Reversing Tools: Disassemblers and Debuggers

Overview

Two categories of tools dominate the reverse engineering workflow:

• Disassemblers — convert machine code to assembly for static analysis
• Debuggers — execute code step-by-step for dynamic code analysis

Both are needed. The disassembler gives you the map; the debugger lets you walk through it in real time.

Disassemblers

IDA Pro vs Ghidra

Feature	IDA Pro	Ghidra
Developer	Hex-Rays (Belgium)	NSA (open-source, 2019)
Cost	Free (IDA Free) / Commercial	Free
Decompiler	Hex-Rays (F5) — industry gold standard	Built-in — very capable
Scripting	IDAPython	Java, Python
Collaboration	Limited	Ghidra Server (multi-analyst)
Architecture support	Very broad	Very broad
Industry adoption	Standard for commercial work	Growing rapidly

Recommendation for this course: Start with Ghidra (free, full-featured). Add IDA when an employer or project requires it. Skills transfer directly — menu locations differ, concepts are identical.

Typical IDA Pro workflow

1. Open sample → auto-analysis runs
2. Navigate to entry point (Edit → Jump to Entry Point)
3. Press Space to switch to Graph View
4. Double-click CALL instructions to follow into functions
5. Press F5 for decompiled pseudocode
6. Press X on any address to see cross-references
7. Press N to rename variables and functions
8. Add comments with ; or Ins key

Typical Ghidra workflow

1. Create new project → Import file
2. Auto-analysis runs (accept defaults)
3. Open CodeBrowser
4. Navigate via Symbol Tree or search
5. Use Decompiler window alongside disassembly
6. Right-click → Edit Function Signature to rename
7. Use Bookmarks for important locations

Debuggers

x64dbg vs OllyDbg

Feature	x64dbg	OllyDbg
Architecture	32-bit (x32dbg) and 64-bit	32-bit only
Status	Active development	Legacy (no updates since 2013)
Cost	Free, open-source	Free
Key features	Scylla (dump/IAT fix), scripting, plugins	Compact UI, built-in assembler
ScyllaHide	Yes (anti-anti-debug plugin)	Limited version
Use case	Modern analysis — recommended	Appears in older tutorials only

This course uses x32dbg (the 32-bit component of x64dbg) for all practical labs. OllyDbg appears in older tutorials; avoid it for new work.

Key x64dbg keyboard shortcuts

Action	Key
Step Into (follow CALL)	F7
Step Over (skip CALL)	F8
Run to Cursor	F4
Run (until breakpoint)	F9
Set software breakpoint	F2
Restart	Ctrl+F2
Navigate to address	Ctrl+G
Toggle graph view	Space

Supporting Static Analysis Tools

Tool	Purpose
PEStudio	PE header inspection, imports, entropy, strings
PE-Bear	Detailed PE structure viewer with hex correlation
Detect It Easy (DIE)	Packer/compiler identification by signature matching
FLOSS	Obfuscated string extraction (stack strings, XOR loops)
Capa	Capability detection mapped to MITRE ATT&CK
CFF Explorer	PE editing and header manipulation

Tool Selection Guide

Start with this stack — all free, all production-quality:

Static:   Ghidra + PEStudio + DIE + FLOSS + Capa
Dynamic:  x32dbg (with ScyllaHide plugin)
Network:  Wireshark + FakeNet-NG
Process:  Process Hacker + Procmon

Add IDA Pro when:

• Your employer uses it and you need to read existing IDA databases
• You are working with obfuscated or custom-packed binaries where Hex-Rays decompiler quality matters
• You need specific IDA plugins not available for Ghidra

The skills from Ghidra transfer immediately to IDA. The interface is different; the concepts are identical.