Not sure why Hex-Rays spends so much time fighting piracy and making the purchase a very complicated process, it's a lost battle, there will always be pirated copy of IDA, stop fighting it and embrace it to make a better offering.
[deleted]
IDA cybersecurity software provider Hex-Rays acquired
91–100 of 116 posts
Re: IDA cybersecurity software provider Hex-Rays acquired
#92Earlier quoted context omitted.
> It will be years before Ghidra Can you elaborate? I would really like to see what the HexRay decompiler does better (or worse) than Ghidra, but I am too poor to buy it (and dogbolt.org is not interactive, so I cannot edit function signatures to "help" the decompiler etc.). Is it better in general, for a specific programming language or platform (e.g. C++, Windows), or for a specific use case (e.g. obfuscated code)?…
> - Decompiler too stubborn sometimes, ignoring user input (e.g. manually specified types). This is the thing that sticks out the most IMO. IDA decompiler is quite a bit more flexible than Ghidra's. When you assert a type, it will usually not ignore it. It may sometime get a bit lost if you give conflicting types to dependant variables, but otherwise, it's pretty good at this. One of the annoying bits of ghidra (thou…
This was my biggest frustration when first using Ghidra (granted, I didn't spend much time reading the documentation before diving in). Big thanks to the people responding to your comment with workarounds!
Re: IDA cybersecurity software provider Hex-Rays acquired
#93Earlier quoted context omitted.
> It will be years before Ghidra Can you elaborate? I would really like to see what the HexRay decompiler does better (or worse) than Ghidra, but I am too poor to buy it (and dogbolt.org is not interactive, so I cannot edit function signatures to "help" the decompiler etc.). Is it better in general, for a specific programming language or platform (e.g. C++, Windows), or for a specific use case (e.g. obfuscated code)?…
Sure, the thing about decompilation is it's by nature taking lossy data and trying to turn it into something that is almost lossless. The working theory of most decompilers, including Ghidra's, is to have a base level of "translation" ability between asm and C (for example). However, there's a ton of stuff that is missed in this base level. Every compiler speaks it's own dialect of assembly, and different compilers p…
My PhD work is about detecting standard library functions in obfuscated/stripped binaries. My most recent model gets about 70% accuracy for a handful of musl-linux-x64 functions. No signatures, just machine learning and disassembly from r2.
I'm not a reverse engineer, but I have been working on this with the assumption that it would be a good time-saver for a reverse engineer. Feel free to DM me if you'd like to discuss.
Re: IDA cybersecurity software provider Hex-Rays acquired
#94Earlier quoted context omitted.
The people who worked on IDA should be teaching classes on development. I do not think I have ever encountered a single bug in my usage (obviously they exist as with almost any system of moderate complexity). It's just a rock solid application.
Their debugger used to be pretty buggy, just after the 5.0 or 5.1 release I'd crash it on a regular basis. More recent versions have improved this though and they offer some really slick features in the debugger than other tools can't even do.
I forget what version I started with, but I believe it was after 6.
Re: IDA cybersecurity software provider Hex-Rays acquired
#95Earlier quoted context omitted.
The people who worked on IDA should be teaching classes on development. I do not think I have ever encountered a single bug in my usage (obviously they exist as with almost any system of moderate complexity). It's just a rock solid application.
Structure editor sometimes bugs out and removes all items from the view, together with comments that serve as help text. The window is completely empty. Also this Python detection tool that needs to be executed prior the first run didn't support python 3.10 at some point -- they've did version detection based on the filename that detected 3.10 as 3.1 (windows9-style version detection). Not sure what's the case with r…
Those are just mere test. You must use IDA to RE itself to fix those bugs. Then you have truly earned the right to use IDA bug free. ;)
Re: IDA cybersecurity software provider Hex-Rays acquired
#96Earlier quoted context omitted.
ooof, ghidra is great because it is free and works, but I wouldn't call it better. I'd still choose ida or binja over ghidra for work. IDC about license cost, I care about ease of use, and binja wins on ease of use for me (and. alot of people I talk to)
I think a lot of the people that say how much better ghidra is, just started reversing and use the decompiler a lot. The workflow and UX of IDA is so much better. I guess there are a lot of people that just click around in the UI but for a keyboard based workflow, Ghidra has a lot of catching up to do even to IDA 4.x.
I've been doing RE work off and on for about twenty years. IDA is a solid tool with some really neat features[1], but the only reason I use it anymore is if I need to look at a binary that's for an architecture so obscure that Ghidra doesn't support it yet.
I like Ghidra's interface better, but I'm also not a keyboard-first type of user. I work with a lot of different OSes and software. I stopped trying to remember most keyboard shortcuts 10+ years ago, because there were too many variations, and the consequences of using the wrong one can be dire.
Releasing and open-sourcing Ghidra was a truly magnificent gift by the NSA, and I can't thank them enough for it.
[1] I'd love to see a Ghidra equivalent of Lumina, for example.
Re: IDA cybersecurity software provider Hex-Rays acquired
#97This makes me hopeful that users will switch to Binary Ninja. I picked up Binja a while ago (because it’s actually affordable for an individual) & haven’t felt any need to return to IDA. There’s also Rizin which seems pretty robust from what I’ve seen (haven’t tried it myself), & of course there’s also Ghidra. IDA isn’t the only effective disassembler in town anymore.
Did they ever fix the debugger situation in Binja? Looks like it's still in beta.
I really hated using Ghidra and Binja compared to IDA as I'm a bit reliant on dynamic RE for some purposes, while IDA is able to bridge the gap between static and dynamic without the need to break out x64dbg or similar.
Re: IDA cybersecurity software provider Hex-Rays acquired
#98Hopefully this works out for Hex-Rays, allowing them to invest more into developing IDA and expanding their low-cost product offerings. The general sentiment I have seen among people doing SRE is that IDA is rapidly losing market share to Ghidra. While it excels in some areas, the licenses are pricy even for tech employers, and entirely out of reach for students or colleges. It's hard to convince an employer to fork…
There's also competitors like Binary Ninja. Ida is best at Mac/ios and Windows by far though, so it's still used in those spaces alot. But for embeded, linux and whatever else, Ghidra/Binja are good enough that employers literally won't buy it anymore and are refusing it to senior engineers and telling them to use something else.
Re: IDA cybersecurity software provider Hex-Rays acquired
#99Hopefully this works out for Hex-Rays, allowing them to invest more into developing IDA and expanding their low-cost product offerings. The general sentiment I have seen among people doing SRE is that IDA is rapidly losing market share to Ghidra. While it excels in some areas, the licenses are pricy even for tech employers, and entirely out of reach for students or colleges. It's hard to convince an employer to fork…
There's also competitors like Binary Ninja. Ida is best at Mac/ios and Windows by far though, so it's still used in those spaces alot. But for embeded, linux and whatever else, Ghidra/Binja are good enough that employers literally won't buy it anymore and are refusing it to senior engineers and telling them to use something else.
I love IDA but it is too rich for my blood so I have gone with Binary Ninja. Not perfect but continually evolving.
Re: IDA cybersecurity software provider Hex-Rays acquired
#100This makes me hopeful that users will switch to Binary Ninja. I picked up Binja a while ago (because it’s actually affordable for an individual) & haven’t felt any need to return to IDA. There’s also Rizin which seems pretty robust from what I’ve seen (haven’t tried it myself), & of course there’s also Ghidra. IDA isn’t the only effective disassembler in town anymore.
Did they ever fix the debugger situation in Binja? Looks like it's still in beta. I really hated using Ghidra and Binja compared to IDA as I'm a bit reliant on dynamic RE for some purposes, while IDA is able to bridge the gap between static and dynamic without the need to break out x64dbg or similar.
It's been on the dev builds enabled by default for several months now and no longer labelled beta, but we're in the middle of a release process right now so at some point soon this week the current stable will have a full debugger release (though you can try that version now if you switch to dev)