Tool List

NSA-developed disassembler and decompiler. Free, full-featured, and the closest thing the free-tool world has to an IDA Pro replacement — this course's screenshots and workflow assume Ghidra.

The free edition of the industry-standard disassembler. No decompiler and 32-bit x86 only in the free tier, but the analysis engine and UI are the real thing.

Commercial disassembler with a clean decompiler and a genuinely good Python API for automating analysis. Has a limited free cloud tier for quick one-off lookups.

A proper GUI on top of the rizin/radare2 engine, with an optional Ghidra-decompiler plugin. Good middle ground if r2's command line isn't for you.

Free, CLI-first reverse engineering framework. Extremely scriptable and fast once you've climbed the (steep) learning curve on its command syntax.

Free, open-source user-mode debugger for Windows PE binaries. The standard free alternative to OllyDbg for x86/x64 — this course's debugging labs are written around it.

Microsoft's own debugger — user-mode and kernel-mode, plus crash-dump analysis. Install via the Microsoft Store. Steeper command syntax than x64dbg, but it's the only option for driver/kernel work.

The standard debugger on Linux/Unix. Command-line only by default (pair it with gdb-dashboard, pwndbg, or GEF for a usable register/memory view).

The LLVM project's debugger, and the default on macOS (it's what Xcode uses under the hood). GDB-compatible command aliases are available.

Fast, focused PE header/section/import-table viewer and editor. The quickest way to eyeball a PE's structure without opening a full disassembler.

Part of the Explorer Suite. A veteran, still-solid PE editor — inspect and directly patch header fields, sections, resources, and imports.

Signature-based packer, compiler, and language detector, plus a built-in entropy view. Your first move on an unknown sample — exactly the workflow lab-16 and lab-22 teach.

Modern, free hex editor with a pattern-language for parsing structured binary formats (write a PE-header template once, reuse it on every sample).

Lightweight, no-frills Windows hex editor. No scripting or templates — just fast, reliable byte-level viewing and editing.

Commercial hex editor built around "binary templates" — parse a file format once as a C-like struct and get an instant structured view of every sample.

Microsoft's official toolset: Process Explorer, Process Monitor (Procmon), Autoruns, TCPView, and more. Procmon's file/registry/network trace is the backbone of any Windows dynamic-analysis workflow.

The actively-maintained continuation of Process Hacker — a Task Manager replacement that shows loaded modules, handles, and memory regions per process.

Hooks and logs Win32 API calls from a running process in real time, with arguments and return values — a dynamic complement to statically reading the import table.

The standard network packet analyzer. Essential once a sample starts talking to a C2 server — capture and inspect the traffic directly.

Dynamic instrumentation toolkit — inject JavaScript to hook and rewrite function behavior in a running process, across desktop and mobile.

Mandiant's FLARE team tool for automatically extracting obfuscated strings (stack strings, XOR/tight-loop-decoded strings) that plain `strings` output misses entirely.

Automatically identifies a binary's capabilities (persistence, injection, C2, anti-debug...) from its code, and maps each finding to MITRE ATT&CK — a fast first-pass triage report.

The industry-standard pattern-matching engine for writing and sharing detection rules — turn what you found in a sample into a signature that flags the next one.

A scripted installer that turns a clean Windows VM into a fully-loaded malware-analysis box — most of the tools on this page, installed and configured in one pass.

A Linux distribution pre-loaded with tools for analyzing malicious documents, scripts, and network traffic — the Linux-side counterpart to FLARE-VM.