The Difference Between Decompilers, Disassemblers, Debuggers, and Hex Editors

For people looking to get into reverse engineering, the barrier to entry can be fairly steep—starting with the terminology. Here are the differences between a few key tools of the trade.

Decompilers reverse binaries into higher-level languages, like C++.
Disassemblers reverse binaries into assembler language.
Debuggers allow you to view and change the state of a running program.
Hex Editors allow you to view and edit the source code of a binary.

Another set of things to know is the different kinds of programming languages. Here they are—from low to high levels of abstraction from the CPU.

Modern languages like Python and Ruby are considered high-level languages, but are functionally a level above.

Machine Code is the 1’s and 0’s executed by a CPU.
Assembler is the next level up, and is the first human-readable level, but just barely.
High-level—also called Compiled—languages include C and C++, and they’re the first level of functionally readable code.
Interpreted Languages are languages like Perl, PHP, Python, and Ruby, which require an environment to run them, trade readability for speed.
Bytecode Languages are languages like Java and .NET, which are cross-platform like Interpreted languages, but with similar readability and speed to compiled languages.


Summary


To go from binary to assembler, use a disassembler.
To go from binary to higher lanugage, use a decompiler.
To edit a particular part of a binary’s contents, use a hex editor.
To interact with an application as it’s running, use a debugger.

—

I spend between 5 and 20 hours creating this content every week. If you're someone who can afford fancy coffee, please consider becoming a member for just $5/month…

Start Membership

Thank you,

Daniel