Does anyone know what impact if any the release of Ghidra had on Hex-Rays?
IDA never really accommodated to the hobbyist, so I wonder did it have any impact on the commercial side of things apart from the IDA Home release?
IDA never really accommodated to the hobbyist, so I wonder did it have any impact on the commercial side of things apart from the IDA Home release?
Hex-Rays did ultimately release IDA Home, but you have to sign up for an account to even find out what their hobbyist license costs.
I cannot underscore how much Hex Rays never wanted to have customers or sell products. Maybe this restructuring will fix that?
Now, more and more tutorials and introductions use Ghidra. Is it better than IDA? In some cases yes, in most not yet, but it’s easier to get.
If I were Hex-Rays, I’d be very concerned with a generational shift as people stop bothering to pirate IDA and those who learned on Ghidra enter the industry and don’t demand an IDA license.
When I was in the US Gov there were plenty of IDA licenses floating around despitr the existence of Ghidra. The Gov thinking was basically "better to have it and not need it instead of need it and not have it". There must be a thousand licenses that never get used year after year. I suspect IDA is safe for a while for this reason alone, but of course could be wrong and don't have the numbers-just speculation.
[0] - http://www.bitsavers.org/components/ti/TMS7000/TMS7000_Famil...
For a "new" professional/team, it makes zero sense to buy a IDA license nowadays.
And even then, IDA Home comes with some pretty serious limitations. It's not just a no-commercial-use version of IDA Pro; it's also a cut-down version with no decompiler, no batch mode, and which only disassembles code for one processor family (which you have to choose at the time of purchase, from a limited subset of what IDA Pro supports).
The total price kicks licensing costs well outside that of hobbyist use cases.
But, like you said, IDA Home is additionally limited to one architecture, which is a bit annoying.
It was all over their release announcement and Twitter, iirc. From their website: “For the price of $365 / year” https://hex-rays.com/products/idahome/
IDA Pro for ARM w/ a decompiler is the cost of a used car.
IDA has a problem where, for some shops, it really makes sense to just have one concurrent IDA user, because IDA is like 10-15% of the work hours --- but it's a critically important 10-15%. So they're super careful to charge for the ability to rotate a team of consultants through the same IDA license.
We had a client, a decade or so ago, that brought us in to do IDA-based vulnerability research work. We wrote some blog posts about the work, and it was so unusual for any of their clients to have that licensing arrangement that IDA (this is in the Pierre era, not the Hex-Rays era) publicly accused us of pirating our copy (which was annoying, because we couldn't out our client, but they absolutely did have the licensing worked out for this.)
It's all super off-putting. But IDA is in sort of a bind, because there just aren't that many users for their ultra-hyper-specialized product. You can have the very best decompiler in the world and you're still going to be a rounding error compared to companies like Figma, because (1) not that many people use disassemblers and (2) less and less software is written in C/C++ every year.
Edit: Ironically the NSA is the entity commoditizing their complement here, getting an in-house SRE tool and making it easier to hire students out of college with skills they want.
(1) could be changed by making a decent offer to hobbyists that they can't refuse, and making the buying experience for them hassle-free.
Yes, the license cost is likely marginal if you only disassemble Windows malware on Windows.
as an aside - When I was taught Ghidra the trainer said "in IDA you spend most of your time in the disassembly graph, in Ghidra I rarely leave the decompiler"
They added an undo button to IDA.
but for reeeeaaal work, that needs to be done by the deadline, it rarely gets considered.