Reverse Engineering & Debuggers

About Reverse Engineering & Debuggers

Reverse engineering tools disassemble, decompile, and debug compiled binaries to understand their behavior when source code is unavailable. The category includes disassemblers like Ghidra, radare2, and Cutter that convert machine code into human-readable assembly, decompilers that attempt to reconstruct higher-level source code from binaries, and debuggers like GDB, pwndbg, and x64dbg that let analysts step through execution, inspect memory, and set breakpoints. These tools are used for malware analysis, where analysts reverse engineer malicious binaries to understand their capabilities, communication protocols, and persistence mechanisms. Firmware auditing is another application, since IoT and embedded device firmware is often distributed without source code, requiring binary analysis to find vulnerabilities. Patch diffing compares two versions of a binary to identify what changed in a security update, which can reveal the vulnerability being patched. The category overlaps with binary exploitation, since exploit development requires understanding binary internals. Tools like angr and Rizin provide programmatic analysis APIs for automated binary inspection, while Ghidra offers a plugin architecture for custom analysis scripts. Most tools support multiple CPU architectures including x86, ARM, MIPS, and RISC-V, since malware and firmware target diverse hardware.