CFR vs Rizin

CFR is a free Java decompiler that reconstructs Java source from Java class files. It can process individual named classes, classes found on a classpath, or a whole JAR, and the command-line tool can place output in a chosen directory with the --outputdir option. Decompilation behavior can be adjusted through command-line options or an options file. The maker says CFR handles many features from Java 9, 12, and 14, and it can attempt class files from other JVM languages; those are rendered as Java rather than their original language. CFR is written in Java 6 and is said to run wherever Java 6 does. It is available as a downloadable JAR, through Maven, and from GitHub. The FAQ notes an API from version 0.135, and the project repository identifies the license as MIT. CFR handles bytecode rather than native code. Its maker also notes that some inputs fall into edge cases where output may be poor. There are no paid plans or usage limits stated.

Rizin is a free, open-source framework for reverse engineering and binary analysis. Its tools include a disassembler, hexadecimal editor, debugger, binary inspection, emulation, and binary diffing. Command-line utilities support analyzing, disassembling, patching, comparing, searching, replacing, and visualizing data. Users can write scripts in languages including Python, Haskell, OCaml, and JavaScript. Cutter is Rizin’s official graphical interface and uses Rizin as its backend. The framework supports plugins, which rz-pm can compile and install; the package manager is described as early in development. Rizin can match unnamed functions against FLIRT signatures from sigdb to help identify common code in stripped binaries. The project also lists decompilation, firmware analysis, hybrid analysis, and a plugin API. Installation routes are provided for Linux, Windows, macOS, OpenBSD, and Android. The project says its work is currently in beta, and community discussion and support are available through Mattermost, Telegram, and IRC.