Back to home

AI Reverse Engineering Tools: A Curated Directory

A curated directory of AI-assisted reverse engineering tools — agent-native platforms, classic disassemblers like IDA and Ghidra, dynamic analysis and malware tooling.

Last updated: 2026-10-15

Agent-native tools (the new wave)

Tools built around AI agents doing the analysis work:

  • REA (Reverse Engineer Anything) — open-source MCP server that connects Claude Code, Codex, Cursor and other agents to Ghidra, Hopper and IDA. Runs locally, MIT licensed, analyzes everything from Electron apps to native binaries. Start with our setup guide.
  • RevEng.AI — a cloud platform for AI-powered binary analysis, aimed at reverse engineers, threat hunters and product security teams. Commercial.
  • ART — AI Reverse-engineering Tool — EPAM's enterprise-grade AI solution for reverse engineering and code comprehension. Commercial / enterprise services.

Disassemblers & decompilers (the classic engines)

The workspaces agents plug into — still where deep manual work happens:

  • Ghidra — the NSA's open-source disassembler and decompiler. Free, scriptable, the default engine for most REA setups.
  • IDA Pro — the industry standard for interactive disassembly and decompilation, with a massive plugin ecosystem. Commercial, with a free edition. The tool AI agents accelerate — not replace.
  • Binary Ninja — modern disassembler with a developer-friendly API and clean UI. Commercial, with a free edition.
  • radare2 / Rizin / Cutter — open-source reversing frameworks and their graphical frontends.

Dynamic analysis & debugging

For watching software run:

  • Frida — inject scripts into running processes to trace calls, inspect data and change behavior.
  • x64dbg — open-source Windows debugger for native executables.
  • GDB with GEF or pwndbg — the Linux reversing staple.
  • Cheat Engine — memory scanner and debugger, mainly for game and application modding.

Malware analysis & triage

  • capa — identifies capabilities in executables using rules over static or dynamic analysis results.
  • FLOSS — recovers obfuscated strings, including ones built on the stack.
  • PE-sieve — scans running processes for injected or modified code and dumps what it finds.
  • YARA-X — the Rust-based successor to YARA for rule-based file classification.
  • MobSF — automated static and dynamic analysis of Android and iOS apps.

How to choose

There is no single best tool — the sensible default in 2026 is a combination:

  1. New to reverse engineering? Start with Ghidra (free) plus REA as the agent layer. You get a full decompiler and a plain-English guide over it.
  2. Already own IDA or Binary Ninja? Keep your workspace and add an agent server on top — REA can use your existing IDA installation.
  3. Security team with cloud workflows? Evaluate RevEng.AI for team-scale binary analysis alongside local tooling.
  4. Mobile focus? JADX and MobSF for Android, plus an agent to summarize findings.
  5. Game or app modding? Frida and Cheat Engine remain the pragmatic picks.

One caveat that applies to every tool on this page: use them on authorized targets only — your own software, licensed inspection, or sanctioned research. See the main guide for where the legal lines usually sit.

Missing a tool? This directory grows — the fastest-moving frontier is agent-native tooling, and this page tracks it.