How do I run ScratchABit on Windows?

The FAQ recommends installing Linux in an emulator or VM, as ScratchABit is designed for Unix-like systems with VT100 terminals. There's no native Windows support, and setup requires manual configuration.

ScratchABit vs IDA Pro: which is better for reverse engineering?

ScratchABit is open-source, hackable with Python plugins, and ideal for static analysis across architectures on a budget. IDA Pro is commercial with more features like decompilation and dynamic debugging, but it's expensive and proprietary.

How to write a custom CPU plugin for ScratchABit?

Use the IDAPython API; write a plugin in Python and place it in the plugins/cpu/ directory or on the Python path. Refer to included examples like x86.py and the example .def files for guidance.

Can ScratchABit handle large binaries efficiently?

It uses Python for disassembly, which may impact performance with very large binaries compared to native tools. However, its incremental disassembly and text-based database help manage memory usage.

Is there a graphical version of ScratchABit?

No, ScratchABit uses a full-screen text UI via ANSI/VT100 sequences to avoid dependencies. For graphical interfaces, you'd need to rely on plugins or external tools, which aren't natively supported.

How to save and version control the disassembly database?

ScratchABit uses text-based database files, making them easy to track with git. However, git integration is listed as a TODO, so manual management is currently required for saving and versioning.

Open-Awesome

ScratchABit

GPL-3.0Pythonv2.0

An interactive, retargetable disassembler with IDAPython-compatible plugin API for static analysis and reverse engineering.

GitHub

413 stars48 forks0 contributors

What is ScratchABit?

ScratchABit is an interactive, retargetable disassembler designed for static analysis of binaries, firmware, and drivers. It solves the problem of analyzing unsupported or proprietary hardware by providing a hackable, plugin-based framework that supports multiple CPU architectures through IDAPython-compatible plugins.

Target Audience

Reverse engineers, firmware developers, and security researchers working on open-source driver/firmware development, hardware interoperability, or security analysis, especially those needing a lightweight, extensible disassembler.

Value Proposition

Developers choose ScratchABit for its simplicity, minimal dependencies, and plugin-based retargetability, offering an open-source alternative to proprietary disassemblers with a focus on community-driven reverse engineering and static analysis.

Overview

Easily retargetable and hackable interactive disassembler with IDAPython-compatible plugin API

Use Cases

Best For

Reverse engineering proprietary firmware or drivers for open-source compatibility
Static analysis of binaries across multiple CPU architectures (x86, ARM, MIPS, etc.)
Writing custom disassembly plugins using Python and IDAPython API
Analyzing raw binary files with custom memory layouts
Educational or research projects in reverse engineering and binary analysis
Integrating disassembly workflows with version control via text-based databases

Not Ideal For

Reverse engineers requiring dynamic debugging or live memory analysis
Teams needing a graphical user interface with modern visualizations and drag-and-drop features
Users on Windows or macOS without a Linux virtual machine setup
Projects that demand built-in decompilation without relying on external tools

Pros & Cons

Pros

Retargetable Architecture Support

Supports any CPU via IDAPython-compatible plugins, with included plugins for x86 and Capstone Engine covering ARM, MIPS, PowerPC, etc., enabling flexible analysis of diverse binaries.

Text-Based Database

Uses easy-to-parse text formats for the disassembly database, facilitating version control and integration with external tools, as emphasized in the project's manifesto.

Minimal Dependencies

Employs a full-screen text UI using ANSI/VT100 sequences, avoiding heavy libraries like curses for a lightweight setup that reduces bloat and compatibility issues.

Plugin Ecosystem

Leverages existing IDAPython processor plugins and allows easy creation of new plugins in Python, enhancing extensibility for custom architectures and analyses.

Cons

No Dynamic Analysis

Lacks debugger support and is dedicated to static analysis, as stated in the FAQ, making it unsuitable for runtime investigations or live debugging scenarios.

Platform Limitation

Primarily designed for Unix-like systems; the FAQ bluntly recommends installing Linux in a VM for other platforms, indicating poor cross-platform support.

Incomplete Feature Set

Marked as a work in progress with TODOs like git integration and improved robustness, suggesting missing functionalities and potential instability.

Sparse User Interface

Text-only UI may be less intuitive for complex analyses compared to graphical disassemblers, and mouse support is limited to XTerm-compatible terminals.

Open Source Alternative To

ScratchABit is an open-source alternative to the following products:

IDA Pro

IDA Pro is the professional version of the Interactive Disassembler, featuring advanced debugging and analysis tools for reverse engineering.

Frequently Asked Questions

Related Projects

x64dbg

An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.

Stars48,979

Forks2,794

Last commit3 days ago

radare2

UNIX-like reverse engineering framework and command-line toolset

Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.

Stars8,907

Forks1,708