Alternatives to Ghidra
The NSA's reverse engineering framework, with a decompiler that turns machine code back into readable C. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Ghidra
The NSA's reverse engineering framework, with a decompiler that turns machine code back into readable C.
Replacements
Listings that take over the same core job as Ghidra.
radare2
Command-line reverse engineering framework and binary analysis toolkit.
radare2 is a command-line framework rather than a Java GUI, covers disassembly, emulation, debugging and patching across many architectures, and is licensed LGPL-3.0 with a famously steep syntax.
x64dbg
An open-source Windows debugger for reverse engineering, with an IDA-like interface, a built-in assembler and a decompiler.
x64dbg is a Windows-only debugger with an IDA-like interface, assembler and Snowman decompiler, but its decompiler is far weaker than Ghidra's and it focuses on live debugging.
Similar software
Related functionality, not a direct replacement.
capa
Identify likely capabilities inside executable files.
REMnux
Linux toolkit for reverse engineering and analysing malicious software.
YARA
Pattern-matching engine for identifying and classifying malware samples.
Frida
Dynamic instrumentation toolkit for inspecting and modifying running applications.
objection
Inspect mobile application behavior at runtime.
