initial ghidra-9.0 #56959
initial ghidra-9.0 #56959
Conversation
|
I wonder if we should wait for its source to be public? |
|
@deliciouslytyped sent me this example using autoPatchelfHook: https://bpaste.net/show/1a7ad6fa151e |
|
I think we could merge this earlier given that all binaries are unstripped and the whole security community have throw their attention on this tool. |
|
This is just something I threw together but it works. {pkgs ? import (
builtins.fetchGit { #need jdk11, just the latest nixpkgs at the time
url = https://github.com/nixos/nixpkgs/;
rev = "5d3fd3674a66c5b1ada63e2eace140519849c967";
}
) {}}:
with pkgs;
stdenv.mkDerivation {
name = "ghidra";
version = "";
src = fetchurl {
url = "https://ghidra-sre.org/ghidra_9.0_PUBLIC_20190228.zip";
sha256 = "1cnngzy1rpf9bmglff7zarm3lzybggl2zca826xwvpmr4j8d4r9v";
};
nativeBuildInputs = [ makeWrapper autoPatchelfHook unzip ];
propagatedBuildInputs = [ pkgs.jdk11 stdenv.cc.cc.lib linux-pam ];
installPhase = ''
mkdir -p $out
cp -r ./ $out
wrapProgram "$out"/ghidraRun --prefix PATH : "${jdk}/bin/"
'';
}I ran the coreutils cat binary through the automatic analysis and everything seemed to work with autoPatchelfHook, before that the decompiler was complaining (which is fine given that its an ELF). |
|
+1
… On Mar 13, 2019, at 09:37, deliciouslytyped ***@***.***> wrote:
@Mic92 I think that link will expire so here's the snippet for posterity ```nix
{pkgs ? import (
builtins.fetchGit { #need jdk11, just the latest nixpkgs at the time
url = https://github.com/nixos/nixpkgs/;
rev = "5d3fd3674a66c5b1ada63e2eace140519849c967";
}
) {}}:
with pkgs;
stdenv.mkDerivation {
name = "ghidra";
version = "";
src = fetchurl {
url = "https://ghidra-sre.org/ghidra_9.0_PUBLIC_20190228.zip";
sha256 = "1cnngzy1rpf9bmglff7zarm3lzybggl2zca826xwvpmr4j8d4r9v";
};
nativeBuildInputs = [ makeWrapper autoPatchelfHook unzip ];
propagatedBuildInputs = [ pkgs.jdk11 stdenv.cc.cc.lib linux-pam ];
installPhase = ''
mkdir -p $out
cp -r ./ $out
wrapProgram "$out"/ghidraRun --prefix PATH : "${jdk}/bin/"
'';
}
I ran the coreutils cat binary through the automatic analysis and everything seemed to work with autoPatchelfHook, before that the decompiler was complaining (which is fine given that its an ELF).
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or mute the thread.
|
|
I would still rather wait for a source release or name it |
| description = "A software reverse engineering (SRE) suite of tools developed by NSA's Research Directorate in support of the Cybersecurity mission"; | ||
| platforms = [ "x86_64-linux" ]; | ||
| license = licenses.asl20; | ||
| maintainers = [ maintainers.ck3d ]; |
|
Or ghidra-bin-nsa even? ;) |
|
Maybe we want to disable the RCE: https://twitter.com/hackerfantastic/status/1103087869063704576 |
|
I really can't help but start the bikeshed that that's not an RCE, but sure I don't see why we can't make it default to not exposing it over the regular network, but people should ideally have a firewall running anyway? (edit: wording) |
|
edit/clarification: this is just the java stuff I think of course...that by itself isn`t going to get anyone a build. |
|
As far as I've heard the java source is given but the native code (decompiler) and build system is not. |
|
Yeah that seems correct. |
|
Thanks for the comments, I changed attribute name to ghidra-bin, added homepage and using autoPatchelfHook. |
|
I think the proper home page is ghidra-sre.org ? |
I tested basic usage of tool CodeBrowser. The tool VersionTracking raises an error.
|
Thanks, I updated homepage |
|
So, I haven't looked at this part much, so I don't know how it will interact with nix-y stuff, there's plugin support for eclipse, for the scripting stuff (see the scripting tutorial in the docs folder), is there anything that we should do to get that to work? |
|
The ghidraDev plugin works with a sufficiently new eclipse (4.10 I think?), which can be retrieved from a sufficiently new nixpkgs. There is a gdk problem currently causing a lot of segfaults, which is worked around by the unset.
|
|
Ghidra source appears to have been properly released. |
|
Which is to say, I don't think I have the spare cycles to work on packaging that now so I'm sticking to the binaries for the moment. @ck3d ? |
|
I seem to have successfully made a working plugin system, I should be filing a PR in the coming days. |
I tested basic usage of tool CodeBrowser.
The tool VersionTracking raises an error.
Motivation for this change
Things done
sandboxinnix.confon non-NixOS)nix-shell -p nox --run "nox-review wip"./result/bin/)nix path-info -Sbefore and after)