Decompilers for CTF Reversing
Compare and use Ghidra, IDA Free, Binary Ninja, and specialized decompilers for CTF reversing.
Decompilers for CTF Reversing
A decompiler reconstructs high-level C-like pseudocode from compiled machine code. Instead of reading raw assembly, you get readable if/while/for structures with variable names. For CTF reversing, decompilers are your primary tool — they transform unreadable bytes into logic you can understand and reverse.
The key skill isn't using the decompiler — it's reading the decompiled output and understanding what the program does.
Choosing the Right Decompiler
Native Binary Decompilers
# Download: https://ghidra-sre.org/
# Requires JDK 17+
./ghidraRunStrengths: Free and open source. Excellent decompiler that competes with IDA. Handles x86, ARM, MIPS, PPC, SPARC. Strong Python/Java scripting.
Ghidra is the recommended primary decompiler for CTF. It's free, handles virtually every architecture, and its decompilation quality matches IDA Pro.
Managed Language Decompilers
# ILSpy (cross-platform, open source)
dotnet tool install ilspycmd -g
ilspycmd suspicious.exe
# dnSpy (Windows, excellent for debugging too)
# Download: https://github.com/dnSpy/dnSpy.NET decompilation is near-perfect — often gives original C# source. dnSpy even lets you set breakpoints at the C# source level. Note: the original dnSpy repository is archived; prefer ILSpy or maintained forks.
Workflow: Choosing the Right Tool
| Binary type | What to use |
|---|---|
| ELF (Linux) or PE (Windows) | Ghidra first; cross-check with IDA Free if unsure |
| .NET / C# | ILSpy or dnSpy (near-original C#) |
| Java / Kotlin | jadx |
| Android APK | jadx / jadx-gui |
Python .pyc | decompile3 or pycdc |
WebAssembly .wasm | See WASM reversing |
Tips for Better Decompilation
Let Ghidra Fully Analyze
Wait for the task bar to complete before browsing. Ghidra's analysis improves significantly after all passes finish.
Rename Variables as You Go
Use L in Ghidra, N in IDA. Rename param_1 → user_input, local_20 → xor_key. Good names make the algorithm obvious.
Retype Variables
Correct types to match context (Ctrl+L in Ghidra). Changing a variable from int to char * can dramatically improve decompiler output.
Use XREFs
Cross References (X in Ghidra/IDA) show where functions are called. Start from interesting strings → find functions that use them → trace the logic.
Check Defined Strings First
Window → Defined Strings often shows the flag directly, or string constants like "Correct!" that lead you straight to the check function.
Compare Decompilers
If one gives nonsense, cross-check with another (e.g., Ghidra + IDA). Different decompilers handle edge cases differently.
Ghidra Navigation Shortcuts
Checklist
- What type of binary? (ELF, PE, .NET, Java, Python)
- Not .NET/Java/Python → Ghidra first
- .NET → ILSpy or dnSpy
- Java/APK → jadx
- Python .pyc → decompile3
- Check Defined Strings immediately
- Navigate to main/entry function
- Rename variables to make code readable
- Cross-check with second decompiler if confused
Last updated on