A collection of tools, case studies and research for websites, games, apps, native binaries, firmware and communication protocols.

English · 简体中文

Search the website · Browse resources · Cases · Papers · Suggest a resource · Contributing

If this collection is useful, a star on GitHub helps others find it.

Review method

Featured benchmarks:

Website reconstruction	Browser agents
Can AI agents rebuild websites through browser exploration? ★ Star on GitHub	Open-source benchmark for browser AI agents on daily tasks. ★ Star on GitHub

Featured: Awesome Computer-Use Agents — a source-backed catalog of papers, models, datasets, benchmarks and tools for agents that use computers.

5,191 curated resources (4,025 cases) · 263 papers · 3,309 indexed repositories · latest source review 2026-11-09.

For agents: Repository instructions · How to contribute and submit a PR · Contribution forms

Use these public files and pages to read the catalog, follow changes, or work with its structured data.

• llms.txt - Machine-readable site map for language models.
• llms-full.txt - Curated entries in one Markdown text.
• JSON and CSV API - Static JSON and CSV exports of resources, papers and categories, plus unreviewed candidates.
• catalog.json - Curated catalog in one JSON file.
• JSON Feed - New and changed entries in JSON Feed format.
• Hugging Face dataset - Parquet and JSONL exports for resources, papers, cases and discovery records.
• Catalog format - Fields, vocabulary and review rules for every record.

Names link to original sources. Each line gives the opening sentence of the description, then the type and relationship; “Full entry” opens the complete description, prerequisites, limitations and review sources.

Each resource appears once under its main purpose. Cases reuse these entries; papers are listed separately. Browse the resource directory.

REA labels refer to the separate upstream CLI and MCP project. About this collection.

Tags: Official REA: published by the REA project · Community REA: third-party REA work · REA maintainer: an REA maintainer's list · Independent MCP, Independent agent, Independent reconstruction: no established REA connection · Mixed workflow: REA plus other tools, per the author · Android, .NET, JVM, WebAssembly: platform · Library: code library · type only: foundation tool or learning resource.

↑ Contents

76 case studies. The 10 newest are below. Full case list.

• canopy-dotmatrix: reconstructing davidluft.com's dot-matrix window - Reconstructs the dot-matrix window on davidluft.com from its public JavaScript bundle and scene payloads. _{Case study · Independent reconstruction · Full entry}
• Dih Pinterest: reconstructing a Pinterest search site's page and data flow - Dih Pinterest reconstructs the search interface and data flow of searchpinterest.vercel.app as a static web app with an optional Vercel proxy. _{Case study · Independent reconstruction · Full entry}
• Drama Live: analysing its Android and web clients and rebuilding an API client - Drama Live analysis documents the Android APK and web PWA of the IPTV player, including their component stacks, endpoint maps and content-source flows. _{Case study · Independent reconstruction · Also: App · Full entry}
• edgestash: reconstructing Vercel Blob and Upstash Redis API behavior - edgestash implements a self-hosted server for the Vercel Blob and Upstash Redis REST APIs, allowing their published SDKs to use a different endpoint. _{Case study · Mixed workflow · Full entry}
• github-websocket-pipelines-api: probing GitHub Actions live-log messages - github-websocket-pipelines-api probes GitHub Actions' undocumented live-log WebSocket interface. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• Google Earth: reconstructing 3D satellite asset formats and access - earth-reverse-engineering investigates Google Earth's 3D satellite mode and reconstructs its resource URL structure, octree metadata, Protobuf asset formats, and mesh and texture decoding steps. _{Case study · Independent reconstruction · Full entry}
• Inception Chat: reconstructing a chat page from design and prompt captures - Inception Chat reconstructs the public chat.inceptionlabs.ai landing page from observed desktop and mobile layouts, deployed CSS tokens and captured suggested prompts. _{Case study · Independent reconstruction · Full entry}
• LoreMaps: a static rewrite of a fantasy-map atlas - A static Astro atlas rewritten from the project’s earlier ASP.NET MVC site. _{Case study · Independent reconstruction · Full entry}
• MAX Messenger: documenting WebSocket and TCP message formats - MAX Messenger API Documentation maps the messenger's WebSocket JSON and TCP MessagePack exchanges from browser traffic and direct request experiments. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• muse-cli: reconstructing the muse.ai personal gateway protocol - muse-cli implements terminal access to the muse.ai personal gateway using behavior derived from its web client bundle. _{Case study · Independent reconstruction · Also: Protocol · Full entry}

• webcrack - Improves JavaScript readability by reversing supported obfuscation patterns and unpacking webpack/Browserify bundles. _{Tool · Also: App · Full entry}
• humanify - Rename identifiers in minified JavaScript with LLM-suggested names, applied through scope-aware AST rewriting so the program structure stays unchanged. _{Tool · Full entry}
• WABT - WebAssembly tools for binary-to-text conversion, section inspection, validation, interpretation and C translation. _{Tool · WebAssembly · Also: Binary · Full entry}
• wasm-tools - Bytecode Alliance CLI and Rust libraries for inspecting WebAssembly modules, metadata, components and WIT interfaces. _{Tool · WebAssembly · Also: Binary · Full entry}
• Chrome DevTools MCP - Connect an agent to Chrome for live page inspection, network debugging, and performance traces. _{Integration · Independent MCP · Full entry}
• mitmproxy - Inspect and record HTTP traffic with an interactive proxy, web interface, or scriptable command-line tools. _{Tool · Also: App, Protocol · Full entry}
• Playwright MCP - Drive browser interactions through structured accessibility snapshots to investigate reproducible web behavior. _{Integration · Independent MCP · Full entry}
• Burp Suite MCP Server - PortSwigger's Burp Suite extension serves an MCP endpoint, plus a packaged stdio proxy, so agents can query proxy HTTP and WebSocket history, send HTTP/1.1 or HTTP/2 requests, and open Repeater or Intruder tabs. _{Integration · Independent MCP · Also: App · Full entry}
• Wakaru - Recover readable modules from shipped JavaScript bundles by reversing recognized minifier and transpiler patterns. _{Tool · Full entry}
• Spectral - Analyze captured application HTTP traffic with an LLM to generate MCP tools, OpenAPI 3.1 specifications, or GraphQL schemas. _{Integration · Independent agent · Also: App, Protocol · Full entry}
• jsdeob-workbench - Inspect JavaScript ASTs and variable scopes while building visual chains of Babel transforms. _{Tool · Full entry}
• Browser Reverse Engineering Toolkit - Capture browser-session evidence, crawl websites in a persistent Chromium session, and generate offline architecture/API reports plus OpenAPI, SDK and mock-server drafts from saved captures. _{Tool · Full entry}
• screenshot-to-code - Generate HTML/CSS, Tailwind, React, Vue, Bootstrap or Ionic front-end code from screenshots, mockups, Figma designs or screen recordings with multimodal models; an optional headless-browser preview lets the model check its rendered output. _{Tool · Full entry}
• Dembrandt - Node.js CLI that renders a website in Playwright-driven Chromium or Firefox and reads computed styles from the DOM to extract its design system: logo, color roles with the evidence behind each pick, typography, spacing, borders, shadows, motion, breakpoints and component styles such as buttons and inputs. _{Tool · Full entry}
• shuji - Command-line tool that writes the original JavaScript and CSS sources embedded in source maps back out as files. _{Tool · Full entry}
• Obfuscator.io Deobfuscator - Deobfuscator dedicated to JavaScript produced by Obfuscator.io (javascript-obfuscator), which its README says also handles most forks. _{Tool · Full entry}
• javascript-deobfuscator - General-purpose JavaScript deobfuscator for common obfuscation patterns, published on npm as js-deobfuscator and usable as a library or CLI. _{Tool · Full entry}
• mitmproxy2swagger - Command-line tool that reverse-engineers undocumented REST APIs from captured traffic. _{Tool · Also: Protocol · Full entry}
• JPEXS Free Flash Decompiler (FFDec) - Java desktop decompiler and editor for Adobe Flash SWF files. _{Tool · Also: Game · Full entry}
• WasmLens: exploratory WebAssembly inspection - Python CLI with static paths for inspecting WebAssembly sections and function signatures, producing WAT-style instruction listings, and reconstructing limited C-like pseudocode. _{Tool · WebAssembly · Also: Binary · Full entry}
• synchrony - JavaScript cleaner and deobfuscator aimed mainly at output from javascript-obfuscator (obfuscator.io). _{Tool · Full entry}
• sourcemapper - Go command-line tool that recreates a web front end's original JavaScript source tree from a source map generated by webpack or a similar bundler, writing each embedded source file under the path the map records. _{Tool · Full entry}
• ngrev - Electron desktop application that statically analyzes an Angular project's TypeScript sources and draws interactive graphs of its NgModules, components, directives, pipes and providers and how they depend on each other, without running the application. _{Tool · Full entry}
• jsluice - Bishop Fox's Go library and command-line tool that parses JavaScript with tree-sitter to recover the endpoints a script calls, judging values by how the code uses them rather than by regular expressions alone. _{Tool · Full entry}
• REstringer - HUMAN Security's Node.js JavaScript deobfuscator. _{Tool · Full entry}
• Chrome extension source viewer (CRX Viewer) - Browser extension and web page by Rob Wu for inspecting packaged browser extensions without installing them. _{Tool · Full entry}
• har-to-openapi - TypeScript library and CLI that infers OpenAPI 3.0 or 3.1 documents from HAR captures of HTTP traffic, loosely based on har2openapi. _{Tool · Full entry}
• decode-js - Babel-based AST processor that turns obfuscated JavaScript back into readable source, with one target selected per run: javascript-obfuscator (obfuscator.io), JS-Confuser 2.x up to its high preset, sojson and its v7 variant for jsjiami.com.v7, sojson's jjencode variant, and a generic pass for unreachable code, nested blocks and constant expressions. _{Tool · Full entry}
• javascript-deobfuscator (LostMyCode) - Browser-based Vue app that restores the strings Obfuscator.io hides behind string-array lookups in JavaScript. _{Tool · Full entry}
• minusone - Airbus CERT's Rust deobfuscation engine for scripts: it parses PowerShell or JavaScript with tree-sitter, applies rules that infer the values of syntax-tree nodes and prints a simplified script. _{Tool · Full entry}
• JS-Deobfuscator (0x1Avram) - Node.js deobfuscator for JavaScript produced by Timofey Kachalov's javascript-obfuscator, also offered as obfuscator.io. _{Tool · Full entry}
• HTTP Toolkit - Open-source HTTP(S) debugging proxy for Windows, Linux and macOS that sets up interception for browsers, terminals, backend runtimes, Electron apps and Android devices, then shows the full headers and body of every request and response with body decoding, inline header documentation and filtering. _{Tool · Also: App, Protocol · Full entry}
• Javascript Deobfuscator - Browser-based workbench for deobfuscating JavaScript by hand, also hosted on GitHub Pages, that pairs a Monaco editor with step-by-step rewriting and evaluation commands instead of a one-click pipeline. _{Tool · Full entry}
• go-fAST - Go library for parsing, traversing, transforming and regenerating JavaScript abstract syntax trees, which its README presents for code analysis, obfuscation and deobfuscation. _{Tool · Full entry}
• Hetty - Open-source HTTP toolkit for security research, which its author aims to make an alternative to Burp Suite Pro. _{Tool · Full entry}
• debundle - Node.js command-line tool that unpacks JavaScript bundles produced by Browserify or Webpack back into a tree of module files, so a bundle can be read file by file instead of as one script. _{Tool · Full entry}
• JStillery - Minded Security's JavaScript deobfuscator, which Stefano Di Paola forked from esdeobfuscate in 2015, simplifies scripts by partial evaluation on an esprima AST. _{Tool · Full entry}
• box.js - Node.js utility for studying malicious JavaScript that runs a sample inside an emulated Windows JScript environment, with WScript, ActiveX, filesystem, registry, WMI and HTTP objects emulated and source rewriting that exposes eval calls and conditional-compilation code. _{Tool · Full entry}
• breakinggood - breakinggood captures a website's screenshots, cleaned DOM, computed design values, images, and XHR/fetch responses, then generates a Vite, React, and Tailwind rebuild with a mock API replaying observed JSON. _{Tool · Full entry}
• Facebook BitMap Codec - Facebook BitMap Codec encodes and decodes Facebook web API parameter values using the project's reverse-engineered bitmap, run-length and custom Base64 scheme. _{Tool · Full entry}
• DevLens Ultra - DevLens Ultra is a Chrome extension for inspecting and extracting website component structure. _{Tool · Full entry}
• AppThreat wasm-tools - wasm-tools is a pure-Python parser and disassembler for WebAssembly core modules and Component Model binaries. _{Tool · WebAssembly · Also: Binary · Full entry}
• web-crawler ReverseAgent - web-crawler includes ReverseAgent for investigating website JavaScript and request signing. _{Tool · Full entry}
• Mirrorframe - Mirrorframe captures webpages with Playwright and reconstructs their observed layout and behavior as a self-contained React app. _{Tool · Full entry}
• unwebpack-sourcemap - unwebpack-sourcemap is a Python script that recovers TypeScript, JSX, and other source files from Webpack source maps. _{Tool · Full entry}
• Wirebrowser - Wirebrowser is a desktop tool for instrumenting browser JavaScript through the Chrome DevTools Protocol. _{Tool · Full entry}
• Thug - Thug is a Python low-interaction honeyclient that mimics a web browser to detect and emulate malicious content. _{Tool · Full entry}
• spy-debugger - spy-debugger is a tool for remotely debugging pages in mobile browsers and app WebViews while capturing HTTP and HTTPS traffic. _{Tool · Also: App · Full entry}
• WebsiteBench - Benchmark that asks whether AI agents can rebuild websites through browser exploration: given a production-level website they can explore through a browser, agents must reverse-engineer a full-stack version that matches its appearance and behavior as closely as possible. _{Project · Full entry}
• wasmdec - Command-line decompiler that parses a WebAssembly binary or text-format module with Binaryen and emits pseudo-C: globals, imported and defined functions with their locals and control flow, and a preamble of C helpers for WebAssembly operations. _{Tool · WebAssembly · Also: Binary · Full entry}
• JS Deobfuscator (kuizuo) - Babel AST-based JavaScript deobfuscator with a CLI, a TypeScript API in the workspace package deob, and a browser playground built with Nuxt 3 and Monaco. _{Tool · Full entry}
• go-mitmproxy - go-mitmproxy is a Go proxy for inspecting and modifying HTTP/HTTPS traffic. _{Tool · Also: Protocol · Full entry}

↑ Contents

2,832 case studies. The 10 newest are below. Full case list.

By method: Matching decompilations and disassemblies (583) · Non-matching decompilations (343) · Static recompilations (761) · Ports of reconstructed source (357) · Engine reimplementations (467) · Other methods and analyses (321)

• 2ooM: decoding Master of Orion II's LBX data for a remake - 2ooM works toward a remake of Master of Orion II that runs on the original game's data files. _{Case study · Independent reconstruction · Full entry}
• A-Team: an Atari 2600 disassembly with PAL conversion - A two-bank 6502 disassembly of A-Team for the Atari 2600 assembles with DASM and doubles as the basis for a PAL conversion. _{Case study · Independent reconstruction · Full entry}
• ACEmulator: Asheron's Call server emulator - ACEmulator rebuilds the Asheron's Call MMORPG server in C#, aiming to reproduce the game world as it was when the official servers closed in January 2017. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• Air-Sea Battle: an annotated Atari 2600 disassembly - A labeled and commented 6502 assembly listing reconstructs Air-Sea Battle, Atari's 1977 game for the Atari 2600, on the MiniDig disassembly page. _{Case study · Independent reconstruction · Full entry}
• Berzerk: a commented Atari 2600 disassembly - Berzerk for the Atari 2600 (Atari, 1982) is reconstructed as a labeled, commented 6502 assembly listing that assembles to the exact original ROM image, with a switch for the NTSC or PAL build. _{Case study · Independent reconstruction · Full entry}
• blackhack: runblack.exe UI widget decompilation - blackhack rebuilds the SetupControl UI widget classes of runblack.exe as hand-decompiled C, covering buttons, big and tab buttons, check boxes, lists, sliders, edit fields, colour pickers, pictures and graph widgets, along with parts of Lionhead's lhlib. _{Case study · Independent reconstruction · Also: Binary · Full entry}
• Combat: an annotated Atari 2600 disassembly - A commented 6502 assembly listing reconstructs Combat, the Atari 2600 tank, biplane and jet game, aiming to explain every instruction, memory location and table. _{Case study · Independent reconstruction · Full entry}
• Cosmic Ark: a commented Atari 2600 disassembly with PAL conversion - Cosmic Ark for the Atari 2600 (Imagic, 1982) is reconstructed as an analyzed, labeled and commented 6502 assembly listing with NTSC and PAL builds. _{Case study · Independent reconstruction · Full entry}
• dataeast_snddrv: High Seas Havoc sound driver disassembly - dataeast_snddrv is a disassembly of the sound driver Data East used in High Seas Havoc, split into 68000 driver code, a Z80 DAC sample player and a frequency table, assembled with vasm. _{Case study · Independent reconstruction · Full entry}
• Donkey Kong 64: matching N64 decompilation - A matching decompilation of the US release of Donkey Kong 64 for the Nintendo 64, rebuilding the ROM from C source organised by the boot segment, global code and overlays named arcade, jetpac, bonus, boss, menu, minecart, multiplayer, race and critter. _{Case study · Independent reconstruction · Full entry}

• RenderDoc - Inspect frame captures, draw calls, shaders, and graphics resources in your own game or graphics application. _{Tool · Also: App · Full entry}
• AssetRipper - Analyze Unity game files, inspect asset dependencies, and convert supported assets into Unity project formats. _{Tool · Full entry}
• Cpp2IL - Recover managed representations from Unity IL2CPP builds using binary and metadata analysis; reconstruction remains a work in progress. _{Tool · Also: App, Binary · Full entry}
• Il2CppDumper - Recover IL2CPP metadata and dummy assemblies, and generate helper scripts for native analysis tools; method code is not restored. _{Tool · Also: App, Binary · Full entry}
• RenderDoc MCP - Expose existing RenderDoc captures to an agent for bounded frame, pipeline, resource, and shader inspection. _{Integration · Independent MCP · Also: App · Full entry}
• UndertaleModTool - Browse and modify supported GameMaker data files, extract assets, and decompile or compile GML VM code. _{Tool · Full entry}
• frida-il2cpp-bridge - Inspect IL2CPP classes, methods, and fields in a live process, and trace or intercept method calls without supplying global-metadata.dat. _{Tool · Also: App · Full entry}
• objdiff - Compare functions and data in reference and rebuilt object files to guide matching decompilation. _{Tool · Also: Binary · Full entry}
• decomp-permuter - Randomly or systematically permutes one C function, recompiling each variant and scoring it against a target object file to search for matching compiler output. _{Tool · Also: Binary · Full entry}
• asm-differ - Diffs original and rebuilt assembly for one function or ROM address to guide matching decompilation; its watch mode can rerun make when sources change. _{Tool · Also: Binary · Full entry}
• UE Explorer - Explore Unreal packages through class, property, and dependency trees; decompile and export UnrealScript classes, inspect bytecode, and examine structured binary data. _{Tool · Also: Binary · Full entry}
• GARbro - Browse recognized visual-novel resource archives as folders, preview their contents, and extract images or audio with conversion to common formats. _{Tool · Full entry}
• Godot RE Tools - Recover supported Godot project files, GDScript and imported resources from exported games. _{Tool · Full entry}
• UE4SS - Inspect Unreal Engine games at runtime through live UObject property views, reflected C++ header dumps, property mappings and actor dumps. _{Tool · Full entry}
• FModel - Explore Unreal Engine game archives with CUE4Parse-backed package and property inspection, asset previews and export. _{Tool · Full entry}
• PSP Web Recomp - Translate PSP MIPS executables into C++ and WebAssembly, backed by a PSP high-level emulation runtime and WebGL2 renderer. _{Project · Also: Website · Full entry}
• N64: Recompiled - Statically recompiles N64 MIPS binaries into C functions from symbol metadata, emitting function lookups and relocation macros so a runtime can handle statically linked and relocatable overlays. _{Tool · Also: Binary · Full entry}
• XenonRecomp - Converts Xbox 360 PowerPC executables into C++ that can be compiled for other platforms, with the XenonAnalyse companion detecting jump tables and function boundaries. _{Tool · Also: Binary · Full entry}
• decomp.me - Collaborative decompilation website for matching work: its compile service builds candidate source with a selected platform compiler, assembles the target assembly and diffs the two objects with asm-differ. _{Tool · Also: Binary · Full entry}
• splat - Binary splitter for decompilation and modding projects: a YAML config says where and how to cut an N64 ROM or PSX, PS2 or PSP binary into code, data and asset segments. _{Tool · Also: Binary · Full entry}
• m2c - Decompiler for matching projects that turns GNU as-format 32-bit MIPS, ARM, PowerPC and SuperH assembly into draft C, with partial C++ support. _{Tool · Also: Binary · Full entry}
• decomp-toolkit - GameCube/Wii matching-decompilation toolkit that analyzes DOL and REL executables and, from a project configuration, splits them into relocatable objects plus an ldscript.lcf for CodeWarrior's linker, so decompiled objects can replace original ones while the relinked binary is checked against the original. _{Tool · Also: Binary · Full entry}
• Cheat Engine MCP Bridge - Connects MCP clients to Cheat Engine through a Lua bridge script and a Python MCP server, so an agent can inspect a process the user runs under Cheat Engine: memory reads and value scans, pointer-chain resolution, structure dissection, RTTI class names, disassembly, cross-references and hardware or DBVM breakpoints. _{Integration · Independent MCP · Also: Binary · Full entry}
• ido-static-recomp - Statically recompiles the IRIX MIPS programs of SGI's IDO 5.3 and 7.1 C toolchain, such as cc, cfe, uopt, ugen and as1, into native Linux, macOS and Windows executables, so matching decompilation projects can build with the original compiler code on modern hosts. _{Tool · Also: Binary · Full entry}
• PS2Recomp - Experimental static recompiler that translates MIPS R5900 code from PlayStation 2 ELF executables into C++ and links it with a bundled runtime. _{Tool · Also: Binary · Full entry}
• Xenosaga I Decomp Compatibility Kit - Checks a PS2 matching decompilation from outside its own build: the C is recompiled with a stock, unpatched ee-gcc 2.96 and assembler, then each function is byte-compared against the original and every difference is classified by its likely toolchain cause. _{Tool · Also: Binary · Full entry}
• GB Recompiled - Static recompiler that turns Game Boy and Game Boy Color ROMs into portable C projects: it decodes and analyzes banked LR35902 code, emits C with machine-readable metadata, and links it with a shared SDL2 runtime for video, audio, input, saves and hardware timing. _{Tool · Also: Binary · Full entry}
• dtk-template - Project template for starting GameCube and Wii matching-decompilation repositories around decomp-toolkit. _{Tool · Full entry}
• N64ModernRuntime - Runtime for N64Recomp static recompilations and traditional source ports of N64 games, made of two libraries. _{Tool · Full entry}
• REDscript - Compiler and decompiler toolkit for REDscript, a statically typed, object-oriented language for writing scripts for REDengine, CD Projekt's engine used in Cyberpunk 2077. _{Tool · Full entry}
• Spice86 - PC emulator for executing, reverse engineering and rewriting real-mode DOS programs whose source code is unavailable. _{Tool · Also: Binary · Full entry}
• PS2 Web Recomp - Statically recompiles PlayStation 2 games for the browser: eerecomp translates the Emotion Engine code of a game's boot executable into C++ that is compiled to WebAssembly, and a runtime emulates the rest of the console, including a high-level EE kernel, an interpreted I/O processor running the disc's IRX modules, the vector units, SPU2 sound and the Graphics Synthesizer on WebGPU compute shaders. _{Tool · Also: Binary · Full entry}
• xboxrecomp - Static-recompilation toolkit for original Xbox games: a Python pipeline parses a retail XBE, disassembles it, classifies library functions, recovers calling conventions and lifts every x86 function to C. _{Tool · Also: Binary · Full entry}
• PCSX-Redux - PlayStation 1 emulator forked from PCSX and built around development and reverse engineering, with an interpreter and dynamic recompiler, software and OpenGL renderers, a MIPS debugger, VRAM viewer, SPU and GPU debugging tools, and a built-in GDB server that its documentation connects to gdb, IDA Pro and Ghidra's debugger. _{Tool · Also: Binary · Full entry}
• Il2CppInspector - Static analysis tool for Unity IL2CPP applications that reads an IL2CPP binary with its global-metadata.dat and outputs the application's type structure and method addresses as C# stub code, .NET assembly shim DLLs for decompilers such as ILSpy and dnSpy, IDA and Ghidra Python scripts that apply symbols and types, C++ type scaffolding and JSON address maps. _{Tool · Also: App, Binary · Full entry}
• MelonLoader - Mod loader for Unity games on both the Mono and IL2CPP runtimes, which loads plugins and mods from folders in a locally installed game; on Windows a proxy DLL, version.dll by default, starts it with the game. _{Tool · Full entry}
• BepInEx - Plugin and patching framework for Unity Mono, Unity IL2CPP and .NET Framework games such as XNA, FNA and MonoGame titles, which loads mods and analysis plugins into a locally installed game. _{Tool · Full entry}
• ReXGlue SDK - Experimental SDK for statically recompiling Xbox 360 executables into portable C++23 that runs natively on Windows, Linux and macOS. _{Tool · Also: Binary · Full entry}
• ps3recomp - Toolkit and runtime for statically recompiling PlayStation 3 games into native executables. _{Tool · Also: Binary · Full entry}
• Nebula (NebulaFD) - Work-in-progress decompiler for games made with Clickteam Fusion 2.5, with fixes for older Multimedia Fusion 1.5 files. _{Tool · Full entry}
• swe1r-assets-unity: Racer model-block editor sample - Work-in-progress Unity editor sample for importing and modifying Star Wars Episode I: Racer model blocks, then serializing them back through swe1r-assets. _{Tool · Full entry}
• LuaJIT Decompiler v2 - Decompiles LuaJIT bytecode files back into Lua source, written as a replacement for the older Python LuaJIT decompiler. _{Tool · Also: Binary · Full entry}
• NTRGhidra - Ghidra loader and plugin for Nintendo DS programs. _{Tool · Full entry}
• mgbdis - Python disassembler that turns a Game Boy or Game Boy Color ROM, including multi-bank ROMs, into RGBDS-compatible assembly plus a Makefile that reassembles it, so the rebuilt ROM can be compared with the input. _{Tool · Also: Binary · Full entry}
• ghidra-allegrex - Ghidra processor module for the Allegrex CPU of the PlayStation Portable, derived from Ghidra's MIPS module. _{Tool · Also: Binary, Firmware · Full entry}
• GM8Decompiler - Command-line tool that turns games built with GameMaker 8.0 or 8.1 back into editable .gmk or .gm81 project files. _{Tool · Full entry}
• UELib (Unreal-Library) - C# library that reads Unreal Engine 1, 2 and 3 package files such as .u, .upk and .udk, auto-detects a matching game build and deserializes their exports, imports and properties. _{Tool · Full entry}
• DiztinGUIsh - Windows disassembler for Super NES ROMs in which the user marks bytes as code or data, steps through 65816 code while the tool tracks the M and X flags and the data bank and direct page registers, adds labels and comments, and exports assembly for the asar assembler that the README says compiles back into the original binary. _{Tool · Full entry}
• Zygisk-Il2CppDumper - Zygisk module by Perfare, the Il2CppDumper author, that dumps type metadata from inside a Unity IL2CPP Android app while it runs. _{Tool · Also: App · Full entry}
• UABEA - Cross-platform reader and writer for the asset bundles and serialized asset files of Unity games, an independent project that started from the archived UABE. _{Tool · Full entry}
• AssetStudio - Tool for exploring, extracting and exporting the assets and asset bundles of Unity versions 3.4 to 2022.1. _{Tool · Full entry}
• vgmstream - Library and tools that decode streamed, prerecorded video game audio in hundreds of formats and codecs, from common game engine files to single-game codecs, including looped music, subsongs, companion files, custom containers and encryption keys. _{Tool · Full entry}
• pkg-to-anyps5 - pkg-to-anyps5 extracts PS5 debug game packages or game folders into the layout expected by the AnyPS5 relinker. _{Tool · Full entry}
• dfsdk - dfsdk dumps Delta Force object metadata by enumerating its object array, decoding per-entry XOR-encrypted names and walking class super chains and property lists. _{Tool · Full entry}
• KBot - KBot inspects and transforms Total Annihilation and TA: Kingdoms game files, pairing a Go CLI with a proprietary format reference. _{Tool · Full entry}
• BNDExtract - BNDExtract is a Go command-line tool for extracting the ALL.BND archive used by Kuon and some other FromSoftware PlayStation 2 games. _{Tool · Full entry}
• RE4METoolbox - RE4METoolbox provides command-line utilities for examining and modifying Resident Evil 4 Mobile Edition files. _{Tool · Full entry}
• Aspyr Archive Tool - Aspyr Archive Tool unpacks and rebuilds Android OBB archives used by three Aspyr game ports: Star Wars: Knights of the Old Republic II, Jade Empire: Special Edition and Fahrenheit: Indigo Prophecy Remastered. _{Tool · Full entry}
• ScriptSource-Dumper - ScriptSource-Dumper extracts scripts from Call of Duty: Black Ops II scriptsrc.clump archives. _{Tool · Full entry}
• .AUP-File-Type-Decryptor-and-Viewer - .AUP-File-Type-Decryptor-and-Viewer is a local browser tool for inspecting Dragon Soul .aup game asset files. _{Tool · Full entry}
• Universal GBA Pokedex - Universal GBA Pokedex scans Game Boy Advance Pokémon ROMs to locate and display evolution, name and item tables. _{Tool · Full entry}
• VG Reverse Engineering - VG Reverse Engineering decodes Vainglory: Community Edition replay files into recorded player names, heroes, K/D/A, items, gold and scoreboard counters. _{Tool · Full entry}
• Chip-8 Emulator and c8-disassembler - The c8-disassembler in Chip-8 Emulator translates CHIP-8 ROM opcodes into assembly instructions. _{Tool · Full entry}
• BGI Converter TGA - BGI Converter TGA analyzes BGI-Ethornell game image files and converts custom RGB or RGBA layouts and BMP images into 32-bit TGA. _{Tool · Full entry}
• Xenus DT1 Decompiler - Xenus DT1 Decompiler extracts DT1 and DT2 texture caches from Xenus 2: White Gold and Boiling Point: Road to Hell; its current decoder has not been tested with The Precursors. _{Tool · Full entry}
• GRB Modding Knowledgebase - GRB Modding Knowledgebase documents Ghost Recon: Breakpoint’s Anvil .forge archives, nested .data resources and asset replacement workflow. _{Project · Full entry}
• psp-media-slopkit - psp-media-slopkit analyses PSP XMB ICON1.PMF and SND0.AT3 files using format findings derived from retail game samples. _{Tool · Full entry}
• DualRip - DualRip extracts Nintendo DS sound effects and music from SDAT archives and Nintendo 3DS audio from CSAR archives, including ROM inputs. _{Tool · Full entry}
• YGO-PoC Toolset - YGO-PoC Toolset handles resource and save formats from Yu-Gi-Oh! _{Tool · Full entry}
• FH6 Model Tools - FH6 Model Tools parses reverse-engineered Forza Horizon 6 asset formats, including burG model and texture containers. _{Tool · Full entry}
• Ed1th's PvZ Toolkit - Ed1th's PvZ Toolkit inspects and edits Plants vs. Zombies resource archives and files through a desktop or web interface backed by Rust format libraries. _{Tool · Full entry}
• kenshi-modkit - kenshi-modkit parses and writes Kenshi .mod and .base files and reads its .save, .zone and .platoon files using Python. _{Tool · Full entry}
• ffxii-tza-tools - ffxii-tza-tools documents and processes FINAL FANTASY XII The Zodiac Age character formats, including .ca animations, .cm models and .phyre assets. _{Tool · Full entry}
• sims-package2glb - sims-package2glb extracts models from The Sims 2, 3 and 4 .package files into glTF binary files. _{Tool · Full entry}
• vc64_240p - vc64_240p analyses and patches the N64 Virtual Console emulator inside Wii WAD channels to output 240p. _{Tool · Also: Binary · Full entry}
• Unrpyc - Unrpyc is a tool that decompiles compiled Ren'Py game scripts into readable script files. _{Tool · Full entry}
• BSPSource - Java map decompiler that turns Source engine .bsp map files back into .vmf files that can be loaded in Hammer. _{Tool · Full entry}
• PKHeX - PKHeX is a C# Windows Forms editor for Pokémon core-series save data. _{Tool · Full entry}
• nxnative - nxnative is a tool that packages Nintendo Switch games as apps that run their code natively on Apple hardware, with graphics translated to Metal. _{Tool · Also: Binary · Full entry}
• UE5 BINKA to WAV - Rejoins UE5 BINKA audio exported by FModel and calls an external Bink decoder to produce WAV files, with a Windows GUI, batch CLI and paired-asset metadata warnings. _{Tool · Full entry}
• PsyZ - C porting library that replaces the API of PSY-Q, Sony's PlayStation runtime library, with native implementations, so decompiled or original PlayStation source can be compiled for Linux, macOS, iOS, Windows, WebAssembly and PSP while still building for the console. _{Tool · Full entry}
• GCRecomp - GCRecomp is a static recompiler that translates GameCube PowerPC DOL binaries into Rust and then into native executables. _{Tool · Full entry}
• GBA-Recomp - GBA-Recomp is a Rust static-recompilation toolkit and runtime for Game Boy Advance cartridges. _{Tool · Full entry}
• Kappa - Kappa is a Visual Studio Code extension for decompilation work. _{Tool · Full entry}
• Panda3DS - High-level Nintendo 3DS emulator written in C++. _{Tool · Full entry}
• Xbox XBE Recomp - Xbox XBE Recomp creates native PC ports of original Xbox games by statically recompiling an XBE's x86 code to C++ and implementing Xbox kernel and XDK libraries on Windows, with Direct3D 12 rendering and XAudio2 playback. _{Tool · Full entry}
• ModernGekko - ModernGekko is a runtime for GameCube and Wii recomps. _{Tool · Full entry}
• Retro Launcher - Retro Launcher catalogs and installs recomps that compile on the user's machine. _{Tool · Full entry}
• DSLuaDecompiler - DSLuaDecompiler decompiles Lua scripts from FromSoftware games for modding. _{Tool · Full entry}
• Balamod - Balamod is a mod loader, injector, and decompiler for the game Balatro. _{Tool · Full entry}
• SR - SR statically recompiles DOS and Windows game executables into Windows, Linux, or macOS builds. _{Tool · Full entry}
• NESRecomp - NESRecomp is a beta static-recompilation framework for NES and Famicom games. _{Tool · Full entry}
• SNESRecomp - SNESRecomp is a beta static-recompilation framework for the Super Nintendo and Super Famicom. _{Tool · Full entry}
• ndsrecomp - ndsrecomp is a pre-alpha static recompiler for the Nintendo DS. _{Tool · Full entry}
• Genesis Recomp - Genesis Recomp is a beta static-recompilation framework for the Sega Genesis, Mega Drive, Sega CD, and Mega-CD. _{Tool · Full entry}
• Decomp Buddy - Decomp Buddy is a Mac, Windows, and Linux application that sets up decompilations, recompilations, and native PC ports from the player's own game files. _{Tool · Full entry}
• yukatool - yukatool works with the Yuka System visual novel engine used by Hooksoft, Smee, PeasSoft, and feng. _{Tool · Full entry}
• OpenRS2 - OpenRS2 develops a server compatible with RuneScape client build 550 and associated client-analysis tools. _{Project · Full entry}
• gore - gore recovers a Godot game into a project that opens in the Godot editor. _{Tool · Full entry}
• Warband module decompiler - This decompiles Mount & Blade: Warband modules. _{Tool · Full entry}
• MiiJS - MiiJS reads, writes, converts, and renders Nintendo Mii data in JavaScript. _{Tool · Full entry}
• psprecomp - psprecomp is a C11 toolkit that statically recompiles PlayStation Portable Allegrex MIPS binaries into C. _{Tool · Full entry}
• Silver SCT tool - This tool reads and writes .sct script files from Silver, the 1999 action RPG. _{Tool · Full entry}
• THPS2 tools - These tools read Tony Hawk's Pro Skater 2 files and overlapping Neversoft Big Guns formats. _{Tool · Full entry}
• SaturnRecomp - SaturnRecomp is a Sega Saturn research toolkit with a disc CLI, an SH-2 execution core, and a Windows SDL2 runner. _{Tool · Full entry}
• YukaTool - YukaTool reads archives from the Yuka System visual-novel engine. _{Tool · Full entry}
• bnGB - bnGB is a Binary Ninja plugin that loads Game Boy ROMs and disassembles Sharp LR35902 bytecode. _{Tool · Full entry}
• RecompOne - RecompOne statically translates PlayStation 1 MIPS instructions into C# and supplies a runtime for BIOS calls, MMIO, GPU commands, and CD-ROM access. _{Tool · Full entry}
• Rusted PackFile Manager - Rusted PackFile Manager is a Rust and Qt6 reimplementation of PackFile Manager. _{Tool · Full entry}
• PSXRecomp - PSXRecomp translates PlayStation 1 MIPS binaries into C and links them with a hardware runtime. _{Tool · Full entry}
• Poryscript - Poryscript compiles a higher-level script into the script bytecode used by pokeemerald, pokefirered, and pokeruby. _{Tool · Full entry}
• OverPy - OverPy is a Python-like language for the Overwatch Workshop. _{Tool · Full entry}
• homm3 unpacker - homm3 unpacker parses Heroes of Might and Magic III LOD archives, DEF animations and PCX images in Node.js or modern browsers. _{Tool · Full entry}
• LEGO Dimensions Save Converter - LEGO Dimensions Save Converter translates game saves among Xbox 360, PS3, PS4 and Wii U formats and into a ReXGlue layout. _{Tool · Full entry}
• pureikyubu - pureikyubu emulates Nintendo GameCube hardware to study the console and technologies used by its games. _{Tool · Full entry}
• GiiBiiAdvance - GiiBiiAdvance is a GB, GBC and GBA emulator with debugger windows for inspecting game execution. _{Tool · Full entry}
• Space Invaders Emulator - Space Invaders Emulator models the arcade game's Intel 8080 CPU, graphics and sound and includes tools for inspecting its ROM code. _{Tool · Also: Binary · Full entry}
• WoW.tools but local - WoW.tools but local inspects a local World of Warcraft installation through a browser interface. _{Tool · Full entry}
• DemoInfo - DemoInfo reads Counter-Strike: Global Offensive demo files through a C# library for replay analysis. _{Tool · Full entry}
• Demoparser - Demoparser analyzes Counter-Strike 2 replay files with a Rust parser exposed through Python, JavaScript and WebAssembly packages. _{Tool · Full entry}
• Mesen - Mesen is an NES/Famicom emulator with tools for inspecting game execution and graphics. _{Tool · Full entry}
• D2s - D2s is a Go parser for Diablo II .d2s character saves. _{Tool · Full entry}
• w3gjs - w3gjs parses Warcraft III .w3g replay files in TypeScript for game analysis. _{Tool · Full entry}
• ZenKit - ZenKit is a C++ library for parsing ZenGin file formats used by Gothic and Gothic II. _{Tool · Full entry}
• wow_chunky - Parses World of Warcraft chunked game files in Rust, including WDT and ADT maps and DXT-compressed BLP images. _{Tool · Full entry}
• dungeon-siege-re - dungeon-siege-re analyzes asset formats used by Dungeon Siege and Legends of Aranna and supplies C++ extraction and conversion tools. _{Tool · Full entry}
• PacmanRecomp - PacmanRecomp currently loads Pac-Man's arcade ROM files, concatenates the program chips and writes a Z80 assembly listing. _{Tool · Full entry}
• SilentHillToolkit - SilentHillToolkit contains a C# routine that decrypts Silent Hill overlay code files by XORing successive 32-bit words with a generated key stream. _{Tool · Full entry}
• StoicGoose - StoicGoose emulates Bandai WonderSwan and WonderSwan Color games and includes a separate Dear ImGui interface for debugging and disassembly. _{Tool · Full entry}
• reGML - reGML inspects GameMaker game packages, disassembles their bytecode, and runs supported games from data.win files. _{Tool · Full entry}
• FortniteReplayDecompressor - FortniteReplayDecompressor parses Fortnite replay files with a C# library and example reader. _{Tool · Full entry}
• mgz - mgz parses Age of Empires II recorded games into Python structures and summaries. _{Tool · Full entry}
• sky-reenigne - sky-reenigne extracts and analyses resource files from the 1994 DOS game Beneath a Steel Sky. _{Tool · Full entry}
• DSHBA - DSHBA emulates Game Boy Advance games and provides an ImGui debugger for examining memory, registers, and execution. _{Tool · Full entry}
• Manta - Manta parses Dota 2 replay files from the Source 2 engine in Go. _{Tool · Full entry}
• Mobiclip Decoder - Mobiclip Decoder decodes Nintendo game video formats using a Mobiclip implementation the author attributes to disassembly. _{Tool · Full entry}
• Mesen-S - Mesen-S is an SNES emulator with facilities for examining game execution and graphics. _{Tool · Full entry}
• OpenCity2k - OpenCity2k provides Python parsers and utilities for SimCity 2000 game data. _{Tool · Full entry}
• faf-scfa-replay-parser - faf-scfa-replay-parser reads Supreme Commander: Forged Alliance replay files into headers, command messages and timing data. _{Tool · Full entry}
• Rocket League Replay Parser - Rocket League Replay Parser decodes Rocket League replay files into C# objects that can be serialized to JSON. _{Tool · Full entry}
• GBFRDataTools - GBFRDataTools extracts and converts Granblue Fantasy: Relink archives and data files, including data.i, .tbl tables, textures and several structured UI formats. _{Tool · Full entry}
• demoinfocs-golang - demoinfocs-golang parses Counter-Strike 2 and Counter-Strike: Global Offensive replay files in Go. _{Tool · Full entry}
• SSF2T Decomp - SSF2T Decomp provides Python tools and documentation for examining the CPS2 ROM layout of Super Street Fighter 2 Turbo. _{Tool · Full entry}
• Reevengi - Reevengi inspects game data from several PlayStation and PC releases of Resident Evil 1, 2 and 3. _{Tool · Full entry}

↑ Contents

233 case studies. The 10 newest are below. Full case list.

• ag-psd: reconstructing PSD document reading and writing - ag-psd reconstructs reading and writing of Photoshop PSD documents in JavaScript and TypeScript using format references and trial and error. _{Case study · Independent reconstruction · Full entry}
• AionLink Open: investigating ICCOA CarLink connectivity for the GAC AION i60 - AionLink Open investigates ICCOA CarLink connectivity for the GAC AION i60 through static analysis of Android APKs and an independently written Android client. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• AirTray: reconstructing an Elgin Air cloud client - AirTray reconstructs an Elgin Air app client as a Windows system-tray controller for compatible air conditioners. _{Case study · Independent reconstruction · Full entry}
• AvatarEditorRecomp: a Kinect-preview Avatar Editor PC port - AvatarEditorRecomp statically recompiles the Fall 2010 Kinect-preview Xbox 360 Avatar Editor into a PC application with ReXGlue. _{Case study · Independent reconstruction · Full entry}
• baseus-desktop: reconstructing Baseus earbuds control - baseus-desktop reconstructs Baseus earbuds control in a Windows and Linux desktop client. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• bline: decoding LINE voice-call traffic - bline investigates an earlier LINE voice-call stack and supplies tools for its custom ZLIB-compressed SIP data. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• cam-server: reconstructing the Digicam Print Channel backend - cam-server implements a backend for the Digicam Print Channel, producing responses in the format the client expects and rendering images from its templates. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• caniOn Rebirth: reconstructing the Mitsubishi ZEV CAN client and protocol - caniOn Rebirth reconstructs the Mitsubishi ZEV CAN protocol used by the caniOn v152 Android app for the i-MiEV, iOn and C-Zero. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• claude-peer: reconstructing Claude's local peer IPC - claude-peer reconstructs the local Unix socket peer exchange used by Claude Code and Claude Desktop. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• Cordial: hosting the Roblox Android client on Linux - Cordial hosts the unmodified Roblox Android client on Linux through a ported bionic linker, ELF import resolution and substitutes for Android JNI and framework calls. _{Case study · Independent reconstruction · Full entry}

• JADX-AI-MCP - JADX plugin paired with a Python MCP server to inspect decompiled Android classes, resources, cross-references and debugger context. _{Integration · Independent MCP · Full entry}
• apktool-mcp-server - Python MCP server that drives a local Apktool install so agents can decode APKs; list, read, search and edit smali and resource files; read AndroidManifest.xml and apktool.yml; and rebuild the project. _{Integration · Independent MCP · Full entry}
• frida-mcp (yfe404) - Frida MCP server with persistent instrumentation sessions, runtime inspection and Android static-to-dynamic navigation. _{Integration · Independent MCP · Also: Game · Full entry}
• Super Trouper - Single-binary Frida MCP server for discovering devices, managing process sessions and loading instrumentation scripts. _{Integration · Independent MCP · Also: Game · Full entry}
• Frida - Dynamic instrumentation toolkit for observing and scripting the behavior of live native and managed processes. _{Tool · Also: Game · Full entry}
• JADX - Dex-to-Java decompiler with CLI/GUI navigation, resource decoding and cross-reference search for Android packages. _{Tool · Android · Full entry}
• Apktool - Decodes Android resources and smali into a project-like tree and can rebuild modified packages. _{Tool · Android · Full entry}
• Androguard - Python toolkit for APK/DEX metadata, bytecode and reference analysis; the v5 source branch also documents agent skills and MCP. _{Tool · Android · Full entry}
• ILSpy - .NET assembly browser and C# decompiler with whole-project export, metadata inspection and a scriptable command-line frontend. _{Tool · .NET · Full entry}
• dnSpyEx - Community continuation of dnSpy for debugging and editing .NET assemblies without the original source. _{Tool · .NET · Full entry}
• @electron/asar - Electron's archive tool lists and extracts ASAR contents so packaged JavaScript and application assets can be inspected. _{Tool · Also: Website · Full entry}
• Mobile Security Framework (MobSF) - Inspect mobile application packages with static analysis and supported-device dynamic testing, including runtime behavior and network traffic, through a web interface and APIs. _{Tool · Android · Full entry}
• objection - Explore running Android and iOS apps with a Frida-backed command interface for inspecting app storage, memory, runtime objects, and instrumented behavior. _{Tool · Android · Full entry}
• Grapefruit - Inspect and hook running iOS and Android apps from a Frida-based web interface, with method and crypto-API hooks, filesystem and SQLite browsers, iOS keychain and UI-hierarchy views, and HTTP capture from common networking libraries. _{Tool · Full entry}
• Blutter - Analyze Flutter Android ARM64 AOT binaries using the matching Dart runtime. _{Tool · Android · Also: Binary · Full entry}
• hermes-dec - Parse, disassemble and partially decompile React Native Hermes bytecode bundles. _{Tool · Android · Full entry}
• Recaf - Inspect and modify compiled JVM applications with integrated decompilers, bytecode assembly, reference search, mappings and deobfuscation tools. _{Tool · JVM · Also: Binary · Full entry}
• nibkit - Decode compiled iOS/macOS interface archives into object trees, Outlet/Action connections, custom classes and navigation relationships. _{Tool · Full entry}
• AOTopsy - Statically inspect Flutter/Dart AOT libapp.so files to recover available metadata, class structures, call edges and pseudocode without embedding a Dart VM or compiling a matching SDK. _{Tool · Android · Also: Binary · Full entry}
• hbctool - Disassemble and reassemble supported React Native Hermes bytecode bundles through HASM files, enabling bytecode inspection and editing for the explicitly supported legacy HBC versions. _{Tool · Android · Full entry}
• Vineflower - Fernflower-derived decompiler for Java and other JVM languages that continues the ForgeFlower, Fabric and Quiltflower forks, focused on output quality and modern Java, including records, sealed classes, switch expressions and pattern matching through Java 21+. _{Tool · JVM · Full entry}
• Droid ASC - Python Android decompiler that answers queries directly against an APK instead of first unpacking and indexing it. _{Tool · Android · Full entry}
• APKEditor - Command-line APK editor built on ARSCLib that decodes an APK's binary resources and DEX into editable JSON, XML or smali and rebuilds a package from them, independent of aapt and aapt2. _{Tool · Android · Full entry}
• jnitrace - Frida-based dynamic-analysis tool that traces an Android app's use of the JNI API, similar to frida-trace or strace but for the Java Native Interface. _{Tool · Android · Full entry}
• AsmResolver - C# library for reading, modifying and rebuilding Portable Executable files, covering both native Windows images and images with .NET metadata. _{Tool · .NET · Also: Binary · Full entry}
• CodemerxDecompile - Cross-platform desktop .NET decompiler maintained by the original JustDecompile creators as a continuation of their JustDecompile Engine, built with Mono.Cecil and an Avalonia UI. _{Tool · .NET · Full entry}
• wxapkg - Desktop GUI for Windows and macOS, built with Wails, that unpacks WeChat mini-program .wxapkg packages for study. _{Tool · Full entry}
• React Native Decompiler - Alpha-stage Node.js CLI that splits a React Native JavaScript bundle (index.android.bundle or main.jsbundle), an unbundled js-modules folder, or Webpack entrypoint and chunk bundles into one readable file per module. _{Tool · Full entry}
• hermes-decomp - Rust decompiler and analysis toolkit for Hermes bytecode (.hbc), the compiled form React Native apps ship for the Hermes engine; the README lists HBC versions 40 to 99. _{Tool · Android · Full entry}
• MEDUSA - Modular Frida-based framework for runtime analysis of Android and iOS apps the analyst is authorized to test. _{Tool · Android · Full entry}
• Android Unpinner - Tool from the mitmproxy project that removes certificate pinning from an Android APK you own or are authorized to test, without a rooted device. _{Tool · Android · Also: Protocol · Full entry}
• apk-mitm - Command-line tool that prepares an Android APK you own or are authorized to test for HTTPS traffic inspection. _{Tool · Android · Also: Protocol · Full entry}
• Frida Mobile Interception Scripts - A set of Frida scripts from HTTP Toolkit for inspecting a mobile app's HTTPS traffic while analysing apps you own or are authorized to test. _{Tool · Android · Also: Protocol · Full entry}
• reFlutter - Flutter reverse-engineering framework for apps the analyst is authorized to inspect. _{Tool · Android · Also: Protocol · Full entry}
• ddc - Rust decompiler that turns Android DEX bytecode, versions 035 to 041, from APKs, multi-dex apps and XAPK/APKS/APKM containers into Java, folding lambdas and string concatenation back into Java syntax and giving locals jadx-style names. _{Tool · Android · Full entry}
• Simplify - Generic Android deobfuscator built on smalivm, a sandboxed Dalvik virtual machine that executes each method and records every possible register and class value along all execution paths, taking both branches when a value such as file or network input is unknown. _{Tool · Android · Full entry}
• GDA (GJoy Dex Analyzer) - Windows-native Dalvik decompiler and Android analysis workbench written in C++ that opens APK, DEX, ODEX, OAT, JAR, AAR and class files without installation. _{Tool · Android · Full entry}
• APKLab - VS Code extension that turns the editor into an Android reverse-engineering workbench around Apktool, Jadx, smali-lsp and uber-apk-signer. _{Tool · Android · Full entry}
• Fernflower - JetBrains' analytical decompiler that turns Java class files back into Java source; IntelliJ IDEA bundles it to show code when debugging or browsing class files. _{Tool · JVM · Full entry}
• Bytecode Viewer - Desktop suite for inspecting compiled Java and Android programs: drop in a class, JAR, WAR, APK, DEX, XAPK or APKM file to browse its classes and resources, with up to three decompiler or disassembler views side by side. _{Tool · JVM · Full entry}
• Logic-Lens - Experimental JavaScript source-analysis toolkit that classifies AST-token sequences into configured formula families after local training, and produces heuristic structure, call-graph and intent reports. _{Tool · Full entry}
• Android Security Toolkit - Local Python APK triage tool that drives apktool and strings, checks manifest settings and source/native-library strings, and produces TXT/JSON findings for manual review. _{Tool · Android · Full entry}
• ilspy-cli: targeted .NET decompilation for agents - Rust CLI that hosts an ILSpy C# bridge in-process for assembly, type and named-method decompilation, source search and structured JSON output. _{Tool · .NET · Full entry}
• React-Decode - Static-analysis CLI for compiled React JavaScript that produces readable bundle output and inferred API-request, route and application-constant reports. _{Tool · Also: Website · Full entry}
• abc-decompiler - Decompiler for HarmonyOS Ark bytecode (.abc), the format HarmonyOS app packages carry in modules.abc, built by adapting the jadx decompiler and reading files through a patched copy of the abcde library. _{Tool · Android · Full entry}
• slicer - Browser-based Java reverse-engineering tool that loads class files and JAR/ZIP archives and disassembles or decompiles them with Vineflower (the default), CFR, Procyon or JASM, compiled to run in the browser, next to its own bytecode disassembler. _{Tool · JVM · Full entry}
• APK Studio - Qt6 desktop front end that drives Apktool, JADX, uber-apk-signer and ADB from an IDE-style workspace for Android packages. _{Tool · Android · Full entry}
• APKiD - PEiD-style identifier for Android packages from RedNaga. _{Tool · Android · Full entry}
• dex2jar - Java toolkit that converts Android DEX bytecode, including DEX inside APKs, into JVM .class files packed as a jar for Java decompilers and bytecode tools. _{Tool · Android · Full entry}
• apk.sh - Bash script that automates repetitive Android app analysis chores around apktool: pulling an installed package from a device or emulator, decoding resources and disassembling dex code, and rebuilding the decoded directory into an APK. _{Tool · Android · Full entry}
• FIRERPA (lamda) - Client/server Android automation and dynamic-analysis platform for devices the analyst is authorized to test. _{Tool · Android · Full entry}
• Binder Trace - Frida-based terminal tool, described by its authors as "Wireshark for Binder", that intercepts the Binder IPC transactions an Android process sends and parses each message and its reply. _{Tool · Android · Also: Protocol · Full entry}
• Quark-Engine - Rule-based engine for analysing suspicious Android apps: it loads an APK's Dalvik bytecode and checks JSON behaviour rules, each naming permissions and a pair of framework API calls, through five confidence stages, from the permission being requested and either API being called up to both calls appearing in order in one method and passing the same register. _{Tool · Android · Full entry}
• Dexcalibur (Reversense) - Android reverse-engineering platform that combines static analysis with Frida-based dynamic instrumentation; the master branch is Reversense (Dexcalibur 2.0), a rewrite that runs as a Node.js web server for collaborative projects. _{Tool · Android · Full entry}
• vdexExtractor - Command-line C tool that extracts the Dex bytecode held in the Vdex containers that ART's dex2oat compiler writes beside Oat files since Android 8.0 (API 26), and by default reverts ART's dex-to-dex quickening so the output is ordinary Dex again. _{Tool · Android · Full entry}
• Garlic - Java and Android decompiler written in C that recovers Java source from class, JAR, WAR, DEX and APK files on multiple threads; it also prints javap- or dexdump-style class listings, converts APK and DEX files to smali, searches their strings with regular expressions and generates call graphs for DEX and APK files. _{Tool · Android · Full entry}
• Android-Disassembler - On-device disassembler and binary viewer for Android, built on Capstone, that opens ELF shared libraries and executables, object files, Windows PE files, .NET assemblies, dex files and APKs chosen from storage or from installed apps. _{Tool · Android · Also: Binary · Full entry}
• XAPKDetector - APK and DEX detector from hors, the author of Detect-It-Easy, that reports the build tools, libraries and protections it identifies in Android packages, using scan engines and signature databases from the Detect-It-Easy family. _{Tool · Android · Full entry}
• Jsxer - C++ decompiler for JSXBIN, the binary format of Adobe's legacy ExtendScript, the ECMAScript 3 dialect used to script applications such as Photoshop, InDesign and After Effects. _{Tool · Full entry}
• jni_helper - Static helper by evilpan for reverse engineering Android JNI code. _{Tool · Android · Also: Binary · Full entry}
• ReArk - Desktop reverse-engineering and AI-assisted analysis workbench for HarmonyOS NEXT packages (.hap, .app and .abc), whose binary releases add Android .apk/.aab, iOS .ipa and standalone PE, ELF and Mach-O analysis. _{Tool · Android · Also: Binary · Full entry}
• ARSCLib - Java library, modeled on AOSP's androidfw ResourceTypes.h and meant to replace aapt/aapt2, that reads, writes, modifies and creates Android resource tables (resources.arsc) and binary XML files such as AndroidManifest.xml. _{Tool · Android · Full entry}
• Pithus (bazaar) - Self-hostable Django platform behind the Pithus Android analysis service, which its README describes as built for activists, journalists, NGOs and researchers. _{Tool · Android · Full entry}
• House - NCC Group’s Python and Flask web interface for Frida-based runtime analysis of Android apps, intended to make writing Frida scripts simpler. _{Tool · Android · Full entry}
• ABCDE - Kotlin toolkit for OpenHarmony reverse engineering that parses Ark bytecode (.abc) files, the format HarmonyOS app packages carry in modules.abc, along with HAP packages and resource index (.index) files. _{Tool · Android · Full entry}
• de4js - Browser-based JavaScript deobfuscator and unpacker, built as a Jekyll site that also works offline as a progressive web app. _{Tool · Also: Website · Full entry}
• DexKit - C++ DEX parsing library with Kotlin and Java APIs that loads an APK, DEX bytes or an app’s class loader and finds classes, methods and fields by their characteristics rather than their obfuscated names. _{Tool · Android · Full entry}
• bun-demincer - Node.js pipeline that recovers readable JavaScript from Bun-compiled standalone executables. _{Tool · Also: Binary · Full entry}
• dex-oracle - Pattern-based Dalvik deobfuscator that takes an APK, a DEX file or a Smali directory, disassembles it with baksmali and runs plugins that look for obfuscation patterns in the Smali code. _{Tool · Android · Full entry}
• arkdecompiler - Decompiler for HarmonyOS NEXT apps, published under the jd-opensource GitHub organization, that turns Panda binary files (.abc Ark bytecode) back into ArkTS source. _{Tool · Android · Full entry}
• JNIAnalyzer - A Ghidra extension by Terry Chia (Ayrx) with scripts for analyzing the native libraries of Android NDK apps. _{Tool · Android · Also: Binary · Full entry}
• Android Reverse - Android app, published only as release APKs, that runs an APK reverse-engineering workflow entirely on the phone, from package extraction and Java decompilation to native analysis, editing and rebuilding. _{Tool · Android · Full entry}
• jsc-decompile-mozjs-34 - PHP decoder and decompiler for SpiderMonkey 34 JavaScript bytecode, which the README says may handle .jsc files compiled by cocos2d-x. _{Tool · Also: Game · Full entry}
• Andromeda - Interactive command-line tool by Lasha Khasaia for first-pass reverse engineering of Android APKs, written in C/C++ for speed. _{Tool · Android · Full entry}
• Dex-Editor-Android - Work-in-progress Android app for editing DEX files on the device, built on a modified in-tree copy of Google's smali, baksmali and dexlib2. _{Tool · Android · Full entry}
• smali/baksmali - Assembler and disassembler for the dex format used by Android's Dalvik VM: baksmali turns dex, APK, odex and oat files into smali text, and smali assembles that text back into a dex file. _{Tool · Android · Full entry}
• dalvikus - Desktop Android reverse-engineering and modification workbench built with Kotlin Compose Multiplatform. _{Tool · Android · Full entry}
• paranoid-deobfuscator - Python command-line tool that recovers the strings hidden by the Paranoid and LSParanoid Android string-obfuscation plugins, so that smali code becomes readable for static analysis. _{Tool · Android · Full entry}
• Katalina - Python emulator for Dalvik bytecode that its README likens to Unicorn: it parses a DEX file and executes methods one instruction at a time, substituting Python mocks for common Java and Android APIs such as String, StringBuilder, Base64, ArrayList, AES Cipher and part of reflection. _{Tool · Android · Full entry}
• Doldrums - Python parser for the Dart AOT snapshots inside libapp.so, the compiled Dart code of an Android Flutter app. _{Tool · Android · Also: Binary · Full entry}
• Frida UI - Local browser interface for Frida aimed at Android app testing: a FastAPI server lists USB, local and remote frida-server devices with their installed apps and running processes, and lets the analyst attach to a process, spawn an app, spawn it with a script injected at launch, detach or kill it. _{Tool · Android · Full entry}
• darter - Python module that parses binary Dart VM snapshots, such as the libapp.so of a release Flutter app, into a navigable graph of VM objects with back-references, including the memory structures the snapshot dumps. _{Tool · Android · Also: Binary · Full entry}
• Appshark - ByteDance's static taint-analysis engine for Android APKs, designed for very large apps, that scans an app against JSON rules naming entry methods, sources, sinks and sanitizers as Jimple signatures, for vulnerability and privacy-compliance review. _{Tool · Android · Full entry}
• Wallbreaker - Frida-based explorer for the live Java heap of a running Android app, loaded as an objection plugin or used through its small Python package. _{Tool · Android · Full entry}
• axmlprinter - Java library and command-line tool that parses Android binary XML, such as the compiled AndroidManifest.xml inside an APK, and prints it as readable XML. _{Tool · Android · Full entry}
• FlowDroid - Static data-flow (taint) analysis for Android apps and Java programs, built on Soot and usable as a command-line tool or as Maven libraries. _{Tool · Android · Full entry}
• Enjarify - Pure-Python 3 translator from Dalvik bytecode to equivalent Java bytecode, so Java analysis tools and decompilers can be applied to Android apps: given an APK, with every DEX file of a multidex APK combined into one jar, or a single DEX file, it writes a jar of class files. _{Tool · Android · Full entry}
• MagiskFrida - Magisk, KernelSU and APatch module that installs frida-server on a rooted Android device and starts it at boot, so Frida clients can attach for dynamic instrumentation without starting the server by hand. _{Tool · Android · Full entry}
• de4dot - Open-source .NET deobfuscator and unpacker that tries to restore a packed and obfuscated assembly to almost its original form. _{Tool · .NET · Full entry}
• ClassyShark - Google's standalone browser for Android executables and libraries that shows class interfaces and members, dex counts and dependencies. _{Tool · Android · Full entry}
• JEB Decompiler - PNF Software's commercial reverse-engineering platform for Android apps and native code, combining a Dalvik decompiler and Android debuggers with disassemblers and decompilers for x86, ARM, MIPS and RISC-V machine code. _{Tool · Android · Also: Binary, Firmware · Full entry}
• Luyten - Graphical Java decompiler front end for the Procyon decompiler, with its editor view powered by RSyntaxTextArea. _{Tool · JVM · Also: Binary · Full entry}
• jd-cli - Command-line wrapper around a jd-core fork that decompiles Java class and JAR files to the console, a directory or a ZIP file, with options for line numbers, file-matching patterns and parallel processing. _{Tool · JVM · Also: Binary · Full entry}
• Android Unpacker - Code and slides from the Defcon 22 talk "Android Hacker Protection Level 0". _{Tool · Android · Full entry}
• ReverseAPK - Command-line tool that decompiles an APK to Java and Smali, lists the extracted files, and statically checks AndroidManifest.xml and the source for common vulnerabilities and behaviours such as intents, command execution, content providers, crypto references and hardcoded secrets. _{Tool · Android · Full entry}
• xHook - PLT hook library for Android native ELF executables and shared libraries. _{Tool · Android · Full entry}
• Epic - Continuation of Dexposed on ART: a runtime method-hooking framework that loads into an app and can hook both the app's own code and Android framework code running in its process. _{Tool · Android · Full entry}
• apkscope - apkscope inspects Android application packages through a Rust viewer, CLI, and MCP server. _{Tool · Android · Also: Binary · Full entry}
• NWBinAnalyzer - NWBinAnalyzer inspects compiled NW.js .bin files by checking their header and walking constant-pool entries. _{Tool · Full entry}
• derkt - derkt parses and disassembles Hermes Bytecode files in Racket. _{Tool · Also: Binary · Full entry}
• ODIS file unpacker - ODIS file unpacker extracts protected Java classes from ODIS plugin JARs and files from its DIDB data archives. _{Tool · JVM · Full entry}
• netdumper - netdumper extracts loaded .NET assemblies from Windows processes through the CLR Data Access Component. _{Tool · .NET · Also: Binary · Full entry}
• Sandwitcher - Sandwitcher instruments Java and Kotlin method calls in Android apps by replacing ART method entry points with a trampoline through Pine and LSPlant. _{Tool · Android · Full entry}
• Zygisk - Frida Gadget - Zygisk - Frida Gadget loads Frida Gadget into selected Android app processes for runtime instrumentation. _{Tool · Android · Full entry}
• dnlib - dnlib is a .NET library for reading and writing modules and assemblies. _{Tool · .NET · Also: Binary · Full entry}
• View8 - View8 is a static analysis tool that decompiles serialized V8 bytecode (JSC) files into readable JavaScript-like text. _{Tool · Also: Binary · Full entry}
• Soot - Soot is a Java optimization framework for analyzing and transforming Java bytecode. _{Tool · JVM · Also: Binary · Full entry}
• DroidLysis - DroidLysis is a pre-analysis tool for Android apps that disassembles samples, organizes their contents, and flags code patterns for further inspection. _{Tool · Android · Also: Binary · Full entry}
• VirtualXposed - VirtualXposed is an Android app that runs Xposed modules alongside apps in a virtual environment without root access, an unlocked bootloader, or a custom system image. _{Tool · Android · Full entry}
• EdXposed Framework - EdXposed is a Riru module that provides an Xposed-compatible ART hooking framework for Android 8.0 through 11. _{Tool · Android · Full entry}
• Vector Framework - Vector Framework is a Zygisk module that provides ART hooking for Android apps. _{Tool · Android · Full entry}
• JustTrustMe - JustTrustMe is an Xposed module that disables SSL certificate checks in Android apps. _{Tool · Android · Full entry}
• DexSQL - Queries classes, methods, fields, strings, call edges and Smali disassembly across Android APK and DEX files with SQL. _{Tool · Android · Full entry}
• smali/baksmali (Google fork) - Assemble and disassemble Android DEX bytecode using Google’s continuation of smali/baksmali. _{Tool · Android · Full entry}
• JD-Core - Embed the Java decompiler engine used by JD-GUI through loader and printer interfaces. _{Tool · JVM · Full entry}
• Mono.Cecil - Inspect and modify .NET metadata and CIL code without loading target assemblies through Reflection. _{Tool · .NET · Also: Binary · Full entry}
• Apk Dependency Graph - Apk Dependency Graph reads an APK and writes an HTML view of class coupling. _{Tool · Android · Full entry}
• apk2gold - apk2gold is a command-line wrapper that decompiles an Android APK toward a single source tree. _{Tool · Android · Full entry}
• AndroidProjectCreator - AndroidProjectCreator converts an APK into an Android Studio project using multiple open-source decompilers. _{Tool · Android · Full entry}
• apkx - apkx is a Python wrapper around free dex converters and Java decompilers that extracts Java source from an APK. _{Tool · Android · Full entry}
• Helios - Helios is a Java reverse engineering application with a file browser and editor. _{Tool · JVM · Also: Binary · Full entry}
• JavaDecompileTool-GUI - JavaDecompileTool-GUI is a desktop front end for the fernflower Java decompiler. _{Tool · JVM · Also: Binary · Full entry}
• dncil - dncil is a Python library that disassembles .NET Common Intermediate Language. _{Tool · .NET · Also: Binary · Full entry}
• droidsaw - droidsaw is a Rust decompiler for Android DEX files and Hermes bundles. _{Tool · Android · Full entry}
• dotscope - dotscope is a Rust framework that parses, disassembles, and modifies .NET PE assemblies and CIL without Windows or the .NET runtime. _{Tool · .NET · Also: Binary · Full entry}
• JD-GUI - JD-GUI is a standalone graphical utility that displays Java source reconstructed from .class files and browses methods and fields. _{Tool · JVM · Also: Binary · Full entry}
• CFR - CFR decompiles Java class files and jars, including Java 9, 12, and 14 features, and is written in Java 6. _{Tool · JVM · Also: Binary · Full entry}
• Krakatau - Krakatau assembles and disassembles Java bytecode, including obfuscated class files, and can reassemble the text back into a class file. _{Tool · JVM · Also: Binary · Full entry}
• ApkToolPlus - ApkToolPlus is a graphical APK analysis tool. _{Tool · Android · Also: Binary · Full entry}
• Procyon - Procyon is a Java metaprogramming suite. _{Tool · JVM · Also: Binary · Full entry}
• onekey-decompile-apk - onekey-decompile-apk runs apktool, dex2jar, and JD-GUI in one step. _{Tool · Android · Also: Binary · Full entry}
• Show Java - Show Java decompiles APK, JAR, and dex files on an Android device, including layouts, drawables, menus, AndroidManifest, and image assets. _{Tool · Android · Also: Binary · Full entry}
• JADXecute - JADXecute is a JADX plugin that runs Java against the open jadx-gui session, so a script can print or change parts of the decompiler output. _{Tool · Android · Also: Binary · Full entry}
• JD-Eclipse - JD-Eclipse is an Eclipse plug-in that shows Java source for class files during debugging. _{Tool · JVM · Also: Binary · Full entry}
• Old Rod - Old Rod disassembles a .NET executable protected by the KoiVM virtualizer in ConfuserEx and recompiles that VM code to CIL. _{Tool · .NET · Also: Binary · Full entry}
• Tika JTD+ - Tika JTD+ parses Ichitaro .jtd, .jtt and .jttc documents for Apache Tika, extracting text, metadata and approximate table structure. _{Tool · JVM · Full entry}
• NPatch - NPatch adds an Xposed loader and Vector hooking core to Android APKs so Xposed modules can run without root access. _{Tool · Android · Full entry}

↑ Contents

64 case studies. The 10 newest are below. Full case list.

• 8088 BIOS: disassembling Tandy and IBM PC firmware images - This repository disassembles BIOS images from 8088 machines: the Tandy 1000, Tandy 1000A, Tandy 1000 HX, IBM PCjr, and IBM PC 5150. _{Case study · Independent reconstruction · Full entry}
• AGS Aging Cartridge: disassembling version 7.0 - The project reconstructs AGS Aging Cartridge 7.0 from a user-supplied Game Boy Advance ROM as assembly and C source. _{Case study · Independent reconstruction · Full entry}
• Character Pipeline: April 2001 library decompilation - Character Pipeline April 2001 Libraries reconstructs C source for the component's built code libraries. _{Case study · Independent reconstruction · Full entry}
• cod4map: reconstructing the Call of Duty 4 BSP compiler - cod4map reconstructs the BSP compiler shipped with the 2007 Call of Duty 4 mod tools from its executable. _{Case study · Independent reconstruction · Full entry}
• dargh: reconstructing Dynamic Animation Replacer for Skyrim - dargh reconstructs the Dynamic Animation Replacer DLL for Skyrim Special Edition in C++ from analysis of versions 1.1.2 and 1.1.3. _{Case study · Independent reconstruction · Full entry}
• DLSS 5 Neural Rendering: reconstructing a runtime model from DLL analysis - DLSS 5 Neural Rendering reconstructs parts of NVIDIA's model from static analysis of nvngx_dlssnr.dll 310.8.0.0 shipped with NBA 2K27. _{Case study · Independent reconstruction · Full entry}
• dolnetbp: reconstructing GameCube network SDK libraries - dolnetbp reconstructs the GameCube Dolphin Network Base Package eth, mdm and netcfg libraries in C. _{Case study · Independent reconstruction · Full entry}
• Dolphin SDK 2004 Libraries: decompiling GameCube SDK archives - Dolphin SDK 2004 Libraries reconstructs the built code libraries of the April 20, 2004 Dolphin SDK as C and assembly sources. _{Case study · Independent reconstruction · Full entry}
• dolsocketlibrary: reconstructing Dolphin networking libraries - dolsocketlibrary reconstructs the Dolphin Network Base Package ip and dvdeth libraries in C. _{Case study · Independent reconstruction · Full entry}
• EGG Library: shared-source Wii library decompilation - EGG Library is a work-in-progress decompilation of a Wii software library, aiming to share one source set across multiple games and applications. _{Case study · Independent reconstruction · Full entry}

• Ghidra - Open-source analysis suite for disassembly, decompilation, graphs and Java/Python automation across executable formats. _{Tool · Also: Game, Firmware · Full entry}
• radare2 - Scriptable command-line framework for inspecting, disassembling, debugging and modifying binaries across many architectures. _{Tool · Also: Game · Full entry}
• Cutter - Rizin-powered graphical reverse-engineering workspace with extensible views and Ghidra decompiler integration. _{Tool · Also: Game · Full entry}
• Qiling - Python emulation framework that adds OS, filesystem and API behavior around CPU emulation for instrumented binary analysis. _{Tool · Also: Firmware · Full entry}
• Unicorn Engine - Multi-architecture CPU emulator for executing selected instruction ranges with register, memory and hook control. _{Tool · Library · Also: Game, Firmware · Full entry}
• angr - Python binary-analysis framework combining control-flow recovery, symbolic execution, data-flow analysis and decompilation. _{Tool · Library · Full entry}
• LIEF - Library for structured parsing and modification of executable formats including ELF, PE and Mach-O. _{Tool · Library · Full entry}
• Capstone - Disassembly library with architecture-neutral APIs and instruction details for custom binary-analysis pipelines. _{Tool · Library · Full entry}
• ImHex - Hex editor with a binary-pattern language, structured data inspection and visual tools for understanding file formats. _{Tool · Also: Game, Firmware · Full entry}
• x64dbg - Windows binary debugger with disassembly, memory views and plugins for analyzing programs without source code. _{Tool · Full entry}
• GDB - Native and remote debugger for controlling execution and inspecting live or crashed program state. _{Tool · Full entry}
• rr - Records process execution and replays it under GDB, enabling repeatable inspection and reverse execution. _{Tool · Full entry}
• Diaphora - IDA-based binary diffing that matches functions and transfers names, comments and types between analyzed versions. _{Tool · Also: Game · Full entry}
• BinDiff - Compares disassembled binaries to find matching functions and changed code across versions. _{Tool · Also: Game · Full entry}
• Detect It Easy - Format-aware file identification and static inspection using parsers, signatures and programmable heuristics. _{Tool · Also: Game · Full entry}
• r2frida - Use radare2 commands and Frida instrumentation together to inspect local or remote process memory, symbols, classes, and runtime calls on desktop and mobile targets. _{Tool · Also: App · Full entry}
• Kaitai Struct - Turn documented binary layouts into reusable parsers for files and network packets. _{Tool · Library · Also: Firmware, Protocol · Full entry}
• GoReSym - Recover Go build metadata, function names and address ranges, source file and line tables, embedded types and strings from Go binaries, including stripped and some malformed unpacked samples. _{Tool · Full entry}
• rev.ng - Open-source decompilation pipeline that lifts x86-64, AArch64, i386, ARM and MIPS code with QEMU, runs LLVM-based analyses and emits C designed to be valid and recompilable. _{Tool · Full entry}
• Rizin - Command-line reverse-engineering framework that began as a fork of radare2. _{Tool · Also: Game · Full entry}
• Decompiler Explorer - Web service at dogbolt.org that runs one small uploaded executable through many decompilers and shows their C-like output side by side, described as Compiler Explorer in reverse. _{Tool · Full entry}
• pwndbg - Python plug-in that loads into GDB, or runs as a REPL around LLDB, to make live program state easier to inspect. _{Tool · Full entry}
• DynamoRIO - Runtime code manipulation system for building dynamic tools that observe or transform any part of an unmodified program while it runs. _{Tool · Full entry}
• Decompyle++ (pycdc) - C++ disassembler and decompiler for compiled Python bytecode that aims to support bytecode from any Python version. _{Tool · Also: App · Full entry}
• cwe_checker - Static analyzer from Fraunhofer FKIE that searches binary executables, mainly Linux and Unix ELF files, for code paths matching Common Weakness Enumeration bug classes such as buffer overflows, use-after-free and double free, NULL pointer dereferences, format strings and integer overflows. _{Tool · Also: Firmware · Full entry}
• FLARE-VM - Mandiant FLARE installer that sets up and maintains a Windows virtual machine for reverse engineering and malware analysis. _{Tool · Full entry}
• B2R2 - Binary analysis framework written in F# for .NET by KAIST's SoftSec Lab. _{Tool · Library · Full entry}
• rz-ghidra - Rizin plugin that embeds Ghidra's C++ decompiler and Sleigh disassembler, so no Java Ghidra installation is needed. _{Tool · Full entry}
• dewolf - Research decompiler from Fraunhofer FKIE, developed with Singapore's DSO National Laboratories between 2019 and 2021, that runs as a Binary Ninja plugin and starts from Binary Ninja's Medium Level IL. _{Tool · Full entry}
• decomp2dbg - Decompiler-to-debugger bridge that serves function names, global variables, stack and register variable names and decompiled code from IDA Pro, Binary Ninja, Ghidra or angr-management to GDB over an XML-RPC connection. _{Tool · Full entry}
• E9Patch - Static binary rewriter for x86-64 Linux ELF executables and shared objects that inserts instrumentation without control-flow recovery and writes a drop-in replacement binary, following the PLDI 2020 paper Binary Rewriting without Control Flow Recovery. _{Tool · Full entry}
• Rellic - Trail of Bits implementation of the pattern-independent structuring algorithm from the No More Gotos paper, turning LLVM bitcode into goto-free C as a small, hackable decompiler back end that interoperates with LLVM and Remill. _{Tool · Library · Full entry}
• ghidra-delinker-extension - Ghidra extension that delinks a selected part of a program back into a relocatable object file. _{Tool · Also: Game · Full entry}
• BinExport - The exporter component of BinDiff: plugins for IDA Pro and Binary Ninja and an extension for Ghidra that write an analyzed disassembly to the Protocol Buffer format BinDiff requires. _{Tool · Full entry}
• Karta - Source-code-assisted IDA Python plugin from Check Point Research that finds and matches open-source libraries compiled into large binaries and firmware. _{Tool · Also: Firmware · Full entry}
• VTIL-Core - C++20 core of the VTIL (Virtual-machine Translation Intermediate Language) project, an intermediate language and optimizing compiler that the README describes as built for binary de-obfuscation and de-virtualization. _{Tool · Library · Full entry}
• Frida Workbench for VSCode - Unofficial Visual Studio Code extension for Frida work. _{Tool · Also: App · Full entry}
• ghidriff - Command-line binary diffing engine that drives Ghidra headlessly through pyghidra: it imports and analyzes an old and a new binary, then reports added, deleted and modified functions, with patch diffing as its main use. _{Tool · Also: Firmware · Full entry}
• Ddisasm - GrammaTech's Datalog disassembler, which turns ELF and PE binaries for x86-32, x86-64, ARM32, ARM64 and MIPS32 into the GTIRB intermediate representation. _{Tool · Full entry}
• PINCE - Linux front end for the GNU Debugger (GDB), focused on games but usable for other reverse engineering; the name stands for “PINCE is not Cheat Engine”. _{Tool · Also: Game · Full entry}
• uncompyle6 - Cross-version decompiler that translates Python bytecode back into equivalent Python source, accepting bytecode from Python 1.0 through 3.8 as well as some PyPy bytecode and Dropbox's Python 2.5. _{Tool · Also: App · Full entry}
• ret-sync - Reverse-Engineering Tools SYNChronization: plugins that keep IDA, Ghidra or Binary Ninja graph and decompiler views following a live WinDbg, GDB, LLDB, OllyDbg 1.10/2 or x64dbg session, rebasing addresses on the fly so ASLR does not break the mapping. _{Tool · Full entry}
• PyInstaller Extractor (pyinstxtractor) - Single-file Python script that extracts the contents of executables built with PyInstaller, including Linux ELF builds without other tools. _{Tool · Also: App · Full entry}
• Binary Analysis Platform (BAP) - OCaml binary analysis platform from Carnegie Mellon University. _{Tool · Library · Full entry}
• Reko - General-purpose decompiler that loads executables or raw images, scans their machine code into a machine-independent register transfer language, groups it into procedures and decompiles them into high-level C code. _{Tool · Also: Firmware · Full entry}
• Dyninst - Binary instrumentation, analysis and modification libraries from the Paradyn project. _{Tool · Full entry}
• goblin - Rust crate for zero-copy, endian-aware parsing of ELF32/64, 32/64-bit Mach-O and multi-architecture fat containers, PE32/PE32+, COFF objects, Terse Executable (TE) images and Unix/BSD archives; Object::parse picks the format from its magic bytes. _{Tool · Library · Full entry}
• FLOSS (FLARE Obfuscated String Solver) - Mandiant FLARE string extractor for malware analysis that is used like strings.exe but also recovers obfuscated strings. _{Tool · Full entry}
• Zydis - Lightweight C11 x86/x86-64 disassembler and code-generation library. _{Tool · Library · Full entry}
• QBDI - Quarkslab's modular dynamic binary instrumentation (DBI) framework, which JIT-recompiles a program's basic blocks inside its own process so that an instrumentation tool can register callbacks before or after instructions, on memory reads and writes, and on VM events. _{Tool · Also: App · Full entry}
• binsider - Terminal user interface for inspecting ELF binaries. _{Tool · Full entry}
• iced - x86 instruction library for 16-, 32- and 64-bit code that decodes, formats, assembles and encodes instructions, with masm, nasm, GNU AT&T and Intel XED output syntaxes. _{Tool · Library · Full entry}
• hrtng - IDA plugin published by Kaspersky that extends the Hex-Rays decompiler with tools its author collected for reverse-engineering work, including malware analysis. _{Tool · Full entry}
• BinCAT - Static binary code analysis toolkit designed for reverse engineers. _{Tool · Full entry}
• GEF (GDB Enhanced Features) - Single-file Python extension, gef.py, that adds dynamic-analysis commands to GDB. _{Tool · Full entry}
• Triton - C++ library with Python bindings for dynamic binary analysis of x86, x86-64, ARM32, AArch64 and RISC-V 32/64 code. _{Tool · Library · Full entry}
• PyLingual - Research decompiler for CPython bytecode from Python 3.6 onward that pairs per-version transformer models with control-flow reconstruction. _{Tool · Also: App · Full entry}
• Miasm - Python reverse-engineering framework for analyzing, modifying and generating binary programs. _{Tool · Library · Full entry}
• HyperDbg - Hypervisor-assisted Windows debugger that virtualizes the running system with Intel VT-x and Extended Page Tables to debug kernel and user mode, either locally as a tracing and introspection tool or from a host attached over a serial connection to a guest virtual machine. _{Tool · Full entry}
• Kuna - Agent-first decompiler written in Rust that began as a port of Ghidra’s C++ decompiler and SLEIGH compiler, and has since diverged with option-gated features, some ported from angr. _{Tool · Full entry}
• Binary Ninja API - Vector 35’s public C++, Python and Rust APIs for Binary Ninja, with their documentation, examples and the open-source plugins built on them. _{Tool · Also: Firmware · Full entry}
• capa - Mandiant FLARE tool that reports what an executable can do by matching a YAML rule set against features extracted from PE, ELF and .NET files or 32/64-bit shellcode, such as API calls, imports, strings and constants. _{Tool · Full entry}
• RetDec - Avast's retargetable machine-code decompiler built on LLVM. _{Tool · Full entry}
• REDasm - Cross-platform interactive disassembler whose version 4 is a plain-C rewrite: a C17 engine library, the Qt6 GUI kept in this repository, and loader, processor and analyzer plugins loaded as shared libraries. _{Tool · Also: Game · Full entry}
• Lighthouse - Code-coverage explorer plugin for IDA Pro and Binary Ninja that loads execution traces of native programs and paints the executed code across the disassembler's views, without needing symbols or source. _{Tool · Full entry}
• BinAbsInspector - Static vulnerability scanner from Tencent Keen Lab that runs as a Ghidra extension or headless script and applies abstract interpretation to Ghidra's P-code rather than to assembly, covering x86, x64, ARMv7 and AArch64 binaries. _{Tool · Full entry}
• VulHunt Community Edition - Open-source Community Edition of Binarly REsearch's VulHunt engine for hunting vulnerabilities in POSIX binaries and UEFI firmware on x86 and ARM. _{Tool · Also: Firmware · Full entry}
• BinSync - Decompiler plugin for collaborative reverse engineering that records each analyst's work in a shared Git repository, one branch per user, so teammates can pull, push or auto-push changes across IDA Pro, Binary Ninja, Ghidra and angr-management. _{Tool · Full entry}
• class-dump - Command-line utility that reads the Objective-C runtime metadata in Mach-O executables, frameworks and bundles and prints it as ordinary Objective-C declarations for the classes, categories and protocols it finds, the same information otool -ov shows in a more compact form. _{Tool · Also: App · Full entry}
• Lucid - IDA Pro plugin by Markus Gaasedelen for studying how the Hex-Rays decompiler transforms its microcode intermediate language. _{Tool · Full entry}
• r2dec - Decompiler plugin for radare2 that turns the disassembly of an analyzed function into pseudo-C through the pdd command. _{Tool · Full entry}
• Runtime Mobile Security (RMS) - Frida-based web interface for observing Android and iOS apps at run time on a test device. _{Tool · Also: App · Full entry}
• Pharos - Carnegie Mellon SEI's framework of automated static analysis tools for binary programs, built on LLNL's ROSE compiler infrastructure for disassembly, control-flow analysis and instruction semantics. _{Tool · Full entry}
• heimdall-rs - Rust toolkit by Jonathan Becker for analyzing EVM smart-contract bytecode, particularly of contracts without verified source. _{Tool · Full entry}
• PE-bear - Qt GUI to view and edit Windows Portable Executable files, meant as a fast first look for malware analysts and robust against malformed PE32 and PE64 files. _{Tool · Full entry}
• PE-sieve - Windows process scanner by hasherezade that finds and dumps implants in one running process: replaced or injected PE modules, shellcode, inline and IAT hooks and other in-memory patches, with the README naming Process Hollowing, Process Doppelgänging and reflective DLL injection among the techniques it detects. _{Tool · Full entry}
• oletools - Python package by Philippe Lagadec for analyzing Microsoft OLE2 (Compound File Binary) files such as Office 97–2003 documents, MSI files and Outlook messages, as well as RTF and OpenXML documents, mainly for malware analysis, forensics and debugging. _{Tool · Full entry}
• MonkeyDev - Based on iOSOpenDev, MonkeyDev adds a MonkeyApp project template to Xcode for instrumenting iOS apps the developer is authorized to analyze. _{Tool · Also: App · Full entry}
• Hollows Hunter - Windows command-line memory scanner by hasherezade that runs the PE-sieve engine across many processes, or the whole system, instead of a single PID. _{Tool · Full entry}
• restore-symbol - macOS command-line tool that writes a stripped iOS app's Mach-O executable back out with a rebuilt symbol table, so a debugger such as lldb can break on and display Objective-C method names. _{Tool · Also: App · Full entry}
• FakeNet-NG - Mandiant FLARE's dynamic network analysis tool for malware analysts, a successor to the original Fakenet. _{Tool · Also: Protocol · Full entry}
• Joern - Static code analysis platform that parses source code, JVM bytecode and executables into code property graphs held in a graph database and queried with a Scala-based language from an interactive shell or server mode. _{Tool · Also: App · Full entry}
• Speakeasy - Mandiant's Windows malware emulation framework, which runs PE executables, DLLs, kernel drivers and raw x86/amd64 shellcode on the Unicorn CPU emulator inside a modeled Windows runtime instead of a full VM. _{Tool · Full entry}
• LazyIDA - Single-file IDA plugin of convenience actions first written for CTF work. _{Tool · Full entry}
• Tiny Tracer - Intel Pin tool by hasherezade that traces a 32- or 64-bit program while it runs on Windows or Linux, logging API calls (with arguments and return values for watched functions), chosen local and statically linked functions, inline system calls, RDTSC, CPUID and INT instructions, and transitions between sections of the traced module, which helps find the original entry point of a packed module. _{Tool · Full entry}
• Ponce - IDA Pro plugin, described by its repository as the winner of the 2016 IDA plugin contest, that brings the Triton framework's taint analysis and symbolic execution into IDA's debugger for x86 and x64 programs. _{Tool · Full entry}
• DRAKVUF Sandbox - CERT Polska’s automated black-box malware analysis system built on the DRAKVUF engine, which observes a Windows guest from the Xen hypervisor through virtual machine introspection rather than an agent installed in the guest. _{Tool · Full entry}
• HexRaysPyTools - IDAPython plugin for IDA Pro's Hex-Rays decompiler that helps rebuild structures and classes from pseudocode. _{Tool · Full entry}
• CAPE Sandbox (CAPEv2) - Malware sandbox derived from Cuckoo v1 that runs samples in isolated Windows guests and records API-hook behavior, created and modified files, network traffic as PCAP, screenshots and memory dumps. _{Tool · Full entry}
• LuaDec - Lua bytecode decompiler that turns compiled chunks back into Lua source, with a disassembly mode, selection of single nested functions by number and a guesser for local variable declarations that can be overridden by hand. _{Tool · Also: Game · Full entry}
• xpcspy - Frida-powered command-line tool that observes XPC messages exchanged between processes on iOS and macOS in both directions, for understanding how Apple-platform apps and services talk over XPC. _{Tool · Also: App, Protocol · Full entry}
• de4py - Python deobfuscation and analysis toolkit with a PySide6 GUI and a CLI mode, aimed at analysts examining obfuscated or packed Python programs. _{Tool · Also: App · Full entry}
• Dwarf - PyQt5 debugger built on Frida that attaches to or spawns processes on Android and iOS devices, the local machine or a remote Frida server. _{Tool · Also: App · Full entry}
• bddisasm - Bitdefender’s dependency-free C decoder for x86/x64 instructions, reporting explicit and implicit operands with their access modes, CPUID feature flags, flag accesses and valid modes, and printing Intel/MASM-style text. _{Tool · Library · Full entry}
• decompyle3 - Reworking of uncompyle6 by the same author that translates Python 3.7 and 3.8 bytecode, including some PyPy 3.7 and 3.8 bytecode, back into equivalent Python source; older bytecode stays with uncompyle6. _{Tool · Also: App · Full entry}
• DRAKVUF - Tamas K Lengyel's virtualization-based, agentless black-box binary analysis system: running on the Xen hypervisor through LibVMI, it traces execution in Windows and Linux guests, from kernel functions to user-mode code, without installing software inside the analyzed virtual machine. _{Tool · Full entry}
• ViperMonkey - VBA parser and emulation engine, created by Philippe Lagadec and developed since 2017 mainly by Kirk Sayre and other contributors, for analyzing and deobfuscating malicious macros in Microsoft Office files such as Word, Excel, PowerPoint and Publisher documents, as well as VBScript files and HTA files carrying VBScript. _{Tool · Full entry}
• BREAD - Injectable real-mode x86 debugger for legacy BIOS code, boot code and DOS programs on real hardware or in a virtual machine. _{Tool · Also: Firmware · Full entry}
• Mergen - Function-level lifter that symbolically lifts one x86-64 function from a Windows PE binary into LLVM IR, then iterates LLVM and custom passes to a fixpoint so obfuscated or virtualized code reduces to simpler control flow and semantics for analysis. _{Tool · Full entry}
• readpe (formerly pev) - Command-line toolkit, formerly named pev, for analyzing 32- and 64-bit Windows PE files. _{Tool · Full entry}
• malware-jail - Node.js sandbox for semi-automatic analysis of JavaScript malware: it runs a sample in Node's vm module against emulated Windows Script Host and ActiveX objects such as WScript.Shell, MSXML2.XMLHTTP, ADODB.Stream, Scripting.FileSystemObject and WMI, plus a partial browser context with selectable browser profiles. _{Tool · Also: Website · Full entry}
• gxpc - macOS command-line XPC sniffer, inspired by xpcspy, that injects a Frida agent into an attached or newly spawned process and logs the XPC messages it sends and receives, labelled with the libxpc function, connection name, peer PID and process name. _{Tool · Also: App, Protocol · Full entry}
• Manticore - Trail of Bits' now-archived symbolic execution tool for Linux ELF binaries on x86, x86-64, AArch64 and ARMv7, Ethereum smart contracts as EVM bytecode, and WebAssembly modules. _{Tool · Library · Full entry}
• Ghidra Ninja ghidra_scripts - Thomas Roth's (Ghidra Ninja) collection of Ghidra Python scripts, which appear under a Ghidra Ninja category in the Script Manager. _{Tool · Full entry}
• FindCrypt - Ghidra Edition - Ghidra script that ports Ilfak Guilfanov's FindCrypt plugin for IDA, searching a program's memory or the current selection for constants of cryptographic and compression algorithms. _{Tool · Full entry}
• Binary Refinery - Large collection of composable Python command-line units for transforming binary data: encodings, compression, encryption, archive and executable-format extraction, carving and pattern search. _{Tool · Full entry}
• AngryGhidra - Ghidra extension that runs angr symbolic execution from a CodeBrowser panel. _{Tool · Full entry}
• fpicker - Frida-based fuzzing suite for closed-source programs, listed here for its in-process instrumentation and coverage layer. _{Tool · Also: App · Full entry}
• RetroWrite - HexHive's static binary rewriter for x64 and aarch64 Linux ELF binaries, which turns a binary into symbolized, reassemblable assembly so instrumentation can be inserted without source code and without heuristics. _{Tool · Full entry}
• Interruptor - Frida library, taken from the Dexcalibur project, that uses Frida’s Stalker to trace a process’s system calls and print strace-like lines with the calling thread, module and offset, decoded flag values and file paths resolved from descriptors. _{Tool · Also: App · Full entry}
• dyld_cache_extract - macOS application and command-line tool that reads a dyld_shared_cache file from macOS or iOS, shows its header, mappings and image list, and copies one library or every library out to a directory. _{Tool · Also: App · Full entry}
• FLARE IDA Pro utilities - Archived collection of IDAPython plugins and scripts from Mandiant's FLARE team for malware and native-code analysis in IDA Pro. _{Tool · Full entry}
• Binlex - Binary trait-lexer framework that extracts instructions, basic blocks and functions from executables and emits searchable JSON traits for similarity, hunting and signature work. _{Tool · Library · Full entry}
• Driver Buddy Reloaded - IDA Pro Python plugin for triaging Windows kernel drivers, building on NCC Group's original DriverBuddy. _{Tool · Full entry}
• FA (Firmware Analysis) - Python framework, mainly used as an IDA plugin, that turns the manual steps of locating symbols, such as finding a string, following its cross-reference and taking the function start, into reusable signatures. _{Tool · Also: Firmware · Full entry}
• pyinstxtractor-ng (PyInstaller Extractor Next Generation) - Fork of PyInstaller Extractor (pyinstxtractor) by the same author that extracts the bundled CArchive files and PYZ modules from Linux ELF and Windows PE executables built with PyInstaller, writing .pyc files with repaired headers for a separate bytecode decompiler. _{Tool · Also: App · Full entry}
• CoBRA (Coefficient-Based Reconstruction of Arithmetic) - Trail of Bits' C++23 simplifier for Mixed Boolean-Arithmetic (MBA) expressions, an obfuscation technique that rewrites simple computations as interleaved arithmetic, bitwise and shift operations. _{Tool · Library · Full entry}
• ollvm-unflattener - Python command-line deobfuscator for the control-flow flattening applied by Obfuscator-LLVM (OLLVM). _{Tool · Full entry}
• GolangAnalyzerExtension - Ghidra extension whose Golang Analyzer reads the runtime header and module data in Go binaries built with go1.6 through go1.27 to identify the Go version, rename functions, correct their arguments, comment source files and line numbers, add Go types to the Data Type Manager and label Go strings. _{Tool · Full entry}
• IDA iOS Helper - IDA Pro plugin that cleans up Hex-Rays pseudocode and adds navigation helpers for iOS user-mode binaries and the kernelcache, enabling its components according to the loaded file. _{Tool · Also: App · Full entry}
• MAMBO - Dynamic binary modification framework from the University of Manchester that runs unmodified Linux user-space programs on 32-bit Arm (A32/T32), AArch64 and RV64GC RISC-V, translating their code into a code cache as it executes. _{Tool · Full entry}
• Class Informer - IDA Pro plugin that scans Microsoft Visual C++ binaries for virtual function tables (vftables) through their C++ run-time type information (RTTI), names, labels and comments the vftables it finds, defines the RTTI data structures and identifies single, multiple and virtual inheritance in each class hierarchy. _{Tool · Full entry}
• Kam1n0 - Server platform from McGill University's Data Mining and Security Lab that indexes collections of disassembled binaries into shared repositories and searches them for cloned assembly functions. _{Tool · Full entry}
• iblessing - Toolkit for analyzing iOS apps and arm64 Mach-O binaries, built on Capstone, Unicorn and Keystone. _{Tool · Also: App · Full entry}
• SiMBA - Research tool from Denuvo that simplifies linear mixed Boolean-arithmetic (MBA) expressions, which combine bitwise and integer operations and are used in code obfuscation. _{Tool · Full entry}
• GTIRB - GrammaTech's intermediate representation for passing disassembly, analysis and rewriting results between binary tools, modeled on the role LLVM-IR plays for compilers. _{Tool · Library · Full entry}
• Quokka - Quarkslab’s binary exporter, inspired by BinExport, saves a disassembler’s analysis to a protobuf .quokka file so functions, basic blocks, data, cross-references, segments and optionally decompiled code can be used later without the disassembler. _{Tool · Full entry}
• knife - Static reverse-engineering toolkit in Rust, installed as the knife command, that parses PE, ELF, Mach-O and WebAssembly files without running them. _{Tool · Full entry}
• BARF - Python binary analysis framework that loads ELF and PE programs, disassembles 32- and 64-bit x86 and 32-bit ARM code with Capstone and translates it into the REIL intermediate language, so its analyses do not depend on the source architecture. _{Tool · Library · Full entry}
• rabbitizer - MIPS instruction decoder written in C that never allocates on the heap, with Python, C++ and Rust bindings in the same repository and the stated aim of producing matching assembly. _{Tool · Library · Also: Game · Full entry}
• ghidrecomp - Python command-line decompiler that drives Ghidra through pyghidra to decompile every function of a binary into separate C files, or into one C file and header with Ghidra's C++ exporter, keeping the Ghidra project so later runs can reuse the analysis. _{Tool · Full entry}
• Vivisect - Pure-Python reverse-engineering framework that combines the vivisect static analyzer, the vtrace debugging library and the vdb debugger. _{Tool · Also: Firmware · Full entry}
• r2pipe - radare2's official scripting interface, with implementations for more than two dozen languages in one repository. _{Tool · Full entry}
• GREASE - Galois's command-line tool, Ghidra plug-in and Haskell library for checking properties of binaries with under-constrained symbolic execution. _{Tool · Full entry}
• PLASMA - Interactive terminal disassembler, formerly named Reverse, for x86 and x86-64 with partial ARM and MIPS/MIPS64 support, reading ELF, PE and raw binaries. _{Tool · Full entry}
• mobdevim - Derek Selander's macOS command-line utility for inspecting and controlling iOS devices connected over USB or Wi-Fi through Apple's private MobileDevice framework. _{Tool · Also: App · Full entry}
• XPEViewer - Qt-based PE file viewer and editor for Windows, Linux and macOS by horsicq, the author of the catalog's Detect It Easy. _{Tool · Full entry}
• Fermion - Ruben Boonen's Electron desktop application that wraps frida-node and the Monaco editor into one window for writing, injecting and refining Frida scripts. _{Tool · Also: App · Full entry}
• Ghidrathon - Mandiant FLARE's Ghidra extension that embeds the user's local CPython 3 interpreter in Ghidra through Jep, as an alternative to Ghidra's Jython-based Python 2.7 scripting. _{Tool · Full entry}
• diStorm3 - Lightweight x86/AMD64 disassembler library in C that the README describes as a decomposer: besides formatted text, distorm_decompose returns a binary structure per instruction with its opcode, operands, prefixes, flow-control class and optionally affected CPU flags. _{Tool · Library · Full entry}
• ProbeDroid - Dynamic Java-method instrumentation kit for Android 5.0 that lets analysts write their own tracing and profiling tools for apps whose source code they do not have. _{Tool · Also: App · Full entry}
• Fridump - Small Python command-line tool that attaches to a running process through Frida and writes its accessible memory ranges to files, run from a Windows, Linux or macOS host against iOS, Android or Windows applications. _{Tool · Also: App · Full entry}
• Redress - Command-line tool, built on the GoRE library, that recovers metadata from stripped binaries produced by the Go compiler. _{Tool · Full entry}
• ghidra-nanomips - Ghidra processor module that adds nanoMIPS disassembly and decompilation through a SLEIGH specification of the little-endian 32-bit nanoMIPS instruction set, including its multithreading instructions. _{Tool · Also: Firmware · Full entry}
• SMDA - Python recursive disassembler library built on Capstone that recovers control-flow graphs from PE, ELF and Mach-O files, .NET assemblies, raw DEX files and memory dumps with a known base address, through x86/x64, AArch64, 32-bit ARM/Thumb, CIL and Dalvik backends. _{Tool · Library · Full entry}
• frida-trace (NowSecure library) - JavaScript library for Frida agents that traces native functions from a declarative description: each function is listed with its return type and input and output arguments, including pointers, UTF-8 and UTF-16 strings and byte arrays whose length is bound to another argument or the return value, with conditions such as reading an output pointer only when the call succeeds. _{Tool · Also: App · Full entry}
• BTD (Bin To DNN) - Research artifact for the USENIX Security 2023 paper “Decompiling x86 Deep Neural Network Executables”. _{Tool · Full entry}
• Boomerang Decompiler - Fork of the SourceForge Boomerang project, a general machine-code decompiler that translates executables into C. _{Tool · Full entry}
• ktool - Pure-Python toolkit for static Mach-O and Objective-C analysis, used as the ktool command line, a terminal browser (ktool open) or a library, with no compiled dependencies. _{Tool · Also: App · Full entry}
• Brida - Burp Suite extension by Federico Dotta and Piergiovanni Cipolloni that bridges Burp and Frida, so an analyst can run an app's own functions on the HTTP messages it exchanges with its backend instead of reimplementing its encryption, encoding or signing. _{Tool · Also: App, Protocol · Full entry}
• Qu1cksc0pe - All-in-one malware triage tool that statically analyses Windows PE, Linux ELF (including Go binaries), macOS Mach-O and Android APK, JAR and DEX files as well as Office and PDF documents, scripts, shortcuts, archives, e-mails and PCAPs, reporting imports and API categories, sections, strings and IOCs, packers, embedded executables, Android permission risk, YARA matches and, for Windows and Linux, MITRE ATT&CK mappings. _{Tool · Also: App · Full entry}
• AppMon - Frida-based framework by Nishant Das Patnaik, shown at Black Hat Arsenal 2016, for watching the system API calls that native macOS, iOS and Android apps make. _{Tool · Also: App · Full entry}
• Yagi - Airbus CERT plugin that embeds Ghidra's native decompiler in IDA Pro and IDA Free: pressing F3 on a function shows Ghidra's C output inside IDA, and edits made there, covering global symbols such as function prototypes and the names and types of stack and register variables, are saved to the IDA database. _{Tool · Full entry}
• frida-scripts (0xdea) - Marco Ivaldi's (raptor) collection of Frida JavaScript instrumentation scripts for reverse engineering mobile apps and Linux programs. _{Tool · Also: App · Full entry}
• System Informer - Windows process viewer and system inspector, formerly Process Hacker, for examining running programs and the system around them. _{Tool · Full entry}
• CyberChef - GCHQ's browser-based workbench for decoding, decrypting, decompressing, parsing and carving data by chaining operations into a recipe, with all processing done client-side. _{Tool · Also: Protocol · Full entry}
• YARA - VirusTotal's pattern-matching tool for identifying and classifying files such as malware samples with rules that combine text, hex and regular-expression strings with a Boolean condition. _{Tool · Full entry}
• Cheat Engine - Memory scanner, debugger, disassembler and assembler for inspecting and changing running games and other applications; its README calls it a development environment focused on modding games and applications for personal use. _{Tool · Also: Game · Full entry}
• Noriben - Python script that drives Sysinternals Process Monitor to record what a program does while it runs, filters out routine system activity and writes a text report of the processes it created and its file, registry and network activity. _{Tool · Full entry}
• QEMU - Machine and user-space emulator that runs code built for one CPU architecture on another through its TCG dynamic translator. _{Tool · Also: Firmware · Full entry}
• Hex Fiend - Open-source macOS hex editor that inspects and edits binary files of any size without loading them into memory. _{Tool · Full entry}
• ScyllaHide - User-mode (ring 3) anti-anti-debug library for 32- and 64-bit Windows programs that hooks system functions so the program being debugged cannot detect the debugger. _{Tool · Full entry}
• YARA-X - VirusTotal's Rust rewrite of YARA for identifying and classifying files with pattern-matching rules. _{Tool · Full entry}
• ReClass.NET - Memory structure editor for reconstructing the classes and data structures of a running x86 or x64 process, a .NET port of ReClass with many additions. _{Tool · Also: Game · Full entry}
• Keypatch - IDA Pro plugin built on the Keystone assembler engine that patches a binary from typed assembly, fills an address range with instructions or raw bytes and searches the loaded binary for assembly instructions. _{Tool · Full entry}
• edb-debugger - Qt-based graphical debugger for AArch32, x86 and x86-64 programs, inspired by OllyDbg, with Linux as its only officially supported platform. _{Tool · Full entry}
• BinNavi - Google's open-sourced binary analysis IDE for inspecting, navigating, editing and annotating the control-flow graphs and call graphs of disassembled code. _{Tool · Full entry}
• flare-emu - Mandiant FLARE Python library that pairs IDA Pro, Rizin or Radare2 with the Unicorn emulator so analysts can script emulation of the binary they are analyzing, for 32- and 64-bit x86, ARM and ARM64. _{Tool · Library · Full entry}
• IDA Pro - Hex-Rays' commercial interactive disassembler, decompiler and debugger, which turns compiled code for more than 70 processor families into annotated, cross-referenced assembly and decompiled pseudocode. _{Tool · Also: Game, App, Firmware · Full entry}
• Binary Ninja - Vector 35's commercial interactive disassembler, decompiler and debugger, whose decompiler is built on the BNIL family of intermediate languages and shows either C or BNIL for every officially supported architecture. _{Tool · Also: Firmware · Full entry}
• Hopper Disassembler - Cryptic Apps' commercial disassembler, decompiler and debugger for macOS and Linux, which reads Mach-O (macOS and iOS), PE and ELF executables built for 32- and 64-bit Intel, ARMv6, ARMv7, ARM64 and PowerPC processors. _{Tool · Also: App · Full entry}
• WinDbg - Microsoft's WinDbg debugger and the Debugging Tools for Windows, documented on Microsoft Learn, for debugging live user-mode and kernel-mode code, analyzing crash dumps and examining CPU registers and memory. _{Tool · Full entry}
• 010 Editor - SweetScape Software's commercial hex and text editor whose Binary Templates, C/C++-like struct definitions with control flow and functions, parse binary files into hierarchical, editable structures. _{Tool · Full entry}
• pestudio - Winitor's Windows tool for initial malware assessment, which statically inspects Windows executable files and reports key indicators such as hard-coded URLs and IP addresses, flagged imports, resources and overlay data. _{Tool · Full entry}
• OllyDbg - 32-bit assembler-level analyzing debugger for Windows that emphasizes binary code analysis for programs without source; its site says development is frozen, and the newest version it lists is 2.01 of 27 September 2013. _{Tool · Full entry}
• Tenet - IDA Pro plugin for exploring execution traces of a binary: it loads an externally recorded trace and lets the analyst step forwards and backwards through time while the disassembly shows the execution flow in both directions. _{Tool · Full entry}
• findcrypt-yara - IDA Pro plugin that scans the loaded database with YARA rules for cryptographic constants and similar signatures, lists the matches in a results window and names each matching address after its rule. _{Tool · Full entry}
• deREferencing - IDA Pro plugin that adds register and stack views to the debugger in which pointers are dereferenced and colored, similar to the context displays of GDB plugins such as PEDA, GEF and pwndbg. _{Tool · Full entry}
• HexRays Toolbox - IDAPython scripts that find code patterns in Hex-Rays decompiler output, independent of the binary's processor architecture, by running user-written lambda queries over the decompiled ctree. _{Tool · Full entry}
• Virtuailor - IDAPython tool that reconstructs C++ virtual tables in IDA Pro for 32- and 64-bit Intel and AArch64 code by observing indirect calls while the program runs under IDA's debugger. _{Tool · Also: Firmware · Full entry}
• xAnalyzer - x64dbg plugin that annotates the static code of the debugged x86 or x64 executable with function-call, argument and loop analysis. _{Tool · Full entry}
• Voltron - Extensible Python debugger UI toolkit that attaches utility views to LLDB, GDB, VDB and WinDbg/CDB sessions. _{Tool · Full entry}
• Remill - Static binary translation library that lifts AArch64, SPARC32, SPARC64, x86 and amd64 machine code, including AVX and AVX512, into LLVM bitcode, with AArch32 support underway. _{Tool · Library · Full entry}
• iaito - Official Qt-based graphical interface for the radare2 reverse-engineering framework, aiming for parity with radare2's commands, features and keybindings so that existing r2 plugins and scripts keep working. _{Tool · Full entry}
• HexRaysCodeXplorer - Hex-Rays decompiler plugin for navigating and reconstructing C++ code in IDA's pseudocode window. _{Tool · Full entry}
• GDB dashboard - Standalone .gdbinit file written with GDB's Python API that shows a modular status interface each time the debugged program stops, reducing the commands needed to inspect its state. _{Tool · Full entry}
• REHex - Cross-platform hex editor for reverse engineering that handles files over 1 TB. _{Tool · Full entry}
• Dobby - Lightweight, modular hook framework for Windows, macOS, iOS, Android and Linux on x86, x86-64, ARM and ARM64. _{Tool · Full entry}
• XLMMacroDeobfuscator - Command-line tool and Python library that extracts and decodes obfuscated Excel 4.0 (XLM) macros from xls, xlsm and xlsb files. _{Tool · Full entry}
• PE Tree - Python module that shows Portable Executable files in a tree view using pefile and PyQt5, as a standalone application and as a plugin for IDA Pro, Ghidra, Volatility, Rekall and minidump. _{Tool · Full entry}
• RpcView - Open-source Windows tool that explores and decompiles the RPC functionality present on a Microsoft system. _{Tool · Full entry}
• amoco - Python package for symbolic analysis of binaries. _{Tool · Library · Full entry}
• Chisel - Collection of LLDB commands for debugging iOS apps. _{Tool · Also: App · Full entry}
• gdbgui - Browser-based frontend to the GNU debugger, gdb. _{Tool · Full entry}
• Porosity - Decompiler that turns Ethereum Virtual Machine bytecode into readable Solidity-syntax contracts, supported on Linux and macOS. _{Tool · Full entry}
• Xori - Automation-ready disassembly and static analysis library for shellcode and PE binaries that outputs disassembly, functions and imports as JSON. _{Tool · Full entry}
• binglide - Visual reverse-engineering tool that gives a quick overview of the data types present in a file. _{Tool · Full entry}
• ERESI - Reverse Engineering Software Interface built around ELFsh, an interactive and scriptable shell for reading and modifying ELF objects, and e2dbg, an embedded ELF debugger. _{Tool · Full entry}
• pixd - Terminal tool that visualises binary data like a hexdump, but draws each octet as a coloured square from a palette. _{Tool · Full entry}
• Universal Extractor 2 - Unofficial, extended continuation of Universal Extractor that unpacks files from standard archives, application installers, disk images and game archives. _{Tool · Also: Game · Full entry}
• ElleKit - Function hooking toolkit for arm64 XNU devices: a C function hooker that patches memory pages directly, an Objective-C function hooker, an arm64 assembler, JIT inline assembly for Swift and a reimplementation of the Substrate and libhooker APIs. _{Tool · Full entry}
• ProcDump for Linux and macOS - Linux and macOS reimagining of the Sysinternals ProcDump tool that writes process dumps in response to performance, runtime, signal and resource-tracking triggers, including native dumps through a Rust ELF writer and managed dumps through .NET diagnostics IPC. _{Tool · Full entry}
• fishhook - Small library that dynamically rebinds symbols in Mach-O binaries running on iOS, on device and in the simulator, by updating the lazy and non-lazy symbol pointers that dyld uses. _{Tool · Also: App · Full entry}
• pcode2code - VBA p-code decompiler based on pcodedmp, written for Office documents whose macro source has been stomped to leave only bytecode. _{Tool · Full entry}
• rust-deobf - rust-deobf analyzes compiled, mainly Rust, ELF, PE and Mach-O binaries to recover hidden strings and related artifacts. _{Tool · Full entry}
• CFG Visualizer - CFG Visualizer extracts function control-flow graphs from ELF, PE and Mach-O binaries with radare2 and presents them in an interactive 3D browser view. _{Tool · Full entry}
• Cpp2CS - Cpp2CS recovers managed methods from Android ARM64 Unity IL2CPP ELF binaries and matching metadata, emitting CIL assemblies, C# source and per-method diagnostics. _{Tool · Full entry}
• ghidra-c6000 - ghidra-c6000 adds Texas Instruments C64x, C67x and C674x DSP support to Ghidra 12.x. _{Tool · Full entry}
• cocos2d-dumper - cocos2d-dumper extracts defined function symbols from ELF shared libraries and demangles C++ names with GNU binutils. _{Tool · Full entry}
• Binary Ninja Security Analysis Plugin - Binary Ninja Security Analysis Plugin batches binary analysis from a Rust plugin and exports Parquet reports. _{Tool · Full entry}
• Human-Readable Decompilation - Human-Readable Decompilation restructures C produced by Ghidra's binary decompiler using an ANTLR parser and AST transformations. _{Tool · Full entry}
• BinStruct Inspector - BinStruct Inspector is a GUI for examining binary file layouts through user-defined field trees. _{Tool · Library · Full entry}
• SimpleParserPE - SimpleParserPE is a C++ command-line inspector for PE32 Windows executables. _{Tool · Full entry}
• tenet_tracer - tenet_tracer uses Intel Pin to record instruction-level execution traces for Tenet. _{Tool · Full entry}
• BinScan - BinScan scans files in bulk and emits per-file JSON containing format identification, structural metadata, hashes and entropy. _{Tool · Full entry}
• Patch-0xC0000022 - Patch-0xC0000022 instruments the running Windows SysMain service by changing its NtCreateFile response to STATUS_ACCESS_DENIED. _{Tool · Also: App · Full entry}
• iMonitor - iMonitor is a Windows endpoint activity monitor for examining running software. _{Tool · Also: App · Full entry}
• m68kdasm - m68kdasm disassembles Motorola 68000-family machine code in Go and returns assembly with structured instruction metadata. _{Tool · Full entry}
• IR Lifting Benchmark - IR Lifting Benchmark compares binary lifting workflows across Ghidra P-code, angr VEX, BAP BIL and optional LLVM IR paths. _{Tool · Full entry}
• Bin-Hunter - Bin-Hunter is a Python command-line tool for initial static inspection of binary files. _{Tool · Full entry}
• BinaryInsight - BinaryInsight inspects ELF, PE, and Mach-O executables and libraries in an interactive terminal view or a text-report CLI. _{Tool · Full entry}
• rust-sig-gen - rust-sig-gen generates IDA FLAIR library signatures from compiled Rust crates for executable analysis. _{Tool · Full entry}
• 1C 7.7 Configuration Parser (MD Parser) - 1C 7.7 Configuration Parser inspects 1C:Enterprise 7.7 1cv7.md configuration containers. _{Tool · Library · Also: App · Full entry}
• x64dbg-tenet - x64dbg-tenet is a native x64dbg plugin that records execution steps in Tenet trace format. _{Tool · Full entry}
• NullSec BinGaze - NullSec BinGaze analyses ELF executables by parsing headers, listing sections and calculating entropy. _{Tool · Full entry}
• pdbinspector - pdbinspector analyzes Microsoft PDB files to list structures, classes, enums, functions, public symbols and exports. _{Tool · Library · Full entry}
• 8086 Register Command Debugger - 8086 Register Command Debugger is an MS-DOS machine-code inspection tool written in 8086 assembly. _{Tool · Full entry}
• advantage - advantage is a Windows research tool for inspecting Lenovo Vantage and add-in RPC commands. _{Tool · Also: App · Full entry}
• Valkyrie - Valkyrie analyzes suspect binaries through static inspection and Docker-based execution. _{Tool · Full entry}
• PE Disassembler - PE Disassembler is a WPF application that extracts the .text section of 32-bit Windows PE executables and displays decoded x86 instructions. _{Tool · Full entry}
• SIC/XE Disassembler and Linking Loader - SIC/XE Disassembler and Linking Loader converts SIC/XE object code into assembly listings and reconstructed symbols. _{Tool · Full entry}
• Malware Deobfuscator - Malware Deobfuscator analyzes obfuscated malware scripts and generates code, behavior and indicator reports. _{Tool · Also: App · Full entry}
• flashkit - flashkit is a Python toolkit for examining Adobe Flash SWF files and AVM2 bytecode. _{Tool · Library · Full entry}
• Kaiju - Kaiju is a Rust reverse-engineering framework with a headless CLI for binary loading and analysis. _{Tool · Full entry}
• sqlce - sqlce reads SQL Server Compact .sdf database files using a cross-platform C++ parser informed by analysis of decompiled SQL CE components. _{Tool · Library · Also: App · Full entry}
• inkterop - inkterop converts native handwriting files from note apps and e-ink devices through a documented intermediate representation. _{Tool · Library · Also: App · Full entry}
• wMatcher - wMatcher compares two Java archives to match classes renamed or obfuscated between releases. _{Tool · Full entry}
• tasm-rs - tasm-rs implements TVM bytecode assembly and disassembly in Rust, with a tdisasm CLI, instruction tables, Fift parsing and trace and coverage reports. _{Tool · Full entry}
• Sogen Dart bindings - Sogen Dart bindings expose Windows and Linux binary emulation through a Dart FFI package and native bridge. _{Tool · Full entry}
• cupertino-files - cupertino-files is a TypeScript library for reading and writing modern Apple Pages, Numbers, and Keynote documents. _{Tool · Library · Also: App · Full entry}
• PackerScope - PackerScope scans Windows PE executables for packer signatures and structural indicators, including entropy, sections, imports and entry-point instructions. _{Tool · Full entry}
• imprint - imprint analyzes Windows PE files by parsing import, delay-import and export directories without executing the image. _{Tool · Full entry}
• kdemulator - kdemulator executes Windows x86-64 kernel-driver binaries outside a live kernel for IOCTL analysis. _{Tool · Full entry}
• angr-management - Cross-platform graphical binary analysis tool powered by the angr platform, with disassembly and decompilation views. _{Tool · Full entry}
• QIRA - QIRA is a tool for examining program execution traces. _{Tool · Full entry}
• Dependencies - Dependencies is a Windows PE dependency analysis tool with command-line and graphical interfaces. _{Tool · Full entry}
• Hachoir - Hachoir is a Python library for viewing and editing binary streams as trees of fields, down to individual bits. _{Tool · Library · Full entry}
• Pigaios - Pigaios is a tool that matches C source code against binaries in IDA. _{Tool · Full entry}
• MachOExplorer - MachOExplorer is a desktop and command-line tool for inspecting Mach-O binaries, Universal binaries, static archives, and dyld shared caches. _{Tool · Full entry}
• FLEX - FLEX is an in-app tool for exploring and debugging running iOS applications. _{Tool · Also: App · Full entry}
• classdump-dyld - classdump-dyld is a command-line tool that generates Objective-C headers from Mach-O app binaries, libraries, frameworks, bundles, and images in the dyld shared cache. _{Tool · Also: App · Full entry}
• Process Dump - Process Dump is a Windows command-line tool that saves code from running processes to disk for malware analysis. _{Tool · Full entry}
• mal_unpack - mal_unpack is a Windows dynamic unpacker based on PE-sieve. _{Tool · Full entry}
• Bloaty - Bloaty is a binary size profiler that attributes file and memory usage to sources such as symbols, compilation units, and sections. _{Tool · Full entry}
• bingrep - bingrep is a command-line tool for inspecting and colorizing binary files. _{Tool · Full entry}
• libPeConv - libPeConv is a Windows library for loading and manipulating PE files. _{Tool · Library · Full entry}
• Viper - Viper is a framework for binary analysis and for organizing malware samples, exploit samples, and research scripts. _{Tool · Full entry}
• Cuckoo3 - Cuckoo3 is a malware analysis tool that tests suspicious files and links in sandboxed platform emulators. _{Tool · Also: Website · Full entry}
• Cuckoo Sandbox - Cuckoo Sandbox is an automated malware analysis system that executes suspicious files in an isolated environment and reports their behavior. _{Tool · Full entry}
• fq - fq is a command-line tool and query language for inspecting and decoding binary formats. _{Tool · Also: Protocol · Full entry}
• innoextract - Unpacks Inno Setup installers on non-Windows systems without running them. _{Tool · Full entry}
• Metasm - Metasm is a Ruby suite for assembling, disassembling, debugging, and modifying executable binaries. _{Tool · Library · Full entry}
• pymobiledevice3 - Pure Python 3 library and command-line tool for communicating with iPhones, iPads and other iOS devices from Windows, Linux or macOS, implementing usbmux, lockdown and its services, DTX-based developer (DVT) services and the RemoteXPC tunnels that iOS 17+ uses for developer access. _{Tool · Also: App, Protocol · Full entry}
• dumpulator - Python library that emulates user-mode code from minidumps of 64-bit and 32-bit Windows processes with Unicorn. _{Tool · Full entry}
• McSema - Archived Trail of Bits executable lifter that translates 32- and 64-bit Linux ELF and Windows PE binaries into LLVM bitcode for analysis or recompilation. _{Tool · Full entry}
• retoolkit - Windows setup program, built with Inno Setup, that installs a ready-made x86/x64 reverse-engineering and malware-analysis toolkit as selectable components: debuggers, decompilers, hex editors, PE, ELF, .NET, Java, Go, Delphi and AutoIt analyzers, and process-inspection, unpacking, network, OLE/PDF and signature tools. _{Tool · Full entry}
• D-810 ng - A refactored, updated fork of Boris Batteux's D-810 IDA Pro plugin that deobfuscates code at decompilation time by rewriting Hex-Rays microcode. _{Tool · Full entry}
• Anvill - Trail of Bits machine-code lifter built on Remill that aims to produce high-quality LLVM bitcode, close to what Clang would emit for a semantically equivalent C function, for Rellic to decompile further into C. _{Tool · Library · Full entry}
• XRefer - A Python plugin for IDA Pro from Google's FLARE team that adds a custom navigation interface. _{Tool · Full entry}
• dsdump (paradiseduo wrapper) - Python wrapper around a prebuilt copy of Derek Selander's dsdump, an improved nm and Objective-C and Swift class-dump for Mach-O binaries, that writes each dumped protocol, class, category and Swift type to its own .h or .swift file instead of a single console stream. _{Tool · Also: App · Full entry}
• Dr. Memory - Instrument running application binaries to diagnose invalid memory access, uninitialized reads, use-after-free and leaks. _{Tool · Also: App · Full entry}
• Intel XED - Encode and decode x86 instructions through Intel’s library and example analysis utilities. _{Tool · Library · Full entry}
• Keystone - Assemble instruction text into machine code through a common API covering x86, Arm, MIPS and other architectures. _{Tool · Library · Full entry}
• Microsoft Detours - Monitor Windows API calls by embedding instrumentation into a program’s execution path. _{Tool · Also: App · Full entry}
• PANDA - Record and replay whole-system execution for repeated inspection, plugin analysis and dynamic taint tracking. _{Tool · Full entry}
• pefile - Inspect PE headers, sections, resources and malformed values through a Python API with limited in-place editing. _{Tool · Library · Full entry}
• PolyTracker - Trace how parser functions consume input bytes by rebuilding programs with LLVM data-flow instrumentation and inspecting the resulting trace. _{Tool · Full entry}
• pyelftools - Parse ELF executables and DWARF debugging information from Python for scripted binary inspection. _{Tool · Library · Full entry}
• rustc-demangle - Turn mangled Rust symbols into readable names for symbol inspection and binary-analysis tooling. _{Tool · Library · Full entry}
• Scylla - Inspect and rebuild x86/x64 PE import tables and repair process dumps during executable analysis. _{Tool · Full entry}
• TitanEngine Community Edition - Embed a Windows debugging engine with breakpoint, exception, process-dump and import-reconstruction support. _{Tool · Full entry}
• Volatility 3 - Inspect operating-system memory samples to recover processes, modules and other runtime artifacts through forensic plugins. _{Tool · Full entry}
• Decompile-Bench - A dataset of binary-source function pairs published for the LLM4Decompile project. _{Project · Full entry}
• FoxDec - FoxDec is a research decompiler for formally checked lifting of x86-64 binaries to recompilable NASM. _{Tool · Full entry}
• Dragodis - Dragodis is a Python framework for writing disassembler scripts that run on more than one disassembler. _{Tool · Full entry}
• MBBSDASM - MBBSDASM is a C# disassembler for 16-bit New Executable (NE) EXE and DLL files, written with .NET Core. _{Tool · Full entry}
• blc - blc, the Binary Lifting Contraption, is an IDA Pro plugin that integrates Ghidra's decompiler and shows a source view for platforms supported by both IDA and Ghidra. _{Tool · Full entry}
• IDA BPF Processor - IDA BPF Processor is a Python processor and loader for classic BPF bytecode in IDA. _{Tool · Full entry}
• Udis86 - Disassembler library for x86 and x86-64. _{Tool · Library · Full entry}
• Quick Assembler - Quick Assembler is a Windows application for editing x86 and x64 assembly, assembling it with NASM or Keystone in 16-bit, 32-bit, or 64-bit mode, and running it in the Unicorn emulator with breakpoints, registers, and memory views. _{Tool · Full entry}
• HLSL Decompiler - HLSL Decompiler translates DXBC for shader model 5.x or lower, DXIL for shader model 6.x, and SPIR-V into HLSL. _{Tool · Full entry}
• Windbg Decompile Extension via LLM - Windows x64 WinDbg extension that resolves a function by name or address, reconstructs a control-flow view, and asks an LLM from the extension to produce pseudocode. _{Tool · Full entry}
• Pseudo C Dump - Pseudo C Dump is a Binary Ninja plugin that writes the decompiler's Pseudo C for a binary into a chosen folder, so the output can be opened in an IDE or passed to a later static-analysis tool. _{Tool · Full entry}
• Ruri.ShaderDecompiler - Ruri.ShaderDecompiler is a shader decompiler library that turns compiled shader binaries into HLSL and rebuilds links between symbols and bytecode. _{Tool · Full entry}
• libghidra - libghidra is a typed API for Ghidra program databases, callable from C++, Python, or Rust. _{Tool · Library · Full entry}
• ghidrasql - ghidrasql is a SQL interface for Ghidra program databases. _{Tool · Full entry}
• Pyre - Pyre runs Ghidra's C++ decompiler in the browser. _{Tool · Full entry}
• gapstone - gapstone is a Go binding for the Capstone disassembly library. _{Tool · Library · Full entry}
• scared - scared is a side-channel analysis framework maintained by eShard. _{Tool · Full entry}
• IDAPyHelper - IDAPyHelper is an IDAPython script that lists names available to IDAPython so they can be sorted, searched, and filtered. _{Tool · Full entry}
• vscode-decompiler - vscode-decompiler is a Visual Studio Code extension that decompiles binaries through Ghidra or an experimental Windows-only IDA Pro path, plus Java jars and classes, Android APKs, Python .pyc and .pyo files, and Ethereum smart contracts. _{Tool · Also: App · Full entry}
• Capstone.js - Capstone.js is a JavaScript and WebAssembly port of the Capstone disassembler, built with Emscripten. _{Tool · Library · Full entry}
• Hexagon processor module - idp_hexagon is an IDA Pro processor module for Qualcomm Hexagon, also called QDSP6. _{Tool · Full entry}
• ida-pro-loadmap - ida-pro-loadmap is an IDA Pro plugin that loads VC, Borland, Dede, GCC, and IDA .map symbol files into an IDA database. _{Tool · Full entry}
• Mach-O-Scope - Mach-O-Scope 0.2 browses the disassembly of Mach-O bundles such as OS X applications and plugins. _{Tool · Full entry}
• dayu - dayu is a parser and a rudimentary decompiler for the Ark Bytecode .abc files used on OpenHarmony and HarmonyOS. _{Tool · Library · Full entry}
• gdbida - gdbida pairs an IDA Pro plugin with a GDB Python client so an interactive GDB session can be followed in IDA. _{Tool · Full entry}
• reccmp - reccmp is a toolchain for decompilation projects that compares a recompilation with the original binary. _{Tool · Full entry}
• decompiler - decompiler is a Python decompiler with IDA and Capstone backends. _{Tool · Full entry}
• unluac-rs - unluac-rs is a Rust decompiler for Lua bytecode. _{Tool · Full entry}
• aevt_decompile - aevt_decompile annotates a disassembled run-only AppleScript. _{Tool · Full entry}
• GBARecomp - GBARecomp is a beta static-recompilation framework for the Game Boy Advance. _{Tool · Also: Game · Full entry}
• Ghidra Function ID dataset repository - This repository holds Ghidra Function ID datasets generated with ghidra-fid-generator from a manual selection of libraries. _{Project · Full entry}
• BinaryAudit - BinaryAudit is a benchmark of AI agents looking for backdoors in compiled binaries of open-source software. _{Project · Full entry}
• Zomboid Decompiler - Zomboid Decompiler is a decompiler for Project Zomboid, powered by Vineflower. _{Tool · Full entry}
• Ghidra Wasm Plugin - Ghidra Wasm Plugin loads WebAssembly modules into Ghidra for disassembly and decompilation. _{Tool · Full entry}
• dx-shader-decompiler - dx-shader-decompiler decompiles DirectX 9 pixel and vertex shaders, shader model 3.0. _{Tool · Full entry}
• agsutils - agsutils unpacks, disassembles, modifies, and repacks Adventure Game Studio games. _{Tool · Also: Game · Full entry}
• ExtractMachO - ExtractMachO is an IDA plugin that extracts Mach-O binaries found in a disassembly. _{Tool · Full entry}
• waterbear - waterbear is an assembler and disassembler for Dreamcast VMU programs, available as a Rust library and command-line program. _{Tool · Also: Firmware · Full entry}
• WPP Remover - WPP Remover is an IDA Pro plugin that removes Windows software-trace calls from Hex-Rays pseudocode. _{Tool · Full entry}
• ds_disassembly_tools - ds_disassembly_tools is a set of scripts for the initial setup of a Nintendo DS disassembly. _{Tool · Also: Firmware · Full entry}
• PSRetrox - PSRetrox is a C++ application for reverse engineering PlayStation 2 games from extracted ISO files. _{Tool · Also: Game · Full entry}
• IDR Pascal - IDR Pascal is a Pascal translation of the Interactive Delphi Reconstructor. _{Tool · Full entry}
• YaraVM - YaraVM is an IDA Pro loader and processor module for compiled YARA rules. _{Tool · Full entry}
• DecompPipeline - DecompPipeline turns a game's machine code into C one function at a time and builds that C into a native port. _{Tool · Also: Game · Full entry}
• GameMaker 8.1 Decompiler - GameMaker 8.1 Decompiler is the 2011 source of a decompiler for GameMaker 8.1 and 8.0 executables. _{Tool · Full entry}
• libdecomp - libdecomp decompiles multi-architecture machine code into source. _{Tool · Full entry}
• PSP Static Recompiler Toolkit - This toolkit translates a PSP relocatable executable into C, links it with a native runtime, and builds a Windows executable. _{Tool · Also: Game · Full entry}
• PbdViewer - PbdViewer is a PowerBuilder decompiler. The README points to a Kanxue thread, bbs.kanxue.com/thread-247372.htm. _{Tool · Full entry}
• Copy as YARA - Copy as YARA is a Binary Ninja plugin that copies selected disassembly as text usable in a YARA rule. _{Tool · Full entry}
• pytest-idapro - pytest-idapro is a pytest plugin for IDA and IDAPython. _{Tool · Full entry}
• 360tools - 360tools is a toolkit and playbook for statically recompiling Xbox 360 games to native x86-64 executables with the ReXGlue SDK. _{Tool · Also: Game · Full entry}
• retrokit - retrokit decompiles 32-bit games from about 1993 to 2010 with headless Ghidra. _{Tool · Also: Game · Full entry}
• Zakuro - Zakuro is a high-level Nintendo 3DS emulator written in Rust. _{Project · Independent reconstruction · Also: Game · Full entry}
• Source 2 Decompiler - Source 2 Decompiler, s2dc, decompiles Source 2 resource files. _{Tool · Also: Game · Full entry}
• Luxon Server - Luxon Server is a clean-room implementation of the Photon Realtime server. _{Project · Independent reconstruction · Also: Protocol · Full entry}
• parascope - parascope scans source code and binaries with weggli rulesets. _{Tool · Full entry}
• MBASED - MBASED is a Binary Ninja plugin that simplifies mixed Boolean-arithmetic expressions. _{Tool · Full entry}
• r2garlic - r2garlic is a radare2 plugin for the Garlic DEX and Dalvik decompiler. _{Tool · Full entry}
• Pocket Disasm - Pocket Disasm is an MCP router that gives each binary its own headless IDALib worker. _{Tool · Full entry}
• Ghidra Hexagon SLEIGH - Ghidra Hexagon SLEIGH is a Ghidra processor module for Qualcomm Hexagon QDSP6. _{Tool · Also: Firmware · Full entry}
• sega2asm - sega2asm splits a Sega Genesis or Mega Drive ROM by segment. _{Tool · Also: Game · Full entry}
• CryptoKnight - CryptoKnight classifies compiled cryptographic primitives. _{Tool · Full entry}
• cLuaDecompiler - cLuaDecompiler is a Free Pascal and Lazarus disassembler and decompiler for Lua bytecode. _{Tool · Full entry}
• FreeVGUI - FreeVGUI reimplements the Half-Life 1 VGUI library. _{Project · Independent reconstruction · Also: Game · Full entry}
• HELPDECO - HELPDECO dissects Windows Help files from Windows 3.0, 3.1, 3.11, and 95, and many MVB multimedia viewer titles, into the files needed to rebuild them with HC30, HC31, HCP, HCW, HCRTF, WMVC, MMVC, or MVC. _{Tool · Full entry}
• NWiiRecomp - NWiiRecomp translates GameCube and Wii DOL and ELF executables into C++. _{Tool · Full entry}
• Nehebn2 - Nehebn2 is a Python 3 command-line interface for Binary Ninja. _{Tool · Full entry}
• Fishbones - Fishbones is a Python library for implementing decompiled code. _{Tool · Full entry}
• JVM Inspector - JVM Inspector is an x64dbg plugin that reads a HotSpot JVM through VMStructs. _{Tool · Full entry}
• Binary Ninja PCode - Binary Ninja PCode loads Ghidra SLEIGH architectures inside Binary Ninja and attempts to lift p-code into Low Level IL. _{Tool · Full entry}
• mapfile_parser - mapfile_parser is a Python and Rust library that parses linker map files for decompilation projects. _{Tool · Full entry}
• idaidle - idaidle is an IDA Pro plugin that watches idle time. _{Tool · Full entry}
• lumina-binja - lumina-binja is a Binary Ninja plugin for IDA Lumina metadata. _{Tool · Full entry}
• gamedb - gamedb is a Rust command-line tool that indexes a directory of decompiled C, C++, Java, or C# into SQLite. _{Tool · Full entry}
• BNPyc - BNPyc is a Binary Ninja plugin that disassembles Python bytecode from version 3.0 through 3.10. _{Tool · Full entry}
• bnpy - bnpy is a Binary Ninja architecture plugin that disassembles raw Python bytecode. _{Tool · Full entry}
• HEXPYRION - HEXPYRION recovers Python source from Nuitka-compiled PE, ELF, and Mach-O binaries. _{Tool · Full entry}
• IDA YARA processor - This is an IDA loader and processor for YARA's compiled rule format. _{Tool · Full entry}
• ida-headless - ida-headless embeds RPyC in IDA so a background thread serves IDA's API over TCP port 18812. _{Tool · Full entry}
• UQBT - UQBT is the University of Queensland binary translator. _{Tool · Full entry}
• IDA embed arch disasm - This IDA plugin disassembles x86-64 instructions, including inlined WOW64 code, inside a 32-bit IDA database. _{Tool · Full entry}
• PowerBuilder decompile - This Python module reads PowerBuilder PBD files. _{Tool · Full entry}
• x64dbg_ext - x64dbg_ext adds three commands to x64dbg. _{Tool · Full entry}
• SemRay - SemRay is an IDA Pro plugin that sends decompiler context to the Gemini API and applies reviewed names back to the IDB. _{Tool · Full entry}
• Paper Mario split - This splits the US Paper Mario ROM for the Nintendo 64. _{Tool · Also: Game · Full entry}
• delink - delink splits binaries for decompilation projects. _{Tool · Full entry}
• AFL++ - AFL++ is a coverage-guided fuzzer forked from American Fuzzy Lop. _{Tool · Full entry}
• AsmDude2 - AsmDude2 is a Visual Studio 2022 extension and language server for assembly. _{Tool · Full entry}
• RePKG - RePKG is a C# unpacker for Wallpaper Engine PKG files and a converter for TEX images. _{Tool · Full entry}
• Malimite - Malimite decompiles iOS and macOS IPA files and application bundles on Mac, Windows, and Linux. _{Tool · Full entry}
• SPIRV-Cross - SPIRV-Cross parses SPIR-V and converts it to GLSL, Metal Shading Language, HLSL, and a JSON reflection format. _{Tool · Full entry}
• PowerUp - PowerUp is a set of disassembly and decompilation utilities. _{Tool · Full entry}
• BiTE - BiTE inspects executable content and debug information. _{Tool · Full entry}
• gooMBA - gooMBA is a Hex-Rays Decompiler plugin that simplifies mixed Boolean-arithmetic expressions. _{Tool · Full entry}
• NtRays - NtRays is a Hex-Rays microcode plugin that simplifies Windows kernel decompilation. _{Tool · Full entry}
• Fickling - Fickling decompiles and statically analyzes Python pickle serializations, including PyTorch files. _{Tool · Full entry}
• r2ghidra - r2ghidra integrates the Ghidra decompiler into radare2. _{Tool · Full entry}
• Oxidizer - Oxidizer is a Rust decompiler on angr. It identifies compiler versions from 1.39.0 through 1.93.0, recovers standard-library functions, and emits Rust pseudocode with enums, match, the ? _{Tool · Full entry}
• E-Decompiler - E-Decompiler is an IDA plugin for analyzing EPL programs. _{Tool · Full entry}
• Nyxstone - Nyxstone assembles and disassembles code with the LLVM libraries already shipped by Linux distributions, Homebrew, and apt.llvm.org. _{Tool · Full entry}
• Mikage Developer Edition - Mikage Developer Edition is a Nintendo 3DS emulator. _{Tool · Full entry}
• STrace - STrace reimplements the Windows DTrace syscall and ETW probes. _{Tool · Full entry}
• BinAIVulHunter - BinAIVulHunter is an IDA Pro plugin that sends Hex-Rays decompiled functions to OpenAI, Google Gemini, or a local Ollama model and reports possible vulnerabilities. _{Tool · Full entry}
• pyasmtools - pyasmtools has a Python bytecode disassembler and a tracer that prints each executed source line with the variables loaded and stored. _{Tool · Full entry}
• GameRoy - GameRoy is a Rust Game Boy emulator and debugger for the original DMG. _{Tool · Also: Game · Full entry}
• chernobog - chernobog is a Hex-Rays decompiler plugin for Hikari LLVM obfuscation. _{Tool · Full entry}
• ProjectorRays - ProjectorRays decompiles Adobe Director and Shockwave movies back to Lingo and editable project files. _{Tool · Full entry}
• Mupen64Plus-Next - Mupen64Plus-Next is a Nintendo 64 emulation library for the libretro API and the successor of the older Mupen64Plus libretro core. _{Tool · Also: Game · Full entry}
• disasm.pro - disasm.pro, formerly disasm.ninja, is a multi-architecture assembler and disassembler with line-to-line correlation. _{Tool · Full entry}
• ROPMEMU - ROPMEMU analyzes code-reuse attacks from a physical memory dump and reconstructs equivalent code for ordinary reverse-engineering tools. _{Tool · Full entry}
• abi-decompiler - abi-decompiler recovers names and argument counts for functions in Ethereum bytecode. _{Tool · Full entry}
• fREedom - fREedom extracts disassembly from executables into the Postgres tables that BinNavi reads, without IDA Pro. _{Tool · Full entry}
• EmuDbg - EmuDbg debugs a Windows executable by disassembling it with Zydis and emulating its instructions. _{Tool · Full entry}
• DolRecomp - DolRecomp statically recompiles GameCube and Wii PowerPC code, with an early Espresso path for Wii U RPX files. _{Tool · Also: Game · Full entry}
• Py2ExeDecompiler - Py2ExeDecompiler recovers source from executables built with py2exe. _{Tool · Full entry}
• dcc - dcc is Cristina Cifuentes and Mike Van Emmerik's decompiler for DOS executables, with later fixes for memory reallocation during decompilation. _{Tool · Full entry}
• HRAST - HRAST is an IDAPython proof of concept for matching and rewriting the Hex-Rays ctree. _{Tool · Full entry}
• Ouroboros - Ouroboros is a Rust decompiler that recovers structure with symbolic execution and constraint tracking. _{Tool · Full entry}
• genmc - genmc is an IDAPython script and plugin that displays Hex-Rays microcode. _{Tool · Full entry}
• serum-preset-packager - serum-preset-packager reads and writes Serum 2 preset files using a format the author reverse engineered. _{Tool · Library · Also: App · Full entry}
• OpenJOC - OpenJOC decodes and inspects E-AC-3 JOC audio bitstreams in Rust. _{Tool · Library · Full entry}
• Felix - Felix is an Atari Lynx emulator with facilities for analysing software running inside it. _{Tool · Full entry}
• aftereffects-aep-parser - aftereffects-aep-parser is a Go library for inspecting Adobe After Effects AEP project files. _{Tool · Library · Also: App · Full entry}
• OpenQBW - OpenQBW reverse engineers the QuickBooks Desktop .qbw company-file format and provides a Rust reader, CLI, Python bindings and a format specification. _{Tool · Library · Also: App · Full entry}
• WinTTD - WinTTD exposes recovered WinDBG virtual CPU structures and callback layouts for instruction instrumentation. _{Tool · Full entry}
• pyhwp - pyhwp parses HWP Document Format v5 files and extracts their internal streams. _{Tool · Library · Also: App · Full entry}
• apfs-fuse - apfs-fuse examines Apple File System volume structures with apfs-dump and apfs-dump-quick, and mounts APFS volumes through a read-only FUSE driver. _{Tool · Library · Full entry}
• Crate Digger - Crate Digger parses rekordbox export databases and track-analysis files with Kaitai Struct definitions and generated Java classes. _{Tool · Library · Also: App · Full entry}
• MDB Tools - MDB Tools reads Microsoft Access MDB files and documents the Jet3 and Jet4 file format. _{Tool · Library · Also: App · Full entry}
• ExtractAltiumSTEPModels - ExtractAltiumSTEPModels is a Python proof of concept for recovering STEP component models embedded in Altium .PcbDoc PCB project files. _{Tool · Library · Also: App · Full entry}
• Rustation PlayStation debugger - Rustation embeds a GDB remote debugger in a Rust PlayStation emulator core for inspecting running game code. _{Tool · Also: Game · Full entry}
• Unshield - Unshield lists and extracts files from InstallShield cabinet files through a C tool and library. _{Tool · Library · Also: App · Full entry}
• XBEpy - XBEpy is a Python library for inspecting Microsoft Xbox executable files. _{Tool · Library · Full entry}
• libagdb - libagdb analyzes the Windows SuperFetch database format and provides C library code and tools for accessing it. _{Tool · Library · Also: App · Full entry}
• StringsX64DbgNext - StringsX64DbgNext scans the main module of an x64dbg debuggee for printable ANSI and UTF-16LE strings. _{Tool · Full entry}
• gho - gho reads, extracts, creates and modifies Norton Ghost GHO disk images through a Go library and CLI. _{Tool · Library · Also: App · Full entry}
• tps-parse - tps-parse reads Clarion TPS database files using a Java parser built from reverse-engineered file structures. _{Tool · Library · Also: App · Full entry}
• OpenOrCadParser - OpenOrCadParser parses Cadence OrCAD Capture binary schematics and symbol libraries with a C++20 library and CLI. _{Tool · Library · Also: App · Full entry}
• xvdtool - xvdtool is a C# command-line utility for inspecting Xbox One XVD and XVC packages. _{Tool · Library · Also: Game · Full entry}
• MartyPC - MartyPC emulates early IBM PCs and provides disassembly, CPU and memory inspection, breakpoints, and instruction or cycle-based logging for 8088 programs. _{Tool · Full entry}
• ptformat - ptformat decrypts and parses Pro Tools session files to extract audio sources, regions and tracks, plus MIDI chunks, regions, tracks and notes. _{Tool · Library · Also: App · Full entry}
• LibreDWG - LibreDWG reads and writes AutoCAD DWG documents through a C library and command-line tools. _{Tool · Library · Also: App · Full entry}
• libsai - libsai documents and implements access to PaintTool SAI .sai artwork files. _{Tool · Library · Also: App · Full entry}
• Hiew - Hiew edits files in text, hex and disassembler modes and supports x86-64 assembly and disassembly. _{Tool · Full entry}
• OpenSKP - OpenSKP parses, writes, and converts SketchUp SKP files using independently implemented Python, TypeScript, .NET, Dart, and C++ libraries. _{Tool · Library · Also: App · Full entry}
• rekordcrate - rekordcrate is a Rust parser and command-line inspector for Pioneer Rekordbox exports used by CDJ and XDJ players. _{Tool · Library · Also: App · Full entry}
• Dislocker - Dislocker inspects and decrypts BitLocker encrypted volumes on Linux and macOS. _{Tool · Library · Full entry}
• libflp - libflp is a C++ library for parsing FL Studio .flp project files. _{Tool · Library · Also: App · Full entry}
• innodb_ruby - innodb_ruby parses InnoDB file formats to expose database storage structures for investigation and teaching. _{Tool · Library · Full entry}
• Hidden Bee IDA loader - Hidden Bee IDA loader imports the malware family's stripped-down PE-like payload format into IDA for binary analysis. _{Tool · Full entry}
• OpenAllegroParser - OpenAllegroParser is a C++17 library and CLI for investigating Cadence Allegro binary design files. _{Tool · Library · Also: App · Full entry}
• LogicX Analyzer - LogicX Analyzer inspects Logic Pro .logicx project bundles and studies their undocumented ProjectData binary format. _{Tool · Library · Also: App · Full entry}
• FunctionParser - FunctionParser identifies function ranges in IDA Pro HTML, reads switch-case error addresses from a XenonRecomp log and writes function entries for a XenonRecomp TOML configuration. _{Tool · Full entry}
• hyperscan-emulator - hyperscan-emulator loads a HyperScan firmware image into emulated memory and exposes CPU execution through an interactive debugger. _{Tool · Also: Firmware · Full entry}
• AppleWin - AppleWin emulates Apple II computers on Windows and includes a symbolic debugger for inspecting running software. _{Tool · Full entry}
• PyFLP - PyFLP parses FL Studio project and preset files in Python. _{Tool · Library · Also: App · Full entry}

↑ Contents

175 case studies. The 10 newest are below. Full case list.

• fdsboot: Famicom Disk System boot ROM disassembly - fdsboot is a 6502 disassembly of the Famicom Disk System boot ROM, split into disk I/O, PPU, joypad, timer, sound, interrupt and random-number routines with include files for the console and FDS registers. _{Case study · Independent reconstruction · Full entry}
• gyx-decomp: Casio ES PLUS GYX firmware decompilation - gyx-decomp is a decompilation of the Casio ES PLUS GYX scientific calculator firmware, which runs on ROHM nX-U8/100 microcontrollers. _{Case study · Independent reconstruction · Full entry}
• vmiv: View-Master Interactive Video emulator and format notes - vmiv emulates the View-Master Interactive Video system by decoding a captured tape video with FFmpeg, extracting the UART-style data bytes and auxiliary audio carried in the scanlines, and feeding them to an 8051 core that runs the VMI8802 ROM alongside a TMS9128 video chip model rendered with SDL2. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• 6502 Model: reconstructing 65C02 cycle behavior - 6502 Model reconstructs the 65C02 chip’s cycle behavior in Rust from traces of external buses recorded during execution on a physical chip. _{Case study · Independent reconstruction · Full entry}
• B3603: reconstructing control-board behavior for replacement firmware - B3603 investigates the buck converter's control board to support replacement STM8 firmware. _{Case study · Independent reconstruction · Full entry}
• Band 9 表盘生成器: Huawei Band 9 HWT watch-face format reconstruction - Band 9 表盘生成器 reconstructs the Huawei Band 9 HWT watch-face package format from binary observations of public packages and builds installable packages for the 194 × 368 HWHD07 screen. _{Case study · Independent reconstruction · Full entry}
• BCM5719 Firmware Reimplementation: rebuilding network-card firmware - BCM5719 Firmware Reimplementation rebuilds firmware for the Broadcom BCM5719 network controller from the Ortega specification. _{Case study · Independent reconstruction · Full entry}
• CamLink 4K: replacement gateware and firmware for an Elgato capture card - CamLink 4K rebuilds the first-generation Elgato Cam Link 4K capture pipeline with LiteX gateware for its ECP5 FPGA and bare-metal C firmware for its FX3 controller. _{Case study · Independent reconstruction · Full entry}
• canon_cr3: mapping Canon CR3 camera files - canon_cr3 maps Canon camera image files, especially the CR3 container and its CRX image structures. _{Case study · Independent reconstruction · Full entry}
• Capybara: reconstructing Sonix hardware for Tamagotchi Paradise firmware - Capybara reconstructs the Sonix SNC73410 hardware environment needed to run Tamagotchi Paradise factory firmware on a computer. _{Case study · Independent reconstruction · Full entry}

• Binwalk - Identifies embedded formats and optionally extracts their contents, with entropy analysis for firmware triage. _{Tool · Full entry}
• unblob - Recursively extracts archives and filesystems from binary blobs while reporting chunk boundaries and unknown regions. _{Tool · Full entry}
• Ghidra Firmware Utilities - Ghidra loaders and helpers for PCI option ROMs, UEFI firmware volumes, Intel flash descriptors and coreboot images. _{Tool · Full entry}
• EMBA - Extract firmware, combine static checks with emulation-based analysis, inventory software components, and generate web reports and SBOMs for further investigation. _{Tool · Full entry}
• Firmware Analysis and Comparison Tool (FACT) - Unpack and analyze firmware through an extensible platform whose web interface and HTTP API make component contents and analysis results searchable and comparable across samples. _{Tool · Full entry}
• OFRAK - Recursively identify, unpack, analyze, modify, and repack firmware and binary formats using a resource-tree GUI and Python API, with optional disassembler backends. _{Tool · Also: Binary · Full entry}
• FirmAE - Emulate router and IP-camera firmware to inspect network services and runtime behavior, with automated emulation checks and separate analysis, run, and debugging modes. _{Tool · Full entry}
• PulseView - Examine captured logic and analog waveforms with sigrok's graphical frontend. _{Tool · Also: Protocol · Full entry}
• UEFITool - Parse UEFI firmware images into an inspectable tree and check their structure. _{Tool · Full entry}
• Glasgow Interface Explorer - Use FPGA-based open hardware and Python applets to read and write SPI flash, I2C EEPROM and parallel memory chips, determine JTAG pinouts, debug supported processors and analyze UART, SPI and QSPI transactions on physical devices. _{Tool · Also: Protocol · Full entry}
• Penguin - Rehost embedded Linux firmware from an extracted root filesystem using a generated, editable configuration of emulation transformations, then refine it through a guest root shell, forwarded network services and recorded dynamic-analysis output. _{Tool · Full entry}
• ipsw - Command-line toolkit for Apple firmware research and reverse engineering. _{Tool · Also: App, Binary · Full entry}
• avatar² - Python framework from EURECOM's S3 group that orchestrates emulators, debuggers and physical devices for dynamic analysis of embedded firmware. _{Tool · Full entry}
• efiXplorer - IDA Pro plugin and loader that automate static analysis of UEFI firmware. _{Tool · Full entry}
• vmlinux-to-elf - Rebuild an analyzable ELF with function and variable symbols from a Linux kernel image, whether a raw or compressed vmlinux, vmlinuz, zImage or bzImage blob, certain Android boot.img files or a stripped kernel ELF, by locating and decoding the embedded kallsyms symbol table. _{Tool · Also: Binary · Full entry}
• Sony-PMCA-RE - USB tool built from reverse engineering Sony digital cameras. _{Tool · Also: Protocol · Full entry}
• cpu_rec - Statistically recognize the CPU instruction set in an arbitrary binary file, such as an unknown firmware image, by comparing Markov-chain byte statistics with a default corpus covering dozens of architectures, from 6502 and 8051 to ARM, MIPS, PowerPC, RISC-V, x86-64 and WebAssembly. _{Tool · Also: Binary · Full entry}
• ME Analyzer - Parse Intel Management Engine (CS)ME, TXE and SPS firmware, Graphics System Controller firmware and their independent PMC, PCHC, PHY and option-ROM images to report family, version, release, SKU, platform, size and health status. _{Tool · Full entry}
• CHIPSEC - Platform security assessment framework, with Intel Corporation copyright notices, for analyzing PC hardware configuration, BIOS/UEFI system firmware and platform components from Windows, Linux or the UEFI shell. _{Tool · Full entry}
• binbloom - Quarkslab command-line tool that infers basic properties of a headerless raw firmware image from simple statistics on its content, which is why the README says it works with any architecture. _{Tool · Full entry}
• m1n1 - Asahi Linux's bootloader and hardware-research environment for Apple Silicon Macs. _{Tool · Full entry}
• SVD-Loader for Ghidra - Ghidra script from leveldown security that reads a CMSIS-SVD file, the XML format describing a microcontroller's memory-mapped peripherals and their registers, and applies it to firmware already loaded in Ghidra. _{Tool · Full entry}
• UEFI Firmware Parser - Python library and uefi-firmware-parser command for identifying, parsing and extracting PC firmware images: UEFI firmware volumes, capsules, firmware file systems, files and sections, Intel PCH flash descriptors, Intel ME modules and Dell PFS update packages. _{Tool · Full entry}
• ESP32 Bit Pirate - Open-source firmware that turns ESP32-S3 boards into a Bus Pirate-inspired multi-protocol hardware tool, operated from a USB serial terminal, a Wi-Fi web CLI or the M5 Cardputer's own keyboard and screen. _{Tool · Also: Protocol · Full entry}
• Firmware Analysis Toolkit (FAT) - Attify's firmware security toolkit, rewritten for version 2 as a Rust command-line tool built around per-image projects. _{Tool · Also: Binary · Full entry}
• FujiHack - Research codebase for reverse engineering Fujifilm cameras so that custom code can run on them under a patched firmware. _{Tool · Full entry}
• efiSeek - Ghidra analyzer extension from Digital Security for individual UEFI modules, enabled by default during auto-analysis of x86 and x64 PE images with an EFI subsystem. _{Tool · Full entry}
• FwAnalyzer - Rule-based checker for filesystem images taken from firmware: it reads ext2/3/4, FAT/VFAT, SquashFS and UBIFS images, cpio archives or a directory, and writes a JSON report of every file that breaks the rules in a TOML configuration. _{Tool · Full entry}
• FwHunt Community Scanner (fwhunt-scan) - Binarly's Python scanner that checks UEFI firmware modules against FwHunt rules, the YAML detection format for known UEFI firmware vulnerabilities whose rules are kept in the separate fwhunt repository. _{Tool · Full entry}
• sniffROM - Python tool that reconstructs serial flash contents from passive bus captures: it parses SPI or I²C analyzer exports from Saleae Logic, recorded while a device reads and writes its own flash chip, and writes the observed data into a binary image at the original memory addresses. _{Tool · Also: Protocol · Full entry}
• Pawn - Linux command-line tool from Google that reads the BIOS/UEFI firmware image out of the SPI flash of Intel-based workstations and laptops. _{Tool · Full entry}
• EMBArk - Web-based enterprise interface for the EMBA firmware security scanner, which it installs and runs as its scanning backend. _{Tool · Full entry}
• IDAPython Embedded Toolkit - Maddie Stone's IDAPython scripts for triaging and annotating embedded-device firmware images in IDA Pro, presented at RECON Montreal and DerbyCon in 2017. _{Tool · Also: App · Full entry}
• fiano - LinuxBoot's Go tools and libraries for parsing and modifying UEFI firmware images. _{Tool · Full entry}
• Pyrrha - Quarkslab's firmware cartography tool, which indexes an extracted firmware filesystem into a database browsed with NumbatUI, Quarkslab's fork of the Sourcetrail code explorer. _{Tool · Also: Binary · Full entry}
• RETracker - Python reverse-engineering framework for the Polyend Tracker music device that patches the vendor's stock firmware, replacing an unused USB RAWHID handler with its own command handler. _{Tool · Full entry}
• Titan M tools (Quarkslab) - Tools Quarkslab published from its research on Google's Titan M security chip in Pixel phones: a Ghidra loader for Titan M (Citadel) firmware files, nosclient for tracing and sending the chip's protobuf-based commands from Android with a black-box fuzzer built on libprotobuf-mutator, a parser for sigrok SPI captures, and scripts that convert firmware images to the rec files of the chip's SPI rescue feature. _{Tool · Also: Protocol · Full entry}
• uefi_retool - Python command-line tool and IDA Pro plugin for UEFI firmware reverse engineering. _{Tool · Full entry}
• Shannon Modem Loader for IDA Pro - IDA Pro loader and post-processing scripts for Samsung Exynos "Shannon" baseband modem images that carry a TOC header, including crash dumps. _{Tool · Full entry}
• IMSProg - Qt desktop programmer that reads, writes, erases and verifies I2C, SPI and MicroWire EEPROMs, FeRAM, DataFlash and SPI NOR/NAND flash chips through low-cost CH341A, CH347T and FT232H USB programmers. _{Tool · Full entry}
• rbasefind - Multithreaded Rust command-line tool that brute-forces the load address of a flat 32-bit firmware image, reimplementing mncoppola's basefind.py and rsaxvc's basefind.cpp. _{Tool · Full entry}
• Aptio V UEFI Editor - Browser-based editor for the setup menus of AMI Aptio V UEFI firmware, offered as an alternative to AMIBCP. _{Tool · Full entry}
• FirmLoader - IDA plugin that applies a microcontroller's memory map to a raw firmware image: once the analyst picks an MCU model, it creates RAM and other memory segments, adds peripheral segments with named registers and, where a vector table is described, labels its entries and turns the handlers they point to into functions. _{Tool · Full entry}
• IFDA (IoT Firmware Deep Analysis) - Static analysis pipeline for extracted IoT firmware: pointed at one ELF or an unpacked root filesystem, it disassembles binaries with Capstone for x86, ARM/Thumb-2, AArch64 and MIPS, recovers functions, call graphs and exploit mitigations, and reports candidate issues from dangerous-function calls, call-graph taint paths, CVE correlation through cve-bin-tool, embedded secrets, script injection patterns and filesystem hardening checks. _{Tool · Also: Binary · Full entry}
• basefind2 - Python script that estimates the load address of a flat 32-bit little-endian firmware image without brute-forcing every candidate base, building on mncoppola's basefind.py and rbasefind. _{Tool · Full entry}
• JTAGulator - Joe Grand's open-source hardware tool and Parallax Propeller firmware for locating on-chip debug interfaces among an unfamiliar board's test points, vias, component pads or connectors. _{Tool · Full entry}
• BIOSUtilities - Python collection of 16 parsers and extractors for vendor BIOS/UEFI update formats, including AMI BIOS Guard (PFAT) and UCP, Dell PFS, Insyde iFlash/iFdPacker, Phoenix TDK Packer, Award, Fujitsu, Panasonic, Portwell, Toshiba and VAIO packages and several Apple EFI containers. _{Tool · Full entry}
• allyourbase - Python script that estimates a firmware image's base address by comparing string addresses with the targets of every possible pointer, for any pointer size and either endianness. _{Tool · Full entry}
• ghidra_kernelcache - Ghidra script framework for reverse engineering Apple kernelcaches and kernel extensions on iOS and macOS. _{Tool · Also: Binary · Full entry}
• esp32_image_parser - Tenable's Python command-line tool, described in its repository as a toolkit for reverse engineering ESP32 firmware, that reads the partition table of an ESP32 flash dump and rebuilds an app partition such as factory or ota_0 as an Xtensa ELF file. _{Tool · Full entry}
• Tigard - Open-hardware board built around the FTDI FT2232H that connects a computer to a target device's UART, SPI, I2C, JTAG and SWD interfaces through level shifters that operate from 1.8 to 5.5 V. _{Tool · Also: Protocol · Full entry}
• UBI Reader - Python module and command-line scripts that read UBI and UBIFS images, including ones inside raw NAND dumps, by locating the first UBI or UBIFS data in a file. _{Tool · Full entry}
• payload-dumper-go - Go command-line tool and library that extracts partition images from Android A/B OTA payloads, reading either a raw payload.bin or the OTA zip that contains it in place. _{Tool · Full entry}
• mithril - Offline C++ scanner for the contents of firmware and IoT software, pointed at a single file or an already unpacked root filesystem, that reports embedded secrets, a software bill of materials, known CVEs, open-source licenses, boot-security configuration and weak or publicly known keys, each finding with its evidence and a confidence level. _{Tool · Full entry}
• img4tool - tihmstar's command-line tool and C++ library for Apple's IMG4 firmware container format. _{Tool · Full entry}
• payload dumper - Python script that extracts the partition images, such as boot.img and system.img, from the payload.bin inside an Android OTA update package. _{Tool · Full entry}
• PMCA-RE RELOADED - PMCA-RE RELOADED is a Rust desktop and CLI toolkit for Sony cameras that includes experimental analysis of where menu settings reside in camera settings memory. _{Tool · Full entry}
• ThisFirmwareDoesNotExist - ThisFirmwareDoesNotExist maps Arturia MicroFreak firmware 5.0.0.2084 and provides freakpatch to modify a user's official update file. _{Tool · Full entry}
• intel_ma - intel_ma inspects PC management firmware in ME/TXE/CSME region images and full SPI dumps. _{Tool · Full entry}
• qemu-rtd2841 - qemu-rtd2841 adds a Realtek RTD2841/RTK284x TV machine model to QEMU for bare-metal diagnostics and local firmware experiments. _{Project · Full entry}
• MS4X - MS4X analyzes Siemens MS42 and MS43 engine-control firmware for BMW M52TU and M54 engines. _{Tool · Full entry}
• AC46 Firmware Tool - AC46 Firmware Tool unpacks firmware images for JieLi AC4600/BT15 devices. _{Tool · Full entry}
• Bin X-ray - Bin X-ray visualizes byte patterns in unknown files and firmware blobs through a 256×256 byte-pair matrix and a 3D byte-trigram plot. _{Tool · Full entry}
• PIC microcontrollers disassembler - PIC microcontrollers disassembler converts Intel HEX dumps for MidRange and Enhanced MidRange PIC12/PIC16 devices into disassembly listings, HI-TECH PICC assembly files, or both. _{Tool · Full entry}
• premium5 - premium5 emulates the Volkswagen Premium 5 car radio at the register and signal level so its original firmware can run without patches. _{Project · Full entry}
• SPRD Flash Tool - SPRD Flash Tool implements the SPRD/UNISOC PAC download protocol in Rust for RDA8910 and UIS8910 devices. _{Tool · Also: Protocol · Full entry}
• PCM Explorer - PCM Explorer is a read-only Python browser for Porsche PCM and Audi MMI head-unit images. _{Tool · Full entry}
• me_cleaner - me_cleaner is a Python script that modifies Intel ME firmware images to reduce the firmware's ability to interact with the system. _{Tool · Full entry}
• Black Magic Debug - Black Magic Debug is a self-contained debugger for microcontrollers. _{Tool · Full entry}
• OpenOCD - OpenOCD is a tool for programming and debugging embedded targets through hardware debug adapters. _{Tool · Full entry}
• qc_debug_monitor - Python monitor by Dmytro Oleksiuk (Cr4sh) that reads debug messages from Qualcomm cellular-modem firmware in real time over the modem's DIAG serial port, on a rooted Android phone or a USB modem. _{Tool · Full entry}
• sasquatch - Patches to the unsquashfs utility from squashfs-tools 4.3 that try to read as many vendor-modified SquashFS implementations from embedded firmware as possible. _{Tool · Full entry}
• FIRMADYNE - Rehost extracted Linux-based embedded firmware with instrumented kernels, NVRAM emulation and inferred network configuration. _{Tool · Full entry}
• flashrom - Identify and read supported flash chips to obtain firmware images for offline inspection, with separate write and verification operations. _{Tool · Full entry}
• InternalBlue - Study and patch supported Broadcom/Cypress Bluetooth firmware while observing link-layer traffic on the participating device. _{Tool · Also: Protocol · Full entry}
• MC Extractor - Find and extract CPU microcode from firmware images, inspect microcode headers and compare entries against a version database. _{Tool · Full entry}
• MTKClient - Inspect MediaTek device flash and partitions through chipset-specific boot-ROM or preloader interfaces. _{Tool · Full entry}
• BoschMe7x - BoschMe7x is an IDA Pro plugin that reads a Bosch ME7.x binary and tries to disassemble it. _{Tool · Full entry}
• CeDImu - CeDImu emulates selected Philips CD-I player hardware so user-provided BIOS images can run and be inspected. _{Tool · Full entry}
• CasioEmuNeo - CasioEmuNeo disassembles Casio calculator ROMs for use with its nX-U8/100 emulator and debugger. _{Tool · Full entry}
• remus-rlf-reader - remus-rlf-reader parses REMUS-100 autonomous underwater vehicle run logs and companion ADCP, GPS, and mission files using an empirically derived record layout. _{Tool · Full entry}
• unME11 - unME11 unpacks Intel ME 11.x firmware regions with Python 2.7 scripts. _{Tool · Full entry}
• pocketwalker - pocketwalker emulates the PokéWalker's H8/38606F hardware for running its device software. _{Tool · Full entry}
• Wii U Firmware Emulator - Wii U Firmware Emulator models the console's processors and hardware to run user-dumped boot1, IOSU and Cafe OS through the menu stage. _{Tool · Full entry}
• Project IceStorm - Project IceStorm documents the Lattice iCE40 FPGA configuration bitstream format and supplies tools to analyse and create bitstream files. _{Tool · Full entry}

↑ Contents

645 case studies. The 10 newest are below. Full case list.

• 433home: reconstructing REV power-switch radio commands - 433home reconstructs the 433 MHz control signals of REV wireless power sockets. _{Case study · Independent reconstruction · Full entry}
• A-OK: reconstructing a 433.92 MHz remote-control protocol - A-OK implements the 433.92 MHz remote-control protocol used by AC114-01B controls for roller shades and projector screens. _{Case study · Independent reconstruction · Full entry}
• Acurite 00592TX Decoder: decoding wireless sensor messages - Acurite 00592TX Decoder implements a receiver for the 433.92 MHz messages sent by AcuRite 00592TX, 06002M and 06044 temperature sensors. _{Case study · Independent reconstruction · Full entry}
• AcuRite 00592TX: decoding wireless temperature frames - The AcuRite 00592TX investigation captures and decodes 433 MHz temperature-probe transmissions with Arduino. _{Case study · Independent reconstruction · Full entry}
• aioharmony: Logitech Harmony Hub protocol notes and client - aioharmony documents Logitech Harmony Hub authentication and control messages while providing an asyncio client for the device. _{Case study · Independent reconstruction · Full entry}
• AirDrop for Windows: investigating iPhone discovery and AWDL reception - AirDrop for Windows investigates how an iPhone discovers receivers and sends files over AWDL. _{Case study · Independent reconstruction · Full entry}
• AirVideo for Ruby: reconstructing server communication - AirVideo for Ruby implements a client for the AirVideo server from a reverse engineered communication protocol. _{Case study · Independent reconstruction · Full entry}
• Ajazz AK820 Pro: reconstructing keyboard lighting control on Linux - Ajazz AK820 Pro Linux Software reconstructs lighting control for the Ajazz SONiX AK820 Pro keyboard from USB traffic captured with Wireshark and PCapUSB. _{Case study · Independent reconstruction · Full entry}
• AK·LINK: reconstructing AJAZZ AK820 Pro HID control - AK·LINK implements Linux control of the AJAZZ AK820 Pro keyboard through its recovered wired HID commands for lighting, per-key RGB and the TFT screen. _{Case study · Mixed workflow · Full entry}
• Apple Wi-Fi Password Sharing: reconstructing the sharing protocol - Apple Wi-Fi Password Sharing reconstructs grantor and requestor behavior for Apple's Wi-Fi password-sharing protocol on macOS. _{Case study · Independent reconstruction · Full entry}

• Wireshark - Inspect captured application and device traffic as decoded protocol fields, with filtering and shared GUI/TShark dissection. _{Tool · Also: App, Firmware · Full entry}
• Netzob - Model communication protocols and infer message layouts from traces, with configured active learning for protocol state machines. _{Tool · Full entry}
• Scapy - Script packet dissection, construction, request/reply matching and capture-file analysis in Python. _{Tool · Full entry}
• Universal Radio Hacker (URH) - Demodulate and decode signals captured with software-defined radios, with automatic modulation-parameter detection and customizable decodings. _{Tool · Full entry}
• SavvyCAN - Capture or load CAN bus traffic and investigate frames with sniffer, graphing, file-comparison and ISO-TP/UDS decoding views; loaded or analyst-edited DBC files map raw bytes to named signals. _{Tool · Full entry}
• AALpy - General-purpose Python automata-learning library that infers deterministic, non-deterministic, stochastic and pushdown models of black-box systems from active queries or passive traces. _{Tool · Full entry}
• rtl_433 - Receives and decodes transmissions from ISM-band devices such as weather sensors, remote controls, doorbells and alarm sensors, using RTL-SDR or SoapySDR receivers or recorded I/Q files, and emits decoded fields as JSON, CSV, MQTT and other outputs. _{Tool · Full entry}
• Blackbox Protobuf - NCC Group's tools for decoding and re-encoding Protocol Buffers messages without the matching .proto definition. _{Tool · Also: App · Full entry}
• furiousMAC Continuity - Reverse-engineering notes and a Wireshark dissector for Apple's proprietary Continuity Bluetooth LE advertisements, continuing the authors' PETS 2019 privacy study. _{Tool · Full entry}
• opendbc - comma.ai's repository of DBC files describing the CAN messages and signals of many car makes, with a Python library that parses and builds CAN messages from those definitions; its porting guide has contributors reverse engineer new messages from recorded drives in the cabana tool. _{Tool · Full entry}
• FISSURE - GNU Radio-based RF framework that carries a signal from survey and detection through IQ capture, inspection, conditioning, feature extraction and classification into a protocol discovery workflow. _{Tool · Full entry}
• friTap - Frida-based tool that hooks TLS libraries such as OpenSSL, BoringSSL, NSS and GnuTLS inside a running process and writes NSS key logs and decrypted payloads as PCAP, so analysts can inspect an application's encrypted traffic in Wireshark. _{Tool · Also: App · Full entry}
• pbtk - Recover Protobuf message definitions from compiled programs as readable .proto files. _{Tool · Also: App · Full entry}
• SteamKit - .NET library that implements the client side of Valve’s Steam network protocol: connection-manager sessions, authentication, friends, unified service and Game Coordinator messages, Web API calls and CDN depot downloads. _{Tool · Also: Game · Full entry}
• protobuf-inspector - Parses Protocol Buffers blobs (proto2 or proto3) without their .proto definition and prints a colored view of the fields in wire order, trying each length-delimited chunk as a nested message, then a packed array, a string and finally a hexdump. _{Tool · Full entry}
• libimobiledevice - C library and command-line tools that speak iOS devices' native service protocols without Apple's proprietary libraries or a jailbreak. _{Tool · Also: App · Full entry}
• Sniffle - NCC Group's sniffer for Bluetooth 5 and 4.x Low Energy, made of firmware for TI CC1352/CC26x2 radio boards and Python host tools. _{Tool · Full entry}
• Packetry - Great Scott Gadgets' USB 2.0 protocol analysis application for live capture with the Cynthion analyzer or for exploring previously captured traffic, working from physical-layer packet data at High, Full and Low Speed. _{Tool · Full entry}
• Caring Caribou - Python automotive security exploration tool, begun in the HEAVENS research project, that the README describes as a zero-knowledge tool to drop onto a CAN network and collect information about the services present. _{Tool · Full entry}
• protodump - Go command-line utility that recovers Protocol Buffers schemas from a compiled binary or any other file: it scans the raw bytes for serialized FileDescriptorProto records embedded by generated code, locating them through their .proto file names, and writes each one back out as a .proto source file under its original descriptor path. _{Tool · Also: Binary · Full entry}
• CAN Commander - A Flipper Zero app and earlier Arduino sketches for reverse engineering CAN bus traffic, chiefly in vehicles. _{Tool · Full entry}
• Automated CAN Payload Reverse Engineering - Research Python and R scripts that automate reverse engineering of Controller Area Network (CAN) payloads recorded from passenger vehicles, implementing the pipeline from Brent Stone's AFIT dissertation. _{Tool · Full entry}
• Deluder - Frida-based interceptor for the traffic of proxy-unaware applications. _{Tool · Also: App · Full entry}
• PiCCANTE - Raspberry Pi Pico firmware and hardware designs for a low-cost CAN bus interface aimed at exploring and reverse engineering vehicle networks. _{Tool · Full entry}
• VanBus - Arduino library for ESP8266/ESP8285 and ESP32 boards that receives and transmits packets on the VAN (Vehicle Area Network) comfort bus that PSA fitted to Peugeot and Citroën models until about 2009. _{Tool · Full entry}
• Apple Continuity Reverse Engineering Toolkit - Three macOS helpers from SEEMOO Lab that the Open Wireless Link project used to study Apple wireless services such as AirDrop, Wi-Fi Password Sharing, Handoff and Offline Finding from the host side. _{Tool · Full entry}
• Cabana (standalone openpilot-cabana) - Qt desktop CAN and CAN FD analyzer for decoding signals and reverse engineering unknown messages, split out of openpilot's cabana by Dean Lee, a frequent contributor to it, and now maintained on its own. _{Tool · Full entry}
• eCapture - eBPF-based Linux and Android tool that attaches uprobes to TLS libraries such as OpenSSL, BoringSSL, GnuTLS and NSS, and to Go's TLS stack, recording the plaintext a process sends and receives without a proxy or an installed CA certificate, so analysts can inspect an application's encrypted traffic on a host they control. _{Tool · Also: App · Full entry}
• USBPcap - Tomasz Moń's open-source USB packet capture for Windows. _{Tool · Full entry}
• cantools - Python 3 library and command-line tool for CAN bus databases that parses DBC, KCD, SYM, ARXML 3/4 and CDD files and encodes and decodes CAN messages, including simple and extended signal multiplexing and diagnostic DIDs. _{Tool · Full entry}
• inspectrum - Desktop analyzer for recorded radio signals, primarily captures from software-defined radio receivers, which the README says handles files of 100 GB and more. _{Tool · Full entry}
• PULSAR - Research prototype by Hugo Gascon and colleagues that learns a model of an unknown network protocol from recorded traffic. _{Tool · Full entry}
• CanLab - PyQt6 desktop workstation and command-line tool for reverse-engineering CAN bus captures offline. _{Tool · Full entry}
• Facedancer - Python library for implementing USB devices in software, with a hardware peripheral such as Cynthion or GreatFET acting as a remote-controlled USB controller attached to the target host. _{Tool · Full entry}
• Mirage - Python framework from IoT-security research at LAAS-CNRS for analysing wireless communications, with lightweight protocol stacks for Bluetooth Low Energy, Bluetooth, Enhanced ShockBurst, Mosart, Zigbee, Wi-Fi and infrared that a command-line interpreter drives through chainable modules. _{Tool · Full entry}
• Protobuf Decoder - Pawit Pornkitprasan's React web application for decoding Protocol Buffers data without the original .proto files, offered as a hosted page or run locally, with all decoding done in the browser. _{Tool · Full entry}
• gr-lora - GNU Radio out-of-tree module by Pieter Robyns and co-authors for receiving and decoding LoRa physical-layer frames with a software-defined radio, implementing the modulation features described in patents and blog posts. _{Tool · Full entry}
• termshark - Graham Clark's terminal user interface for tshark, inspired by Wireshark and aimed at inspecting captures on a remote machine, for example over SSH, without copying them back to a desktop. _{Tool · Full entry}
• SigDigger - Qt graphical digital signal analyzer by Gonzalo José Carracedo Carballal, built on his Suscan and Sigutils libraries; its user manual names reverse engineering of radio signals with unknown parameters as the main use. _{Tool · Full entry}
• grpc-tools - Bradley Kemp's suite of gRPC debugging tools, described as Fiddler or Charles for gRPC. _{Tool · Also: App · Full entry}
• Holley EFI Parser - Holley EFI Parser decodes Holley DL and DLZ data logs and live ECU CAN messages. _{Tool · Full entry}
• CAN Bus Parser - CAN Bus Parser decodes VanMoof SA5 and later bicycle CAN captures from CSV or candump input. _{Tool · Full entry}
• Lutron Protocols - Lutron Protocols researches CCA radio packets, CCX Thread and CoAP messages, the LEAP processor API and IPL Designer integration frames for Lutron lighting systems. _{Project · Also: App, Binary, Firmware · Full entry}
• Hermes - Hermes is a Flipper Zero app for identifying unknown UART settings and inspecting a device's serial console. _{Tool · Full entry}
• RoflLens - RoflLens is a Python library and CLI for analysing League of Legends ROFL v2 replay containers and network transport. _{Tool · Also: Game, Binary · Full entry}
• LogicAnalyzer - LogicAnalyzer is a hardware and software tool for capturing digital signals and decoding communication protocols. _{Tool · Full entry}
• BtleJuice - BtleJuice is a framework for intercepting Bluetooth Low Energy GATT operations between devices. _{Tool · Full entry}
• NearDrop - macOS menu bar app that partially implements Nearby Share and Quick Share to exchange files and links with Android devices. _{Project · Full entry}
• Impacket - Impacket is a Python library for constructing and parsing network packets and working with protocol implementations. _{Tool · Full entry}
• BtleJack - Capture Bluetooth Low Energy connections with compatible nRF51822-based boards and export packets for Wireshark analysis. _{Tool · Full entry}
• can-utils - Record, filter, compare and replay SocketCAN traffic with tools for raw CAN, ISO-TP and J1939 analysis. _{Tool · Full entry}
• libsigrokdecode - Run sigrok’s Python protocol decoders through a C library to interpret captured digital signals. _{Tool · Full entry}
• Ubertooth - Capture Bluetooth radio traffic using the Ubertooth hardware platform and its host analysis tools. _{Tool · Full entry}
• Umap2 - Explore a USB host’s supported device classes and vendor-specific behavior through programmable device emulation. _{Tool · Full entry}
• DSDcc - DSDcc decodes digital radio traffic in DMR, D-Star, dPMR and Yaesu System Fusion formats through a C++ library and command-line program. _{Tool · Full entry}
• winbox - winbox implements the Winbox protocol's M2 packet and message structures in Python. _{Tool · Full entry}
• wow_messages - wow_messages maintains World of Warcraft authentication and world-server message definitions in the wowm language. _{Tool · Full entry}
• Vifterpreter - Vifterpreter is a Rust crate for inspecting PlayStation 2 DMA packet structures and VIF commands. _{Tool · Full entry}
• meteor_decoder - meteor_decoder processes captured Meteor-M LRPT weather-satellite signals into BMP images or decoded dumps. _{Tool · Full entry}
• RF-Bridge-OB38S003 - RF-Bridge-OB38S003 provides replacement firmware for 433 MHz radio-to-Wi-Fi bridges that decodes radio packets and sniffs unknown codes. _{Tool · Full entry}
• RFLink ESP - RFLink ESP is ESP32 and ESP8266 firmware that receives and decodes 433 MHz OOK device messages. _{Tool · Full entry}
• bedrock-protocol - bedrock-protocol parses and serializes Minecraft Bedrock Edition packets as JavaScript objects and provides client, server and proxy connections. _{Tool · Full entry}
• Twonkie - Twonkie is a USB-PD sniffer, injector and sink built around a four-layer board derived from the open-source Twinkie design. _{Tool · Full entry}
• BresserWeatherSensorReceiver - BresserWeatherSensorReceiver is an Arduino library for receiving and decoding 868 MHz transmissions from Bresser weather sensors. _{Tool · Full entry}
• rtlamr - rtlamr receives and decodes Itron ERT-compatible smart-meter transmissions in the 900 MHz ISM band through rtl-sdr and rtl_tcp. _{Tool · Full entry}
• ORBCOMM receiver - ORBCOMM receiver decodes satellite transmissions into packets and parses known packet types. _{Tool · Full entry}
• iridium-sniffer - iridium-sniffer detects and demodulates Iridium L-band bursts from supported SDR devices or recorded IQ files. _{Tool · Full entry}
• Booma.Proxy - Booma.Proxy is a set of C# libraries that model Phantasy Star Online Blue Burst's binary packets for client and server emulation. _{Tool · Also: Game · Full entry}
• gr-elster - gr-elster receives and decodes 902–928 MHz packets from Elster smart meters with a GNU Radio block and sample flow graphs. _{Tool · Full entry}
• COMS-1 Meteorological Satellite Tools - COMS-1 Meteorological Satellite Tools parse LRIT and HRIT files carried by the satellite's L-band downlinks. _{Tool · Full entry}
• renard-phy - renard-phy processes Sigfox uplink and downlink radio frames in Python for software-defined radios. _{Tool · Full entry}
• Bus Pirate - Bus Pirate firmware turns v3 and v4 boards into terminal-controlled tools for investigating electronic buses. _{Tool · Full entry}
• EDACS-FM Florida Man Edition - EDACS-FM decodes EDACS 9600 trunked-radio control channels and follows assigned voice channels. _{Tool · Full entry}
• orbcomm-rx - orbcomm-rx demodulates and decodes Orbcomm VHF Subscriber Transmitter downlinks. _{Tool · Full entry}
• Meteor LRPT Decoder - Meteor LRPT Decoder processes Meteor M N2 satellite transmissions into channel packets. _{Tool · Full entry}

↑ Contents

Also in target sections: Website: Chrome DevTools MCP, Playwright MCP, Burp Suite MCP Server, Spectral · Game: RenderDoc MCP, Cheat Engine MCP Bridge · App: JADX-AI-MCP, apktool-mcp-server, frida-mcp (yfe404), Super Trouper

• REA — Reverse Engineer Anything - The upstream CLI and MCP server for evidence-based investigations of shipped software and runtime behavior. _{Project · Official REA · Targets: Website, Game, App, Binary, Firmware, Protocol · Full entry}
• Official reverse-engineer-anything skill - Target routing, connection recovery and evidence practices for agents using REA. _{Integration · Official REA · Targets: Website, Game, App, Binary, Firmware, Protocol · Full entry}
• dsh-mcp-rea - A community MCP bridge presents a smaller selected tool surface and forwards explicit commands to the REA CLI. _{Integration · Community REA · Targets: Website, Game, App, Binary, Firmware · Full entry}
• rea-jev - A Claude Code plugin adds Jev-based routing and evidence checks around a pinned REA MCP integration. _{Integration · Community REA · Targets: Website, App · Full entry}
• rea-casebook - A Claude Code mod collects received REA Evidence, tracks unknowns and records findings that cite delivered evidence IDs. _{Integration · Community REA · Targets: Binary · Full entry}
• Eleven - An agent-first desktop reverse-engineering app that opens Mach-O, ELF and PE binaries, Android packages and GPU kernels, and lets any Agent Client Protocol agent read code, rename functions, add notes and propose patches in a shared window. _{Integration · Community REA · Targets: App, Binary · Full entry}
• REA plugin for Hermes Agent - Nous Research’s Hermes Agent plugin package for REA. _{Integration · Community REA · Targets: Website, App, Binary, Firmware · Full entry}
• crashlens - A crash-triage tool that turns Linux core dumps, runtime panics, exception traces and sanitizer reports into Markdown bug reports naming the crash type, the first frame in the user’s code and a stable signature. _{Integration · Community REA · Targets: Binary · Full entry}
• REA Workspace Template - A clone-first Chinese workspace template for analyzing one target per workspace with REA from Claude Code or Codex. _{Integration · Community REA · Targets: Website, App, Binary · Full entry}
• REA Reconstruction Companion - A third-party Agent Skill that works alongside REA’s own skill to turn reverse-engineering evidence into scoped requirements, design, staged implementation and validation, from one feature or format to a whole app. _{Integration · Community REA · Targets: App, Binary · Full entry}
• App X-Ray - Builds evidence-linked HTML/JSON reports, summary cards and diffs from REA analysis of app packages, native build metadata and model files. _{Integration · Community REA · Targets: App, Binary · Full entry}
• Decepticon: REA reversing service and subagent tools - An optional reversing workload in BitterSecurity’s Decepticon wraps rea-agents and Ghidra inside a dedicated HTTP/MCP container and exposes three tools to its reverser subagent. _{Integration · Community REA · Targets: Binary · Full entry}
• Hex-Rays IDA MCP - Official Hex-Rays MCP server for agent access to IDA databases, with headless operation and optional GUI integration. _{Integration · Independent MCP · Targets: Binary · Full entry}
• GhidraMCP - Ghidra extension and MCP bridge exposing decompilation, symbol navigation and renaming to agents, with GUI and headless modes. _{Integration · Independent MCP · Targets: Binary · Full entry}
• Binary Ninja MCP (official) - Binary Ninja's own MCP interface exposes functions, symbols, disassembly, intermediate languages and decompiled text to agents. _{Integration · Independent MCP · Targets: Binary · Full entry}
• Binary Ninja MCP (fosdickio) - Community Binary Ninja plugin and bridge for MCP clients, including workflows that switch among multiple open binaries. _{Integration · Independent MCP · Targets: Binary · Full entry}
• IDA Pro MCP (mrexodia) - Community IDA integration useful for existing setups and migration context; its maintainer now recommends the official Hex-Rays MCP server. _{Integration · Independent MCP · Targets: Binary · Full entry}
• Radare2 MCP Server - Native radare2 MCP server offering binary-analysis tools, reusable sessions and configurable read-only access. _{Integration · Independent MCP · Targets: Binary · Full entry}
• r2ai - AI plugins inside radare2 for function explanations, naming suggestions and model-assisted decompilation using local or remote models. _{Integration · Independent agent · Targets: Binary · Full entry}
• DAILA - Decompiler-independent AI assistant for function summaries and naming across IDA, Ghidra, Binary Ninja and angr-management. _{Integration · Independent agent · Targets: Binary · Full entry}
• RevEng.AI Ghidra Plugin - Connects Ghidra to RevEng.AI for function similarity, recovered names, AI explanations and agent-assisted annotation. _{Integration · Independent agent · Targets: Binary · Full entry}
• LLDB MCP - LLDB's official MCP interface gives agents debugger sessions and commands for breakpoints, memory inspection and stepping. _{Integration · Independent MCP · Targets: App, Binary · Full entry}
• Claude Reverse Engineering Skill - Community agent skill for triage, headless exports and evidence-based RE reports; explicitly documents workflows with REA and other MCP servers. _{Integration · Independent agent · Targets: App, Binary · Full entry}
• SpecterOps Reverse Engineering Skills - Focused Binary Ninja and Ghidra analysis skills that describe MCP tool use, analysis recipes and annotation practices. _{Integration · Independent agent · Targets: Binary · Full entry}
• pyghidra-mcp - PyGhidra-based MCP server that analyzes every binary in a Ghidra project and exposes decompilation, cross-references, call graphs, symbol and string search, indexed semantic code search, and renaming, typing and comment edits. _{Integration · Independent MCP · Targets: Binary · Full entry}
• LeanREA - An independent agent skill that routes application and binary investigations through ordinary command-line tools. _{Integration · Independent agent · Targets: App, Binary · Full entry}
• Universal Modder - Packages agent skills, three role briefs, a Python CLI and preconfigured fal MCP settings for modding PC games the user owns. _{Integration · Independent agent · Targets: Game · Full entry}
• ReVa (Reverse Engineering Assistant) - Ghidra extension that runs an MCP server inside Ghidra, giving agents decompilation with namespace and cross-reference context, symbol, string, data-type, structure and call-graph tools, program diffing, renaming and PyGhidra scripting. _{Integration · Independent MCP · Targets: Binary · Full entry}
• x64dbg-MCP Server - Native x64dbg plugin, written in Zig for both x32dbg and x64dbg, that serves an MCP endpoint over streamable HTTP and SSE from inside the debugger. _{Integration · Independent MCP · Targets: Binary · Full entry}
• mcp-windbg - Independent, community-built MCP server that runs Microsoft's cdb.exe and kd.exe headless, so agents can open and triage user-mode and kernel crash dumps, attach to cdb remote debug servers and KD kernel targets, and run arbitrary debugger commands in separately addressed sessions. _{Integration · Independent MCP · Targets: Binary · Full entry}
• Wireshark MCP - MCP server that wraps tshark, and optionally other Wireshark command-line tools, so agents can query saved captures through Wireshark's dissectors: packet lists and details, stream following, arbitrary field extraction, protocol hierarchies and conversations, decode-as rules for non-standard ports, protocol preferences, TLS and WPA decryption with user-supplied keys, and one tool that applies preset fields and filters for 25 protocols such as Modbus, S7comm, MQTT, Zigbee and BLE. _{Integration · Independent MCP · Targets: Protocol · Full entry}
• BINNY - An open-source terminal agent harness from OpenBin that runs a user-chosen hosted or local model over binary-analysis data. _{Integration · Independent agent · Targets: App, Binary, Firmware · Full entry}
• decomp.wtf - A discontinued local app and MCP server that hands AI coding agents one function of a user-owned console game at a time, compiles each C attempt with the game’s period compiler and accepts it only when the linked result matches the original bytes. _{Integration · Independent agent · Targets: Game · Full entry}
• Claude Intercept - A local man-in-the-middle proxy and dashboard that captures HTTP/S traffic from the user’s own computer and devices, stores it in SQLite and hands it to Claude Code through an /intercept skill and CLI. _{Integration · Independent agent · Targets: App, Protocol · Full entry}
• Ghidra MCP Server (bethington) - A Ghidra GUI plugin, standalone headless server and Python MCP bridge exposing a 209-tool catalog: decompilation, cross-references, renaming, typing, structures, comments and batch edits, plus P-code emulation, live debugging through Ghidra’s TraceRmi framework, shared Ghidra Server repository and version-control operations, and hash-based transfer of function documentation between binary versions. _{Integration · Independent MCP · Targets: Binary · Full entry}
• DecompilerServer - Stdio MCP server built on the ICSharpCode.Decompiler engine that lets agents load managed .NET assemblies, including a Unity game's Assembly-CSharp.dll located from its game directory, then search symbols, string literals and attributes, read decompiled C# or IL, and trace callers, callees, usages and inheritance. _{Integration · Independent MCP · Targets: Game, App · Full entry}
• Gepetto - IDA Pro plugin that sends Hex-Rays pseudocode to a hosted or local language model the user selects, to explain a function, comment it or propose new variable and function names, which the user picks from before they are applied. _{Integration · Independent agent · Targets: Binary · Full entry}
• GhidrAssistMCP - Ghidra extension that runs an MCP server inside Ghidra over streamable HTTP and legacy SSE, with 100 explicitly named tools (93 enabled by default) for pseudocode, disassembly, P-code, control-flow and call graphs, cross-references, strings, imports and exports, plus renaming, retyping, comments and structure inference. _{Integration · Independent MCP · Targets: Binary · Full entry}
• Android Reverse Engineering Skill - Claude Code plugin and agent skill that drives jadx and Fernflower/Vineflower to decompile Android APK, XAPK, JAR and AAR files and document their HTTP APIs. _{Integration · Independent agent · Targets: App · Full entry}
• Reverify - Python CLI and stdio MCP server that checks a model’s structured claims about a binary, such as bytes or typed values at an offset, strings, imports and exports, instruction mnemonics, emulation results and tested or Z3-proved equivalence, and returns VERIFIED, REFUTED or INCONCLUSIVE with the evidence the tools observed. _{Integration · Independent agent · Targets: Binary · Full entry}
• DecompAI - Gradio chat application whose LangGraph ReAct agent analyses an uploaded x86 Linux ELF binary: it lists and disassembles functions, decompiles them with Ghidra, drives radare2 and gdb, and runs shell commands and Python scripts in a privileged Kali Linux runner container. _{Integration · Independent agent · Targets: Binary · Full entry}
• Kong - Command-line pipeline that runs Ghidra in-process through PyGhidra and asks Claude, OpenAI or OpenAI-compatible models to name the functions, types and parameters of a stripped binary, working bottom-up through the call graph so callers see already-named callees. _{Integration · Independent agent · Targets: Binary · Full entry}
• Co-op Anything - Agent playbook, skill set and stdio MCP server for adding online or split-screen co-op to single-player games the players already have installed. _{Integration · Community REA · Targets: Game · Full entry}
• DeepExtract (DeepExtractIDA) - IDA Pro 9.x plugin and PowerShell batch extractor that turn Windows PE files into material AI coding agents can read: a per-binary SQLite database of PE metadata, signatures, disassembly, Hex-Rays pseudocode, cross-references, strings, stack frames, loops and dangerous API calls, plus optional grouped C++ and assembly files with per-function caller, callee and string headers and JSON indexes. _{Integration · Independent agent · Targets: Binary · Full entry}
• Mizuchi - Plugin pipeline for matching decompilation that loops over functions in an existing decomp project: m2c drafts C, decomp-permuter mutates it, Claude rewrites it through a compile-and-diff tool, and objdiff accepts a result only when the compiled object matches the target assembly. _{Integration · Independent agent · Targets: Game, Binary · Full entry}
• ReAgent - An open-source Python agent, published on PyPI as auto-re-agent, that drafts C/C++ implementations of functions in a compiled program from Ghidra evidence and has a separately configurable checker model review each draft in a bounded fix loop. _{Integration · Independent agent · Targets: Game, Binary · Full entry}
• lisa.py - LLDB extension that adds an MCP bridge to a debugging session, adapted from ida-pro-mcp: the plugin's mcp start command serves 18 debugger functions over local JSON-RPC, and a FastMCP stdio server generated from those functions exposes them to MCP clients such as Claude Desktop. _{Integration · Independent MCP · Targets: Binary · Full entry}
• WireMCP - Node.js MCP server that runs Wireshark's tshark for LLM clients, aimed in its README at threat hunting, network diagnostics and anomaly detection. _{Integration · Independent MCP · Targets: Protocol · Full entry}
• ReverserAI - Binary Ninja plugin that suggests function names from HLIL decompiler output with a language model run locally through llama.cpp; the README says it operates entirely offline once the model is downloaded. _{Integration · Independent agent · Targets: Binary · Full entry}
• WPeGPT - IDA plugin, formerly WPeChatGPT and inspired by Gepetto, that sends the Hex-Rays pseudocode of a function to an OpenAI-compatible model (OpenAI, DeepSeek or another compatible endpoint) and writes the model's analysis back into IDA as comments. _{Integration · Independent agent · Targets: Binary · Full entry}
• IDAssist - IDA Pro plugin by Jason Tang, who also wrote GhidrAssist, that adds a dockable PySide6 panel for LLM-assisted analysis of the open database. _{Integration · Independent agent · Targets: Binary · Full entry}
• GhidraGPT - Ghidra extension that sends one function’s decompiled C to a hosted or local language model the user selects and streams the answer into a GhidraGPT console. _{Integration · Independent agent · Targets: Binary · Full entry}
• GhidrAssist - Ghidra extension by Jason Tang, who also wrote GhidrAssistMCP, that adds a tabbed GhidrAssist window to CodeBrowser for LLM-assisted analysis of the open program. _{Integration · Independent agent · Targets: Binary · Full entry}
• Rikugan - IDA Pro and Binary Ninja plugin that runs its own agent loop inside the disassembler: a model the user chooses streams its answers and calls more than 60 in-process tools for navigation, decompilation, disassembly, cross-references, strings, types, annotations, scripting and host IL or microcode edits. _{Integration · Independent agent · Targets: Binary · Full entry}
• bn - Agent-oriented command-line interface for the Binary Ninja database already open in the GUI, reached through a companion plugin that listens on a local Unix-domain socket. _{Integration · Independent agent · Targets: Binary · Full entry}
• IDA Pro MCP Server (fdrechsler) - An IDA Pro plugin and a TypeScript MCP server by Florian Drechsler: the plugin starts an HTTP server inside IDA on 127.0.0.1:9045, and the stdio MCP server forwards agent requests to it. _{Integration · Independent MCP · Targets: Binary · Full entry}
• Ghidra Headless MCP - Headless MCP server that drives Ghidra through PyGhidra and is meant to share a container with the agent. _{Integration · Independent MCP · Targets: Binary · Full entry}
• Binary Ninja Headless MCP - A third-party, headless-only MCP server by Ruben Marks (mrphrazer) that gives agents a large Binary Ninja tool surface the project counts as 181 tools across 36 feature groups, including disassembly, intermediate languages, cross-references, types, search, patching with undo/redo transactions, and arbitrary scripting through binja.eval and binja.call. _{Integration · Independent MCP · Targets: Binary · Full entry}
• IDA-Skill - Agent skill that has an AI agent triage malware samples statically in IDA Pro through headless idat. _{Integration · Independent agent · Targets: Binary · Full entry}
• BinAssist - Binary Ninja plugin by Jason Tang, who also wrote GhidrAssist and IDAssist, that adds a BinAssist sidebar for LLM-assisted analysis of the open binary. _{Integration · Independent agent · Targets: Binary · Full entry}
• Reversecore MCP - MCP server that puts radare2 with r2ghidra, LIEF, Capstone, YARA, CAPA, Detect It Easy, binwalk, angr, Volatility3, Scapy, Sleuth Kit and other engines behind 177 typed tools for AI clients such as Claude and Cursor. _{Integration · Independent MCP · Targets: Binary · Full entry}
• AutoProber - Flying-probe control stack meant to let a coding agent or an operator take a circuit board on a GRBL 3018-style CNC from locating it on the plate, through XYZ-tagged USB-microscope frames and an annotated map of pads, pins and chips, to probing targets the operator has approved. _{Integration · Independent agent · Targets: Firmware · Full entry}
• ToCode - Python CLI that exports a binary, IDA database, Android APK, .NET assembly or whole application folder into a source-like project tree for coding agents: recovered C (Java for APKs, C# and IL for .NET) with matching assembly and function summaries, recovered headers and types, section dumps, JSON indexes of functions, strings, imports, exports, reachability and call-graph clusters, and generated AGENTS.md and CLAUDE.md files. _{Integration · Independent agent · Targets: App, Binary · Full entry}
• Reverse API Engineer - Python CLI that turns the HTTP traffic a website actually produces into a typed API client. _{Integration · Independent agent · Targets: Website · Full entry}
• OpenBaud - Rust MCP server and Codex plugin that gives coding agents audited access to local serial devices, from identifying ports by USB metadata and sending framed requests to recording every received and transmitted byte in lossless .obcap captures. _{Integration · Independent MCP · Targets: Protocol · Full entry}
• JADX MCP Server (Qtty) - MCP server for Android APK analysis in which a Python FastMCP process talks to the agent over stdio and drives a long-lived local JVM daemon that embeds JADX 1.5.6 as a library, so no JADX GUI is involved and a loaded APK stays warm between sessions. _{Integration · Independent MCP · Targets: App · Full entry}
• usb-rea - Python CLI and stdio MCP server for inferring the USB protocol of a device whose only control software is a vendor app. _{Integration · Independent MCP · Targets: Protocol · Full entry}
• IDA NO MCP - IDA Pro exporter that turns an analyzed binary into plain files for AI coding tools such as Cursor or Claude Code instead of serving it over MCP. _{Integration · Independent agent · Targets: Binary · Full entry}
• ida-mcp-rs - Headless MCP server written in Rust that drives IDA Pro through idalib, so agents such as Claude Code, Codex CLI, Gemini CLI or Cursor can open and analyze binaries without the IDA GUI. _{Integration · Independent MCP · Targets: Binary · Full entry}
• ida-multi-mcp - MCP server that lets an agent analyze several IDA Pro databases at once through one endpoint. _{Integration · Independent MCP · Targets: Binary · Full entry}
• x64dbg MCP (x64dbgMCP) - MCP server that connects LLM clients to the x64dbg and x32dbg debuggers through a native plugin and a Python MCP script. _{Integration · Independent MCP · Targets: Binary · Full entry}
• IDASQL - SQL interface to IDA Pro databases that exposes a binary's analysis as more than 30 live virtual tables for agents and scripts. _{Integration · Independent agent · Targets: Binary · Full entry}
• Exoproc - Exoproc exposes Windows x64 process inspection and instrumentation to agents through a CLI and MCP server. _{Integration · Independent MCP · Targets: Binary · Full entry}
• OpenOCD SPI Dump Plugin - OpenOCD SPI Dump Plugin guides an agent through extracting SPI flash or EEPROM contents using a target MCU's SWD/JTAG debug connection. _{Integration · Independent agent · Targets: Firmware · Full entry}
• dos-mcp - dos-mcp connects AI agents to DOS programs running in js-dos for interactive reverse engineering. _{Integration · Independent MCP · Targets: Game, Binary · Full entry}
• x64dbg MCP - x64dbg MCP gives agents debugger control over Windows binaries through a native x64dbg plugin and a C# stdio MCP server. _{Integration · Independent MCP · Targets: Binary · Full entry}
• adb-mcp - adb-mcp gives agents structured Android Debug Bridge tools for investigating app behavior on a device. _{Integration · Independent MCP · Targets: App · Full entry}
• website-to-cli - website-to-cli is an agent skill for deriving terminal clients from captured website traffic. _{Integration · Independent agent · Targets: Website · Full entry}
• reverse-workbench-skill - reverse-workbench-skill is a multi-agent-harness skill bundle that routes investigations to workflows for APKs, native binaries, firmware, frontend JavaScript, and network traffic. _{Integration · Independent agent · Targets: Website, App, Binary, Firmware · Full entry}
• MindNode MCP Server - MindNode MCP Server connects agents to MindNode Next mind maps on macOS. _{Integration · Independent MCP · Targets: App · Full entry}
• OGhidra - OGhidra is an AI integration for analyzing binaries with Ghidra through natural language. _{Integration · Independent MCP · Targets: Binary · Full entry}
• aiDAPal - aiDAPal is an IDA Pro plugin that uses a locally hosted language model trained for Hex-Rays pseudocode to assist with code analysis. _{Integration · Independent agent · Targets: Binary · Full entry}
• x64dbg MCP Server Plugin - An MCP server plugin for x64dbg and x32dbg that lets external applications and AI agents control debugging through HTTP. _{Integration · Independent MCP · Targets: Binary · Full entry}
• JEB-MCP - JEB-MCP is an MCP server and JEB Pro script that lets MCP clients inspect and rename elements of Android apps in JEB. _{Integration · Independent MCP · Targets: App · Full entry}
• re-shell - re-shell is a Nix flake development environment that provides Claude Code with reverse engineering tools and workflows. _{Integration · Independent agent · Targets: Website, App, Binary, Protocol · Full entry}
• ghidra-rpc - ghidra-rpc is a CLI integration that lets AI coding assistants use a persistent Ghidra session for binary analysis. _{Integration · Independent agent · Targets: Binary · Full entry}
• r0idamcp - r0idamcp is a single-file MCP server that connects IDA Pro to an MCP-capable assistant for automated reverse engineering. _{Integration · Independent MCP · Targets: Binary · Full entry}
• SOMCP - SOMCP is an Android MCP server for analyzing and modifying native SO libraries. _{Integration · Independent MCP · Targets: App, Binary · Full entry}
• Game Decompilation Skill For Claude - Game Decompilation Skill For Claude is a set of Claude Code skills for building a byte-matching decompilation of a game. _{Tool · Independent agent · Targets: Game · Full entry}
• /re - /re is a Claude Code skill that bootstraps a reverse-engineering workspace from a ROM or binary and then disassembles, annotates, extracts assets, and ports the game to a web canvas. _{Tool · Independent agent · Targets: Game, Binary · Full entry}
• Console skill - The Console skill is a set of eleven skill folders and Python 3.8 tools for driving a PlayStation 2 port. _{Tool · Targets: Game · Full entry}

↑ Contents

• Awesome Reverse Engineering - A task-oriented reverse-engineering resource list by REA's maintainer, useful for broader tools and foundations. _{Collection · REA maintainer · Targets: Website, Game, App, Binary, Firmware, Protocol · Full entry}
• Awesome REA Cases - A bilingual collection of REA and other AI-assisted reverse engineering cases, with source links and explicit distinctions between reported and reproduced outcomes. _{Collection · Community REA · Targets: Website, Game, App, Binary, Firmware, Protocol · Full entry}
• awesome-rea (yibie): verification-focused projects and practice reports - Organizes AI-assisted game decompilation, native ports, static recompilation and tooling around stated acceptance checks, alongside a separate track of practitioner write-ups and discussions. _{Collection · Community REA · Targets: Game, Binary · Full entry}
• Reversed with AI - A moderated website directory of AI-assisted reverse-engineering projects across games, firmware, file formats, APIs and protocols, apps and legacy software. _{Collection · Community REA · Targets: Game, App, Binary, Firmware, Protocol · Full entry}
• Awesome Malware Analysis - A long-running single-README list of malware analysis tools and resources, grouped into 17 top-level sections covering open-source threat intelligence, detection and classification, online scanners and sandboxes, document and shellcode analysis, deobfuscation, debugging and reverse engineering, network, memory forensics, Windows artifacts, plus books and other references. _{Collection · Targets: Binary · Full entry}
• Awesome Connected Things Security - A single-README list of security-research references for IoT, embedded, industrial and automotive systems, organized into sections on hardware attacks, wireless protocols (BLE, Zigbee/Z-Wave, LoRa, Matter/Thread, cellular, NFC/RFID, Wi-Fi, USB), firmware security including extraction, static and dynamic analysis and secure boot, network and web protocols, cloud backends, mobile apps, and industrial and automotive topics. _{Collection · Targets: Firmware, Protocol · Full entry}
• Awesome CAN Bus - A single-README list of CAN bus tools, hardware and resources for automotive and embedded work, grouped into sections for reverse-engineering tools, test equipment and simulators, higher-layer protocols (OBD-II, UDS, ISO-TP, J1939, J2534), general and Linux utilities, CAN database formats (DBC, KCD) with converters, and hardware for ARM, Arduino, ESP32, single-board computers and FPGA cores. _{Collection · Targets: Firmware, Protocol · Full entry}
• Awesome CAN ID - A single-README list that gathers links to CAN message identifier and payload decodings in one place, grouped by vehicle make and model under about 30 car brands and brand groups plus BMW, Ducati and KTM motorcycles. _{Collection · Targets: Protocol · Full entry}
• Awesome REA: Reverse Engineer Anything with AI (AIshihzong) - An unofficial, bilingual awesome list of what AI agents have reverse-engineered and rebuilt, tagged by whether each case's own sources show that REA was used. _{Collection · Community REA · Targets: Game, App, Binary, Protocol · Full entry}
• AI Rebuilds - A website and GitHub list of 81 projects that rebuild existing software or games without the original source: AI-built clean-room apps such as the ArtCraft suite, software rewritten with coding agents, AI-assisted game decompilations, game engine reimplementations, human-led decompilations and ports, clean-room classics such as Wine and ReactOS, and tools for rebuilders. _{Collection · Community REA · Targets: Game, App, Binary · Full entry}
• awesome-game-decompilations - A single-README list of about 480 game decompilation, recompilation and disassembly projects, grouped by console from the NES and Game Boy to the Xbox 360, PC and mobile, with a large uncategorised section. _{Collection · Targets: Game · Full entry}
• Awesome Decomp Games - A generated, rated index of public game reconstruction projects: decompilations, disassemblies, static recompilations, source ports, engine remakes and browser ports. _{Collection · Targets: Game · Full entry}
• awesome-unofficial-pc-ports - A single-README guide to unofficial PC ports of console games built from decompilations or recompilations and chosen for easy installation by players. _{Collection · Targets: Game · Full entry}
• awesome-decompilation - A short, link-only reading list on decompiling machine code, last updated in 2023. _{Collection · Targets: Binary · Full entry}
• Remade - The source repository of remade.wiki, a community-curated directory of open-source reimplementations of closed-source software, mostly creative, productivity and engineering applications. _{Collection · Targets: App · Full entry}
• Reverse Engineering resources (wtsxDev) - A single-README awesome list, started in January 2017 and maintained under the KaliTut name, of 139 reverse-engineering links in 16 sections: books, courses, practice targets, hex editors, binary-format tools, disassemblers, binary analysis, bytecode analysis, import reconstruction, dynamic analysis, debugging, Mac decryption, document analysis, scripting, Android and YARA. _{Collection · Targets: App, Binary · Full entry}
• Awesome Android Reverse Engineering - An awesome list of Android reverse-engineering training, tools and resources started in 2023 by James Stevenson, with 92 one-line entries, 16 of them starred as great and up to date. _{Collection · Targets: App · Full entry}
• Awesome Frida - An awesome list of libraries, scripts, tools, talks and articles built on or about Frida, the dynamic instrumentation toolkit, started by David Weinstein in May 2016. _{Collection · Targets: App, Binary · Full entry}
• Awesome Ghidra - An awesome list of Ghidra scripts, plugins, extensions, learning materials and related services, kept by the Allsafe GitHub organization since December 2019. _{Collection · Targets: Binary · Full entry}
• PRE-list - A table-based reading list of 71 research papers on automatic protocol reverse engineering for network protocols, from the Protocol Informatics project (2004) to NetPlier (2021). _{Collection · Targets: Protocol · Full entry}
• awesome-reverse-engineering (alphaSeclab) - Large reverse-engineering link list, auto-exported in 2019 in English and Chinese, with abridged and full README versions. _{Collection · Targets: App, Binary · Full entry}
• awesome-mobile-security - A single-README list of Android and iOS application security resources, about 245 links in all, divided by platform into blogs, papers and how-tos, books, courses, tools, deliberately vulnerable lab apps, talks and miscellany. _{Collection · Targets: App · Full entry}
• Awesome Executable Packing - A single-README list of resources on executable packing, meaning the bundling, compression, encryption, mutation, protection or virtualization of PE, ELF and other executables, including Android apps, and on detecting and unpacking packed files. _{Collection · Targets: App, Binary · Full entry}
• Awesome AI Reverse Engineering - A single-README, Chinese-language list of AI-assisted reverse-engineering projects, grouped into JavaScript reversing, binary and native analysis, Android and iOS security, and browser automation and traffic analysis. _{Collection · Targets: Website, App, Binary · Full entry}
• Interactive IDA Plugin List - A sortable, filterable list of 618 plugins, loaders, processor modules and scripts for Hex-Rays' IDA Pro, published as a GitHub Pages table with a static copy generated into the README. _{Collection · Targets: Binary · Full entry}
• Awesome RE-MCP - A single-README list, written in July 2025, of 28 MCP servers for reverse-engineering tools, grouped into disassemblers and decompilers (IDA Pro, Ghidra, Binary Ninja and others), debuggers, static and dynamic analysis, network analysis, Android and security testing, with a one-line note per entry. _{Collection · Targets: App, Binary · Full entry}
• RE list (extremecoders-re) - A single-README list of 71 open-source reverse-engineering tools with a focus on binary analysis, kept as one alphabetical list from Amoco to X86isa. _{Collection · Targets: Binary · Full entry}
• awesome-te - A public-domain directory, started in June 2026, of hacking projects for Teenage Engineering devices: custom firmware, reverse-engineering notes and protocol documentation, tools, hardware mods, teardown and recovery guides and community hubs for the OP-1, OP-Z, OP-XY, TP-7, SP-1 Stem Player, EP series, Pocket Operators and other gear. _{Collection · Targets: Firmware, Protocol · Full entry}
• Awesome UEFI Security - A single-README awesome list of UEFI and BIOS security material, which its maintainer describes as a personal and not comprehensive collection. _{Collection · Targets: Firmware · Full entry}
• Firmware-Analysis-Papers - A single-README reading list of 28 academic security papers on firmware and embedded-system analysis, grouped by year from 2013 to 2021. _{Collection · Targets: Firmware · Full entry}
• OpenDeviceDB - OpenDeviceDB indexes devices with existing firmware or protocol reverse-engineering work and links back to source projects. _{Collection · Targets: Firmware, Protocol · Full entry}
• Malware Analysis & CTI Reports - Malware Analysis & CTI Reports collects ten PDF investigations of malware, security tools and binaries with disputed detections. _{Collection · Targets: Binary · Full entry}
• SCUMM Decompilation Archive - Eric Oakford's archive collects decompiled scripts for Lucasfilm and Humongous Entertainment SCUMM games. _{Collection · Targets: Game · Full entry}

↑ Contents

• Installation and client setup - Reviewed setup plans, client registration, provider prerequisites and scoped readiness checks. _{Documentation · Official REA · Targets: Website, Game, App, Binary, Firmware · Full entry}
• CLI and Evidence - CLI workflows for saving Evidence and projecting smaller views from completed analysis. _{Documentation · Official REA · Targets: Website, Game, App, Binary, Firmware · Full entry}
• MCP contracts and generated catalog - Canonical tool contracts, provider discovery and Evidence semantics for integration authors. _{Documentation · Official REA · Targets: Website, Game, App, Binary, Firmware · Full entry}
• Native binary investigation - Locate a function, inspect instructions and pseudocode, and follow references with a selected native provider. _{Documentation · Official REA · Targets: Game, Binary · Full entry}
• Cross-layer JavaScript application workflows - Trace features and compare authenticated JavaScript application graphs while preserving static-analysis limits. _{Documentation · Official REA · Targets: Website, App · Full entry}
• Static Android APK analysis - Inspect Android package identity, classes, methods and references through REA's JADX integration. _{Documentation · Official REA · Targets: App · Full entry}
• Managed-code analysis - Read PE/CLI metadata and CIL, compare managed members and inspect declared native boundaries without loading the assembly. _{Documentation · Official REA · Targets: App · Full entry}
• Historical web network captures - Inspect saved web captures offline; recorded URLs are not fetched and no proxy is started. _{Documentation · Official REA · Targets: Website, App, Protocol · Full entry}
• Firmware analysis - Inspect firmware regions with Binwalk and explicitly extract with Unblob, retaining tool and artifact identity. _{Documentation · Official REA · Targets: Firmware · Full entry}
• Recorded packet capture inspection - Select TShark fields, display filters and decode-as rules over an existing network, USB or Bluetooth capture, and look up installed field names. _{Documentation · Official REA · Targets: Protocol · Full entry}
• Packet capture summaries - Summarize a saved pcap or pcapng file’s endpoints, DNS questions and addresses, TLS SNI, protocol stacks and HTTP URIs into paged Evidence views. _{Documentation · Official REA · Targets: Protocol · Full entry}
• Recorded signal decoding - Run caller-chosen sigrok protocol decoders, such as UART or I2C, over an existing logic-signal recording and keep annotation text with sample ranges. _{Documentation · Official REA · Targets: Firmware, Protocol · Full entry}
• Browser observation guide - Follow a user-triggered export request in the supplied Notes browser example and connect it to the downloaded result. _{Documentation · Official REA · Targets: Website · Full entry}
• JavaScript and Electron: follow a CSV export - A source-owned Notes fixture teaches the renderer, preload, IPC and CSV path with linked analysis evidence. _{Documentation · Official REA · Targets: App · Full entry}
• rea-playbook - An Electron practice target, Evidence extractor and MCP probe; offline fixture mode is distinguished from real REA analysis. _{Learning resource · Community REA · Targets: App · Full entry}
• rea-lab - A Windows REA/Ghidra lab with seeded challenges, published studies, upstream contributions and recorded limitations. _{Research · Community REA · Targets: Binary · Full entry}
• Flutter build identification - Identifies a Flutter APK’s Dart snapshot hash, per-ABI library digests and engine build provenance, then inspects one ABI’s AOT snapshot sections, through REA’s pure-parsing CLI and MCP tools. _{Documentation · Official REA · Targets: App · Full entry}
• Static HarmonyOS package inventory - Inventories HarmonyOS HAP, HSP and App Pack files through REA’s hardened ZIP reader and projects an execution-free application graph: component paths, IDs and hashes, Stage/FA packaging hints, runtime-family hints and path-based native-bridge hypotheses. _{Documentation · Official REA · Targets: App · Full entry}
• MIPS ELF analysis through Ghidra - Documents REA’s Ghidra lane for MIPS ELF executables, relocatable objects and MIPS16 shared images, including a pinned 32-bit language for recordless legacy firmware executables that Ghidra would otherwise import as 64-bit. _{Documentation · Official REA · Targets: Binary, Firmware · Full entry}
• PSP static ELF analysis through Ghidra - Documents REA’s bounded Ghidra profile for static PSP ELF executables, which leaves Allegrex instructions, PSP loading and calling conventions to a caller-installed ghidra-allegrex extension while reusing REA’s CLI, MCP, Evidence and snapshot workflows. _{Documentation · Official REA · Targets: Game, Binary · Full entry}
• NativeAOT metadata recovery with Ghidra - Recovers .NET 8 NativeAOT metadata from x64 PE executables during REA’s Ghidra analysis: MethodTable relationships, virtual slots and frozen strings from RTR 9.1 data, through a built-in read-only parser or an optional headless adapter that annotates the Ghidra database. _{Documentation · Official REA · Targets: Binary · Full entry}
• REA & AI RE Tools Guide (unofficial) - An unofficial, independently run guide to installing REA and connecting it to coding agents, in 32 pages: install paths for npx, npm and Bun including Windows, MCP setup for Claude Code and Desktop, Codex, Cursor, Windsurf and Gemini CLI, a config generator for 24 clients, Ghidra, IDA and JADX provider setup, and troubleshooting pages that match exact error text to upstream REA issues. _{Learning resource · Community REA · Targets: Website, App, Binary · Full entry}
• OpenSecurityTraining2 - Free self-paced security courses with learning paths for reverse engineering, firmware and systems foundations. _{Learning resource · Targets: Binary · Full entry}
• pwn.college: Reverse Engineering - Hands-on reverse-engineering module covering functions, data access, static tools and dynamic tools with hosted exercises. _{Learning resource · Targets: Binary · Full entry}
• Reverse Engineering for Beginners - Dennis Yurichev's free book on understanding compiled programs and assembly, available in multiple languages. _{Learning resource · Targets: Binary · Full entry}
• The Official Radare2 Book - Official practical reference for radare2 analysis, disassembly, scripting, debugging and related plugins. _{Learning resource · Targets: Binary · Full entry}
• Finding Jingle Town: Debugging an N64 Game without Symbols - A walkthrough from the Snowboard Kids 2 decompilation project on attaching gdb-multiarch to the Ares emulator while the matching build still cannot carry debug information. _{Learning resource · Targets: Game · Full entry}
• JPCERT/CC: APK analysis and API probing on attack servers - JPCERT/CC’s 15 October 2026 blog post on the infrastructure behind a series of unauthorized-access incidents in Japan. _{Learning resource · Targets: App · Full entry}
• Reverse Engineering (mytechnotalent) - A free, English lesson index by mytechnotalent that grows almost daily: 490 numbered lessons, most of which have learners write small programs and then debug and patch ("hack") them, across x86, x64, 32/64-bit ARM, RISC-V and AVR. _{Learning resource · Targets: Binary, Firmware · Full entry}
• Z0FCourse Reverse Engineering - A free English course by Z0F on reverse engineering 64-bit Windows programs, which its README pitches as taking learners from beginner to intermediate. _{Learning resource · Targets: Binary · Full entry}
• OWASP Mobile Application Security Testing Guide (MASTG) - OWASP’s open manual for Android and iOS app security testing and reverse engineering, published at mas.owasp.org. _{Learning resource · Targets: App · Full entry}
• The Decompilation Wiki - Community wiki explaining how decompilers work, from disassembly, lifting and control-flow recovery to type recovery, control-flow structuring, quality evaluation and neural decompilation, citing the research behind each technique. _{Learning resource · Targets: Game, Binary · Full entry}
• Frontkick vs Rikugan: a CREBench agent comparison - Matthieu Breuil’s Synacktiv article explains tool-calling and code-executing agent designs and describes Frontkick, a CodeAct agent that runs generated Python inside Binary Ninja. _{Learning resource · Targets: Binary · Full entry}
• FLARE Learning Hub - Free English reverse-engineering and malware-analysis modules from Mandiant's FLARE team, published as Google Docs, with lab binaries, IDA databases and scripts kept in this repository. _{Learning resource · Targets: Binary · Full entry}
• Nintendo Switch Reverse Engineering - Notes begun by dekuNukem in 2017 and extended by contributors on how the Joy-Con, Pro Controller and parts of the Switch console and dock work, worked out from teardowns, logic-analyzer captures and packet logs. _{Learning resource · Targets: Firmware, Protocol · Full entry}
• Android App Reverse Engineering 101 - Maddie Stone's free English workshop introducing static reverse engineering of Android apps, published as GitHub Pages. _{Learning resource · Targets: App, Binary · Full entry}
• Reverse Engineering iOS Applications - Ivan Rodriguez's free English course (version 1.1) on reverse engineering iOS applications, aimed at beginners in iOS app security. _{Learning resource · Targets: App, Binary · Full entry}
• tiny-dec - Zhuo Zhang's small educational decompiler for 32-bit RISC-V (RV32I) ELF files, written in Python to teach how decompilation works rather than to compete with production decompilers. _{Learning resource · Targets: Binary · Full entry}
• Reverse Engineering Reading List - A short reading list, compiled by One Thawt mostly in 2015–2016, of about 58 links to reverse-engineering tools, books, papers, talks and blog posts, kept in a README and a separate malware-analysis page. _{Learning resource · Targets: Binary · Full entry}
• Decomp Academy - A free, English, in-browser course in matching decompilation maintained by Jack Price-Burns: learners read a function's target assembly, write C, and the original console compiler grades the result byte for byte. _{Learning resource · Targets: Game, Binary · Full entry}
• OWASP Firmware Security Testing Methodology (FSTM) - A free English methodology, maintained by Aaron Guzman and published on GitBook, for security testing and reverse engineering embedded-device firmware. _{Learning resource · Targets: Firmware · Full entry}
• Emproof workshop: Firmware Reverse Engineering - Slides and 14 self-contained exercises from Emproof's firmware reverse-engineering workshop at ScapyCon Automotive 2025, designed by Tim Blazytko for a technical audience with little security experience. _{Learning resource · Targets: Binary, Firmware · Full entry}
• iOS App Reverse Engineering - Freely published 2015 book by snakeninny and hangcom on reverse engineering iOS apps, distributed in its repository as a 442-page English PDF. _{Learning resource · Targets: App · Full entry}
• Frida Snippets - A single large README that collects hand-written Frida instrumentation examples, grouped into Native, Android and iOS sections, for observing how a running app behaves. _{Learning resource · Targets: App · Full entry}
• iOSRE: iOS Reverse Engineering reference - A community-maintained reference on iOS reverse engineering started by kpwn, built from a wiki, a curated index of public technical papers and talks, and a few environment-setup scripts. _{Learning resource · Targets: App, Binary, Firmware · Full entry}
• linux-re-101 - Michal Malik’s single-README reading list for Linux reverse engineering, with about 230 links and book titles that run from quick references on system calls, ELF and processor ABIs through 101 and 201 tiers on program start-up, linking and relocations. _{Learning resource · Targets: Binary · Full entry}
• Frida Labs - Eleven Android challenge apps with step-by-step write-ups for learning Frida instrumentation, progressing from setting up frida-server and hooking a Java method through calling static methods, changing fields, creating instances and hooking constructors to hooking, calling and patching native functions. _{Learning resource · Targets: App · Full entry}
• osx & ios re 101 - A single-README reading list for macOS (OS X) and iOS reverse engineering, kept by Michal Malik from 2015 to 2019 and labelled a work in progress. _{Learning resource · Targets: App, Binary · Full entry}
• AndroidReverse101 - A Chinese-language Android reverse-engineering course by Evil0ctal, planned as 100 daily lessons. _{Learning resource · Targets: App · Full entry}
• Ghidra Snippets - A single-page collection of 30 commented Python examples for scripting Ghidra, grouped by task: projects, programs, functions and cross-references, basic blocks, instructions, stack variables, decompiler output, comments, P-code emulation and dumps, call graphs and program slices. _{Learning resource · Targets: Binary · Full entry}
• Frida Boot: a beginner binary instrumentation workshop - A beginner workshop by leonjza on binary instrumentation with Frida, served as offline pages from a Docker container that has gdb with GEF and frida-tools preinstalled. _{Learning resource · Targets: Binary · Full entry}
• Embedded Hacking (mytechnotalent) - A free English course by mytechnotalent on developing, debugging and reverse engineering firmware for the Raspberry Pi Pico 2 (RP2350, Arm Cortex-M33). _{Learning resource · Targets: Firmware · Full entry}
• Reverse-Engineering a Bluetooth-Enabled Radar Detector - Write-up of how the author decoded the Bluetooth RFCOMM protocol of a Cobra iRAD 900 radar detector so that a Raspberry Pi 3 could receive alerts without the iOS or Android app. _{Learning resource · Targets: Protocol · Full entry}
• Link Pi ENCx encoders (unofficial documentation) - A single-README notebook, kept since 2021 by an owner with no ties to the vendor, on the internals of LinkPi ENC-series video encoders and the TBS 2603SE, which share one firmware line; the author's first units use the F3520D board with a HiSilicon Hi3520DV400. _{Learning resource · Targets: Firmware · Full entry}
• Supplementary AST-Based Deobfuscation Materials - Companion code for the ReverseJS blog's 2022 series on deobfuscating JavaScript by manipulating abstract syntax trees with Babel. _{Learning resource · Targets: Website · Full entry}
• MCP Reversing Dataset (mrexodia) - Three worked examples by mrexodia of a language model reverse-engineering crackme binaries in IDA Pro through his IDA Pro MCP server. _{Learning resource · Targets: Binary · Full entry}
• ICSim (Instrument Cluster Simulator) - OpenGarages' Instrument Cluster Simulator for practising CAN bus reverse engineering on a Linux virtual CAN interface instead of a car. _{Learning resource · Targets: Protocol · Full entry}
• CNNPRE (IEEE Access 2023) - Research code and data for CNNPRE, a message-type identification method for protocol reverse engineering by Javad Garshasbi and Mehdi Teimouri, published in IEEE Access in 2023. _{Research · Targets: Protocol · Full entry}
• RPISEC Malware Analysis course (CSCI 4976) - Materials from the student-run Malware Analysis course that RPISEC taught at Rensselaer Polytechnic Institute in Fall 2015, built around the book Practical Malware Analysis. _{Learning resource · Targets: Binary · Full entry}
• Corkami pics - Collection of posters and diagrams that dissect file formats byte by byte, published as PNG and PDF images. _{Learning resource · Targets: Binary · Full entry}
• Practical Malware Analysis - No Starch Press book, published in February 2012, that teaches hands-on malware analysis from basic static and dynamic techniques in virtual machines through x86 disassembly with IDA Pro, debugging with OllyDbg and kernel debugging with WinDbg. _{Learning resource · Targets: Binary · Full entry}
• Windows Malware Analysis training, volume 1 (malware_training_vol1) - Slides and exercises for a Windows malware analysis training that builds an understanding of common malware techniques through programming, reverse engineering and Windows internals, and shows how analysis tools are used for particular goals. _{Learning resource · Targets: Binary · Full entry}
• esp-idf-injection-ng - esp-idf-injection-ng documents an investigation of ESP-IDF's compiled libnet80211.a frame-type check. _{Research · Targets: Binary · Full entry}
• RE-Workstation - RE-Workstation is a Chinese reference library for reverse-engineering workflows and related security research. _{Learning resource · Targets: Website, App, Binary, Firmware · Full entry}
• Walksnail Ascent VRX UART Protocol - Walksnail Ascent VRX UART Protocol documents serial control messages for Walksnail video receivers and supplies a C reference transmitter with an STM32 example. _{Documentation · Targets: Protocol · Full entry}
• T2 platform research - T2 platform research maps Apple T2 firmware, hardware and Linux-facing interfaces using static analysis, hardware observations and driver comparisons. _{Research · Targets: Firmware, Protocol · Full entry}
• Glaurung Models - Glaurung Models contains tokenizer and model experiments for executable analysis. _{Research · Targets: Binary · Full entry}
• CrackMes - CrackMes is a set of walkthroughs for purpose-built crackme binaries from crackmes.one. _{Learning resource · Targets: Binary · Full entry}
• Binary BPE Tokenizer for Executable Analysis - Binary BPE Tokenizer for Executable Analysis studies byte-pair encoding of ELF, PE, Mach-O and APK files for transformer-based binary analysis. _{Research · Targets: App, Binary · Full entry}
• Assassin's Creed III online service docs - Assassin's Creed III online service docs record method IDs and request and response fields for the PC game's online services. _{Documentation · Targets: Game, Protocol · Full entry}
• AC4 docs - AC4 docs records online service interfaces for the PC version of Assassin's Creed IV Black Flag. _{Documentation · Targets: Game, Protocol · Full entry}
• eRepublik API Documentation - eRepublik API Documentation maps endpoints observed in the browser-based strategy game's web client. _{Documentation · Targets: Website, Game · Full entry}
• Garmin Strength Workout API - Garmin Strength Workout API documents payloads for creating strength workouts through Garmin Connect's undocumented API. _{Documentation · Targets: Website, Protocol · Full entry}
• Substack API Reference (Unofficial) - Substack API Reference documents the web app's undocumented JSON API using curl probes and captured browser requests. _{Documentation · Targets: Website, Protocol · Full entry}
• hyperscan-homebrew - hyperscan-homebrew documents Mattel HyperScan hardware behavior for homebrew and emulation work. _{Documentation · Targets: Protocol · Full entry}
• Локальный аудиостриминг на Яндекс.Станцию - Local audio streaming on Yandex Station is a technical guide to the device’s Glagol WebSocket control channel and its HTTP audio-stream behavior. _{Documentation · Targets: Protocol · Full entry}
• Hacking the Xbox — 日本語訳 - Hacking the Xbox — 日本語訳 publishes a Japanese translation of a book on Xbox reverse engineering. _{Learning resource · Targets: Firmware · Full entry}
• Spelunking - Spelunking studies Apple apps, private frameworks and system services with Swift and Objective-C probes. _{Research · Targets: App, Binary · Full entry}
• whatsapp-docs - whatsapp-docs records findings from static decompilation of the WhatsApp Android APK, covering app internals and communication formats. _{Documentation · Android · Targets: App, Protocol · Full entry}
• RtG-Format - RtG-Format documents the observed save and construction format of the Roblox game Road To Gramby's. _{Documentation · Targets: Game · Full entry}
• Apple Data Formats and Knowledge - The Hack Different community's knowledge base on Apple hardware, firmware and operating-system internals, set up and largely maintained by Rick Mark, which pairs a long categorized link list with original pages and machine-readable YAML data. _{Learning resource · Targets: Binary, Firmware, Protocol · Full entry}
• Snake & Apple: macOS internals and security article series - Code repository for Karol Mazurek’s Snake & Apple article series on macOS internals and security research. _{Learning resource · Targets: App, Binary · Full entry}
• Compiler Explorer - Compare source constructs with compiler-generated assembly to study optimizations and recognize code patterns during reverse engineering. _{Learning resource · Targets: Binary · Full entry}
• DecBench - DecBench is an experimental benchmark for comparing decompilers and language models on recovering exact source code. _{Research · Targets: Binary · Full entry}
• Little Big Adventure engine architecture - This is documentation of how Adeline Software International built Little Big Adventure, Little Big Adventure 2, and Time Commando. _{Learning resource · Targets: Game · Full entry}
• IDA Pro guide - This is a practical guide to reading a binary in IDA Pro. _{Learning resource · Targets: Binary · Full entry}
• PAN GlobalProtect protocol documentation - PAN GlobalProtect protocol documentation records authentication, configuration, tunnel data and logout exchanges between a VPN client and server. _{Documentation · Targets: Protocol · Full entry}
• MiiTube - MiiTube documents the structure of Miitopia's SpotPass MiiTube.dat package with a Kaitai specification. _{Documentation · Targets: Game · Full entry}
• FSEQ File Format - FSEQ File Format documents the version 2 Falcon sequence files used by Falcon Player and xLights for timed lighting-channel states. _{Documentation · Targets: App · Full entry}
• iWork '13 File Format - iWork '13 File Format documents the structure of documents produced by Apple's iWork '13 apps. _{Documentation · Targets: App · Full entry}
• GameSpy Documentations - GameSpy Documentations collects technical research on the GameSpy protocol and games that use it. _{Documentation · Targets: Protocol · Full entry}
• max-cube-protocol - max-cube-protocol documents the eQ3/ELV MAX! _{Documentation · Targets: Protocol · Full entry}
• PoE dat schema - PoE dat schema documents Path of Exile dat-file layouts as versioned GraphQL schemas. _{Documentation · Targets: Game · Full entry}
• RS41 Decoding - RS41 Decoding documents the Vaisala RS41 radiosonde's radio frame format, from FSK audio and bit ordering to XOR whitening, Reed–Solomon data, frame types and CRC-protected blocks. _{Documentation · Targets: Protocol · Full entry}
• XiPackets - XiPackets documents reverse-engineered Final Fantasy XI network behavior across its lobby, world, cache and patch services. _{Documentation · Targets: Game, Protocol · Full entry}
• Nintendo Switch app REST API documentation - Nintendo Switch app REST API documentation maps the iOS companion app's account and game-service requests, including its embedded Splatoon 2 web app. _{Documentation · Targets: Website, App, Protocol · Full entry}
• unifi-inform-protocol - unifi-inform-protocol documents the observed discovery and inform exchanges between Ubiquiti UniFi access points and their controller. _{Documentation · Targets: Protocol · Full entry}
• Reverse Engineered UniFi Protocol - Reverse Engineered UniFi Protocol documents communication between UniFi access points and their controller from observed traffic. _{Documentation · Targets: Protocol · Full entry}
• Decompile-Bench-Eval - Decompile-Bench-Eval is a binary decompilation evaluation dataset pairing C and C++ function source with assembly and IDA Pro and Ghidra pseudocode. _{Research · Targets: Binary · Full entry}
• Java Decompiler Dataset - Java Decompiler Dataset provides paired Java source and decompiled Java assembly for training and evaluating decompilation models. _{Research · JVM · Targets: Binary · Full entry}
• TH-D74-Kenwood - PC RIG control commands - TH-D74-Kenwood documents reverse-engineered PC control commands for the Kenwood TH-D74 radio. _{Documentation · Targets: Protocol · Full entry}
• Diablo II Save File Format - Diablo II Save File Format documents the binary layout of Diablo II .d2s character saves. _{Documentation · Targets: Game · Full entry}
• reMarkable Kaitai Specs - reMarkable Kaitai Specs defines Kaitai Struct parsers for versions 3 and 5 of the reMarkable tablet's binary .rm pen-stroke format. _{Documentation · Library · Targets: App · Full entry}
• Serflings Remake Project: Settlers 1 savegame format - Serflings publishes a byte-level reference for Settlers 1 savegames. _{Documentation · Targets: Game · Full entry}
• Game Boy Advance LCD Interface - Game Boy Advance LCD Interface documents the handheld's 40-pin and 32-pin display connectors and interprets their pixel clock, RGB data, latch and synchronization signals. _{Documentation · Targets: Protocol · Full entry}
• WoWDBDefs - WoWDBDefs records column names, types, relationships and versioned layouts for World of Warcraft DBC and DB2 client databases. _{Documentation · Targets: Game · Full entry}
• MinYMizer - MinYMizer documents a portable representation of maxYMiser MYS song and MYV voiceset files for lightweight PSG playback. _{Documentation · Library · Targets: App · Full entry}
• GTPD-Code-Reference - GTPD-Code-Reference documents Ghost Trick: Phantom Detective's Nintendo DS code through C++ type declarations and linker symbol maps. _{Documentation · Targets: Game · Full entry}

263 papers, grouped by topic and ordered newest first in the full paper list. The 10 most recent are below; each line shows the study’s opening sentence, venue, publication status and first author.

Full paper list · Browse the paper directory · Complete bibliography JSON · Suggest a paper

By topic: Agent evaluation (14) · Decompilation (133) · Websites (31) · Games (15) · Apps (18) · Firmware (30) · Protocols (22)

Each paper’s “Full entry” holds its complete summary, scope and limitations, all authors and citation.

↑ Contents

• ICALL-BENCH: Benchmarking LLM Interprocedural Reasoning in Binary Programs - ICALL-BENCH measures whether language models and agents can follow interprocedural meaning in compiled binaries, using indirect-call target recovery as the probe. _{arXiv 2026 · Preprint · Shenglong Yao et al. · PDF · Full entry}
• Locate, Then Reason: End-to-End Patch Presence Testing in Stripped Binaries - Locates patch-relevant code in stripped binaries using instruction-aligned retrieval and caller/callee context, then uses an LLM to screen candidate matches and compare patch-specific behavior with vulnerable and patched references. _{arXiv 2026 · Preprint · Huaijin Wang et al. · PDF · Full entry}
• Recall-Oriented Precise Binary-to-Source Function Matching - BScout matches decompiled functions to a source corpus using chunked embeddings and inlining-aware training. _{arXiv 2026 · Preprint · Junlin Li et al. · PDF · Full entry}
• Decoding What iOS Location Services Send to Apple: An LLM Is an Unreliable Analyst but a Useful Toolmaker - Compares direct LLM recovery of Apple PBCodable schemas with an AI-written Extractor checked against compiled synthetic fixtures, published descriptors and captured traffic. _{arXiv 2026 · Preprint · Douglas Leith · PDF · Code · Full entry}
• PrismaCoder: Pushing the Boundaries of Open Multimodal Code Intelligence through Decomposed Rubric Synthesis - Trains visual-code models using separate code and rendered-output rubrics for data filtering and reinforcement learning. _{arXiv 2026 · Preprint · Qiushi Sun et al. · PDF · Full entry}
• State-Aware Generation of Deployable Websites from Visual Prototypes and Requirements - VisStateCoder links visual prototype elements, project files, interaction requirements and render evidence in a project state graph, then uses those links to generate websites and limit subsequent repairs to selected files. _{arXiv 2026 · Preprint · Ruwei Pan et al. · PDF · Full entry}
• Humans vs. Machines: A Comparison With AI Agents in Software Reverse Engineering - Compares human and LLM-agent understanding and navigation on the same static reverse-engineering challenges, then studies how binary representations consume context windows. _{arXiv 2026 · Preprint · Samuele Doria et al. · PDF · Full entry}
• SoK: Are LLMs Reliable at Source Code Recovery? A Taxonomy and Empirical Evaluation - This SoK organizes LLM-assisted source-recovery designs and separates compilation, readability, structural and behavioral metrics. _{arXiv 2026 · Preprint · Varun Kohli et al. · PDF · Code · Full entry}
• The CodeInverter Suite: Structure- and Data-Aware Binary Decompilation with Efficient LLMs - CodeInverter studies function-level LLM decompilation using control-flow graphs and memory-to-data mappings extracted with IDA/objdump. _{ASE 2026 · Conference paper · Peipei Liu et al. · PDF · Code · Full entry}
• TaoD2C-Bench: Benchmarking MLLMs for Industrial UI Code Generation Beyond Visual Fidelity - TaoD2C-Bench reconstructs interfaces from design images, layer metadata and component-library documentation. _{arXiv 2026 · Preprint · Chengwei Shi et al. · PDF · Full entry}

This published selection contains 3,500 captured repository records and 3,309 browsable entries. 187 scope-excluded entries and 4 whose upstream repository is no longer available remain in the published JSON. These entries are discovered automatically and unreviewed.

Browse by category on GitHub · Search website · Full bilingual index JSON · Curated catalog JSON

The resource list above is curated from primary sources. Detailed requirements, original evidence, and review dates are available in the catalog data.

Help improve an entry or share a useful source. Start with the contribution guide, then suggest a resource, recommend a paper, correct a translation or report an outdated entry.

REA (Reverse Engineer Anything) is a separate upstream CLI and MCP project, and this collection takes its name from it. “REA” in entry tags and labels such as “Official REA documentation” refers to that project.

Original descriptions and code are MIT licensed; linked projects retain their own licenses.

To cite the collection itself, use its citation metadata. Cite listed papers, tools and other works from their own primary sources, and give the commit or snapshot date with any scan-derived counts.

For AI-built software and agent training or evaluation resources, explore AI Can What? across games, websites and applications.

Explore the interactive star history.

Catalog format · Scan methodology · Build status · Back to top