5 ms·

The original and the most powerful disassembler is IDA Pro. The project was started in the 90s and has been used for security analysis, antivirus work, protecti

by os_ 12y ago

The original and the most powerful disassembler is IDA Pro. The project was started in the 90s and has been used for security analysis, antivirus work, protection analysis/research, hacks as well as normal dev work in the closed-source ecosystems. https://www.hex-rays.com/products/ida/index.shtml https://www.hex-rays.com/products/ida/index.shtml The author has implemented a decompiler plugin over the top of IDA and it works on the real-world code. The point here is to annotate the disassembly bottom-up and then decompile. https://www.hex-rays.com/products/decompiler/index.shtml https://www.hex-rays.com/products/decompiler/index.shtml I don't want to bash the author of Snowman - this kind of research is serious fun. Yet, IDA has an insane lead.

pjmlp 12y ago
IDA was not the first one. There have been a few others since the 80's.
- os_ 12y ago
  AFAIK it was the first one that got the model right. The only other one I remember is Sourcer (sr) for MS-DOS.
  - jacquesm 12y ago
    Sourcerer iirc. Purple floppy.
DigitalJack 12y ago
It's also expensive. I'm sure it's worth it from all I've heard, but it's unlikely I'll ever have the money for hobby work.
- os_ 12y ago
  Right, both products are expensive. I get them through work (for work). You can get the free (and very limited) version of IDA for hobby stuff: https://www.hex-rays.com/products/ida/support/download_freeware.shtml https://www.hex-rays.com/products/ida/support/download_freew...
  - wolfgke 12y ago
    Unluckily, e.g. support for ARM or x86-64 is missing from the free version (while I have no problem with the disallowance of commercial use - if I really made money with it, of course I'd pay).
- tptacek 12y ago
  For what IDA does, it's incredibly inexpensive, so much so that it's distorted the market for reverse engineering tools. Consider that people who use IDA on a day-to-day basis have $250/hr+ bill rates, and if they use IDA, they rely on it. Meanwhile, the set of people who use IDA on a day-to-day basis is very small relative to the whole industry. I'm not saying you should buy IDA, just that I think IDA is severely mispriced.
  - os_ 12y ago
    I hear you. For the sake of completeness, here is the other side of the argument from students that use IDA for reverse engineering. Those activities are really about cracking freemium/shareware apps and the associated subculture is a little... well... special. I have heard countless times that IDA should cost $200 and the author should work with the community to improve the tool... My stance is that the tool is very specialized, unique and the cost is reasonable for professional usecases.
    - tptacek 12y ago
      I know I'm repeating myself here, but I want to make sure I communicate this: IDA's price is so low that it actually harms the market for professional reverse engineering tools. Most useful products you can build --- tracers, visualizers, emulators, pattern matchers, debuggers --- fit into IDA's orbit. As products, as "feature/function/benefit" statements, they are subsets of IDA. But they're chained down by IDA's price. Just like IDA, they have to serve a small market of users who make tens of thousands of dollars per week using the tools, but the market optics make it hard to charge even a significant fraction of the (low) total cost of IDA. It's sort of hilarious to me to see what Hopper is doing to the market. "Ruining it entirely" wouldn't be far from the truth. I'm only sort of complaining. Viscerally, I'm thrilled that Hopper exists.
      - duckingtest 12y ago
        Who is making tens of thousands per week? Outside of selling exploits to government agencies or cybercrime. Or is that what you meant? AV jobs pay shit.
- makomk 12y ago
  It's unlikely they'd let you license it for hobby work; last I heard they're very restrictive about who they're willing to license it to in order to prevent pirate copies leaking.
  - mmastrac 12y ago
    Definitely not true. I know of someone who licensed it personally for a hobby, without a corporation.
tptacek 12y ago
IDA is great, but for day-to-day work, especially if you're casual, Hopper is a really strong contender, and it's (amazingly) even cheaper than IDA. Hopper also was designed from the get-go to have a first-class Python interface, and it includes a workable decompiler.

by os_ 12y ago

pjmlp 12y ago

IDA was not the first one. There have been a few others since the 80's.

os_ 12y ago
AFAIK it was the first one that got the model right. The only other one I remember is Sourcer (sr) for MS-DOS.
- jacquesm 12y ago
  Sourcerer iirc. Purple floppy.

DigitalJack 12y ago

It's also expensive. I'm sure it's worth it from all I've heard, but it's unlikely I'll ever have the money for hobby work.

os_ 12y ago
Right, both products are expensive. I get them through work (for work). You can get the free (and very limited) version of IDA for hobby stuff: https://www.hex-rays.com/products/ida/support/download_freeware.shtml https://www.hex-rays.com/products/ida/support/download_freew...
- wolfgke 12y ago
  Unluckily, e.g. support for ARM or x86-64 is missing from the free version (while I have no problem with the disallowance of commercial use - if I really made money with it, of course I'd pay).
tptacek 12y ago
For what IDA does, it's incredibly inexpensive, so much so that it's distorted the market for reverse engineering tools. Consider that people who use IDA on a day-to-day basis have $250/hr+ bill rates, and if they use IDA, they rely on it. Meanwhile, the set of people who use IDA on a day-to-day basis is very small relative to the whole industry. I'm not saying you should buy IDA, just that I think IDA is severely mispriced.
- os_ 12y ago
  I hear you. For the sake of completeness, here is the other side of the argument from students that use IDA for reverse engineering. Those activities are really about cracking freemium/shareware apps and the associated subculture is a little... well... special. I have heard countless times that IDA should cost $200 and the author should work with the community to improve the tool... My stance is that the tool is very specialized, unique and the cost is reasonable for professional usecases.
  - tptacek 12y ago
    I know I'm repeating myself here, but I want to make sure I communicate this: IDA's price is so low that it actually harms the market for professional reverse engineering tools. Most useful products you can build --- tracers, visualizers, emulators, pattern matchers, debuggers --- fit into IDA's orbit. As products, as "feature/function/benefit" statements, they are subsets of IDA. But they're chained down by IDA's price. Just like IDA, they have to serve a small market of users who make tens of thousands of dollars per week using the tools, but the market optics make it hard to charge even a significant fraction of the (low) total cost of IDA. It's sort of hilarious to me to see what Hopper is doing to the market. "Ruining it entirely" wouldn't be far from the truth. I'm only sort of complaining. Viscerally, I'm thrilled that Hopper exists.
    - duckingtest 12y ago
      Who is making tens of thousands per week? Outside of selling exploits to government agencies or cybercrime. Or is that what you meant? AV jobs pay shit.
makomk 12y ago
It's unlikely they'd let you license it for hobby work; last I heard they're very restrictive about who they're willing to license it to in order to prevent pirate copies leaking.
- mmastrac 12y ago
  Definitely not true. I know of someone who licensed it personally for a hobby, without a corporation.

tptacek 12y ago

IDA is great, but for day-to-day work, especially if you're casual, Hopper is a really strong contender, and it's (amazingly) even cheaper than IDA. Hopper also was designed from the get-go to have a first-class Python interface, and it includes a workable decompiler.