IDA cybersecurity software provider Hex-Rays acquired • Hacker News Board

Re: IDA cybersecurity software provider Hex-Rays acquired

#51

Post by q-big » Wed, Oct 19, 2022, 9:29 AM UTC

tptacek wrote: post #21

pseudo0 wrote: post #20

Earlier quoted context omitted.

Around $3k for a one year floating license, then $4k per architecture, at least according to this price list: https://www.componentsource.com/product/ida-pro-hex-rays-dec...

That's for floating licenses, though, which are like 2x the price of the fixed and named licenses, right? IDA has a problem where, for some shops, it really makes sense to just have one concurrent IDA user, because IDA is like 10-15% of the work hours --- but it's a critically important 10-15%. So they're super careful to charge for the ability to rotate a team of consultants through the same IDA license. We had a cl…

> You can have the very best decompiler in the world and you're still going to be a rounding error compared to companies like Figma, because (1) not that many people use disassemblers

(1) could be changed by making a decent offer to hobbyists that they can't refuse, and making the buying experience for them hassle-free.

Re: IDA cybersecurity software provider Hex-Rays acquired

#52

Post by sirsinsalot » Wed, Oct 19, 2022, 9:43 AM UTC

rfoo wrote: post #50

saagarjha wrote: post #33

Earlier quoted context omitted.

Right, but if you want that MacBook you call up Apple and they will ship you those computers tomorrow, hassle-free, and you can hand those laptops to any of your employees without someone harassing you for how you're doing licensing. For large companies the issue isn't even the cost but the annoyance. Like, the employees who use those IDA licenses are paid pretty well…annoyances you put in the path of them getting ID…

It's hilarious that pirating a (DRM-less!) software is much easier than purchasing it. Even if you had the money and really want to buy it.

The pirates probably used a pirated IDA to pirate it

Re: IDA cybersecurity software provider Hex-Rays acquired

#53

Post by TheAdamist » Wed, Oct 19, 2022, 10:04 AM UTC

rjzzleep wrote: post #10

pseudo0 wrote: post #8

Hopefully this works out for Hex-Rays, allowing them to invest more into developing IDA and expanding their low-cost product offerings. The general sentiment I have seen among people doing SRE is that IDA is rapidly losing market share to Ghidra. While it excels in some areas, the licenses are pricy even for tech employers, and entirely out of reach for students or colleges. It's hard to convince an employer to fork…

For me I got the Company I was contracting for to buy me an IDA license and as I was trying to take over from there Hexrays never responded to any requests. I'm guessing that I'm on the same pirate blacklist that a lot of people landed. I guess I should have expensed it instead of having the Company buy it. I was the only person doing RE work, it was a single user person license and I was also the only linux user out…

Ghidra has function id databases, but only ships with signatures for relatively modern visual studio.

You can create your own signature databases, although i have been unsuccessful in my brief attempts.

The algorithm is different from flirt though.

Its roughly, mask a bunch of stuff (relocations, etc), and hash whats left. There is some parent/child analysis for ambiguous calls i believe.

My recollection is flirt also masks its version of a bunch of stuff, but builds a trie of the first xx bytes with some provision for needed values past that, and some parent child analysis. They have a paper on the algorithm you can google.

Ida ships with more signatures out of the box, In my experience. Although i havent seen them listed anywhere.

Re: IDA cybersecurity software provider Hex-Rays acquired

#54

Post by tralarpa » Wed, Oct 19, 2022, 10:06 AM UTC

Test0129 wrote: post #26

pseudo0 wrote: post #8

Hopefully this works out for Hex-Rays, allowing them to invest more into developing IDA and expanding their low-cost product offerings. The general sentiment I have seen among people doing SRE is that IDA is rapidly losing market share to Ghidra. While it excels in some areas, the licenses are pricy even for tech employers, and entirely out of reach for students or colleges. It's hard to convince an employer to fork…

I am not going to hold my breath on extending their hobbyist offerings. I own a copy of IDA (legally). It was an absolute pain to purchase and it seems that a large portion of their margins are dedicated to piracy control. I won't detail the process...but it seems unusually personal. If I had to guess they will expand their decompilers (the actual flagship project). It will be years before Ghidra + a community catch…

> It will be years before Ghidra

Can you elaborate? I would really like to see what the HexRay decompiler does better (or worse) than Ghidra, but I am too poor to buy it (and dogbolt.org is not interactive, so I cannot edit function signatures to "help" the decompiler etc.).

Is it better in general, for a specific programming language or platform (e.g. C++, Windows), or for a specific use case (e.g. obfuscated code)? I heard about their cloud-based stuff, although I don't know what they are exactly doing there. Maybe ML trained on source code? Function signatures of the latest malware?

After several hundred hours with Ghidra, I think it certainly would need some polishing, in particular:

  - UI. Too many frequently-used dialogs are not optimized for keyboard usage.
  - Decompiler too stubborn sometimes, ignoring user input (e.g. manually specified types).
  - Decompiler needs better heuristics for the treatment of some common cases (e.g., often doesn't recognize for-loops and array accesses)
  - Quite dangerous: Sometimes the decompiler gets lost, especially if a function contains handwritten assembly code with unusual control flows. Okay, can happen. But instead of displaying a warning it just shows you the part it could decompile and you have to figure out by yourself that something is missing.

But most of the above issues are fixable. Instead, I would be interested in learning about more fundamental differences between the two decompilers.

Re: IDA cybersecurity software provider Hex-Rays acquired

#55

Post by roblabla » Wed, Oct 19, 2022, 10:23 AM UTC

tralarpa wrote: post #54

Test0129 wrote: post #26

Earlier quoted context omitted.

I am not going to hold my breath on extending their hobbyist offerings. I own a copy of IDA (legally). It was an absolute pain to purchase and it seems that a large portion of their margins are dedicated to piracy control. I won't detail the process...but it seems unusually personal. If I had to guess they will expand their decompilers (the actual flagship project). It will be years before Ghidra + a community catch…

> It will be years before Ghidra Can you elaborate? I would really like to see what the HexRay decompiler does better (or worse) than Ghidra, but I am too poor to buy it (and dogbolt.org is not interactive, so I cannot edit function signatures to "help" the decompiler etc.). Is it better in general, for a specific programming language or platform (e.g. C++, Windows), or for a specific use case (e.g. obfuscated code)?…

> - Decompiler too stubborn sometimes, ignoring user input (e.g. manually specified types).

This is the thing that sticks out the most IMO. IDA decompiler is quite a bit more flexible than Ghidra's. When you assert a type, it will usually not ignore it. It may sometime get a bit lost if you give conflicting types to dependant variables, but otherwise, it's pretty good at this.

One of the annoying bits of ghidra (though it may have improved, it's been around a year since I last used it) is that there's no way to "split" a variable. Sometimes, ghidra will have some code that looks roughly like:

    int x;

    x = 0;
    doSomething(x);
    x = 1;
    doSomething2(x);

(Obviously, really simplified).

The problem is, sometimes, x needs to be an int for the first function, and a bitflag structure for the second. But Ghidra has no way to say, "hey, from this assignment on, treat `x` as another variable", so you have to either generate a union (ugly) or deal with sending the wrong type (also ugly).

IDA tends to be much better at this. All variables start out as "split" as it can make it (almost in static single assignment form). Then, the user can tell it "Those two variables are actually the same, please treat them as one". I find this flow works really, really well.

Re: IDA cybersecurity software provider Hex-Rays acquired

#56

Post by gnfargbl » Wed, Oct 19, 2022, 10:24 AM UTC

yakkityyak wrote: post #14

stolen_biscuit wrote: post #7

Does anyone know what impact if any the release of Ghidra had on Hex-Rays? IDA never really accommodated to the hobbyist, so I wonder did it have any impact on the commercial side of things apart from the IDA Home release?

I ended up buying Binary Ninja for hobbyist projects instead. Worked great for doing a bit of Gameboy Advance rom hacking. IDA Pro for ARM w/ a decompiler is the cost of a used car.

Hopper is worth a look, also: https://www.hopperapp.com/. Very reasonably priced.

Re: IDA cybersecurity software provider Hex-Rays acquired

#57

Post by super256 » Wed, Oct 19, 2022, 10:38 AM UTC

stolen_biscuit wrote: post #7

Does anyone know what impact if any the release of Ghidra had on Hex-Rays? IDA never really accommodated to the hobbyist, so I wonder did it have any impact on the commercial side of things apart from the IDA Home release?

> Does anyone know what impact if any the release of Ghidra had on Hex-Rays?

They added an undo button to IDA.

Re: IDA cybersecurity software provider Hex-Rays acquired

#58

Post by tsujamin » Wed, Oct 19, 2022, 10:59 AM UTC

gnfargbl wrote: post #56

yakkityyak wrote: post #14

Earlier quoted context omitted.

I ended up buying Binary Ninja for hobbyist projects instead. Worked great for doing a bit of Gameboy Advance rom hacking. IDA Pro for ARM w/ a decompiler is the cost of a used car.

Hopper is worth a look, also: https://www.hopperapp.com/ . Very reasonably priced.

Hopper is my go-to for light reveng or macOS binaries, Ghidra for Windows mainly because you can refine your typing until the decompiler window becomes very readable.

as an aside - When I was taught Ghidra the trainer said "in IDA you spend most of your time in the disassembly graph, in Ghidra I rarely leave the decompiler"

Re: IDA cybersecurity software provider Hex-Rays acquired

#59

Post by super256 » Wed, Oct 19, 2022, 11:20 AM UTC

Test0129 wrote: post #26

pseudo0 wrote: post #8

Hopefully this works out for Hex-Rays, allowing them to invest more into developing IDA and expanding their low-cost product offerings. The general sentiment I have seen among people doing SRE is that IDA is rapidly losing market share to Ghidra. While it excels in some areas, the licenses are pricy even for tech employers, and entirely out of reach for students or colleges. It's hard to convince an employer to fork…

I am not going to hold my breath on extending their hobbyist offerings. I own a copy of IDA (legally). It was an absolute pain to purchase and it seems that a large portion of their margins are dedicated to piracy control. I won't detail the process...but it seems unusually personal. If I had to guess they will expand their decompilers (the actual flagship project). It will be years before Ghidra + a community catch…

> It was an absolute pain to purchase and it seems that a large portion of their margins are dedicated to piracy control

I know what you mean. I tried to purchase it and got this email:

  Dear Sir/Madam,

  Thank you for your order. Please could you send a copy of your passport and fill out the attached form? Our compliance policy now requires this.  
  Many thanks
  Hex-Rays SA

I used a cracked copy after that.

Re: IDA cybersecurity software provider Hex-Rays acquired

#60

Post by q3k » Wed, Oct 19, 2022, 11:21 AM UTC

roblabla wrote: post #55

tralarpa wrote: post #54

Earlier quoted context omitted.

> It will be years before Ghidra Can you elaborate? I would really like to see what the HexRay decompiler does better (or worse) than Ghidra, but I am too poor to buy it (and dogbolt.org is not interactive, so I cannot edit function signatures to "help" the decompiler etc.). Is it better in general, for a specific programming language or platform (e.g. C++, Windows), or for a specific use case (e.g. obfuscated code)?…

> - Decompiler too stubborn sometimes, ignoring user input (e.g. manually specified types). This is the thing that sticks out the most IMO. IDA decompiler is quite a bit more flexible than Ghidra's. When you assert a type, it will usually not ignore it. It may sometime get a bit lost if you give conflicting types to dependant variables, but otherwise, it's pretty good at this. One of the annoying bits of ghidra (thou…

> is that there's no way to "split" a variable

Right click -> “Split Out As New Variable”, but it seems like this doesn't work for stack reuse yet (just registers, or more generally, simple varnodes).

https://github.com/NationalSecurityAgency/ghidra/issues/2573