News for hackers. Stuff that matters.
Re:Ask HN: What's the best resource for learning modern x64 ... by Godel_unicode on Saturday February 08, 2020 @09:12PM (#22279952)
In addition to IDA, I highly recommend looking into ghidra. It's open source, so you can peak under the hood and see how it does things.

https://github.com/NationalSecurityAgency/ghidra

Re:Ask HN: What's the best resource for learning modern x64 ... by anonsivalley652 on Saturday February 08, 2020 @09:32PM (#22280016)
Yep. It's a FOSS-quality disassembler; good if you don't have IDA (I wish), supports maybe 10% of what IDA does in total but has some other niceities that it doesn't (think: disassembler-equivalent of LLVM). (Ideally, you'd have both.) For those who don't know, IDA disassembles basically every unclassified, commercially-available architecture and executable/library/object container format (think: disassembler-equivalent of GCC if it were an IBM or Green Hills product -:P). It also has a built-in scripting API in Python(?), IIRC.

An interesting semi-abandonware static disassembler that was really good is Sourcer 8.01 from V-Communications. I think it supports Pentium II/Pro/III at most, which would include real, protected mode and long mode DOS/DOS extended/Win16/Win32 EXEs and COMs IIRC. It did a lot of memory typing and clever analysis long before IDA existed, and still interesting for retro computing.

https://www.vetusware.com/download/Sourcer%208.01%208.01/?id...

Re:Ask HN: What's the best resource for learning modern x64 ... by Godel_unicode on Sunday February 09, 2020 @02:39AM (#22280920)
You might be interested in this talk from the creator of IDA, Ilfak Guilfanov, explaining how he used Sourcer and it's shortcomings lead directly to him creating IDA.

https://m.youtube.com/watch?v=hLBlck1lTUs

Re:Ask HN: What's the best resource for learning modern x64 ... by zelly on Sunday February 09, 2020 @12:48AM (#22280603)
It's way better than IDA Pro. I have used the Pro version with the Hex-Rays decompiler. Ghidra is legitimately better. I wouldn't recommend IDA to anyone at this point because I don't see it having much of a future (sorry not sorry).

It's worth learning the Ghidra Scripting API because you can write ad-hoc scripts with Jython syntax to automate tasks/do custom analysis.

Re:Ask HN: What's the best resource for learning modern x64 ... by ackbar03 on Sunday February 09, 2020 @02:53AM (#22280956)
I was using ghidra for one of my uhh research projects earlier and I actually found the decompiler from hex rays still does better in some cases. In ghidra sometimes it times out and fails to decompile. Maybe I'm not using it correctly? I haven't begun exploring what kind of plug-ins and stuff it has, maybe that helps?
Re:Ask HN: What's the best resource for learning modern x64 ... by gallexme on Sunday February 09, 2020 @05:24AM (#22281391)
For me ghidra is better with c++ disassembling than hex ray, but hex ray is better with c style assemblies

Thanks to the better RTTI Analyzer

Re:Ask HN: What's the best resource for learning modern x64 ... by zelly on Sunday February 09, 2020 @04:12PM (#22284339)
It depends massively on platform, architecture, and programming language. Hex-Rays is probably still ideal for embedded and obscure platforms. Ghidra's decompiler seems optimized for ARM and amd64 userland consumer-level stuff that the NSA was most interested in hacking.