Glonce

Decompiler Explorer runs one binary through 13 decompilers at once

toolsThe Glonce editorsHacker News🔥38Glonce rating38Impact50Novelty25Relevance75Surprise20Players15Credibility75

Decompiler Explorer, hosted at dogbolt.org, is an interactive online tool that takes an uploaded binary and runs it through many different decompilers at once, displaying each one's equivalent C-like reconstruction of the source side by side for comparison. The project's own FAQ describes it as meant to be the reverse of Compiler Explorer, the well known tool that shows how source code compiles to assembly across different compilers. Uploaded files must be under 2MB, and users can instead try one of several provided sample binaries, including a CTF challenge on x86 Linux, a "Hello World" on Arm Linux, and test binaries covering arm64 FreeBSD, arm64 macOS, x86 Windows and x86_64 Linux. The FAQ page lists 13 decompilers currently integrated into the site: angr, Binary Ninja, Boomerang, dewolf, Ghidra, Hex-Rays (IDA Pro), Kuna, REC Studio, Reko, Relyze, RetDec, rev.ng and Snowman. The project traces back to Vector 35, the company behind the Binary Ninja decompiler, which built an internal prototype that grew into the public site with input from the community and inspiration from tools such as mdec; it is now a fully open source, community maintained project on GitHub that accepts contributions. Hosting on Digital Ocean is jointly sponsored by Vector 35 and Hex-Rays, the maker of IDA Pro, as a community service; the infrastructure consists of one "basic" dual core, 4GB RAM web front end and four "basic" quad core, 8GB RAM worker instances that sometimes scale temporarily to eight under load. The FAQ states that the public service runs with the express permission of the commercial tool vendors involved, since running an independent public mirror bundling commercial tools such as Binary Ninja or IDA Pro would run into licence terms covering time sharing services and derivative works; Vector 35 offers separate "headless" licences for longer term internal deployments of Binary Ninja. There is intentionally no public API, since the FAQ says the tool is not meant for automating decompiler comparisons; anyone wanting to automate that kind of comparison is told to contact the relevant licence holders directly. All binaries submitted to the site are saved and made available to the authors of the decompilers used, so they can use them to improve their tools.

Key facts

  • Decompiler Explorer (dogbolt.org) uploads one binary and shows the C-like output of 13 decompilers side by side, positioned as the reverse of Compiler Explorer.
  • Uploads are capped at 2MB; the site also offers sample binaries covering architectures such as x86 Linux, Arm Linux, arm64 FreeBSD/macOS, x86 Windows and x86_64 Linux.
  • The integrated decompilers include angr, Binary Ninja, Boomerang, dewolf, Ghidra, Hex-Rays (IDA Pro), Kuna, REC Studio, Reko, Relyze, RetDec, rev.ng and Snowman.
  • It began as an internal Vector 35 (Binary Ninja) prototype and is now open source on GitHub; hosting on Digital Ocean is jointly sponsored by Vector 35 and Hex-Rays.
  • There is no public API by design, and the FAQ says the public service runs only with the express permission of the commercial decompiler vendors involved.

Why it matters

Reverse engineers who want to know how a binary was really built have historically had to run each decompiler separately and compare output by hand. Decompiler Explorer puts commercial tools such as Hex-Rays IDA Pro and Binary Ninja next to free and open source ones such as Ghidra, angr and RetDec in one place, on one upload, which turns picking or checking a decompiler into a quick side-by-side comparison instead of a series of separate installs and runs.

Who it affects

The audience is reverse engineers, security researchers and malware analysts who need to read decompiled C-like code from a binary, plus the authors of the decompilers themselves, who get access to the binaries people submit so they can improve their tools. It also affects anyone hoping to build automated tooling on top of decompiler comparisons, since the FAQ says explicitly that use case is not supported.

How to use it

Go to dogbolt.org and upload a binary under 2MB, or pick one of the provided samples covering platforms like x86 Linux, Arm Linux, arm64 FreeBSD or macOS, and x86 Windows. The site then shows the output of each of its 13 integrated decompilers for that binary. There is no API for scripted or automated use; the FAQ is explicit that the tool is meant for manual, interactive comparison rather than automation, and anyone wanting to automate decompiler comparisons is directed to contact the individual licence holders. The project is open source on GitHub and accepts contributions.

How solid is it

The project has a real institutional backing: it grew out of an internal prototype at Vector 35, the company that makes the Binary Ninja decompiler, and its public hosting on Digital Ocean is jointly sponsored by Vector 35 and Hex-Rays, the vendor of IDA Pro. Running commercial decompilers as a public web service required the express permission of those vendors, because an independent public mirror bundling their tools would conflict with licence terms on time sharing services and derivative works. The infrastructure is modest by design: one small web front end and four worker instances that can scale to eight under load, which is consistent with a community sponsored service rather than a commercially operated one.

Risks and caveats

All binaries submitted to the site are saved and made available to the decompiler authors, so anyone uploading proprietary or sensitive binaries should treat the service as non-private. The commercial tool vendors involved are cleared for this specific public deployment under the FAQ's stated permission; the FAQ warns that a self-hosted public mirror including those commercial decompilers would likely violate their licence terms, though private internal deployments may be possible depending on the licence held, and Vector 35 offers separate headless licences for that purpose. The lack of a public API is a deliberate limitation, not a gap to be worked around.

“It's meant to be the reverse of the amazing Compiler Explorer.”

— Decompiler Explorer FAQ