Reverse engineering tools:
what to use for each job
Reverse engineering tools are programs that turn compiled software back into something a person can read and test, without access to the source code. In November 2026 the work splits into five jobs, and each job has its own tools: reading the code, running it under control, watching it from the inside, identifying the file, and handing the analysis to an AI model. Most analysts keep one or two tools per job. Nobody uses one tool for everything.
This guide sorts the common reverse engineering tools by job and says what each one shows. It also covers the point where all of them stop: code that a protector has moved into its own virtual machine.
What are reverse engineering tools?
Reverse engineering tools are the software an analyst uses to understand a compiled program: what it does, how it is built and how it behaves when it runs. “Reverse engineering software” means the same thing in this context. The term also covers 3D-scanning and CAD tools for physical parts, which this guide leaves out.
Software reverse engineering tools fall into two groups. Static tools read the file without running it. Dynamic tools run the program and watch it. Security researchers, malware analysts and developers who maintain old code without its source all use both.
Reverse engineering tools by task
Reverse engineering tools by task look like this, from the first look at a file to the hand-off to an AI agent.
| Task | What it answers | Common tools | Free or paid |
|---|---|---|---|
| File triage | What is this file, and was it packed or protected? | Detect It Easy, PE-bear, pestudio | Free |
| Disassembly and decompilation | What does the code say? | Ghidra, IDA Pro, Binary Ninja, radare2 | Ghidra and radare2 free; IDA Pro and Binary Ninja paid, with free versions |
| Debugging | What happens when this line runs? | x64dbg, WinDbg, GDB, LLDB | Free |
| Dynamic instrumentation | What does the program call while it runs? | Frida | Free |
| Network and behavior | What does it send, and to whom? | Wireshark | Free |
| AI and MCP | Can a model read and explain this analysis? | AI decompiler plugins, MCP servers for IDA Pro and Ghidra | Mixed |
Disassemblers and decompilers
Disassemblers and decompilers are the center of most reverse engineering work. A disassembler turns machine code into assembly instructions. A decompiler goes one step further and rebuilds C-like pseudocode from those instructions.
- Ghidra is a free, open-source reverse engineering framework that the NSA released in March 2019. It includes a decompiler for x86, x64, ARM and many other architectures, and it supports scripting in Java and Python.
- IDA Pro, from Hex-Rays, is the long-standing commercial standard, with the Hex-Rays decompiler and a large plugin ecosystem. Many delivered analyses, including Devirt’s, arrive as IDA databases.
- Binary Ninja, from Vector 35, is a commercial disassembler and decompiler built around an intermediate language that scripts and plugins can work with.
- radare2 is a free, command-line reverse engineering framework that runs almost everywhere and suits scripting.
For managed code the tools differ. ILSpy decompiles .NET assemblies and JD-GUI decompiles Java classes, because that bytecode keeps far more structure than native machine code.
Debuggers
A debugger runs a program one step at a time so you can stop it, inspect memory and registers, and change values. Static reading tells you what the code could do. A debugger shows what it does on one run.
Dynamic instrumentation
Dynamic instrumentation tools hook into a running program and report what it does without stepping through it by hand. Frida is the best known. It injects a script into a process so you can log calls, read arguments and change return values on Windows, macOS, Linux, iOS and Android.
Instrumentation is fast for answering “which files, keys and network calls does this touch?” Like a debugger, it only sees the code paths that run during your session.
File triage tools
File triage tools answer the first question about a sample: what is this file? Detect It Easy reads a file’s signatures and reports the compiler, packer or protector it recognizes. PE-bear and pestudio show the structure of a Windows Portable Executable (PE) file: its sections, imports and resources. pestudio also flags indicators an analyst should look at first.
Malware analysts add YARA, a pattern-matching language for describing and finding families of samples, and Wireshark for network captures. Triage decides what comes next. A file that triage tools report as protected by VMProtect or Themida will not read normally in a decompiler, and that changes the plan.
AI and MCP tools
AI and MCP tools are the newest category of reverse engineering tools. They connect a large language model to an existing disassembler so it can rename variables, summarize functions or answer questions about the binary.
- AI decompiler plugins send a decompiler’s output to a model and bring back a rewrite. The guide to what an AI decompiler recovers and where it stops covers the three kinds and what each can confirm.
- MCP servers use the Model Context Protocol so an AI agent can query IDA Pro or Ghidra directly: list functions, read pseudocode and follow cross-references. The guide to reverse engineering MCP on obfuscated binaries explains where these agents stall.
- Devirt’s read-only MCP connector lets an agent read assessments, jobs, results and the structured ledger metadata beside its other tools.
A model’s output reads cleanly, but the names it adds are predictions. Treat them as hypotheses until something checks them.
Where reverse engineering tools stop: VM-protected code
Reverse engineering tools stop at code virtualization, a protection used by VMProtect, Themida and similar protectors. Virtualization translates selected functions into bytecode for a private virtual machine embedded in the program. The original instructions are no longer in the file at all.
Each tool meets that wall differently:
- A decompiler such as IDA Pro or Ghidra shows the virtual machine’s dispatcher loop and its handlers instead of the function’s logic.
- A debugger or Frida shows the handlers executing, one bytecode instruction at a time, and only for the paths that ran.
- Triage tools can report that a protector is present, but not what the protected functions do.
- An AI model reads what the decompiler shows it, so it describes the interpreter rather than the program.
Recovering the logic is a separate job called devirtualization. The comparison of devirtualization, deobfuscation and unpacking explains the three kinds of protection and what removes each one. Devirt returns recovered functions as an IDA database and annotated pseudocode, with a coverage ledger that says which functions were proven. The walkthrough of reviewing a recovered VMProtect result in IDA shows what that looks like in practice.
What is the best tool for reverse engineering?
The best reverse engineering tool depends on the job, but most analysts start with one disassembler-decompiler and one debugger. Ghidra is the usual free starting point, IDA Pro is the long-standing commercial standard, and Binary Ninja sits between them. On Windows, x64dbg covers debugging.
A sensible kit by job:
- Malware triage: Detect It Easy, pestudio, Ghidra or IDA Pro, x64dbg, YARA and Wireshark.
- Vulnerability research: IDA Pro or Binary Ninja, a debugger, and Frida for runtime checks.
- Legacy code without source: Ghidra or IDA Pro, plus ILSpy or JD-GUI if the program is .NET or Java.
- Agent-assisted analysis: any of the above plus an MCP server, so a model can read the analysis.
If triage shows VM protection, add devirtualization to that list before planning weeks of manual tracing. The protected binary analysis workflow walks through the stages in order, and the binary analysis research hub explains the methods behind them.
Questions about reverse engineering tools
Can ChatGPT decompile code?
ChatGPT and other general-purpose language models are not decompilers: they don’t open a binary file themselves. Given the assembly or pseudocode that a decompiler such as Ghidra or IDA Pro produces, they can rewrite and explain it. NowSecure’s January 2025 write-up shows models renaming variables and explaining a function’s logic, and warns that hallucinations make human oversight important.
Is it legal to use reverse engineering tools?
Reverse engineering tools are legal to own and use, and they are standard in security research, malware analysis and interoperability work. Whether a particular analysis is allowed depends on your rights to the specific file, the license you accepted and the law where you are. Devirt accepts only files you own or are authorized to analyze, and its acceptable use policy refuses cracking and license bypass. This is general information, not legal advice.
Are there free reverse engineering tools?
Most reverse engineering tools have a free option. Ghidra, radare2, x64dbg, WinDbg, GDB, Frida, Detect It Easy, PE-bear, YARA and Wireshark are all free. IDA Pro and Binary Ninja are paid products, and both offer free versions with fewer features.
Do I need a service for software reverse engineering?
You need a software reverse engineering service when the job is bigger than your team’s time, or when the code is protected in a way your tools can’t read. Devirt’s software reverse engineering services cover protected binaries, and the list of supported protectors shows which protections it automates.
To see what recovery would cover for your own file, create an account and upload a file you own or are authorized to analyze. Paid work starts only after you accept the offer.