5 ms·

I've been watching the ecosystem of radare2 GUIs for a while now. I've loved IDA for its long-standing support of numerous architectures, as well as its built-i

I've been watching the ecosystem of radare2 GUIs for a while now. I've loved IDA for its long-standing support of numerous architectures, as well as its built-in interpreter for running Python/IDC scripts with ease, however the price is nearly inhibitive for the average student or weekend hacker. IMO, the one major reason that radare isn't as widely adopted in the RE industry is simply because of a lack of GUIs that aren't either web-based or half-baked and partially broken. In many ways, the radare2 plugin architecture is far superior to IDAs, and I hope this project can start to bridge the gap between functionality and ease-of-use. On an entirely separate note, I'd love to see a port of this for Android :)

colechristensen 8y ago
I looked into buying IDA Pro a while back and the experience was like buying enterprise software in 1997. There's not much of a reason for me to have it but it'd be a fun thing to have and toy with in spare time but I'm not really willing to pay an insane subscription price on a sketchy website.
- rocky12 8y ago
  Sure, but it's not really the type of tool you play with during the weekends. It's high powered and the industry standard. I, and many of my colleagues, would gladly play 4 or 5 times the price for IDA and Hex Rays. Though, any decent security company will purchase a subscription for it's employees.
  - colechristensen 8y ago
    >it's not really the type of tool you play with during the weekends I am not so sure I agree. I can take another example, CAD software. There are high powered industry standard softwares which I would love to use on weekends and maybe even use in side projects for profit, but there's no way I can pay $2k/year and justify that. A $2k permanent license? Sure, it's a stretch but I'd probably go for it. 180/month though, whatever I'm doing would have to be really serious before I could justify that. And I won't ever start at that price so the deal is dead. There's a parallel in 3d printing. Not so long ago 3d printers were insanely expensive and only accessible to professionals. Now consumer grade machines are starting to replace machines that cost 10-100x more. It's a frustrating thing about the economy where power tools that could enable a lot of people to do a lot of things are priced so that only a few people who can pay a lot can have access to them. I get that the people making them need to make a livelihood, but the frustration remains.
    - slobotron 8y ago
      For free CAD, checkout OnShape if you don't mind all your drawings to be public. https://www.onshape.com/ https://www.onshape.com/
      - colechristensen 8y ago
        Oh yes there's plenty of free CAD (for example, FreeCAD), but there are some truly excellent but insanely expensive tools out there too. I would be happy to spend a large sum of money for a copy, but you can't any more. You have to buy a subscription. If I can buy something excellent and know that I'll be able to use it, even if outdated, in 10 years, there's real value to an investment like that. If I'm throwing several dollars a day into a hole for something I'll probably only use sometimes, and at that, perhaps taking years between uses, I can't justify the expense. Something like how I bought the best cordless drill I could find. Not because I use it every day, or even every month, but because I wanted my drilling experience to be good every time I used it. If you have good tools you're more likely to do things and do them well. People give the same advice about guitars. Don't buy a cheap guitar if you want to pick up the skill. It will be difficult to tune, it won't keep a tune, and it won't sound great whatever you do. Buy a good guitar and what you do will sound better and encourage you to keep it up and get better. A lot of free software tools are the same. They can do what they do, but their flaws discourage use and make failure as a beginner a lot more likely. There is probably an optimum there. Not so refined as to be too expensive to be accessible to most people and not so rudimentary as to turn away people who try with low success.
    - inferiorhuman 8y ago
      If you're not worried about the ethical implications, Autodesk doesn't verify student info for their free student licenses.
      - colechristensen 8y ago
        Fusion 360 is free for hobbiests. Not just students. If I _wanted_ to be unethical, I could surely get anything I wanted. I want to buy something and be in good standing to use it to perhaps build something to sell.
  - tptacek 8y ago
    Last I checked, they didn't do group subscriptions; you buy named licenses for each team member, and they're pretty unpleasant about the process.
    - burfog 8y ago
      They won't do unlimited licenses or subscriptions at all, but you can get group licenses (with license server) and support subscriptions. Your three choices are: a. license server b. licensed to a specific person c. licensed to a specific computer They are indeed pretty unpleasant about the process. They've been burned by license violations.
      - jjoonathan 8y ago
        More than unpleasant. I bought a license, missed the (2 week or something?) deadline to install/activate, and their support ghosted me, leaving my repeated pleas to open another window unanswered. $1k down the drain. I'd take 'em to court if I knew how.
- heathl 8y ago
  https://www.hex-rays.com/products/ida/support/download_freeware.shtml https://www.hex-rays.com/products/ida/support/download_freew... Version 7 is freeware now. Sure you don't get the decompiler and you're limited on target architectures, but it's still an amazing piece of software.
guitarbill 8y ago
I'm not very experienced with RE, but for my limited use-case Cutter/radare2 is usually as good as free IDA version. For this one old MFC4.2 app, Cutter was actually better than IDA at demangling the symbols! It's very exciting to have such a great tool available. IDA might actually be detrimental in the long run. We desperately need more pentesters/infosec folks, and this generation's exposure is more high-level. So open-source RE tooling is essential to get people interested and messing about with this stuff (IMO).
inferiorhuman 8y ago
> In many ways, the radare2 plugin architecture is far superior to IDAs, and I hope this project can start to bridge the gap between functionality and ease-of-use. I think one of the most difficult things for me with r2 is that there is no stable API and minimal detection for the internal stuff. If you're merely working on top of well supported architectures (e.g. arm, x86) you're probably going to do just fine with the "pipe" interface. However, for more advanced features (e.g. new architectures) it's less fun. For instance, when the python bindings break the general response is "fix it yourself and submit a pull request because we don't want to maintain python bindings". Which would be great if the APIs weren't a constantly moving target. The lack of clear documentation hurts the APIs themselves as it's not necessarily clear which parts are deprecated and which represent best practices. Hopefully with the growing community we'll see some of the cruft get cleaned up.
- inferiorhuman 8y ago
  s/detection/documentation/

colechristensen 8y ago

I looked into buying IDA Pro a while back and the experience was like buying enterprise software in 1997. There's not much of a reason for me to have it but it'd be a fun thing to have and toy with in spare time but I'm not really willing to pay an insane subscription price on a sketchy website.

rocky12 8y ago
Sure, but it's not really the type of tool you play with during the weekends. It's high powered and the industry standard. I, and many of my colleagues, would gladly play 4 or 5 times the price for IDA and Hex Rays. Though, any decent security company will purchase a subscription for it's employees.
- colechristensen 8y ago
  >it's not really the type of tool you play with during the weekends I am not so sure I agree. I can take another example, CAD software. There are high powered industry standard softwares which I would love to use on weekends and maybe even use in side projects for profit, but there's no way I can pay $2k/year and justify that. A $2k permanent license? Sure, it's a stretch but I'd probably go for it. 180/month though, whatever I'm doing would have to be really serious before I could justify that. And I won't ever start at that price so the deal is dead. There's a parallel in 3d printing. Not so long ago 3d printers were insanely expensive and only accessible to professionals. Now consumer grade machines are starting to replace machines that cost 10-100x more. It's a frustrating thing about the economy where power tools that could enable a lot of people to do a lot of things are priced so that only a few people who can pay a lot can have access to them. I get that the people making them need to make a livelihood, but the frustration remains.
  - slobotron 8y ago
    For free CAD, checkout OnShape if you don't mind all your drawings to be public. https://www.onshape.com/ https://www.onshape.com/
    - colechristensen 8y ago
      Oh yes there's plenty of free CAD (for example, FreeCAD), but there are some truly excellent but insanely expensive tools out there too. I would be happy to spend a large sum of money for a copy, but you can't any more. You have to buy a subscription. If I can buy something excellent and know that I'll be able to use it, even if outdated, in 10 years, there's real value to an investment like that. If I'm throwing several dollars a day into a hole for something I'll probably only use sometimes, and at that, perhaps taking years between uses, I can't justify the expense. Something like how I bought the best cordless drill I could find. Not because I use it every day, or even every month, but because I wanted my drilling experience to be good every time I used it. If you have good tools you're more likely to do things and do them well. People give the same advice about guitars. Don't buy a cheap guitar if you want to pick up the skill. It will be difficult to tune, it won't keep a tune, and it won't sound great whatever you do. Buy a good guitar and what you do will sound better and encourage you to keep it up and get better. A lot of free software tools are the same. They can do what they do, but their flaws discourage use and make failure as a beginner a lot more likely. There is probably an optimum there. Not so refined as to be too expensive to be accessible to most people and not so rudimentary as to turn away people who try with low success.
  - inferiorhuman 8y ago
    If you're not worried about the ethical implications, Autodesk doesn't verify student info for their free student licenses.
    - colechristensen 8y ago
      Fusion 360 is free for hobbiests. Not just students. If I _wanted_ to be unethical, I could surely get anything I wanted. I want to buy something and be in good standing to use it to perhaps build something to sell.
- tptacek 8y ago
  Last I checked, they didn't do group subscriptions; you buy named licenses for each team member, and they're pretty unpleasant about the process.
  - burfog 8y ago
    They won't do unlimited licenses or subscriptions at all, but you can get group licenses (with license server) and support subscriptions. Your three choices are: a. license server b. licensed to a specific person c. licensed to a specific computer They are indeed pretty unpleasant about the process. They've been burned by license violations.
    - jjoonathan 8y ago
      More than unpleasant. I bought a license, missed the (2 week or something?) deadline to install/activate, and their support ghosted me, leaving my repeated pleas to open another window unanswered. $1k down the drain. I'd take 'em to court if I knew how.
heathl 8y ago
https://www.hex-rays.com/products/ida/support/download_freeware.shtml https://www.hex-rays.com/products/ida/support/download_freew... Version 7 is freeware now. Sure you don't get the decompiler and you're limited on target architectures, but it's still an amazing piece of software.

guitarbill 8y ago

I'm not very experienced with RE, but for my limited use-case Cutter/radare2 is usually as good as free IDA version. For this one old MFC4.2 app, Cutter was actually better than IDA at demangling the symbols! It's very exciting to have such a great tool available. IDA might actually be detrimental in the long run. We desperately need more pentesters/infosec folks, and this generation's exposure is more high-level. So open-source RE tooling is essential to get people interested and messing about with this stuff (IMO).

inferiorhuman 8y ago

> In many ways, the radare2 plugin architecture is far superior to IDAs, and I hope this project can start to bridge the gap between functionality and ease-of-use. I think one of the most difficult things for me with r2 is that there is no stable API and minimal detection for the internal stuff. If you're merely working on top of well supported architectures (e.g. arm, x86) you're probably going to do just fine with the "pipe" interface. However, for more advanced features (e.g. new architectures) it's less fun. For instance, when the python bindings break the general response is "fix it yourself and submit a pull request because we don't want to maintain python bindings". Which would be great if the APIs weren't a constantly moving target. The lack of clear documentation hurts the APIs themselves as it's not necessarily clear which parts are deprecated and which represent best practices. Hopefully with the growing community we'll see some of the cruft get cleaned up.

inferiorhuman 8y ago
s/detection/documentation/