My favourite disassember is radare2, I’ve mainly used this for reverse engineering and a little bit for pwning. Besides radare2, I’ve worked with the following programs in varying degrees: ollydbg, x64dbg, IDA Pro, Binary Ninja(the trial version), gdb and a few others. Let me point out why I especially like radare2:
It is a commandline tool. The advantage of this is that it allows you to quickly display important information. For instance, in debugging mode, the registers can be shown quickly with the “dr” command, instead of going through a few GUI views. Furthermore, there are no distracting views with redundant information; everything you want to know can easily be requested with a few keystrokes. Besides efficiency, there may be situations where using a GUI is not an option, for instance on a headless server. Lastly, it allows you to work soley with the keyboard and makes you look like a hacker
Very efficient commands: As hinted earlier with the ‘‘dr’’ command, almost all commands are short and follow a command hierarchy. The commands are usually composed of a few letters such as ‘‘pxw’’. Here the first letter ‘‘p’’ means print, this includes all printing commands. The second letter is to further specify the exact printing command; in this case the ‘‘x’’ indicates print in hex. The next letter again further specifies the print command to print the hexadecimals as 32 bits words. At any point in the command, the question mark can be inserted to show all possible options. For instance, the ‘‘p?’’ command can be used to show all possible printing commands. In this way, radare2 is to a large extend self documented, although there are options that can be hard to find in the hierarchy.
File formats and architectures: One of the cool things of radare2 is that it supports a large number of different computer architectures and file formats to disassemble. With radare2 it is, for instance, possible to open files for the SNES, Nintendo 3DS firmware, Web Assembly, brainfuck and all other sorts of cool architectures. I believe that there are no other disassemblers that provide the same number of options regarding this aspect.
Opensource: Ofcourse, it is always nice to have an opensource tool, what else do I need to say here
A few disadvantages:
- A common critique is the steep learning curve of radare2; this I will not deny. I think learning radare2 can be compared with learning vim, at the start it is frustrating as it is hard to figure out how to perform even the most simple operations such as writing or even exiting the file. Eventually, you will start to appreciate the elegance of vim and radare2 once you are over the initial struggles, at least that is how I look at both programs.
- With radare, you can get lost if a program has very complex logic. It may be nice to use a disassembler with a GUI to have a better overview of the program in these cases.
There are probably more advantages and disadvantages that I forgot to include. Please, let me know if you have anything to add or disagree with me; that is, of course, also fine.