Reverse Engineering
Software analysis tools used for malware triage, binary inspection, firmware auditing, and patch diffing across multiple CPU architectures.
| Tool | License | Platforms | Pricing | Action |
|---|---|---|---|---|
| angr | BSD-2-Clause | Linux, macOS, Windows | Open Source | Profile→ |
| Binary Ninja | Proprietary | Linux, macOS, Windows | Freemium | Profile→ |
| BinDiff | Apache-2.0 | Linux, macOS, Windows | Open Source | Profile→ |
| Cutter | GPL-3.0-only | Linux, macOS, Windows | Open Source | Profile→ |
| Diaphora | AGPL-3.0-or-later | Linux, macOS, Windows | Open Source | Profile→ |
| dnSpyEx | GPL-3.0-or-later | Windows | Open Source | Profile→ |
| GDB | GPL-3.0-or-later | Linux, macOS, Windows | Open Source | Profile→ |
| Ghidra | Apache-2.0 | Linux, macOS, Windows | Open Source | Profile→ |
| IDA Pro | Proprietary | Linux, macOS, Windows | Commercial | Profile→ |
| radare2 | LGPL-3.0-only (core); GPL-3.0-only (selective plugins) | Linux, macOS, Windows, BSD | Open Source | Profile→ |
| Rizin | LGPL-3.0-only | Linux, macOS, Windows, BSD | Open Source | Profile→ |
| x64dbg | Modified GPL-3.0 with custom plugin exception (not OSI-approved; see repo LICENSE) | Windows | Free | Profile→ |
Software in Reverse Engineering
angr
Open SourcePython framework for multi-architecture binary analysis, combining symbolic execution with static and dynamic methods for security auditing.
Binary Ninja
FreemiumModern interactive disassembler and decompiler platform with strong APIs and a free cloud tier.
BinDiff
Open SourceBinary comparison tool that visualizes function-level differences between two builds of a program.
Cutter
Open SourceFree reverse engineering platform powered by Rizin, providing a modern Qt interface for binary decompilation and graph views.
Diaphora
Open SourceOpen source program diffing tool that compares binary function sets to find patched vulnerabilities.
dnSpyEx
Open SourceUnofficial continuation of dnSpy, a .NET debugger and assembly editor for inspection, modification, and debugging of managed code without source files.
GDB
Open SourceGNU Project source-level debugger for inspecting process memory, breakpoints, and program execution in C, C++, Rust, and Go.
Ghidra
Open SourceSoftware reverse engineering suite developed by the NSA, offering disassembly, decompilation, and scriptable binary analysis.
IDA Pro
CommercialIndustry-standard disassembler and decompiler from Hex-Rays with the broadest processor support.
radare2
Open SourceCommand-line reverse engineering framework providing scriptable disassembly, binary patching, and cross-platform analysis.
Rizin
Open SourceUNIX-like reverse engineering framework and disassembler focused on stability, scriptability, and deep binary forensics.
x64dbg
FreeFree x64 and x32 debugger for Windows binaries, featuring assembly viewing, memory editing, and plugin extensibility.
Frequently Asked Questions
What is Reverse Engineering?→
Software analysis tools used for malware triage, binary inspection, firmware auditing, and patch diffing across multiple CPU architectures.
What topics does the Reverse Engineering category cover?→
Multi-Architecture Disassembly, Decompilation & Source Recovery, Dynamic Debugging & Tracing, Firmware Auditing, Binary Diffing & Patch Analysis
About Reverse Engineering
Reverse engineering tools disassemble, decompile, and debug compiled binaries to understand their behavior when source code is unavailable. The category includes disassemblers like Ghidra, radare2, and Cutter that convert machine code into human-readable assembly, decompilers that attempt to reconstruct higher-level source code from binaries, and debuggers like GDB, pwndbg, and x64dbg that let analysts step through execution, inspect memory, and set breakpoints. These tools are used for malware analysis, where analysts reverse engineer malicious binaries to understand their capabilities, communication protocols, and persistence mechanisms. Firmware auditing is another application, since IoT and embedded device firmware is often distributed without source code, requiring binary analysis to find vulnerabilities. Patch diffing compares two versions of a binary to identify what changed in a security update, which can reveal the vulnerability being patched. The category overlaps with binary exploitation, since exploit development requires understanding binary internals. Tools like angr and Rizin provide programmatic analysis APIs for automated binary inspection, while Ghidra offers a plugin architecture for custom analysis scripts. Most tools support multiple CPU architectures including x86, ARM, MIPS, and RISC-V, since malware and firmware target diverse hardware.
Covered Topics & Disciplines
Related Security Categories
Binary analysis and ROP tools for exploit research and compiler-mitigation verification.
Disk and memory forensics, malware sandboxes, and incident response collection platforms.
Android and iOS application analyzers, runtime instrumentation frameworks, and mobile assessment suites.