How does RetDec compare to Ghidra for reverse engineering?

RetDec is architecture-agnostic and supports more formats out-of-the-box, while Ghidra offers a full IDE with scripting. RetDec's LLVM-based decompilation can be accurate, but Ghidra has more active development and a larger community.

How to decompile a Windows PE file with RetDec?

Install RetDec and optional Graphviz, then run 'retdec-decompiler.exe yourfile.exe' from the command line, as per the Windows use instructions in the README. Ensure Microsoft Visual C++ Redistributable is installed.

Does RetDec support ARM64 binaries on modern macOS?

Yes, RetDec lists ARM64 (AArch64) as a supported architecture and handles Mach-O files, so it can decompile macOS binaries, including those for Apple Silicon systems.

What's the accuracy of RetDec's decompiled output?

RetDec uses LLVM for reliable static analysis, but accuracy varies with binary complexity and compiler optimizations. It's best for understanding code structure rather than perfect source recovery.

Can RetDec handle obfuscated or packed executables?

It includes packer detection and signature-based library removal, but for heavily obfuscated binaries, you may need to preprocess with tools like UPX, which is listed as an optional dependency.

How to generate control flow graphs with RetDec?

Install Graphviz as an optional dependency, then use the retdec-decompiler command with appropriate flags to output graphs, as described in the installation sections for each OS.

Is RetDec good for malware analysis beginners?

Due to its complex setup, command-line interface, and limited maintenance, it's better suited for experienced analysts who can handle static decompilation without extensive support.

Open-Awesome

retdec

MITC++v5.0

A retargetable machine-code decompiler based on LLVM, supporting multiple architectures and file formats.

Visit Website GitHub

8.7k stars1.0k forks0 contributors

What is retdec?

RetDec is a retargetable machine-code decompiler that converts compiled binaries back into high-level source code like C or a Python-like language. It is built on LLVM and supports a wide range of architectures and file formats, enabling detailed static analysis and code reconstruction. The tool is essential for reverse engineering, security research, and understanding legacy or obfuscated software.

Target Audience

Security researchers, malware analysts, reverse engineers, and developers working with binary analysis or legacy code who need to decompile executables across multiple platforms.

Value Proposition

Developers choose RetDec for its architecture-agnostic design, extensive format support, and accurate reconstruction of high-level code structures, all backed by the LLVM framework for reliable analysis.

Overview

RetDec is a retargetable machine-code decompiler based on LLVM.

Use Cases

Best For

Decompiling malware samples for behavioral analysis
Reverse engineering proprietary software without source code
Analyzing firmware or embedded system binaries
Converting legacy binaries to readable source code for auditing
Studying compiler optimizations and code generation patterns
Extracting debugging information from stripped executables

Not Ideal For

Real-time dynamic analysis and debugging requiring interactive tools
Simple disassembly tasks where lighter utilities like objdump suffice
Projects needing active vendor support or rapid feature updates
Analyzing binaries from very recent or unsupported architectures

Pros & Cons

Pros

Broad Format Support

Handles ELF, PE, Mach-O, COFF, AR, Intel HEX, and raw machine code, enabling analysis across diverse platforms as listed in the README.

Architecture Agnostic Design

Supports 32-bit and 64-bit architectures including x86, ARM, MIPS, and PowerPC, making it versatile for various binary files.

Advanced Code Reconstruction

Reconstructs functions, types, C++ class hierarchies, and high-level constructs using LLVM for accurate decompilation into C or a Python-like language.

Integrated Static Analysis

Provides compiler and packer detection, signature-based library removal, and debugging information extraction for detailed binary inspection.

Cons

Limited Maintenance Mode

Explicitly stated in the README warning, with delayed issue responses up to a quarter and minimal active development, reducing reliability for critical projects.

Complex Installation Process

Requires building from source with dependencies like CMake, OpenSSL, and Python, or downloading large 5-6 GB packages, making setup non-trivial.

Incomplete Documentation

The Wiki is noted as 'in progress', which may hinder users seeking comprehensive guides or troubleshooting assistance.

Frequently Asked Questions

Related Projects

jadx

Dex to Java decompiler

Stars51,165

Forks5,817

Last commit8 days ago

dnSpy

.NET debugger and assembly editor

Stars29,658

Forks5,677

Last commit5 years ago

ILSpy

.NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform!

Stars26,773

Forks3,786

Last commit2 days ago

JD-GUI

A standalone Java Decompiler GUI

Stars15,217

Forks2,474

Last commit2 years ago

Community-curated · Updated weekly · 100% open source

Found a gem we're missing?

Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.

Submit a project Star on GitHub