My Master’s graduate research paper for my Cybersecurity program at California State University-Dominguez Hills.
ABSTRACT
Cyber threats and malware continued to increase in complexity which further emphasizes the lack of well trained individuals with proper knowledge or tools for software reverse engineering (SRE). Despite the crucial role SRE plays in vulnerability discovery, malware analysis, and program repair, a large knowledge gap exists regarding the tools and concepts of decompilation. This paper aims to narrow this gap by providing a foundational understanding of decompilation and conducting a comparative review of the three most popular SRE frameworks: IDA Pro, Ghidra, and Binary Ninja. The frameworks are assessed on three core criteria: History/Maturity, Unique Features, and Cost. In review, it reveals that IDA Pro with its maturity and powerful add-ons makes the most comprehensive package despite its high financial barrier of entry. Ghidra in its fully featured, open source version provides a complete package with a wide range of community support and resources. Binary Ninja provides modern features with AI integration and embedded reverse engineering at a fractional cost in comparison to IDA Pro. A feature comparison chart was created to provide a clear reference for selecting the optimal SRE framework based on specific operational needs and budget constraints.
Full Paper Below:
Programs Used: Ghidra, Binary Ninja, IDA Pro