[mparlane]

Bad actors have been using IDA this entire time. So no, not really.

[gpm]

Bad actors have had access to this tool too... it was leaked previously.

This is cool because:

- It's legal and free - It's open source

[willstrafach]

The tool was never leaked previously.

[gpm]

Uh, you're sure about that? I can't say I have first hand experience with the leak (running second hand NSA software not meant for public release seems like a bad idea somehow) but I know I've heard that it was, and this seems pretty suggestive...

https://wikileaks.org/ciav7p1/cms/page_51183656.html

[willstrafach]

I am sure about that.

Your linked informational page leaked out when someone sent WikiLeaks a dump from a classified Confluence used by CIA’s cyber folks.

The tool itself, however, had not leaked.

[nyrulez]

You mean there is nothing new here? Then why is this news?

I am not wondering about the concept of reverse engineering but the specific (and hopefully novel) feature set that this may enable.

[__jal]

There are more options in the universe of reactions than "Eek! They're going to get us all killed!" and "Eh?"

[jchw]

Conceptually there's nothing new, but it doesn't hurt to have more options available, especially considering how pricey IDA is.

[saagarjha]

It's a competitor to IDA's monopoly, basically. It might be better in certain aspects.

[tptacek]

IDA has a bunch of competitors --- Hopper, Binja, and all the Capstone interfaces.

[monocasa]

So, albeit my use case is a little weird I guess, and I generally am using it for embedded systems, but:

Hopper - is Capstone.

BinaryNinja - The extension API isn't well documented last time I checked. Embedded systems sort of requires letting me fill in some of the gaps myself.

Capstone - I got frustrated when the translation script behind it that autogens code from the LLVM definitions wasn't available (as source or otherwise) which meant that I couldn't add to the instruction set in a meaningful way like I needed to.

Radare(2) - Feels like the barely glued together independent projects that it is. Somehow has a more inscrutable interface than IDA.

One of the frontends I tried (can't remember if it was Hopper, Clipper, or something else) for some reason thought PowerPC had branch delay slots, which was totally screwing up the basic block determination.

[saagarjha]

Yup, well aware of them (I think Hopper uses Capstone, FWIW). I'm sure you agree that they're not quite at the level of IDA, though ;)

[tptacek]

I'm not especially a fan of IDA, but I don't do much of this work anymore and haven't had a reason to catch up. IDA definitely wouldn't be the first tool I'd reach for in 2019.

[saagarjha]

I'm not really a fan either, but it's somewhat better and this makes people seem to like to pass around IDBs…