rchtsang / docker-ghidrathon

a docker container for Ghidrathon

docker-ghidra-local

Dependencies

• eclipse-temurin

Getting Started

Client

On macOS

1. Install XQuartz brew install xquartz
2. Install socat brew install socat
3. open -a XQuartz and make sure you "Allow connections from network clients" (in XQuartz > Preferences... > Security)
4. Now add the IP using Xhost with: xhost + 127.0.0.1 or xhost + $(ipconfig getifaddr en0)
5. Start socat socat TCP-LISTEN:6000,reuseaddr,fork UNIX-CLIENT:\"$DISPLAY\"
6. Start up Ghidra

$ make all
$ make run

Known Issues

Black Background Issue

If the Ghidra opens in XQuartz with a black background, try closing XQuartz, executing defaults write org.xquartz.X11 enable_render_extension 0 in terminal. See issue #31 on XQuartz GitHub repo for more information.

Socat "Address already in use"

Per this nice blog post, OSX doesn't close byte streams when they stop responding, so ports will stay open. They need to be killed forcibly like so:

$ lsof -n -i | grep 6000
X11.bin   10540 me  12u  IPv6 0xcddXX  0t0  TCP *:6000 (LISTEN)
X11.bin   10540 me  13u  IPv4 0xcddXX  0t0  TCP *:6000 (LISTEN)
$ kill -9 10540

Credits

• NSA Research Directorate https://github.com/NationalSecurityAgency/ghidra
• blacktop/docker-ghidra
• mandiant/Ghidrathon

License

Apache License (Version 2.0)