Why the switch from BAP to Ghidra?

[0xchase]

Hello, I'd be interested to know the details of why cwe_checker switched from BAP to Ghidra as the backend. BAP seems to have the more modern design, and can probably support more sophisticated analyses via the primus system. What initiated this switch? Was it perhaps the additional architectures supported by Ghidra? Or something else?

I'm particularly interested because I'm deciding between these two backends for my own project.

[Enkelmann]

I will try to summarize the arguments leading to my decision. They may not be 100% accurate anymore (due to updates since then), but most of them should still be true.

Advantages of BAP over Ghidra:

• Primus. If you want to use Primus for microexecution-like stuff in your project, go for it! In Ghidra you would have to essentially reinvent the wheel, which is usually not worth the trouble. For the cwe_checker this argument was moot, since our analyses cannot use Primus.
• Ocaml, but only if you like programming in Ocaml.
• The community. If you have any questions about BAP, you can always ask it in their Gitter channel and get a helpful answer within the day.

Advantages of Ghidra over BAP:

• Less bugs. It can be quite annoying if you cannot disassemble a binary due to some BAP bug (although they are rare). Up until now this happened not once to me with Ghidra.
• Especially for larger binaries, Ghidra is way faster than BAP and needs much less RAM.
• Ghidra supports way more architectures than BAP and support is usually better. I have good memories of BAP when looking at x86 or ARM binaries, but support for MIPS was bad. In Ghidra, MIPS works just as well as x86 and ARM and additionally Ghidra supports a lot of the more esoteric architectures that BAP just does not support at all. For the cwe_checker, this was in fact the main reason for the switch.
• Slightly better documentation. In BAP you can always ask in the official Gitter channel, but in Ghidra you can find the answers in the documentation most of the time. At least after a while. At the beginning, when you do not yet know where to look for what, it is sometimes difficult to find anything. Google helps in this case.
• The Ghidra community is larger and the chances are higher with Ghidra that it is still around 10 years from now. If that is a concern for your project.

[dgutson]

What about BAP supporting Ghidra now? BinaryAnalysisPlatform/bap#1326
Would you go back to BAP?

[Enkelmann]

No. We used BAP as a disassembler, not as an analysis framework. And using BAP on top of Ghidra just to get the disassembly output of Ghidra makes no sense. Even if I wanted to write new analyses that use BAP Primus I would rather do it in a new, separate tool and then combine the results of it with those of the cwe_checker.
And the switch from BAP to Ghidra also taught me that I very strongly prefer programming in Rust over having to use Ocaml.

[XVilka]

@Enkelmann it would be nice to read a short blog post or something like that about your experience of OCaml vs Rust. I think, it might be beneficial for both languages.

[Enkelmann]

@XVilka That would be comparing apples with oranges, although other people already did this comparison as far as I can remember. My time with Ocaml was also a bit too short to really understand the language and do it justice. So I will try to stay out of the programming language discussions here. ;-)