Disassembler
Supported architectures
Here you will find the list of architectures that Malcat is able to disassemble and/or decompile:
Cpu |
Disassembler |
Decompiler |
Strings identification |
Function discovery |
Notes |
|---|---|---|---|---|---|
x86 |
Yes (Zydis) |
Yes (Sleigh) |
scan, heuristics (Golang & Rust) |
linear, recursive, pattern matching |
|
x64 |
Yes (Zydis) |
Yes (Sleigh) |
scan, heuristics (Golang & Rust) |
linear, recursive, pattern matching |
|
.NET |
Yes |
No |
Yes (metadata) |
Yes (metadata) |
custom disassembler |
PY 2.7 |
Yes |
No |
Yes (metadata) |
Yes (metadata) |
custom disassembler |
PY 3.6+ |
Yes |
No |
Yes (metadata) |
Yes (metadata) |
custom disassembler |
NSIS |
Yes |
No |
Yes (metadata) |
linear + recursive |
custom disassembler |
PascalScript (InnoSetup) |
Yes |
No |
Yes |
linear + recursive |
custom disassembler |
AutoIT 3.26+ |
No |
Yes |
No |
No |
Simple detokenisation |
VB Pcode |
Partial |
No |
Yes (xref scan) |
Yes |
incomplete because of lack of doc |
VBA (office) |
No |
Yes |
No |
No |
can also display orphan scripts |
Excel macros (office) |
No |
Yes |
Yes (metadata) |
Biff8 (XLS) and Biff12 (XLSB) support |
|
MSI installers |
Tables |
No |