Skip to content

Instantly share code, notes, and snippets.

@top-master
Created February 1, 2024 05:21
Show Gist options
  • Save top-master/d70ee720a271f3127c59bc1345446fc2 to your computer and use it in GitHub Desktop.
Save top-master/d70ee720a271f3127c59bc1345446fc2 to your computer and use it in GitHub Desktop.
Is there any disassembler to rival IDA Pro?

You didn't mention a platform (Windows, Linux, macOS, etc), but here are some great disassemblers.

Ghidra

Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. Windows, Mac OS, and Linux.

Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of process instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python.

IDE - Integerated (Reverse) Development Environment: Has almost anything you would normally pick IDA-Pro for (can show C source beside related ASM, Call-Graph view, multi-user collaboration).

Top Cons: Is slower than IDA Pro, since it's written in Java, but that can be worked around by purchasing better PC instead of IDA Pro license (else static-analysis for 3 MiB or 4 MiB binary may take around one hour).

radare2

Radare2 is an open source tool to disassemble, debug, analyze and manipulate binary files.

It actually supports many architectures (x86{16,32,64}, Dalvik, avr, ARM, java, PowerPC, Sparc, MIPS) and several binary formats (pe{32,64}, [fat]mach0{32,64}, ELF{32,64}, dex and Java classes), apart from support for filesystem images and many more features.

Top Cons: It runs on the command line, but it has a graphical interface called Cutter that has support for some of its features already.

Binary Ninja

Binary Ninja is a reverse engineering platform. It focuses on a clean and easy to use interface with a powerful multithreaded analysis built on a custom IL to quickly adapt to a variety of architectures, platforms, and compilers. Runs on macOS, Windows, and Linux.

IDE: Has almost anything you would normally pick IDA-Pro for (can show C code beside related ASM, Call-Graph view, multi-user collaboration).

Top Cons: Need purchase (at time of writting) to access most features. Also, comunity is new, hence less plug-ins compared to IDA Pro.

Hopper

Hopper is a reverse engineering tool for macOS and Linux, that lets you disassemble, decompile and debug (OS X only) your 32/64bits Intel Mac, Windows and iOS (ARM) executables.

x64dbg

An open-source x64/x32 debugger for windows.

Top Cons: Source shown for binary is not always valid, and complicated, hence may be better to view ASM-mode instead.

ImmunityDbg

Immunity Debugger is a branch of OllyDbg v1.10, with built-in support for Python scripting and much more.

Top Cons (at time of writting): Is not updated since 2020. Has no C/C++ Source view.

PE Explorer's disassembler

The PE Explorer Disassembler is designed to be easy to use compared with other disassemblers. To that end, some of the functionality found in other products has been left out in order to keep the process simple and fast. While as powerful as the more expensive, dedicated disassemblers, PE Explorer focuses on ease of use, clarity and navigation.

Hiew

Hiew is a great disassembler designed for hackers, as the name suggests. It supports three modes - Text, Hexadecimal and Decode (Dis-assembly) mode.

Top Cons: DOS-age GUI (preview), but at least more than just command line.

ODA

The Online Disassembler is a free web-based, reverse engineering platform that supports over 60 architectures and object file formats from all the major operating systems, including Windows, Mac OS X, Linux, and mobile platforms.

Relyze

Relyze is a commercial interactive disassembler for x86, x64 and ARM software with loaders for PE or ELF file formats. It supports interactive flat and graph views of the disassembly, generating call and reference graphs, binary diffing two executables, exploring the executable file's structure and a Ruby plugin API. It can also handle things like symbols (PDB's), function local variables, switch statements, exception handlers, static library identification and more.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment