[q3k]

IDA is the better tool if you're being paid to work with architectures that IDA supports well (ARM(64), x86(_64), etc). This usually means 'mainstream' security/malware research. It's not worth the price for hobbyists. Before Hex-Rays was sold to private equity, it could make sense for rich hobbyists to pay for a private license once and use it for a few years without software updates, with the cloud offering now it pretty much makes no sense.

Ghidra is the better tool if you're dealing with exotic architectures, even ones that you need to implement support for yourself. That's because any architecture that you have a full SLEIGH definition for will get decompilation output for free. It might not be the best decompiler out there, sure, but for some architectures it's the only decompiler available.

Both are generally shit UX wise and take time to learn. I've mostly switched from IDA to Ghidra a while back which felt like pulling teeth. Now when I sometimes go back to IDA it feels like pulling teeth.

[19h]

Which exotic architectures is IDA missing from your perspective?

[q3k]

Stuff I've recently analyzed that IDA has no decomp support for (and Ghidra's is anywhere from good enough to actually good):

  - AVR
  - Z80
  - HC08
  - 8051
  - Tricore
  - Xtensa
  - WebAssembly
  - Apple/Samsung S5L87xx NAND controller command sequencer VLIW (custom SLEIGH)

And probably more that I've forgotten.

It's also not about lack of support, but the fact that you have to pay extra for every single decompiler. This sucks if you're analyzing a wide variety of targets because of the kind of work you do.

IDA also struggles with disasm for Harvard architectures which tend to make up a bulk of what I analyze - it's all faked around synthetic relocations. Ghidra has native support for multiple address spaces.

[burnt-resistor]

Fuck private equity, e.g., rich vampiric assholes ruining everything.