3 ms·

Binja is the only real competitor in any remote sense IMO, and while the LLIL/MLIL are nothing compared to Hex-Rays, they do still dramatically improve the spee

by aseipp 8y ago

Binja is the only real competitor in any remote sense IMO, and while the LLIL/MLIL are nothing compared to Hex-Rays, they do still dramatically improve the speed of the job. Binja is also fairly extensible/pluggable, though it's pretty undocumented... I just don't do it enough in my spare time these days (not in the field anymore) to justify a Hex-Rays license for myself (even if it is permanent...) That said I just renewed my license so I have to get some use out of it, but Ghidra does seem like it could be the real deal. Honestly, I never really expected any free/FOSS alternative to IDA to ever exist at this point, so the possibility is tantalizing.

xvilka 8y ago
I agree, they have a big potential. But if you speak about FOSS alternative - there is already radare2[1]+Cutter[2]+radeco[3]. [1] https://github.com/radare/radare2 https://github.com/radare/radare2 [2] https://github.com/radareorg/cutter https://github.com/radareorg/cutter [3] https://github.com/radareorg/radeco https://github.com/radareorg/radeco
- aseipp 8y ago
  Binary-Ninja and IDA are a completely different class of tool from Radare. Don't get me wrong, I'm happy Radare exists. And I occasionally check it out and play with it -- I think "the vim of RE tools" is a cool point in the design space. As a Linux person, I find that attractive, especially for certain kinds of automated stuff (vs loading Python scripts in through a UX or whatever). But that kind of aesthetic is an extremely small part of these tools in the whole, and it simply does not matter if the tool cannot "keep up" with your work. All of that comes later on. You're comparing a Jalopy to a Prius -- and that Prius is already going up against a Ferrari. When I use IDA, almost all of my actual work in the tool itself is very "boring" RE stuff, because it does its job. I am not constantly fighting with it to get basic things analyzed propertly, or fighting a lack of supported features that prevent it from opening something, or a bad analysis engine that misses 80% of things I later reverse by hand. You could comparatively stitch something together with the tools in Radare to patch over this for the cases it doesn't handle. You might even call those "edge cases", but reverse engineering is 90% edge cases and 10% easy stuff. I'll already be done by then. I should also be clear that part of the issue is that reverse engineering is a money game, one where money is easy to come by if you have the clients -- and as a result and a lot of the developers of those tools have more money/labor available than the Radare developers. That also means people who need this can simply throw money at a problem, like an expensive IDA license, and move on. That doesn't mean Radare developers are incompetent. If you gave them a lot of money -- like, enough to fund 5-10 core developers for a couple years -- Radare would dramatically improve extremely quickly, I'm sure. (This is one of the reasons why I suspected a true competitor to IDA would never come around as FOSS -- it takes a shitload of money to do that, and it's also something you can make a shitload of money from.) But I'll say this: if you put me into a situation where I had to reverse something, I'd pay for an IDA license 10/10 times even if every Radare developer was at my command, and I'd probably still get it done faster (most RE tools I know of lack even the most basic, fundamental features IDA has had for years -- such as FLIRT -- that can dramatically improve reversing speed.)
  - xvilka 8y ago
    R2 has Cutter GUI, along with FLIRT support (and custom signatures format as well) for years as well. So bad example. And there are not much money even for IDA developers - it is very small market. So no tool would get a "shitload" of money ever.
    - souprock 8y ago
      IDA developers get paid. My company alone probably gives them more than two million dollars per year. If we switch, it will be to Ghidra or to Binary Ninja.

by aseipp 8y ago

xvilka 8y ago

I agree, they have a big potential. But if you speak about FOSS alternative - there is already radare2[1]+Cutter[2]+radeco[3]. [1] https://github.com/radare/radare2 https://github.com/radare/radare2 [2] https://github.com/radareorg/cutter https://github.com/radareorg/cutter [3] https://github.com/radareorg/radeco https://github.com/radareorg/radeco

aseipp 8y ago
Binary-Ninja and IDA are a completely different class of tool from Radare. Don't get me wrong, I'm happy Radare exists. And I occasionally check it out and play with it -- I think "the vim of RE tools" is a cool point in the design space. As a Linux person, I find that attractive, especially for certain kinds of automated stuff (vs loading Python scripts in through a UX or whatever). But that kind of aesthetic is an extremely small part of these tools in the whole, and it simply does not matter if the tool cannot "keep up" with your work. All of that comes later on. You're comparing a Jalopy to a Prius -- and that Prius is already going up against a Ferrari. When I use IDA, almost all of my actual work in the tool itself is very "boring" RE stuff, because it does its job. I am not constantly fighting with it to get basic things analyzed propertly, or fighting a lack of supported features that prevent it from opening something, or a bad analysis engine that misses 80% of things I later reverse by hand. You could comparatively stitch something together with the tools in Radare to patch over this for the cases it doesn't handle. You might even call those "edge cases", but reverse engineering is 90% edge cases and 10% easy stuff. I'll already be done by then. I should also be clear that part of the issue is that reverse engineering is a money game, one where money is easy to come by if you have the clients -- and as a result and a lot of the developers of those tools have more money/labor available than the Radare developers. That also means people who need this can simply throw money at a problem, like an expensive IDA license, and move on. That doesn't mean Radare developers are incompetent. If you gave them a lot of money -- like, enough to fund 5-10 core developers for a couple years -- Radare would dramatically improve extremely quickly, I'm sure. (This is one of the reasons why I suspected a true competitor to IDA would never come around as FOSS -- it takes a shitload of money to do that, and it's also something you can make a shitload of money from.) But I'll say this: if you put me into a situation where I had to reverse something, I'd pay for an IDA license 10/10 times even if every Radare developer was at my command, and I'd probably still get it done faster (most RE tools I know of lack even the most basic, fundamental features IDA has had for years -- such as FLIRT -- that can dramatically improve reversing speed.)
- xvilka 8y ago
  R2 has Cutter GUI, along with FLIRT support (and custom signatures format as well) for years as well. So bad example. And there are not much money even for IDA developers - it is very small market. So no tool would get a "shitload" of money ever.
  - souprock 8y ago
    IDA developers get paid. My company alone probably gives them more than two million dollars per year. If we switch, it will be to Ghidra or to Binary Ninja.