Category: Blog (page 4 of 12)

There’s a quiet, almost meditative side to reverse engineering that doesn’t involve debuggers, breakpoints, or live memory snapshots. It’s the craft of taking apart a binary while it sits lifeless on your drive—no execution, no sandbox, just raw bytes and the structures they encode. Static binary analysis is the bedrock of vulnerability research, malware triage, and understanding proprietary software. The right tools turn a hex dump into a story. Here’s a look at the instruments that make that possible, from disassemblers to binary ninjas (the concept, not just the product).

Disassemblers: The Core of the Craft

Disassembly is your first real step into a binary’s logic. A disassembler translates machine code back into assembly, giving you a human-readable (well, mostly) view of the processor’s instructions. The real test of a disassembler is how well it separates code from data, follows control flow, and resolves indirect calls. A sloppy disassembler will send you down rabbit holes of misinterpreted bytes. A sharp one becomes an extension of your own analytical mind.

IDA Pro still sets the standard, especially for its interactive features. Its graph view transforms spaghetti code into a visual map of basic blocks, and its Python scripting (IDAPython) lets you automate the grunt work. The Hex-Rays decompiler plugin, while not purely static, offers a pseudo-C view that can dramatically speed up understanding of complex functions. For those who can’t justify the price tag, Ghidra—released by the NSA—has grown into a formidable alternative. Its collaborative features and built-in decompiler for multiple architectures make it a powerhouse, particularly for firmware analysis. radare2 (and its GUI frontend, Cutter) is the command-line junkie’s dream. It’s scriptable, lightweight, and handles obscure file formats that choke other tools. Its visual mode and deep binary patching capabilities are unmatched for quick, precise work.

Hex Editors: Where the Bytes Hit the Screen

Sometimes you need to see the forest and the trees. A hex editor shows the raw binary content alongside its ASCII (or Unicode) interpretation, and the best ones understand file structures. 010 Editor shines here with its Binary Templates feature. You can parse a PE, ELF, or Mach-O header with a single click, seeing each field labeled and interpreted. This is invaluable for spotting malformed headers, hidden data in slack space, or manually reconstructing a corrupted file. HxD is a fast, no-nonsense Windows hex editor with disk editing and RAM inspection—handy for grabbing a process’s memory snapshot for offline analysis. On Linux, wxHexEditor offers similar low-level access. The key is finding one that doesn’t choke on massive files, like multi-gigabyte firmware dumps, and gives you unfiltered access to every byte.

File Format Parsers and Structure Analyzers

Before you dive into disassembly, you need to know what you’re looking at. The file command on Unix-like systems is the first line of defense, but it relies on magic bytes and can be fooled. TrID goes deeper, using a database of file signatures to identify thousands of formats. For PE files, PE-bear provides a clean, modern interface for exploring headers, sections, imports, exports, and resources. It highlights anomalies like suspicious section permissions (writable and executable) or unusual entry points. On Linux, readelf and objdump (from binutils) are indispensable for ELF files, dumping symbol tables, dynamic linking information, and section headers. For Mach-O files (macOS/iOS), MachOView gives a detailed tree view of the binary’s structure, including load commands and encrypted segments.

Signature Scanning and Pattern Matching

When you’re hunting for known code patterns—a specific crypto implementation, a malware family trait, a vulnerable library version—signature tools are your best friend. YARA has become the de facto standard for writing and applying pattern-matching rules against files and memory. Its rule syntax is expressive enough to match byte sequences, strings, and even regular expressions at specific offsets. For large-scale binary triage, ClamAV’s signature database and engine can be repurposed, though it’s less flexible than YARA for custom research. A lesser-known but powerful tool is FLOSS (from FireEye’s Mandiant), which statically extracts obfuscated strings from malware binaries—it automates what used to be a manual, tedious process of decoding stack strings and other obfuscation tricks.

Binary Diffing: Spotting the Changes

When a vendor releases a patch, the security implications often hide in the differences between the old and new binaries. Binary diffing tools compare two versions of a file and highlight what changed. BinDiff (now free, from Google) is the classic choice, integrating with IDA to show matched functions and basic blocks, with color-coded similarity scores. It’s essential for patch analysis—identifying which vulnerabilities were fixed without any public disclosure. Diaphora is a powerful open-source alternative that works as an IDA plugin, offering multiple diffing algorithms and a focus on portability across architectures. For quick, text-based comparisons, radiff2 (part of radare2) can show delta differences at the byte and instruction level.

Static Unpacking and Deobfuscation

Packers and obfuscators are the bane of static analysis. They compress or encrypt the real code, leaving only a stub that unpacks at runtime. While dynamic analysis is often needed to fully unpack a binary, several static techniques can peel back layers. UPX (Ultimate Packer for eXecutables) can decompress its own format, and many others, with the -d flag. For custom packers, binwalk is a static analysis swiss army knife: it scans a binary for embedded file signatures and can extract them. This is particularly useful for firmware images that contain multiple filesystems or compressed kernels. XORSearch and bruteforce-salted-openssl help identify and crack simple XOR-based obfuscation or weak encryption of embedded resources.

Specialized Analysis Frameworks

Some tools transcend single categories. Binary Ninja (the platform) has gained a cult following for its clean API and intermediate language (IL) design. Its static analysis engine lifts assembly to a medium-level IL, then to a high-level IL, enabling architecture-agnostic analysis. You can write plugins that operate on the IL without caring whether the original binary was x86, ARM, or MIPS. angr is a Python framework that takes static analysis to the extreme: it lifts binaries to an intermediate representation (VEX, via Valgrind) and performs symbolic execution and control-flow graph recovery. While often used for dynamic symbolic execution, its static analysis components—like CFGFast—can recover control flow from stripped binaries with impressive accuracy. BAP (Binary Analysis Platform) is another heavyweight, used in academic and DARPA-funded research, that provides a formal verification layer on top of disassembly.

String Analysis and Metadata Extraction

Never underestimate the power of strings. The classic Unix utility dumps all printable character sequences in a file, often revealing hardcoded URLs, IP addresses, registry keys, and error messages. For a more structured approach, flarestrings (from FireEye’s FLARE team) enhances string extraction with Unicode support and filtering. ExifTool is indispensable for pulling metadata from binaries—compilation timestamps, linker versions, and even debug paths that leak the developer’s username or build environment. These small details can pivot an investigation or provide the context needed to understand a binary’s origin.

FAQ

What’s the difference between static and dynamic analysis?

Static analysis examines a binary without executing it—you’re looking at the code, data, and structure as they exist on disk. Dynamic analysis runs the program in a controlled environment (like a debugger or sandbox) to observe its behavior. Static analysis is safer for malware, but can be thwarted by obfuscation and packing. Dynamic analysis reveals runtime behavior but risks detection or unintended consequences. Most serious reverse engineering combines both.

Do I need to know assembly language for static analysis?

Yes, at least a working knowledge. Disassemblers output assembly, and while decompilers can give you pseudo-C, they’re often wrong or incomplete. Understanding the instruction set of your target architecture (x86/x64, ARM, MIPS) is essential to spot the decompiler’s mistakes and to recognize low-level patterns like system calls, cryptographic primitives, or anti-analysis tricks.

Which tool should a beginner start with?

Ghidra offers the best combination of power and price (free). Its decompiler is excellent, and the UI is approachable. Start with simple crackmes or capture-the-flag challenges to learn the workflow. As you grow comfortable, explore IDA’s free version or radare2 for more specialized tasks. The key is to stick with one tool long enough to internalize its shortcuts and scripting API before jumping around.

How do I handle stripped binaries?

Stripped binaries lack symbol information, making function identification harder. Tools like IDA’s FLIRT (Fast Library Identification and Recognition Technology) can match code patterns against known libraries to restore function names. Ghidra’s function ID does the same. For custom code, focus on identifying the entry point, then trace cross-references from API calls. Signature tools like YARA can also help label known code snippets.

Static analysis is a discipline that rewards patience and pattern recognition. The tools listed here are the ones that have proven themselves in the trenches—each with its own learning curve, but each capable of revealing the secrets locked inside a binary. The best way to master them is to pick a target, any target, and start peeling back the layers.

Static binary analysis is the dark art of pulling apart compiled code without ever letting it run. For reverse engineers, malware analysts, and vuln researchers, it’s the first line of defense—and the first step on offense. You’re not just staring at hex dumps; you’re reconstructing logic, sniffing out backdoors, and mapping control flow from a dead file. The right tools turn a weekend lost in IDA’s graph view into a clean hit on an obfuscated payload. This isn’t a glossy product roundup. It’s a field guide to the tools that actually ship results when you’re buried in ELF headers, PE sections, or raw firmware blobs.

Why Static Analysis Still Rules the Underground

Dynamic analysis gets the hype—sandboxes, debuggers, fuzzers spinning up VMs. But static analysis is where you build the mental model. No kernel hooks, no anti-debug traps, no network noise. You’re working with the artifact itself: a binary that might be packed, stripped, or laced with anti-reversing tricks. The goal is to extract symbols, map imports, identify cryptographic constants, and trace execution paths without ever hitting F9. In the underground, where targets range from IoT malware to proprietary firmware blobs, static analysis is often the only option. The hardware isn’t available, the OS is obscure, or the sample self-destructs on launch. Your toolkit needs to handle that reality.

Good static analysis tools share a few traits: they parse file formats deeply, they surface anomalies without choking on malformed headers, and they give you a disassembly or intermediate representation you can actually work with. The best ones let you script your own analysis passes. Below, I’ll walk through the core categories—disassemblers, binary viewers, signature scanners, and specialized utilities—and name the specific tools that earn their keep in the trenches.

Disassemblers and Reverse Engineering Frameworks

IDA Pro: The Heavyweight

No list starts without IDA. The Interactive Disassembler from Hex-Rays is the industry anchor for a reason. Its recursive descent disassembly handles x86, ARM, MIPS, PowerPC, and dozens of other architectures. The real power isn’t just the disassembly listing—it’s the database. IDA builds a cross-reference graph, tracks function boundaries, and lets you annotate and rename everything. The Hex-Rays decompiler plugin turns assembly back into pseudo-C, which is indispensable when you’re staring at a 2MB stripped binary at 3 a.m. The SDK (C++ and Python) means you can write custom loaders for obscure firmware formats or automate control-flow deobfuscation. Yes, it’s expensive. The freeware version is deliberately crippled—no x64, no decompiler, limited scripting. But if you’re serious, you find a way. The underground runs on IDA.

Ghidra: The Open-Source Disruptor

When the NSA dropped Ghidra in 2019, it reshaped the landscape. A full reverse-engineering suite with a decompiler, cross-references, graphing, and collaborative server mode—all free. Ghidra’s decompiler is shockingly good, often producing cleaner output than Hex-Rays for certain code patterns. Its scriptability in Java and Python (via Jython) is deep, and the plugin ecosystem has exploded. For static analysis of malware families, Ghidra’s version tracking and function-hashing features let you diff binaries and identify reused code across samples. The learning curve is real—the UI is idiosyncratic, and the project model takes getting used to—but once you’re fluent, it’s a primary weapon. Many shops now run IDA and Ghidra side by side, cross-checking decompiler output.

Radare2 / Rizin: The Terminal Powerhouse

If you live in the command line, radare2 (and its modern fork Rizin) is your scalpel. It’s a framework more than a single tool: disassembler, hex editor, binary diffing, emulation, and scripting all in one. The learning curve is brutal—the command syntax is terse and non-obvious—but once you internalize it, you move at the speed of thought. Radare2 excels at rapid triage: identify file type, list imports, find strings, dump sections, all in a few keystrokes. Its visual mode (V) gives you a terminal-based graph view that’s surprisingly usable. For embedded firmware with custom architectures, radare2’s plugin system lets you define new CPU profiles quickly. It’s the tool you reach for when you need to script analysis across hundreds of samples.

Binary Ninja: The Middle Ground

Binary Ninja sits between IDA’s polish and Ghidra’s price tag. It’s commercial but affordable, with a clean UI and a powerful Python API. The decompiler is solid, though not as mature as Hex-Rays or Ghidra. Where Binary Ninja shines is in its intermediate language (IL) system: low-level IL, medium-level IL, and high-level IL. You can write analysis passes that operate on any of these representations, making it easier to build architecture-agnostic tools. The type recovery and data-flow analysis are well-integrated. For vulnerability research, the ability to lift binary code to an IL and then reason about it programmatically is a force multiplier. The community is smaller but active, and the developers ship updates frequently.

Binary Inspection and Hex Editing

010 Editor: Templates and Binary Parsing

Sometimes you don’t need a disassembler—you need to see the raw structure. 010 Editor is a hex editor with a killer feature: binary templates. These are declarative scripts that parse file formats and display fields in a structured tree view. You can write templates for PE, ELF, Mach-O, or any custom format. When you’re reversing an undocumented firmware image, a template lets you isolate headers, checksums, and payload offsets without manually counting bytes. The integrated scripting engine (C-like syntax) can modify files in place, recalculate CRCs, or extract embedded blobs. It’s an essential companion for static analysis of file formats themselves.

ImHex: The Newcomer with Pattern Language

ImHex is a modern, open-source hex editor that’s rapidly gaining traction. Its pattern language is more expressive than 010 Editor’s templates, supporting complex parsing, highlighting, and data transformation. It includes a disassembler, a data inspector, and a diffing mode. For static analysis of binary protocols or file formats, ImHex’s ability to visually annotate hex dumps with parsed fields is unmatched. It’s also cross-platform and actively developed. If you’re doing a lot of manual binary inspection, this tool deserves a spot in your arsenal.

Signature Scanning and Identification

YARA: Pattern Matching for Binaries

YARA is the lingua franca of malware classification. You write rules—text or binary patterns combined with Boolean logic—and YARA scans files for matches. It’s not just for malware; you can use YARA to identify specific libraries, compilers, or known-vulnerable code snippets in any binary. The rule syntax is simple but expressive, and the engine is fast enough to scan thousands of files. For static analysis workflows, YARA is the triage step: before you open IDA, you run a YARA scan to see if the sample matches known families. Writing good YARA rules is an art—too specific and you miss variants, too broad and you drown in false positives. The best rules target unique byte sequences in core functions, not just strings.

BinDiff: Binary Comparison

When you have two versions of a binary—say, a patched and unpatched firmware—BinDiff (now integrated into Ghidra as BinExport/BinDiff) identifies changed functions. It uses graph isomorphism algorithms to match functions across binaries, then highlights structural differences. This is invaluable for patch analysis: you can pinpoint exactly which functions were modified to fix a vulnerability, then reverse only those. BinDiff works best with IDA databases, but the Ghidra integration is improving. For static vulnerability discovery, patch diffing is one of the most efficient techniques.

Specialized Utilities for Deep Static Analysis

Pyew: Python-Based Hex Analysis

Pyew is a lesser-known but powerful tool for static malware analysis. It’s a Python-based hex editor and disassembler that supports scripting for automated analysis. Pyew can parse PE and ELF structures, display disassembly, and let you write custom analysis scripts in Python. It’s particularly useful for analyzing shellcode—you can load a raw binary blob, set the base address, and start disassembling immediately. The tool is lightweight and doesn’t require a heavy GUI, making it ideal for headless analysis pipelines.

FLOSS: String Extraction on Steroids

Standard strings output is noisy and misses obfuscated data. FLOSS (FireEye Labs Obfuscated String Solver) uses static analysis to extract strings that are constructed at runtime—decoded, deobfuscated, or built on the stack. It emulates small portions of the binary to resolve string-building routines, then dumps the results. For malware analysis, this surfaces C2 addresses, registry keys, and mutex names that would otherwise remain hidden. It’s a critical first-pass tool before you even open a disassembler.

angr: Binary Analysis Framework

angr is a Python framework for analyzing binaries. It lifts code into an intermediate representation (VEX, borrowed from Valgrind) and provides symbolic execution, control-flow graph recovery, and data-flow analysis. For static analysis, angr’s CFGFast can recover control flow from stripped binaries with high accuracy. Its backward slicing lets you trace data dependencies from a point of interest back to their origins. angr is complex and resource-intensive, but for deep static analysis—like finding the inputs that reach a vulnerable function—it’s unmatched. It’s more a research tool than a daily driver, but when you need it, nothing else comes close.

Building a Static Analysis Workflow

Tools are only as good as the process they fit into. A typical static analysis workflow for an unknown binary looks like this:

1. Triage: Run file, check entropy, scan with YARA rules. Use FLOSS to pull obfuscated strings. This gives you a high-level classification—packed? Known family? Interesting strings?

2. Structural Analysis: Open in 010 Editor or ImHex to inspect headers, sections, and any embedded resources. If the binary is packed, this is where you identify the packer and locate the OEP (original entry point).

3. Disassembly: Load into IDA, Ghidra, or radare2. Let the auto-analysis run. Identify the main function, imports, and any anti-analysis tricks. Rename functions and annotate as you go.

4. Deep Dive: For critical functions, use decompiler output to understand logic. If the code is obfuscated, write IDAPython or Ghidra scripts to deobfuscate control flow or decrypt strings. Use BinDiff if you have a related sample.

5. Reporting: Extract IOCs (indicators of compromise), document functionality, and map the binary’s capabilities. YARA rules written during analysis feed back into the triage step for future samples.

This isn’t a linear process—you’ll jump between steps as you discover new leads. The key is having tools that don’t get in your way when you need to pivot quickly.

FAQ

What’s the difference between static and dynamic binary analysis?

Static analysis examines a binary without executing it—you’re reading disassembly, parsing headers, and extracting strings. Dynamic analysis runs the binary in a controlled environment (debugger, sandbox) to observe its behavior. Static analysis is safer (no risk of detonation) and often the only option for non-executable firmware or exotic architectures. Dynamic analysis reveals runtime behavior like network connections and process injection. The two are complementary; most serious reverse engineers combine them.

Do I need to pay for IDA Pro, or can I use free tools?

Free tools like Ghidra and radare2 are capable enough for many tasks, especially malware triage and standard reverse engineering. IDA Pro’s advantages—mature decompiler, extensive processor support, and a vast plugin ecosystem—become critical for complex, obfuscated, or unusual binaries. Many professionals use both: Ghidra for collaboration and scripting, IDA for deep dives. The freeware version of IDA is limited to 32-bit x86 and lacks a decompiler, so it’s not a full replacement.

How do I handle packed or obfuscated binaries statically?

Start with entropy analysis to detect packing. Tools like FLOSS can extract obfuscated strings without unpacking. For manual unpacking, use a hex editor to locate the OEP and dump the unpacked payload, then load that into your disassembler. Some packers can be defeated with static unpacking scripts (e.g., in IDAPython). If static unpacking fails, you’ll need dynamic analysis to let the binary unpack itself in memory, then dump the process. The line between static and dynamic blurs here—many analysts use a hybrid approach.

What’s the best tool for analyzing firmware images?

It depends on the firmware format. For raw dumps, start with binwalk to identify embedded filesystems and compression. Then use a hex editor with custom templates to parse headers. For disassembly, Ghidra’s support for obscure architectures (via SLEIGH) is excellent—you can define a new processor specification if needed. IDA also supports many embedded architectures. The key is identifying the base address and loading the binary at the correct offset so cross-references resolve properly.

Static binary analysis isn’t a spectator sport. You’re not just reading code—you’re dissecting compiled flesh, hunting for malformations, backdoors, and the subtle fingerprints of a compiler that lied. I’m Zel Mathis, and I’ve spent more nights than I’d like to admit staring at hex dumps and control-flow graphs, trying to figure out what some black-box firmware is really doing. The right tools make the difference between a clean extraction of truth and a week lost in false positives. Here’s what actually works.

Why Static Binary Analysis Matters

When you can’t run the binary—maybe it’s for an embedded device you don’t own, or it’s malware you’re not insane enough to execute—static analysis is your only window. Even when you can run it, dynamic analysis shows you one path. Static analysis shows you all possible paths. That’s the theory, anyway. In practice, you’re wrestling with stripped symbols, obfuscated control flow, and instruction sets that make your eyes bleed. The tools you pick determine whether you’ll find the hidden command-and-control loop or just generate a 200MB PDF of worthless call graphs.

I’ve spent years in the weeds with firmware extraction, reverse engineering, and vulnerability research. The tools below aren’t the shiniest or the most marketed. They’re the ones that don’t crash when you feed them a 40MB monolithic ARM binary, the ones that let you script your way out of a corner, and the ones that actually teach you something about the code you’re dissecting.

Disassemblers: The Foundation

Without a disassembler, you’re reading raw bytes. That’s a special kind of masochism. A good disassembler doesn’t just translate opcodes—it builds a mental model of the binary’s layout, resolves cross-references, and gives you a canvas for annotation. The two that dominate the underground are IDA Pro and Ghidra, but they serve different masters.

IDA Pro: The Old King

IDA Pro is the standard for a reason. Its interactive interface, mature scripting engine, and vast processor support make it the go-to for professional reverse engineers. The FLIRT signature database can identify library functions in stripped binaries, saving you from reversing memcpy for the hundredth time. The decompiler plugin (Hex-Rays) is expensive but often worth it—it turns assembly into pseudo-C that’s surprisingly readable, especially after you’ve spent a few hours teaching it function prototypes and structure definitions.

But IDA has warts. It’s proprietary, expensive, and its plugin ecosystem is a walled garden. The Python API is powerful but quirky, and you’ll find yourself fighting with type systems when you just want to iterate over basic blocks. For large binaries, the analysis can be slow, and the database files balloon to gigabytes. Still, when I need to deeply understand a binary’s logic, IDA is where I live.

Ghidra: The Open-Source Contender

Ghidra came out of the NSA in 2019 and immediately changed the game. It’s free, open-source, and its decompiler rivals Hex-Rays in many cases—sometimes surpassing it, especially on weird calling conventions or obfuscated code. The collaborative server mode lets multiple analysts work on the same binary simultaneously, which is a godsend for large firmware dumps. Ghidra’s scripting is Java-based, which feels clunky compared to IDA’s Python, but the API is well-designed and you can do serious automation with it.

Where Ghidra really shines is in its analysis of non-standard architectures. I’ve thrown obscure DSP firmware at it and watched it correctly identify function boundaries that IDA missed. The learning curve is steeper—the UI is dense and the terminology is idiosyncratic—but once you internalize its mental model, you can work fast. For anyone starting out or working on a budget, Ghidra is the obvious choice.

Binary Ninja: The Middle Ground

Binary Ninja occupies a sweet spot between IDA’s power and Ghidra’s accessibility. It’s commercial but reasonably priced, with a clean, modern UI and a Python API that feels thoughtfully designed rather than bolted on. Its intermediate language (IL) representation is a standout feature—you can write analysis scripts that work across x86, ARM, MIPS, and PowerPC without rewriting architecture-specific logic. The decompiler is good and improving rapidly, and the plugin ecosystem is small but high-quality.

I reach for Binary Ninja when I need to prototype an analysis quickly or when I’m working with a team that needs a gentler learning curve than Ghidra. Its type system and structure recovery are intuitive, and the graph view is the best of any tool I’ve used. The main limitation is architecture support—it covers the majors but lacks the esoteric DSPs and microcontrollers that IDA handles. For mainstream reverse engineering, though, it’s a joy to use.

Specialized Analysis Engines

Disassemblers give you the raw material. Specialized tools help you ask specific questions: Does this binary contain known vulnerable code patterns? What are the actual import dependencies? Where are the crypto constants hiding? These tools don’t replace your brain—they amplify it.

Radare2 / Rizin: The Scriptable Workhorse

Radare2 (and its community fork Rizin) is the command-line powerhouse. It’s not pretty, but it’s fast, scriptable, and can chew through binaries that make IDA choke. I use it for batch analysis—pulling strings, identifying crypto constants, extracting entropy data, and doing initial triage on hundreds of firmware images. The learning curve is a cliff face, but once you’ve internalized the command syntax, you can pipe analysis results into Python or your own toolchain with minimal friction.

Rizin is the cleaner, more modern fork that fixes many of radare2’s historical UI and stability issues. It’s the one I recommend for new users. The rz-ghidra plugin brings Ghidra’s decompiler into Rizin, giving you a powerful free command-line decompiler. For automated binary analysis pipelines, Rizin is hard to beat.

angr: Symbolic Execution for the Brave

angr is a Python framework for binary analysis that includes a symbolic execution engine. It lets you ask questions like “What input reaches this basic block?” or “Is there any path from this function to that sensitive system call?” It’s not a tool you use casually—setting up an angr analysis requires real programming and a deep understanding of the binary’s logic. But when you need to automatically explore state spaces that are too large for manual analysis, angr is unmatched.

I’ve used angr to find authentication bypasses in embedded web servers and to generate inputs that trigger hidden debug modes. It’s slow, memory-hungry, and the learning curve is brutal. But it solves problems that no other tool can touch. If you’re doing vulnerability research on complex binaries, angr belongs in your arsenal.

Binary Diffing: Finding the Needle

When a vendor silently patches a vulnerability, you need to know what changed. Binary diffing tools compare two versions of a compiled binary and highlight the differences—new basic blocks, modified functions, changed constants. This is how you find the fix and then reverse-engineer the original bug.

Diaphora: IDA’s Diffing Plugin

Diaphora is a plugin for IDA Pro that performs binary diffing at multiple levels: raw bytes, assembly instructions, basic blocks, and pseudo-code. It’s fast, free, and the output is a searchable database that lets you filter by similarity percentage, function name, or specific instruction patterns. I use it to track changes across firmware versions and to identify borrowed code between different vendors’ products. The pseudo-code diffing is particularly useful—it can spot semantic changes that raw assembly diffing misses.

BinDiff: The Commercial Standard

BinDiff (now owned by Google, distributed as a free IDA plugin) is the other major player. It uses a more sophisticated graph-theoretic approach to function matching, which can be more resilient against compiler changes and optimization differences. BinDiff’s visual diff mode is excellent for quickly understanding how a function’s control flow changed. I tend to use both Diaphora and BinDiff on the same binary pair—they catch different things, and the combination gives a more complete picture.

Unpacking and Deobfuscation

Malware and DRM-protected binaries rarely come in the clear. Packers, cryptors, and obfuscators wrap the real code in layers of garbage. Static analysis of a packed binary is a waste of time—you need to strip the armor first.

Detect It Easy (DIE): Packer Identification

Before you can unpack, you need to know what you’re dealing with. DIE is a signature-based tool that identifies packers, compilers, and cryptors. It’s more comprehensive than the old PEiD and is actively maintained. DIE gives you entropy graphs, section analysis, and heuristic detection that often nails the exact packer version. It’s the first thing I run on an unknown sample.

UnpacMe: Automated Unpacking

UnpacMe is an online service that automates unpacking for many common packers. You upload a sample, it runs it through a gauntlet of unpacking engines, and returns the unpacked binary. It’s not perfect—custom packers and advanced obfuscation will defeat it—but for commodity malware, it saves hours of manual unpacking. The service is free for small files and has an API for batch processing.

String Analysis and Pattern Matching

Strings are the lowest-hanging fruit in static analysis. A binary’s strings can reveal URLs, IP addresses, registry keys, file paths, and even embedded scripts. But standard strings misses Unicode, misses XOR-obfuscated strings, and gives you no context. Better tools exist.

flare-floss: Strings with Brains

FLOSS (FireEye Labs Obfuscated String Solver) is a must-have. It extracts ASCII and Unicode strings like the standard tool, but also statically deobfuscates strings that are built at runtime—XOR loops, stack constructions, and simple decryption routines. It works on Windows, Linux, and macOS binaries. I’ve found C2 addresses and decryption keys that the standard strings command completely missed. FLOSS also provides a “tight strings” score that helps you focus on the most likely interesting strings, filtering out compiler noise.

YARA: Pattern Matching for Binaries

YARA is a rule-based pattern matching engine. You write rules that describe byte sequences, strings, or regular expressions, and YARA scans binaries for matches. It’s the backbone of malware classification and threat intelligence sharing. I use YARA to identify known code families, to find embedded cryptographic constants, and to flag binaries that contain specific vulnerable code patterns. Writing good YARA rules is an art—too specific and you miss variants, too broad and you drown in false positives. But once you have a solid rule set, it’s like having a metal detector in a minefield.

Control Flow and Call Graph Analysis

Understanding how functions relate to each other is essential for reverse engineering. A flat disassembly listing is nearly useless for large binaries—you need to see the call graph, identify clusters of related functions, and spot anomalies like functions that are never called or that call into suspicious APIs.

Gephi + IDA/Ghidra Export: Visualizing the Graph

Both IDA and Ghidra can export call graphs, but their built-in visualization is limited. I export the graph data and load it into Gephi, an open-source graph visualization tool. Gephi lets you apply force-directed layouts, size nodes by centrality, and color by modularity class. This reveals the binary’s architecture at a glance—you can see the main loop, the initialization routines, the network handlers, and any disconnected “islands” of code that might be injected or obfuscated. It’s a technique I picked up from malware analysts and it’s saved me days of manual graph tracing.

FAQ

Which tool should I learn first for static binary analysis?

Start with Ghidra. It’s free, powerful, and has an excellent decompiler. The learning curve is real, but there are plenty of tutorials and the community is active. Once you’re comfortable with Ghidra, you’ll appreciate IDA Pro’s polish and Binary Ninja’s speed, but you won’t be lost without them. If you’re on a budget and need to do real work, Ghidra is the answer.

Can static analysis find all vulnerabilities?

No. Static analysis can find many bug classes—buffer overflows, use-after-free patterns, hardcoded credentials, missing bounds checks—but it can’t find everything. Logic flaws that depend on runtime state, vulnerabilities in dynamically generated code, and issues that only manifest under specific environmental conditions often require dynamic analysis or manual code review. Static analysis is a filter, not a guarantee.

How do I handle heavily obfuscated binaries?

Start with packer identification (DIE) and automated unpacking (UnpacMe). If those fail, you’re in for manual unpacking—find the original entry point, dump the process memory, and rebuild the import table. For code-level obfuscation like control-flow flattening or opaque predicates, Ghidra’s decompiler often cuts through the noise better than IDA’s. In extreme cases, you may need to write custom scripts using angr or a disassembler API to deobfuscate specific patterns. There’s no silver bullet—obfuscation is an arms race.

What’s the best way to analyze firmware blobs?

First, extract the filesystem with binwalk or unblob. Then identify the architecture—DIE can help, or you can look for telltale opcode patterns. Load the main binary into Ghidra or IDA, but be prepared for a stripped binary with no symbols. Use FLOSS to pull strings, YARA to identify known code, and Gephi to map the call graph. Firmware analysis is mostly about persistence and pattern recognition—the tools help, but experience is what gets you through.

The tools I’ve described are my daily drivers. They’re not the only ones, and they’re not always the best for every situation. But they’re the ones that have earned their place on my hard drive through years of actual use. Static binary analysis is a craft—the tools are your instruments, but your brain is the one making the music. Pick tools that respect your intelligence and don’t get in your way.

Static binary analysis is a quiet, stubborn art—pulling apart compiled code without ever letting it touch a CPU. No sandboxes, no debuggers, no live execution. For reverse engineers, malware analysts, and firmware spelunkers, it’s the first real step into the guts of a program. You don’t need the target OS, and you don’t need to worry about tripping anti-debugging traps. You just need the right tools and a willingness to stare at raw bytes until they start making sense. Here’s a look at the utilities that actually deliver, from the well-known heavyweights to the underground gems.

Why Static Analysis Still Matters

Dynamic analysis gets all the attention—sandboxing, fuzzing, step-through debugging. But static analysis is where you learn the true shape of a binary. There are no anti-debugging tricks to dodge, no environment checks, no encrypted payloads waiting for runtime to unpack. You’re staring at the raw instructions, the import tables, the strings some developer forgot to obfuscate. It’s slow, detail-oriented work, but it shows you the skeleton before the flesh ever twitches.

For malware reverse engineering, static analysis is often the only safe way to handle a sample. For vulnerability research, it’s how you spot the dangerous functions—strcpy, sprintf, gets—without accidentally triggering an exploit. And for firmware dissection, it’s how you map out memory-mapped I/O and undocumented features when you can’t even boot the device.

Disassemblers: The Core of the Toolkit

IDA Pro

Still the king, and for good reason. Hex-Rays’ interactive disassembler has been the standard for decades. Its graph view turns spaghetti x86 into something you can actually follow. The Python scripting engine lets you automate annotation, rename functions in batches, or hunt for known-bad code patterns. The decompiler plugins—Hex-Rays for x86/x64/ARM—are expensive but worth it when you need pseudocode that reads like mangled C. If you’re doing serious vulnerability research or malware triage, you’ll end up here eventually. The freeware version handles x86/x64 but lacks the decompiler; still, it’s enough to learn the craft.

Ghidra

The NSA’s open-source gift to the reversing community. Ghidra’s decompiler is surprisingly good for a free tool, often going toe-to-toe with Hex-Rays on complex functions. It supports a sprawling list of architectures—x86, ARM, MIPS, PowerPC, SPARC, even oddities like Z80 and 6502. The collaborative server mode lets teams work on the same binary at the same time, something IDA still fumbles. The learning curve is steep, and the UI feels like Java from 2005, but once you’re past that, Ghidra is a beast. Scripting in Java or Python (via Jython) is solid, and the community keeps dropping new scripts and processor modules.

radare2 / rizin

This is the terminal-native, script-first, Unix-philosophy disassembler. radare2 (and its modern fork rizin) is what you reach for when you need to pipe analysis into other tools, or when you’re working headless on a server. The learning curve is a cliff face—commands are terse, documentation is scattered, and the defaults are bare-bones. But the power is immense. It handles disassembly, hex editing, binary diffing, and even basic debugging. The r2ghidra plugin pulls Ghidra’s decompiler into the radare2 environment, giving you the best of both worlds. If you live in the terminal, this is your weapon.

Binary Ninja

A commercial tool that’s been quietly eating market share. Binary Ninja’s UI is modern and snappy, its API is clean and well-documented, and its intermediate language (BNIL) makes analysis scripts portable across architectures. The decompiler is good and improving fast. It’s not as feature-complete as IDA, but for many tasks—CTFs, embedded firmware, medium-complexity malware—it’s faster and more pleasant to use. The personal license is affordable compared to IDA Pro, which has made it a favorite among independents.

Hex Editors and Binary Parsers

010 Editor

Not just a hex editor—a binary parsing framework. 010 Editor’s template system lets you define C-like structs that overlay the raw bytes, turning a blob of firmware into labeled fields: headers, checksums, partition tables. The community repository has templates for hundreds of file formats, from ELF and PE to Nintendo ROMs and automotive ECU dumps. The scripting engine (similar to C) can run analysis passes, extract embedded files, or brute-force checksums. For reverse engineering file formats or carving data from unknown binaries, this is the tool.

ImHex

A newer, open-source hex editor with a pattern language inspired by 010 Editor’s templates. ImHex is built by and for reverse engineers: it has a built-in disassembler (via Capstone), data inspector, diffing view, and even a node-based pattern editor. The UI is dark and sleek, and it handles massive files without choking. It’s still maturing, but the pace of development is furious. If you want a free, extensible hex editor that understands binary structures, ImHex is the one to watch.

xxd / hexdump

Sometimes you don’t need a GUI. The classic xxd (or hexdump on BSD) is a command-line hex dumper that can also reverse a hex dump back into binary. It’s everywhere, it’s fast, and it pipes beautifully. Use it to grab a quick visual of a suspicious file, extract a byte range, or convert between formats in a script. Not glamorous, but foundational.

String Analysis and Metadata Extraction

GNU strings

The first thing you run on an unknown binary. strings pulls out printable character sequences, often revealing hardcoded URLs, IP addresses, registry keys, error messages, and function names. The -e flag lets you specify encoding (ASCII, Unicode, etc.), which is critical for modern malware that uses wide strings. Combine with grep to filter for patterns like HTTP, base64, or suspicious file paths. It’s primitive, but it’s the quickest way to get a sense of what a binary is doing.

FLOSS

The FireEye Labs Obfuscated String Solver. Malware authors love to obfuscate strings—XOR them, stack-construct them, or hide them in custom encodings. FLOSS automatically extracts both static and obfuscated strings from a binary by emulating small code sequences. It’s a massive time-saver when dealing with packed or protected samples. Run it before you even open a disassembler; the output often gives you the campaign ID, C2 domains, and mutex names without any manual reversing.

Exeinfo PE / Detect It Easy

Before you dive deep, you need to know what you’re dealing with. These tools identify packers, compilers, and protectors. Exeinfo PE is a Windows classic with a huge signature database. Detect It Easy (DIE) is its open-source, cross-platform cousin with a cleaner UI and scriptable detection engine. Both tell you if the binary is packed with UPX, protected with Themida, or compiled with Visual Studio—information that dictates your entire analysis strategy.

Binary Diffing and Patching

Diaphora

An IDA plugin that performs program binary diffing. Diaphora compares two IDA databases—say, a patched version of a binary against the original—and highlights added, removed, and modified functions. It’s essential for patch analysis: when a vendor silently fixes a vulnerability, diffing the before and after reveals exactly what changed, often pointing straight to the bug. It supports multiple matching heuristics and exports results to SQLite for further querying.

BinDiff

Google’s commercial binary diffing tool, now free after its acquisition from zynamics. BinDiff integrates with IDA and Ghidra, using graph isomorphism algorithms to match functions across binaries. It’s faster and more accurate than Diaphora on heavily optimized code, and its visual call graph diffing is excellent. A must-have for patch diffing and malware variant analysis.

radiff2

Part of the radare2 suite, radiff2 does binary diffing from the command line. It can compare two files byte-by-byte, or use more sophisticated analysis to match functions. The output is raw but scriptable—useful for automated triage pipelines where you need to quickly spot changes across hundreds of samples.

Specialized Static Analysis Engines

Binwalk

The firmware carving tool. Binwalk scans a binary blob for magic bytes that indicate embedded filesystems, compressed archives, or executable code. It can recursively extract a firmware image into its constituent parts—kernel, initramfs, squashfs, bootloader—often revealing hidden filesystems or backdoor binaries. If you’re doing IoT or router analysis, Binwalk is your first step after getting the firmware dump.

Checksec / PwnTools

For exploit development, you need to know the binary’s defenses. Checksec (part of pwntools) reads ELF and PE headers to report stack canaries, NX bit, PIE, RELRO, and other mitigations. It’s a one-liner that tells you whether your target is a hard nut or low-hanging fruit. Pwntools itself is a Python library that wraps a lot of tedious exploit-dev tasks, but its static analysis helpers are worth using even if you never fire up a debugger.

CWE Checker

An open-source tool that uses Ghidra’s headless mode to scan binaries for common weakness patterns—hardcoded passwords, dangerous functions, missing mitigations. It’s essentially a static analysis linter for compiled code. The output maps findings to CWE numbers, which is handy for reporting. It’s not a replacement for manual review, but it catches low-hanging bugs that might otherwise slip by.

Building Your Workflow

Static analysis isn’t about picking one tool—it’s about chaining them. A typical session on an unknown sample might look like this:

1. Triage: Run Exeinfo PE or DIE to identify the packer and compiler. If it’s packed, consider whether to unpack statically or dynamically.
2. Strings: Run FLOSS to pull both static and obfuscated strings. Grep for URLs, IPs, and suspicious patterns.
3. Metadata: Use Binwalk if it’s firmware; otherwise, check the PE/ELF headers manually or with Checksec.
4. Disassembly: Load into Ghidra or IDA. Run initial auto-analysis. Identify the entry point, main function, and any interesting imports.
5. Deep Dive: Annotate functions, trace cross-references, decompile critical sections. Use scripting to automate repetitive tasks.
6. Diffing: If you have a related sample (patched version, earlier variant), use BinDiff or Diaphora to spot changes.
7. Reporting: Export findings, annotate the disassembly database, and generate a report with key IOCs and behavioral summary.

This pipeline works for malware, firmware, and vulnerability research alike. The tools change, but the methodology stays consistent: peel back layers, map the structure, and document everything.

FAQ

What’s the difference between static and dynamic binary analysis?

Static analysis examines a binary without executing it—you’re reading the code, data, and metadata as they exist on disk. Dynamic analysis runs the binary in a controlled environment (sandbox, debugger) to observe its behavior. Static analysis is safer for malicious samples and reveals the full codebase, but it can’t show runtime-decrypted payloads or environment-dependent behavior. Most serious reverse engineering combines both.

Do I need to learn assembly language for static analysis?

Yes, but not all of it at once. Start with the architecture you encounter most—likely x86/x64 or ARM. Focus on calling conventions, control flow instructions, and common patterns like function prologues. Decompilers help by generating pseudocode, but they make mistakes, especially with hand-written assembly or obfuscated code. You need to read the disassembly to verify what the decompiler tells you.

Is Ghidra really a replacement for IDA Pro?

For many users, yes. Ghidra’s decompiler is excellent, its architecture support is broader, and it’s free. IDA still has advantages: a more mature plugin ecosystem, better debugger integration, and some advanced analysis features. High-end vulnerability research shops often keep both. If you’re starting out or working on a budget, Ghidra is the obvious choice.

How do I handle packed or obfuscated binaries statically?

First, identify the packer with tools like DIE or Exeinfo PE. Some packers (UPX, ASPack) can be statically unpacked with their own utilities or with generic unpacking scripts. For custom packers, you may need to manually reconstruct the original entry point by analyzing the unpacking stub in a disassembler. Tools like FLOSS can extract obfuscated strings without full unpacking. In many cases, static unpacking is possible but time-consuming; dynamic unpacking via memory dumps is often faster.

You’ve got a binary. No source. No symbols. No documentation. Just a slab of compiled code sitting on your drive, daring you to figure out what it really does. Maybe it’s a sketchy executable pulled from a phishing campaign, a firmware blob ripped off an IoT gadget, or some legacy app that outlived the developers who wrote it. The first move never changes: static analysis. No execution, no sandbox—just you, the file, and the tools that peel back its layers. This isn’t the sanitized world of automated scanners. This is the raw, hands-on craft of reverse engineering, and the tools you pick decide how deep you can go.

Why Static Analysis Still Matters

Dynamic analysis gets all the hype—sandboxes, debuggers, runtime instrumentation. But static analysis is where the real work begins. Before you ever let a binary touch memory, you need to know what you’re dealing with. File format quirks, embedded strings, suspicious imports, entropy anomalies, packing signatures—these are the breadcrumbs that tell you whether you’re looking at malware, a protection scheme, or just sloppy engineering. Static analysis is also the only safe way to handle truly hostile code. No VM escape worries, no anti-debug tricks, no time bombs waiting for the right system clock. You sit in your terminal, dissecting bytes, and the binary never gets a chance to fight back.

For the underground reverse engineer, static analysis isn’t just a preliminary step—it’s a philosophy. It’s about understanding the artifact as a whole before you ever poke it with a debugger. The tools in this space range from venerable command-line stalwarts to modern graphical suites, but they all share one trait: they give you control. No black-box reports, no sanitized risk scores. Just raw data and the freedom to interpret it.

The Core Toolkit: Disassemblers and Decompilers

At the heart of static analysis sits the disassembler. It translates machine code back into assembly language, giving you a human-readable (if not always human-friendly) view of the program’s logic. The decompiler goes a step further, attempting to reconstruct higher-level C-like pseudocode. These tools are your primary lens into the binary’s soul.

IDA Pro: The Industry Standard

IDA Pro has been the undisputed heavyweight of static analysis for decades. Its interactive disassembler lets you explore binaries with surgical precision—renaming functions, annotating code, defining data structures, and mapping out control flow graphs. The built-in decompiler (via the Hex-Rays plugin) turns assembly back into readable C pseudocode, which is often the fastest way to grasp complex logic. IDA’s plugin ecosystem is vast: Python scripting, custom loaders for obscure file formats, and community tools that automate everything from string deobfuscation to control flow flattening removal. The freeware version is limited to x86/x64 and lacks the decompiler, but it’s still a powerhouse for learning the craft. For serious work, the licensed version is non-negotiable.

What makes IDA truly dangerous in the right hands is its interactivity. You’re not just staring at a dead listing—you’re building a mental model of the program, labeling functions, tracking cross-references, and slowly reconstructing the original developer’s intent. It’s tedious, but it’s the closest thing to reading the programmer’s mind.

Ghidra: The NSA’s Open-Source Beast

When Ghidra dropped in 2019, it sent shockwaves through the reverse engineering community. A full-featured disassembler and decompiler, developed by the NSA and released for free, with support for dozens of processor architectures. Its decompiler is genuinely excellent—often producing cleaner pseudocode than IDA’s Hex-Rays, especially for complex ARM and MIPS binaries. The collaborative features (shared projects, version tracking) make it ideal for team-based analysis, and the scripting framework (Java or Python via Jython) is deep enough to automate almost anything.

Ghidra’s learning curve is steep, and its UI can feel clunky compared to IDA’s polish. But for anyone who can’t drop thousands on a license, or who needs to analyze obscure embedded firmware, Ghidra is a revelation. It’s also become the go-to for malware analysts who want to share annotated databases without worrying about license servers. The underground scene has embraced it hard—custom scripts for deobfuscation, unpacking, and signature generation are everywhere.

Radare2 / Rizin: The Hacker’s Scalpel

If IDA and Ghidra are full surgical suites, radare2 is the scalpel you carry in your pocket. It’s a command-line framework for reverse engineering that can disassemble, analyze, and patch binaries across an absurd range of architectures. The learning curve is vertical—commands are terse, the interface is dense—but once you internalize it, you can tear apart a binary faster than any GUI tool. Rizin is the community fork that’s been cleaning up the codebase and improving usability, but the spirit remains the same: total control, no hand-holding.

Radare2 shines in automation. Need to extract all strings from a hundred firmware samples and cross-reference them with known CVE patterns? A few lines of r2pipe script and you’re done. It’s also the tool of choice for patching binaries on the fly, analyzing esoteric file formats, and doing deep binary diffing. Not for the faint of heart, but indispensable for the underground.

Peeling Back the Layers: File Format Parsers and Unpackers

Before you even fire up a disassembler, you need to know what you’re looking at. Modern binaries are rarely just a clean PE or ELF file. They’re packed, encrypted, obfuscated, or wrapped in custom loaders designed to frustrate analysis. Static unpacking and format parsing tools are your first line of offense.

Detect It Easy (DIE)

DIE is the underground’s replacement for the aging PEiD. It’s a packer identifier, compiler detector, and file format scanner rolled into one. Written in C++ with a Qt GUI, it uses signature-based detection but also heuristics to spot unknown packers, cryptors, and protectors. It handles PE, ELF, Mach-O, and even .NET assemblies. The real power is in its scripting engine—you can write custom detection scripts in JavaScript or Python to catch new obfuscators as they appear in the wild. For anyone analyzing malware or protected binaries, DIE is the first tool you reach for.

UnpacMe and Manual Unpacking

Automated unpacking services like UnpacMe are useful for quick triage, but static unpacking is an art form. Packers like UPX are trivial to reverse, but custom protectors (Themida, VMProtect, Obsidium) require deep knowledge of PE structure, import reconstruction, and sometimes raw hex editing. Tools like PE-bear and CFF Explorer give you surgical control over PE headers, sections, and directories. For ELF, readelf and pyelftools are your friends. The goal is to reconstruct the original binary before it ever executes—a skill that separates script kiddies from serious analysts.

String Analysis and Pattern Matching

Strings are the lowest-hanging fruit in static analysis. They reveal URLs, IP addresses, registry keys, file paths, function names, and sometimes even entire command-and-control protocols. But modern malware rarely leaves strings in plain sight. They’re XOR’d, stacked, or encrypted with custom algorithms. That’s where specialized string tools come in.

FLOSS: Beyond the Basics

FireEye’s FLOSS (now maintained by Mandiant) is the gold standard for string extraction. Unlike the classic strings command, FLOSS uses static analysis to decode obfuscated strings automatically. It emulates small portions of code to resolve stack strings, tight loops, and simple XOR routines—all without executing the binary. It also scores strings by interestingness, helping you cut through the noise. For packed samples, FLOSS can’t always reach the payload, but for unpacked malware, it’s a massive time-saver.

YARA: Signature-Based Hunting

YARA isn’t just a tool—it’s a language for describing binary patterns. You write rules that match on strings, hex sequences, or even regex patterns, and YARA scans files or memory dumps to find hits. It’s the backbone of malware classification and threat intelligence sharing. The underground uses YARA for everything: identifying known packers, flagging suspicious API combinations, hunting for specific crypto constants, and building custom detection sets for private malware families. Combined with a disassembler, YARA rules can be generated automatically from unique code patterns, making it a force multiplier for static analysis.

Binary Diffing and Patching

Sometimes you’re not analyzing a single binary—you’re comparing two versions of the same malware, or a patched and unpatched firmware, to understand what changed. Binary diffing tools highlight the differences at the assembly level, letting you zero in on new functionality, bug fixes, or backdoors.

Diaphora

Diaphora is a binary diffing plugin for IDA Pro that’s become the standard for vulnerability research and malware comparison. It performs multiple rounds of diffing—from basic hash matching to deep structural analysis using ASTs and control flow graphs—to find matches even when code has been heavily modified or recompiled. It’s open source and actively developed by Joxean Koret, a well-known name in the exploit development scene. If you’re trying to figure out what a patch actually fixed, Diaphora is the tool.

PatchDiff2 and BinDiff

PatchDiff2 is another IDA plugin focused on comparing patched binaries, especially for Microsoft Patch Tuesday analysis. It’s simpler than Diaphora but effective for quick comparisons. BinDiff, originally from zynamics (now Google), is a commercial tool that uses graph isomorphism algorithms to match functions across binaries. It’s particularly good at identifying similar code in different malware samples, helping analysts track code reuse and family relationships.

Specialized Analysis: Firmware, Mobile, and .NET

Not all binaries are created equal. Firmware images, Android APKs, and .NET assemblies each require their own tooling. The underground has adapted by building or adopting tools that understand these specific formats.

Firmware Analysis with Binwalk and FACT

Binwalk is the Swiss Army knife of firmware extraction. It scans binary blobs for known file signatures—filesystems, compressed archives, bootloaders, kernels—and carves them out automatically. It can even calculate entropy to identify encrypted or compressed regions. For deeper static analysis of Linux-based firmware, the Firmware Analysis and Comparison Tool (FACT) automates extraction, disassembly, and vulnerability scanning. It’s a framework, not just a tool, and it’s invaluable for IoT security research.

.NET Decompilation: dnSpy and ILSpy

.NET binaries are a different beast. They compile to CIL (Common Intermediate Language) rather than native code, which makes decompilation far more accurate. dnSpy is the weapon of choice—it’s a debugger, decompiler, and assembly editor all in one. You can decompile a .NET malware sample to nearly original source code, patch out anti-analysis checks, and recompile on the fly. ILSpy is a solid open-source alternative. For obfuscated .NET binaries, de4dot is a pre-processor that cleans up control flow, decrypts strings, and removes junk code before you feed it to dnSpy.

Android APK Analysis: APKTool and JADX

Android malware often hides its logic in native libraries, but the entry point is the DEX bytecode. APKTool decodes APK resources and disassembles DEX to Smali, a human-readable assembly language. JADX decompiles DEX directly to Java source, which is often surprisingly readable. For native libraries, you fall back to Ghidra or IDA. The combination of JADX for the Java layer and Ghidra for the native layer covers most Android threats.

Automating Static Analysis at Scale

When you’re dealing with hundreds or thousands of samples, manual analysis isn’t feasible. You need pipelines that extract features, classify, and cluster without human intervention. This is where static analysis meets scripting.

Building Your Own Pipeline

A typical static analysis pipeline starts with file identification (magic bytes, format validation), then moves to unpacking (if needed), string extraction, YARA scanning, and finally disassembly-based feature extraction. Tools like radare2 and Ghidra’s headless mode are perfect for this—they can be scripted to output function metadata, call graphs, and instruction histograms. Combine that with a database of known malware features, and you can cluster new samples by similarity, flag anomalies, and prioritize the most interesting binaries for manual review.

The underground scene has built entire ecosystems around these pipelines. Private YARA rule repositories, custom Ghidra scripts for deobfuscation, and radare2-based triage systems are shared in closed circles. The goal isn’t just detection—it’s understanding at scale.

FAQ

What’s the difference between static and dynamic analysis?

Static analysis examines a binary without executing it—looking at its structure, disassembly, strings, and metadata. Dynamic analysis runs the binary in a controlled environment (sandbox, debugger) to observe its behavior. Static analysis is safer and often faster for initial triage, but it can’t reveal runtime behavior like network connections or decryption of deeply obfuscated code. The two approaches are complementary.

Do I need to pay for IDA Pro, or is Ghidra enough?

Ghidra covers most use cases and is free. IDA Pro’s advantages are its mature plugin ecosystem, superior interactive disassembly, and the quality of the Hex-Rays decompiler for certain architectures. If you’re doing professional vulnerability research or analyzing heavily obfuscated x86/x64 malware, IDA Pro is often worth the investment. For learning, firmware analysis, or collaborative work, Ghidra is more than sufficient.

How do I handle packed or obfuscated binaries statically?

Start with detection tools like DIE to identify the packer. If it’s a known packer, use its unpacker (e.g., UPX -d). For custom packers, you’ll need to manually reconstruct the original entry point by analyzing the unpacking stub in a disassembler. Tools like FLOSS can still extract strings from packed samples by emulating the unpacking code. In many cases, static unpacking is possible but requires deep knowledge of the file format and the packer’s techniques.

What’s the best way to learn static analysis?

Start with simple crackmes from sites like crackmes.one. Use Ghidra or radare2 to analyze them, focusing on understanding control flow and identifying key functions. Read write-ups from other reversers to see how they approach problems. Practice on real malware samples from repositories like theZoo or MalwareBazaar, but always in a safe, isolated environment. The skill comes from repetition and curiosity—there’s no shortcut.

Why Static Analysis Still Matters

It’s 2 a.m. and you’re staring down a stripped ELF binary. You can’t just fire it up in a sandbox—maybe the sample phones home and burns your analysis environment, maybe it’s targeting an architecture you don’t have lying around, or maybe you just need a fast answer before the morning briefing. This is where static analysis earns its stripes. Not the polished, academic kind you read about in sanitized papers, but the messy, hands-on dissection that reverse engineers and malware analysts do when the clock is ticking and the sample is hostile.

Static analysis means tearing a binary apart without ever letting it execute. You’re parsing headers, stepping through disassembly, mapping control flow, and sniffing out suspicious strings or imports. The right tool can mean the difference between spotting a packed dropper in five minutes and spending hours lost in a hex dump. This isn’t a roundup of every tool on GitHub. It’s a curated set of what actually holds up in the field, with a bias toward Linux and cross-platform targets.

Disassemblers and Interactive Analysis

If you’re doing serious static work, you practically live inside a disassembler. The heavy hitters get most of the attention, but a few lesser-known options still have cult followings for specific niches.

Ghidra: The NSA’s Open-Source Powerhouse

Ghidra changed the game when it landed. A full reverse engineering framework with a decompiler that goes toe-to-toe with Hex-Rays, and it costs nothing. You can script tedious chores—unpacking, identifying crypto constants—in Java or Python. The learning curve is real; the UI feels like it was designed by a committee that never met. But once you remap the keybindings and get a feel for the project management, it’s hard to live without. The decompiler output is clean enough to refactor into readable pseudocode, and the function graph view untangles spaghetti logic faster than you’d expect.

For static analysis in particular, Ghidra’s headless mode is a quiet killer feature. You can script entire analysis pipelines: import a binary, run auto-analysis, apply signatures, dump decompiled functions to text—all without ever opening the GUI. That’s a lifesaver when you’re processing dozens of samples from the same campaign.

radare2 / rizin: The Terminal Workhorse

If you’re a terminal native, radare2—or its more actively maintained fork, rizin—is your scalpel. It’s not pretty. But it’s fast and scriptable to a degree that GUI tools can’t touch. Static analysis features include recursive disassembly, entropy analysis for spotting packed sections, and a dense set of commands for hunting ROP gadgets. The learning curve is brutal; the command syntax feels like an arcane dialect you have to learn by osmosis. Once it clicks, though, you can dismantle a binary faster than any point-and-click tool. Pair it with r2pipe for Python scripting and you’ve got a static analysis engine that slots neatly into custom pipelines.

Binary Ninja: The Hacker’s Disassembler

Binary Ninja sits somewhere between Ghidra and radare2 in complexity, with a focus on clean design and a seriously capable API. Its intermediate language (IL) system is a standout for static analysis: you can lift binaries to a platform-agnostic IL and write analysis passes that work across architectures. The decompiler is solid, though not as battle-hardened as Ghidra’s, and the collaborative features make it a decent pick for teams. For static vulnerability research, the automated function signature matching and type propagation save hours of manual annotation.

Specialized Static Analysis Tools

Disassemblers are the foundation, but specialized tools zero in on specific tasks with way more efficiency. These don’t always make the top-10 lists, but they earn their keep in real engagements.

FLOSS: FireEye Labs Obfuscated String Solver

Malware authors love to hide strings—stack-based construction, XOR loops, custom decoders. FLOSS automates pulling these hidden strings out of static binaries. Under the hood, it uses vivisect to statically emulate decryption routines, extracting C2 URLs, registry keys, and other indicators without ever executing the sample. The tool has evolved to handle increasingly twisted obfuscation patterns, and its output is structured for easy ingestion into threat intelligence platforms. If you’re doing malware triage, this one’s non-negotiable.

Binwalk: Firmware and Embedded Analysis

Binwalk is the go-to for extracting filesystems and compressed data from firmware images. It scans for magic bytes, unpacks nested archives, and identifies file types buried inside monolithic blobs. For static analysis of IoT or router firmware, Binwalk is step one—it pulls out the squashfs, jffs2, or cramfs so you can then analyze individual binaries. The entropy graphing feature is also handy for spotting encrypted or compressed sections in any binary, not just firmware.

Checksec: Hardening Verification

Part of the pwntools suite, checksec is a lightweight script that inspects a binary’s security features: RELRO, stack canaries, NX, PIE, and Fortify Source. It’s a quick first pass to understand what mitigations you’re up against. For static analysis, knowing whether a binary has full RELRO or no canaries tells you immediately where to focus your effort. The tool also parses kernel configs for embedded Linux targets, which is handy when assessing attack surface on routers or IoT devices.

Static Analysis for Malware Triage

When you’re staring down a folder of 200 samples from a phishing campaign, speed is everything. These tools prioritize rapid feature extraction over deep disassembly.

YARA: Pattern Matching on Steroids

YARA is the lingua franca of malware classification. Writing effective rules means understanding both the malware family and YARA’s syntax quirks. For static analysis, YARA rules can identify packed samples, detect specific crypto implementations, or flag suspicious API import patterns—all without execution. The real power comes from weaving YARA into your analysis pipeline: scan incoming samples, route matches to appropriate handlers, and enrich results with threat intel. Keep your rule sets lean; bloated rules slow scanning and spike false positives.

CAPA: Capabilities Detection

FireEye’s CAPA tool lifts static analysis to a higher abstraction level. Instead of matching bytes, it identifies capabilities—what the malware does. Using a ruleset mapped to the MITRE ATT&CK framework, CAPA analyzes disassembly and extracts features like keylogging, process injection, or C2 communication. It works with Ghidra or IDA, and the output is a structured list of behaviors with confidence scores. For triage, this tells you immediately whether a sample is a generic stealer or something that deserves a deeper look.

PEFrame and Manalyze: PE Analysis Specialists

For Windows binaries, PEFrame gives you a quick static overview: imports, exports, sections, resources, anomalies. It’s a Python script that wraps pefile and adds heuristics for common malware traits. Manalyze goes deeper, using a YARA-based plugin system to detect packers, cryptors, and suspicious patterns. Both are essential for rapid PE triage when you don’t have time to load every sample in a disassembler.

Deep Static Analysis: Unpacking and Deobfuscation

Packers and obfuscators are the bane of static analysis. These tools help peel back the layers without letting the code execute.

UnpacMe: Automated Unpacking Service

UnpacMe is a web-based platform that automates unpacking for common packers. You upload a sample, and it returns the unpacked binary along with a report. It’s not a silver bullet—custom packers still need manual intervention—but for commodity malware using UPX, ASPack, or similar, it saves hours. The API integration means you can feed it samples directly from your analysis pipeline.

Detect It Easy (DIE): Packer Identification

Before you can unpack, you need to know what you’re dealing with. DIE identifies packers, compilers, and cryptors with a signature-based approach that’s more comprehensive than PEiD. It handles ELF and Mach-O in addition to PE, and its entropy analysis helps spot custom packing. The tool is cross-platform and actively maintained, with a plugin system for extending detection capabilities.

FLARE VM and the Mandiant Stack

While FLARE VM is a full Windows analysis environment, its static analysis components deserve a nod. Tools like FakeNet-NG (for network simulation) and FLOSS (covered above) are part of a curated toolkit that streamlines malware dissection. The VM itself is a time-saver, but the individual tools can be used standalone on any Windows analysis box.

Static Analysis for Vulnerability Research

When you’re auditing code for bugs, static analysis shifts from triage to deep inspection. These tools help find the needle in the haystack.

CodeQL: Semantic Code Analysis

CodeQL treats code as data, letting you write queries that find vulnerability patterns. Originally from Semmle and now part of GitHub, it’s free for open-source projects. For binary analysis, CodeQL can ingest decompiled code from Ghidra and apply the same queries. This means you can hunt for use-after-free, double-fetch, or other complex bugs in closed-source binaries. The query language has a learning curve, but the community provides a growing library of pre-built queries for common vulnerability classes.

BinDiff: Binary Comparison

When you need to understand what changed between two versions of a binary—say, a patched and unpatched firmware—BinDiff is the tool. It matches functions across binaries and highlights differences in control flow and call graphs. This is invaluable for patch diffing, where you reverse the fix to understand the original vulnerability. BinDiff integrates with Ghidra and IDA, and while it’s not free, the time it saves justifies the cost for professional work.

Angr: Concolic Execution Engine

Angr blurs the line between static and dynamic analysis. It’s a Python framework for binary analysis that can perform symbolic execution, control-flow recovery, and data-flow analysis. In static mode, you can use it to generate call graphs, identify dead code, or solve for conditions that reach a specific code path. It’s heavy and complex, but for deep-dive vulnerability research, it’s unmatched in the open-source world.

Building a Static Analysis Pipeline

No single tool does everything. The real power comes from chaining them together. A typical pipeline for unknown samples might look like this:

1. File identification: Use file and DIE to determine the binary format and any known packers.
2. Unpacking: If packed, run through UnpacMe or manual unpacking scripts.
3. String extraction: Run FLOSS to pull obfuscated and plaintext strings.
4. Capability detection: Feed the sample to CAPA for behavioral fingerprinting.
5. YARA scanning: Match against known malware families and packer signatures.
6. Disassembly: Load into Ghidra or Binary Ninja for deep inspection if flagged as interesting.
7. Vulnerability research: Apply CodeQL queries or BinDiff if the sample is a target for exploit development.

Automating this pipeline with scripting is where the real efficiency gains happen. Ghidra’s headless mode, radare2’s r2pipe, and Python wrappers for most of these tools let you process hundreds of samples with minimal human intervention. The goal isn’t to replace the analyst—it’s to filter out the noise so you can focus on the signals.

FAQ

What’s the best free disassembler for static analysis?

Ghidra is the top free option for most use cases. It offers a decompiler, extensive scripting, and a collaborative project model. If you need a lightweight terminal-based tool, radare2/rizin is faster and more scriptable but has a steeper learning curve.

How do I handle obfuscated strings without running the binary?

FLOSS is purpose-built for this. It statically emulates decryption routines to extract hidden strings. For heavily obfuscated samples, you may need to combine it with manual unpacking first, but FLOSS handles most common obfuscation patterns out of the box.

Can static analysis replace dynamic analysis for malware triage?

Not completely, but it can handle a large percentage of initial triage. Tools like CAPA and YARA can classify samples and extract capabilities without execution. Dynamic analysis is still needed for samples with heavy anti-static tricks, but a solid static pipeline reduces the number of samples that require a sandbox.

What’s the best approach for analyzing firmware statically?

Start with Binwalk to extract the filesystem, then use checksec to assess hardening on individual binaries. For deeper analysis, load extracted ELFs into Ghidra and apply CodeQL queries if you’re hunting vulnerabilities. Firmware often contains stripped binaries, so function ID via FLIRT or Ghidra’s BSim can help recover symbol names.

Static analysis isn’t about having the flashiest toolkit—it’s about knowing which tool to reach for when the pressure is on. Master a core set, script the repetitive stuff, and keep your YARA rules fresh. The binaries aren’t going to reverse themselves.