Reverse Engineering Platforms: IDA, Ghidra, and Cutter

• Reverse Engineering Platforms: IDA, Ghidra, and Cutter
  • What an RE Platform Does
  • The Three Platforms at a Glance
  • Installation and Licensing
    • IDA Classroom
    • Ghidra
    • Cutter
  • The Concepts You Need First
    • Loaders and Base Addresses
    • Auto-Analysis
    • Disassembly Views: Linear vs. Graph
    • Decompilers
    • Cross-References (XRefs)
    • Renaming and Commenting
    • The Database / Project
  • Getting Started with IDA
    • Loading a File
    • The Interface
    • Navigation
    • Annotation
    • Decompiler
  • Getting Started with Ghidra
    • Creating a Project
    • Importing and Analyzing
    • The CodeBrowser
    • Navigation
    • Annotation
    • Decompiler Workflow
    • Multi-Binary Projects
  • Getting Started with Cutter
    • Loading a File
    • The Interface
    • Navigation
    • Annotation
    • The Rizin Console
    • Decompiler Selection
  • Side-by-Side: Common Operations
  • A Suggested First-Binary Workflow
  • Scripting and Automation
  • Choosing a Tool
  • Troubleshooting
  • Further Reading
    • Official documentation
    • Books
    • Community writeups
    • Source repositories

This page introduces the three reverse engineering (RE) platforms used in this course: IDA Classroom (Hex-Rays), Ghidra (NSA), and Cutter (the Rizin-based GUI). It assumes you are already comfortable reading x86 assembly and have worked through basic malware triage — extracting strings, checking imports, examining PE headers, and running file/hash/entropy checks. This page picks up where triage ends: you have an interesting binary, and now you need to understand what it actually does.

All three tools attempt to solve the same core problem — turn a binary back into something a human can reason about — and they share most of the same vocabulary. Once you know how to navigate one, the other two feel familiar. The differences show up in cost, licensing, decompiler quality, debugger integration, and scripting ecosystems.

What an RE Platform Does

A reverse engineering platform is a workbench for static binary analysis. Every one of these tools does the following things, just with different names and hotkeys:

1. Loader — parses the executable format (PE, ELF, Mach-O, raw binary, firmware image) and maps sections into a virtual address space the same way the OS loader would.
2. Disassembler — converts machine code into assembly, identifies function boundaries, and recovers stack frames and parameter layouts.
3. Cross-referencer — builds a bidirectional index of “who calls this function,” “who reads this string,” and “where does this jump come from.” This is the single most important feature for analysis work; you will use it constantly.
4. Decompiler — translates assembly into C-like pseudocode. All three tools now have a decompiler, though their quality and availability differ.
5. Database — stores your annotations (renames, comments, type information, structure definitions) so your analysis survives closing the program.
6. Scripting / plugin interface — lets you automate repetitive tasks and build on top of the platform.

The workflow is the same everywhere: load → auto-analyze → navigate from known starting points (imports, strings, entry point) → rename and comment as you understand code → iterate until the behavior is clear.

The Three Platforms at a Glance

The one-sentence summary: IDA is the industry reference with the polished UI and the best signature database; Ghidra has the best decompiler and scales to multi-binary projects; Cutter is the lightweight Rizin-backed option that lets you drop to a command-line console whenever the GUI gets in the way.

Installation and Licensing

IDA Classroom

See the IDA Classroom installation page. Each student receives a pre-activated license registered to their PSU email; download the .hexlic file from the My Hex-Rays portal and place it in the install directory or home folder.

Ghidra

Download a pre-built release from the Ghidra GitHub releases page. Requires JDK 21 (64-bit). Extract the archive and launch:

# Linux / macOS
./ghidraRun

# Windows
ghidraRun.bat

On REMnux, Ghidra is pre-installed; just type ghidra at the shell.

Cutter

Download from the Cutter releases page. Platform packages:

• macOS: .dmg
• Windows: .zip (portable) or .msi
• Linux: .AppImage

chmod +x Cutter-v*-x86_64.AppImage
./Cutter-v*-x86_64.AppImage

Cutter bundles Rizin; no separate installation required. REMnux ships with Cutter as well.

The Concepts You Need First

Before walking through each tool, here are the concepts that show up in all three. Learn them once and the platform-specific terminology follows.

Loaders and Base Addresses

When a platform loads a binary, it parses the container format and lays the sections out in virtual memory exactly as the OS loader would. This is why the addresses you see (0x00401000, 0x10001757) match what you’d see at runtime in a debugger. Malware frequently appends shellcode or encrypted blobs after the normal PE sections; the loader won’t include these by default. All three platforms offer a “raw binary” or “manual load” option to force every byte into the analysis view.

Auto-Analysis

After loading, each tool runs an analysis pass that starts at the entry point, follows control flow through call/jmp/jcc instructions, marks function boundaries, recovers stack frames, and identifies strings and data. This takes anywhere from a few seconds (small EXEs) to several minutes (statically linked binaries). Let auto-analysis finish before you start working — navigating into unanalyzed regions will confuse you.

Disassembly Views: Linear vs. Graph

• Linear (text) view — instructions shown sequentially by address, the way they sit in the file. Good for seeing data interspersed with code, inspecting jump tables, or scanning long basic blocks.
• Graph view — each function rendered as a flowchart of basic blocks connected by control-flow edges. Good for understanding conditionals, loops, and switch structures at a glance.

In all three tools, edge color conveys branch semantics (taken/not-taken/unconditional). Upward-pointing edges are loops.

Decompilers

A decompiler lifts assembly into C-like pseudocode. This is not the original source — variable names are synthesized, control-flow may be restructured, and types are guessed from usage — but it is dramatically easier to read than assembly for most functions. The three tools handle decompilation differently:

• IDA Classroom ships cloud-based decompilation for x86, x86-64, ARM-32, and ARM-64.
• Ghidra has a native decompiler widely considered the strongest free option; it recovers C++ classes and handles unusual calling conventions well.
• Cutter can use jsdec (built in, approximate) or delegate to the Ghidra decompiler via the rz-ghidra plugin (same engine as Ghidra proper).

Workflow tip: read the decompiler output first to form a hypothesis, then drop to assembly to verify the details. Don’t trust the decompiler blindly — optimized or obfuscated code produces misleading pseudocode.

Cross-References (XRefs)

Every tool tracks two categories:

• Code xrefs — who calls this function, who jumps here
• Data xrefs — who reads this string, who writes this global

Cross-references are how you move through a binary productively. You find an interesting API call in Imports → follow its xrefs to see every caller → rename the caller based on what it’s doing → follow its xrefs, and so on.

Renaming and Commenting

Auto-generated names like sub_401000, FUN_00401000, fcn.00401000, var_8, and arg_4 tell you nothing. As soon as you understand what a function or variable does, rename it. All three tools propagate the new name to every reference. Add comments for the why (non-obvious constraints, observed behavior, references to external documentation) rather than the what (which the code already says).

The Database / Project

Your analysis is saved in a per-binary database:

• IDA: .idb (32-bit) or .i64 (64-bit)
• Ghidra: inside the project directory, a .gpr file plus storage
• Cutter: .rzdb Rizin project file

Save often. None of these tools have a crash recovery model as reliable as modern IDEs, and large malware samples can provoke interesting bugs.

Getting Started with IDA

Loading a File

Drag the binary onto IDA or use File → Open. IDA’s loader dialog asks you to confirm the file format, processor, and loading options. Accepting defaults works for almost all PE/ELF malware; the two options worth knowing are:

• Binary File — forces IDA to treat the input as raw bytes (no PE parsing). Use this when analyzing shellcode dumps or firmware.
• Manual Load — lets you load each PE section including the PE header itself, which malware sometimes abuses to hide code.

Let auto-analysis complete before doing anything else (the progress bar at the bottom).

The Interface

The main window is the disassembly view, which opens in graph mode by default. Press Space to toggle between graph and text (linear) modes.

Subviews you will use constantly, found under View → Open Subviews:

• Functions — all recognized functions; L flag marks library functions identified by FLIRT (skip these)
• Imports — every API the binary calls; usually the first thing to check
• Exports — only relevant for DLLs
• Strings — ASCII and Unicode strings longer than 5 characters by default
• Names — every named location (functions, labels, globals)
• Structures — define or import struct layouts to improve readability

At the bottom of the toolbar is the navigation band, a color-coded map of the binary’s address space. Dark blue is user-written code — focus your analysis there.

Navigation

Annotation

The M shortcut is especially useful when you see push 80000000h — pressing M lets you replace the literal with GENERIC_READ, instantly revealing that the nearby call is CreateFile.

Decompiler

Press F5 on any function to open the Pseudocode view in a new tab. Renames and type edits in the pseudocode propagate to the disassembly view and vice versa. Right-click a variable → Set lvar type to apply a C type; this often cleans up casts and reveals structure access.

Getting Started with Ghidra

Creating a Project

Ghidra organizes work into projects, which hold one or more binaries plus your annotations. On first launch, create a project via File → New Project → Non-Shared Project, pick a directory, and name it. Projects persist across sessions; you can import many binaries into the same project and cross-reference between them (useful for malware families with multiple components).

Importing and Analyzing

Drag a binary into the project window, or use File → Import File. Ghidra auto-detects the format and opens an import dialog; the defaults are almost always correct. Once imported, double-click the binary to open it in the CodeBrowser, then say Yes to the auto-analyze prompt. The default analysis options are reasonable; for malware, leave Decompiler Parameter ID and Stack enabled.

The CodeBrowser

The CodeBrowser is Ghidra’s main analysis environment. The default layout shows:

• Listing (center) — the disassembly, similar to IDA’s text mode. Ghidra does not have a separate “graph mode” by default; graphs open in a separate window.
• Decompiler (right) — live C-like pseudocode for the current function. Click anywhere in the decompiler and the listing cursor follows; click in the listing and the decompiler highlights the matching line. This bidirectional linking is Ghidra’s signature feature.
• Symbol Tree (left) — organized view of Imports, Exports, Functions, Labels, Classes, and Namespaces. Expand Imports first when analyzing malware.
• Data Type Manager (lower left) — all known types; drag a struct onto a variable to apply it.
• Program Tree (upper left, tab) — view by section (.text, .data, etc.)
• Console (bottom) — script output and messages.

Opening the Function Graph (Window → Function Graph, or the icon in the toolbar) gives you a graph view equivalent to IDA’s graph mode.

Navigation

Annotation

Ghidra’s comment system offers five distinct types (EOL, Plate, Pre, Post, Repeatable), all reachable from the single ; dialog. Use plate comments to mark section headers (“— Decryption routine —”) and EOL comments for inline notes.

Decompiler Workflow

The decompiler is where you spend most of your time in Ghidra. Key operations:

• Rename variable — right-click in decompiler → Rename Variable (or press L). Propagates everywhere.
• Retype variable — right-click → Retype Variable. Change undefined4 to int, or apply a struct pointer.
• Edit function signature — right-click the function name at the top → Edit Function Signature. Fix parameter counts and types here first; correct types propagate through all callers.
• Highlight — click a variable; every use in the current function highlights. Click an if-condition; the corresponding compare-and-branch highlights in the listing.

Multi-Binary Projects

Ghidra’s killer feature for malware work is multi-binary projects. Import a dropper, its second-stage payload, and any dropped DLLs into the same project. You can cross-reference symbols across binaries and use Version Tracking (Tools → Version Tracking) to compare variants of the same family.

Getting Started with Cutter

Loading a File

Launch Cutter and pick Open File. The load dialog shows detected architecture, bits, OS, and base address — usually correct. For shellcode or firmware, toggle Load in write mode, Load bin info, and Use virtual addressing as needed. Click Ok and Cutter runs Rizin’s auto-analysis (aaa under the hood).

The Interface

Cutter’s UI is fully dockable: every panel (widget) can be dragged, detached, or closed. The default layout includes:

• Disassembly — main code view; press Space to toggle between linear and graph.
• Decompiler — select between jsdec (Rizin’s built-in, lightweight) and Ghidra (via rz-ghidra) in the view selector. Use Ghidra for anything non-trivial.
• Functions — searchable function list with offsets, sizes, and xref counts.
• Imports / Exports / Strings / Symbols — standard triage pivots.
• Graph Overview — miniature control-flow graph of the current function.
• Hexdump — byte-level view with computed hashes (MD5, SHA1, SHA256, CRC32) and format conversion to C, Python, JSON.
• Console — direct Rizin command line; anything the GUI can’t do, Rizin commands can.

Close unused panels via Windows → [panel name] and save your preferred layout with Windows → Save Layout.

Navigation

Annotation

The Rizin Console

The console at the bottom exposes the full Rizin command surface. A few commands worth knowing:

Rizin uses an operation-on-what @ where syntax. pdf @ 0x401000 prints function disassembly at 0x401000. This is Cutter’s escape hatch when the GUI doesn’t expose what you need.

Decompiler Selection

Switch decompiler engines via the dropdown in the Decompiler panel header:

• jsdec — fast, JavaScript-based, approximate. Fine for small functions.
• rz-ghidra (Ghidra) — the real Ghidra decompiler. Slower on first run (loads language definitions) but produces output comparable to Ghidra itself.

For serious analysis, always use the Ghidra backend.

Side-by-Side: Common Operations

A Suggested First-Binary Workflow

This workflow applies to all three tools. The specifics of how you do each step are covered above.

1. Triage recap: before loading anything, you should already know the file’s hash, architecture, import table highlights, and any obvious strings. If you don’t, go back to triage.
2. Load and let auto-analysis finish. Don’t touch anything until the progress bar clears.
3. Scan Imports. Flag network APIs (WSAStartup, connect, HttpSendRequest), process manipulation (CreateProcess, WriteProcessMemory, CreateRemoteThread), persistence (RegSetValue, CreateService), crypto (CryptEncrypt, BCryptEncrypt), and file I/O (CreateFile, WriteFile).
4. Scan Strings. Look for URLs, file paths, registry keys, mutex names, user-agent strings, ransom notes, and error messages. Double-click interesting strings to jump to the code that uses them.
5. Find main (or WinMain, or DllMain). Start from the entry point and follow calls.
6. Decompile each called function. Rename as you identify behavior: sub_401200 becomes resolve_c2_domain; FUN_00402000 becomes build_rc4_key.
7. Follow xrefs from imports you flagged in step 3. If CreateProcessA is only called in one place, you want to read that function first.
8. Save frequently.
9. When stuck, toggle views. If the decompiler output is confusing, read the assembly. If the assembly is too tedious, check the decompiler. If both are confusing, look at the graph — the shape of the control flow sometimes reveals the construct (loop, switch, error handling) faster than either text view.

Scripting and Automation

All three platforms expose their analysis database through scripting APIs. You don’t need these for basic analysis, but they become essential once you start dealing with obfuscated or packed samples.

For classroom exercises, IDAPython scripts are usually the most approachable. Ghidra’s Script Manager (Window → Script Manager) ships with hundreds of example scripts that demonstrate the API.

Choosing a Tool

You will use all three in this course. In practice, working analysts tend to settle on a primary tool and use others as needed:

• Start with IDA Classroom for in-class exercises; its graph view and documentation are the most polished, and the Hex-Rays decompiler is strong for x86/x64.
• Reach for Ghidra when you need a better decompiler, when analyzing a multi-binary family, when you want multi-user collaboration via Ghidra Server, or when working on a non-x86 architecture the Classroom license doesn’t cover.
• Reach for Cutter when you want the Rizin command line alongside a GUI, when working on ARM/MIPS/RISC-V firmware, or when you want a lightweight tool that starts in under a second.

You’ll develop strong opinions about which one feels right; they’re all correct opinions. What matters is that you can navigate any binary handed to you in any of the three.

Troubleshooting

Further Reading

Official documentation

• Hex-Rays IDA documentation — Basic Usage, Graph View, Cross-References, Subviews
• IDA Pro Basic Usage
• IDA Graph View reference
• Ghidra on GitHub — official source, releases, and security advisories
• Introduction to Ghidra Student Guide — NSA’s own class material, best free Ghidra tutorial
• Cutter documentation — official user and developer docs
• Rizin documentation — the command reference for Cutter’s console
• Igor’s Tip of the Week — Cross-references (Hex-Rays blog)

Books

• Practical Malware Analysis (Sikorski & Honig, No Starch Press, 2012) — chapter 5 covers IDA in depth; see Advanced Static Analysis summary.
• The IDA Pro Book, 2nd Edition (Chris Eagle, No Starch Press, 2011) — the definitive IDA reference.
• The Ghidra Book (Chris Eagle & Kara Nance, No Starch Press, 2020) — the Ghidra counterpart.

Community writeups

• Intro to Cutter — GoggleHeadedHacker
• How to Use Ghidra to Reverse Engineer Malware — Varonis
• Ghidra vs. IDA Pro — hackmag
• Comparison of Reverse-Engineering Tools — reHex Ninja
• Get started with the Ghidra reverse-engineering framework — TechTarget

Source repositories

• NationalSecurityAgency/ghidra
• rizinorg/cutter
• rizinorg/rizin
• rizinorg/rz-ghidra — the Ghidra decompiler integration used by Cutter