News for hackers. Stuff that matters.
Re:NSA Ghidra software reverse engineering framework by myself248 on Wednesday March 29, 2023 @01:51AM (#35353155)
That's an incredibly useful model for how to approach the problem! And it sounds like exactly the questions I find myself asking about random suspected-malware, which is often precisely your original example -- a burned CD included with some aliexpress hardware.

I'm familiar with 'strings' and I've been playing with 'binwalk' to take apart files, but I'm out of my depth when it comes to loading something up in a debugger or whatever (is ghidra a debugger or what's the difference?) and looking at code. I don't speak C, and everything seems to look like C when it's shown in the examples of these things. How do I know if I'm looking at a sensible decompilation with actual runnable code or just gibberish because I'm trying to interpret a jpeg as an executable?

I don't know if that makes me teachable or beyond help, but I'd be an eager student.

Re:NSA Ghidra software reverse engineering framework by pmoriarty on Wednesday March 29, 2023 @07:09AM (#35355439)
"I don't speak C, and everything seems to look like C when it's shown in the examples of these things."

If you know how to program you could probably already make sense of a lot of C, and for the rest you could try asking an AI to explain it to you.

Re:NSA Ghidra software reverse engineering framework by andai on Wednesday March 29, 2023 @07:13AM (#35355470)
And if you learn a bit of assembly first, C will seem like a high level language again!
Re:NSA Ghidra software reverse engineering framework by doktrin on Wednesday March 29, 2023 @07:16AM (#35355502)
I am not a SME here, but can at least try to clarify a few of these points for you.

> I'm out of my depth when it comes to loading something up in a debugger or whatever (is ghidra a debugger or what's the difference?)

When you hear "debugger", think "breakpoints". It's any tool that lets you do things like set breakpoints and step through code execution. In the C world, that would be tools like GDB and Valgrind. For Java - the IDEs themselves ship with debuggers (Eclipse, Intellij, etc), or jdb. In the frontend world your browser devtools ships with this functionality.

Debuggers can also typically let you view lower level details of a given binary's execution - like machine code for C, bytecode for Java, etc. They won't however decompile binaries or bytecode into the original higher level language.

Ghidra does come bundled with a debugger, but it can also do lots of other stuff (including decompilation).

> I don't know if that makes me teachable or beyond help, but I'd be an eager student.

If you're actually interested in this stuff, it would probably help to get some baseline familiarity with systems programming. Look up the 15-213 course material and exercises and work through it with the help of video lectures and a tutor - sentience agnostic.