RetDec - Retargetable Machine-Code Decompiler Cheatsheet
RetDec (Retargetable Decompiler, by Avast) is an open-source machine-code decompiler that converts compiled binaries back into readable high-level code. “Retargetable” is the key property: rather than being built for one architecture, it lifts many instruction sets — x86, ARM, MIPS, PIC32, PowerPC — into LLVM IR, then decompiles that common representation into C or a Python-like pseudocode. It runs standalone and integrates with IDA, Ghidra, and radare2.
Installation
| Method | How |
|---|
| Release build | Download the prebuilt package from GitHub Releases |
| From source | CMake build (see the repo’s build docs) |
| Docker | docker run -v "$PWD:/dst" retdec/retdec |
| Verify | retdec-decompiler --version |
Basic Decompilation
| Command | Description |
|---|
retdec-decompiler binary.exe | Decompile to binary.exe.c |
retdec-decompiler -o out.c binary | Choose the output path |
retdec-decompiler --backend-no-debug binary | Cleaner output |
retdec-decompiler --cleanup binary | Remove intermediate files |
retdec-decompiler --help | Full option list |
# Decompile and read the result
retdec-decompiler suspicious.exe
less suspicious.exe.c
| Flag | Produces |
|---|
| (default) | C source |
-f py | Python-like pseudocode |
--backend-emit-cfg | Control-flow graphs |
--backend-emit-cg | Call graph |
--config out.json | Structured analysis config/results |
| LLVM IR | Intermediate .ll output during decompilation |
Supported Architectures
| Architecture | Formats |
|---|
| x86 / x86-64 | PE, ELF, Mach-O |
| ARM / Thumb | ELF, PE, raw |
| MIPS | ELF, raw |
| PIC32 | ELF, Intel HEX |
| PowerPC | ELF |
Broad architecture coverage makes RetDec particularly useful for embedded and firmware work, where MIPS and PIC32 binaries are common and mainstream decompilers offer less.
Useful Options
| Option | Effect |
|---|
-a arch | Force an architecture |
-e endian | Set endianness (little/big) |
-m mode | Mode: bin, raw, ll |
--raw-entry-point ADDR | Entry point for raw binaries |
--raw-section-vma ADDR | Load address for raw code |
--select-ranges A-B | Decompile only an address range |
--select-functions f1,f2 | Decompile specific functions |
# Raw firmware blob: tell RetDec how to load it
retdec-decompiler -m raw -a mips -e big \
--raw-entry-point 0x80000000 --raw-section-vma 0x80000000 firmware.bin
Analysis Features
| Feature | Provides |
|---|
| File format detection | PE/ELF/Mach-O parsing |
| Compiler/packer detection | Toolchain fingerprinting |
| Signature-based function ID | Recognize statically-linked library code |
| Type reconstruction | Recover structures and types |
| Debug info use | DWARF/PDB when available |
Library-function identification matters a lot in practice: it lets you skip the thousands of lines of statically-linked libc and focus on the application’s own logic.
Integrations
| Tool | Plugin |
|---|
| IDA Pro | RetDec IDA plugin |
| Ghidra | RetDec Ghidra plugin |
| radare2 | r2retdec |
| API | Decompile programmatically via the CLI/config |
RetDec vs Other Decompilers
| Aspect | RetDec | Ghidra | Hex-Rays (IDA) | Binary Ninja |
|---|
| Cost | Free/open-source | Free/open-source | Commercial | Commercial |
| Architectures | Many (incl. PIC32) | Many | Many (per-decompiler licence) | Many |
| Interactive | No (batch) | Yes (GUI) | Yes | Yes |
| Best for | Batch/scripted decompilation, embedded | Interactive RE | Highest-quality output | Modern API/UX |
Complements Ghidra for interactive work — RetDec shines for automated pipelines and unusual architectures.
Resources
