I am a complete newbie in the reverse engineering world, and being able to decompile .exe files in my OSX is being a pain.

Does anybody know a good decompiler of .exe for OSX, or any hint about where I can find one? Have I got any conceptual mistake like "that things don't exist"? :P Google is being quite confusing about it.

BTW, I know these apps could have illegal applications, but also very legal ones (nothing new for this site, i guess :P) In my case, I'm just trying to learn a little bit of reversing and I need this decompiler to pass some levels of an online wargame (or, at least, I think so). In concrete, this one: http://www.yashira.org/index.php?mode=Retos&resp=inforeto&level=126 (in spanish)

Thanks a lot for your time! :D

EDIT: @YoavAner has brought to my eyes that the linked page requires a login (thanks, @YoavAner :D). If you are interested in the wargame (or in this level in particular), you will need to register in to access to the levels.

  • It does actually sound illegal. I can't access the link because it leads to a login page, but most (closed-source) products, particularly commercial, explicitly prohibit any reverse-engineering of their code. see this question
    – Yoav Aner
    Commented Mar 1, 2012 at 8:49
  • 1
    Learning reverse-engineering, or performing it for research purposes is probably legal though. This means you're not supposed to use it (subtle, but important difference). I am not a lawyer, and I believe it changes from country to country.
    – Yoav Aner
    Commented Mar 1, 2012 at 8:57
  • Oopse! My fault. I linked to a page only accessible for registered members, but the thing is: it's just a public wargame. In that level they give you the .exe file and ask you to cause a buffer overflow to it; after that you will receive a password which you have to input in the webpage to get the level passed. As you see, the code has been done to be hacked :)
    – Palantir
    Commented Mar 1, 2012 at 10:14
  • 3
    @YoavAner Indeed, different countries have different laws. In France, the law explicitly allows reverse engineering when the purpose is interoperability, e.g. reverse-engineer a communication program in order to write a program that communicates with it. (ObUSdisclaimer: this is my layman's explanation, don't rely on it as if it was legal advice.) The offshot is that there are enough legal applications that this question is definitely valid. Commented Mar 1, 2012 at 10:14
  • @Palantir - that explains it then. I thought it was some online game simulating a war rather than an pentesting / reverse-engineering exercise.
    – Yoav Aner
    Commented Mar 1, 2012 at 10:29

7 Answers 7


GNU binutils include the objdump utility which can disassemble executable files into human-readable, or at least programmer-readable, assembly source code. It can do so for any supported target it has been compiled for, regardless of what architecture the tool itself is running on. In particular, it can disassemble a Windows .exe file even when running on MacOS X.

(Installing GNU binutils with support for a lot of binary targets, not only the one the tools are actually running on, entails downloading the source code for GNU binutils, and recompiling it with the appropriate cross-target options. Documentation is included. People who can do anything at all with a disassembled binary ought to be able to do such a task easily.)

Of course, disassembly is only the first step in reverse-engineering. The second step is a lot of hard thinking, which you do in your brain.

Note: I assumed here that the .exe was a Windows binary file, with x86 opcodes. Nowadays, it may also be a .NET assembly, i.e. not x86 opcodes, but CIL. In that case, you will want to use specific disassembler like these ones. It will still work with MacOS X, and still be opensource and free. And you will still need to think a lot.

  • 1
    I do my hard thinking on a piece of paper (or sometimes more than one). Commented May 6, 2013 at 21:12

IDA Pro is widely considered to be the single best static analysis for binary software. It also supports debugging, but in this field other tools (Immunity Debugger, ollydbg, WinDbg, etc.) may be better in various scenarios. Since you have no intention (and you can't) of executing and debugging your binary, we need not worry about that.

The recent versions of IDA support Linux and Mac OS X in addition to Windows (since version 6.0). Unfortunately for you, it's kind-of pricey. There is a free for non-commercial use download, but it's the 5.0 version, and runs only on Windows.

You can, however, download an evaluation version of IDA 6.3. It has several limitation, the one that is most crucial for you is: "you will not be able to save your work, it will time out after some use, it will not disassemble itself." But after trying it for a while, in comparison to other tools suggested here, you might find that it's worth the 500$ (unless you want 64-bit support, and then the price is double).

IDA is the answer to your question, since you didn't specify that you only want free solutions. Several lists of disassemblers are given below. Many are free, like REC Studio 4, Shadok mentioned in his answer, but none of them comes close to IDA.

  • 1
    There is the hexrays decompiler plugin for IDA which is pretty cool. Unfortunately it's even pricier than IDA. Commented Dec 2, 2012 at 13:44

I'm a little confused with your question... Reverse-engineering in your case means executing the binary to understand it so you must execute .exe files on MacOsX.

So first, you should look at DarWine (Wine for MacOSX), Wine is an alternate Win32 Environnement which can execute your .exe file. After this you can attach a debugger (OllyDbg, Ice, ...) as you would on Windows (Don't forget to look at the compatibility of your game with wine on the wine appdb).

Btw I advise you to learn reverse-engineering by cracking some simpler software before (look at hack challenge on google, there is plenty of it). Because real-life software are a litte difficult.

  • 4
    Software reverse engineering does not mean executing the binary, just like missile reverse engineering does not mean launching the missile you study. There are many ways to reverse engineer hardware without actually attempting to power it; basically various kinds of scanning. Same goes for software. You're confused with the question because of the false assumption you have. I suggest you start with this section in a wikipedia article, and then take a look at this book.
    – conio
    Commented Dec 3, 2012 at 0:58
  • +1 conio, though PMA is arguably a more newbie friendly book: Practical Malware Analysis: practicalmalwareanalysis.com
    – adric
    Commented Aug 1, 2013 at 17:01

You should lookt at those two articles from Symantec:
Reverse Engineering Hostile Code
Alien Autopsy: Reverse Engineering Win32 Trojans on Linux

The tools used in those two articles are basic GNU tools (diff, grep, hexedit...), Wine, gdb and IDA Pro (Freeware version).
Two other tools you could be interested in are REC Studio and NASM.

All the above tools support OSX.


An accessible, reasonably priced (~US$60) tool is Hopper. It is a a good balance between price and functionality compared to more expensive (~US$1129) but more powerful IDA Pro. If you are just starting out, this is an excellent tool that easier to use than most disassemblers, and it is relatively economical.


You can use string to get the order its look that lets say that it's the code

int main(){
fprintf(stderr ,"hello word");

and then write in the terminal

$strings file.exe

If you want to get real function and not only requests from the kernel you need to use a tool like ida pro or something.

  • 1
    I fixed the most obvious grammatical mistakes. But there are still parts left where I have no clue what you were trying to say. So I suggest you edit it further.
    – kasperd
    Commented Nov 20, 2016 at 18:27

There are some good answers here. One I haven't seen is the free Ghidra tool. It will run on Mac OS but it's Java-based so you need a JRE. And some people have a thing against running software from the NSA.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .