Hacker News new | ask | show | jobs
by tptacek 2669 days ago
IDA has a bunch of competitors --- Hopper, Binja, and all the Capstone interfaces.
2 comments

So, albeit my use case is a little weird I guess, and I generally am using it for embedded systems, but:

Hopper - is Capstone.

BinaryNinja - The extension API isn't well documented last time I checked. Embedded systems sort of requires letting me fill in some of the gaps myself.

Capstone - I got frustrated when the translation script behind it that autogens code from the LLVM definitions wasn't available (as source or otherwise) which meant that I couldn't add to the instruction set in a meaningful way like I needed to.

Radare(2) - Feels like the barely glued together independent projects that it is. Somehow has a more inscrutable interface than IDA.

One of the frontends I tried (can't remember if it was Hopper, Clipper, or something else) for some reason thought PowerPC had branch delay slots, which was totally screwing up the basic block determination.

Yup, well aware of them (I think Hopper uses Capstone, FWIW). I'm sure you agree that they're not quite at the level of IDA, though ;)
I'm not especially a fan of IDA, but I don't do much of this work anymore and haven't had a reason to catch up. IDA definitely wouldn't be the first tool I'd reach for in 2019.
I'm not really a fan either, but it's somewhat better and this makes people seem to like to pass around IDBs…
It's the de facto standard and the program you can assume everyone is already using, plus the fact that a lot of tooling relies on IDA (in part because, for a long time, it was the only game in town) for analysis and function recovery. I don't know if that really makes it "better".

I got out of this stuff before decompilation became a mainstream feature, so it might be a big deal that Ghidra has a strong decompiler.

Yeah, that's basically it. Most other tools either lack a decompiler or have a somewhat poorer one.