Reverse Engineering — Ghidra, IDA, Binary Ninja

Reverse engineering is the bridge from "binary blob" to "I understand what this does." The 2024–26 landscape: Ghidra's decompiler closed the gap with IDA, Binary Ninja added a free Cloud tier, and Frida is the dominant dynamic-instrumentation toolkit. For binary fuzzing see Binary Fuzzing. For exploit development see CTF Tools (pwntools). For malware-specific RE see Malware Analysis.

Disassemblers / decompilers

• ★ ★ Ghidra (NSA) — full reverse-engineering platform; disassembler + decompiler + scripting + collaborative server. Java GUI; supports x86/x64, ARM, MIPS, PowerPC, RISC-V, AVR, SuperH … Free / OSS — the surprise gift from NSA in 2019 that has aged into a serious IDA competitor.
• IDA Free (Hex-Rays) — the legacy reference disassembler; Free version (x64 only, no decompiler), IDA Home / Pro paid ($365–$2,000+/yr) for the full Hex-Rays decompiler.
• Binary Ninja (Vector 35) — modern UX; scripting-first. Personal license $300 one-time, Cloud free tier for browser-based RE since 2023.
• Hopper Disassembler — Mac-native; paid ($99 personal).
• Cutter — Qt GUI on top of Rizin (radare2 fork); fully free; the FOSS IDA-alike. Modernised significantly 2023–26.
• radare2 / rizin — CLI / scripting; rizin is the sustainable fork. Steep curve, bottomless capability.
• JEB Pro (PNF Software) — paid; the best Android decompiler / dex decompiler.
• angr — Python symbolic execution framework; binary auto-analysis.
• BinDiff (Zynamics / Google) — patch-diff / similarity. Free.
• Diaphora — IDA / Ghidra plugin for binary diffing.

Decompiler-only / online

• Decompiler Explorer (decompiler.uk) — paste a binary, see Ghidra / IDA / Snowman / RetDec output side-by-side. Free.
• dogbolt.org — same idea; multi-decompiler comparison.
• RetDec (Avast) — open-source decompiler.
• Snowman — older C++ decompiler.

Debuggers

• ★ GDB + ★ GEF / pwndbg / PEDA — the Linux exploit-dev debugger trio of plugins. Free.
• ★ x64dbg (Win) — modern x64/x86 Windows debugger; FOSS replacement for OllyDbg. Free.
• WinDbg / WinDbg Preview (Microsoft) — kernel + user; for Windows internals and dump analysis.
• OllyDbg 1.10 — legacy; still used for malware reversing.
• Immunity Debugger — old.
• LLDB — Apple / clang's debugger.
• Frida + frida-gdb — bridge dynamic instrumentation to gdb sessions.

Dynamic instrumentation / hooking

• ★ ★ Frida — JS-driven dynamic instrumentation; hook functions, patch in-memory, dump/replace data; runs on Win / macOS / Linux / Android / iOS. Free. The dominant tool for app-runtime RE in 2026.
• objection (SensePost) — Frida wrapper; mobile-app shortcuts (cert pinning bypass, root-detect bypass, keychain dump). Free.
• DynamoRIO / Pin — instruction-level instrumentation (Intel).
• Hopper / IDAPython / JEB Python — host-native scripting.

Android / Java

• ★ jadx — Android dex → Java decompiler; the default. Free.
• apktool — repack / rebuild APKs.
• dex2jar — older.
• bytecode-viewer — multi-decompiler view.
• Procyon / CFR / Fernflower — pure-Java decompilers.
• smali / baksmali — Dalvik assembler / disassembler.
• MobSF — see Mobile Pentesting.

iOS / Mach-O

• Hopper / IDA / Ghidra — disassemble Mach-O; Hopper is comfiest on Mac.
• class-dump / class-dump-z — Objective-C class headers.
• frida-ios-dump — pull decrypted IPA.
• Ghidra macOS toolchain extension — Apple Silicon / arm64e support improved 2024–26.

Binary inspection / triage

• strings, rabin2, binwalk, die (Detect It Easy), PEStudio, PE-bear, ExifTool — quick triage.
• capa (Mandiant) — capability detection rules; "this binary creates registry persistence." Free.
• FLOSS (Mandiant) — extract obfuscated strings.
• YARA — pattern-matching; see Detection (Sigma / YARA / ATT&CK).

Firmware / embedded

• ★ binwalk — extract embedded filesystems / kernels from firmware images. Free. See also Steganography (binwalk).
• firmware-mod-kit / unblob — modern unpackers; unblob is Onekey's Rust replacement and is much better than binwalk's extractor for 2024+ work.
• EMBA / FACT — automated firmware analysis frameworks.
• Ghidra SVD-Loader — load ARM Cortex peripheral defs.
• See also Hardware Hacking (Flipper).

Pick this if…

• Default free disassembler + decompiler: Ghidra.
• Hex-Rays decompile is non-negotiable: IDA Pro (paid).
• Modern UX, scripting: Binary Ninja.
• FOSS Qt GUI on radare-family: Cutter / rizin.
• Windows live debug: x64dbg.
• Linux exploit debug: GDB + GEF.
• Android app teardown: jadx + apktool + Frida + objection.
• Runtime hooking, all platforms: Frida.
• Firmware unpacking: unblob > binwalk for 2024+ formats.