필사 모드: Reverse Engineering Tools 2026 — Ghidra / IDA Pro / Binary Ninja / radare2 / Frida / x64dbg / angr Deep Dive

Prologue — Why the RE tool stack needs a fresh look in 2026

In March 2019, the NSA dropped Ghidra at the RSA Conference under Apache 2.0. That single announcement broke a 30-year equilibrium in the reverse engineering market. Before it, anyone who could not afford an IDA Pro license (commercial Decompiler bundle starting at \$3,710) — students, hobbyists, underfunded security labs — was stuck with free disassemblers that barely showed Intel syntax. The decompiler market was effectively a Hex-Rays monopoly. Ghidra flipped the table. Free decompilation for x86, ARM, MIPS, PowerPC, SPARC, RISC-V. Multi-user collaboration. Java and Python scripting APIs out of the box.

Seven years later, the 2026 RE landscape is no longer "IDA Pro vs. nothing." On the disassembler side Ghidra, IDA Pro, Binary Ninja, radare2 with the Cutter UI, and Hopper all coexist. Mobile RE has standardized on Frida. The CTF scene runs on Pwntools, Pwndbg, and GEF. The academic side has settled on symbolic execution engines like angr, Triton, and KLEE. And the biggest shift — LLM-assisted RE. Binary Ninja Sidekick, IDA Pros Decompiler AI plugin, and Ghidras GhidraMCP / G-3PO / Sidekick integrations now auto-rename decompiler output into readable function and variable names.

This article aligns 17 tools and ecosystems on the same axes. Each tool gets the same template: strengths, weaknesses, who actually uses it, 2026 pricing, licensing. The final chapter is a decision tree for students, CTF players, mobile RE engineers, firmware analysts, and professional RE engineers.

> Models keep converging. Tools keep diverging. The same ELF binary read through Ghidra and through Binary Ninja produces a different mental picture, and that difference sets the speed of analysis.

Pricing and feature numbers move fast. Every number is as of May 2026. The focus is on structural differences that will outlast specific version bumps.

Chapter 1 · The 2026 RE Map — Four Categories

Start by sorting tools into four categories. That sort is itself the first decision.

**Axis 1 — Static Disassemblers / Decompilers**

Break a binary down into assembly and C-like pseudocode without executing it. Ghidra, IDA Pro, Binary Ninja, radare2 + Cutter, Hopper, Plasma. Every RE task starts here. Decompiler quality drives market share.

**Axis 2 — Dynamic Debuggers**

Attach to a running process and inspect registers, memory, call stacks. x64dbg (Windows), OllyDbg (32-bit Windows, legacy), WinDbg (Microsoft official), GDB with Pwndbg/GEF (Linux), LLDB (macOS/iOS). Core CTF tools.

**Axis 3 — Dynamic Instrumentation**

Inject code into a live process to intercept or rewrite function calls. Frida (mobile and desktop standard), Cheat Engine (game memory), Intel Pin, DynamoRIO, Wireshark (network level). Strong where static analysis hits packed or obfuscated binaries.

**Axis 4 — Symbolic Execution / Abstract Interpretation**

Treat inputs as symbolic variables rather than concrete values, and explore every reachable path. angr (Python), Triton (C++ with Python bindings), KLEE (LLVM-based), Manticore. The academic foundation for automatic exploit generation and vulnerability discovery.

Two supporting layers sit underneath.

**Engine Layer**

Libraries other tools build on. Capstone (disassembler engine), Keystone (assembler engine), Unicorn (CPU emulator), QEMU (system emulator). radare2, Binary Ninja, and angr all stand on these.

**LLM Layer**

A new layer in 2026. Binary Ninja Sidekick, IDA Pro Decompiler AI, GhidraMCP and G-3PO for Ghidra, claude-mcp-ghidra. They feed decompiled code to an LLM to auto-generate function names, variable names, and comments.

Keep those four axes plus two layers in mind. From here, each chapter follows the same template: vendor and license, strengths, weaknesses, who actually uses it, 2026 pricing.

Chapter 2 · Ghidra — The Free Standard the NSA Released

**Vendor and License**

Built by the NSAs cybersecurity directorate. Open-sourced under Apache 2.0 at RSA 2019. The GitHub repository NationalSecurityAgency/ghidra is the canonical home. As of 2026 the stable line is the 11.x series.

**Strengths**

Free. That one word changed everything. Java GUI with an Eclipse-style multi-window layout. Architecture support spans x86, x86-64, ARM, AArch64, MIPS, PowerPC, SPARC, RISC-V, AVR, 6502, and more. Decompiler quality is now a real challenger to IDA Hex-Rays. Ghidra Server for official collaboration, Ghidrathon for Python scripting, GhidraMCP for LLM integration, and Python 3 support all stabilized between 2024 and 2025. The clean P-code intermediate representation makes plugin authoring straightforward.

**Weaknesses**

The debugger was historically weak. Added in 2022, it is still rough compared to GDB or x64dbg. The Java Swing UI never feels native on macOS. Analysis slows on large binaries (50 MB plus). Server setup for collaboration is involved — effectively you need an SRE to deploy it.

**Who Actually Uses It**

Students, CTF players, underfunded security labs, government contractors (especially in the US), and most open-source security researchers. As of 2026, Ghidra is the default for anyone new to RE. KAIST and POSTECH security clubs publish writeups with Ghidra screenshots. KISA reports lean on it. Companies that cannot get a Hex-Rays purchase order through procurement install Ghidra.

**2026 Pricing**

Zero. The NSA ships a new release on GitHub every year.

Chapter 3 · IDA Pro (Hex-Rays) — The Classic, Expensive, Still the Benchmark

**Vendor and License**

Hex-Rays SA, based in Belgium. First released in 1996, the benchmark RE tool for 30 years running. Commercial license. Both perpetual-with-annual-updates and subscription models are supported. As of 2026 the line is IDA Pro 9.x.

**Strengths**

Decompiler quality is still the industry leader, especially on ARM64, MIPS, and odd compiler optimization patterns. Interactive graph view, polished since the 1990s, remains the fastest way to grasp function structure. IDAPython and IDC scripting. FLIRT and FLAIR signatures auto-identify library functions. IDA Lumina for cloud-shared function metadata. The Hex-Rays AI Decompilation plugin. Microsoft, Google, Apple, and government contractors have spent decades layering custom tooling on top of IDA Pro workflows. The de facto in-house standard for government, finance, and game-protection RE teams.

**Weaknesses**

Pricing. As of 2026, IDA Pro Named License starts at \$3,710. Each additional Hex-Rays Decompiler architecture adds \$2,995. Annual maintenance is separate. A full package — x86, x64, ARM, MIPS, PowerPC decompilers plus a year of updates — easily clears \$15,000. Not a hobbyist price. IDA Free (the student tier) heavily restricts cloud decompilation. The UI never quite escaped its 1990s Windows look — 9.x improved some panels, but the feel persists.

**Who Actually Uses It**

Professional RE engineers. Government, defense, finance, game security, and malware-analysis companies still onboard new hires through IDA Pro. In Korea, parts of AhnLab, RAONWHITEHAT, and KISA work in IDA. In Japan, LAC, the Trend Micro Tokyo lab, and FFRI Security all hold IDA Pro licenses.

**2026 Pricing**

Named License \$3,710 plus \$2,995 per decompiler architecture plus annual maintenance. A full setup runs \$15,000 and up. A corporate purchase order is mandatory.

Chapter 4 · Binary Ninja (Vector 35) — Modern, with a Clean API

**Vendor and License**

Vector 35, based in Seattle. Launched in 2016. As of 2026 the series is 5.x. Commercial license, roughly one-tenth of an IDA Pro full stack.

**Strengths**

A Python API treated as a first-class citizen from day one. BNIL — Binary Ninja Intermediate Language — is a multi-tier IR (LLIL into MLIL into HLIL) clean enough to make plugin authoring straightforward. HLIL is effectively the decompiler output, and its quality is closing the gap to IDA quickly. Modern UI built on Qt with a proper dark theme, multi-tab editing, and fast search. Sidekick provides in-house LLM-assisted RE. Binary Ninja Cloud runs in the browser for collaboration. Headless mode integrates with CI pipelines. Through 2024 and 2025 the team added P-Code and Triton integration, a KLEE backend, and an experimental MLIR pipeline.

**Weaknesses**

The decompiler is not as mature as IDA Pro Hex-Rays, particularly on MIPS, SPARC, and exotic architectures. Market share in Korean and Japanese government and finance verticals stays low, which keeps the local hiring pool small. The free Cloud tier is feature-limited.

**Who Actually Uses It**

Modern RE engineers, security startups, exploit developers, CTF teams. Trail of Bits, Synacktiv, and Theori publish in-house Binary Ninja plugins. In Korea, Theori HQ stacks its custom tooling on top of Binary Ninja.

**2026 Pricing**

Personal \$300 perpetual plus \$150 a year for updates. Commercial \$1,500 plus \$750 a year. Enterprise is custom. The Cloud free tier sits alongside paid tiers from \$10 a month.

Chapter 5 · radare2 + Cutter — Powerful OSS Wrapped in a Qt UI

**Vendor and License**

Open-source project started by Sergi Alvarez in 2006. Itay Cohen joined in 2018 to build Cutter, the Qt-based GUI. Both projects are LGPL 3.0.

**Strengths**

Completely free and open source. The CLI radare2 is exceptionally strong — one `aaa` runs auto-analysis, then short commands handle everything: `pdf` prints disassembled functions, `s` seeks, `wx` writes hex. Cutter wraps that CLI in a Qt GUI and calls into the Ghidra decompiler as a backend. The r2pipe interface lets you script from Python, Node.js, or Rust. Binary patching is more direct than in any commercial competitor. Strong on embedded RE — firmware analysis, IoT devices, and the architectures those tend to use.

**Weaknesses**

Steep learning curve. The CLI vocabulary is often compared to Vim, except worse — you really do have to memorize a small books worth of short commands. Cutter improved a lot, but still rough next to IDA or Binary Ninja. The decompiler is borrowed from Ghidra, which means it inherits Ghidras limits.

**Who Actually Uses It**

A lot of European and Latin American security researchers — the project itself is Spanish-origin. Firmware RE, IoT device RE, embedded ARM, MIPS, and PowerPC analysis. Strong OSS partisans. Often shows up in CTF.

**2026 Pricing**

Zero.

Chapter 6 · x64dbg — The New Standard Windows Debugger

**Vendor and License**

Started in 2013 by Duncan Ogilvie (mrexodia) under GPL 3.0. Despite the name "x64dbg," the 32-bit companion module x32dbg ships in the same bundle.

**Strengths**

Free and open source, yet it has cleanly taken over from OllyDbg 2.x as the Windows PE debugger of choice. Optimized for both 32-bit and 64-bit Windows binaries. Patching, breakpoints, the memory map, call stacks, handle view, and module view all reach IDA Pro-equivalent ergonomics. Clean plugin SDK with a rich ecosystem: ScyllaHide for anti-anti-debug, SwissArmyKnife, Snowman for decompilation, x64dbgIDA for syncing back to IDA. Monthly releases still ship in 2026.

**Weaknesses**

Windows-only — no Linux or macOS support. No decompiler in the base install; you add Snowman as a plugin. Memory view can drag on very large binaries.

**Who Actually Uses It**

Windows malware analysts, game cheaters and anti-cheat engineers (mirror images of each other), Windows exploit developers. Anti-cheat teams at Korean game studios (NCSOFT, Nexon, Krafton) and Trend Micro Tokyo use x64dbg as a standard tool.

**2026 Pricing**

Zero.

Chapter 7 · OllyDbg — A Legacy 32-bit Workhorse

**Vendor and License**

Oleh Yuschuk released this 32-bit Windows debugger in 2000. Versions 1.x and 2.x exist; both are freeware but not open source. Major updates effectively stopped after 2014.

**Strengths**

For the late 2000s and early 2010s, OllyDbg was the standard for Windows malware analysis. Lightweight, simple, intuitive UI. Legendary plugins like ScyllaHide, OllyDumpEx, and OllyAdvanced. Once you learn the shortcut layout, it stays in your fingers forever.

**Weaknesses**

32-bit only. With 64-bit as the de facto 2026 baseline, share has collapsed. The maintainer effectively departed; the successor is x64dbg. Modern Windows 11 and Server 2025 anti-debug techniques are not handled.

**Who Actually Uses It**

Senior engineers who learned RE on OllyDbg in the 2010s and still pull it out for 32-bit legacy binaries — old industrial control systems, old games, old malware samples. Korean and Japanese seniors sometimes use it for nostalgia. New learners should start with x64dbg.

**2026 Pricing**

Zero (freeware).

Chapter 8 · Hopper Disassembler — A Compact, Elegant Mac and Linux Choice

**Vendor and License**

Cryptic Apps, based in France. Launched in 2011. Commercial license, perpetual model.

**Strengths**

The best-integrated RE tool on macOS. Strong handling of iOS and macOS binaries (Mach-O, dyld_shared_cache). The Hopper decompiler is not as deep as IDA Pro or Ghidra, but it is fast and clean. UI is light and natively macOS — Retina, dark mode, even the Touch Bar feel right. Python and Lua scripting. Pricing is reasonable.

**Weaknesses**

No Windows support (macOS and Linux only). Decompiler depth is shallower than IDA Pro Hex-Rays. The plugin ecosystem is thinner than IDA or Ghidra. ARM64 decompilation is improving fast in the Apple Silicon era but still trails Hex-Rays.

**Who Actually Uses It**

macOS and iOS RE engineers, Apple-ecosystem security researchers, the jailbreak community. iOS researchers at Korean firms (Dream Security, Samsung Research) and Japanese mobile-security shops standardize on a Hopper plus Frida combo.

**2026 Pricing**

Personal \$129 perpetual with one year of updates. Educational \$99. Pro / Commercial \$199 perpetual with one year of updates. Update extensions are optional. Roughly one-thirtieth the cost of IDA Pro.

Chapter 9 · angr / Triton / KLEE — The Symbolic Execution Three

**angr (UC Santa Barbara, now its own foundation)**

Started in 2015 at UCSBs SecLab. Apache 2.0. A Python library that loads ELF, PE, and Mach-O binaries to recover CFGs, run symbolic execution, and perform static analysis. The core tech behind the Mayhem team at the 2016 Cyber Grand Challenge. Still the academic-and-CTF standard in 2026.

**Triton (Quarkslab, now its own maintainers)**

Started in 2015 at the French security firm Quarkslab. Apache 2.0. C++ core with Python bindings. Combines dynamic symbolic execution, taint analysis, and SMT solver integration (Z3 or Bitwuzla). Plugins exist for Binary Ninja and IDA Pro. Closer to industrial usage than angr — symbolic state on top of a live trace.

**KLEE (Stanford, now Imperial College)**

Released in 2008 by Cristian Cadar and collaborators at Stanford. NCSA license. An LLVM-based symbolic execution engine: compile C to LLVM IR and run symbolic execution against the IR. So you need source code (or a lift back to LLVM IR). The same tool that famously found bugs in dozens of GNU coreutils in the 2010s. Highest academic precision, lowest industrial ergonomics.

**When To Reach For It**

When you want to explore every possible path under arbitrary input, so you can ask "what input drives the program to that branch" — for example, the branch where a password check returns true. CTF challenges on password-validation bypasses, fuzzing supplements, automatic exploit generation. The 2026 reality is unchanged: path explosion still kills you on large programs. But for small functions, CTF challenges, and verification domains, symbolic execution is unbeatable.

**Weaknesses**

Steep learning curve. You need a working mental model of an SMT solver. Effectively unusable on full browsers or OS kernels. State explosion is the eternal enemy.

Chapter 10 · Frida — The Tool That Redefined Mobile RE

**Vendor and License**

Norwegian developer Ole Andre V. Ravnaas started the open-source project in 2013. wxWindows-style permissive license. In one line: a dynamic instrumentation toolkit where you hook functions in JavaScript.

**Strengths**

Supports Android, iOS, Windows, macOS, Linux, and QNX. Injects frida-agent into the target process and lets you hook functions, modify arguments, and rewrite return values from JavaScript. A single `Interceptor.attach(addr, { onEnter, onLeave })` line intercepts any function. Works to a reasonable degree on iOS without a jailbreak (via Corellium or rootless mode), though a jailbreak still helps. The tooling stack stacks beautifully on top: frida-tools (`frida-trace`, `frida-ps`), Objection as an automated mobile RE framework.

**Weaknesses**

It gets detected. Banking apps and game anti-cheats actively block Frida — they scan for `/data/local/tmp/frida-server`, inspect syscall patterns, and fingerprint the memory mappings Frida creates. Bypasses exist, but it is a constant arms race. Hooking large functions can have noticeable performance impact.

**Who Actually Uses It**

Mobile RE engineers, mobile app security auditors, pentesters, mobile malware analysts, and the game-RE community. Korean mobile-pentest firms (CodeCheck, SecurityFirst) and Japanese mobile-security researchers cannot operate without Frida. In iOS RE it is effectively the standard.

**2026 Pricing**

Zero.

Chapter 11 · Cheat Engine — A Living Legend of Game Memory Editing

**Vendor and License**

Dutch developer Eric "Dark Byte" Heijnen started this Windows game memory editor in 2000. Partially open source — most of the source lives on GitHub as cheat-engine/cheat-engine, with some licensing restrictions.

**Strengths**

"I want to change my gold to 1,000" becomes a one-liner: scan memory, track value changes, walk pointer chains, write a trainer — all in one GUI. Lua scripting is powerful. Unless an anti-cheat blocks it, Cheat Engine is the fastest tool for game RE. It also has a built-in debugger, which means within the game scope you can do OllyDbg-style work.

**Weaknesses**

Because of the name, antivirus engines often auto-quarantine it. Anti-cheats (VAC, BattlEye, EasyAntiCheat, Vanguard) actively block Cheat Engine — in multiplayer, using it gets your account banned. Windows only. Legality varies per game (singleplayer is usually fine, multiplayer is hard no).

**Who Actually Uses It**

Singleplayer game modders, game RE students, anti-cheat engineers studying the attacker side, and a slice of the security research community. Korean and Japanese game-security companies use it internally to understand the attacker viewpoint.

**2026 Pricing**

Zero (donations welcomed).

Chapter 12 · Wireshark — RE at the Network Level

**Vendor and License**

Gerald Combs started this in 1998 under the name Ethereal; renamed to Wireshark in 2006. GPL 2. The Wireshark Foundation is the maintainer.

**Strengths**

The de facto standard for network packet capture and analysis. Captures from Wi-Fi, Ethernet, Bluetooth, USB, and CAN bus. More than 2,000 protocol dissectors ship in-box — TLS 1.3, HTTP/3 QUIC, gRPC, MQTT, Modbus, BACnet, and on. Capture files (.pcap, .pcapng) are an industry standard. The tshark CLI variant makes automation feasible. TLS 1.3 decryption (via pre-shared keys or `SSLKEYLOGFILE`) and the HTTP/3 dissector stabilized in 2026.

**Weaknesses**

TLS decryption only works when you have the keys — that is, when the client cooperates. For mobile traffic capture, MITM proxies (mitmproxy, Burp, Charles) are often more convenient. The UI cannot quite escape its 1990s GTK feel (a Qt 6 migration is in progress as of 2025).

**Who Actually Uses It**

Network RE, malware C2 analysis, IoT protocol RE, mobile traffic analysis, embedded RE. Korean KISA and Financial Security Institute incident-response teams, and JPCERTs malware traffic analysis team in Japan, use Wireshark as a standard.

**2026 Pricing**

Zero.

Chapter 13 · The CTF Toolchain — Pwntools / Pwndbg / GEF

**Pwntools (Gallopsled)**

A Python exploit-development framework. Began circa 2013. MIT. One `from pwn import *` brings in process, remote, ELF, ROP, shellcraft, and logging. In the pwn category of CTF, this is the standard import. Korean teams like LeaveCat and KaisaHack live on it.

**Pwndbg (the pwndbg project)**

A GDB plugin. Enhances the display for exploit development — heap state, ROP gadgets, memory mappings, cached telescope output. The `heap` command visualizes glibc heap chunks. MIT-licensed. In 2026 it is one of the two major GDB plugins alongside GEF.

**GEF (GDB Enhanced Features, hugsy)**

The other major GDB plugin. Installs as a single Python file. Functionality overlaps with Pwndbg, but the single-file lightness is the point. ARM, MIPS, and PowerPC support is better than Pwndbgs. Korean and Japanese CTF scenes lean toward GEF for ARM challenges.

**The Pattern**

"GDB plus Pwndbg (or GEF) plus Pwntools" is the standard setup for CTF pwn challenges. Binary analysis in Ghidra or Binary Ninja, dynamic debugging in GDB plus Pwndbg, exploit writing in Pwntools.

from pwn import *

context.arch = 'amd64'

context.log_level = 'debug'

p = process('./vuln')

elf = ELF('./vuln')

payload = b'A' * 40

payload += p64(elf.sym['win'])

p.sendline(payload)

p.interactive()

The simplest ROP exploit: overflow a 40-byte buffer, then jump to the `win` function. Intro pwn code has barely changed from the late 2010s into 2026.

Chapter 14 · The Engine Layer — Capstone / Keystone / Unicorn / QEMU

These four are the foundation other tools sit on. Once you start doing RE, you trip over them constantly.

**Capstone (Aquynh, originally at COSEINC, now its own foundation)**

Released in 2014. BSD. A multi-architecture disassembler engine — x86, ARM, MIPS, PowerPC, SPARC, SystemZ, XCore, M68K, M680X, RISC-V, BPF, EVM, 6502. Bindings exist for Python, Java, Ruby, Go, and C#. radare2, angr, Frida, Cuckoo Sandbox, Volatility, and BAP all stand on Capstone.

**Keystone (same team)**

The complement to Capstone. Released in 2016. BSD. A multi-architecture assembler engine. If Capstone is "bytes to assembly," Keystone is "assembly to bytes." Essential for exploit payload generation and shellcode authoring.

**Unicorn (same team)**

Released in 2015. GPL 2. A multi-architecture CPU emulator. It strips out QEMUs TCG engine to emulate "not a process, not a full system, just a CPU." Frida uses it in part inside Stalker (the code tracer). angr calls into it for some operations. Useful for testing shellcode, unpacking, and unrolling VM-based obfuscation.

**QEMU (Fabrice Bellard, now its own foundation)**

Started in 1999, the de facto standard for system emulation. GPL 2. Indispensable for firmware RE — extract the ARM or MIPS firmware from an IoT device, boot it under QEMU, and attach gdbserver. Anyone who has done firmware RE once cannot live without it. Tools like FirmAE and Firmadyne are firmware-emulation automations built on top of QEMU.

**Why You Need To Know About Them**

Ghidra, Binary Ninja, angr, and Frida are great, but when their disassembly looks off, the trail usually leads back to a Capstone version or option. When shellcode encoding breaks during exploit development, you check Keystone settings. When firmware refuses to unpack, the issue is usually the QEMU machine model. These four engines are the floor of the entire RE stack.

Chapter 15 · LLM-assisted RE — Binary Ninja Sidekick / IDA Decompiler AI / GhidraMCP

The biggest shift of 2024 to 2026 is LLMs entering the RE workflow. Three directions matter.

**(a) Decompiler renaming and commenting**

The most stable LLM use case. Take a decompiler output stuffed with `sub_401000`, `v1`, `v2`, send it to an LLM, and let it infer meaningful function and variable names and inline comments. Binary Ninja Sidekick, the IDA Pro Decompiler AI plugin, and Ghidra-side projects (GhidraMCP, G-3PO, sidekick-for-ghidra) all do this. Claude 3.7 / 4, GPT-5, and Gemini 2.0 produce decent Korean and Japanese function names too.

**(b) Natural-language analysis questions**

"What does this function appear to do?" "Why isnt this branch hit?" "How does this packer come apart?" — asked in natural language, with decompiler output passed in as context. Once MCP integrations land, the LLM can call Ghidra, IDA, or Binary Ninja APIs directly to rename variables or define new functions.

**(c) Exploit and vulnerability auto-discovery**

Experimental. Stack an LLM heuristic on top of angr-style symbolic execution. As of 2026, "production-grade automated exploit discovery" does not exist. But assisting a human RE engineer is now achievable.

**Limits and Cautions**

The LLM is reasoning on top of decompiler pseudocode. If the decompilation is wrong, the LLM is more plausibly wrong. Inlined functions under heavy compiler optimization, vtable code, and obfuscation produce confident but incorrect function names. Auto-applying without verification is dangerous. The healthy pattern is "LLM proposes, human verifies."

Chapter 16 · Korea and Japan — KAIST, KISA, AIST, JPCERT, FFRI Security

**Korea — Academia, Government, Industry**

KAISTs SoftSec and SysSec labs are the academic center of RE and vulnerability research. POSTECHs and Korea Universitys security clubs (Lazy and KUICS) and Seoul National Universitys SNU CSE security labs form the talent pipeline. The CTF scene is led by KaisaHack (KAIST), LeaveCat, Cykor (Korea University), Goblins, and PLUS, regularly making DEFCON CTF and Codegate finals. On the government side, KISA (Korea Internet and Security Agency) publishes incident analyses and malware reports — Ghidra, IDA Pro, and Wireshark screenshots are the standard there. On the industry side, AhnLab (the largest Korean antivirus vendor), RAONWHITEHAT (pentest), S2W (malware analysis), and Theori (a global security consultancy with US and Korean offices) all hire RE talent. Theori is well known for stacking custom tooling on top of Binary Ninja.

**Japan — More Conservative, More Academic**

AISTs cybersecurity research center is the academic and governmental hub. JPCERT/CC is the Japanese counterpart to KISA. On the industry side, FFRI Security is the best-known RE-specialist firm — own EDR, own malware analysis, own vulnerability research. LAC, NTT-CERT, the Trend Micro Tokyo lab, and IBM Security Japan all hire RE engineers. Academic touchpoints include the Waseda SecCap program, security courses at Keio, and information security courses at the University of Tokyo. CTF teams include TokyoWesterns (a strong international team) and Sutegoma2. SECCON CTF is the largest CTF event in Japan.

**Subtle Tool Preferences**

Korean government and finance verticals still buy IDA Pro licenses where the budget exists. Students and researchers default to Ghidra. Mobile RE in both countries means Frida plus Hopper. Japan adopted x64dbg as the OllyDbg successor a beat later than Korea — senior analysts tend to keep using OllyDbg longer there. Firmware RE in both countries is moving toward radare2 plus QEMU.

Chapter 17 · Who Should Pick What — A Decision Tree

**Student / Beginner**

Ghidra plus GDB plus Pwndbg or GEF. Zero dollars and everything works. Add Pwntools once you start CTFs. Add Frida if mobile interests you. IDA Pro shows up naturally once you join a company that has it.

**CTF Player**

Ghidra for fast static analysis, Binary Ninja for per-challenge automation scripts through the API, GDB plus Pwndbg or GEF, Pwntools. Binary Ninja Personal at \$300 pays for itself if you take CTF seriously. angr occasionally solves password-bypass-style challenges like magic.

**Mobile RE (Android / iOS)**

Frida plus Objection plus Hopper (for macOS / iOS) plus Ghidra (for Android APK native and ELF). Add Burp Suite or mitmproxy. iOS pipeline: jailbroken device (or Corellium cloud) plus Hopper plus Frida. Android pipeline: jadx (Java decompiler) plus Ghidra (native libraries) plus Frida.

**Firmware / IoT RE**

radare2 plus Cutter plus QEMU plus Ghidra. Add binwalk (firmware extraction) and FirmAE or Firmadyne (auto-emulation). For serial or JTAG hardware debugging, add OpenOCD and a Saleae logic analyzer. Keep Wireshark on.

**Windows Malware Analysis**

IDA Pro if the budget exists, otherwise Ghidra, plus x64dbg plus Wireshark. ScyllaHide as an anti-anti-debug plugin. Cuckoo Sandbox or ANY.RUN as the automated environment. PE parsers like PE-bear and CFF Explorer.

**Professional RE Engineer (Government / Defense / Finance / Game Security)**

Full IDA Pro plus Hex-Rays decompiler license, with Binary Ninja as backup, Ghidra for a second opinion, x64dbg, Frida, Wireshark, and Pwntools occasionally. The company writes the \$15,000 check for the full IDA stack. Korean and Japanese government contractors treat IDA as standard.

**Security Researcher / Vulnerability Hunter**

Binary Ninja (API automation) plus Ghidra (second opinion) plus angr or Triton (symbolic) plus Frida (dynamic) plus AFL++ or libFuzzer (fuzzing) plus Pwntools (exploits). Use LLMs only as an assistant, and verify everything they produce by hand.

**The Most Common Mistake**

Believing IDA Pro alone is enough — or, the inverse, believing Ghidra is free so IDA Pro is wasted money. Real professional RE engineers install IDA, Ghidra, and Binary Ninja side by side and read the same function in all three to see which decompiler is least wrong. Decompilers are always wrong. The game is which one is less wrong.

References

- [Ghidra GitHub — National Security Agency](https://github.com/NationalSecurityAgency/ghidra)

- [Ghidra Official Site](https://ghidra-sre.org/)

- [IDA Pro — Hex-Rays SA](https://hex-rays.com/ida-pro/)

- [IDA Pro Pricing — Hex-Rays](https://hex-rays.com/buy)

- [Binary Ninja — Vector 35](https://binary.ninja/)

- [Binary Ninja Sidekick — AI assistant](https://sidekick.binary.ninja/)

- [radare2 GitHub](https://github.com/radareorg/radare2)

- [Cutter — Qt UI for radare2](https://cutter.re/)

- [x64dbg GitHub](https://github.com/x64dbg/x64dbg)

- [OllyDbg Official Site](https://www.ollydbg.de/)

- [Hopper Disassembler](https://www.hopperapp.com/)

- [angr — UCSB SecLab](https://angr.io/)

- [Triton — Quarkslab](https://triton-library.github.io/)

- [KLEE Symbolic Execution Engine](https://klee-se.org/)

- [Frida — Dynamic Instrumentation Toolkit](https://frida.re/)

- [Cheat Engine GitHub](https://github.com/cheat-engine/cheat-engine)

- [Wireshark Official Site](https://www.wireshark.org/)

- [Pwntools — Gallopsled](https://github.com/Gallopsled/pwntools)

- [Pwndbg GitHub](https://github.com/pwndbg/pwndbg)

- [GEF — GDB Enhanced Features](https://github.com/hugsy/gef)

- [Capstone Disassembler Engine](https://www.capstone-engine.org/)

- [Keystone Assembler Engine](https://www.keystone-engine.org/)

- [Unicorn CPU Emulator](https://www.unicorn-engine.org/)

- [QEMU Official Site](https://www.qemu.org/)

- [GhidraMCP — Ghidra MCP integration](https://github.com/LaurieWired/GhidraMCP)

- [KAIST SoftSec Lab](https://softsec.kaist.ac.kr/)

- [KISA — Korea Internet & Security Agency](https://www.kisa.or.kr/)

- [JPCERT/CC](https://www.jpcert.or.jp/)

- [FFRI Security](https://www.ffri.jp/)

- [SECCON CTF Japan](https://www.seccon.jp/)

- [Codegate CTF Korea](https://www.codegate.org/)