const {P,H2,H3,Callout,Code,Ul,Related,PostHead}=window;
function Article(){
return <>
<PostHead cat="/COMPARISON" date="2026-07-24" title="IDA vs Ghidra vs Binary Ninja vs radare2" lede="Pick the decompiler for the job, not for the brand. License, headless, IL, and who has to maintain the project after we leave."/>
<P>This is not a bake-off with invented scores. It is how we assign tools on an authorized desk in 2026. If a vendor number exists, it is theirs. If we have no number, the cell stays empty.</P>
<H2>What we actually optimize for</H2>
<Ul items={[
'Can a second analyst reopen the project in six months without a dongle dance.',
'Can we batch 200 ELFs overnight.',
'Is the decompiler lying in a way we can catch (see confirm, not GUI).',
'Does the customer already own seats.'
]}/>
<H2>Ghidra</H2>
<P>NSA, Apache-ish license, Java. Headless analysis is a first-class story. SLEIGH covers weird ISAs you will see in gateways. The decompiler is good and sometimes verbose. Startup is slow. Collaboration is a project directory, not magic. <strong>Default when the customer has no preference.</strong></P>
<H2>IDA Pro</H2>
<P>Hex-Rays decompiler is still the one many auditors screenshot into a PDF because the reader already trusts that window. FLIRT signatures save time on statically linked C. Processor modules for DSP and MCU work that Ghidra may not have. Cost and license servers are real. <strong>Default when the house already runs IDA, or when Hex-Rays is clearly better on that compiler family.</strong></P>
<H2>Binary Ninja</H2>
<P>BNIL / MLIL / HLIL: you can write a checker against the IL instead of regexing decompiler text. UI is fast. Price sits between Ghidra (zero) and IDA (a lot). Coverage of exotic ISAs is the tax. <strong>Default when the deliverable is a scripted parser recovery, not a tour of 12 DSP cores.</strong></P>
<H2>radare2 / rizin</H2>
<P>CLI, ESIL, rasms, rabin2. The right tool in a pipeline and the wrong tool for a two-hour screen-share with a CISO. Graphs exist; nobody loves them. <strong>Default in scripts and in “what is this immediate, from stdin.”</strong></P>
<H2>A boring assignment table</H2>
<Code lang="assign.txt">{`Overnight folder of ELF/PE     Ghidra headless
Customer already on IDA        IDA
Need a stable IL to script     Binary Ninja
CI / pipes / one-off xref      r2 or rizin
Confirm a struct offset        Unicorn (not a decompiler)
Android Java                   jadx, then native tool on .so
Firmware container             unblob first, decompiler later`}</Code>
<Callout>Switching tools mid-function because Twitter said so is how you lose the thread. Finish the confirm step in one toolchain, then migrate if you must.</Callout>
<H2>What none of them do</H2>
<P>None of them prove the layout. That is Unicorn, QEMU, or a debugger. None of them are a substitute for a scope file. None of them should ingest the sample into a random cloud AI.</P>
<Related items={[
['post-re-stack.html','The reverse-engineering desk']
]}/>
</>;
}
window.Article=Article;
mountPost();