setodaNote

入手先

Ghidra

意図せずデバッグモードが有効になってしまうバグへの対処

Windows

設定ファイル（support/launch.bat）の140行にある ＊ を 127.0.0.1 に修正

Linux

設定ファイル（support/launch.sh）の150行にある ＊ を 127.0.0.1 に修正

チュートリアル動画（インストールしてちょっと使うところまで）

GHIDRA Tutorial — Learn How to Use Reverse Engineering Tool - YouTube

https://www.youtube.com/watch?v=xDyLy0zLV7s

使ってみた動画

First Look at Ghidra (NSA Reverse Engineering Tool) - YouTube

https://www.youtube.com/watch?v=285b_DEmvHY

TrickBot を解析してみた記事

PepperMalware Blog: Quick Analysis of a Trickbot Sample with NSA's Ghidra SRE Framework

http://www.peppermalware.com/2019/03/quick-analysis-of-trickbot-sample-with.html

使ってみた人の感想

The good things:

- The decompiler is fucking awesome.
- The decompiler supports anything that you can disassemble.
- Everything is fully integrated.
- Multi-binaries projects with version control.
- Undo!
— Joxean Koret (@matalaz) 2019年3月6日

The bad things:

- Filters in IDA are better & IDA is more stable.
- Shortcuts are different to IDA ones (I'm going to break my ESC).
- Nothing works the way you expect because you're used to other RE tools.
- You need a big or multiple monitors for proper use.
- Java.
— Joxean Koret (@matalaz) 2019年3月6日

reddit での感想・評価

Ghidra, NSA's reverse engineering tool, is now available to the public : programming

https://www.reddit.com/r/programming/comments/axt97a/ghidra_nsas_reverse_engineering_tool_is_now/

TipsをつぶやくTwitterアカウント

Ghidra(@GHIDRA_RE)さん | Twitter

https://twitter.com/GHIDRA_RE

ghidraninja(@ghidraninja)さん | Twitter

https://twitter.com/ghidraninja