radare2 and Rizin
radareorg; RizinOrg · radare2 6 / Rizin 0.9 · 2026
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
Two closely related open-source reverse engineering frameworks. radare2 is the original Unix-style command-line toolkit for binary analysis, patching, and debugging; Rizin is a fork of radare2 that set out to stabilise the API and command set and ships the Cutter GUI. Both are actively developed and release regularly.
Who it is for, and when
These are the scriptable end of reverse engineering: batch-analyse a thousand binaries, diff two samples, patch a byte and re-run, or drive analysis from Python in a pipeline — things that are awkward in a GUI-first tool. Rizin plus Cutter is the gentler entry point and the more predictable API to build against; radare2 has the longer history and larger body of published scripts. Either serves well as a second opinion against Ghidra's decompiler.
What it does not cover
Both have a famously steep command syntax and neither is a forensic suite — no case management, no reporting, no evidence handling. Their decompilers are weaker than Ghidra's, they do not defeat packing or obfuscation on their own, and the fork means scripts and plugins are not reliably portable between the two.
Go to the source
Open at book.rada.re (opens in a new tab)https://book.rada.re/
Details
- Type
- Tool
- Written for
- AdvancedAdvanced
- Publisher
- radareorg; RizinOrg
- Version verified
- radare2 6 / Rizin 0.9
- Year
- 2026
- Topics
- reverse-engineering, malware, scripting, open-source
- Checked at source
Related entries
Ghidra
FreeAn open-source software reverse engineering framework released by the NSA, with a disassembler, a decompiler producing C-like output, scripting in Java and Python, and support for many processor architectures. The former ghidra-sre.org address now redirects to the GitHub project.
Binary analysis from the format upward on Linux: ELF and PE structure, writing a loader with libbfd, how disassembly actually works and where it goes wrong, ELF code injection, then binary instrumentation with Pin, dynamic taint analysis with libdft, and symbolic execution with Triton.
The Ghidra Book
PaidThe reference manual for Ghidra: core reverse-engineering technique, Ghidra's data displays, the decompiler, collaborative server-based analysis, customisation and new data types, headless operation, and scripting — with Python 3 support through PyGhidra new to this edition.
CyberChef
FreeA browser-based tool published by GCHQ that chains together hundreds of data operations — encodings, ciphers, compression, hashing, timestamp conversion, parsing, and extraction — into a visible recipe. It runs entirely client-side and is actively released.
YARA and YARA-X
FreeA pattern-matching language and scanner for identifying files by their content — strings, byte sequences, and structural conditions — used to label malware families and find known artefacts at scale. YARA-X is a ground-up rewrite in Rust from the same maintainers and is now the forward direction of the project; the original YARA 4.x line still receives releases and remains widely deployed.