Color: Both (offensive vuln research + defensive malware analysis).
What Is This Category?
Mix (10 tools)
- License: 6 open source · 4 proprietary
- Hosting: 10 self-hosted · 0 SaaS · 0 both
Static and dynamic disassembly / decompilation of binaries – used in malware analysis, vulnerability research, and exploit development.
Reverse engineering tools turn machine code back into something a human can read: assembly, C-like pseudocode, control-flow graphs, type information. The work is manual and deep – a binary analyst spends hours per sample where a sandbox spends minutes – but the depth is irreplaceable for novel malware families, vulnerability research, and zero-day exploit development.
Distinct from neighbouring categories
- Malware Analysis Sandbox – Sandbox runs the sample and records behaviour; RE reads the sample and explains how it behaves
- Code Quality / SAST / DAST – Code quality / SAST scans source; RE works on shipped binaries
- Digital Forensics & IR (DFIR) – DFIR investigates what a specific compromised host shows; RE investigates what an attacker’s tool does in general
About this data & disclaimer
The information on these pages was researched by a combination of human review and large language models. This catalogue serves as a reference for the resources, applications, devices, deployment payloads, and other components that the ResorsIT platform integrates, deploys, and manages. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. This information is compiled on a best-effort basis: it may be incomplete, contain errors, and become out of date as tools, vendors, licences, and features change. Use this catalogue only as a starting point for your own research, and independently verify and review any tool carefully against your own requirements before relying on it.
Comparison
RE tooling splits four ways: free open-source multi-arch platforms (Ghidra, radare2 / rizin), focused-purpose open-source tools (x64dbg for Windows debugging, gdb+pwndbg for Linux, angr for symbolic execution), commercial mid-tier (Hopper, Binary Ninja), and commercial premium (IDA Pro, Binary Ninja Enterprise).
Workflow Type
What each tool is for.
| Tool | Static Disasm | Decompile | Dynamic Debug | Symbolic Exec | Scriptable |
|---|---|---|---|---|---|
| Ghidra | yes | yes | yes* | – | yes (Java / Jython) |
| radare2 + Cutter | yes | yes** | yes | partial (ESIL) | yes (r2pipe) |
| rizin + iaito | yes | yes** | yes | partial | yes |
| x64dbg | yes | – | yes | – | yes (Python / GScript) |
| gdb + pwndbg / GEF | – | – | yes | – | yes (Python) |
| angr | yes | partial | partial | yes | yes (Python) |
| Binary Ninja Free | yes | yes | – | – | yes (limited) |
| IDA Pro | yes | yes (Hex-Rays) | yes | – | yes (IDAPython) |
| Binary Ninja Commercial | yes | yes | – | – | yes (BNIL) |
| Hopper | yes | yes | yes*** | – | yes (Python) |
* Ghidra ships an integrated debugger; “yes*” indicates more limited than x64dbg / gdb.
** radare2 / rizin decompilation is via the bundled Ghidra-decompiler plugin (Cutter / iaito).
*** Hopper has an integrated debugger primarily for macOS / Linux targets.
License + Cost Tier
| Tool | License | OSI | Tier | Cost |
|---|---|---|---|---|
| Ghidra | Apache-2.0 | yes | OSS | $0 |
| radare2 + Cutter | LGPL-3.0-only | yes | OSS | $0 |
| rizin + iaito | LGPL-3.0-only | yes | OSS | $0 |
| x64dbg | GPL-3.0-only | yes | OSS | $0 |
| gdb + pwndbg / GEF | MIT | yes | OSS | $0 |
| angr | BSD-2-Clause | yes | OSS | $0 |
| Binary Ninja Free | Proprietary | – | Free (non-commercial) | $0 |
| Hopper | Proprietary | – | Mid commercial | $129-389 |
| Binary Ninja Commercial | Proprietary | – | Mid commercial | $299-1,499 |
| IDA Pro | Proprietary | – | Premium commercial | $2,000+ / seat |
Architecture Coverage
| Tool | x86/x64 | ARM/ARM64 | MIPS | PowerPC | RISC-V | m68k | exotic |
|---|---|---|---|---|---|---|---|
| Ghidra | yes | yes | yes | yes | yes | yes | many |
| radare2 + Cutter | yes | yes | yes | yes | yes | yes | many |
| rizin + iaito | yes | yes | yes | yes | yes | yes | many |
| x64dbg | yes | – | – | – | – | – | – |
| gdb + pwndbg / GEF | yes | yes | yes | partial | partial | partial | many |
| angr | yes | yes | yes | yes | – | – | some |
| Binary Ninja Free | yes | yes | – | – | – | – | – |
| Hopper | yes | yes | partial | partial | – | – | – |
| Binary Ninja Commercial | yes | yes | yes | yes | partial | yes | many |
| IDA Pro | yes | yes | yes | yes | yes | yes | most |
OS Coverage (host)
What OS the analyst tool itself runs on.
| Tool | Windows | macOS | Linux |
|---|---|---|---|
| Ghidra | yes | yes | yes |
| radare2 + Cutter | yes | yes | yes |
| rizin + iaito | yes | yes | yes |
| x64dbg | yes | – | – |
| gdb + pwndbg / GEF | partial | yes | yes |
| angr | yes | yes | yes |
| Binary Ninja Free | yes | yes | yes |
| Hopper | yes | yes | yes |
| Binary Ninja Commercial | yes | yes | yes |
| IDA Pro | yes | yes | yes |
Stack Composition
Two canonical analyst stacks.
OSS-only RE workstation
Ghidra -- primary static + decompiler radare2 / Cutter -- scripting / automation x64dbg -- Windows dynamic analysis gdb + pwndbg -- Linux dynamic analysis angr -- symbolic execution (research)
Output: full RE coverage on Linux / macOS / Windows hosts at zero license cost.
Commercial-tier workstation
IDA Pro -- premium static + Hex-Rays decompiler Binary Ninja -- modern API + BNIL (complementary) x64dbg / gdb+pwndbg -- still OSS for dynamic
Output: gold-standard static analysis where IDA’s decompiler depth and FLIRT signatures matter.
Tools
10 tools.
angr
Binary analysis framework from UC Santa Barbara; symbolic execution, control-flow analysis, and concrete + symbolic emulation in one Python package.
License: BSD-2-Clause (OSS) · Kind: library · Deploy: direct, package · SSO: none
ResorsIT usage: Library
Binary Ninja Commercial
Commercial Binary Ninja from Vector 35; widely seen as the most analyst-friendly modern commercial RE platform; strong API ergonomics.
License: Proprietary (proprietary) · Kind: desktop · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Vaulted credential · Local host account
Binary Ninja Free
Binary Ninja Free is the free, non-commercial tier of Vector 35’s Binary Ninja reverse-engineering tool, with x86/x64/ARM/ARM64 disassembly and decompilation, the BNIL intermediate language, and a Python API.
License: Proprietary (proprietary) · Kind: desktop · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Vaulted credential · Local host account
gdb + pwndbg / GEF
GDB with the pwndbg or GEF extension; the canonical Linux-side debugger for exploit development and binary analysis.
License: MIT (OSS) · Kind: cli · Deploy: direct, package · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Local host account · Key-based access
Ghidra
NSA-released open-source software reverse-engineering framework; comparable to IDA Pro at zero cost; the canonical OSS disassembler / decompiler.
License: Apache-2.0 (OSS) · Kind: desktop · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Vaulted credential · Local host account
Hopper Disassembler
macOS / Linux reverse-engineering tool from Hopper Software; analyst-friendly UI; popular for iOS / macOS-side RE.
License: Proprietary (proprietary) · Kind: desktop · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Vaulted credential · Local host account
IDA Pro
Premium commercial reverse-engineering platform from Hex-Rays; the long-standing industry standard before Ghidra’s open release.
License: Proprietary (proprietary) · Kind: desktop · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Vaulted credential · Local host account
radare2 + Cutter
Long-running open-source reverse-engineering framework; Cutter is the Qt-based GUI on top of the radare2 engine.
License: LGPL-3.0-only (OSS) · Kind: desktop · Deploy: direct, docker, package · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Vaulted credential · Local host account
rizin + iaito
Community fork of radare2 emphasising stability and documentation; iaito is its Qt GUI counterpart to Cutter.
License: LGPL-3.0-only (OSS) · Kind: desktop · Deploy: direct, docker, package · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Vaulted credential · Local host account
x64dbg
Open-source Windows debugger for x86 / x64; the successor to OllyDbg; the analyst favourite for Windows-side malware analysis.
License: GPL-3.0-only (OSS) · Kind: desktop · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Vaulted credential · Local host account
