KTRW: The Journey to Build a Debuggable iPhone

Post by tambre » Tue, Oct 29, 2019, 3:20 PM UTC

saagarjha wrote: post #13

comex wrote: post #9

Earlier quoted context omitted.

I've recently been using Ghidra for a personal project, after using IDA extensively in the past. My impressions so far: The feature set is solid. I've been frustrated by a few minor things that are missing from Ghidra, but Ghidra also has several features that are missing from IDA, and other features are better designed than in IDA. But the whole thing is crushingly slow, especially the parts written in Java. (The de…

It's a bit of a gloomy view into the landscape of disassemblers, but I was very impressed that Ghidra managed to keep one of my temporary unsaved projects I had been working on (mostly) intact through a kernel panic. Oh, and there are certain things that Ghidra's UI is better than IDA's at: defining structures, for example. And I'd like to think it has less malware in it than pirated IDA…

Post by heavenlyblue » Tue, Oct 29, 2019, 4:25 PM UTC

saagarjha wrote: post #19

comex wrote: post #16

Earlier quoted context omitted.

Defining structures is one of the worst parts of Ghidra for me! But maybe I'm missing something. - When I first tried Ghidra I couldn't set the size of a struct by editing the size field, so I had to go through an awkward process of creating an undefined byte and then duplicating it. However, that seems to have been fixed, so it's now better than IDA (where I always have to create a dummy field and move it to the end…

I mean, it's not perfect; I just thought that IDA does many of the same things that Ghidra does wrong but with a somewhat less forgiving UI. You did hit on some of the issues I've had with Ghidra, though: I agree that the way to create structures requires a lot of overhead and while I don't deal with anything too large, I kind of wish that Ghidra would collapse runs of "undefined" and only expand them if you clicked…

Post by musicale » Tue, Oct 29, 2019, 11:37 PM UTC