# Tool routes — verified 2026-10-23

Every license below was read from the LICENSE file in the project's official
repository on 2026-10-23 — not from a badge, a listing, or a search snippet.
Price anchors were read the same day from the vendors' own pages.

## Native code (programs, firmware, native game builds)

**Ghidra — Apache-2.0.** The NSA's reverse-engineering framework: disassembler
plus decompiler for almost any processor. Download from GitHub releases
(v12.2, build dated 2026-10-16, ~450 MB). Windows / macOS / Linux, GUI plus a
headless batch analyzer. **Friction:** needs a current 64-bit JDK installed
first (the 12.2 release requires JDK 25, per its Getting Started doc — the
sweep's first run bounced off JDK 21); the download is big; the first open
of a large binary takes a while because it analyzes before it shows you
code. This is the shelf's flagship — the tool that made the €4,999/year
IDA seat optional for this job.

**RetDec — MIT.** Avast's machine-code decompiler; turns compiled programs
into readable C. Prebuilt releases for Windows and Linux. Covers x86, ARM,
MIPS, PowerPC and more. **Friction:** heavy install, wants real RAM, slower
than Ghidra on big binaries. Best as the scripted route or second opinion.

**Boomerang — BSD-style license (flagged, not MIT/Apache).** An early
open-source native decompiler. Build from source. Older, quiet project —
fine for small programs, not the first reach.

**Capstone — BSD-3-Clause (flagged).** Not a decompiler: the disassembly
engine other tools build on. Useful when a script (or your AI) needs an
assembly listing. Plumbing, not a viewer.

## Java / Android

**jadx — Apache-2.0.** Reads APKs and Java bytecode back into Java, with a
friendly viewer. GitHub releases for all platforms; needs a Java runtime.
The easiest route on this shelf for an Android build.

**CFR — MIT.** A one-file Java decompiler: `java -jar cfr.jar yourbuild.jar`
and readable Java comes out. No viewer — the workflow prompt in this pack is
how your AI reads it with you. Proven on the sweep's test rig (see proof.md).

**Vineflower — Apache-2.0.** The modern Java decompiler (the maintained
Fernflower line); cleanest output on current Java features. Single jar,
command line; needs Java 17+. Also proven on the test rig.

**Procyon — Apache-2.0.** Another capable Java decompiler, strong on newer
language features. The alternate when CFR or Vineflower trips on something.

**Recaf — MIT.** A Java bytecode workbench: view, search, edit, with
decompilers built in. Needs a JDK. **Friction:** it's the power tool of this
set — more screen, more knobs. For looking inside a mod or plugin you own.

## .NET / Unity

**ILSpy — MIT.** Reads .NET assemblies back into C#. Windows app from GitHub
releases, cross-platform `ilspycmd` from NuGet, or a VS Code extension. For a
Unity game build, open `Assembly-CSharp.dll` — for many lost projects that
file *is* the game logic, and ILSpy makes it readable again.

## WebAssembly

**WABT (WebAssembly Binary Toolkit) — Apache-2.0.** `wasm2wat` (readable
text form), `wasm2c` (a C translation), and `wasm-decompile` (real
decompiled output). **Friction, measured:** the current 1.0.42 release
binaries omit `wasm-decompile`; the 1.0.34 release ships it and works.
Prebuilt binaries for Windows / macOS / Linux.

## Deliberately NOT on this shelf

- **Rizin, Cutter, pycdc, uncompyle6** — real, respected tools whose licenses
  are GPL-3.0 (read at the source). We don't bundle copyleft. You may install
  and use them yourself; note the consequence: the well-known Python
  decompilers are all copyleft, so this shelf ships no Python decompiler.
  Python builds usually travel with their source; for a stray `.pyc`, read
  the bytecode listing with Python's built-in `dis` and your AI's help.
- **Snowman** — could not be verified: no LICENSE file locatable at the
  source. Not shipped, not cited, until it can be read.
- **dogbolt.org (Decompiler Explorer)** — a free hosted *service*, not code.
  Fine for a first look at a throwaway binary. Its own page warns that
  **uploaded binaries are retained** — never upload a private build you
  wouldn't hand a stranger.