2

I recently downloaded Ghidra (link) ver 9 on windows.

The decompiler feature is presumable found at

<GHIDRA_HOME>\Ghidra\Features\Decompiler

There is a lib folder containing the Java code. Then there is an os folder containing binaries for 3 different platforms (win, mac and linux) around 2.4 - 2.9 MB each per platform.

My questions

  1. This makes Ghidra not truly portable. If there is a reason to do this, then why not use JNI/JNA instead? Why take the dirty route of launching an executable?

  2. Is the decompiler open source but written in native code? Can you point out the source codes location for such? If its not provided then can we say its truly open source (read backdoors!) If the decompiler's job is just to spit out pseudo-c code from the dissembly, then 2+ MB is an overkill for such a component, assuming a low-level language like C/C++ is used to write it.

2 Answers 2

2
  1. I guess that the debugger part of the IDE needed to be close to the system at some point in order to trigger a ptrace() call or equivalent in other systems. So, these binary libraries are perfectly legitimate to me (there is probably no other way around, I think in my humble opinion).

  2. It will be Open Source with an Apache 2.0 License. But, the code is still being reworked at NSA before being published (at least, this is what they say on their GitHub page).

3

For posterity: the decompiler was open-sourced not too long after the initial release of Ghidra. Its code is here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.