Live data from Hacker News

BinDiff now available for free

security.googleblog.com

11–20 of 35 posts

Re: BinDiff now available for free

#11
post #2

To be clear, it is still a plugin for a ~$5000 application. Nonetheless, thanks Google for lowering the bar for entry into professional security work!

From the article, it didn't appear that the decompiler was required, just the disassembler. IDA Pro disassembler (professional edition) is $1129. So it's somewhat less expensive. I wish Hopper (hopperapp.com) were more publicized; it's only $89!

If you cant splurge on IDA try radare2 before Hopper:

http://www.radare.org/r/cmp.html

Then in a couple weeks donate $89 saved to the radare2 efforts.

Re: BinDiff now available for free

#12
If you look at the EULA you'll see that free here means free as in no cost. It is still proprietary software and isn't considered "open source" by the OSI definition[2] even tho the page claims it's "open source".

[1] http://www.zynamics.com/eula.html [2] https://opensource.org/osd

Re: BinDiff now available for free

#13
post #5

Earlier quoted context omitted.

From the article, it didn't appear that the decompiler was required, just the disassembler. IDA Pro disassembler (professional edition) is $1129. So it's somewhat less expensive. I wish Hopper (hopperapp.com) were more publicized; it's only $89!

What's the Windows status there? I have looked at their web page many times and it's just confusing. The main description page says Mac only, a blog post from long ago says Windows is available (with some restrictions).

Version 2 of Hopper had a Windows version available, but with later versions it has been discontinued: https://twitter.com/bSr43/status/672185178236825601

Re: BinDiff now available for free

#19

This would have been news worthy 10 years ago. Today, it's more like shrug who cares. Dependency on IDA, closed source, limited platform support, Java/Swing ... Far better free solutions out there.

Serious question -- can you point to a better (or at least more free) recursive, graphical debugger for Windows than IDA?

Re: BinDiff now available for free

#20
post #6

Why is the linked site served over http? http://www.zynamics.com/software.html Changing to https reveals a security cert valid for *.google.com, but not for www.zynamics.com.

Interesting. I brought up a similar issue about what browser dot org and while they took months to get it working with HTTPS, I consider it a win.

Still interesting though. I'd just use a separate certificate for this. > www.zynamics.com uses an invalid security certificate. The certificate is only valid for the following names: .google.com, .android.com, .appengine.google.com, .cloud.google.com, .google-analytics.com, .google.ca, .google.cl, .google.co.in, .google.co.jp, .google.co.uk, .google.com.ar, .google.com.au, .google.com.br, .google.com.co, .google.com.mx, .google.com.tr, .google.com.vn, .google.de, .google.es, .google.fr, .google.hu, .google.it, .google.nl, .google.pl, .google.pt, .googleadapis.com, .googleapis.cn, .googlecommerce.com, .googlevideo.com, .gstatic.cn, .gstatic.com, .gvt1.com, .gvt2.com, .metric.gstatic.com, .urchin.com, .url.google.com, .youtube-nocookie.com, .youtube.com, .youtubeeducation.com, .ytimg.com, android.clients.google.com, android.com, g.co, goo.gl, google-analytics.com, google.com, googlecommerce.com, urchin.com, youtu.be, youtube.com, youtubeeducation.com Error code: SSL_ERROR_BAD_CERT_DOMAIN

Post reply on HN