A lot of tool choices only make sense once you know the tradeoff. This page keeps those calls short and practical.
If you are deciding between two options, read the comparison, make the call, and move on. You can always swap later once the target gets weird.
Ghidra is for when you have more time than money. It is clunky, but for zero dollars, you get a world-class decompiler. IDA Pro is the king of the scene, but the price is insane for a hobbyist. Binary Ninja is for people who hate the Windows 95 look of IDA and want a modern API that makes automating the boring stuff actually fun.
pe-sieve is the engine; it scans a single process for hooks and patches. HollowsHunter is the scanner; it loops through all running processes and feeds them to pe-sieve. Use HollowsHunter when you don't know where the malware/cheat is hiding.
System Informer is the modernized successor for monitoring kernel-level handles and verifying DLL injection status. It is essential for checking if an anti-cheat has stripped process access or for analyzing the thread state of an internal module. Note: System Informer no longer includes the old Process Hacker 2 injector UI.
Use Ghidra for long-term research on massive game binaries where mapping out complex class structures and inherited structs is required. Pick Cutter (Rizin) for quick, lightweight analysis of a specific internal cheat DLL or a shellcode snippet carved from memory.
Cheat Engine is your scratchpad for finding that first address, like your health or ammo. ReClass.NET is what you open next to see what is living next to that address. Use CE to find the number, then use ReClass to map out the entire player structure so you can find your coordinates and team ID without having to scan again.
Fiddler is a spectator tool. It is great for sitting back and watching what JSON data a game sends to a server. Burp Suite is a weapon. You use it to catch a request in the air, change the price of an item to zero, and send it anyway to see if the server is lazy enough to believe you.
JADX is a viewer for your PC. You use it to read the logic of an APK and find where the security checks are hiding. MT Manager is a surgeon's tool for your phone. It lets you edit code, swap textures, and sign the APK right on the device without ever needing to touch a computer.
Flex 3 is an on-device runtime inspector. It's perfect for finding boolean methods (like 'isPremium') and flipping them instantly. Theos is a build system for creating proper jailbreak tweaks (.dylib) using C++ and Logos hooking. Use Flex for quick tests and simple patches; use Theos when you want to build a full menu or complex logic.
kdmapper is the classic entry point for sneaking a driver into the kernel, but it is a giant red flag for games with Vanguard or BattlEye. KDU is the heavy artillery. If one driver gets blocked by a Windows update, KDU lets you cycle through a dozen other vulnerable drivers until you find a backdoor that actually works.
Themida is the heavy option. It wraps your file in so many layers that it becomes a nightmare to dump, but it also makes your cheat loader twice as big and triggers every antivirus on the planet. VMProtect is surgical. You pick your most important functions and virtualize them, keeping things lightweight and fast while still making life miserable for crackers.
ScyllaHide is your invisibility cloak for basic games. It stops them from seeing your debugger, but it fails against anything with a kernel driver. TitanHide is the real deal. It runs in Ring 0 and hides your debugger from the entire OS. It is mandatory if you want to attach to a game that has BattlEye or EAC.
Software methods like HyperDbg hide by using CPU virtualization features, but they still run code on the target machine. DMA (Direct Memory Access) uses a PCIe card to read memory physically. The target CPU is unaware it's being read. DMA is the only true 'undetectable' method against top-tier anti-cheats.
These are common .NET obfuscators you will run into. The practical impact is not which name it is, but what it did to readability, strings, and control flow. If the code looks like spaghetti, the fastest move is often to figure out the inputs and outputs first, then come back and clean up names once we know what matters.
Mono games are a gift. You can open their DLLs in dnSpyEx and see the original code like you wrote it yourself. IL2CPP games are a headache. They turn all that C# into native machine code. You have to use a dumper just to get a map of where the functions are before you even start reversing in Ghidra.
UEDumper is the GUI-heavy pick with a live property editor, great for seeing objects in real-time and generating Mapping Data Kits (MDKs) for external research. Dumper-7 is the gold standard for producing clean, compilable C++ SDKs for internal projects. UE4SS is more of a platform than a dumper—it's what you use if you want to write Lua scripts or recreate a full project using the Unreal Header Tool (UHT). Pick UEDumper for live editing and MDKs, Dumper-7 for SDKs, or UE4SS for Lua/UHT.
If you just need a quick look at the code, ILSpy is the fastest. If you need to debug the app or patch a method to see how it acts, dnSpyEx is the one. dotPeek is heavier, but the process view is handy for seeing exactly what DLLs a game has loaded in memory. Use ILSpy for fast analysis, dnSpyEx for debugging/patching.
MegaDumper is the classic choice, but it often misses managed modules in games with modern protection. ExtremeDumper is the 'advanced' move; it injects a core DLL to read metadata directly from CLR internals, making it much better at carving out assemblies that are reflectively loaded or packed. Use ExtremeDumper as your primary; MegaDumper is now a legacy fallback.
Regular de4dot is stagnant. If you're hitting a wall with modern string encryption or control-flow proxies, de4dotEx is the community-maintained fork you need to use.
Xposed is great for persistent 'quality of life' mods because it hooks once and stays there, but it's very easy for a packer to detect the modified zygote. Frida is the standard for research because it's 'on-the-fly' and harder to catch if you use a private server. Use Xposed for your personal phone mods; use Frida for actual binary analysis and research.
Frida is like a surgical knife—you inject it into a live game and hook exactly what you want. Qiling is a full sandbox; it emulates the whole OS environment so you can run a suspicious loader without worrying about it wiping your disk. Use Frida for live game research, use Qiling for 'cold' analysis of unknown binaries.
Procyon is a pattern-matching decompiler that tries to make Java code look 'original' and pretty. Krakatau is a semantic decompiler; it doesn't care about looking like the original source, it just wants the logic to be correct. If Procyon crashes on obfuscated bytecode, Krakatau is your best bet for a logical recovery.
Triton is the library that does the heavy lifting for symbolic execution and MBA simplification. Qsynthesis is the tool built on top of it that actually tries to 'synthesize' clean code from a mess of obfuscated instructions. Use Triton if you're writing your own devirtualizer; use Qsynthesis if you want to automate the cleanup of a specific function.
DexGuard is the well-known choice for general Android protection, but DexProtector has been shifting the goalposts by moving core logic into custom ELF loaders (libdexprotector.so). These loaders derive decryption keys from the system linker state at runtime, making them extremely hard to solve with static tools. If you're hitting a wall with static DEX analysis, you're likely dealing with DexProtector's RASP layers.
Bytecode Viewer is a massive multi-tool that runs five different decompilers at once so you can compare the output. Recaf is more of a surgeon's tool—it lets you edit the bytecode directly and rename things on the fly. Use Bytecode Viewer for initial analysis, use Recaf when you're ready to start renaming and rebuilding.
MinHook is the old reliable. It is simple and gets the job done for basic API hooks. SafetyHook is the modern meta. It is built to handle mid-function hooks and automatically freezes threads so your game doesn't crash every time you try to inject your logic. If you want a stable cheat, use SafetyHook.
010 Editor is the pro choice. Its binary templates can map out a custom game archive so it looks like a clean spreadsheet. ImHex is the free, modern rival that looks way better and uses a custom pattern language. If you are doing professional work on obscure formats, 010 is worth the price, but for hobby work, ImHex wins.