6 ms·

Hopefully this works out for Hex-Rays, allowing them to invest more into developing IDA and expanding their low-cost product offerings. The general sentiment I

Hopefully this works out for Hex-Rays, allowing them to invest more into developing IDA and expanding their low-cost product offerings. The general sentiment I have seen among people doing SRE is that IDA is rapidly losing market share to Ghidra. While it excels in some areas, the licenses are pricy even for tech employers, and entirely out of reach for students or colleges. It's hard to convince an employer to fork out cash for IDA licenses when new employees are asking to use Ghidra, because that's what they use at home and at school.

rjzzleep 4y ago
For me I got the Company I was contracting for to buy me an IDA license and as I was trying to take over from there Hexrays never responded to any requests. I'm guessing that I'm on the same pirate blacklist that a lot of people landed. I guess I should have expensed it instead of having the Company buy it. I was the only person doing RE work, it was a single user person license and I was also the only linux user out of that 300 people org. I think there are a lot of people that would like to pay for IDA but can't get it. On the other hand I really don't like the Ghidra user experience. Is there something similar to FLIRT in r2 or ghidra?
- pseudo0 4y ago
  I don't think Ghidra has a proper FLIRT equivalent yet. That's one of those bells and whistles that may (or may not) be worth the license fee, along with in my opinion a more polished UI. Just to clarify, if I wasn't concerned with budget and had to pick a product today, I'd still go with IDA, but the mindshare among new hires and interns is swinging pretty rapidly towards Ghidra. If they are able to continue adding features (with US government funding, and open source development), IDA is right to be worried about whether they will still be the best choice in 5 years.
- ylk 4y ago
  It’s not r2 or ghidra, but binary ninja has signature libraries: “The matching algorithm is inspired by FLIRT, which was designed with similar requirements in mind.” https://binary.ninja/2020/03/11/signature-libraries.html https://binary.ninja/2020/03/11/signature-libraries.html
- deroad 4y ago
  Rizin (and Cutter) does fully support FLIRT. You can create and load them, we also provide sigdb which is a collection of FLIRT files created by us (and yes, they are 100% compatible with IDA if you ever want to use them). - https://github.com/rizinorg/cutter/releases/tag/v2.1.0 https://github.com/rizinorg/cutter/releases/tag/v2.1.0 - https://github.com/rizinorg/rizin/releases/tag/v0.4.0 https://github.com/rizinorg/rizin/releases/tag/v0.4.0 - https://github.com/rizinorg/sigdb https://github.com/rizinorg/sigdb beware that these are not the latest versions.
  - rjzzleep 4y ago
    Fantastic. So Rizin is a more active fork of r2 + iaito?
    - deroad 4y ago
      can't speak for r2, but we are definetely active. The project github page has better details :) But as far as i know rizin is the only tool capable to fully support flirt, and i would love to extend the support even more (and obviously add more features) in both tools (rizin & cutter).
- grzaks 4y ago
  > I think there are a lot of people that would like to pay for IDA but can't get it. Many years ago we wanted to buy IDA Pro license and were quickly declined because we had whois privacy protection enabled on our domain.
- TheAdamist 4y ago
  Ghidra has function id databases, but only ships with signatures for relatively modern visual studio. You can create your own signature databases, although i have been unsuccessful in my brief attempts. The algorithm is different from flirt though. Its roughly, mask a bunch of stuff (relocations, etc), and hash whats left. There is some parent/child analysis for ambiguous calls i believe. My recollection is flirt also masks its version of a bunch of stuff, but builds a trie of the first xx bytes with some provision for needed values past that, and some parent child analysis. They have a paper on the algorithm you can google. Ida ships with more signatures out of the box, In my experience. Although i havent seen them listed anywhere.
Test0129 4y ago
I am not going to hold my breath on extending their hobbyist offerings. I own a copy of IDA (legally). It was an absolute pain to purchase and it seems that a large portion of their margins are dedicated to piracy control. I won't detail the process...but it seems unusually personal. If I had to guess they will expand their decompilers (the actual flagship project). It will be years before Ghidra + a community catch up to them and Binary Ninja (I also own a copy of it) may never. The disassembler is just a familiar tool. Their decompilers are way, way far ahead.
- tralarpa 4y ago
  > It will be years before Ghidra Can you elaborate? I would really like to see what the HexRay decompiler does better (or worse) than Ghidra, but I am too poor to buy it (and dogbolt.org is not interactive, so I cannot edit function signatures to "help" the decompiler etc.). Is it better in general, for a specific programming language or platform (e.g. C++, Windows), or for a specific use case (e.g. obfuscated code)? I heard about their cloud-based stuff, although I don't know what they are exactly doing there. Maybe ML trained on source code? Function signatures of the latest malware? After several hundred hours with Ghidra, I think it certainly would need some polishing, in particular: - UI. Too many frequently-used dialogs are not optimized for keyboard usage. - Decompiler too stubborn sometimes, ignoring user input (e.g. manually specified types). - Decompiler needs better heuristics for the treatment of some common cases (e.g., often doesn't recognize for-loops and array accesses) - Quite dangerous: Sometimes the decompiler gets lost, especially if a function contains handwritten assembly code with unusual control flows. Okay, can happen. But instead of displaying a warning it just shows you the part it could decompile and you have to figure out by yourself that something is missing. But most of the above issues are fixable. Instead, I would be interested in learning about more fundamental differences between the two decompilers.
  - roblabla 4y ago
    > - Decompiler too stubborn sometimes, ignoring user input (e.g. manually specified types). This is the thing that sticks out the most IMO. IDA decompiler is quite a bit more flexible than Ghidra's. When you assert a type, it will usually not ignore it. It may sometime get a bit lost if you give conflicting types to dependant variables, but otherwise, it's pretty good at this. One of the annoying bits of ghidra (though it may have improved, it's been around a year since I last used it) is that there's no way to "split" a variable. Sometimes, ghidra will have some code that looks roughly like: int x; x = 0; doSomething(x); x = 1; doSomething2(x); (Obviously, really simplified). The problem is, sometimes, x needs to be an int for the first function, and a bitflag structure for the second. But Ghidra has no way to say, "hey, from this assignment on, treat `x` as another variable", so you have to either generate a union (ugly) or deal with sending the wrong type (also ugly). IDA tends to be much better at this. All variables start out as "split" as it can make it (almost in static single assignment form). Then, the user can tell it "Those two variables are actually the same, please treat them as one". I find this flow works really, really well.
batch12 4y ago
I have forced myself to move to other tools like Ghidra, x32dbg, ollydbg, etc. I haven't settled yet on a perfect workflow, but I have found that most of my needs are met without having to launch IDA nowadays.
- throwup 4y ago
  Hasn't ollydbg development stalled? What do you use it for that x64dbg can't also do?
crote 4y ago
There have been acquired by a venture capital investor, and the press release mainly focuses on their rapid growth and "extraordinary margins". I think it is safe to assume that offering cheaper products will be the last thing they are going to do.
- wongarsu 4y ago
  They can have growth and huge margins by offering students a free license that has to be renewed yearly, the way Tableau does; or by giving 80-90% student discounts the way Adobe did before they switched to subscriptions. But then again those take time to show their benefit, and they probably make piracy easier.
dwheeler 4y ago
> The general sentiment I have seen among people doing SRE is that IDA is rapidly losing market share to Ghidra. While it excels in some areas, the licenses are pricy even for tech employers, and entirely out of reach for students or colleges. It's hard to convince an employer to fork out cash for IDA licenses when new employees are asking to use Ghidra, because that's what they use at home and at school. I don't have formal data, but in my narrow slice of the world that's what I'm seeing as well. IDA's price is so high that it's easy to justify using Ghidra instead. Heck, if Ghidra does something less well, it might be cheaper to pay to improve Ghidra (and then you can use those improvements forever). I encourage organizations who are thinking of using Ghidra to contribute back to it; if those improvements get integrated back in, then those improvements will continue into the future along with other improvements.
- bitexploder 4y ago
  Ghidra is just better overall now. Full stop. IDA still does some things better, but Ghidra is a great tool and most people still on IDA are there because of their existing tooling, scripts, and experience with the software. Starting from scratch, Ghidra would win. Been using IDA for like 16 years now.
  - Beached 4y ago
    ooof, ghidra is great because it is free and works, but I wouldn't call it better. I'd still choose ida or binja over ghidra for work. IDC about license cost, I care about ease of use, and binja wins on ease of use for me (and. alot of people I talk to)
    - rjzzleep 4y ago
      I think a lot of the people that say how much better ghidra is, just started reversing and use the decompiler a lot. The workflow and UX of IDA is so much better. I guess there are a lot of people that just click around in the UI but for a keyboard based workflow, Ghidra has a lot of catching up to do even to IDA 4.x.
maldev 4y ago
There's also competitors like Binary Ninja. Ida is best at Mac/ios and Windows by far though, so it's still used in those spaces alot. But for embeded, linux and whatever else, Ghidra/Binja are good enough that employers literally won't buy it anymore and are refusing it to senior engineers and telling them to use something else.
- macjohnmcc 4y ago
  I love IDA but it is too rich for my blood so I have gone with Binary Ninja. Not perfect but continually evolving.

rjzzleep 4y ago

For me I got the Company I was contracting for to buy me an IDA license and as I was trying to take over from there Hexrays never responded to any requests. I'm guessing that I'm on the same pirate blacklist that a lot of people landed. I guess I should have expensed it instead of having the Company buy it. I was the only person doing RE work, it was a single user person license and I was also the only linux user out of that 300 people org. I think there are a lot of people that would like to pay for IDA but can't get it. On the other hand I really don't like the Ghidra user experience. Is there something similar to FLIRT in r2 or ghidra?

pseudo0 4y ago
I don't think Ghidra has a proper FLIRT equivalent yet. That's one of those bells and whistles that may (or may not) be worth the license fee, along with in my opinion a more polished UI. Just to clarify, if I wasn't concerned with budget and had to pick a product today, I'd still go with IDA, but the mindshare among new hires and interns is swinging pretty rapidly towards Ghidra. If they are able to continue adding features (with US government funding, and open source development), IDA is right to be worried about whether they will still be the best choice in 5 years.
ylk 4y ago
It’s not r2 or ghidra, but binary ninja has signature libraries: “The matching algorithm is inspired by FLIRT, which was designed with similar requirements in mind.” https://binary.ninja/2020/03/11/signature-libraries.html https://binary.ninja/2020/03/11/signature-libraries.html
deroad 4y ago
Rizin (and Cutter) does fully support FLIRT. You can create and load them, we also provide sigdb which is a collection of FLIRT files created by us (and yes, they are 100% compatible with IDA if you ever want to use them). - https://github.com/rizinorg/cutter/releases/tag/v2.1.0 https://github.com/rizinorg/cutter/releases/tag/v2.1.0 - https://github.com/rizinorg/rizin/releases/tag/v0.4.0 https://github.com/rizinorg/rizin/releases/tag/v0.4.0 - https://github.com/rizinorg/sigdb https://github.com/rizinorg/sigdb beware that these are not the latest versions.
- rjzzleep 4y ago
  Fantastic. So Rizin is a more active fork of r2 + iaito?
  - deroad 4y ago
    can't speak for r2, but we are definetely active. The project github page has better details :) But as far as i know rizin is the only tool capable to fully support flirt, and i would love to extend the support even more (and obviously add more features) in both tools (rizin & cutter).
grzaks 4y ago
> I think there are a lot of people that would like to pay for IDA but can't get it. Many years ago we wanted to buy IDA Pro license and were quickly declined because we had whois privacy protection enabled on our domain.
TheAdamist 4y ago
Ghidra has function id databases, but only ships with signatures for relatively modern visual studio. You can create your own signature databases, although i have been unsuccessful in my brief attempts. The algorithm is different from flirt though. Its roughly, mask a bunch of stuff (relocations, etc), and hash whats left. There is some parent/child analysis for ambiguous calls i believe. My recollection is flirt also masks its version of a bunch of stuff, but builds a trie of the first xx bytes with some provision for needed values past that, and some parent child analysis. They have a paper on the algorithm you can google. Ida ships with more signatures out of the box, In my experience. Although i havent seen them listed anywhere.

Test0129 4y ago

I am not going to hold my breath on extending their hobbyist offerings. I own a copy of IDA (legally). It was an absolute pain to purchase and it seems that a large portion of their margins are dedicated to piracy control. I won't detail the process...but it seems unusually personal. If I had to guess they will expand their decompilers (the actual flagship project). It will be years before Ghidra + a community catch up to them and Binary Ninja (I also own a copy of it) may never. The disassembler is just a familiar tool. Their decompilers are way, way far ahead.

tralarpa 4y ago
> It will be years before Ghidra Can you elaborate? I would really like to see what the HexRay decompiler does better (or worse) than Ghidra, but I am too poor to buy it (and dogbolt.org is not interactive, so I cannot edit function signatures to "help" the decompiler etc.). Is it better in general, for a specific programming language or platform (e.g. C++, Windows), or for a specific use case (e.g. obfuscated code)? I heard about their cloud-based stuff, although I don't know what they are exactly doing there. Maybe ML trained on source code? Function signatures of the latest malware? After several hundred hours with Ghidra, I think it certainly would need some polishing, in particular: - UI. Too many frequently-used dialogs are not optimized for keyboard usage. - Decompiler too stubborn sometimes, ignoring user input (e.g. manually specified types). - Decompiler needs better heuristics for the treatment of some common cases (e.g., often doesn't recognize for-loops and array accesses) - Quite dangerous: Sometimes the decompiler gets lost, especially if a function contains handwritten assembly code with unusual control flows. Okay, can happen. But instead of displaying a warning it just shows you the part it could decompile and you have to figure out by yourself that something is missing. But most of the above issues are fixable. Instead, I would be interested in learning about more fundamental differences between the two decompilers.
- roblabla 4y ago
  > - Decompiler too stubborn sometimes, ignoring user input (e.g. manually specified types). This is the thing that sticks out the most IMO. IDA decompiler is quite a bit more flexible than Ghidra's. When you assert a type, it will usually not ignore it. It may sometime get a bit lost if you give conflicting types to dependant variables, but otherwise, it's pretty good at this. One of the annoying bits of ghidra (though it may have improved, it's been around a year since I last used it) is that there's no way to "split" a variable. Sometimes, ghidra will have some code that looks roughly like: int x; x = 0; doSomething(x); x = 1; doSomething2(x); (Obviously, really simplified). The problem is, sometimes, x needs to be an int for the first function, and a bitflag structure for the second. But Ghidra has no way to say, "hey, from this assignment on, treat `x` as another variable", so you have to either generate a union (ugly) or deal with sending the wrong type (also ugly). IDA tends to be much better at this. All variables start out as "split" as it can make it (almost in static single assignment form). Then, the user can tell it "Those two variables are actually the same, please treat them as one". I find this flow works really, really well.

batch12 4y ago

I have forced myself to move to other tools like Ghidra, x32dbg, ollydbg, etc. I haven't settled yet on a perfect workflow, but I have found that most of my needs are met without having to launch IDA nowadays.

throwup 4y ago
Hasn't ollydbg development stalled? What do you use it for that x64dbg can't also do?

crote 4y ago

There have been acquired by a venture capital investor, and the press release mainly focuses on their rapid growth and "extraordinary margins". I think it is safe to assume that offering cheaper products will be the last thing they are going to do.

wongarsu 4y ago
They can have growth and huge margins by offering students a free license that has to be renewed yearly, the way Tableau does; or by giving 80-90% student discounts the way Adobe did before they switched to subscriptions. But then again those take time to show their benefit, and they probably make piracy easier.

dwheeler 4y ago

> The general sentiment I have seen among people doing SRE is that IDA is rapidly losing market share to Ghidra. While it excels in some areas, the licenses are pricy even for tech employers, and entirely out of reach for students or colleges. It's hard to convince an employer to fork out cash for IDA licenses when new employees are asking to use Ghidra, because that's what they use at home and at school. I don't have formal data, but in my narrow slice of the world that's what I'm seeing as well. IDA's price is so high that it's easy to justify using Ghidra instead. Heck, if Ghidra does something less well, it might be cheaper to pay to improve Ghidra (and then you can use those improvements forever). I encourage organizations who are thinking of using Ghidra to contribute back to it; if those improvements get integrated back in, then those improvements will continue into the future along with other improvements.

bitexploder 4y ago
Ghidra is just better overall now. Full stop. IDA still does some things better, but Ghidra is a great tool and most people still on IDA are there because of their existing tooling, scripts, and experience with the software. Starting from scratch, Ghidra would win. Been using IDA for like 16 years now.
- Beached 4y ago
  ooof, ghidra is great because it is free and works, but I wouldn't call it better. I'd still choose ida or binja over ghidra for work. IDC about license cost, I care about ease of use, and binja wins on ease of use for me (and. alot of people I talk to)
  - rjzzleep 4y ago
    I think a lot of the people that say how much better ghidra is, just started reversing and use the decompiler a lot. The workflow and UX of IDA is so much better. I guess there are a lot of people that just click around in the UI but for a keyboard based workflow, Ghidra has a lot of catching up to do even to IDA 4.x.

maldev 4y ago

There's also competitors like Binary Ninja. Ida is best at Mac/ios and Windows by far though, so it's still used in those spaces alot. But for embeded, linux and whatever else, Ghidra/Binja are good enough that employers literally won't buy it anymore and are refusing it to senior engineers and telling them to use something else.

macjohnmcc 4y ago
I love IDA but it is too rich for my blood so I have gone with Binary Ninja. Not perfect but continually evolving.