I always wondered whether they have a much more capable internal version. And I wonder the same thing for AI labs (they have to do a lot of lobotomy for their models to be ready for public use... but internally, they can just skip this perhaps?)

▲

bjackman 3 hours ago | parent | next [-]

Very likely people who actually work on RE at the NSA also have access to IDA Pro licenses. I don't work in this space, so take it with a pinch of salt, but my understanding is this is a fairly long term strategic initiative to _eventually_ be the best tool.

▲

bri3d 3 hours ago | parent | next [-]

It’s better in some dimensions and not others, and it’s built on a fundamentally different architecture, so of course they use both.

Ghidra excels because it is extremely abstract, so new processors can be added at will and automatically have a decompiler, control flow tracing, mostly working assembler, and emulation.

IDA excels because it has been developed for a gazillion years against patterns found in common binaries and has an extremely fast, ergonomic UI and an awesome debugger.

For UI driven reversing against anything that runs on an OS I generally prefer IDA, for anything below that I’m 50/50 on Ghidra, and for anything where IDA doesn’t have a decompiler, Ghidra wins by default.

For plugin development or automated reversing (even pre LLMs, stuff like pattern matching scripts or little evaluators) Ghidra offers a ton of power since you can basically execute the underlying program using PCode, but the APIs are clunky and until recently you really needed to be using Java.

▲

19h 3 hours ago | parent | prev [-]

Ghidra has a slightly different focus than IDA, so they're definitely not just using Ghidra :-)

▲

sergent_moon 3 hours ago | parent [-]

I have only a very basic understanding of the two tools. Can you give me just some highlights regarding their differences?

	▲	19h 3 hours ago \| parent [-]
		Well, Ghidra's strength is batch processing at scale (which is why P-Code is less accurate than IDA's but still good enough) while allowing a massive amount of modules to execute. That allows huge distributed fleets of Ghidra. IDA has idalib now, and hcli will soon allow batch fleets, but IDA's focus is very much highly accurate analysis (for now), which makes it a lot less scalable performance wise (for now).

▲

jacquesm 3 hours ago | parent | prev | next [-]

Too many people in the know about this stuff I think to keep it hidden for that long. At the same time, we keep finding stuff that that should have held for and it didn't, so maybe you're right.

▲

hn92726819 2 hours ago | parent | prev | next [-]

I doubt it. Ghidra is extremely extensible with their plugin/tool architecture. Public Ghidra includes the extremely helpful decompiler tool, and a few others, but I'm willing to bet that NSA uses regular Ghidra + some way more capable plugins instead of having another Ghidra.

	▲	HelloNurse an hour ago \| parent [-]
		Powerful, "capable" plugins are obvious; NSA cannot stop people from writing them, and they have little reason to restrict their use. I think what NSA is likely to keep confidential are in-house plugins that are so specialized and/or underengineered that their publication would give away confidential information: stolen and illegitimate secrets (e.g. cryptographic private keys from a game console SDK), or exploits that they intend to deny knowledge of and continue milking, or general strategies and methods (e.g. a tool to "customize" UEFI images, with the implication that they have means to install them on a victim's computer).

▲

cactusplant7374 3 hours ago | parent | prev [-]

The gains come from pairing Ghidra with a coding agent. It works amazing well.

	▲	Mattwmaster58 2 hours ago \| parent \| next [-]
		I'll second this. I used opencode + opus 4.6 + ghidra to reverse engineer a seedkey generation algorithm[1] from v850 assembly. I gave it the binary, the known address for the generation function, and a set of known inputs/outputs, and it was able to crack it. [1] https://github.com/Mattwmaster58/ic204
	▲	bibelo 3 hours ago \| parent \| prev [-]
		would you have a tutorial on that?