Is there any disassembler (not only a live debugger) second to IDA in capabilities? IDA is wonderful, and somewhat amazing in how robust and useful it is for reversing. However, it is quite expensive to properly license. Is there any viable alternative, or does IDA hold the monopoly on this market?

I don't expect an alternative to be as good as IDA, just looking for other options that may be more affordable, and useful enough.

EDIT: Preferrably, multi-platform support should exist, though that's optional. MIPS, ARM, x86, and x86-64 would be nice, but a disassembler that handles any one of those is a good option to know about.

  • 2
    I don't know any tool for static analysis other than IDA. However for live debugging there are many better alternatives, x64dbg being one of them. IDA's UI is clunky and lacking. – savram Dec 26 '17 at 20:02

16 Answers 16

up vote 222 down vote accepted

You didn't mention a platform (Windows, Linux, macOS, etc), but here are some great disassemblers.

radare2

Radare2 is an open source tool to disassemble, debug, analyze and manipulate binary files.

It actually supports many architectures (x86{16,32,64}, Dalvik, avr, ARM, java, PowerPC, Sparc, MIPS) and several binary formats (pe{32,64}, [fat]mach0{32,64}, ELF{32,64}, dex and Java classes), apart from support for filesystem images and many more features.

It runs on the command line, but it has a graphical interface in PyGTK called Bokken that has support for some of its features already.

Binary Ninja

Binary Ninja is a reverse engineering platform. It focuses on a clean and easy to use interface with a powerful multithreaded analysis built on a custom IL to quickly adapt to a variety of architectures, platforms, and compilers. Runs on macOS, Windows, and Linux.

Hopper

Hopper is a reverse engineering tool for macOS and Linux, that lets you disassemble, decompile and debug (OS X only) your 32/64bits Intel Mac, Windows and iOS (ARM) executables.

x64dbg

An open-source x64/x32 debugger for windows.

ImmunityDbg

Immunity Debugger is a branch of OllyDbg v1.10, with built-in support for Python scripting and much more.

PE Explorer's disassembler

The PE Explorer Disassembler is designed to be easy to use compared with other disassemblers. To that end, some of the functionality found in other products has been left out in order to keep the process simple and fast. While as powerful as the more expensive, dedicated disassemblers, PE Explorer focuses on ease of use, clarity and navigation.

Hiew

Hiew is a great disassembler designed for hackers, as the name suggests. It supports three modes - Text, Hexadecimal and Decode (Dis-assembly) mode.

ODA

The Online Disassembler is a free web-based, reverse engineering platform that supports over 60 architectures and object file formats from all the major operating systems, including Windows, Mac OS X, Linux, and mobile platforms.

Relyze

Relyze is a commercial interactive disassembler for x86, x64 and ARM software with loaders for PE or ELF file formats. It supports interactive flat and graph views of the disassembly, generating call and reference graphs, binary diffing two executables, exploring the executable file's structure and a Ruby plugin API. It can also handle things like symbols (PDB's), function local variables, switch statements, exception handlers, static library identification and more.

Medusa

Medusa is an open source disassembler with x86, x64, z80 and partial ARM support. It runs on Windows and Linux. It has interactive flat and graph views.

  • 3
    I would add HIEW too, since you included PE Explorer. I've always found it remarkably good to do this day, though it needs an update bad. – dyasta Apr 17 '13 at 1:55
  • 3
    I'm a bit surprised that ImmunityDebugger and OllyDbg are not part of this list. Is it because they are not multi-platforms ? – perror Apr 17 '13 at 9:09
  • 3
    From my experience radare2 is much better than hopper. Just use 'fresh' version (at least 0.9.4) and visual mode ('Vpd' command). – Anton Kochkov Apr 18 '13 at 8:55
  • 3
    @MickGrove: as much as I appreciate to learn about (new) tools others use, wasn't the question in particular about a contender for IDA as disassembler? – 0xC0000022L Apr 18 '13 at 22:25
  • 3
    Hopper is not available for Windows. – Mahmoud Al-Qudsi Feb 19 '17 at 17:15

If you were looking for a contender, I believe ImmunityDebugger and OllyDbg can compete in part for and Hopper in part for .

That said, there is a big gap between the capabilities you get with the aforementioned software and IDA.

IDA Pro is pretty unique with its capabilities and if you add the Hex-Rays Decompiler Plugin into the equation, things look bleak for the wannabe contenders. However, for casual disassembly and even some decompiling Hopper seems a good choice for anyone not willing to shell out hundreds of bucks for IDA Pro. If you want a free ride, radare2 is probably the next in line, but it takes some getting used to.

Having gotten my first IDA Pro Standard license as a student I have to admit the price point is steep, but it's worth every penny. When I began to work professionally with RCE-related things I upgraded to the "normal" license first and later upgraded to IDA Pro Advanced to get the x64 support.

Also keep in mind there is a freeware version of IDA with license restrictions (but suitable for hobbyists or students) and restrictions of the capabilities.

Some other disassemblers / decompilers

W32Dasm
W32DASM was an excellent 16/32 bit disassembler for Windows, it seems it is no longer developed. the latest version available is from 2003

Capstone
Capstone is a lightweight multi-platform, multi-architecture disassembly framework.

BORG Disassembler
BORG is an excellent Win32 Disassembler with GUI.

DSM Studio Disassembler
DSM Studio is an easy-to-use yet comprehensive application that can aid you in the disassembly and inspection of executables built for the Intel x86 architecture.

Decompiler
Decompiler is an easy to use and simply application designed to read program binaries and decompile executable or DLL files. The application is designed to decompile executables for any processor architecture and not be tied to a particular instruction set. Although currently only a x86 front end is implemented, there is nothing preventing you from implementing a 68K, Sparc, or VAX front end if you need one.

Lida - linux interactive disassembler
lida is a fast feature packed interactive ELF disassembler / code-/cryptoanalyzer based on bastards libdisasm

BugDbg x64 v0.7.5
BugDbg x64 is a user-land debugger designed to debug native 64-bit applications. BugDbg is released as Freeware.

distorm3
A lightweight, Easy-to-Use and Fast Disassembler/Decomposer Library for x86/AMD64

Udis86
Udis86 is an easy-to-use, minimalistic disassembler library (libudis86) for the x86 class of instruction set architectures. It has a convenient interface for use in the analysis and instrumentation of binary code.

BeaEngine
This project is a package with a multi-platform x86 and x64 disassembler library (Solaris, MAC OSX, AIX, Irix, OS/2, Linux, Windows)

C4 Decompiler

  • General Machine Code to C Decompiler
  • Free Windows I64 target edition
  • Interactive Windows GUI

REC Studio 4 - Reverse Engineering Compiler
REC Studio is an interactive decompiler. It reads a Windows, Linux, Mac OS X or raw executable file, and attempts to produce a C-like representation of the code and data used to build the executable file. It has been designed to read files produced for many different targets, and it has been compiled on several host systems.

Retargetable Decompiler
A retargetable decompiler that can be utilized for source code recovery, static malware analysis, etc. The decompiler is supposed to be not bounded to any particular target architecture, operating system, or executable file format.

miasm
Miasm is a a free and open source (GPLv2) reverse engineering framework written in python. Miasm aims at analyzing/modifying/generating binary programs.

Free Code Manipulation Library
This is a general purpose machine code manipulation library for IA-32 and Intel 64 architectures. The library supports UNIX-like systems as well as Windows and is highly portable.

Intel® X86 Encoder Decoder Software Library
Intel® XED is a software library (and associated headers) for encoding and decoding X86 (IA32 and Intel64) instructions.

angr
angr is a framework for analyzing binaries. It focuses on both static and dynamic symbolic ("concolic") analysis, making it applicable to a variety of tasks.

JEB Decompiler
JEB is a reverse-engineering platform to perform disassembly, decompilation, debugging, and analysis of code and document files, manually or as part of an analysis pipeline.

Cutter
A Qt and C++ GUI for radare2 reverse engineering framework (originally Iaito). Cutter is not aimed at existing radare2 users. It instead focuses on those whose are not yet radare2 users because of the learning curve, because they don't like CLI applications or because of the difficulty/instability of radare2.

  • 1
    as far as I know W32Dasm development was stopped in 1997 and the last version is 8.9 – ZAB Jan 26 '16 at 21:52

Another framework to check out is Vdb and Vivisect

  • Vdb - Python based debugger and programatic debugging API
    • VdbTargetVMWare32 - Kernel debugging using the vmware hypervisor
    • VdbOnAndroid - Using vdb to debug android processes
  • Vivisect - Python based static analysis and emulation framework

Reverse - Reverse engineering tool for x86/ARM/MIPS. Generates indented pseudo-C with colored syntax code. enter image description here

SmartDec (aka Snowman) is a native code to C/C++ decompiler. Supports PE and ELF (both 32 and 64bit) also has plugin modules for IDA (6.1, 6.4, 6.5).

Decompiler example.

Currently supports Intel x86 and x86-x64 architectures. C++ reconstruction supports the 32-bit ABI used by MSVC compiler under Windows.

Structures.

C reconstruction is generic and can be used on a code produced by virtually any compiler for x86 and x86-x64 architectures.

Github repo can be found here.

  • Ida Free doesn't appear to support plugins although there is hope, in the meantime Snowman might be better used as standalone. – Laurie Stearn Apr 6 at 5:39

On of my favorite alternatives to IDA is HT Editor.

I've used it on x86 and x64 binaries and java class files. I think it has support for many other architectures/bytecode. It is cross platform and has some nice features.

Relyze is a commercial interactive disassembler for x86, x64 and ARM software with loaders for PE or ELF file formats. It supports interactive flat and graph views of the disassembly, generating call and reference graphs, binary diffing two executables, exploring the executable file's structure and a Ruby plugin API. It can also handle things like symbols (PDB's), function local variables, switch statements, exception handlers, static library identification and more.

enter image description here


Medusa is an open source disassembler with x86, x64, z80 and partial ARM support. It runs on Windows and Linux. It has interactive flat and graph views.

enter image description here

Sourcer was quite awesome, but I'm not sure it's what you need.

  • 1
    indeed it was good during its time and I kept the manual for years because it had this very nice opcode table (similar what you offer on your website) - until one of my colleagues ended up losing it :-| – 0xC0000022L Apr 19 '13 at 17:34
  • Oh yea! I nearly forgot about Sourcer. Thanks for the memory! – dyasta Apr 19 '13 at 19:34
  • 1
    It looks like this link is no longer available. – Tacet Mar 6 '17 at 0:13

I have been using Hopper recently, and while it is not up to the level IDA is, it's really surprisingly sophisticated, particularly considering what it costs. Its main platform is OS X, but there are versions available for Linux and Windows as well. The OS X version also has some gdb integration, so you can use it as a debugger.

ArkDasm is a 64-bit interactive disassembler. Supported file types: PE64, raw binary files. Its currently in alpha stage but works well.

Just for completeness: one more disassembler, Binary Ninja:

As for now (9/26/2016) it has the following properties:

  • Commercial ($99 as introductory price for personal use license)
  • Handles x86, x64, ARMv7-8, MIPS and 6502 architectures
  • Works on Linux, Mac OsX and Windows
  • Supports PE/COFF, ELF, .NES and Mach-O
  • Has python API
  • Has Undo
  • Has IL
  • Has a lot of other cool features

Have you checked out the open-source Metasm framework? It is a ruby framework for assembly manipulation, and can compete with IDA's static analysis capabilities. It has a graph view, can do disassembly/decompilation on x86/64, MIPS, and PPC and supports a couple of executable file formats.

I believe it has also been integrated into Metasploit.

ODA (the Online Disassembler) supports a myriad of architectures and provides a basic feature set. You can enter binary data in the Live View and watch the disassembly appear as you type, or you can upload a file to disassemble. A nice feature of this site is that you can share the link to the disassembly with others.

http://www.onlinedisassembler.com

I would also add

PEBrowse64 Professional

With the PEBrowse disassembler, one can open and examine any executable without the need to have it loaded as part of an active process with a debugger. Applications, system DLLs, device-drivers and Microsoft .NET assemblies are all candidates for offline analysis using either PEBrowse programs. The information is organized in a convenient treeview index with the major divisions of the PE file displayed as nodes. In most cases selecting nodes will enable context-sensitive multiple view menu options, including binary dump, section detail, disassembly and structure options as well as displaying sub-items, such as optional header directory entries or exported functions, that can be found as part of a PE file unit. Several table displays, hex/ASCII equivalents, window messages and error codes, as well as a calculator and scratchpads are accessible from the main menu (calculator, messages and codes in PEBrowse Professional only).

This is an awesome tool with a lot of useful feature regarding executable analysis and there is also a version that could be used and an interactive debugger.

The first tool that comes to mind is Hopper, which is no longer tied to OSX. It has some debugging support(at least on OSX), but focuses on static analysis, which seems like what you're looking for.

It has the ability to break basic blocks into a control flow graph, rudimentary decompilation support, and you can rename functions as you make sense of them. Perhaps someone who uses it instead of IDA will chime in with a better comparison, I've only played around briefly.

Also, IDA's free version is rather capable and worth a look if you haven't tried it.

ScratchABit is an open-source, interactive, incremental, direct-manipulation(*) disassembler with IDAPython-compatible API, allowing reuse of multitude of the plugins developed by the community. ScratchABit stores program state in text files, allowing for easy information reuse and interfacing with other applications and scripts, or tracking history and working collaboratively using version control systems, and minimizing risk of database corruption and recovery efforts.

Full disclosure: I'm the author of ScratchABit and it is a work-in-progress project.

(*) Direct manipulation means that you press a command key and immediately get a reaction, you don't need to type long commands with manually specified addresses and parameters and press Enter.

ScratchABit screenshot

  • ScratchABit 1.0 was released recently, which means it's now at the state I wish some other project were instead, saving me from writing ScatchABit - both useful and functional already, and giving good base for further hacking and experimentation. – pfalcon Oct 17 '15 at 21:18
  • The latest is 1.8: github.com/pfalcon/ScratchABit/releases/tag/v1.8 – pfalcon Dec 26 '17 at 10:55

protected by asheeshr Oct 4 '13 at 15:53

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.