The NSA open-sourced its reverse engineering toolkit, and it decompiles binaries across tons of CPU architectures for free. 🔗 github.com/NationalSecurityAgency/ghidra
Credits: github.com/NationalSecurityAgency/ghidra
#ghidra #java #reverseengineering
Credits: github.com/NationalSecurityAgency/ghidra
#ghidra #java #reverseengineering
November 2, 2026 at 6:30 PM
The NSA open-sourced its reverse engineering toolkit, and it decompiles binaries across tons of CPU architectures for free. 🔗 github.com/NationalSecurityAgency/ghidra
Credits: github.com/NationalSecurityAgency/ghidra
#ghidra #java #reverseengineering
Credits: github.com/NationalSecurityAgency/ghidra
#ghidra #java #reverseengineering
🔍 Trust nothing. Verify everything!
A big thank you to Ivan Pesenti for showing us how to audit third-party Go binaries without source code, using eBPF tracing, static analysis, and Ghidra.
A practical look at software security! 🔐 #GoLab2026
A big thank you to Ivan Pesenti for showing us how to audit third-party Go binaries without source code, using eBPF tracing, static analysis, and Ghidra.
A practical look at software security! 🔐 #GoLab2026
November 2, 2026 at 3:31 PM
🔍 Trust nothing. Verify everything!
A big thank you to Ivan Pesenti for showing us how to audit third-party Go binaries without source code, using eBPF tracing, static analysis, and Ghidra.
A practical look at software security! 🔐 #GoLab2026
A big thank you to Ivan Pesenti for showing us how to audit third-party Go binaries without source code, using eBPF tracing, static analysis, and Ghidra.
A practical look at software security! 🔐 #GoLab2026
It's a time consuming process that primarily consisted of copy-pasting chunks of code from Ghidra and then trying to trick a twenty year old compiler intro reproducing the exact same bytes. It's not exactly honourable work.
November 2, 2026 at 1:35 PM
It's a time consuming process that primarily consisted of copy-pasting chunks of code from Ghidra and then trying to trick a twenty year old compiler intro reproducing the exact same bytes. It's not exactly honourable work.
Vanilla+ 0.0.7 — Release Notes: R77 → R83
Shared Stash 2 → 10 pages, Two 720p UI fixes filed and confirmed (R81 = issue #21, R83 = issue #23).
github.com/VTSTech/D2Lo...
Shared Stash 2 → 10 pages, Two 720p UI fixes filed and confirmed (R81 = issue #21, R83 = issue #23).
github.com/VTSTech/D2Lo...
Release D2LoD Vanilla+0.0.7-R83 · VTSTech/D2LoD-libslang-vk
Vanilla+ 0.0.7 — Release Notes: R77 → R83
Seven rounds, 2026-11-01 → 2026-11-02. One stash-tab polish round (R77), three upstream Ghidra-recovery syncs with zero feature changes (R78–R80, upstream ...
github.com
November 2, 2026 at 4:54 AM
Vanilla+ 0.0.7 — Release Notes: R77 → R83
Shared Stash 2 → 10 pages, Two 720p UI fixes filed and confirmed (R81 = issue #21, R83 = issue #23).
github.com/VTSTech/D2Lo...
Shared Stash 2 → 10 pages, Two 720p UI fixes filed and confirmed (R81 = issue #21, R83 = issue #23).
github.com/VTSTech/D2Lo...
does anyone know why
* `killall` failed to locate the ghidra process running on my machine
* `pkill` found it and supposedly delivered the signal, but ghidra remained open
* `procs` easily found the process, and when `kill` sent a SIGTERM ghidra closed immediately
* `killall` failed to locate the ghidra process running on my machine
* `pkill` found it and supposedly delivered the signal, but ghidra remained open
* `procs` easily found the process, and when `kill` sent a SIGTERM ghidra closed immediately
![> killall ghidra
ghidra: no process found
> pkill ghidra
> pkill -9 ghidra
> procs ghidra
[output showing a running java process]
> kill 182820
> procs ghidra
[no processes found]](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:a3yasbjknf5tn7asyhivu3jn/bafkreietwjx5kviovf77wl5m3snkcrgzij6ux33tqh5ay32zlttata2r2q)
November 1, 2026 at 9:27 PM
does anyone know why
* `killall` failed to locate the ghidra process running on my machine
* `pkill` found it and supposedly delivered the signal, but ghidra remained open
* `procs` easily found the process, and when `kill` sent a SIGTERM ghidra closed immediately
* `killall` failed to locate the ghidra process running on my machine
* `pkill` found it and supposedly delivered the signal, but ghidra remained open
* `procs` easily found the process, and when `kill` sent a SIGTERM ghidra closed immediately
#D2LoD Vanilla+0.0.7-R77 - Now with 2 shared stash pages. Another 3 rounds of #Ghidra Recovery merged from upstream. 40% of Retail #Diablo2 1.14d reverse engineered. github.com/VTSTech/D2Lo...
November 1, 2026 at 8:35 PM
#D2LoD Vanilla+0.0.7-R77 - Now with 2 shared stash pages. Another 3 rounds of #Ghidra Recovery merged from upstream. 40% of Retail #Diablo2 1.14d reverse engineered. github.com/VTSTech/D2Lo...
I haven't looked at REA! this is a bespoke harness, continually improved by Claude, that uses a scheduler to drive Ghidra and Pi w/ custom tools to maximise knowledge-sharing and throughput
claudeslop readme section, will revise this once the final shape's in place (alt-text cont'd in second image)
claudeslop readme section, will revise this once the final shape's in place (alt-text cont'd in second image)
November 1, 2026 at 6:43 PM
I haven't looked at REA! this is a bespoke harness, continually improved by Claude, that uses a scheduler to drive Ghidra and Pi w/ custom tools to maximise knowledge-sharing and throughput
claudeslop readme section, will revise this once the final shape's in place (alt-text cont'd in second image)
claudeslop readme section, will revise this once the final shape's in place (alt-text cont'd in second image)
Reading assembly is a dying art. Between decompilers like Ghidra and AI that can rewrite binary into C, are you actually looking at opcodes anymore, or are you just auditing high-level abstractions? What's your workflow when the symbols are stripped? #ReverseEngineering #Infosec
October 31, 2026 at 11:00 PM
Reading assembly is a dying art. Between decompilers like Ghidra and AI that can rewrite binary into C, are you actually looking at opcodes anymore, or are you just auditing high-level abstractions? What's your workflow when the symbols are stripped? #ReverseEngineering #Infosec
Because i'm all for pissing off spoiled brat rich tech bros... 😈
Another tip, there's tons of how to, beginner lessons and such for how to start into reverse engineering on YouTube. There's also a lot of info on Reddit as well as people who can point out where to start based on your skill level.
Another tip, there's tons of how to, beginner lessons and such for how to start into reverse engineering on YouTube. There's also a lot of info on Reddit as well as people who can point out where to start based on your skill level.
October 31, 2026 at 10:59 PM
Because i'm all for pissing off spoiled brat rich tech bros... 😈
Another tip, there's tons of how to, beginner lessons and such for how to start into reverse engineering on YouTube. There's also a lot of info on Reddit as well as people who can point out where to start based on your skill level.
Another tip, there's tons of how to, beginner lessons and such for how to start into reverse engineering on YouTube. There's also a lot of info on Reddit as well as people who can point out where to start based on your skill level.
I told it where the original code lived on my hard drive, as an assurance that it was actually my own project, but also not to look at it because that would be cheating.
After installing Ghidra and starting to do some work, it told me it refused to continue.
After installing Ghidra and starting to do some work, it told me it refused to continue.
October 31, 2026 at 9:33 AM
I told it where the original code lived on my hard drive, as an assurance that it was actually my own project, but also not to look at it because that would be cheating.
After installing Ghidra and starting to do some work, it told me it refused to continue.
After installing Ghidra and starting to do some work, it told me it refused to continue.
REA, the open-source tool that lets coding agents reverse-engineer apps, hit ~355k GitHub stars. We ran it.
No Ghidra, no functions. A 3-file folder produced 10MB+ of output, too big for the agent.
Rarely wrong. Often silent.
#PRISMAGENDA #InfoSec
prismagenda.net/blog/2026-10...
No Ghidra, no functions. A 3-file folder produced 10MB+ of output, too big for the agent.
Rarely wrong. Often silent.
#PRISMAGENDA #InfoSec
prismagenda.net/blog/2026-10...
REA 리버스 엔지니어링 오픈소스, 직접 돌려 본 성능과 한계
깃허브 35만 스타 REA를 직접 돌려 봤다. 디컴파일러가 아니라 에이전트용 배선이고, 틀리기보다 빠뜨리는 도구였다.
prismagenda.net
October 31, 2026 at 12:22 AM
REA, the open-source tool that lets coding agents reverse-engineer apps, hit ~355k GitHub stars. We ran it.
No Ghidra, no functions. A 3-file folder produced 10MB+ of output, too big for the agent.
Rarely wrong. Often silent.
#PRISMAGENDA #InfoSec
prismagenda.net/blog/2026-10...
No Ghidra, no functions. A 3-file folder produced 10MB+ of output, too big for the agent.
Rarely wrong. Often silent.
#PRISMAGENDA #InfoSec
prismagenda.net/blog/2026-10...
A big star count is a reason to investigate, not a verdict.
Sky explains REA’s role alongside Ghidra or IDA. What would you want to test?
30 Oct figures. Early chart history is estimated; projected growth is conditional. AI presenter/voice.
repoquarry.dev/projects/rea
Sky explains REA’s role alongside Ghidra or IDA. What would you want to test?
30 Oct figures. Early chart history is estimated; projected growth is conditional. AI presenter/voice.
repoquarry.dev/projects/rea
October 30, 2026 at 6:45 PM
A big star count is a reason to investigate, not a verdict.
Sky explains REA’s role alongside Ghidra or IDA. What would you want to test?
30 Oct figures. Early chart history is estimated; projected growth is conditional. AI presenter/voice.
repoquarry.dev/projects/rea
Sky explains REA’s role alongside Ghidra or IDA. What would you want to test?
30 Oct figures. Early chart history is estimated; projected growth is conditional. AI presenter/voice.
repoquarry.dev/projects/rea
man its so fucking hard to get excited for recomps these days
October 30, 2026 at 2:33 PM
man its so fucking hard to get excited for recomps these days
Deploying local Ghidra Server for persistent malware analysis & Claude's zero-click flaw in Mul. 🔬💻 #CyberSeguridad https://fefd.link/jL95M
October 30, 2026 at 9:10 AM
Deploying local Ghidra Server for persistent malware analysis & Claude's zero-click flaw in Mul. 🔬💻 #CyberSeguridad https://fefd.link/jL95M
What's your go-to strategy for bypassing obfuscated binaries when you can't get a clean import in IDA or Ghidra? You taking the time to write a custom loader or just brute forcing it with tedious manual patching? #ReverseEngineering #MalwareAnalysis
October 30, 2026 at 7:00 AM
What's your go-to strategy for bypassing obfuscated binaries when you can't get a clean import in IDA or Ghidra? You taking the time to write a custom loader or just brute forcing it with tedious manual patching? #ReverseEngineering #MalwareAnalysis
Europe sovereign and Ghidra spotted in the very same Mistral Large 4 anouncement website. Considering Radare2 is European and performs 4 times better than Ghidra in general cybersec challenges thats feels very wrong to me
October 30, 2026 at 5:14 AM
Europe sovereign and Ghidra spotted in the very same Mistral Large 4 anouncement website. Considering Radare2 is European and performs 4 times better than Ghidra in general cybersec challenges thats feels very wrong to me
Deploying a Local Ghidra Server for Your Malware Analysis Lab, (Thu, Oct 29th)
This article overstates the practical security benefit of using a local Ghidra server, especially when discussing data confidentiality. While versioning is useful, relying on an internal…
via SANS Internet Storm Center
This article overstates the practical security benefit of using a local Ghidra server, especially when discussing data confidentiality. While versioning is useful, relying on an internal…
via SANS Internet Storm Center
huntaegis.com
October 30, 2026 at 4:19 AM
Deploying a Local Ghidra Server for Your Malware Analysis Lab, (Thu, Oct 29th)
This article overstates the practical security benefit of using a local Ghidra server, especially when discussing data confidentiality. While versioning is useful, relying on an internal…
via SANS Internet Storm Center
This article overstates the practical security benefit of using a local Ghidra server, especially when discussing data confidentiality. While versioning is useful, relying on an internal…
via SANS Internet Storm Center
Deploying a Local Ghidra Server for Your Malware Analysis Lab, (Thu, Oct 29th)
Building your malware analysis lab is a key point before playing with malware. Today, thanks to virtualization, it&#;x26;#;39;s convenient to play with snapshots in your lab. Start a new investigation …
#hackernews #news
Building your malware analysis lab is a key point before playing with malware. Today, thanks to virtualization, it&#;x26;#;39;s convenient to play with snapshots in your lab. Start a new investigation …
#hackernews #news
Deploying a Local Ghidra Server for Your Malware Analysis Lab, (Thu, Oct 29th)
Building your malware analysis lab is a key point before playing with malware. Today, thanks to virtualization, it&#;x26;#;39;s convenient to play with snapshots in your lab. Start a new investigation from a clean snapshot and take some more when you reached a critical step. But, if you need to revert to a previous snapshot, all changes applied to the VM are... lost! Therefore, it&#;x26;#;39;s important to store important data outside the VM.
isc.sans.edu
October 30, 2026 at 3:59 AM
Deploying a Local Ghidra Server for Your Malware Analysis Lab, (Thu, Oct 29th)
Building your malware analysis lab is a key point before playing with malware. Today, thanks to virtualization, it&#;x26;#;39;s convenient to play with snapshots in your lab. Start a new investigation …
#hackernews #news
Building your malware analysis lab is a key point before playing with malware. Today, thanks to virtualization, it&#;x26;#;39;s convenient to play with snapshots in your lab. Start a new investigation …
#hackernews #news
SANS Stormcast Friday, October 30th, 2026: Local Ghidra Server for Malware Analysis Labs; Claude Finds Linux Kernel Multipath TCP RCE (CVE-2026-98432); Hugging Face Cryptomining Malware Campaign
https://isc.sans.edu/podcastdetail/10158
https://isc.sans.edu/podcastdetail/10158
October 30, 2026 at 3:31 AM
SANS Stormcast Friday, October 30th, 2026: Local Ghidra Server for Malware Analysis Labs; Claude Finds Linux Kernel Multipath TCP RCE (CVE-2026-98432); Hugging Face Cryptomining Malware Campaign
https://isc.sans.edu/podcastdetail/10158
https://isc.sans.edu/podcastdetail/10158
mcp-reverse — MCP server exposing 180+ reverse-engineering tools that aggregate Ghidra, IDA, x64dbg, Frida and 56 other backends with native binary parsers and a 4,200-skill knowledge base. https://ktp.sh/V3dINwDNfb
October 29, 2026 at 10:38 PM
mcp-reverse — MCP server exposing 180+ reverse-engineering tools that aggregate Ghidra, IDA, x64dbg, Frida and 56 other backends with native binary parsers and a 4,200-skill knowledge base. https://ktp.sh/V3dINwDNfb
Ghidra turns compiled machine code back into readable C, and the NSA gave it away in 2019. Hex-Rays still charges $8,599 a year for the plan that bundles every decompiler.
https://botmonster.com/coding/ghidra-reverse-engineering-decompiler-guide/?utm_source=bluesky&utm_medium=social
https://botmonster.com/coding/ghidra-reverse-engineering-decompiler-guide/?utm_source=bluesky&utm_medium=social
October 29, 2026 at 8:57 PM
Ghidra turns compiled machine code back into readable C, and the NSA gave it away in 2019. Hex-Rays still charges $8,599 a year for the plan that bundles every decompiler.
https://botmonster.com/coding/ghidra-reverse-engineering-decompiler-guide/?utm_source=bluesky&utm_medium=social
https://botmonster.com/coding/ghidra-reverse-engineering-decompiler-guide/?utm_source=bluesky&utm_medium=social
Deploying a Local Ghidra Server for Your Malware Analysis Lab, (Thu, Oct 29th)
isc.sans.edu/diary/rss/33...
#Cybersecurity #ThreatIntel #Vulnerability
isc.sans.edu/diary/rss/33...
#Cybersecurity #ThreatIntel #Vulnerability
Deploying a Local Ghidra Server for Your Malware Analysis Lab
Deploying a Local Ghidra Server for Your Malware Analysis Lab, Author: Xavier Mertens
isc.sans.edu
October 29, 2026 at 3:30 PM
Deploying a Local Ghidra Server for Your Malware Analysis Lab, (Thu, Oct 29th)
isc.sans.edu/diary/rss/33...
#Cybersecurity #ThreatIntel #Vulnerability
isc.sans.edu/diary/rss/33...
#Cybersecurity #ThreatIntel #Vulnerability
Does anyone here know how I could possibly decompile a kernelcache of iOS 2.1.1 (armv6) so that I have access to the linked drivers as well, using Ghidra?
October 29, 2026 at 12:04 PM
Does anyone here know how I could possibly decompile a kernelcache of iOS 2.1.1 (armv6) so that I have access to the linked drivers as well, using Ghidra?