RetDec
A retargetable machine-code decompiler based on LLVM, supporting multiple architectures and file formats.
What is RetDec?
RetDec is a retargetable machine-code decompiler that converts compiled binaries back into high-level source code representations like C or a Python-like language. It solves the problem of analyzing and understanding executable files without access to original source code, which is crucial for reverse engineering, security auditing, and malware research. Built on LLVM, it supports a wide range of architectures and file formats.
Security researchers, malware analysts, reverse engineers, and software developers who need to analyze or audit binary executables for vulnerabilities, compatibility, or educational purposes.
Developers choose RetDec for its retargetable design that works across multiple architectures and file formats without limitations, its advanced features like C++ class hierarchy reconstruction and library code removal, and its open-source nature which allows for customization and integration into security toolchains.
Overview
RetDec is a retargetable machine-code decompiler based on LLVM.
Use Cases
Best For
- Reverse engineering proprietary software binaries
- Analyzing malware and suspicious executables
- Auditing closed-source software for security vulnerabilities
- Recovering lost source code from compiled programs
- Educational purposes in binary analysis and decompilation
- Cross-architecture binary analysis and porting efforts
Not Ideal For
- Teams needing active support and quick bug fixes due to delayed issue responses in limited maintenance mode.
- Simple, one-off decompilation tasks where more user-friendly tools like Ghidra offer faster results.
- Projects requiring a GUI-driven workflow without external plugins or integrations.
- Environments with strict performance or real-time analysis requirements, as decompilation is computationally intensive.
Pros & Cons
Pros
Supports 32-bit and 64-bit architectures including x86, ARM, MIPS, and PowerPC, enabling analysis across diverse platforms without vendor lock-in.
Reconstructs C++ class hierarchies, utilizes debugging information like DWARF and PDB, and removes library code via signatures for accurate source recovery.
Handles multiple formats such as ELF, PE, Mach-O, COFF, and raw machine code, eliminating barriers for analyzing various binary types.
Built on LLVM with CMake integration and library APIs, allowing customization and embedding into security toolchains or other projects.
Cons
The project is in limited maintenance due to resource constraints, with issues responded to quarterly and minimal active development, as warned in the README.
Requires building from source with heavy dependencies like OpenSSL, Python, and autotools, which can be error-prone and time-consuming for non-experts.
Primarily a command-line tool; users must rely on external plugins for IDA or Radare2 for graphical interfaces, adding extra steps.
Slow development means fewer updates and new features compared to competitors, potentially missing optimizations or support for newer binary formats.
Frequently Asked Questions
Related Projects
angrA powerful and user-friendly binary analysis platform!
de4dot.NET deobfuscator and unpacker.
CapaThe FLARE team's open-source tool to identify capabilities in executable files.
LIEFLIEF - Library to Instrument Executable Formats (C++, Python, Rust)
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.