NSA's Ghidra decompiler

[Shelwien]

https://www.rsaconference.com/writab...ring-tool_.pdf
https://github.com/NationalSecurityAgency/ghidra https://github.com/NationalSecurityAgency/ghidra/issue
https://www.ghidra-sre.org/ (blocked for russian ips)
https://mega.nz/#!DQ5mkaKa!RrnNF_qOo...TnWA3YeLASDyYY

https://twitter.com/GHIDRA_RE
http://ghidra.re/ghidra_docs/api/
http://ghidra.re/online-courses/

[Piotr Tarsa]

How it compares to IDA from HexRays?

[Shelwien]

There're some useful features that ida lacks, like working with multiple exe/dll files at once.
And the decompiler is not locked to a single platform.

In any case, Ghidra is better than previous attempts, like radare2 or 3rd-party decompiler plugins for Ida.
And its open-source, so there's potential.
But atm Ida is more convenient.

http://0xeb.net/2019/03/ghidra-a-quick-overview/
https://blog.fadyothman.com/an-hour-...-and-the-ugly/
https://news.ycombinator.com/item?id=19315273

[kassane]

https://github.com/ghidraninja/ghidra_scripts