| ▲ | bjackman 3 hours ago | ||||||||||||||||
Very likely people who actually work on RE at the NSA also have access to IDA Pro licenses. I don't work in this space, so take it with a pinch of salt, but my understanding is this is a fairly long term strategic initiative to _eventually_ be the best tool. | |||||||||||||||||
| ▲ | bri3d 3 hours ago | parent | next [-] | ||||||||||||||||
It’s better in some dimensions and not others, and it’s built on a fundamentally different architecture, so of course they use both. Ghidra excels because it is extremely abstract, so new processors can be added at will and automatically have a decompiler, control flow tracing, mostly working assembler, and emulation. IDA excels because it has been developed for a gazillion years against patterns found in common binaries and has an extremely fast, ergonomic UI and an awesome debugger. For UI driven reversing against anything that runs on an OS I generally prefer IDA, for anything below that I’m 50/50 on Ghidra, and for anything where IDA doesn’t have a decompiler, Ghidra wins by default. For plugin development or automated reversing (even pre LLMs, stuff like pattern matching scripts or little evaluators) Ghidra offers a ton of power since you can basically execute the underlying program using PCode, but the APIs are clunky and until recently you really needed to be using Java. | |||||||||||||||||
| ▲ | 19h 3 hours ago | parent | prev [-] | ||||||||||||||||
Ghidra has a slightly different focus than IDA, so they're definitely not just using Ghidra :-) | |||||||||||||||||
| |||||||||||||||||