3 ms·

How does ghidra compare nowadays to IDA? Is it good enough already to be used as a replacement to IDA and Hex-Rays decompilation, at least for x86 code?

by vadfa 5y ago

saagarjha 5y ago
That would depend on your needs. For me, at least, it's largely an adequate replacement-I'd rank it as "consistently at least 50% as good, sometimes up to 200% as good as IDA". For the price it's simply unbeatable.
bri3d 5y ago
Yes, I think Ghidra is "good enough" for most use cases. For some (architectures other than x86/ARM), it is vastly superior. For others (Windows and especially C++) it's not quite as good, but still useable. For C++ projects targeting Windows, IDA is still a lot better in terms of decompilation quality. The demangler and function signature system is particularly tailored to MSVC++. For other architectures, Ghidra kills IDA by virtue of abstraction - all disassembly turns into the same IR (P-code) and is decompiled from there. So, the decompiler works across all architectures with a processor spec, rather than being specialized to x86/ARM. And, the exposure of this P-code system is very powerful as well - with some clever plugin scripting for Ghidra, you can actually single-step through the P-code as though you had a full emulator/debugger, without needing to set up an entire virtual environment. https://wrongbaud.github.io/posts/kong-vs-ghidra/ https://wrongbaud.github.io/posts/kong-vs-ghidra/
ur-whale 5y ago
> How does ghidra compare nowadays to IDA? Not in the same category, IDA is really good. However, Ghidra is: a) free b) good enough for many thing One downside: the UI is convoluted.
- bri3d 5y ago
  This is interesting to me - I feel as though both GUIs are an acquired taste and now that I've spent enough time in Ghidra, I find IDA annoying sometimes. I agree that IDA is head-and-shoulders better for Windows, especially Microsoft-compiler built software, but I'm not sure Ghidra isn't in the same category, especially for embedded. I find myself much more productive in Ghidra than IDA for embedded tasks.
  - ur-whale 5y ago
    > I find myself much more productive in Ghidra than IDA for embedded tasks. Ah, fair enough. I've only used these tools in an windows x86-64 context.

How does ghidra compare nowadays to IDA? Is it good enough already to be used as a replacement to IDA and Hex-Rays decompilation, at least for x86 code?

by vadfa 5y ago

How does ghidra compare nowadays to IDA? Is it good enough already to be used as a replacement to IDA and Hex-Rays decompilation, at least for x86 code?

saagarjha 5y ago

That would depend on your needs. For me, at least, it's largely an adequate replacement-I'd rank it as "consistently at least 50% as good, sometimes up to 200% as good as IDA". For the price it's simply unbeatable.

bri3d 5y ago

Yes, I think Ghidra is "good enough" for most use cases. For some (architectures other than x86/ARM), it is vastly superior. For others (Windows and especially C++) it's not quite as good, but still useable. For C++ projects targeting Windows, IDA is still a lot better in terms of decompilation quality. The demangler and function signature system is particularly tailored to MSVC++. For other architectures, Ghidra kills IDA by virtue of abstraction - all disassembly turns into the same IR (P-code) and is decompiled from there. So, the decompiler works across all architectures with a processor spec, rather than being specialized to x86/ARM. And, the exposure of this P-code system is very powerful as well - with some clever plugin scripting for Ghidra, you can actually single-step through the P-code as though you had a full emulator/debugger, without needing to set up an entire virtual environment. https://wrongbaud.github.io/posts/kong-vs-ghidra/ https://wrongbaud.github.io/posts/kong-vs-ghidra/

ur-whale 5y ago

> How does ghidra compare nowadays to IDA? Not in the same category, IDA is really good. However, Ghidra is: a) free b) good enough for many thing One downside: the UI is convoluted.

bri3d 5y ago
This is interesting to me - I feel as though both GUIs are an acquired taste and now that I've spent enough time in Ghidra, I find IDA annoying sometimes. I agree that IDA is head-and-shoulders better for Windows, especially Microsoft-compiler built software, but I'm not sure Ghidra isn't in the same category, especially for embedded. I find myself much more productive in Ghidra than IDA for embedded tasks.
- ur-whale 5y ago
  > I find myself much more productive in Ghidra than IDA for embedded tasks. Ah, fair enough. I've only used these tools in an windows x86-64 context.