Hacker News new | past | comments | ask | show | jobs | submit login

I've used Hex-Rays (IDA Pro's decompiler); not full-time, but 100+ hours, including professionally. My information is a few years out of date, but I think most of it is still current. I've also used Ghidra (9.1) for maybe 50 hours or so.

First, let me say: Both are leaps and bounds above _anything_ else out there. Stuff like Hopper is basically just assembler code in a different syntax; Hex-Rays and Ghidra are real, working, useful decompilers. Hex-Rays charges four-figure sums for single licenses, and it's because the product is utterly worth it if you do this kind of thing for a living (or at least was before Ghidra came along). I would estimate it speeds up reverse-engineering by 10x. There's a wonderful interactivity where the decompiler does all the boring book-keeping for you, and you keep feeding it info and it tells you stuff in return. Decompiling is often about figuring out data structures; both will infer a lot of struct types and sometimes even names based on usage and surrounding code. This is _so incredibly useful_. When you give a field a type or a name, it propagates throughout the program and gives you new understanding.

Both products are weird and have arcane UIs. IDA/Hex-Rays feels more ergonomical to me, though (for instance, highlighting happens automatically instead of having to middle-click), perhaps because it's what I started on. Both have strange bugs that you eventually learn to work around. Both have lots of bells and whistles only advanced users will get to use.

Hex-Rays' output feels much more polished to me. It recognizes a lot of compiler idioms, and every new release recognizes more. On the other hand, Hex-Rays only supports a few select platforms (when I started, it did 32-bit x86 only; now it does x86, x86-64, arm, aarch64, ppc, ppc64, mips), and you have to pay for it separately. Ghidra supports decompilation for almost all targets it can disassemble! This either is huge, or doesn't matter to you at all.

Hex-Rays' support is amazing. You report a bug, include a specialized program database by means of a function in the GUI, and four hours later, you receive an email with the bug fixed. On the other hand, Ghidra is free and Hex-Rays is the most expensive software I've ever used, which is obviously a huge deal for anyone not doing this full-time. (The Hex-Rays license lasts for only a year, but after the license is expired, you can still use the software. You just don't get support or newer versions.) If Ghidra cost $500 (for a permanent license), I would probably consider getting it, but it happens to be $0. Fantastic value for money.

If I could choose only one, and cost didn't matter? I'd probably go with Hex-Rays.




My experience with IDA versus Ghidra is that I would still vastly prefer IDA. Even without the decompiler, I found IDA's structure support quite useful for managing disassembly, and Ghidra's structure editing tool and assembly renaming were pretty poor when I tried playing with it, which is why I ultimately ended up resorting to editing objdump disassemblies to decompile the code, relying on Ghidra for the vtable analysis.

However, I use these tools strictly on a hobbyist basis, and I'm not sure that IDA Pro's price tag is really worth it. I think I might have a copy of IDA Free kicking about before they really gimped it, but what I really want is a working IDA on Linux.


When I was in the cracking scene (over a decade ago now), cracking your own copy of IDA Pro was considered somewhat a "rite of passage", because the authors obviously expected it and made it more difficult. Nonetheless, cracked copies still appear.


The main problem is getting the IDA binaries in the first place.


How does one enter the cracking scene? seems very fun!


The structure editing tool is less fluid, yes. It's one of many ergonomy things, although you can get used to it with some wrangling.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: