RE Toolkit (2/5): the free desktop kit — Detect It Easy, ImHex, x64dbg, Cutter, ILSpy

Ghidra and IDA are the main operating theatre, but day-to-day reverse engineering also needs a smaller kit: identify a file before opening it, read raw bytes with structure, debug on Windows, and decompile .NET. Part 2 of the RE Toolkit series gathers the six free, open-source repos the community uses most for those jobs, plus a sensible order to use them in.

GitHub: https://github.com/WerWolv/ImHex · about 55.8k stars · C++ · GPL-2.0

The kit and what each tool does

Step 1: identify with Detect It Easy

Before opening anything, ask: what file is this, what built it, is it packed? DiE answers with a signature database plus heuristic modules written in JavaScript (DiE-JS), without executing the file. The console build diec is handy for scripts:

diec sample.exe

A result like "UPX" or ".NET + obfuscator" decides the next step: unpack first, or go straight to ILSpy instead of Ghidra. The README warns that detectiteasy.com is not the official site; download only from GitHub Releases.

Step 2: read structured bytes with ImHex

For unknown file formats, save games, packets or firmware headers, ImHex goes far beyond a plain hex editor thanks to its pattern language: describe the layout C-style and ImHex colours and splits the fields on the live data.

struct Header {
    char magic[4];
    u32  version;
    u32  entry_count;
};
Header header @ 0x00;

Add the data inspector (read a byte range as int, float, timestamp…), search, file diffing and entropy graphs to spot compressed or encrypted regions. On macOS, brew install --cask imhex.

Step 3: pick the analysis tool

Native Windows code: x64dbg

x64dbg (with x32dbg for 32-bit) is the most widely used free debugger for dynamic analysis on Windows: conditional breakpoints, tracing, memory patching, and bundled Scylla to rebuild the import table after a dump. The ScyllaHide plugin defeats common anti-debug checks.

Cross-platform and free: Cutter + rizin

Cutter is the GUI for rizin (a radare2 fork), with control-flow graphs, a debug mode and a Ghidra-based decompiler shipped in its releases. Good when you want something lighter than Ghidra or prefer scripting with rizin commands:

rizin -A ./binary      # open and analyse
afl                    # list functions
pdf @ main             # print disassembly of main

.NET: ILSpy and dnSpyEx

.NET apps keep rich metadata, so they decompile almost back to the original C#. Use ILSpy to read and export projects; dnSpyEx (the community continuation of the discontinued dnSpy) to set breakpoints on decompiled C# and edit assemblies.

dotnet tool install --global ilspycmd
ilspycmd -p -o ./out App.dll    # export as a C# project

Caveats

• Debug untrusted samples only inside a VM with snapshots and shared folders disabled.
• DiE results are hints, not verdicts; custom packers have no signature.
• Modifying and redistributing someone else's assemblies may breach the licence; only do it on software you own or are authorised to.

How to apply it

• Dev: Install DiE, ImHex and ILSpy even if you are not in security: they help debug your own file formats and read .NET libraries without source.
• Tech Lead: Add DiE (diec) to release checks to confirm the build used the right compiler and the chosen protector.
• PM: The whole kit is free; the real cost is training time, not licences.