Ah, I hadn't heard of the IL functionality. From a quick test of the Binary Ninja demo, it looks like an approach that could become a viable competitor to a de

Ah, I hadn't heard of the IL functionality. From a quick test of the Binary Ninja demo, it looks like an approach that could become a viable competitor to a decompiler in the future, but isn't a good one in its current state. For instance, one of the most useful aspects of a decompiler for me is the ability to recover high-level control flow, which Binary Ninja apparently doesn't support. Instead it gives you an IDA-like graph view (but with IL instead of assembly in the graph nodes); but at least in my experience using IDA without a decompiler, even moderately large functions tend to result in a spiderweb of a graph, and recovering the control flow by hand ends up feeling like a pointless brain teaser. (This condition being true short-circuits this set of comparisons, so it must be an ||... but it still ends up doing this other set of comparisons, which you can also get to from... wait, where was I again?) It also doesn't seem to allow eliding temporary assignments. Here's a short sample from some random function (retyped by hand since I don't see a way to copy and paste): int32_t edx = arg4 int32_t eax = esi eax_1, ecx_2 = sub_3c670(eax, edx) It does do a sort of SSA transformation and assign unique variable names (like eax_1 instaed of eax) to the same register based on the location in the program, so that's nice. But what I really want is eax_1, ecx_2 = sub_3c670(esi, arg4) I may be missing some option to do this manually, but it should be automatic.