License & Deployment Mix: 10 tools – 6 OSS, 1 free non-commercial, 3 commercial.
Color: Both (offensive vuln research + defensive malware analysis).
What Is This Category?
Static and dynamic disassembly / decompilation of binaries – used in malware analysis, vulnerability research, and exploit development.
Reverse engineering tools turn machine code back into something a human can read: assembly, C-like pseudocode, control-flow graphs, type information. The work is manual and deep – a binary analyst spends hours per sample where a sandbox spends minutes – but the depth is irreplaceable for novel malware families, vulnerability research, and zero-day exploit development.
Distinct from neighbouring categories
- Malware Analysis Sandbox – Sandbox runs the sample and records behaviour; RE reads the sample and explains how it behaves
- Code Quality / SAST / DAST – Code quality / SAST scans source; RE works on shipped binaries
- Digital Forensics & IR (DFIR) – DFIR investigates what a specific compromised host shows; RE investigates what an attacker’s tool does in general
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
RE tooling splits four ways: free open-source multi-arch platforms (Ghidra, radare2 / rizin), focused-purpose open-source tools (x64dbg for Windows debugging, gdb+pwndbg for Linux, angr for symbolic execution), commercial mid-tier (Hopper, Binary Ninja), and commercial premium (IDA Pro, Binary Ninja Enterprise).
Workflow Type
What each tool is for.
| Tool | Static Disasm | Decompile | Dynamic Debug | Symbolic Exec | Scriptable |
|---|---|---|---|---|---|
| Ghidra | yes | yes | yes* | – | yes (Java / Jython) |
| radare2 + Cutter | yes | yes** | yes | partial (ESIL) | yes (r2pipe) |
| rizin + iaito | yes | yes** | yes | partial | yes |
| x64dbg | yes | – | yes | – | yes (Python / GScript) |
| gdb + pwndbg / GEF | – | – | yes | – | yes (Python) |
| angr | yes | partial | partial | yes | yes (Python) |
| Binary Ninja Free | yes | yes | – | – | yes (limited) |
| IDA Pro | yes | yes (Hex-Rays) | yes | – | yes (IDAPython) |
| Binary Ninja Commercial | yes | yes | – | – | yes (BNIL) |
| Hopper | yes | yes | yes*** | – | yes (Python) |
* Ghidra ships an integrated debugger; “yes*” indicates more limited than x64dbg / gdb.
** radare2 / rizin decompilation is via the bundled Ghidra-decompiler plugin (Cutter / iaito).
*** Hopper has an integrated debugger primarily for macOS / Linux targets.
License + Cost Tier
| Tool | License | OSI | Tier | Cost |
|---|---|---|---|---|
| Ghidra | Apache-2.0 | yes | OSS | $0 |
| radare2 + Cutter | LGPL-3.0-only | yes | OSS | $0 |
| rizin + iaito | LGPL-3.0-only | yes | OSS | $0 |
| x64dbg | GPL-3.0-only | yes | OSS | $0 |
| gdb + pwndbg / GEF | MIT | yes | OSS | $0 |
| angr | BSD-2-Clause | yes | OSS | $0 |
| Binary Ninja Free | Proprietary | – | Free (non-commercial) | $0 |
| Hopper | Proprietary | – | Mid commercial | $129-389 |
| Binary Ninja Commercial | Proprietary | – | Mid commercial | $299-1,499 |
| IDA Pro | Proprietary | – | Premium commercial | $2,000+ / seat |
Architecture Coverage
| Tool | x86/x64 | ARM/ARM64 | MIPS | PowerPC | RISC-V | m68k | exotic |
|---|---|---|---|---|---|---|---|
| Ghidra | yes | yes | yes | yes | yes | yes | many |
| radare2 + Cutter | yes | yes | yes | yes | yes | yes | many |
| rizin + iaito | yes | yes | yes | yes | yes | yes | many |
| x64dbg | yes | – | – | – | – | – | – |
| gdb + pwndbg / GEF | yes | yes | yes | partial | partial | partial | many |
| angr | yes | yes | yes | yes | – | – | some |
| Binary Ninja Free | yes | yes | – | – | – | – | – |
| Hopper | yes | yes | partial | partial | – | – | – |
| Binary Ninja Commercial | yes | yes | yes | yes | partial | yes | many |
| IDA Pro | yes | yes | yes | yes | yes | yes | most |
OS Coverage (host)
What OS the analyst tool itself runs on.
| Tool | Windows | macOS | Linux |
|---|---|---|---|
| Ghidra | yes | yes | yes |
| radare2 + Cutter | yes | yes | yes |
| rizin + iaito | yes | yes | yes |
| x64dbg | yes | – | – |
| gdb + pwndbg / GEF | partial | yes | yes |
| angr | yes | yes | yes |
| Binary Ninja Free | yes | yes | yes |
| Hopper | yes | yes | yes |
| Binary Ninja Commercial | yes | yes | yes |
| IDA Pro | yes | yes | yes |
Stack Composition
Two canonical analyst stacks.
OSS-only RE workstation
Ghidra -- primary static + decompiler radare2 / Cutter -- scripting / automation x64dbg -- Windows dynamic analysis gdb + pwndbg -- Linux dynamic analysis angr -- symbolic execution (research)
Output: full RE coverage on Linux / macOS / Windows hosts at zero license cost.
Commercial-tier workstation
IDA Pro -- premium static + Hex-Rays decompiler Binary Ninja -- modern API + BNIL (complementary) x64dbg / gdb+pwndbg -- still OSS for dynamic
Output: gold-standard static analysis where IDA’s decompiler depth and FLIRT signatures matter.
Tools
10 tools.
angr
Binary analysis framework from UC Santa Barbara; symbolic execution, control-flow analysis, and concrete + symbolic emulation in one Python package.
License: BSD-2-Clause (OSS) · Kind: library · Deploy: native, package · SSO: none
Binary Ninja Commercial
Commercial Binary Ninja from Vector 35; widely seen as the most analyst-friendly modern commercial RE platform; strong API ergonomics.
License: Proprietary (proprietary) · Kind: desktop · Deploy: native · SSO: none
Binary Ninja Free
Binary Ninja Free is the free, non-commercial tier of Vector 35’s Binary Ninja reverse-engineering tool, with x86/x64/ARM/ARM64 disassembly and decompilation, the BNIL intermediate language, and a Python API.
License: Proprietary (proprietary) · Kind: desktop · Deploy: native · SSO: none
gdb + pwndbg / GEF
GDB with the pwndbg or GEF extension; the canonical Linux-side debugger for exploit development and binary analysis.
License: MIT (OSS) · Kind: cli · Deploy: native, package · SSO: none
Ghidra
NSA-released open-source software reverse-engineering framework; comparable to IDA Pro at zero cost; the canonical OSS disassembler / decompiler.
License: Apache-2.0 (OSS) · Kind: desktop · Deploy: native · SSO: none
Hopper Disassembler
macOS / Linux reverse-engineering tool from Hopper Software; analyst-friendly UI; popular for iOS / macOS-side RE.
License: Proprietary (proprietary) · Kind: desktop · Deploy: native · SSO: none
IDA Pro
Premium commercial reverse-engineering platform from Hex-Rays; the long-standing industry standard before Ghidra’s open release.
License: Proprietary (proprietary) · Kind: desktop · Deploy: native · SSO: none
radare2 + Cutter
Long-running open-source reverse-engineering framework; Cutter is the Qt-based GUI on top of the radare2 engine.
License: LGPL-3.0-only (OSS) · Kind: desktop · Deploy: native, docker, package · SSO: none
rizin + iaito
Community fork of radare2 emphasising stability and documentation; iaito is its Qt GUI counterpart to Cutter.
License: LGPL-3.0-only (OSS) · Kind: desktop · Deploy: native, docker, package · SSO: none
x64dbg
Open-source Windows debugger for x86 / x64; the successor to OllyDbg; the analyst favourite for Windows-side malware analysis.
License: GPL-3.0-only (OSS) · Kind: desktop · Deploy: native · SSO: none
