Frida vs RetDec

Frida is a dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers. It lets users place scripts in running processes to hook functions, inspect APIs, and trace application code without source code. Documented uses include API tracing, diagnostics, encrypted-protocol analysis, and black-box testing.

Frida supports injected, embedded, and preloaded instrumentation. When injection is unavailable, Frida Gadget can be embedded in a program, including on jailed iOS and Android systems. Supported targets include Windows, macOS, GNU/Linux, iOS, watchOS, tvOS, Android, FreeBSD, and QNX. Language bindings include Node.js, Python, Swift, .NET, Qt/Qml, and Go, alongside a C API. The CLI tools require Python and run on Windows, macOS, or GNU/Linux; the documented installation command is `pip install frida-tools`.

RetDec is a free machine-code decompiler based on LLVM that reconstructs functions, types, and higher-level constructs as C or a Python-like language. It supports ELF, PE, Mach-O, COFF, AR archives, Intel HEX, and raw machine code, plus 32-bit Intel x86, ARM, MIPS, PIC32, and PowerPC, and 64-bit x86-64 and ARM64. Analysis includes static executable inspection, compiler and packer detection, and loading and instruction decoding. RetDec can use DWARF and PDB debugging information, reconstruct C++ class hierarchies from RTTI and vtables, and demangle GCC, MSVC, and Borland symbols. An integrated disassembler can generate call graphs, control-flow graphs, and statistics. It can be downloaded as a pre-built package, built from source, or run in Docker; related repositories provide IDA and Radare2 plugins. The project lists Windows 7 or later, Linux, and macOS, with experimental FreeBSD support. Installation requires about 5 to 6 GB of free disk space. The project says development is very limited, with issue responses potentially delayed up to one quarter.