From someone who does binary reverse engineering full time, in my experience, BinaryNinja, Hopper, radare2, etc are toys compared to IDA Pro + Hex Rays Decompiler. The quality of the results and the features supported are unmatched... until now. I haven’t spent too much time with ghidra yet but it’s the real deal. The output of the decompiler looks alright (not complete garbage like I’ve seen with other tools). Even…
Leaving the decompiler aside, for core disassembly features, in what ways is modern IDA far ahead of its competitors?
Ghidra, NSA's reverse-engineering tool
81–90 of 425 posts
Re: Ghidra, NSA's reverse-engineering tool
#82Are they serious? They are banning Russian IPs with decompiler source code. Hmm, I know ARM and x86 assembly. Of course, I don't know how to download these sources :)
Re: Ghidra, NSA's reverse-engineering tool
#83Earlier quoted context omitted.
It's a funny situation, though: decompilation probably should cost a small fortune. If you're in a line of work that needs it, the quality of your decompiler is probably a huge factor in how valuable an hour of your time is, and many [most?] fields where people routinely decompile stuff are very highly compensated. IDA has always had a weirdly low price point given the bill rates of people who use it, and it's intere…
It depends on what you're doing. I imagine a lot of people use IDA pro for modding video games, which often/usually provides no monetary compensation. Perhaps they would benefit from some type of "free/cheap for noncommercial use" license?
Re: Ghidra, NSA's reverse-engineering tool
#84Earlier quoted context omitted.
They're arguably competitors if you don't care about decompilation. But Binary Ninja has no decompiler and Hopper's was awful last I checked. Ghidra's decompiler seems as competent as Hex-Rays.
Binary Ninja has most of a decompiler and is expected to get the rest soon. Binary Ninja offers multiple views of the code, each with an API that gives you the same access that the GUI has. The different views vary in how much they are like assembly or C. Only that last step, real C code, is still missing. Those other views are quite good if your goal is to understand things, but less good if you were hoping to throw…
For instance, one of the most useful aspects of a decompiler for me is the ability to recover high-level control flow, which Binary Ninja apparently doesn't support. Instead it gives you an IDA-like graph view (but with IL instead of assembly in the graph nodes); but at least in my experience using IDA without a decompiler, even moderately large functions tend to result in a spiderweb of a graph, and recovering the control flow by hand ends up feeling like a pointless brain teaser. (This condition being true short-circuits this set of comparisons, so it must be an ||... but it still ends up doing this other set of comparisons, which you can also get to from... wait, where was I again?)
It also doesn't seem to allow eliding temporary assignments. Here's a short sample from some random function (retyped by hand since I don't see a way to copy and paste):
int32_t edx = arg4
int32_t eax = esi
eax_1, ecx_2 = sub_3c670(eax, edx)
It does do a sort of SSA transformation and assign unique variable names (like eax_1 instaed of eax) to the same register based on the location in the program, so that's nice. But what I really want is eax_1, ecx_2 = sub_3c670(esi, arg4)
I may be missing some option to do this manually, but it should be automatic.Re: Ghidra, NSA's reverse-engineering tool
#85Re: Ghidra, NSA's reverse-engineering tool
#86Earlier quoted context omitted.
It's a competitor to IDA's monopoly, basically. It might be better in certain aspects.
IDA has a bunch of competitors --- Hopper, Binja, and all the Capstone interfaces.
Hopper - is Capstone.
BinaryNinja - The extension API isn't well documented last time I checked. Embedded systems sort of requires letting me fill in some of the gaps myself.
Capstone - I got frustrated when the translation script behind it that autogens code from the LLVM definitions wasn't available (as source or otherwise) which meant that I couldn't add to the instruction set in a meaningful way like I needed to.
Radare(2) - Feels like the barely glued together independent projects that it is. Somehow has a more inscrutable interface than IDA.
One of the frontends I tried (can't remember if it was Hopper, Clipper, or something else) for some reason thought PowerPC had branch delay slots, which was totally screwing up the basic block determination.
Re: Ghidra, NSA's reverse-engineering tool
#87It's not the first real competitor available to the public. Hopper Disassembler and Binary Ninja are both capable. They have been available for a few years. Binary Ninja is also collaborative if you get the enterprise edition: https://binary.ninja/purchase/
This looks like an excellent free competitor. Been trying to learn; a tedious process without the fancy tools. Even hopper and binary ninja are very expensive (for a student). Radare2 has been a godsend so far and very helpful, but not as user-friendly.
Re: Ghidra, NSA's reverse-engineering tool
#88Earlier quoted context omitted.
It depends on what you're doing. I imagine a lot of people use IDA pro for modding video games, which often/usually provides no monetary compensation. Perhaps they would benefit from some type of "free/cheap for noncommercial use" license?
There is a free (much less capable) version of IDA.
Re: Ghidra, NSA's reverse-engineering tool
#89Are they serious? They are banning Russian IPs with decompiler source code. Hmm, I know ARM and x86 assembly. Of course, I don't know how to download these sources :)
Legal reasons.
Re: Ghidra, NSA's reverse-engineering tool
#90Earlier quoted context omitted.
It depends on what you're doing. I imagine a lot of people use IDA pro for modding video games, which often/usually provides no monetary compensation. Perhaps they would benefit from some type of "free/cheap for noncommercial use" license?
Video game modders certainly use IDA. IDA's purchase price, though, is, ah, not an issue for them- not because they have lots of funds available, but rather quite the opposite.
That's not going to prevent many people from taking the five finger discount I'm sure, since they'd rather have as many of the features as they can, but at least nobody can say HexRays isn't trying.