Ilfak Guilfanov: Building IDA and Patching Windows Himself

Every malware analyst, every exploit developer and, by his own cheerful admission, every "three-letter agency" that takes software apart does it with a program one man started writing in Moscow in 1991.

Ilfak Guilfanov is the author of IDA, the Interactive Disassembler. For thirty-five years it's been the standard way to turn compiled machine code back into something a human can read, and the decompiler he added in 2007 turns it almost back into source.

Most of the world heard his name only once, over a New Year's holiday. Microsoft had a hole in every Windows PC on Earth and no patch. A quiet programmer in Liège wrote one himself, and the security industry told everyone to install it.

Ilfak Guilfanov at a Glance

• Guilfanov went to school in a small village in Tatarstan and studied at Moscow State University's mechanics and mathematics faculty, earning a degree in mathematics.
• He began IDA in late 1990 and released version 0.1 on May 21, 1991. From 1994 it spread as shareware over FidoNet and dial-up bulletin boards.
• In 1996 a Belgian company, DataRescue of Liège, began selling it as IDA Pro. Guilfanov moved to Belgium and worked there as a senior developer.
• On December 31, 2005, he published an unofficial fix for the Windows Metafile flaw. SANS and F-Secure told users to install it; Microsoft's own patch came on January 5, 2006.
• He founded Hex-Rays in 2005, shipped the Hex-Rays Decompiler on September 17, 2007, and took over IDA itself on January 1, 2008.
• Revenue passed €20 million in 2020. In October 2022 a consortium led by Smartfin and two Belgian public funds bought control of the company. Belgian press reported his payout at €81 million; he reinvested and became chairman.
• IDA moved to subscriptions with version 9.0 in 2024. IDA 9.5 shipped on October 6, 2026, and Guilfanov remains founder and CTO.

The Life of Ilfak Guilfanov

Guilfanov's Early Years

Ilfak Guilfanov grew up far from any computer. He went to school in a small village in Tatarstan, on the Volga, and then won a place in the mechanics and mathematics faculty of Moscow State University, the Soviet Union's most demanding mathematics program.

"It was a very interesting place," he told a Russian interviewer years later. "I was very lucky to study surrounded by so many extraordinary people." He left with a bachelor's degree in mathematics and a habit of thinking about programs the way a mathematician thinks about proofs.

A Disassembler Named IDA

A disassembler takes the raw bytes of a compiled program and renders them as assembly language, the first step in understanding software whose source code you don't have. In late 1990 Guilfanov started writing his own, and the first line of code went down in January 1991.

IDA 0.1 appeared on May 21, 1991. Its trick was to disassemble a file incrementally instead of loading all of it into the tiny memories of the day, and, as the name promised, to let the analyst interact: rename a function, mark a block as data, add a comment, and have the whole listing update around the change.

Version 2.0 in 1994 added IDC, a built-in scripting language, and the program went out as shareware over FidoNet and bulletin boards. Guilfanov called it The Interactive Disassembler, which "quickly became known as IDA," and the logo became a portrait of a certain seventeenth-century French lady, Madame de Maintenon, lifted from a CD of ten thousand royalty-free images.

Liège and DataRescue

In 1996 a small Belgian firm, DataRescue, began distributing IDA in Europe, and the product acquired its surname: IDA Pro. A 1997 release added FLIRT, a technology that recognized standard library functions by their fingerprints so analysts could skip straight to the interesting code. IDA 4.0, in 1999, brought a Windows graphical interface.

Guilfanov moved to Liège and became DataRescue's senior developer. Asked whether he worked anywhere else, he joked that no, he didn't unload railway wagons in the evenings. He admitted the code from the early 1990s was "far from perfect, but it works, so for now we won't rewrite it."

By the mid-2000s IDA Pro was simply how the job was done. "IDA Pro is used to analyze all malware and viruses today," Guilfanov said in 2006, and he wasn't exaggerating much.

New Year's Eve, 2005

In the last days of December 2005, attackers began exploiting a flaw in how Windows rendered WMF image files. A booby-trapped picture on a web page could take over a PC. Microsoft said its patch would arrive with the regular January updates.

Guilfanov didn't want to wait. On December 31 he released an unofficial fix, with full source code, that disabled the vulnerable function.

Within days the SANS Institute's Internet Storm Center and the antivirus firm F-Secure were advising people to install a patch written by a man most of them had never heard of, an almost unheard-of step. Traffic crushed his personal website, which had to be shut down for a time.

"People are free not to trust my fix, but they are already depending on IDA Pro to get precise analysis of binary programs today," he told CNET. "Maybe because I do not hide anything and put the source code in front of everyone's eyes?" Microsoft published its own fix, MS06-001, on January 5, 2006, five days early.

Hex-Rays

Reading assembly language is slow even for experts. For years Guilfanov had been working on something harder: a decompiler that'd turn machine code into readable, C-like pseudocode. In 2005 he founded Hex-Rays SA in Liège, and the Hex-Rays Decompiler 1.0 shipped on September 17, 2007, the "fruit of more than ten years of proprietary research," as the company put it.

On January 1, 2008, IDA Pro itself moved to Hex-Rays. DataRescue's farewell note said that publishing IDA from late 1995 to January 2008 "has allowed us to meet the best minds of the IT Security world," and wished Guilfanov well as he "continues the adventure."

The adventure paid. Over the following decade Hex-Rays grew about 23 percent a year, and in 2020 its revenue crossed €20 million with what one report called "extraordinary" margins.

In 2022 the company booked €21.5 million in revenue and €14.5 million in net profit. IDA even turned up in the trophy case of Michal Zalewski's AFL fuzzer, listed among the software in which the fuzzer found bugs.

Selling, but Not Leaving

On October 20, 2022, Hex-Rays announced that a consortium led by the Belgian investor Smartfin, with the federal fund SFPIM and the Walloon fund SRIW, had bought control. Guilfanov, the announcement said, would reinvest "a substantial amount" in the new structure. "This partnership is an important milestone and opens new horizons for Hex-Rays," he said.

A Belgian wealth report later put the numbers on it: €81 million to Guilfanov, with the holding valued at €95 million, and a new chief executive brought in to run growth while the founder took the chairman's seat. Hex-Rays says he and its employees remain the largest shareholders of the parent company.

He's a Belgian citizen now, and lives in the country with his family. The company that started as one mathematician's shareware employs more than fifty people, and its mascot got an AI-assisted makeover for IDA 9.

IDA at 35

The product keeps moving. IDA 9.0, in October 2024, added decompilers for RISC-V and nanoMIPS and shifted the business to subscriptions. IDA 9.4 arrived in July 2026 with Swift analysis and a Git-style collaboration add-on, and IDA 9.5 followed on October 6, 2026, with three more decompilers and an MCP server so AI assistants can drive the tool.

Guilfanov's title is founder and CTO. Thirty-five years on, the man who wrote the first line of IDA is still the one deciding what it does next.

Ilfak Guilfanov: The Man Who Reads Machine Code

Guilfanov never hunted criminals or chased headlines. He built the microscope everyone else looks through, and when the world needed a patch on a holiday, he wrote one and showed his work.

That's the whole career: careful, open, unhurried, and indispensable.

If you've ever read a report on a piece of malware, you've read IDA's output. You just didn't see the name of the mathematician from Tatarstan at the bottom.