3 ms·
A quick overview of what makes IDA cool for those unfamiliar with it: * It has one of the best decompilers available * It supports a ridiculous number of plat
by bitexploder 9y ago
A quick overview of what makes IDA cool for those unfamiliar with it:
* It has one of the best decompilers available
* It supports a ridiculous number of platforms
* I trust its disassembler (especially for mainstream languages) more than almost any other disassembler
* Demangling of Swift names is a nice quality of life improvement, Swift moves fast and is hard to keep up with
* Still the best disassembler and machine code reversing tool out there
If you can't afford IDA, it is very expensive, there are a lot of great alternatives:
* Hopper (mac only). Its disassembler, is not so great, it gets confused and fails to find code in Swift apps pretty often. It is still generally good and with some encouragement you can get it to do a competent job.
* radare2. Works on a lot of more esoteric processors. Great for when working on small firmwares from less common processors. Not so great at big files. Slow. Very powerful regardless. Open source.
* ImmunityDbg still works for Win
* Other tools, just search.
The more time you spend looking at disassembled machine code the more valuable IDA gets. But you really have to do a lot of RCE. Most people first getting into RCE really think they need IDA when they haven't even cracked the docs for their target environment yet or lack fundamental knowledge about how CPUs work, which holds them back far more than a second class disassembler ever has.
- yan 9y agoYou'd be remiss if you don't mention Binary Ninja[1]. A relative newcomer that's already extremely capable, has great scripting support and is under very active development. [1] https://binary.ninja/ https://binary.ninja/
- bitexploder 9y agoForgot about them! Folks are really liking it. Affordable too. I have not had time to play with it yet.
- beltex 9y ago> Hopper (mac only). Hopper supports Linux since V3 :) * https://www.hopperapp.com https://www.hopperapp.com * https://twitter.com/bSr43/status/851832213066973185 https://twitter.com/bSr43/status/851832213066973185
- satysin 9y agoIt isn't as powerful as IDA but x64dbg is a free and open source debugger for Windows and a good goto for hobbyists imho - https://x64dbg.com https://x64dbg.com
- Cerium 9y agox64dbg is great. It has enough features (such as visual charts) to make debugging much easier than on a classic debugger. That said, it makes mistakes and is not nearly as bulletproof as IDA.
- tacoman 9y agoIf you're looking for a gui for radare2, https://github.com/hteso/iaito https://github.com/hteso/iaito has worked well for me so far. Despite the warnings about it being highly unstable, I spent 4 hours in it reversing an arm binary and it worked perfectly fine.
- ktta 9y agoThere's also Capstone, which is open source http://www.capstone-engine.org/ http://www.capstone-engine.org/ https://github.com/aquynh/capstone https://github.com/aquynh/capstone
- AceJohnny2 9y ago> I trust its disassembler (especially for mainstream languages) more than almost any other disassembler Might I suggest Christopher Domas' Black Hat talk "Breaking the x86 ISA", along the way of which he demonstrates the limitations of all disassemblers out there, including IDA's :) Talk: https://youtu.be/KrksBdWcZgQ https://youtu.be/KrksBdWcZgQ Slides: https://www.blackhat.com/docs/us-17/thursday/us-17-Domas-Breaking-The-x86-ISA.pdf https://www.blackhat.com/docs/us-17/thursday/us-17-Domas-Bre... Paper: https://www.blackhat.com/docs/us-17/thursday/us-17-Domas-Breaking-The-x86-Instruction-Set-wp.pdf https://www.blackhat.com/docs/us-17/thursday/us-17-Domas-Bre...
- FraKtus 9y agoHopper on the Mac is very nice an affordable, it did save me several time to understand undocumented features in some plugins...