8 ms·
Binary Ninja – A new kind of reversing platform
- empressplay 10y ago$399? ouch.
- iamcreasy 10y ago$99 for Non-commercial use.
- moyix 10y agoYou can't buy that version yet, though.
- psifertex 10y agoShould be out in a week or two. Most of the code changes are done, we're just taking a break between DEF CON / recuperating from a lot of long nights getting the first release out. It should only take a day or two once we get working again.
- moyix 10y agoCool! Looking forward to it.
- rincebrain 10y agoWhen it says the non-commercial version lacks "High-Performance Multi-Threading", does that mean all decompiles are going to be single-threaded, or every kind of worker in the entire platform, or ? I (mostly) understand the rationale of not wanting to make it easy to bulk-decompile binaries for supposedly "non-commercial" users, but I'd be wary of seeing how much personal usability suffers before signing the dotted line.
- ej_campbell 10y ago> non-commercial version lacks "High-Performance Multi-Threading" At least until someone uses the tool to remove these limitations from Binary Ninja itself.
- seanp2k2 10y agoAssuming they ship the version with it enabled in the cheaper versions. It's always been hilarious to me that the software which is used to remove license checks and registration schemes has those things. IMO give it away and sell commercial licenses as support / etc. seems like given all the trouble trying to implement DRM and checks for the people who are most skilled at breaking those things is kinda pointless for the returns you get. Also, your product would likely generate a lot of good will and user adoption, since seriously a lot of people who want this stuff aren't even 18 yet and couldn't afford it anyway. Just give it to them, let them grow up learning how to use it, then sell it to their employer some day. Adobe and MSFT do this at the university level with great success.
- deleted 10y ago[deleted]
- loeg 10y agoHow does one use a binary reverser commercially?
- bathory 10y agoanti-virus development, just to name one...
- SXX 10y agoFor reverse engineering of protocols and formats for legacy software that was developed decades ago with no source code available. This is totally legal in many cases since there tons of companies that lose source for their own software.
- baby 10y agosecurity audit
- moyix 10y agoTheir main competitor is IDA Pro, which goes for $1129 for its "standard" edition. There is a version of IDA Pro that's only $589, but it supports only 32-bit code.
- SXX 10y agoCost of IDA is nothing. Actual problem is that you can't really buy it at all if you're not well-known expert or AV company employee. Plenty of people would be happy to buy it, but they can't.
- dsacco 10y ago>>Actual problem is that you can't really buy it at all if you're not well-known expert or AV company employee. Plenty of people would be happy to buy it, but they can't. This is patently false. You can buy all HexRays products online.[1] I've done it myself. I'm confused as to why you're claiming this. [1]: https://www.hex-rays.com/cgi-bin/quote.cgi https://www.hex-rays.com/cgi-bin/quote.cgi
- SXX 10y agoLucky you then. They simply not selling it to someone who reverse engineer old games for instance. Or anyone who decide to not send them scan of their passport and provide any other weird proof of identify. PS: Just in case not everyone live in first world countries or being employee of well known companies. While it's possible to buy almost any software just fine IDA have extremely weird policies.
- Darmani 10y agoHi, I bought a copy of IDA when I was 18 expressly for the purpose of reverse-engineering old games. To be fair, I used my university E-mail, and they thought they were licensing it to my university until I tried to transfer it to my personal E-mail upon graduating....
- seanp2k2 10y ago
- qwertyuiop924 10y agoOkay. But aside from the really nice UX/UI, what does this do that Radare2 doesn't? No, I'm not trying to be snarky, I genuinely don't know.
- eugeneionesco 10y agoIt's actually usable.
- qwertyuiop924 10y agoGood answer. Okay, what does it do that Radare doesn't?
- StavrosK 10y agoI don't know what Radare does, but after I read your comment I installed Radare2 (because binja didn't let me save my file). I didn't get anywhere because Radare2 looks like it has a super steep learning curve, whereas with binja I just right-clicked the jump that looked like it'd do what I want and selected "Patch -> Never jump". I'm not sure why you're dismissing usability, but it's a very big feature in a tool, one of the most important ones.
- tedunangst 10y ago"Actually useable" is a little terse, and not very informative if you've already figured out radare2.
- qwertyuiop924 10y agoIt's important, but the market share of Vim is roughly inverse porportional to how important it is. Anyways, yeah, Radare isn't super usable. I'd guess I only understand 10% of it. And Radare2 is in active development, and wasn't totally ready for prime time, which is what I thought the usability comment was about.
- cmrx64 10y agoPoking around the demo this feels really polished, which is a welcome change from most tools in this space, as they tend to be awkward at best. I look forward to future features.
- psifertex 10y agoOne of the developers here, been planning on doing some coordinated posts about it, just been super busy at DEF CON this week. Happy to answer questions though. If you do happen to be at DEF CON we're actually having a meet up this evening: https://twitter.com/vector_35/status/762050462195396608 https://twitter.com/vector_35/status/762050462195396608
- baby 10y agodoes the binja team at the CTF have any relation with your tool?
- psifertex 10y agoNope, just an unfortunate name collision. We've been using binary ninja as the name of the tool for many years now, but it was a private tool that nobody knew we had it for the first few years for CTFs (this is the python version we open sourced before we started rewriting it) so they just happened to start using a similar team name some time after that. The domain name time stamps should show that if it matters, though I don't think it really does.
- StavrosK 10y agoDoes "no saving of databases" include "no saving of binaries"? I patched a binary in the view to test but can't save it.
- strictfp 10y agoMaybe patch binary ninja to allow it? ;)
- StavrosK 10y agoI can't patch stuff unless Binary Ninja works, and I can't get it to work unless I can patch stuff! :( I'm afraid I'm not knowledgeable enough to do it by hand. I can make a jump always fail by setting the instructions to NOPs, but I can't recalculate offsets and things required to turn a jne into a jmp...
- psifertex 10y agoNot right now -- we might change that in the future though.
- borski 10y agoBeen using this for quite some time - psifertex and crew have really done an incredible job in a pretty short period of time. Highly recommend checking it out, especially if you're sick of the shittiness of IDA. Only thing it's missing is some solid decompilers.
- pedalpete 10y agoSorry to seem a bit daft, but I'm looking for a definition of 'reversing platform' and I'm not getting much. What is this for and what does it do? Who would use it? On the other hand, Binary Ninja is the first result, so in some ways, you've got the SEO right :)
- GrumpyYoungMan 10y ago"reversing" in this sense is shorthand for "reverse engineering" or the analysis and reconstruction of the code for a executable binary at the assembly language level without the benefit of the original source code or debug symbols. The most common legitimate use is for analyzing malware and viruses. The best known product in this field is IDA Pro. (It would have been nice for the site to provide a comparison between the two, since such a comparison is inevitable anyway.)
- eugenekolo2 10y agoNice looking, but it's just IDA w/ Undo, and less features. There has to be a shift in use case design more than making it prettier.
- eugeneionesco 10y agoGive them a break man, it's the first release...
- eugenekolo2 10y agoDon't take it the wrong way. It looks like a nice start. I just wish for better reversing tooling, and am merely giving a critique that if this was to replace IDA for me, it'd have to provide something that IDA does not.
- psifertex 10y agoThere's plenty of things IDA does that we don't do, but the list of things we do they don't is growing. To start with, we have undo, which is a simple feature but it underlies some design decisions that are going to show up in other features in the near future as well. Because we have the ability to separate user interactions from our internal analysis we can not only undo, but also better support collaborative editing and upgrading of older saved databases. In terms of features we already have, we have a static data flow implementation that allows you to query register values at addresses which greatly simplifies a lot of analysis plugins. Here's an example: http://arm.ninja/2016/03/08/intro-to-binary-ninja-api/ http://arm.ninja/2016/03/08/intro-to-binary-ninja-api/ (The domain name is a coincidence, Q was just a beta tester, not officially affiliated with us) Notice how much more robust and simpler the final implementation of that plugin using our data flow is: https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/arm-syscall.py https://github.com/Vector35/binaryninja-api/blob/dev/python/...
- tropo 10y agoI see that you have faithfully replicated at least some of IDA's insane graph view glitches. Do you have the one where a line goes to one side by more than a screen's width, goes down a tad, and then goes back sideways to nearly where it started?
- ComodoHacker 10y agoIs the GUI Electron-based?
- makerofthings 10y agoSeems to be QT.
- psifertex 10y agoYup! QT. Electron might be fast enough for graph view, I don't know, we'd have to test it. The good news is that the core is completely separable from the interface so we could re-architect the GUI if needed.
- pmorici 10y agoI see the demo is 32-bit x86 only but what is the full version does it do ARM as well as x86? edit: never mind found it in the FAQ, x86, ARM, MIPS, 6502
- psifertex 10y agoPowerPC is close to being done (also, the armv8 support is quite solid but the v7 needs work and thumb isn't integrated but is mostly complete). A few of our early users are also working on some other architecture plugins so I think MSP430 or AVR might exist soon.
- fileoffset 10y agoI just installed this and had a quick play. Basic feature support: disassembly, renaming, code graph, strings, function/imports list, x-ref, hex editor, undo Some questions: - Why do you copy IDA and have a 32bit only demo? I can't actually evaluate this properly as everything I care about reversing these days is x64 - Doesn't seem to be any python/API plugin support? I hope you are thinking about how you will support plugins from the start, and not tack it on later (usually this results in hell for dev and users - see IDA's shitty plugin architecture) - In the non-callgraph disassembly mode, it's difficult to follow. I think there is an overload of colour/styles TLDR; Nice interface, clean gui, but lacking many features of IDA. The features it does have seem to work well though. I will be keeping an eye on this in future.