13 ms·

Why this is important (for those uninitiated): - Ghidra is basically the first real competitor to IDA Pro, the extremely expensive and often pirated state-of-t

Why this is important (for those uninitiated): - Ghidra is basically the first real competitor to IDA Pro, the extremely expensive and often pirated state-of-the-art software for reverse engineering. Nothing else has come close to IDA Pro. - Ghidra is open-source, IDA Pro is not. - Ghidra has a lot of really cool features that IDA Pro doesn't, such as decompiling binaries to pseudo-C code. - It's also collaborative, which is interesting because multiple people can reverse engineer the same binary at the same time -- something IDA only got VERY recently.

saagarjha 8y ago
> Ghidra has a lot of really cool features that IDA Pro doesn't, such as decompiling binaries to pseudo-C code. To be fair, IDA Pro has a decompiler plugin to do this.
- slimsag 8y ago
  It does, but it costs an extra $1.5k on top of the main software, per architecture.
  - Avery3R 8y ago
    $2.6k+ you mean
- _wmd 8y ago
  For which they charge a per-CPU fortune https://www.hex-rays.com/cgi-bin/quote.cgi https://www.hex-rays.com/cgi-bin/quote.cgi
  - tptacek 8y ago
    It's a funny situation, though: decompilation probably should cost a small fortune. If you're in a line of work that needs it, the quality of your decompiler is probably a huge factor in how valuable an hour of your time is, and many [most?] fields where people routinely decompile stuff are very highly compensated. IDA has always had a weirdly low price point given the bill rates of people who use it, and it's interesting to see that price being competed all the way down to free.
    - Wowfunhappy 8y ago
      It depends on what you're doing. I imagine a lot of people use IDA pro for modding video games, which often/usually provides no monetary compensation. Perhaps they would benefit from some type of "free/cheap for noncommercial use" license?
      - AtHeartEngineer 8y ago
        And looking for vulnerabilities
      - tptacek 8y ago
        There is a free (much less capable) version of IDA.
        monocasa 8y ago
        Which doesn't provide decompilation.
        anonymious 8y ago
        And has a very limited support CPU arch / executable format selection.
      - XMPPwocky 8y ago
        Video game modders certainly use IDA. IDA's purchase price, though, is, ah, not an issue for them- not because they have lots of funds available, but rather quite the opposite.
        jchw 8y ago
        To be fair, I don't think HexRays is oblivious to this dynamic, and to that end I think the freeware version they offer makes a lot of sense. Especially if it supports AMD64, which I'm hearing it does nowadays. That's not going to prevent many people from taking the five finger discount I'm sure, since they'd rather have as many of the features as they can, but at least nobody can say HexRays isn't trying.
  - verall 8y ago
    $4k/cpu/year is really not very expensive at all for industry-leading niche software. Good comparison might be Synopsys VCS. Prices are not published but I believe they are over $30k/cpu/year and for larger designs you really want a big sim server.
dman 8y ago
Think BinaryNinja has been acting pretty effectively as a competitor to IDA Pro. Its much cheaper than IDA, has a good API and I have been a very happy customer.
- justinjlynn 8y ago
  It's not Open Source.
  - idlewords 8y ago
    You can just reverse-engineer it!
    - justinjlynn 8y ago
      No, you almost certainly promised not to do so when you bought a licence.
      - gpm 8y ago
        Ghidra on the other hand you could, since even if they never get around to fully releasing the source (unlikely) they still granted us an apache license on the whole thing :) I think it's probably pretty unique right now in that it's under an OSS license without all the source available.
        pcwalton 8y ago
        Ghidra is mostly Java, so decompilation would pretty high-fidelity to begin with.
        gpm 8y ago
        The java sources seem to all be there in zip files actually (as far as I can tell). The part I was most interested in atm (the decompiler) turns out to be some sort of native language compiled to an executable, and its source isn't there.
supermw 8y ago
IDA Pro is not expensive at all for serious professionals in the field. Other common software in the industry costs way more. Nessus is $2k a year, Metasploit like $1500 to $15000, and Core Impact is $30k and up. If this is expensive to you, then it’s not for you. This is for people who are making real money with these tools, not hobbyists dicking around.
- vageli 8y ago
  > If this is expensive to you, then it’s not for you. This is for people who are making real money with these tools, not hobbyists dicking around. That's an odd perspective. Imagine if this type of sentiment were applied to paint brushes. There is a lot of useful work that is not economically viable per se, and to discount that and to be pejorative feels wrong.
  - _jal 8y ago
    It is less odd if you look at it from the perspective of a professional in the field. Being expensive (and a little mean about it) discourages potential competitors from entry. Not necessarily nice, but it makes sense.
    - smokeyj 8y ago
      /r/gatekeeping
  - supermw 8y ago
    If you are using these tools you are either defending systems from threats or breaking into systems and making money through illegal activities. There is not really any other useful work you can do with these tools. I don’t see how the perspective is odd. Having tools like Core Impact and the knowledge of how to use them well can propel you to a six figure income easily. On top of that these tools are also business expenses you can use for tax write offs. They are certainly worth the investment. The only people who see the price as steep are those who cannot see any viable way to make a decent ROI off them.
voctor 8y ago
There is JEB Decompiler too: https://www.pnfsoftware.com https://www.pnfsoftware.com
nneonneo 8y ago
Ghidra also appears to have a functioning Undo operation, which IDA seems to still not have. Being able to make changes without worrying about your IDB accidentally becoming unusable is huge. Context: in IDA, certain changes you make can inadvertently wipe out a lot of work - for example, undefining a function (U) can erase all your annotations in a single keystroke; defining a return type incorrectly can completely mess up callers, sometimes to the point where they won't even decompile properly; making a typo to an array size argument can obliterate the stack and every variable annotation you made on it, etc. etc. Many of these require much more work to undo than simply reverting the change you made. So a functioning undo is a big deal Some more comparisons: - Ghidra's type system is nice, and in some ways nicer than IDA's. Semi-automatic struct inference rocks, and it comes with a big type library. - Ghidra will decompile code from a dozen different architectures. IDA will only do x86, x64, ARM and AArch64 (and you pay for all of those separately). In theory it could decompile a custom architecture if you implement your disassembler backend thoroughly enough. - Ghidra's UI is marginally worse than IDA because it's implemented in Java Swing (compared with IDA's Qt). - Ghidra and IDA both use Python for scripting. However, Ghidra's Python is actually Jython, which gives it access to the entire state of the system (minus the decompiler, which is native code - but you can interact with all the code that drives the decompiler). This is really big - the API surface of the entirety of Ghidra is pretty massive so the scripting opportunities are similarly exciting. - Ghidra has a (mostly functional) patching interface which understands assembly. IDA Pro, despite costing many thousands of dollars, gets confused when you try to assemble something as basic as "mov rdi, rdx" in 64-bit code. (There's an outstanding bug which breaks ELF files - but being open-source, I'm sure it will be fixed soon)
- blattimwind 8y ago
  I don't think I've ever seen an application where a working undo function was added in a posteriori. You either design it in from the start or you don't get a working one or you have to rewrite most of the application.
Darmani 8y ago
Wait, IDA has a collaborative mode? I couldn't find one; link please? This is shocking, because, in an E-mail exchange a few years ago, Ilfak wrote to me: > [...] we at hex-rays do not have any ideas how to implement dynamic database synchronization, so it is unlikely that others will come up with a good solution.
- q3k 8y ago
  https://github.com/IDArlingTeam/IDArling/ https://github.com/IDArlingTeam/IDArling/
  - Darmani 8y ago
    How well does it work? The aforementioned exchange with Ilfak came after my poor experience with collabREate, a previous plugin that claimed to do the same thing.
    - souprock 8y ago
      Ghidra appears to use version control, with a need to merge changes. Merges could get ugly. I think Binary Ninja's enterprise version might involve clients connecting to a server that maintains the database. It would be more like Google Docs if that is the case. Actions in the GUI would request atomic transactions on the server, then display the current state.
bryanrasmussen 8y ago
Even if it is open source, I might worry about using an open source tool from the NSA.
- OskarS 8y ago
  Yeah, my mouse was hovering over the download button eager to test it out when my brain suddenly went "wait, don't do that!" If you wanna run this thing, you should probably build it from source yourself (don't trust the binaries) and even then run it in a pretty well sandboxed virtual machine. I would not be surprised at all if the NSA left some surprises in that thing.
  - pbhjpbhj 8y ago
    Maybe it's all just an elaborate recruitment ad. :)
  - Goz3rr 8y ago
    I hope you don't use Linux, because the NSA contributes to quite a lot of OSS. They also created SELinux for instance.
    - mattigames 8y ago
      Those changes on OSS are reviewed by a lot of people, this here is just released and reviewed by themselves only.
      - AnIdiotOnTheNet 8y ago
        Sure, the ones officially contributed by the NSA. What you have to wonder is how much code was contributed by some seemingly normal community member that is actually a front for the NSA to introduce subtly flawed code that they can use to their advantage while being plausibly just a bug? There are those who suspect Heartbleed came about this way.
    - AsyncAwait 8y ago
      - SELinux has been free-software for over a decade, with many open-source contributions. - Many people don't use SELinux, especially on distros like Arch, Gentoo etc. where it (luckily) doesn't come as part of the package, SELinux is far from universal.
ernst_klim 8y ago
>is basically the first real competitor to IDA Pro What do you think of BAP[1]? [1] https://github.com/BinaryAnalysisPlatform/bap https://github.com/BinaryAnalysisPlatform/bap
- ivg_t 8y ago
  BAP is not a competitor to IDA Pro or Ghidra, it's a platform for implementing automated analysis, while IDA and Ghidra are more like reverse engineering tools that are focused on human interactions. We do support IDA Pro so that you can run BAP analysis from it and have the best of two words. We will soon roll out the support for Ghidra too (the issue is created [1]). What is a really great contribution of Ghidra, to my opinion, is the detailed specification of all supported ISA in Sleigh (their terse and concrete ISA specification language). Ghidra ships with about ~200kLOC of instruction descriptions and this is the most valuable contribution to the community. We're planning to support Sleigh in the nearest future, and I believe that Sleigh might become a standard de facto for instruction semantics specification. [1]: https://github.com/BinaryAnalysisPlatform/bap/issues/929 https://github.com/BinaryAnalysisPlatform/bap/issues/929
vectorEQ 8y ago
ida can use hexrays to decompile, which is working great. but ofcourse you need some employer to pay for it which is aa pain, no one will pay some 10k for a tool personally. however, free version is very adequate for most things. i would say these both tools ,as well as r2 have their own merits and weak points, and it would be good not to exclude one and take the other as better, but to have them compliment eachother in your arsenal. in the end if you want quality, then manual work is always better than these opinionated tools, and sometimes that is required, so really the tools offer different perspectives / opinions of the same thing, and that is valuable in any case. when you run into the limit of 1 tool ,another might just fill that gap.
smolsky 8y ago
Let's not forget https://www.radare.org https://www.radare.org which is trying to be a OSS IDA Pro.
- S-E-P 8y ago
  I use r2 almost all the time, it's just so fast and convenient, and it makes working with Binary Ninja easier. Also use IDA when all else fails. And the decompiler is dope for IDA
webninja 8y ago
Ghidra’s source source code was not released. The only thing on Github is the Readme, the license, and some git files. The best you can likely do is use Ghidra to reverse-engineer Ghidra.
- tbodt 8y ago
  The download includes a zip file containing source code next to every jar file.

saagarjha 8y ago

> Ghidra has a lot of really cool features that IDA Pro doesn't, such as decompiling binaries to pseudo-C code. To be fair, IDA Pro has a decompiler plugin to do this.

slimsag 8y ago
It does, but it costs an extra $1.5k on top of the main software, per architecture.
- Avery3R 8y ago
  $2.6k+ you mean
_wmd 8y ago
For which they charge a per-CPU fortune https://www.hex-rays.com/cgi-bin/quote.cgi https://www.hex-rays.com/cgi-bin/quote.cgi
- tptacek 8y ago
  It's a funny situation, though: decompilation probably should cost a small fortune. If you're in a line of work that needs it, the quality of your decompiler is probably a huge factor in how valuable an hour of your time is, and many [most?] fields where people routinely decompile stuff are very highly compensated. IDA has always had a weirdly low price point given the bill rates of people who use it, and it's interesting to see that price being competed all the way down to free.
  - Wowfunhappy 8y ago
    It depends on what you're doing. I imagine a lot of people use IDA pro for modding video games, which often/usually provides no monetary compensation. Perhaps they would benefit from some type of "free/cheap for noncommercial use" license?
    - AtHeartEngineer 8y ago
      And looking for vulnerabilities
    - tptacek 8y ago
      There is a free (much less capable) version of IDA.
      - monocasa 8y ago
        Which doesn't provide decompilation.
        anonymious 8y ago
        And has a very limited support CPU arch / executable format selection.
    - XMPPwocky 8y ago
      Video game modders certainly use IDA. IDA's purchase price, though, is, ah, not an issue for them- not because they have lots of funds available, but rather quite the opposite.
      - jchw 8y ago
        To be fair, I don't think HexRays is oblivious to this dynamic, and to that end I think the freeware version they offer makes a lot of sense. Especially if it supports AMD64, which I'm hearing it does nowadays. That's not going to prevent many people from taking the five finger discount I'm sure, since they'd rather have as many of the features as they can, but at least nobody can say HexRays isn't trying.
- verall 8y ago
  $4k/cpu/year is really not very expensive at all for industry-leading niche software. Good comparison might be Synopsys VCS. Prices are not published but I believe they are over $30k/cpu/year and for larger designs you really want a big sim server.

dman 8y ago

Think BinaryNinja has been acting pretty effectively as a competitor to IDA Pro. Its much cheaper than IDA, has a good API and I have been a very happy customer.

justinjlynn 8y ago
It's not Open Source.
- idlewords 8y ago
  You can just reverse-engineer it!
  - justinjlynn 8y ago
    No, you almost certainly promised not to do so when you bought a licence.
    - gpm 8y ago
      Ghidra on the other hand you could, since even if they never get around to fully releasing the source (unlikely) they still granted us an apache license on the whole thing :) I think it's probably pretty unique right now in that it's under an OSS license without all the source available.
      - pcwalton 8y ago
        Ghidra is mostly Java, so decompilation would pretty high-fidelity to begin with.
        gpm 8y ago
        The java sources seem to all be there in zip files actually (as far as I can tell). The part I was most interested in atm (the decompiler) turns out to be some sort of native language compiled to an executable, and its source isn't there.

supermw 8y ago

IDA Pro is not expensive at all for serious professionals in the field. Other common software in the industry costs way more. Nessus is $2k a year, Metasploit like $1500 to $15000, and Core Impact is $30k and up. If this is expensive to you, then it’s not for you. This is for people who are making real money with these tools, not hobbyists dicking around.

vageli 8y ago
> If this is expensive to you, then it’s not for you. This is for people who are making real money with these tools, not hobbyists dicking around. That's an odd perspective. Imagine if this type of sentiment were applied to paint brushes. There is a lot of useful work that is not economically viable per se, and to discount that and to be pejorative feels wrong.
- _jal 8y ago
  It is less odd if you look at it from the perspective of a professional in the field. Being expensive (and a little mean about it) discourages potential competitors from entry. Not necessarily nice, but it makes sense.
  - smokeyj 8y ago
    /r/gatekeeping
- supermw 8y ago
  If you are using these tools you are either defending systems from threats or breaking into systems and making money through illegal activities. There is not really any other useful work you can do with these tools. I don’t see how the perspective is odd. Having tools like Core Impact and the knowledge of how to use them well can propel you to a six figure income easily. On top of that these tools are also business expenses you can use for tax write offs. They are certainly worth the investment. The only people who see the price as steep are those who cannot see any viable way to make a decent ROI off them.

voctor 8y ago

There is JEB Decompiler too: https://www.pnfsoftware.com https://www.pnfsoftware.com

nneonneo 8y ago

Ghidra also appears to have a functioning Undo operation, which IDA seems to still not have. Being able to make changes without worrying about your IDB accidentally becoming unusable is huge. Context: in IDA, certain changes you make can inadvertently wipe out a lot of work - for example, undefining a function (U) can erase all your annotations in a single keystroke; defining a return type incorrectly can completely mess up callers, sometimes to the point where they won't even decompile properly; making a typo to an array size argument can obliterate the stack and every variable annotation you made on it, etc. etc. Many of these require much more work to undo than simply reverting the change you made. So a functioning undo is a big deal Some more comparisons: - Ghidra's type system is nice, and in some ways nicer than IDA's. Semi-automatic struct inference rocks, and it comes with a big type library. - Ghidra will decompile code from a dozen different architectures. IDA will only do x86, x64, ARM and AArch64 (and you pay for all of those separately). In theory it could decompile a custom architecture if you implement your disassembler backend thoroughly enough. - Ghidra's UI is marginally worse than IDA because it's implemented in Java Swing (compared with IDA's Qt). - Ghidra and IDA both use Python for scripting. However, Ghidra's Python is actually Jython, which gives it access to the entire state of the system (minus the decompiler, which is native code - but you can interact with all the code that drives the decompiler). This is really big - the API surface of the entirety of Ghidra is pretty massive so the scripting opportunities are similarly exciting. - Ghidra has a (mostly functional) patching interface which understands assembly. IDA Pro, despite costing many thousands of dollars, gets confused when you try to assemble something as basic as "mov rdi, rdx" in 64-bit code. (There's an outstanding bug which breaks ELF files - but being open-source, I'm sure it will be fixed soon)

blattimwind 8y ago
I don't think I've ever seen an application where a working undo function was added in a posteriori. You either design it in from the start or you don't get a working one or you have to rewrite most of the application.

Darmani 8y ago

Wait, IDA has a collaborative mode? I couldn't find one; link please? This is shocking, because, in an E-mail exchange a few years ago, Ilfak wrote to me: > [...] we at hex-rays do not have any ideas how to implement dynamic database synchronization, so it is unlikely that others will come up with a good solution.

q3k 8y ago
https://github.com/IDArlingTeam/IDArling/ https://github.com/IDArlingTeam/IDArling/
- Darmani 8y ago
  How well does it work? The aforementioned exchange with Ilfak came after my poor experience with collabREate, a previous plugin that claimed to do the same thing.
  - souprock 8y ago
    Ghidra appears to use version control, with a need to merge changes. Merges could get ugly. I think Binary Ninja's enterprise version might involve clients connecting to a server that maintains the database. It would be more like Google Docs if that is the case. Actions in the GUI would request atomic transactions on the server, then display the current state.

bryanrasmussen 8y ago

Even if it is open source, I might worry about using an open source tool from the NSA.

OskarS 8y ago
Yeah, my mouse was hovering over the download button eager to test it out when my brain suddenly went "wait, don't do that!" If you wanna run this thing, you should probably build it from source yourself (don't trust the binaries) and even then run it in a pretty well sandboxed virtual machine. I would not be surprised at all if the NSA left some surprises in that thing.
- pbhjpbhj 8y ago
  Maybe it's all just an elaborate recruitment ad. :)
- Goz3rr 8y ago
  I hope you don't use Linux, because the NSA contributes to quite a lot of OSS. They also created SELinux for instance.
  - mattigames 8y ago
    Those changes on OSS are reviewed by a lot of people, this here is just released and reviewed by themselves only.
    - AnIdiotOnTheNet 8y ago
      Sure, the ones officially contributed by the NSA. What you have to wonder is how much code was contributed by some seemingly normal community member that is actually a front for the NSA to introduce subtly flawed code that they can use to their advantage while being plausibly just a bug? There are those who suspect Heartbleed came about this way.
  - AsyncAwait 8y ago
    - SELinux has been free-software for over a decade, with many open-source contributions. - Many people don't use SELinux, especially on distros like Arch, Gentoo etc. where it (luckily) doesn't come as part of the package, SELinux is far from universal.

ernst_klim 8y ago

>is basically the first real competitor to IDA Pro What do you think of BAP[1]? [1] https://github.com/BinaryAnalysisPlatform/bap https://github.com/BinaryAnalysisPlatform/bap

ivg_t 8y ago
BAP is not a competitor to IDA Pro or Ghidra, it's a platform for implementing automated analysis, while IDA and Ghidra are more like reverse engineering tools that are focused on human interactions. We do support IDA Pro so that you can run BAP analysis from it and have the best of two words. We will soon roll out the support for Ghidra too (the issue is created [1]). What is a really great contribution of Ghidra, to my opinion, is the detailed specification of all supported ISA in Sleigh (their terse and concrete ISA specification language). Ghidra ships with about ~200kLOC of instruction descriptions and this is the most valuable contribution to the community. We're planning to support Sleigh in the nearest future, and I believe that Sleigh might become a standard de facto for instruction semantics specification. [1]: https://github.com/BinaryAnalysisPlatform/bap/issues/929 https://github.com/BinaryAnalysisPlatform/bap/issues/929

vectorEQ 8y ago

ida can use hexrays to decompile, which is working great. but ofcourse you need some employer to pay for it which is aa pain, no one will pay some 10k for a tool personally. however, free version is very adequate for most things. i would say these both tools ,as well as r2 have their own merits and weak points, and it would be good not to exclude one and take the other as better, but to have them compliment eachother in your arsenal. in the end if you want quality, then manual work is always better than these opinionated tools, and sometimes that is required, so really the tools offer different perspectives / opinions of the same thing, and that is valuable in any case. when you run into the limit of 1 tool ,another might just fill that gap.

smolsky 8y ago

Let's not forget https://www.radare.org https://www.radare.org which is trying to be a OSS IDA Pro.

S-E-P 8y ago
I use r2 almost all the time, it's just so fast and convenient, and it makes working with Binary Ninja easier. Also use IDA when all else fails. And the decompiler is dope for IDA

webninja 8y ago

Ghidra’s source source code was not released. The only thing on Github is the Readme, the license, and some git files. The best you can likely do is use Ghidra to reverse-engineer Ghidra.

tbodt 8y ago
The download includes a zip file containing source code next to every jar file.