Live data from Hacker News

IDA cybersecurity software provider Hex-Rays acquired

smartfinvc.com

71–80 of 116 posts

Re: IDA cybersecurity software provider Hex-Rays acquired

#71
post #8

Hopefully this works out for Hex-Rays, allowing them to invest more into developing IDA and expanding their low-cost product offerings. The general sentiment I have seen among people doing SRE is that IDA is rapidly losing market share to Ghidra. While it excels in some areas, the licenses are pricy even for tech employers, and entirely out of reach for students or colleges. It's hard to convince an employer to fork…

> The general sentiment I have seen among people doing SRE is that IDA is rapidly losing market share to Ghidra. While it excels in some areas, the licenses are pricy even for tech employers, and entirely out of reach for students or colleges. It's hard to convince an employer to fork out cash for IDA licenses when new employees are asking to use Ghidra, because that's what they use at home and at school.

I don't have formal data, but in my narrow slice of the world that's what I'm seeing as well.

IDA's price is so high that it's easy to justify using Ghidra instead. Heck, if Ghidra does something less well, it might be cheaper to pay to improve Ghidra (and then you can use those improvements forever). I encourage organizations who are thinking of using Ghidra to contribute back to it; if those improvements get integrated back in, then those improvements will continue into the future along with other improvements.

Re: IDA cybersecurity software provider Hex-Rays acquired

#72
post #64
post #8

Hopefully this works out for Hex-Rays, allowing them to invest more into developing IDA and expanding their low-cost product offerings. The general sentiment I have seen among people doing SRE is that IDA is rapidly losing market share to Ghidra. While it excels in some areas, the licenses are pricy even for tech employers, and entirely out of reach for students or colleges. It's hard to convince an employer to fork…

There have been acquired by a venture capital investor, and the press release mainly focuses on their rapid growth and "extraordinary margins". I think it is safe to assume that offering cheaper products will be the last thing they are going to do.

They can have growth and huge margins by offering students a free license that has to be renewed yearly, the way Tableau does; or by giving 80-90% student discounts the way Adobe did before they switched to subscriptions.

But then again those take time to show their benefit, and they probably make piracy easier.

Re: IDA cybersecurity software provider Hex-Rays acquired

#73

Earlier quoted context omitted.

I am not going to hold my breath on extending their hobbyist offerings. I own a copy of IDA (legally). It was an absolute pain to purchase and it seems that a large portion of their margins are dedicated to piracy control. I won't detail the process...but it seems unusually personal. If I had to guess they will expand their decompilers (the actual flagship project). It will be years before Ghidra + a community catch…

> It was an absolute pain to purchase and it seems that a large portion of their margins are dedicated to piracy control I know what you mean. I tried to purchase it and got this email: Dear Sir/Madam, Thank you for your order. Please could you send a copy of your passport and fill out the attached form? Our compliance policy now requires this. Many thanks Hex-Rays SA I used a cracked copy after that.

It used to be worse under Pierre. His personal mission in life was to make sure no one dodgy ever got a license and to hunt down every possible source of a cracked copy. My manager had purchased a license for me because it was cheap enough that he could approve it… a year later I tried to renew by emailing Pierre about it. He never replied, instead he contacted my manager to tell him that the license was being pirated and blah blah blah. Was very annoying to sort out.

Re: IDA cybersecurity software provider Hex-Rays acquired

#74
post #70

Not sure why Hex-Rays spends so much time fighting piracy and making the purchase a very complicated process, it's a lost battle, there will always be pirated copy of IDA, stop fighting it and embrace it to make a better offering.

For reference, I downloaded a cracked copy off TPB (or some such place) when I was in high school for reversing video games, and I've never seen a legitimate reason to upgrade or get a real license.

It's really a testament to the robustness of the software.

Re: IDA cybersecurity software provider Hex-Rays acquired

#75
post #70

Not sure why Hex-Rays spends so much time fighting piracy and making the purchase a very complicated process, it's a lost battle, there will always be pirated copy of IDA, stop fighting it and embrace it to make a better offering.

It seems like a completely senseless waste of their efforts, given the nature of the product they are selling and the user community who knows how to use such a thing.

Re: IDA cybersecurity software provider Hex-Rays acquired

#76

Earlier quoted context omitted.

> It will be years before Ghidra Can you elaborate? I would really like to see what the HexRay decompiler does better (or worse) than Ghidra, but I am too poor to buy it (and dogbolt.org is not interactive, so I cannot edit function signatures to "help" the decompiler etc.). Is it better in general, for a specific programming language or platform (e.g. C++, Windows), or for a specific use case (e.g. obfuscated code)?…

> - Decompiler too stubborn sometimes, ignoring user input (e.g. manually specified types). This is the thing that sticks out the most IMO. IDA decompiler is quite a bit more flexible than Ghidra's. When you assert a type, it will usually not ignore it. It may sometime get a bit lost if you give conflicting types to dependant variables, but otherwise, it's pretty good at this. One of the annoying bits of ghidra (thou…

In my experience, in Ghidra you can Ctrl+L to mark a variable as a different type, but retyping or renaming sometimes fails because it creates a HASH variable which sometimes fails to apply to the decompiler output (instead creating a new variable of the right type but the code still references the old wrong one).

Also can I haz offset pointers pretty please? It's not in the last released version I tried, and the last Git version I tried had offset pointers but they didn't affect decompiler output so multiple inheritance and container_of linked lists still came out broken.

Re: IDA cybersecurity software provider Hex-Rays acquired

#77
post #75
post #70

Not sure why Hex-Rays spends so much time fighting piracy and making the purchase a very complicated process, it's a lost battle, there will always be pirated copy of IDA, stop fighting it and embrace it to make a better offering.

It seems like a completely senseless waste of their efforts, given the nature of the product they are selling and the user community who knows how to use such a thing.

Indeed, I still remember when it was a "rite of passage" to crack IDA yourself.

Re: IDA cybersecurity software provider Hex-Rays acquired

#78
post #8

Hopefully this works out for Hex-Rays, allowing them to invest more into developing IDA and expanding their low-cost product offerings. The general sentiment I have seen among people doing SRE is that IDA is rapidly losing market share to Ghidra. While it excels in some areas, the licenses are pricy even for tech employers, and entirely out of reach for students or colleges. It's hard to convince an employer to fork…

> The general sentiment I have seen among people doing SRE is that IDA is rapidly losing market share to Ghidra. While it excels in some areas, the licenses are pricy even for tech employers, and entirely out of reach for students or colleges. It's hard to convince an employer to fork out cash for IDA licenses when new employees are asking to use Ghidra, because that's what they use at home and at school. I don't hav…

Ghidra is just better overall now. Full stop. IDA still does some things better, but Ghidra is a great tool and most people still on IDA are there because of their existing tooling, scripts, and experience with the software. Starting from scratch, Ghidra would win. Been using IDA for like 16 years now.

Re: IDA cybersecurity software provider Hex-Rays acquired

#79

Earlier quoted context omitted.

I am not going to hold my breath on extending their hobbyist offerings. I own a copy of IDA (legally). It was an absolute pain to purchase and it seems that a large portion of their margins are dedicated to piracy control. I won't detail the process...but it seems unusually personal. If I had to guess they will expand their decompilers (the actual flagship project). It will be years before Ghidra + a community catch…

> It will be years before Ghidra Can you elaborate? I would really like to see what the HexRay decompiler does better (or worse) than Ghidra, but I am too poor to buy it (and dogbolt.org is not interactive, so I cannot edit function signatures to "help" the decompiler etc.). Is it better in general, for a specific programming language or platform (e.g. C++, Windows), or for a specific use case (e.g. obfuscated code)?…

Sure, the thing about decompilation is it's by nature taking lossy data and trying to turn it into something that is almost lossless. The working theory of most decompilers, including Ghidra's, is to have a base level of "translation" ability between asm and C (for example). However, there's a ton of stuff that is missed in this base level. Every compiler speaks it's own dialect of assembly, and different compilers prefer different optimizations, code removal, etc as a strategy. As a result a good decompiler also includes heuristics that are expensive to create and learn about. Hex Rays has dedicated an entire company to finding these heuristics in many compilers across many platforms. This isn't knowledge that is easy to acquire or maintain. I think that Ghidra has the right sauce to do it (a large community) but it will be a while before that community can organically produce the same results.

Due to these heuristics IDA produces real actionable code quicker. My experience with Ghidra (less than yours) is that it produces mostly garbage on a lot of different things and it requires a lot of prep work to make truly usable. This might not be noticeable on small or simple binaries but on larger binaries it actually becomes a real measurable problem. While Hex Rays isn't perfect, it's about as close as we can come to it right now and it generates very human-looking code with smart optimization removal. One thing I remember with Ghidra not long ago was a common optimization like using SSE registers for arrays would produce a page worth of non-sense for something simple. Additionally, detection of standard libraries still isn't good so you end up wasting your reversing time on re-reversing a different compilers version of strlen than actually doing the work you need to do. If you could use FLIRT signatures in Ghidra legally I'd imagine Ghidra would be vastly improved.

Re: IDA cybersecurity software provider Hex-Rays acquired

#80
post #70

Not sure why Hex-Rays spends so much time fighting piracy and making the purchase a very complicated process, it's a lost battle, there will always be pirated copy of IDA, stop fighting it and embrace it to make a better offering.

For reference, I downloaded a cracked copy off TPB (or some such place) when I was in high school for reversing video games, and I've never seen a legitimate reason to upgrade or get a real license. It's really a testament to the robustness of the software.

The people who worked on IDA should be teaching classes on development. I do not think I have ever encountered a single bug in my usage (obviously they exist as with almost any system of moderate complexity). It's just a rock solid application.
Post reply on HN