4 ms·

Yup. IDA Pro is the gold standard, and was basically the only choice for a long time. It's also stupidly expensive and priced for defense contractor funny money

by chc4 8y ago

Yup. IDA Pro is the gold standard, and was basically the only choice for a long time. It's also stupidly expensive and priced for defense contractor funny money, with an individual license nearly $3000 [0]. Most freelancers just use a cracked copy or the freeware version. Recently Hopper and BinaryNinja have been rising in use, with much more affordable pricing plans, but they're still second-rate as far as I know. (There's also radare2, which for all it's mentioned occasionally I don't actually know anyone that uses it) 0: https://www.hex-rays.com/cgi-bin/quote.cgi https://www.hex-rays.com/cgi-bin/quote.cgi

joshschreuder 8y ago
I've always wondered this - there's a real "pay for your useful tools" philosophy on here at least, for things like Sublime Text. Often quoted is the cost per hour of use, etc. which justify the price (which is admittedly low compared to Ida). Does the same not apply to Ida where you would make the money back fast enough to justify the pricetag? Or is it that there are more hobbyists and less people making actual money from using Ida?
- pm90 8y ago
  This is basically how a monopoly works. And the defense industry behaves like a monopoly even if its made up of a bunch of different companies.
  - Godel_unicode 8y ago
    I disagree, I think there's an important difference between a monopoly and a company that happens to have no competition at the moment. I think that active anti-competitive actions are one of the defining characteristics of a monopoly, and so far we haven't seen that behavior from hex-rays. They had a significant barrier to entry protecting them, in that making a decompiler (the hex rays decompiler is the expensive part of "Ida") is hard, and the market is (was?) small. Consider the difference between Standard Oil and Adobe. Photoshop was the only game in town not because Adobe lost money on it to drive out rivals but because it's hard to make software that does what Photoshop does.
    - saagarjha 8y ago
      Both Photoshop and IDA Pro treat their customers pretty poorly, but they work well so everyone uses it. Hence why people are excited to see competitors in the space.
    - zokier 8y ago
      > I think there's an important difference between a monopoly and a company that happens to have no competition at the moment. I think that active anti-competitive actions are one of the defining characteristics of a monopoly You are of course free to think so, but be aware that does not align with the common use of the term monopoly.
- Godel_unicode 8y ago
  Lots of people make serious money with Ida, it's a license to print money similar to knowing Cisco was a few years ago (although even more so I'm hoping). The problem is barrier to entry. Many RE blogs and free resources start with "open up Ida", which means that in order to learn how to use the tool to make that money, you first have to buy the tool. Yes, there's the community edition, but it always seems to be missing that one feature you really need... I'm really curious what the prevalence of tools like this is going to do to the salaries for reverse engineers.
saagarjha 8y ago
Yeah, IDA is simultaneously the worst piece of software I have used from a usability standpoint but also the best reverse engineering tool out there. The author basically does whatever he likes because most reverse engineers use it :(
tpfour 8y ago
I don't understand why you think 3000$ per seat is asking too much. If there's a market for cheaper products just build it. After putting in the work, you might actually think 3000$ is cheap. I have never used IDA Pro but maybe the licensing comes with some sort of support agreement?
- souprock 8y ago
  Yes, the support is excellent. Sometimes they will even email you a new version with your requested bug fix. Note that $3000 lacks the decompilers, of which there are 5 available. The total price with all of those is about $15,000.
  - tpfour 8y ago
    I see. Thank you. I am sure for some that $15K is an investment.

by chc4 8y ago

joshschreuder 8y ago

I've always wondered this - there's a real "pay for your useful tools" philosophy on here at least, for things like Sublime Text. Often quoted is the cost per hour of use, etc. which justify the price (which is admittedly low compared to Ida). Does the same not apply to Ida where you would make the money back fast enough to justify the pricetag? Or is it that there are more hobbyists and less people making actual money from using Ida?

pm90 8y ago
This is basically how a monopoly works. And the defense industry behaves like a monopoly even if its made up of a bunch of different companies.
- Godel_unicode 8y ago
  I disagree, I think there's an important difference between a monopoly and a company that happens to have no competition at the moment. I think that active anti-competitive actions are one of the defining characteristics of a monopoly, and so far we haven't seen that behavior from hex-rays. They had a significant barrier to entry protecting them, in that making a decompiler (the hex rays decompiler is the expensive part of "Ida") is hard, and the market is (was?) small. Consider the difference between Standard Oil and Adobe. Photoshop was the only game in town not because Adobe lost money on it to drive out rivals but because it's hard to make software that does what Photoshop does.
  - saagarjha 8y ago
    Both Photoshop and IDA Pro treat their customers pretty poorly, but they work well so everyone uses it. Hence why people are excited to see competitors in the space.
  - zokier 8y ago
    > I think there's an important difference between a monopoly and a company that happens to have no competition at the moment. I think that active anti-competitive actions are one of the defining characteristics of a monopoly You are of course free to think so, but be aware that does not align with the common use of the term monopoly.
Godel_unicode 8y ago
Lots of people make serious money with Ida, it's a license to print money similar to knowing Cisco was a few years ago (although even more so I'm hoping). The problem is barrier to entry. Many RE blogs and free resources start with "open up Ida", which means that in order to learn how to use the tool to make that money, you first have to buy the tool. Yes, there's the community edition, but it always seems to be missing that one feature you really need... I'm really curious what the prevalence of tools like this is going to do to the salaries for reverse engineers.

saagarjha 8y ago

Yeah, IDA is simultaneously the worst piece of software I have used from a usability standpoint but also the best reverse engineering tool out there. The author basically does whatever he likes because most reverse engineers use it :(

tpfour 8y ago

I don't understand why you think 3000$ per seat is asking too much. If there's a market for cheaper products just build it. After putting in the work, you might actually think 3000$ is cheap. I have never used IDA Pro but maybe the licensing comes with some sort of support agreement?

souprock 8y ago
Yes, the support is excellent. Sometimes they will even email you a new version with your requested bug fix. Note that $3000 lacks the decompilers, of which there are 5 available. The total price with all of those is about $15,000.
- tpfour 8y ago
  I see. Thank you. I am sure for some that $15K is an investment.