CFR vs Vivisect

CFR is a free Java decompiler that reconstructs Java source from Java class files. It can process individual named classes, classes found on a classpath, or a whole JAR, and the command-line tool can place output in a chosen directory with the --outputdir option. Decompilation behavior can be adjusted through command-line options or an options file. The maker says CFR handles many features from Java 9, 12, and 14, and it can attempt class files from other JVM languages; those are rendered as Java rather than their original language. CFR is written in Java 6 and is said to run wherever Java 6 does. It is available as a downloadable JAR, through Maven, and from GitHub. The FAQ notes an API from version 0.135, and the project repository identifies the license as MIT. CFR handles bytecode rather than native code. Its maker also notes that some inputs fall into edge cases where output may be poor. There are no paid plans or usage limits stated.

Vivisect is a free, Apache-2.0 static analysis platform for binaries, with the related Vdb tool providing cross-platform debugging. Its pure-Python tools perform static and dynamic analysis, including built-in static and symbolic analysis, in a hybrid workflow. Analysis can run through an extensible UI, scripts, an API, or headlessly; command-line bulk processing can save a .viv workspace. Distributed analysis is available through cobra. Vivisect runs on Linux, macOS, and Windows, and lists i386, amd64, ARMv7, Thumb16, Thumb, AArch64, MSP430, and H8 architectures. Python 3.6 and newer are supported and installation is available through pip. The gui extra adds PyQt5 dependencies. Workspaces can be shared between instances or served over a network or localhost, with connected updates propagating as events arrive. Vdb can attach by process ID or command-line substring, or start and attach to a process.