Reverse engineering tools, reviewed for safety
135 tools and resources for understanding software you did not write: native binaries, Android and .NET apps, language runtimes, web apps, firmware and smart contracts. Every entry is flagged for execution and disclosure risk, and maintenance data refreshes weekly.
Categories
Compare
Ghidra vs IDA Pro vs Binary Ninja: price, decompilation, scripting, AI integration and security notes side by side.
Safety first
Analyse in a full VM with no route out, download tools only from the official source (lookalike sites for Ghidra, dnSpy and ILSpy have pushed malware), treat project files and proof-of-concept repos as code, look up hashes instead of uploading, and keep approvals on when an AI agent reads a hostile binary.
Frequently asked questions
What is the best free decompiler?
Ghidra is the most capable free decompiler: open source under Apache-2.0, with a decompiler for every supported architecture, scripting in Java and Python, BSim similarity search and a team server. Binary Ninja Free (non-commercial) decompiles x86, x86-64, ARMv7 and AArch64, and Cutter bundles the Ghidra decompiler in a lighter GUI. IDA Free decompiles in the cloud, so your code leaves your machine.
Is it legal to reverse engineer software?
It depends on the country, the licence and what you do with the result. The EU Software Directive (Art. 6) permits decompilation for interoperability, and US law (17 USC 1201(f)) permits circumvention for interoperability, while licence terms banning reverse engineering can still bind you. Your own code, open-source code, CTF and crackme binaries released for analysis, and targets under written authorisation are the safe ground. This is not legal advice.
How do I start learning reverse engineering?
Build an isolated VM first, then compile your own small C programs at -O0 and -O2 and read them in Compiler Explorer and Ghidra. Add x86-64 and the calling conventions (OpenSecurityTraining2 Arch1001, pwn.college), then practise on browser and SSH targets such as picoGym, Microcorruption and OverTheWire Leviathan before downloading crackmes into the VM. The list includes a 12-week path.
Is it safe to download reverse engineering tools?
Only from the official source. Lookalike sites for Ghidra, dnSpy and ILSpy (for example ghidralite.com, dnspy.org, dnspy.net and ilspy.org) have pushed wallet-stealing malware, a trojanised cracked IDA Pro was used against researchers, and fake proof-of-concept repositories have hidden payloads in dependencies. Every entry in this list links its official source and flags tools that are commonly impersonated.
Can AI agents reverse engineer binaries?
They can drive real tools through MCP servers for Ghidra, IDA, Binary Ninja, JADX and radare2, and REA wraps many of them behind one server. They are good at triage, naming and navigation, but research decompilers produce code that re-executes correctly on only about 20 to 65% of benchmark functions, so every model claim needs checking against the disassembly. Run agents inside an isolated VM with approvals on, because strings in a hostile binary can try to instruct the agent.
What should I use for Android apps?
Start with JADX for readable Java from DEX, Apktool for resources and smali, and Androguard for scripting. JEB is a commercial decompiler aimed at obfuscated Android code, and MobSF automates an audit. Use Frida-based tools such as objection only on apps you are authorised to test, on an emulator or a test device.