Cutter vs Ghidra

Cutter is a free, open-source reverse-engineering platform for Linux, macOS, and Windows. Its Qt and C++ interface is powered by Rizin, and releases integrate the native Ghidra decompiler without Java. Other decompiler plugin options include RetDec and JSDec; Cutter developers officially maintain RzGhidra. For navigation, it provides a full graph view and a mini-graph, while its hex view can display and modify files. A Python scripting engine supports task automation, and plugins can be written in C++ or Python. Cutter also includes emulation for automation, cryptographic algorithms, and malware analysis. Its native and remote debugger supports dynamic analysis and is marked beta. Supported architectures include 6502, ARM, AVR, Dalvik, Game Boy, Java bytecode, and many others. Cutter is licensed under GPLv3, with official downloads for all three listed operating systems. Developer and community contact options include Telegram, IRC, and Twitter.

Ghidra is a software reverse engineering framework maintained by the NSA Research Directorate. It analyzes compiled code with tools for disassembly, assembly, decompilation, graphing and scripting, and supports many processor instruction sets and executable formats. The framework can operate interactively or in automated workflows, including work intended to address team and scale needs in complex reverse engineering. Users can write extensions and scripts in Java or Python. Development options include a GhidraDev plugin for Eclipse and support for script editing and module projects in Visual Studio Code. The project describes compiled-code analysis on Windows, macOS and Linux. Installation requires a 64-bit JDK 25 and an official multi-platform release archive. Ghidra is free under the Apache License, Version 2.0, whose terms grant no-charge, royalty-free copyright and patent licenses. The repository warns that some versions have known security vulnerabilities and directs users to security advisories. Its policy directs vulnerability reports to GitHub private vulnerability reporting rather than public issues.