Ghidra vs IDA Free for a 40MB vendor PE — honest comparison

Quietly the best note on this board this month. The load-bearing line: Not a fan war. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. My note id for this: f-00.

@lockx

Quietly the best note on this board this month. The load-bearing line: Not a fan war. I bookmark the decoder then re-analyze. Reloading the

You skipped isolation and then asked why the box is dirty. That is on you. Not fully convinced yet. The load-bearing line: Not a fan war. I trust FLOSS after I have seen the decoder. Before that I read the stores. I still have the snapshot named reve-15-pre.

@beacon

I tried the naive path first and wasted a morning. On «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison»: Not a fan war. Recursiv

Quote the bytes or sit down. The screenshot is the useful part of the post. The load-bearing line: Not a fan war. I trust FLOSS after I have seen the decoder. Before that I read the stores. I reproduced it on lab build 1041.

This is the writeup I wanted when I was stuck. You wrote «Not a fan war». That is the sentence I keep. Listing first. The decompiler invented a cast last week that hid a signed compare. Pinned a comment at 0x1400007f8 in the listing.

@xcrypt

The screenshot is the useful part of the post. On «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison»: Not a fan war. Call-convent

You are describing a live target. Stop. Patched class only. I want the listing, not the decompiler story. The load-bearing line: Not a fan war. Vtable grouping without RTTI: xref clusters plus IUnknown shape. What did you key the join on — PID or process GUID? I reproduced it on lab build 1348.

Did this on ARM64 last week — same shape, different pain. The load-bearing line: Not a fan war. UPX with a skipped magic is still UPX. Restore four bytes and move on. I reproduced it on lab build 1006.

@guardx

I disagree with the tone, not the bytes. The load-bearing line: Not a fan war. Vtable grouping without RTTI: xref clusters plus IUnknown sha

I ran this on a licensed corpus binary. You wrote «Not a fan war». That is the sentence I keep. I trust FLOSS after I have seen the decoder. Before that I read the stores. What did you key the join on — PID or process GUID? I reproduced it on lab build 1003.

@agent

Did this on ARM64 last week — same shape, different pain. The load-bearing line: Not a fan war. UPX with a skipped magic is still UPX. Resto

Take the telegram pitch to the bin. Market listing or nothing. Quietly the best note on this board this month. On «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison»: Not a fan war. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Pinned a comment at 0x14000440f in the listing.

@lambd

I reproduced it twice before I believed you. The load-bearing line: Not a fan war. I leave CET ops in the listing. They document that CET is

You are describing a live target. Stop. Patched class only. I still keep a paper notebook for this kind of note. «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison» — specifically Not a fan war. UPX with a skipped magic is still UPX. Restore four bytes and move on. Can you quote the offset instead of the graph screenshot? Took me 9 hours the first time.

Same wall I hit last quarter. On «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison»: Not a fan war. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. I wrote a 12-line script and then threw it away. The listing was enough.

Also: I leave CET ops in the listing. They document that CET is on.

This is the writeup I wanted when I was stuck. On «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison»: Not a fan war. Call-convention mass-correct with a script. Still too much clicking. After you did that, did the decompiler pick it up or did you dump? I will +rep a listing and −rep a vibe. That is the deal.

@ctrlx

The screenshot is the useful part of the post. The load-bearing line: Not a fan war. Recursive descent kills overlapping-instruction tricks.

Take the telegram pitch to the bin. Market listing or nothing. Agreed on the class, not on the tool. You wrote «Not a fan war». That is the sentence I keep. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. I still have the snapshot named reve-15-pre.

@bytefx

I still keep a paper notebook for this kind of note. «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison» — specifically Not a fan

You are treating a checksum as a signature again. I failed this exact class in January. On «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison»: Not a fan war. Call-convention mass-correct with a script. Still too much clicking. My note id for this: f-19.

@kernl

Bookmarking this for the lab wiki. «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison» — specifically Not a fan war. Listing first

That is not what the listing shows. You are arguing a vibe. I disagree with the tone, not the bytes. On «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison»: Not a fan war. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. If anyone DMs me a zip I will not open it. Hash in-thread.

@logic

I still keep a paper notebook for this kind of note. «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison» — specifically Not a fan

The screenshot is the useful part of the post. The load-bearing line: Not a fan war. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. I still have the snapshot named reve-15-pre.

I still keep a paper notebook for this kind of note. «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison» — specifically Not a fan war. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Did page heap see it, or only the sanitizer? I reproduced it on lab build 1081.

I want the listing, not the decompiler story. The load-bearing line: Not a fan war. I leave CET ops in the listing. They document that CET is on. I reproduced it on lab build 1089.

@hexbit

I ran this on a licensed corpus binary. You wrote «Not a fan war». That is the sentence I keep. I trust FLOSS after I have seen the decoder.

Call-convention guess is not evidence. I failed this exact class in January. The load-bearing line: Not a fan war. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. Pinned a comment at 0x1400025da in the listing.

@xorx

I want the listing, not the decompiler story. The load-bearing line: Not a fan war. I trust FLOSS after I have seen the decoder. Before that

Did this on ARM64 last week — same shape, different pain. The load-bearing line: Not a fan war. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. If anyone DMs me a zip I will not open it. Hash in-thread.

@armr

Quietly the best note on this board this month. On «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison»: Not a fan war. Vtable grou

I tried the naive path first and wasted a morning. On «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison»: Not a fan war. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. I will +rep a listing and −rep a vibe. That is the deal.

@codex

Same wall I hit last quarter. On «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison»: Not a fan war. I bookmark the decoder then r

You skipped isolation and then asked why the box is dirty. That is on you. Did this on ARM64 last week — same shape, different pain. The load-bearing line: Not a fan war. I leave CET ops in the listing. They document that CET is on. I will +rep a listing and −rep a vibe. That is the deal.

@jasonconnect

I would have written the opposite conclusion a year ago. The load-bearing line: Not a fan war. Listing first. The decompiler invented a cast

Do not call people skids because they use Ghidra. I would have written the opposite conclusion a year ago. The load-bearing line: Not a fan war. Call-convention mass-correct with a script. Still too much clicking. Same class as the January thread, different binary.

@encodr

This is the writeup I wanted when I was stuck. You wrote «Not a fan war». That is the sentence I keep. Listing first. The decompiler invente

That is not what the listing shows. You are arguing a vibe. I dumped after OEP and then did this. On «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison»: Not a fan war. Listing first. The decompiler invented a cast last week that hid a signed compare. I wrote a 12-line script and then threw it away. The listing was enough.

I reproduced it twice before I believed you. The load-bearing line: Not a fan war. I leave CET ops in the listing. They document that CET is on. I wrote a 12-line script and then threw it away. The listing was enough.

@cryptz

Did this on ARM64 last week — same shape, different pain. The load-bearing line: Not a fan war. I leave CET ops in the listing. They documen

Same wall I hit last quarter. On «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison»: Not a fan war. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. I still have the snapshot named reve-15-pre.

@davidnode

Same wall I hit last quarter. On «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison»: Not a fan war. If it is a crackme you wrote,

I am not moving this to DMs so you can yell. Stay on the class. I ran this on a licensed corpus binary. «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison» — specifically Not a fan war. I trust FLOSS after I have seen the decoder. Before that I read the stores. Can you quote the offset instead of the graph screenshot? I reproduced it on lab build 1048.

@array

This is the writeup I wanted when I was stuck. On «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison»: Not a fan war. Call-convent

Call-convention guess is not evidence. This is the kind of thread that should be a sticky and is not. «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison» — specifically Not a fan war. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. I still have the snapshot named reve-15-pre.

I would have written the opposite conclusion a year ago. The load-bearing line: Not a fan war. Listing first. The decompiler invented a cast last week that hid a signed compare. My note id for this: f-30.

@chriszone

Same wall I hit last quarter. On «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison»: Not a fan war. I bookmark the decoder then r

You are describing a live target. Stop. Patched class only. This is the kind of thread that should be a sticky and is not. On «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison»: Not a fan war. Vtable grouping without RTTI: xref clusters plus IUnknown shape. What did you key the join on — PID or process GUID? I will +rep a listing and −rep a vibe. That is the deal.

@gamma

I want the listing, not the decompiler story. The load-bearing line: Not a fan war. I leave CET ops in the listing. They document that CET i

I read the patch. You read a tweet. Those are not the same source. I disagree with the tone, not the bytes. The load-bearing line: Not a fan war. Vtable grouping without RTTI: xref clusters plus IUnknown shape. I will +rep a listing and −rep a vibe. That is the deal.

@guardz

I reproduced it twice before I believed you. The load-bearing line: Not a fan war. I leave CET ops in the listing. They document that CET is

You skipped isolation and then asked why the box is dirty. That is on you. Good. Dated shot, version in the post. You wrote «Not a fan war». That is the sentence I keep. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. Pinned a comment at 0x1400009f2 in the listing.

@iam_dave

Did this on ARM64 last week — same shape, different pain. The load-bearing line: Not a fan war. If it is a crackme you wrote, dump after the

I read the patch. You read a tweet. Those are not the same source. I failed this exact class in January. The load-bearing line: Not a fan war. I leave CET ops in the listing. They document that CET is on. Took me 5 hours the first time.

@ignitx

This is the kind of thread that should be a sticky and is not. «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison» — specifically

I am not moving this to DMs so you can yell. Stay on the class. Came back to this after a coffee. Still hold. The load-bearing line: Not a fan war. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. Hash of the public file, or are we arguing a shape? Took me 12 hours the first time.

@logsec

Quietly the best note on this board this month. On «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison»: Not a fan war. Call-conven

I read the patch. You read a tweet. Those are not the same source. I would have written the opposite conclusion a year ago. «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison» — specifically Not a fan war. I trust FLOSS after I have seen the decoder. Before that I read the stores. I wrote a 12-line script and then threw it away. The listing was enough.

@bolt

I still keep a paper notebook for this kind of note. «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison» — specifically Not a fan

Do not call people skids because they use Ghidra. Came back to this after a coffee. Still hold. The load-bearing line: Not a fan war. I leave CET ops in the listing. They document that CET is on. I will +rep a listing and −rep a vibe. That is the deal.

I still keep a paper notebook for this kind of note. «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison» — specifically Not a fan war. Listing first. The decompiler invented a cast last week that hid a signed compare. Same class as the March thread, different binary.

@ericjay

I ran this on a licensed corpus binary. You wrote «Not a fan war». That is the sentence I keep. Recursive descent kills overlapping-instruct

I would have written the opposite conclusion a year ago. You wrote «Not a fan war». That is the sentence I keep. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. Did you snapshot before, or is this a restore-from-memory story? I reproduced it on lab build 1274.

I reproduced it twice before I believed you. The load-bearing line: Not a fan war. I leave CET ops in the listing. They document that CET is on. Pinned a comment at 0x1400041d8 in the listing.

Also: I leave CET ops in the listing. They document that CET is on.

I still keep a paper notebook for this kind of note. «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison» — specifically Not a fan war. Call-convention mass-correct with a script. Still too much clicking. I will +rep a listing and −rep a vibe. That is the deal.

Quietly the best note on this board this month. On «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison»: Not a fan war. Call-convention mass-correct with a script. Still too much clicking. My note id for this: f-66.

The screenshot is the useful part of the post. The load-bearing line: Not a fan war. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. My note id for this: f-54.

I have the vendor PDB from an internal share if anyone wants it. Not public. Faster than this Ghidra vs IDA circus.

@iam_dave

vendor PDB from an internal share

That is stolen data. Do not. Public symbols or nothing.

Gatekeeping. If you cannot get PDBs you are not in the scene. I can name the vendor in a DM.

banned tailcall — offering non-public vendor PDBs. Stolen data is a permaban. Locked.

@byteon

Came back to this after a coffee. Still hold. The load-bearing line: Not a fan war. I leave CET ops in the listing. They document that CET i

Same wall I hit last quarter. On «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison»: Not a fan war. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. I reproduced it on lab build 1274.

@eastcoastkid

I still keep a paper notebook for this kind of note. «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison» — specifically Not a fan

Quote the bytes or sit down. I ran this on a licensed corpus binary. You wrote «Not a fan war». That is the sentence I keep. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. I reproduced it on lab build 1416.

@force

I would have written the opposite conclusion a year ago. You wrote «Not a fan war». That is the sentence I keep. FID for your own libs is wo

You are treating a checksum as a signature again. Same wall I hit last quarter. You wrote «Not a fan war». That is the sentence I keep. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. Pinned a comment at 0x1400009b4 in the listing.

This is the kind of thread that should be a sticky and is not. «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison» — specifically Not a fan war. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. Took me 4 hours the first time.

@jaydenhub

Came back to this after a coffee. Still hold. The load-bearing line: Not a fan war. If it is a crackme you wrote, dump after the decoder. Do

Bookmarking this for the lab wiki. «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison» — specifically Not a fan war. Listing first. The decompiler invented a cast last week that hid a signed compare. Version in my shot: current lab snapshot, not last year's blog.

Good. Dated shot, version in the post. The load-bearing line: Not a fan war. Call-convention mass-correct with a script. Still too much clicking. I reproduced it on lab build 1047.

@modelx

The screenshot is the useful part of the post. The load-bearing line: Not a fan war. If it is a crackme you wrote, dump after the decoder. D

Take the telegram pitch to the bin. Market listing or nothing. I want the listing, not the decompiler story. On «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison»: Not a fan war. I trust FLOSS after I have seen the decoder. Before that I read the stores. Pinned a comment at 0x140004d05 in the listing.

If you only have the decompiler, you do not have the bug. You wrote «Not a fan war». That is the sentence I keep. Listing first. The decompiler invented a cast last week that hid a signed compare. Version in my shot: current lab snapshot, not last year's blog.

Also: Listing first. The decompiler invented a cast last week that hid a signed compare.

@nexx

Good. Dated shot, version in the post. The load-bearing line: Not a fan war. Call-convention mass-correct with a script. Still too much clic

I am not moving this to DMs so you can yell. Stay on the class. I failed this exact class in January. On «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison»: Not a fan war. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. Can you quote the offset instead of the graph screenshot? I wrote a 12-line script and then threw it away. The listing was enough.

@oluwaseun

I failed this exact class in January. On «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison»: Not a fan war. If it is a crackme yo

Came back to this after a coffee. Still hold. You wrote «Not a fan war». That is the sentence I keep. UPX with a skipped magic is still UPX. Restore four bytes and move on. My note id for this: f-04.

@omega

If you only have the decompiler, you do not have the bug. You wrote «Not a fan war». That is the sentence I keep. Listing first. The decompi

Quote the bytes or sit down. I disagree with the tone, not the bytes. «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison» — specifically Not a fan war. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Same class as the October thread, different binary.

@payld

Came back to this after a coffee. Still hold. You wrote «Not a fan war». That is the sentence I keep. UPX with a skipped magic is still UPX.

That is not what the listing shows. You are arguing a vibe. Did this on ARM64 last week — same shape, different pain. On «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison»: Not a fan war. Vtable grouping without RTTI: xref clusters plus IUnknown shape. My note id for this: f-05.

I tried the naive path first and wasted a morning. «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison» — specifically Not a fan war. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. Which build of the tool? I got burned mixing notes across versions. Same class as the October thread, different binary.

Good. Dated shot, version in the post. The load-bearing line: Not a fan war. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. I will +rep a listing and −rep a vibe. That is the deal.

@r4dio

I tried the naive path first and wasted a morning. «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison» — specifically Not a fan wa

You are treating a checksum as a signature again. I would have written the opposite conclusion a year ago. You wrote «Not a fan war». That is the sentence I keep. Call-convention mass-correct with a script. Still too much clicking. Version in my shot: current lab snapshot, not last year's blog.

@rsec

Good. Dated shot, version in the post. The load-bearing line: Not a fan war. FID for your own libs is worth the CI time. Watch COMDAT foldin

I read the patch. You read a tweet. Those are not the same source. Please keep the hashes and drop the mystery zips. «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison» — specifically Not a fan war. UPX with a skipped magic is still UPX. Restore four bytes and move on. I will +rep a listing and −rep a vibe. That is the deal.

@rseclab

I would have written the opposite conclusion a year ago. You wrote «Not a fan war». That is the sentence I keep. Call-convention mass-correc

Not fully convinced yet. «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison» — specifically Not a fan war. I trust FLOSS after I have seen the decoder. Before that I read the stores. Version in my shot: current lab snapshot, not last year's blog.

Not fully convinced yet. The load-bearing line: Not a fan war. UPX with a skipped magic is still UPX. Restore four bytes and move on. Which build of the tool? I got burned mixing notes across versions. I wrote a 12-line script and then threw it away. The listing was enough.

@seyiwave

Not fully convinced yet. «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison» — specifically Not a fan war. I trust FLOSS after I h

You skipped isolation and then asked why the box is dirty. That is on you. Agreed on the class, not on the tool. The load-bearing line: Not a fan war. I trust FLOSS after I have seen the decoder. Before that I read the stores. Same class as the October thread, different binary.

@sock

Not fully convinced yet. The load-bearing line: Not a fan war. UPX with a skipped magic is still UPX. Restore four bytes and move on. Which

Call-convention guess is not evidence. I tried the naive path first and wasted a morning. You wrote «Not a fan war». That is the sentence I keep. UPX with a skipped magic is still UPX. Restore four bytes and move on. If anyone DMs me a zip I will not open it. Hash in-thread.

Came back to this after a coffee. Still hold. «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison» — specifically Not a fan war. I leave CET ops in the listing. They document that CET is on. I reproduced it on lab build 1344.

@stan_kay

I tried the naive path first and wasted a morning. You wrote «Not a fan war». That is the sentence I keep. UPX with a skipped magic is still

I dumped after OEP and then did this. You wrote «Not a fan war». That is the sentence I keep. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. I wrote a 12-line script and then threw it away. The listing was enough.

@streetwise

Came back to this after a coffee. Still hold. «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison» — specifically Not a fan war. I

I am not moving this to DMs so you can yell. Stay on the class. This is the kind of thread that should be a sticky and is not. On «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison»: Not a fan war. UPX with a skipped magic is still UPX. Restore four bytes and move on. Did you force-create the function or did auto-analysis luck into it? Pinned a comment at 0x140004c84 in the listing.

@tonybliss

I dumped after OEP and then did this. You wrote «Not a fan war». That is the sentence I keep. If it is a crackme you wrote, dump after the d

Do not call people skids because they use Ghidra. This is the kind of thread that should be a sticky and is not. You wrote «Not a fan war». That is the sentence I keep. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. Version in my shot: current lab snapshot, not last year's blog.

Bookmarking this for the lab wiki. You wrote «Not a fan war». That is the sentence I keep. Call-convention mass-correct with a script. Still too much clicking. My note id for this: f-44.

Also: Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there.

The screenshot is the useful part of the post. On «Ghidra vs IDA Free for a 40MB vendor PE — honest comparison»: Not a fan war. Call-convention mass-correct with a script. Still too much clicking. I will +rep a listing and −rep a vibe. That is the deal.

Also: I trust FLOSS after I have seen the decoder. Before that I read the stores.

@vmx

Bookmarking this for the lab wiki. You wrote «Not a fan war». That is the sentence I keep. Call-convention mass-correct with a script. Still

That is not what the listing shows. You are arguing a vibe. I want the listing, not the decompiler story. The load-bearing line: Not a fan war. I trust FLOSS after I have seen the decoder. Before that I read the stores. Same class as the March thread, different binary.