How beginners choose an RE tool (authorized analysis only)
If you are new to reverse engineering, pick a tool from what you are allowed to analyze, your OS, and your budget — not from social-media hype. As of late 2026, a practical free stack is Ghidra 12.1.4 for native decompilation, Cutter 2.5.0 for a Rizin GUI, x64dbg 2026.05.27 for Windows debugging, jadx for Android DEX/APK, and ImHex for structured hex work.
Authorized analysis only. BinBench does not teach license bypass, pirated installs or unauthorized reverse engineering.
Decision table
| Your situation | Start with | Why |
|---|---|---|
| Native PE/ELF/Mach-O, $0 budget | Ghidra | Free Apache-2.0 decompiler; multi-platform |
| Prefer GUI over Java Swing | Cutter (Rizin) | GPL-3.0 GUI; ships Ghidra decompiler in releases (no Java) |
| Windows user-mode debug only | x64dbg | GPL-3.0; classic debugger UI |
| Android APK / DEX | jadx (+ Apktool for resources) | Apache-2.0; see jadx vs Apktool |
| Hex / file formats / templates | ImHex or 010 Editor | Free GPL vs commercial Templates |
| macOS-native commercial UI | Hopper (after demo) | Perpetual license; see Hopper vs Ghidra |
| Employer standardizes on Hex-Rays | IDA (legal plan) | Check hex-rays.com/pricing |
| Prefer Binary Ninja UX/API | Binary Ninja edition you may legally use | See purchase page |
Versions cited from BinBench checks: Ghidra 12.1.4 (2026-09-21), Cutter v2.5.0 (2026-06-30), x64dbg 2026.05.27, ImHex v1.38.1 (2025-12-21). Re-verify on official release pages.
Budget bands
| Budget | Realistic starter set |
|---|---|
| $0 | Ghidra + Cutter or radare2/Rizin + ImHex (+ x64dbg on Windows; jadx for Android) |
| Low commercial | Hopper Personal/Computer after demo; or Binary Ninja Personal if non-commercial terms fit |
| Team / commercial RE | IDA Pro or Binary Ninja Commercial under vendor licenses — never pirated copies |
Hex-Rays and Vector 35 publish official prices; see IDA Pro pricing and Binary Ninja pricing.
A 30-day beginner path (legal samples)
- Week 1 — Setup. Install Ghidra + JDK; open a binary you compiled yourself or a public domain / explicitly permitted sample.
- Week 2 — Navigate. Learn functions, cross-references, strings and the decompiler pane. Optionally mirror the same file in Cutter.
- Week 3 — Dynamic (Windows). If on Windows, step through your own program in x64dbg. Keep a lab VM.
- Week 4 — Specialize. Android → jadx; hex formats → ImHex; macOS focus → Hopper demo.
Document every target's authorization. If you cannot state why you may analyze it, stop.
Common beginner traps
| Trap | Better approach |
|---|---|
| Downloading pirated IDA builds | Use IDA Free / paid plan or Ghidra |
| Analyzing DRM-locked App Store apps without rights | Analyze your own builds or authorized research samples |
| Judging tools by one YouTube thumbnail | Compare on the same authorized sample |
| Skipping assembly basics | Pair tool practice with a short asm primer |
| Mixing malware and daily driver | Use an isolated VM |
Related on BinBench
- Free RE tools · OSS IDA alternatives · Ghidra vs IDA · Cutter getting started · x64dbg getting started · Hopper vs Ghidra · ImHex vs 010 Editor
FAQ
What should I install first with zero budget?
For native binaries, Ghidra 12.1.4 (Apache-2.0) plus a matching JDK. Add Cutter if you prefer a Qt GUI on Rizin, or x64dbg if you only debug Windows user-mode processes.
Do I need IDA Pro as a beginner?
No. Learn workflows on free tools first. Evaluate IDA Free (non-commercial) or paid plans only when your organization requires Hex-Rays.
Can beginners analyze any app from an app store?
No. Only software you own or are authorized to examine. DRM bypass, pirated licenses and stolen license files are illegal and out of scope on BinBench.
Is Frida a beginner first tool?
Frida is powerful for dynamic instrumentation but assumes you already understand processes and APIs. Start with static tools, then add Frida on authorized targets.
Where do prices come from?
Official vendor pages linked from each BinBench pricing/comparison article. Re-check before buying; list prices change.