A collection of tools, case studies and research for websites, games, apps, native binaries, firmware and communication protocols.

English · 简体中文

Search the website · Browse resources · Cases · Papers · Suggest a resource · Contributing

If this collection is useful, a star on GitHub helps others find it.

Review method

Featured benchmarks:

Website reconstruction	Browser agents
Can AI agents rebuild websites through browser exploration? ★ Star on GitHub	Open-source benchmark for browser AI agents on daily tasks. ★ Star on GitHub

Featured: Awesome Computer-Use Agents — a source-backed catalog of papers, models, datasets, benchmarks and tools for agents that use computers.

Contents

1,265 curated resources (442 cases) · 235 papers · 3,309 indexed repositories · latest source review 2026-11-06.

Section	What you will find	Entries
Website	Tools and cases for inspecting, deobfuscating and rebuilding websites	62
Game	Decompilations, recompilations, ports, engine reimplementations, analysis tools and cases	318
App	Analysis tools and cases for Android, .NET, JVM and Electron apps	184
Native Binary	Disassemblers, decompilers, debuggers, binary libraries, diffing tools and native cases	270
Firmware and Hardware	Firmware extraction and analysis tools, plus hardware and device-image cases	89
Protocol	Tools and cases for wire formats, device protocols and packet captures	140
Agents and MCP	Official REA material, MCP servers, integrations and agent workflows, labelled by REA relationship	87
Related Collections	Other curated lists on reverse engineering and related security topics	32
References and Learning	Documentation, investigation guides, labs and learning resources	80
Papers	Research bibliography, kept in generated paper lists	235
Full Repository Index	Public repositories found by README scans; unreviewed	3,309

For agents: Repository instructions · How to contribute and submit a PR · Contribution forms

All sections and subsections

• Find by task
• Use the data
• Resources (1,262)
  • Website (62)
  • Game (318)
  • App (184)
  • Native Binary (270)
  • Firmware and Hardware (89)
  • Protocol (140)
  • Agents and MCP (87)
  • Related Collections (32)
  • References and Learning (80)
• Papers (235)
  • Most recent papers (10)
• Full Repository Index (3,309)
• About
• Star History

Also on this page: Contributing

Find by task

Task	Relevant sections
Inspect a website or app interface	Websites · Apps
Rebuild a game or check matching code	Games · Game cases
Analyze compiled code or recover symbols	Native binaries · Agents and MCP
Investigate firmware or device protocols	Firmware · Protocols
Compare methods and evaluation evidence	Papers · Survey comparisons

Use the data

Use these public files and pages to read the catalog, follow changes, or work with its structured data.

• llms.txt - Machine-readable site map for language models.
• llms-full.txt - Curated entries in one Markdown text.
• JSON and CSV API - Static JSON and CSV exports of resources, papers and categories, plus unreviewed candidates.
• catalog.json - Curated catalog in one JSON file.
• JSON Feed - New and changed entries in JSON Feed format.
• Hugging Face dataset - Parquet and JSONL exports for resources, papers, cases and discovery records.
• Catalog format - Fields, vocabulary and review rules for every record.

Resources

Names link to original sources. Each line gives the opening sentence of the description, then the type and relationship; “Full entry” opens the complete description, prerequisites, limitations and review sources.

Each resource appears once under its main purpose. Cases reuse these entries; papers are listed separately. Browse the resource directory.

REA labels refer to the separate upstream CLI and MCP project. About this collection.

Tags: Official REA: published by the REA project · Community REA: third-party REA work · REA maintainer: an REA maintainer's list · Independent MCP, Independent agent, Independent reconstruction: no established REA connection · Mixed workflow: REA plus other tools, per the author · Android, .NET, JVM, WebAssembly: platform · Library: code library · type only: foundation tool or learning resource.

Website

↑ Contents

13 case studies. The 10 newest are below. Full case list.

Case studies

• Power BI API Scraper: decoding a published report query format - Power BI API Scraper reconstructs the web client's undocumented query and response format for published reports. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• Sheypoor MCP: mapping marketplace APIs from browser traffic - Sheypoor MCP implements a client and MCP server for the Sheypoor classifieds site using API behavior documented from browser traffic. _{Case study · Independent reconstruction · Full entry}
• ZCode-Android: reconstructing the ZCode remote-control client - ZCode-Android recreates ZCode remote control on Android from captured traffic and analysis of its official web page. _{Case study · Independent reconstruction · Also: App, Protocol · Full entry}
• Terminal: a Rust terminal informed by TradingView chart research - An independent Rust market interface uses REA browser-scenario research on public logged-out TradingView chart interactions. _{Case study · Mixed workflow · Also: App · Full entry}
• Littlebird.ai static home-page rebuild - Rebuilds the Littlebird.ai home page in plain HTML/CSS/JavaScript from captured markup and assets, with source-wired mobile navigation, FAQ toggles, scroll reveals and OS-dependent call-to-action presentation. _{Case study · Independent reconstruction · Full entry}
• Ruffle: a Rust reimplementation of Adobe Flash Player - Reimplements Adobe Flash Player in Rust so that SWF content, from ActionScript 1/2 (AVM1) to ActionScript 3 (AVM2), runs in a native desktop player or in browsers through WebAssembly, as a self-hosted script or a browser extension. _{Case study · Independent reconstruction · Also: Game · Full entry}
• Dinosaur runner: an REA-inspected speed rule rebuilt with Codex - The author uses REA’s MCP browser tools to passively capture the JavaScript loaded by wayou’s open-source T-Rex Runner page, then has Codex rebuild its acceleration rule in one self-contained HTML5 Canvas game. _{Case study · Mixed workflow · Also: Game · Full entry}
• whatsapp-web-reveng: documenting the legacy WhatsApp Web protocol - Documents and reimplements the WebSocket protocol WhatsApp Web used while browser sessions mirrored a paired phone: QR pairing, Curve25519/HKDF key setup, AES/HMAC-protected binary messages, the token-based node encoding and end-to-end media encryption. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• BaoCut Design: porting reconstructed canvas and design-system editors - Documents BaoCut’s design-canvas and design-system editors, which the project says it ported 1:1 from TypeScript reconstructions of Claude Design’s editors and hosts in agent sessions with annotation and export. _{Case study · Independent reconstruction · Also: App · Full entry}
• REA in Claude Code: an isolated static-analysis A/B trial - A Japanese field report connects REA 6.4.0 to Claude Code in a separate project directory, denies 43 of its 170 tools and common shell launch forms, and compares REA-enabled and REA-disabled runs on two real tasks: an Electron terminal’s packaged files and a saved HAR capture. _{Case study · Mixed workflow · Also: App · Full entry}

Tools, projects and integrations

• webcrack - Improves JavaScript readability by reversing supported obfuscation patterns and unpacking webpack/Browserify bundles. _{Tool · Also: App · Full entry}
• humanify - Rename identifiers in minified JavaScript with LLM-suggested names, applied through scope-aware AST rewriting so the program structure stays unchanged. _{Tool · Full entry}
• WABT - WebAssembly tools for binary-to-text conversion, section inspection, validation, interpretation and C translation. _{Tool · WebAssembly · Also: Binary · Full entry}
• wasm-tools - Bytecode Alliance CLI and Rust libraries for inspecting WebAssembly modules, metadata, components and WIT interfaces. _{Tool · WebAssembly · Also: Binary · Full entry}
• Chrome DevTools MCP - Connect an agent to Chrome for live page inspection, network debugging, and performance traces. _{Integration · Independent MCP · Full entry}
• mitmproxy - Inspect and record HTTP traffic with an interactive proxy, web interface, or scriptable command-line tools. _{Tool · Also: App, Protocol · Full entry}
• Playwright MCP - Drive browser interactions through structured accessibility snapshots to investigate reproducible web behavior. _{Integration · Independent MCP · Full entry}
• Burp Suite MCP Server - PortSwigger's Burp Suite extension serves an MCP endpoint, plus a packaged stdio proxy, so agents can query proxy HTTP and WebSocket history, send HTTP/1.1 or HTTP/2 requests, and open Repeater or Intruder tabs. _{Integration · Independent MCP · Also: App · Full entry}
• Wakaru - Recover readable modules from shipped JavaScript bundles by reversing recognized minifier and transpiler patterns. _{Tool · Full entry}
• Spectral - Analyze captured application HTTP traffic with an LLM to generate MCP tools, OpenAPI 3.1 specifications, or GraphQL schemas. _{Integration · Independent agent · Also: App, Protocol · Full entry}
• jsdeob-workbench - Inspect JavaScript ASTs and variable scopes while building visual chains of Babel transforms. _{Tool · Full entry}
• Browser Reverse Engineering Toolkit - Capture browser-session evidence, crawl websites in a persistent Chromium session, and generate offline architecture/API reports plus OpenAPI, SDK and mock-server drafts from saved captures. _{Tool · Full entry}
• screenshot-to-code - Generate HTML/CSS, Tailwind, React, Vue, Bootstrap or Ionic front-end code from screenshots, mockups, Figma designs or screen recordings with multimodal models; an optional headless-browser preview lets the model check its rendered output. _{Tool · Full entry}
• Dembrandt - Node.js CLI that renders a website in Playwright-driven Chromium or Firefox and reads computed styles from the DOM to extract its design system: logo, color roles with the evidence behind each pick, typography, spacing, borders, shadows, motion, breakpoints and component styles such as buttons and inputs. _{Tool · Full entry}
• shuji - Command-line tool that writes the original JavaScript and CSS sources embedded in source maps back out as files. _{Tool · Full entry}
• Obfuscator.io Deobfuscator - Deobfuscator dedicated to JavaScript produced by Obfuscator.io (javascript-obfuscator), which its README says also handles most forks. _{Tool · Full entry}
• javascript-deobfuscator - General-purpose JavaScript deobfuscator for common obfuscation patterns, published on npm as js-deobfuscator and usable as a library or CLI. _{Tool · Full entry}
• mitmproxy2swagger - Command-line tool that reverse-engineers undocumented REST APIs from captured traffic. _{Tool · Also: Protocol · Full entry}
• JPEXS Free Flash Decompiler (FFDec) - Java desktop decompiler and editor for Adobe Flash SWF files. _{Tool · Also: Game · Full entry}
• WasmLens: exploratory WebAssembly inspection - Python CLI with static paths for inspecting WebAssembly sections and function signatures, producing WAT-style instruction listings, and reconstructing limited C-like pseudocode. _{Tool · WebAssembly · Also: Binary · Full entry}
• synchrony - JavaScript cleaner and deobfuscator aimed mainly at output from javascript-obfuscator (obfuscator.io). _{Tool · Full entry}
• sourcemapper - Go command-line tool that recreates a web front end's original JavaScript source tree from a source map generated by webpack or a similar bundler, writing each embedded source file under the path the map records. _{Tool · Full entry}
• ngrev - Electron desktop application that statically analyzes an Angular project's TypeScript sources and draws interactive graphs of its NgModules, components, directives, pipes and providers and how they depend on each other, without running the application. _{Tool · Full entry}
• jsluice - Bishop Fox's Go library and command-line tool that parses JavaScript with tree-sitter to recover the endpoints a script calls, judging values by how the code uses them rather than by regular expressions alone. _{Tool · Full entry}
• REstringer - HUMAN Security's Node.js JavaScript deobfuscator. _{Tool · Full entry}
• Chrome extension source viewer (CRX Viewer) - Browser extension and web page by Rob Wu for inspecting packaged browser extensions without installing them. _{Tool · Full entry}
• har-to-openapi - TypeScript library and CLI that infers OpenAPI 3.0 or 3.1 documents from HAR captures of HTTP traffic, loosely based on har2openapi. _{Tool · Full entry}
• decode-js - Babel-based AST processor that turns obfuscated JavaScript back into readable source, with one target selected per run: javascript-obfuscator (obfuscator.io), JS-Confuser 2.x up to its high preset, sojson and its v7 variant for jsjiami.com.v7, sojson's jjencode variant, and a generic pass for unreachable code, nested blocks and constant expressions. _{Tool · Full entry}
• javascript-deobfuscator (LostMyCode) - Browser-based Vue app that restores the strings Obfuscator.io hides behind string-array lookups in JavaScript. _{Tool · Full entry}
• minusone - Airbus CERT's Rust deobfuscation engine for scripts: it parses PowerShell or JavaScript with tree-sitter, applies rules that infer the values of syntax-tree nodes and prints a simplified script. _{Tool · Full entry}
• JS-Deobfuscator (0x1Avram) - Node.js deobfuscator for JavaScript produced by Timofey Kachalov's javascript-obfuscator, also offered as obfuscator.io. _{Tool · Full entry}
• HTTP Toolkit - Open-source HTTP(S) debugging proxy for Windows, Linux and macOS that sets up interception for browsers, terminals, backend runtimes, Electron apps and Android devices, then shows the full headers and body of every request and response with body decoding, inline header documentation and filtering. _{Tool · Also: App, Protocol · Full entry}
• Javascript Deobfuscator - Browser-based workbench for deobfuscating JavaScript by hand, also hosted on GitHub Pages, that pairs a Monaco editor with step-by-step rewriting and evaluation commands instead of a one-click pipeline. _{Tool · Full entry}
• go-fAST - Go library for parsing, traversing, transforming and regenerating JavaScript abstract syntax trees, which its README presents for code analysis, obfuscation and deobfuscation. _{Tool · Full entry}
• Hetty - Open-source HTTP toolkit for security research, which its author aims to make an alternative to Burp Suite Pro. _{Tool · Full entry}
• debundle - Node.js command-line tool that unpacks JavaScript bundles produced by Browserify or Webpack back into a tree of module files, so a bundle can be read file by file instead of as one script. _{Tool · Full entry}
• JStillery - Minded Security's JavaScript deobfuscator, which Stefano Di Paola forked from esdeobfuscate in 2015, simplifies scripts by partial evaluation on an esprima AST. _{Tool · Full entry}
• box.js - Node.js utility for studying malicious JavaScript that runs a sample inside an emulated Windows JScript environment, with WScript, ActiveX, filesystem, registry, WMI and HTTP objects emulated and source rewriting that exposes eval calls and conditional-compilation code. _{Tool · Full entry}
• breakinggood - breakinggood captures a website's screenshots, cleaned DOM, computed design values, images, and XHR/fetch responses, then generates a Vite, React, and Tailwind rebuild with a mock API replaying observed JSON. _{Tool · Full entry}
• Facebook BitMap Codec - Facebook BitMap Codec encodes and decodes Facebook web API parameter values using the project's reverse-engineered bitmap, run-length and custom Base64 scheme. _{Tool · Full entry}
• DevLens Ultra - DevLens Ultra is a Chrome extension for inspecting and extracting website component structure. _{Tool · Full entry}
• AppThreat wasm-tools - wasm-tools is a pure-Python parser and disassembler for WebAssembly core modules and Component Model binaries. _{Tool · WebAssembly · Also: Binary · Full entry}
• web-crawler ReverseAgent - web-crawler includes ReverseAgent for investigating website JavaScript and request signing. _{Tool · Full entry}
• Mirrorframe - Mirrorframe captures webpages with Playwright and reconstructs their observed layout and behavior as a self-contained React app. _{Tool · Full entry}
• unwebpack-sourcemap - unwebpack-sourcemap is a Python script that recovers TypeScript, JSX, and other source files from Webpack source maps. _{Tool · Full entry}
• Wirebrowser - Wirebrowser is a desktop tool for instrumenting browser JavaScript through the Chrome DevTools Protocol. _{Tool · Full entry}
• Thug - Thug is a Python low-interaction honeyclient that mimics a web browser to detect and emulate malicious content. _{Tool · Full entry}
• spy-debugger - spy-debugger is a tool for remotely debugging pages in mobile browsers and app WebViews while capturing HTTP and HTTPS traffic. _{Tool · Also: App · Full entry}
• WebsiteBench - Benchmark that asks whether AI agents can rebuild websites through browser exploration: given a production-level website they can explore through a browser, agents must reverse-engineer a full-stack version that matches its appearance and behavior as closely as possible. _{Project · Full entry}

Game

↑ Contents

239 case studies. The 10 newest are below. Full case list.

By method: Matching decompilations and disassemblies (69) · Non-matching decompilations (19) · Static recompilations (48) · Ports of reconstructed source (33) · Engine reimplementations (47) · Other methods and analyses (23)

Case studies

• Atlantis Native: porting the Atlantis and Atlantis II engines to Rust - Atlantis Native ports the reverse-engineered CryOmni3D Atlantis engine to Rust for Atlantis: The Lost Tales and Atlantis II. _{Case study · Independent reconstruction · Full entry}
• bf-private-server: a Brave Frontier revival server - bf-private-server recreates a self-hosted server for Brave Frontier client version 2.19.6. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• Chariot: Age of Empires engine reimplementation - Chariot is an open-source effort to reimplement the engine of the original Age of Empires (1997). _{Case study · Independent reconstruction · Full entry}
• Cosmo: a native port of Cosmo's Cosmic Adventure - Cosmo ports the reconstructed source of Cosmo's Cosmic Adventure: Forbidden Planet to macOS, Linux and Windows. _{Case study · Independent reconstruction · Full entry}
• Cursed Lands: a Godot engine for Evil Islands and Lost in Astral - Cursed Lands reimplements the engine for Evil Islands and Lost in Astral in Godot, reading maps, models, audio, scripts and tables from the player's own game copy. _{Case study · Independent reconstruction · Full entry}
• d2mac-linux: porting the Diablo II Mac executable to 32-bit Linux - d2mac-linux ports the Diablo II 1.14d Mac executable to 32-bit Linux by converting its i386 Mach-O container to ELF and reimplementing imported Darwin, Carbon and AGL interfaces in Zig. _{Case study · Independent reconstruction · Also: Binary · Full entry}
• Devil May Cry: an experimental PS2 static recompilation - dmc-recomp translates the PlayStation 2 PAL release of Devil May Cry into native PC code through PS2Recomp and a project runtime. _{Case study · Independent reconstruction · Full entry}
• FH2MP: reconstructed Forza Horizon 2 online services - FH2MP restores Forza Horizon 2 multiplayer with a replacement server based on protocol behavior recovered from the Xbox One game client. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• FreeRS42: reimplementing Ricochet Xtreme - FreeRS42 is a C++ project to reimplement the PC game Ricochet Xtreme using the NuVelocity engine. _{Case study · Independent reconstruction · Full entry}
• GTA Mode: reverse-engineering SimCity 3000 Unlimited for a native plugin - GTA Mode is a native plugin that adds direct control of spawned citizens and cars to SimCity 3000 Unlimited. _{Case study · Also: Binary · Full entry}

Tools, projects and integrations

• RenderDoc - Inspect frame captures, draw calls, shaders, and graphics resources in your own game or graphics application. _{Tool · Also: App · Full entry}
• AssetRipper - Analyze Unity game files, inspect asset dependencies, and convert supported assets into Unity project formats. _{Tool · Full entry}
• Cpp2IL - Recover managed representations from Unity IL2CPP builds using binary and metadata analysis; reconstruction remains a work in progress. _{Tool · Also: App, Binary · Full entry}
• Il2CppDumper - Recover IL2CPP metadata and dummy assemblies, and generate helper scripts for native analysis tools; method code is not restored. _{Tool · Also: App, Binary · Full entry}
• RenderDoc MCP - Expose existing RenderDoc captures to an agent for bounded frame, pipeline, resource, and shader inspection. _{Integration · Independent MCP · Also: App · Full entry}
• UndertaleModTool - Browse and modify supported GameMaker data files, extract assets, and decompile or compile GML VM code. _{Tool · Full entry}
• frida-il2cpp-bridge - Inspect IL2CPP classes, methods, and fields in a live process, and trace or intercept method calls without supplying global-metadata.dat. _{Tool · Also: App · Full entry}
• objdiff - Compare functions and data in reference and rebuilt object files to guide matching decompilation. _{Tool · Also: Binary · Full entry}
• decomp-permuter - Randomly or systematically permutes one C function, recompiling each variant and scoring it against a target object file to search for matching compiler output. _{Tool · Also: Binary · Full entry}
• asm-differ - Diffs original and rebuilt assembly for one function or ROM address to guide matching decompilation; its watch mode can rerun make when sources change. _{Tool · Also: Binary · Full entry}
• UE Explorer - Explore Unreal packages through class, property, and dependency trees; decompile and export UnrealScript classes, inspect bytecode, and examine structured binary data. _{Tool · Also: Binary · Full entry}
• GARbro - Browse recognized visual-novel resource archives as folders, preview their contents, and extract images or audio with conversion to common formats. _{Tool · Full entry}
• Godot RE Tools - Recover supported Godot project files, GDScript and imported resources from exported games. _{Tool · Full entry}
• UE4SS - Inspect Unreal Engine games at runtime through live UObject property views, reflected C++ header dumps, property mappings and actor dumps. _{Tool · Full entry}
• FModel - Explore Unreal Engine game archives with CUE4Parse-backed package and property inspection, asset previews and export. _{Tool · Full entry}
• PSP Web Recomp - Translate PSP MIPS executables into C++ and WebAssembly, backed by a PSP high-level emulation runtime and WebGL2 renderer. _{Project · Also: Website · Full entry}
• N64: Recompiled - Statically recompiles N64 MIPS binaries into C functions from symbol metadata, emitting function lookups and relocation macros so a runtime can handle statically linked and relocatable overlays. _{Tool · Also: Binary · Full entry}
• XenonRecomp - Converts Xbox 360 PowerPC executables into C++ that can be compiled for other platforms, with the XenonAnalyse companion detecting jump tables and function boundaries. _{Tool · Also: Binary · Full entry}
• decomp.me - Collaborative decompilation website for matching work: its compile service builds candidate source with a selected platform compiler, assembles the target assembly and diffs the two objects with asm-differ. _{Tool · Also: Binary · Full entry}
• splat - Binary splitter for decompilation and modding projects: a YAML config says where and how to cut an N64 ROM or PSX, PS2 or PSP binary into code, data and asset segments. _{Tool · Also: Binary · Full entry}
• m2c - Decompiler for matching projects that turns GNU as-format 32-bit MIPS, ARM, PowerPC and SuperH assembly into draft C, with partial C++ support. _{Tool · Also: Binary · Full entry}
• decomp-toolkit - GameCube/Wii matching-decompilation toolkit that analyzes DOL and REL executables and, from a project configuration, splits them into relocatable objects plus an ldscript.lcf for CodeWarrior's linker, so decompiled objects can replace original ones while the relinked binary is checked against the original. _{Tool · Also: Binary · Full entry}
• Cheat Engine MCP Bridge - Connects MCP clients to Cheat Engine through a Lua bridge script and a Python MCP server, so an agent can inspect a process the user runs under Cheat Engine: memory reads and value scans, pointer-chain resolution, structure dissection, RTTI class names, disassembly, cross-references and hardware or DBVM breakpoints. _{Integration · Independent MCP · Also: Binary · Full entry}
• ido-static-recomp - Statically recompiles the IRIX MIPS programs of SGI's IDO 5.3 and 7.1 C toolchain, such as cc, cfe, uopt, ugen and as1, into native Linux, macOS and Windows executables, so matching decompilation projects can build with the original compiler code on modern hosts. _{Tool · Also: Binary · Full entry}
• PS2Recomp - Experimental static recompiler that translates MIPS R5900 code from PlayStation 2 ELF executables into C++ and links it with a bundled runtime. _{Tool · Also: Binary · Full entry}
• Xenosaga I Decomp Compatibility Kit - Checks a PS2 matching decompilation from outside its own build: the C is recompiled with a stock, unpatched ee-gcc 2.96 and assembler, then each function is byte-compared against the original and every difference is classified by its likely toolchain cause. _{Tool · Also: Binary · Full entry}
• GB Recompiled - Static recompiler that turns Game Boy and Game Boy Color ROMs into portable C projects: it decodes and analyzes banked LR35902 code, emits C with machine-readable metadata, and links it with a shared SDL2 runtime for video, audio, input, saves and hardware timing. _{Tool · Also: Binary · Full entry}
• dtk-template - Project template for starting GameCube and Wii matching-decompilation repositories around decomp-toolkit. _{Tool · Full entry}
• N64ModernRuntime - Runtime for N64Recomp static recompilations and traditional source ports of N64 games, made of two libraries. _{Tool · Full entry}
• REDscript - Compiler and decompiler toolkit for REDscript, a statically typed, object-oriented language for writing scripts for REDengine, CD Projekt's engine used in Cyberpunk 2077. _{Tool · Full entry}
• Spice86 - PC emulator for executing, reverse engineering and rewriting real-mode DOS programs whose source code is unavailable. _{Tool · Also: Binary · Full entry}
• PS2 Web Recomp - Statically recompiles PlayStation 2 games for the browser: eerecomp translates the Emotion Engine code of a game's boot executable into C++ that is compiled to WebAssembly, and a runtime emulates the rest of the console, including a high-level EE kernel, an interpreted I/O processor running the disc's IRX modules, the vector units, SPU2 sound and the Graphics Synthesizer on WebGPU compute shaders. _{Tool · Also: Binary · Full entry}
• xboxrecomp - Static-recompilation toolkit for original Xbox games: a Python pipeline parses a retail XBE, disassembles it, classifies library functions, recovers calling conventions and lifts every x86 function to C. _{Tool · Also: Binary · Full entry}
• PCSX-Redux - PlayStation 1 emulator forked from PCSX and built around development and reverse engineering, with an interpreter and dynamic recompiler, software and OpenGL renderers, a MIPS debugger, VRAM viewer, SPU and GPU debugging tools, and a built-in GDB server that its documentation connects to gdb, IDA Pro and Ghidra's debugger. _{Tool · Also: Binary · Full entry}
• Il2CppInspector - Static analysis tool for Unity IL2CPP applications that reads an IL2CPP binary with its global-metadata.dat and outputs the application's type structure and method addresses as C# stub code, .NET assembly shim DLLs for decompilers such as ILSpy and dnSpy, IDA and Ghidra Python scripts that apply symbols and types, C++ type scaffolding and JSON address maps. _{Tool · Also: App, Binary · Full entry}
• MelonLoader - Mod loader for Unity games on both the Mono and IL2CPP runtimes, which loads plugins and mods from folders in a locally installed game; on Windows a proxy DLL, version.dll by default, starts it with the game. _{Tool · Full entry}
• BepInEx - Plugin and patching framework for Unity Mono, Unity IL2CPP and .NET Framework games such as XNA, FNA and MonoGame titles, which loads mods and analysis plugins into a locally installed game. _{Tool · Full entry}
• ReXGlue SDK - Experimental SDK for statically recompiling Xbox 360 executables into portable C++23 that runs natively on Windows, Linux and macOS. _{Tool · Also: Binary · Full entry}
• ps3recomp - Toolkit and runtime for statically recompiling PlayStation 3 games into native executables. _{Tool · Also: Binary · Full entry}
• Nebula (NebulaFD) - Work-in-progress decompiler for games made with Clickteam Fusion 2.5, with fixes for older Multimedia Fusion 1.5 files. _{Tool · Full entry}
• swe1r-assets-unity: Racer model-block editor sample - Work-in-progress Unity editor sample for importing and modifying Star Wars Episode I: Racer model blocks, then serializing them back through swe1r-assets. _{Tool · Full entry}
• LuaJIT Decompiler v2 - Decompiles LuaJIT bytecode files back into Lua source, written as a replacement for the older Python LuaJIT decompiler. _{Tool · Also: Binary · Full entry}
• NTRGhidra - Ghidra loader and plugin for Nintendo DS programs. _{Tool · Full entry}
• mgbdis - Python disassembler that turns a Game Boy or Game Boy Color ROM, including multi-bank ROMs, into RGBDS-compatible assembly plus a Makefile that reassembles it, so the rebuilt ROM can be compared with the input. _{Tool · Also: Binary · Full entry}
• ghidra-allegrex - Ghidra processor module for the Allegrex CPU of the PlayStation Portable, derived from Ghidra's MIPS module. _{Tool · Also: Binary, Firmware · Full entry}
• GM8Decompiler - Command-line tool that turns games built with GameMaker 8.0 or 8.1 back into editable .gmk or .gm81 project files. _{Tool · Full entry}
• UELib (Unreal-Library) - C# library that reads Unreal Engine 1, 2 and 3 package files such as .u, .upk and .udk, auto-detects a matching game build and deserializes their exports, imports and properties. _{Tool · Full entry}
• DiztinGUIsh - Windows disassembler for Super NES ROMs in which the user marks bytes as code or data, steps through 65816 code while the tool tracks the M and X flags and the data bank and direct page registers, adds labels and comments, and exports assembly for the asar assembler that the README says compiles back into the original binary. _{Tool · Full entry}
• Zygisk-Il2CppDumper - Zygisk module by Perfare, the Il2CppDumper author, that dumps type metadata from inside a Unity IL2CPP Android app while it runs. _{Tool · Also: App · Full entry}
• UABEA - Cross-platform reader and writer for the asset bundles and serialized asset files of Unity games, originally based on, though not a fork of, the archived UABE. _{Tool · Full entry}
• AssetStudio - Tool for exploring, extracting and exporting the assets and asset bundles of Unity versions 3.4 to 2022.1. _{Tool · Full entry}
• vgmstream - Library and tools that decode streamed, prerecorded video game audio in hundreds of formats and codecs, from common game engine files to single-game codecs, including looped music, subsongs, companion files, custom containers and encryption keys. _{Tool · Full entry}
• pkg-to-anyps5 - pkg-to-anyps5 extracts PS5 debug game packages or game folders into the layout expected by the AnyPS5 relinker. _{Tool · Full entry}
• dfsdk - dfsdk dumps Delta Force object metadata by enumerating its object array, decoding per-entry XOR-encrypted names and walking class super chains and property lists. _{Tool · Full entry}
• KBot - KBot inspects and transforms Total Annihilation and TA: Kingdoms game files, pairing a Go CLI with a proprietary format reference. _{Tool · Full entry}
• BNDExtract - BNDExtract is a Go command-line tool for extracting the ALL.BND archive used by Kuon and some other FromSoftware PlayStation 2 games. _{Tool · Full entry}
• RE4METoolbox - RE4METoolbox provides command-line utilities for examining and modifying Resident Evil 4 Mobile Edition files. _{Tool · Full entry}
• Aspyr Archive Tool - Aspyr Archive Tool unpacks and rebuilds Android OBB archives used by three Aspyr game ports: Star Wars: Knights of the Old Republic II, Jade Empire: Special Edition and Fahrenheit: Indigo Prophecy Remastered. _{Tool · Full entry}
• ScriptSource-Dumper - ScriptSource-Dumper extracts scripts from Call of Duty: Black Ops II scriptsrc.clump archives. _{Tool · Full entry}
• .AUP-File-Type-Decryptor-and-Viewer - .AUP-File-Type-Decryptor-and-Viewer is a local browser tool for inspecting Dragon Soul .aup game asset files. _{Tool · Full entry}
• Universal GBA Pokedex - Universal GBA Pokedex scans Game Boy Advance Pokémon ROMs to locate and display evolution, name and item tables. _{Tool · Full entry}
• VG Reverse Engineering - VG Reverse Engineering decodes Vainglory: Community Edition replay files into recorded player names, heroes, K/D/A, items, gold and scoreboard counters. _{Tool · Full entry}
• Chip-8 Emulator and c8-disassembler - The c8-disassembler in Chip-8 Emulator translates CHIP-8 ROM opcodes into assembly instructions. _{Tool · Full entry}
• BGI Converter TGA - BGI Converter TGA analyzes BGI-Ethornell game image files and converts custom RGB or RGBA layouts and BMP images into 32-bit TGA. _{Tool · Full entry}
• Xenus DT1 Decompiler - Xenus DT1 Decompiler extracts DT1 and DT2 texture caches from Xenus 2: White Gold and Boiling Point: Road to Hell; its current decoder has not been tested with The Precursors. _{Tool · Full entry}
• GRB Modding Knowledgebase - GRB Modding Knowledgebase documents Ghost Recon: Breakpoint’s Anvil .forge archives, nested .data resources and asset replacement workflow. _{Project · Full entry}
• psp-media-slopkit - psp-media-slopkit analyses PSP XMB ICON1.PMF and SND0.AT3 files using format findings derived from retail game samples. _{Tool · Full entry}
• DualRip - DualRip extracts Nintendo DS sound effects and music from SDAT archives and Nintendo 3DS audio from CSAR archives, including ROM inputs. _{Tool · Full entry}
• YGO-PoC Toolset - YGO-PoC Toolset handles resource and save formats from Yu-Gi-Oh! _{Tool · Full entry}
• FH6 Model Tools - FH6 Model Tools parses reverse-engineered Forza Horizon 6 asset formats, including burG model and texture containers. _{Tool · Full entry}
• Ed1th's PvZ Toolkit - Ed1th's PvZ Toolkit inspects and edits Plants vs. Zombies resource archives and files through a desktop or web interface backed by Rust format libraries. _{Tool · Full entry}
• kenshi-modkit - kenshi-modkit parses and writes Kenshi .mod and .base files and reads its .save, .zone and .platoon files using Python. _{Tool · Full entry}
• ffxii-tza-tools - ffxii-tza-tools documents and processes FINAL FANTASY XII The Zodiac Age character formats, including .ca animations, .cm models and .phyre assets. _{Tool · Full entry}
• sims-package2glb - sims-package2glb extracts models from The Sims 2, 3 and 4 .package files into glTF binary files. _{Tool · Full entry}
• vc64_240p - vc64_240p analyses and patches the N64 Virtual Console emulator inside Wii WAD channels to output 240p. _{Tool · Also: Binary · Full entry}
• Unrpyc - Unrpyc is a tool that decompiles compiled Ren'Py game scripts into readable script files. _{Tool · Full entry}
• BSPSource - Java map decompiler that turns Source engine .bsp map files back into .vmf files that can be loaded in Hammer. _{Tool · Full entry}
• PKHeX - PKHeX is a C# Windows Forms editor for Pokémon core-series save data. _{Tool · Full entry}
• nxnative - nxnative is a tool that packages Nintendo Switch games as apps that run their code natively on Apple hardware, with graphics translated to Metal. _{Tool · Also: Binary · Full entry}

App

↑ Contents

72 case studies. The 10 newest are below. Full case list.

Case studies

• AOL 7.0 Retro Server: reconstructing the P3 server session - AOL 7.0 Retro Server implements local Python servers for the 2001 AOL 7.0 client. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• Benro Polaris Firmware Patcher: rebuilding camera control and mapping the app protocol - Benro Polaris Firmware Patcher investigates the Polaris camera controller and repacks a user-supplied firmware image with a newer libgphoto2 stack and targeted pgphoto changes. _{Case study · Independent reconstruction · Also: Firmware, Protocol · Full entry}
• CADCraft: a clean-room CAD and drafting application in Rust - The authors describe CADCraft as an open-source, clean-room computer-aided design and drafting application built in pure Rust. _{Case study · Independent reconstruction · Full entry}
• Clickwill: reconstructing iPod library database editing - Clickwill reconstructs direct editing of iPod classic and iPod nano music libraries in a Swift Mac app. _{Case study · Independent reconstruction · Full entry}
• ddg-tenor-bridge: replacing Gboard's Tenor search endpoint - ddg-tenor-bridge redirects Gboard's Tenor GIF searches to a service that returns DuckDuckGo animated-image results in Tenor v2 response form. _{Case study · Independent reconstruction · Full entry}
• DesignCraft: a clean-room page layout and publishing studio in Rust - The authors describe DesignCraft as an open-source, clean-room page layout and desktop publishing studio built in pure Rust. _{Case study · Independent reconstruction · Full entry}
• EffectCraft: a clean-room motion graphics and compositing studio in Rust - The authors describe EffectCraft as an open-source, clean-room motion graphics and visual effects studio built in pure Rust. _{Case study · Independent reconstruction · Full entry}
• FigCraft: a clean-room interface design and prototyping tool in Rust - The authors describe FigCraft as an open-source, clean-room interface design and prototyping tool built in pure Rust. _{Case study · Independent reconstruction · Full entry}
• FilmCraft: a clean-room nonlinear video editor in Rust - The authors describe FilmCraft as an open-source, clean-room nonlinear video editor built in pure Rust. _{Case study · Independent reconstruction · Full entry}
• grsimwrite-mac: reconstructing GRSIMWrite for macOS - grsimwrite-mac reconstructs the Windows GRSIMWrite 4.4.10 SIM-writing workflow in Python for macOS. _{Case study · Independent reconstruction · Also: Protocol · Full entry}

Tools, projects and integrations

• JADX-AI-MCP - JADX plugin paired with a Python MCP server to inspect decompiled Android classes, resources, cross-references and debugger context. _{Integration · Independent MCP · Full entry}
• apktool-mcp-server - Python MCP server that drives a local Apktool install so agents can decode APKs; list, read, search and edit smali and resource files; read AndroidManifest.xml and apktool.yml; and rebuild the project. _{Integration · Independent MCP · Full entry}
• frida-mcp (yfe404) - Frida MCP server with persistent instrumentation sessions, runtime inspection and Android static-to-dynamic navigation. _{Integration · Independent MCP · Also: Game · Full entry}
• Super Trouper - Single-binary Frida MCP server for discovering devices, managing process sessions and loading instrumentation scripts. _{Integration · Independent MCP · Also: Game · Full entry}
• Frida - Dynamic instrumentation toolkit for observing and scripting the behavior of live native and managed processes. _{Tool · Also: Game · Full entry}
• JADX - Dex-to-Java decompiler with CLI/GUI navigation, resource decoding and cross-reference search for Android packages. _{Tool · Android · Full entry}
• Apktool - Decodes Android resources and smali into a project-like tree and can rebuild modified packages. _{Tool · Android · Full entry}
• Androguard - Python toolkit for APK/DEX metadata, bytecode and reference analysis; the v5 source branch also documents agent skills and MCP. _{Tool · Android · Full entry}
• ILSpy - .NET assembly browser and C# decompiler with whole-project export, metadata inspection and a scriptable command-line frontend. _{Tool · .NET · Full entry}
• dnSpyEx - Community continuation of dnSpy for debugging and editing .NET assemblies without the original source. _{Tool · .NET · Full entry}
• @electron/asar - Electron's archive tool lists and extracts ASAR contents so packaged JavaScript and application assets can be inspected. _{Tool · Also: Website · Full entry}
• Mobile Security Framework (MobSF) - Inspect mobile application packages with static analysis and supported-device dynamic testing, including runtime behavior and network traffic, through a web interface and APIs. _{Tool · Android · Full entry}
• objection - Explore running Android and iOS apps with a Frida-backed command interface for inspecting app storage, memory, runtime objects, and instrumented behavior. _{Tool · Android · Full entry}
• Grapefruit - Inspect and hook running iOS and Android apps from a Frida-based web interface, with method and crypto-API hooks, filesystem and SQLite browsers, iOS keychain and UI-hierarchy views, and HTTP capture from common networking libraries. _{Tool · Full entry}
• Blutter - Analyze Flutter Android ARM64 AOT binaries using the matching Dart runtime. _{Tool · Android · Also: Binary · Full entry}
• hermes-dec - Parse, disassemble and partially decompile React Native Hermes bytecode bundles. _{Tool · Android · Full entry}
• Recaf - Inspect and modify compiled JVM applications with integrated decompilers, bytecode assembly, reference search, mappings and deobfuscation tools. _{Tool · JVM · Also: Binary · Full entry}
• nibkit - Decode compiled iOS/macOS interface archives into object trees, Outlet/Action connections, custom classes and navigation relationships. _{Tool · Full entry}
• AOTopsy - Statically inspect Flutter/Dart AOT libapp.so files to recover available metadata, class structures, call edges and pseudocode without embedding a Dart VM or compiling a matching SDK. _{Tool · Android · Also: Binary · Full entry}
• hbctool - Disassemble and reassemble supported React Native Hermes bytecode bundles through HASM files, enabling bytecode inspection and editing for the explicitly supported legacy HBC versions. _{Tool · Android · Full entry}
• Vineflower - Fernflower-derived decompiler for Java and other JVM languages that continues the ForgeFlower, Fabric and Quiltflower forks, focused on output quality and modern Java, including records, sealed classes, switch expressions and pattern matching through Java 21+. _{Tool · JVM · Full entry}
• Droid ASC - Python Android decompiler that answers queries directly against an APK instead of first unpacking and indexing it. _{Tool · Android · Full entry}
• APKEditor - Command-line APK editor built on ARSCLib that decodes an APK's binary resources and DEX into editable JSON, XML or smali and rebuilds a package from them, independent of aapt and aapt2. _{Tool · Android · Full entry}
• jnitrace - Frida-based dynamic-analysis tool that traces an Android app's use of the JNI API, similar to frida-trace or strace but for the Java Native Interface. _{Tool · Android · Full entry}
• AsmResolver - C# library for reading, modifying and rebuilding Portable Executable files, covering both native Windows images and images with .NET metadata. _{Tool · .NET · Also: Binary · Full entry}
• CodemerxDecompile - Cross-platform desktop .NET decompiler maintained by the original JustDecompile creators as a continuation of their JustDecompile Engine, built with Mono.Cecil and an Avalonia UI. _{Tool · .NET · Full entry}
• wxapkg - Desktop GUI for Windows and macOS, built with Wails, that unpacks WeChat mini-program .wxapkg packages for study. _{Tool · Full entry}
• React Native Decompiler - Alpha-stage Node.js CLI that splits a React Native JavaScript bundle (index.android.bundle or main.jsbundle), an unbundled js-modules folder, or Webpack entrypoint and chunk bundles into one readable file per module. _{Tool · Full entry}
• hermes-decomp - Rust decompiler and analysis toolkit for Hermes bytecode (.hbc), the compiled form React Native apps ship for the Hermes engine; the README lists HBC versions 40 to 99. _{Tool · Android · Full entry}
• MEDUSA - Modular Frida-based framework for runtime analysis of Android and iOS apps the analyst is authorized to test. _{Tool · Android · Full entry}
• Android Unpinner - Tool from the mitmproxy project that removes certificate pinning from an Android APK you own or are authorized to test, without a rooted device. _{Tool · Android · Also: Protocol · Full entry}
• apk-mitm - Command-line tool that prepares an Android APK you own or are authorized to test for HTTPS traffic inspection. _{Tool · Android · Also: Protocol · Full entry}
• Frida Mobile Interception Scripts - A set of Frida scripts from HTTP Toolkit for inspecting a mobile app's HTTPS traffic while analysing apps you own or are authorized to test. _{Tool · Android · Also: Protocol · Full entry}
• reFlutter - Flutter reverse-engineering framework for apps the analyst is authorized to inspect. _{Tool · Android · Also: Protocol · Full entry}
• ddc - Rust decompiler that turns Android DEX bytecode, versions 035 to 041, from APKs, multi-dex apps and XAPK/APKS/APKM containers into Java, folding lambdas and string concatenation back into Java syntax and giving locals jadx-style names. _{Tool · Android · Full entry}
• Simplify - Generic Android deobfuscator built on smalivm, a sandboxed Dalvik virtual machine that executes each method and records every possible register and class value along all execution paths, taking both branches when a value such as file or network input is unknown. _{Tool · Android · Full entry}
• GDA (GJoy Dex Analyzer) - Windows-native Dalvik decompiler and Android analysis workbench written in C++ that opens APK, DEX, ODEX, OAT, JAR, AAR and class files without installation. _{Tool · Android · Full entry}
• APKLab - VS Code extension that turns the editor into an Android reverse-engineering workbench around Apktool, Jadx, smali-lsp and uber-apk-signer. _{Tool · Android · Full entry}
• Fernflower - JetBrains' analytical decompiler that turns Java class files back into Java source; IntelliJ IDEA bundles it to show code when debugging or browsing class files. _{Tool · JVM · Full entry}
• Bytecode Viewer - Desktop suite for inspecting compiled Java and Android programs: drop in a class, JAR, WAR, APK, DEX, XAPK or APKM file to browse its classes and resources, with up to three decompiler or disassembler views side by side. _{Tool · JVM · Full entry}
• Logic-Lens - Experimental JavaScript source-analysis toolkit that classifies AST-token sequences into configured formula families after local training, and produces heuristic structure, call-graph and intent reports. _{Tool · Full entry}
• Android Security Toolkit - Local Python APK triage tool that drives apktool and strings, checks manifest settings and source/native-library strings, and produces TXT/JSON findings for manual review. _{Tool · Android · Full entry}
• ilspy-cli: targeted .NET decompilation for agents - Rust CLI that hosts an ILSpy C# bridge in-process for assembly, type and named-method decompilation, source search and structured JSON output. _{Tool · .NET · Full entry}
• React-Decode - Static-analysis CLI for compiled React JavaScript that produces readable bundle output and inferred API-request, route and application-constant reports. _{Tool · Also: Website · Full entry}
• abc-decompiler - Decompiler for HarmonyOS Ark bytecode (.abc), the format HarmonyOS app packages carry in modules.abc, built by adapting the jadx decompiler and reading files through a patched copy of the abcde library. _{Tool · Android · Full entry}
• slicer - Browser-based Java reverse-engineering tool that loads class files and JAR/ZIP archives and disassembles or decompiles them with Vineflower (the default), CFR, Procyon or JASM, compiled to run in the browser, next to its own bytecode disassembler. _{Tool · JVM · Full entry}
• APK Studio - Qt6 desktop front end that drives Apktool, JADX, uber-apk-signer and ADB from an IDE-style workspace for Android packages. _{Tool · Android · Full entry}
• APKiD - PEiD-style identifier for Android packages from RedNaga. _{Tool · Android · Full entry}
• dex2jar - Java toolkit that converts Android DEX bytecode, including DEX inside APKs, into JVM .class files packed as a jar for Java decompilers and bytecode tools. _{Tool · Android · Full entry}
• apk.sh - Bash script that automates repetitive Android app analysis chores around apktool: pulling an installed package from a device or emulator, decoding resources and disassembling dex code, and rebuilding the decoded directory into an APK. _{Tool · Android · Full entry}
• FIRERPA (lamda) - Client/server Android automation and dynamic-analysis platform for devices the analyst is authorized to test. _{Tool · Android · Full entry}
• Binder Trace - Frida-based terminal tool, described by its authors as "Wireshark for Binder", that intercepts the Binder IPC transactions an Android process sends and parses each message and its reply. _{Tool · Android · Also: Protocol · Full entry}
• Quark-Engine - Rule-based engine for analysing suspicious Android apps: it loads an APK's Dalvik bytecode and checks JSON behaviour rules, each naming permissions and a pair of framework API calls, through five confidence stages, from the permission being requested and either API being called up to both calls appearing in order in one method and passing the same register. _{Tool · Android · Full entry}
• Dexcalibur (Reversense) - Android reverse-engineering platform that combines static analysis with Frida-based dynamic instrumentation; the master branch is Reversense (Dexcalibur 2.0), a rewrite that runs as a Node.js web server for collaborative projects. _{Tool · Android · Full entry}
• vdexExtractor - Command-line C tool that extracts the Dex bytecode held in the Vdex containers that ART's dex2oat compiler writes beside Oat files since Android 8.0 (API 26), and by default reverts ART's dex-to-dex quickening so the output is ordinary Dex again. _{Tool · Android · Full entry}
• Garlic - Java and Android decompiler written in C that recovers Java source from class, JAR, WAR, DEX and APK files on multiple threads; it also prints javap- or dexdump-style class listings, converts APK and DEX files to smali, searches their strings with regular expressions and generates call graphs for DEX and APK files. _{Tool · Android · Full entry}
• Android-Disassembler - On-device disassembler and binary viewer for Android, built on Capstone, that opens ELF shared libraries and executables, object files, Windows PE files, .NET assemblies, dex files and APKs chosen from storage or from installed apps. _{Tool · Android · Also: Binary · Full entry}
• XAPKDetector - APK and DEX detector from hors, the author of Detect-It-Easy, that reports the build tools, libraries and protections it identifies in Android packages, using scan engines and signature databases from the Detect-It-Easy family. _{Tool · Android · Full entry}
• Jsxer - C++ decompiler for JSXBIN, the binary format of Adobe's legacy ExtendScript, the ECMAScript 3 dialect used to script applications such as Photoshop, InDesign and After Effects. _{Tool · Full entry}
• jni_helper - Static helper by evilpan for reverse engineering Android JNI code. _{Tool · Android · Also: Binary · Full entry}
• ReArk - Desktop reverse-engineering and AI-assisted analysis workbench for HarmonyOS NEXT packages (.hap, .app and .abc), whose binary releases add Android .apk/.aab, iOS .ipa and standalone PE, ELF and Mach-O analysis. _{Tool · Android · Also: Binary · Full entry}
• ARSCLib - Java library, modeled on AOSP's androidfw ResourceTypes.h and meant to replace aapt/aapt2, that reads, writes, modifies and creates Android resource tables (resources.arsc) and binary XML files such as AndroidManifest.xml. _{Tool · Android · Full entry}
• Pithus (bazaar) - Self-hostable Django platform behind the Pithus Android analysis service, which its README describes as built for activists, journalists, NGOs and researchers. _{Tool · Android · Full entry}
• House - NCC Group’s Python and Flask web interface for Frida-based runtime analysis of Android apps, intended to make writing Frida scripts simpler. _{Tool · Android · Full entry}
• ABCDE - Kotlin toolkit for OpenHarmony reverse engineering that parses Ark bytecode (.abc) files, the format HarmonyOS app packages carry in modules.abc, along with HAP packages and resource index (.index) files. _{Tool · Android · Full entry}
• de4js - Browser-based JavaScript deobfuscator and unpacker, built as a Jekyll site that also works offline as a progressive web app. _{Tool · Also: Website · Full entry}
• DexKit - C++ DEX parsing library with Kotlin and Java APIs that loads an APK, DEX bytes or an app’s class loader and finds classes, methods and fields by their characteristics rather than their obfuscated names. _{Tool · Android · Full entry}
• bun-demincer - Node.js pipeline that recovers readable JavaScript from Bun-compiled standalone executables. _{Tool · Also: Binary · Full entry}
• dex-oracle - Pattern-based Dalvik deobfuscator that takes an APK, a DEX file or a Smali directory, disassembles it with baksmali and runs plugins that look for obfuscation patterns in the Smali code. _{Tool · Android · Full entry}
• arkdecompiler - Decompiler for HarmonyOS NEXT apps, published under the jd-opensource GitHub organization, that turns Panda binary files (.abc Ark bytecode) back into ArkTS source. _{Tool · Android · Full entry}
• JNIAnalyzer - A Ghidra extension by Terry Chia (Ayrx) with scripts for analyzing the native libraries of Android NDK apps. _{Tool · Android · Also: Binary · Full entry}
• Android Reverse - Android app, published only as release APKs, that runs an APK reverse-engineering workflow entirely on the phone, from package extraction and Java decompilation to native analysis, editing and rebuilding. _{Tool · Android · Full entry}
• jsc-decompile-mozjs-34 - PHP decoder and decompiler for SpiderMonkey 34 JavaScript bytecode, which the README says may handle .jsc files compiled by cocos2d-x. _{Tool · Also: Game · Full entry}
• Andromeda - Interactive command-line tool by Lasha Khasaia for first-pass reverse engineering of Android APKs, written in C/C++ for speed. _{Tool · Android · Full entry}
• Dex-Editor-Android - Work-in-progress Android app for editing DEX files on the device, built on a modified in-tree copy of Google's smali, baksmali and dexlib2. _{Tool · Android · Full entry}
• smali/baksmali - Assembler and disassembler for the dex format used by Android's Dalvik VM: baksmali turns dex, APK, odex and oat files into smali text, and smali assembles that text back into a dex file. _{Tool · Android · Full entry}
• dalvikus - Desktop Android reverse-engineering and modification workbench built with Kotlin Compose Multiplatform. _{Tool · Android · Full entry}
• paranoid-deobfuscator - Python command-line tool that recovers the strings hidden by the Paranoid and LSParanoid Android string-obfuscation plugins, so that smali code becomes readable for static analysis. _{Tool · Android · Full entry}
• Katalina - Python emulator for Dalvik bytecode that its README likens to Unicorn: it parses a DEX file and executes methods one instruction at a time, substituting Python mocks for common Java and Android APIs such as String, StringBuilder, Base64, ArrayList, AES Cipher and part of reflection. _{Tool · Android · Full entry}
• Doldrums - Python parser for the Dart AOT snapshots inside libapp.so, the compiled Dart code of an Android Flutter app. _{Tool · Android · Also: Binary · Full entry}
• Frida UI - Local browser interface for Frida aimed at Android app testing: a FastAPI server lists USB, local and remote frida-server devices with their installed apps and running processes, and lets the analyst attach to a process, spawn an app, spawn it with a script injected at launch, detach or kill it. _{Tool · Android · Full entry}
• darter - Python module that parses binary Dart VM snapshots, such as the libapp.so of a release Flutter app, into a navigable graph of VM objects with back-references, including the memory structures the snapshot dumps. _{Tool · Android · Also: Binary · Full entry}
• Appshark - ByteDance's static taint-analysis engine for Android APKs, designed for very large apps, that scans an app against JSON rules naming entry methods, sources, sinks and sanitizers as Jimple signatures, for vulnerability and privacy-compliance review. _{Tool · Android · Full entry}
• Wallbreaker - Frida-based explorer for the live Java heap of a running Android app, loaded as an objection plugin or used through its small Python package. _{Tool · Android · Full entry}
• axmlprinter - Java library and command-line tool that parses Android binary XML, such as the compiled AndroidManifest.xml inside an APK, and prints it as readable XML. _{Tool · Android · Full entry}
• FlowDroid - Static data-flow (taint) analysis for Android apps and Java programs, built on Soot and usable as a command-line tool or as Maven libraries. _{Tool · Android · Full entry}
• Enjarify - Pure-Python 3 translator from Dalvik bytecode to equivalent Java bytecode, so Java analysis tools and decompilers can be applied to Android apps: given an APK, with every DEX file of a multidex APK combined into one jar, or a single DEX file, it writes a jar of class files. _{Tool · Android · Full entry}
• MagiskFrida - Magisk, KernelSU and APatch module that installs frida-server on a rooted Android device and starts it at boot, so Frida clients can attach for dynamic instrumentation without starting the server by hand. _{Tool · Android · Full entry}
• de4dot - Open-source .NET deobfuscator and unpacker that tries to restore a packed and obfuscated assembly to almost its original form. _{Tool · .NET · Full entry}
• ClassyShark - Google's standalone browser for Android executables and libraries that shows class interfaces and members, dex counts and dependencies. _{Tool · Android · Full entry}
• JEB Decompiler - PNF Software's commercial reverse-engineering platform for Android apps and native code, combining a Dalvik decompiler and Android debuggers with disassemblers and decompilers for x86, ARM, MIPS and RISC-V machine code. _{Tool · Android · Also: Binary, Firmware · Full entry}
• Luyten - Graphical Java decompiler front end for the Procyon decompiler, with its editor view powered by RSyntaxTextArea. _{Tool · JVM · Also: Binary · Full entry}
• jd-cli - Command-line wrapper around a jd-core fork that decompiles Java class and JAR files to the console, a directory or a ZIP file, with options for line numbers, file-matching patterns and parallel processing. _{Tool · JVM · Also: Binary · Full entry}
• Android Unpacker - Code and slides from the Defcon 22 talk "Android Hacker Protection Level 0". _{Tool · Android · Full entry}
• ReverseAPK - Command-line tool that decompiles an APK to Java and Smali, lists the extracted files, and statically checks AndroidManifest.xml and the source for common vulnerabilities and behaviours such as intents, command execution, content providers, crypto references and hardcoded secrets. _{Tool · Android · Full entry}
• xHook - PLT hook library for Android native ELF executables and shared libraries. _{Tool · Android · Full entry}
• Epic - Continuation of Dexposed on ART: a runtime method-hooking framework that loads into an app and can hook both the app's own code and Android framework code running in its process. _{Tool · Android · Full entry}
• apkscope - apkscope inspects Android application packages through a Rust viewer, CLI, and MCP server. _{Tool · Android · Also: Binary · Full entry}
• NWBinAnalyzer - NWBinAnalyzer inspects compiled NW.js .bin files by checking their header and walking constant-pool entries. _{Tool · Full entry}
• derkt - derkt parses and disassembles Hermes Bytecode files in Racket. _{Tool · Also: Binary · Full entry}
• ODIS file unpacker - ODIS file unpacker extracts protected Java classes from ODIS plugin JARs and files from its DIDB data archives. _{Tool · JVM · Full entry}
• netdumper - netdumper extracts loaded .NET assemblies from Windows processes through the CLR Data Access Component. _{Tool · .NET · Also: Binary · Full entry}
• Sandwitcher - Sandwitcher instruments Java and Kotlin method calls in Android apps by replacing ART method entry points with a trampoline through Pine and LSPlant. _{Tool · Android · Full entry}
• Zygisk - Frida Gadget - Zygisk - Frida Gadget loads Frida Gadget into selected Android app processes for runtime instrumentation. _{Tool · Android · Full entry}
• dnlib - dnlib is a .NET library for reading and writing modules and assemblies. _{Tool · .NET · Also: Binary · Full entry}
• View8 - View8 is a static analysis tool that decompiles serialized V8 bytecode (JSC) files into readable JavaScript-like text. _{Tool · Also: Binary · Full entry}
• Soot - Soot is a Java optimization framework for analyzing and transforming Java bytecode. _{Tool · JVM · Also: Binary · Full entry}
• DroidLysis - DroidLysis is a pre-analysis tool for Android apps that disassembles samples, organizes their contents, and flags code patterns for further inspection. _{Tool · Android · Also: Binary · Full entry}
• VirtualXposed - VirtualXposed is an Android app that runs Xposed modules alongside apps in a virtual environment without root access, an unlocked bootloader, or a custom system image. _{Tool · Android · Full entry}
• EdXposed Framework - EdXposed is a Riru module that provides an Xposed-compatible ART hooking framework for Android 8.0 through 11. _{Tool · Android · Full entry}
• Vector Framework - Vector Framework is a Zygisk module that provides ART hooking for Android apps. _{Tool · Android · Full entry}
• JustTrustMe - JustTrustMe is an Xposed module that disables SSL certificate checks in Android apps. _{Tool · Android · Full entry}

Native Binary

↑ Contents

Case studies

• CPQ IO Scheduler: reconstructing Xiaomi's block scheduler - CPQ IO Scheduler reconstructs Xiaomi's proprietary cpq.ko Linux block scheduler from a stripped ARM64 kernel module. _{Case study · Independent reconstruction · Full entry}
• m0rph: tracing an obfuscated ELF flag checker - The m0rph investigation examines an obfuscated x86-64 ELF CTF flag checker with readelf, strings, Cutter and Radare2. _{Case study · Full entry}
• Malware Analysis: njRAT and Casdet behavior investigation - A malware investigation examines njRAT and a UPX-packed Casdet executable with PEStudio static triage and ANY.RUN sandbox telemetry, alongside a malicious PDF and benign comparison files. _{Case study · Independent reconstruction · Full entry}
• Woxi: a Wolfram Language interpreter in Rust - The authors describe Woxi as a Rust interpreter for a subset of the Wolfram Language, focused on CLI scripting and Jupyter notebooks. _{Case study · Independent reconstruction · Full entry}
• OpenBSD netcat: static REA and Ghidra investigation - A REA/Ghidra report studies the Ubuntu netcat-openbsd 1.234-1 ELF binary and publishes evidence envelopes, decompiled functions and a function inventory. _{Case study · Mixed workflow · Full entry}
• Windows loader: static malware analysis with REA and Codex - Fedele Mantuano reports using Codex with REA in an offline Docker lab to statically analyze a public Windows malware sample without executing it. _{Case study · Mixed workflow · Full entry}
• Show Your Work: a measured dissection of REA's evidence architecture - An unofficial field study that reads REA's source and then drives the running server through 1,012 recorded calls across 27 artifact classes, measuring its content-addressed Evidence records, revision-chained unknown ledger, typed refusals, cold starts and response limits. _{Case study · Mixed workflow · Full entry}
• DownUnderCTF: masked-squares flag checker - An official educational challenge investigation connects binary checks to equations and records an original-program validation. _{Case study · Official REA · Full entry}

Tools, projects and integrations

• Ghidra - Open-source analysis suite for disassembly, decompilation, graphs and Java/Python automation across executable formats. _{Tool · Also: Game, Firmware · Full entry}
• radare2 - Scriptable command-line framework for inspecting, disassembling, debugging and modifying binaries across many architectures. _{Tool · Also: Game · Full entry}
• Cutter - Rizin-powered graphical reverse-engineering workspace with extensible views and Ghidra decompiler integration. _{Tool · Also: Game · Full entry}
• Qiling - Python emulation framework that adds OS, filesystem and API behavior around CPU emulation for instrumented binary analysis. _{Tool · Also: Firmware · Full entry}
• Unicorn Engine - Multi-architecture CPU emulator for executing selected instruction ranges with register, memory and hook control. _{Tool · Library · Also: Game, Firmware · Full entry}
• angr - Python binary-analysis framework combining control-flow recovery, symbolic execution, data-flow analysis and decompilation. _{Tool · Library · Full entry}
• LIEF - Library for structured parsing and modification of executable formats including ELF, PE and Mach-O. _{Tool · Library · Full entry}
• Capstone - Disassembly library with architecture-neutral APIs and instruction details for custom binary-analysis pipelines. _{Tool · Library · Full entry}
• ImHex - Hex editor with a binary-pattern language, structured data inspection and visual tools for understanding file formats. _{Tool · Also: Game, Firmware · Full entry}
• x64dbg - Windows binary debugger with disassembly, memory views and plugins for analyzing programs without source code. _{Tool · Full entry}
• GDB - Native and remote debugger for controlling execution and inspecting live or crashed program state. _{Tool · Full entry}
• rr - Records process execution and replays it under GDB, enabling repeatable inspection and reverse execution. _{Tool · Full entry}
• Diaphora - IDA-based binary diffing that matches functions and transfers names, comments and types between analyzed versions. _{Tool · Also: Game · Full entry}
• BinDiff - Compares disassembled binaries to find matching functions and changed code across versions. _{Tool · Also: Game · Full entry}
• Detect It Easy - Format-aware file identification and static inspection using parsers, signatures and programmable heuristics. _{Tool · Also: Game · Full entry}
• r2frida - Use radare2 commands and Frida instrumentation together to inspect local or remote process memory, symbols, classes, and runtime calls on desktop and mobile targets. _{Tool · Also: App · Full entry}
• Kaitai Struct - Turn documented binary layouts into reusable parsers for files and network packets. _{Tool · Library · Also: Firmware, Protocol · Full entry}
• GoReSym - Recover Go build metadata, function names and address ranges, source file and line tables, embedded types and strings from Go binaries, including stripped and some malformed unpacked samples. _{Tool · Full entry}
• rev.ng - Open-source decompilation pipeline that lifts x86-64, AArch64, i386, ARM and MIPS code with QEMU, runs LLVM-based analyses and emits C designed to be valid and recompilable. _{Tool · Full entry}
• Rizin - Command-line reverse-engineering framework that began as a fork of radare2. _{Tool · Also: Game · Full entry}
• Decompiler Explorer - Web service at dogbolt.org that runs one small uploaded executable through many decompilers and shows their C-like output side by side, described as Compiler Explorer in reverse. _{Tool · Full entry}
• pwndbg - Python plug-in that loads into GDB, or runs as a REPL around LLDB, to make live program state easier to inspect. _{Tool · Full entry}
• DynamoRIO - Runtime code manipulation system for building dynamic tools that observe or transform any part of an unmodified program while it runs. _{Tool · Full entry}
• Decompyle++ (pycdc) - C++ disassembler and decompiler for compiled Python bytecode that aims to support bytecode from any Python version. _{Tool · Also: App · Full entry}
• cwe_checker - Static analyzer from Fraunhofer FKIE that searches binary executables, mainly Linux and Unix ELF files, for code paths matching Common Weakness Enumeration bug classes such as buffer overflows, use-after-free and double free, NULL pointer dereferences, format strings and integer overflows. _{Tool · Also: Firmware · Full entry}
• FLARE-VM - Mandiant FLARE installer that sets up and maintains a Windows virtual machine for reverse engineering and malware analysis. _{Tool · Full entry}
• B2R2 - Binary analysis framework written in F# for .NET by KAIST's SoftSec Lab. _{Tool · Library · Full entry}
• rz-ghidra - Rizin plugin that embeds Ghidra's C++ decompiler and Sleigh disassembler, so no Java Ghidra installation is needed. _{Tool · Full entry}
• dewolf - Research decompiler from Fraunhofer FKIE, developed with Singapore's DSO National Laboratories between 2019 and 2021, that runs as a Binary Ninja plugin and starts from Binary Ninja's Medium Level IL. _{Tool · Full entry}
• decomp2dbg - Decompiler-to-debugger bridge that serves function names, global variables, stack and register variable names and decompiled code from IDA Pro, Binary Ninja, Ghidra or angr-management to GDB over an XML-RPC connection. _{Tool · Full entry}
• E9Patch - Static binary rewriter for x86-64 Linux ELF executables and shared objects that inserts instrumentation without control-flow recovery and writes a drop-in replacement binary, following the PLDI 2020 paper Binary Rewriting without Control Flow Recovery. _{Tool · Full entry}
• Rellic - Trail of Bits implementation of the pattern-independent structuring algorithm from the No More Gotos paper, turning LLVM bitcode into goto-free C as a small, hackable decompiler back end that interoperates with LLVM and Remill. _{Tool · Library · Full entry}
• ghidra-delinker-extension - Ghidra extension that delinks a selected part of a program back into a relocatable object file. _{Tool · Also: Game · Full entry}
• BinExport - The exporter component of BinDiff: plugins for IDA Pro and Binary Ninja and an extension for Ghidra that write an analyzed disassembly to the Protocol Buffer format BinDiff requires. _{Tool · Full entry}
• Karta - Source-code-assisted IDA Python plugin from Check Point Research that finds and matches open-source libraries compiled into large binaries and firmware. _{Tool · Also: Firmware · Full entry}
• VTIL-Core - C++20 core of the VTIL (Virtual-machine Translation Intermediate Language) project, an intermediate language and optimizing compiler that the README describes as built for binary de-obfuscation and de-virtualization. _{Tool · Library · Full entry}
• Frida Workbench for VSCode - Unofficial Visual Studio Code extension for Frida work. _{Tool · Also: App · Full entry}
• ghidriff - Command-line binary diffing engine that drives Ghidra headlessly through pyghidra: it imports and analyzes an old and a new binary, then reports added, deleted and modified functions, with patch diffing as its main use. _{Tool · Also: Firmware · Full entry}
• Ddisasm - GrammaTech's Datalog disassembler, which turns ELF and PE binaries for x86-32, x86-64, ARM32, ARM64 and MIPS32 into the GTIRB intermediate representation. _{Tool · Full entry}
• PINCE - Linux front end for the GNU Debugger (GDB), focused on games but usable for other reverse engineering; the name stands for “PINCE is not Cheat Engine”. _{Tool · Also: Game · Full entry}
• uncompyle6 - Cross-version decompiler that translates Python bytecode back into equivalent Python source, accepting bytecode from Python 1.0 through 3.8 as well as some PyPy bytecode and Dropbox's Python 2.5. _{Tool · Also: App · Full entry}
• ret-sync - Reverse-Engineering Tools SYNChronization: plugins that keep IDA, Ghidra or Binary Ninja graph and decompiler views following a live WinDbg, GDB, LLDB, OllyDbg 1.10/2 or x64dbg session, rebasing addresses on the fly so ASLR does not break the mapping. _{Tool · Full entry}
• PyInstaller Extractor (pyinstxtractor) - Single-file Python script that extracts the contents of executables built with PyInstaller, including Linux ELF builds without other tools. _{Tool · Also: App · Full entry}
• Binary Analysis Platform (BAP) - OCaml binary analysis platform from Carnegie Mellon University. _{Tool · Library · Full entry}
• Reko - General-purpose decompiler that loads executables or raw images, scans their machine code into a machine-independent register transfer language, groups it into procedures and decompiles them into high-level C code. _{Tool · Also: Firmware · Full entry}
• Dyninst - Binary instrumentation, analysis and modification libraries from the Paradyn project. _{Tool · Full entry}
• goblin - Rust crate for zero-copy, endian-aware parsing of ELF32/64, 32/64-bit Mach-O and multi-architecture fat containers, PE32/PE32+, COFF objects, Terse Executable (TE) images and Unix/BSD archives; Object::parse picks the format from its magic bytes. _{Tool · Library · Full entry}
• FLOSS (FLARE Obfuscated String Solver) - Mandiant FLARE string extractor for malware analysis that is used like strings.exe but also recovers obfuscated strings. _{Tool · Full entry}
• Zydis - Lightweight C11 x86/x86-64 disassembler and code-generation library. _{Tool · Library · Full entry}
• QBDI - Quarkslab's modular dynamic binary instrumentation (DBI) framework, which JIT-recompiles a program's basic blocks inside its own process so that an instrumentation tool can register callbacks before or after instructions, on memory reads and writes, and on VM events. _{Tool · Also: App · Full entry}
• binsider - Terminal user interface for inspecting ELF binaries. _{Tool · Full entry}
• iced - x86 instruction library for 16-, 32- and 64-bit code that decodes, formats, assembles and encodes instructions, with masm, nasm, GNU AT&T and Intel XED output syntaxes. _{Tool · Library · Full entry}
• hrtng - IDA plugin published by Kaspersky that extends the Hex-Rays decompiler with tools its author collected for reverse-engineering work, including malware analysis. _{Tool · Full entry}
• BinCAT - Static binary code analysis toolkit designed for reverse engineers. _{Tool · Full entry}
• GEF (GDB Enhanced Features) - Single-file Python extension, gef.py, that adds dynamic-analysis commands to GDB. _{Tool · Full entry}
• Triton - C++ library with Python bindings for dynamic binary analysis of x86, x86-64, ARM32, AArch64 and RISC-V 32/64 code. _{Tool · Library · Full entry}
• PyLingual - Research decompiler for CPython bytecode from Python 3.6 onward that pairs per-version transformer models with control-flow reconstruction. _{Tool · Also: App · Full entry}
• Miasm - Python reverse-engineering framework for analyzing, modifying and generating binary programs. _{Tool · Library · Full entry}
• HyperDbg - Hypervisor-assisted Windows debugger that virtualizes the running system with Intel VT-x and Extended Page Tables to debug kernel and user mode, either locally as a tracing and introspection tool or from a host attached over a serial connection to a guest virtual machine. _{Tool · Full entry}
• Kuna - Agent-first decompiler written in Rust that began as a port of Ghidra’s C++ decompiler and SLEIGH compiler, and has since diverged with option-gated features, some ported from angr. _{Tool · Full entry}
• Binary Ninja API - Vector 35’s public C++, Python and Rust APIs for Binary Ninja, with their documentation, examples and the open-source plugins built on them. _{Tool · Also: Firmware · Full entry}
• capa - Mandiant FLARE tool that reports what an executable can do by matching a YAML rule set against features extracted from PE, ELF and .NET files or 32/64-bit shellcode, such as API calls, imports, strings and constants. _{Tool · Full entry}
• RetDec - Avast's retargetable machine-code decompiler built on LLVM. _{Tool · Full entry}
• REDasm - Cross-platform interactive disassembler whose version 4 is a plain-C rewrite: a C17 engine library, the Qt6 GUI kept in this repository, and loader, processor and analyzer plugins loaded as shared libraries. _{Tool · Also: Game · Full entry}
• Lighthouse - Code-coverage explorer plugin for IDA Pro and Binary Ninja that loads execution traces of native programs and paints the executed code across the disassembler's views, without needing symbols or source. _{Tool · Full entry}
• BinAbsInspector - Static vulnerability scanner from Tencent Keen Lab that runs as a Ghidra extension or headless script and applies abstract interpretation to Ghidra's P-code rather than to assembly, covering x86, x64, ARMv7 and AArch64 binaries. _{Tool · Full entry}
• VulHunt Community Edition - Open-source Community Edition of Binarly REsearch's VulHunt engine for hunting vulnerabilities in POSIX binaries and UEFI firmware on x86 and ARM. _{Tool · Also: Firmware · Full entry}
• BinSync - Decompiler plugin for collaborative reverse engineering that records each analyst's work in a shared Git repository, one branch per user, so teammates can pull, push or auto-push changes across IDA Pro, Binary Ninja, Ghidra and angr-management. _{Tool · Full entry}
• class-dump - Command-line utility that reads the Objective-C runtime metadata in Mach-O executables, frameworks and bundles and prints it as ordinary Objective-C declarations for the classes, categories and protocols it finds, the same information otool -ov shows in a more compact form. _{Tool · Also: App · Full entry}
• Lucid - IDA Pro plugin by Markus Gaasedelen for studying how the Hex-Rays decompiler transforms its microcode intermediate language. _{Tool · Full entry}
• r2dec - Decompiler plugin for radare2 that turns the disassembly of an analyzed function into pseudo-C through the pdd command. _{Tool · Full entry}
• Runtime Mobile Security (RMS) - Frida-based web interface for observing Android and iOS apps at run time on a test device. _{Tool · Also: App · Full entry}
• Pharos - Carnegie Mellon SEI's framework of automated static analysis tools for binary programs, built on LLNL's ROSE compiler infrastructure for disassembly, control-flow analysis and instruction semantics. _{Tool · Full entry}
• heimdall-rs - Rust toolkit by Jonathan Becker for analyzing EVM smart-contract bytecode, particularly of contracts without verified source. _{Tool · Full entry}
• PE-bear - Qt GUI to view and edit Windows Portable Executable files, meant as a fast first look for malware analysts and robust against malformed PE32 and PE64 files. _{Tool · Full entry}
• PE-sieve - Windows process scanner by hasherezade that finds and dumps implants in one running process: replaced or injected PE modules, shellcode, inline and IAT hooks and other in-memory patches, with the README naming Process Hollowing, Process Doppelgänging and reflective DLL injection among the techniques it detects. _{Tool · Full entry}
• oletools - Python package by Philippe Lagadec for analyzing Microsoft OLE2 (Compound File Binary) files such as Office 97–2003 documents, MSI files and Outlook messages, as well as RTF and OpenXML documents, mainly for malware analysis, forensics and debugging. _{Tool · Full entry}
• MonkeyDev - Based on iOSOpenDev, MonkeyDev adds a MonkeyApp project template to Xcode for instrumenting iOS apps the developer is authorized to analyze. _{Tool · Also: App · Full entry}
• Hollows Hunter - Windows command-line memory scanner by hasherezade that runs the PE-sieve engine across many processes, or the whole system, instead of a single PID. _{Tool · Full entry}
• restore-symbol - macOS command-line tool that writes a stripped iOS app's Mach-O executable back out with a rebuilt symbol table, so a debugger such as lldb can break on and display Objective-C method names. _{Tool · Also: App · Full entry}
• FakeNet-NG - Mandiant FLARE's dynamic network analysis tool for malware analysts, a successor to the original Fakenet. _{Tool · Also: Protocol · Full entry}
• Joern - Static code analysis platform that parses source code, JVM bytecode and executables into code property graphs held in a graph database and queried with a Scala-based language from an interactive shell or server mode. _{Tool · Also: App · Full entry}
• Speakeasy - Mandiant's Windows malware emulation framework, which runs PE executables, DLLs, kernel drivers and raw x86/amd64 shellcode on the Unicorn CPU emulator inside a modeled Windows runtime instead of a full VM. _{Tool · Full entry}
• LazyIDA - Single-file IDA plugin of convenience actions first written for CTF work. _{Tool · Full entry}
• Tiny Tracer - Intel Pin tool by hasherezade that traces a 32- or 64-bit program while it runs on Windows or Linux, logging API calls (with arguments and return values for watched functions), chosen local and statically linked functions, inline system calls, RDTSC, CPUID and INT instructions, and transitions between sections of the traced module, which helps find the original entry point of a packed module. _{Tool · Full entry}
• Ponce - IDA Pro plugin, described by its repository as the winner of the 2016 IDA plugin contest, that brings the Triton framework's taint analysis and symbolic execution into IDA's debugger for x86 and x64 programs. _{Tool · Full entry}
• DRAKVUF Sandbox - CERT Polska’s automated black-box malware analysis system built on the DRAKVUF engine, which observes a Windows guest from the Xen hypervisor through virtual machine introspection rather than an agent installed in the guest. _{Tool · Full entry}
• HexRaysPyTools - IDAPython plugin for IDA Pro's Hex-Rays decompiler that helps rebuild structures and classes from pseudocode. _{Tool · Full entry}
• CAPE Sandbox (CAPEv2) - Malware sandbox derived from Cuckoo v1 that runs samples in isolated Windows guests and records API-hook behavior, created and modified files, network traffic as PCAP, screenshots and memory dumps. _{Tool · Full entry}
• LuaDec - Lua bytecode decompiler that turns compiled chunks back into Lua source, with a disassembly mode, selection of single nested functions by number and a guesser for local variable declarations that can be overridden by hand. _{Tool · Also: Game · Full entry}
• xpcspy - Frida-powered command-line tool that observes XPC messages exchanged between processes on iOS and macOS in both directions, for understanding how Apple-platform apps and services talk over XPC. _{Tool · Also: App, Protocol · Full entry}
• de4py - Python deobfuscation and analysis toolkit with a PySide6 GUI and a CLI mode, aimed at analysts examining obfuscated or packed Python programs. _{Tool · Also: App · Full entry}
• Dwarf - PyQt5 debugger built on Frida that attaches to or spawns processes on Android and iOS devices, the local machine or a remote Frida server. _{Tool · Also: App · Full entry}
• bddisasm - Bitdefender’s dependency-free C decoder for x86/x64 instructions, reporting explicit and implicit operands with their access modes, CPUID feature flags, flag accesses and valid modes, and printing Intel/MASM-style text. _{Tool · Library · Full entry}
• decompyle3 - Reworking of uncompyle6 by the same author that translates Python 3.7 and 3.8 bytecode, including some PyPy 3.7 and 3.8 bytecode, back into equivalent Python source; older bytecode stays with uncompyle6. _{Tool · Also: App · Full entry}
• DRAKVUF - Tamas K Lengyel's virtualization-based, agentless black-box binary analysis system: running on the Xen hypervisor through LibVMI, it traces execution in Windows and Linux guests, from kernel functions to user-mode code, without installing software inside the analyzed virtual machine. _{Tool · Full entry}
• ViperMonkey - VBA parser and emulation engine, created by Philippe Lagadec and developed since 2017 mainly by Kirk Sayre and other contributors, for analyzing and deobfuscating malicious macros in Microsoft Office files such as Word, Excel, PowerPoint and Publisher documents, as well as VBScript files and HTA files carrying VBScript. _{Tool · Full entry}
• BREAD - Injectable real-mode x86 debugger for legacy BIOS code, boot code and DOS programs on real hardware or in a virtual machine. _{Tool · Also: Firmware · Full entry}
• Mergen - Function-level lifter that symbolically lifts one x86-64 function from a Windows PE binary into LLVM IR, then iterates LLVM and custom passes to a fixpoint so obfuscated or virtualized code reduces to simpler control flow and semantics for analysis. _{Tool · Full entry}
• readpe (formerly pev) - Command-line toolkit, formerly named pev, for analyzing 32- and 64-bit Windows PE files. _{Tool · Full entry}
• malware-jail - Node.js sandbox for semi-automatic analysis of JavaScript malware: it runs a sample in Node's vm module against emulated Windows Script Host and ActiveX objects such as WScript.Shell, MSXML2.XMLHTTP, ADODB.Stream, Scripting.FileSystemObject and WMI, plus a partial browser context with selectable browser profiles. _{Tool · Also: Website · Full entry}
• gxpc - macOS command-line XPC sniffer, inspired by xpcspy, that injects a Frida agent into an attached or newly spawned process and logs the XPC messages it sends and receives, labelled with the libxpc function, connection name, peer PID and process name. _{Tool · Also: App, Protocol · Full entry}
• Manticore - Trail of Bits' now-archived symbolic execution tool for Linux ELF binaries on x86, x86-64, AArch64 and ARMv7, Ethereum smart contracts as EVM bytecode, and WebAssembly modules. _{Tool · Library · Full entry}
• Ghidra Ninja ghidra_scripts - Thomas Roth's (Ghidra Ninja) collection of Ghidra Python scripts, which appear under a Ghidra Ninja category in the Script Manager. _{Tool · Full entry}
• FindCrypt - Ghidra Edition - Ghidra script that ports Ilfak Guilfanov's FindCrypt plugin for IDA, searching a program's memory or the current selection for constants of cryptographic and compression algorithms. _{Tool · Full entry}
• Binary Refinery - Large collection of composable Python command-line units for transforming binary data: encodings, compression, encryption, archive and executable-format extraction, carving and pattern search. _{Tool · Full entry}
• AngryGhidra - Ghidra extension that runs angr symbolic execution from a CodeBrowser panel. _{Tool · Full entry}
• fpicker - Frida-based fuzzing suite for closed-source programs, listed here for its in-process instrumentation and coverage layer. _{Tool · Also: App · Full entry}
• RetroWrite - HexHive's static binary rewriter for x64 and aarch64 Linux ELF binaries, which turns a binary into symbolized, reassemblable assembly so instrumentation can be inserted without source code and without heuristics. _{Tool · Full entry}
• Interruptor - Frida library, taken from the Dexcalibur project, that uses Frida’s Stalker to trace a process’s system calls and print strace-like lines with the calling thread, module and offset, decoded flag values and file paths resolved from descriptors. _{Tool · Also: App · Full entry}
• dyld_cache_extract - macOS application and command-line tool that reads a dyld_shared_cache file from macOS or iOS, shows its header, mappings and image list, and copies one library or every library out to a directory. _{Tool · Also: App · Full entry}
• FLARE IDA Pro utilities - Archived collection of IDAPython plugins and scripts from Mandiant's FLARE team for malware and native-code analysis in IDA Pro. _{Tool · Full entry}
• Binlex - Binary trait-lexer framework that extracts instructions, basic blocks and functions from executables and emits searchable JSON traits for similarity, hunting and signature work. _{Tool · Library · Full entry}
• Driver Buddy Reloaded - IDA Pro Python plugin for triaging Windows kernel drivers, building on NCC Group's original DriverBuddy. _{Tool · Full entry}
• FA (Firmware Analysis) - Python framework, mainly used as an IDA plugin, that turns the manual steps of locating symbols, such as finding a string, following its cross-reference and taking the function start, into reusable signatures. _{Tool · Also: Firmware · Full entry}
• pyinstxtractor-ng (PyInstaller Extractor Next Generation) - Fork of PyInstaller Extractor (pyinstxtractor) by the same author that extracts the bundled CArchive files and PYZ modules from Linux ELF and Windows PE executables built with PyInstaller, writing .pyc files with repaired headers for a separate bytecode decompiler. _{Tool · Also: App · Full entry}
• CoBRA (Coefficient-Based Reconstruction of Arithmetic) - Trail of Bits' C++23 simplifier for Mixed Boolean-Arithmetic (MBA) expressions, an obfuscation technique that rewrites simple computations as interleaved arithmetic, bitwise and shift operations. _{Tool · Library · Full entry}
• ollvm-unflattener - Python command-line deobfuscator for the control-flow flattening applied by Obfuscator-LLVM (OLLVM). _{Tool · Full entry}
• GolangAnalyzerExtension - Ghidra extension whose Golang Analyzer reads the runtime header and module data in Go binaries built with go1.6 through go1.27 to identify the Go version, rename functions, correct their arguments, comment source files and line numbers, add Go types to the Data Type Manager and label Go strings. _{Tool · Full entry}
• IDA iOS Helper - IDA Pro plugin that cleans up Hex-Rays pseudocode and adds navigation helpers for iOS user-mode binaries and the kernelcache, enabling its components according to the loaded file. _{Tool · Also: App · Full entry}
• MAMBO - Dynamic binary modification framework from the University of Manchester that runs unmodified Linux user-space programs on 32-bit Arm (A32/T32), AArch64 and RV64GC RISC-V, translating their code into a code cache as it executes. _{Tool · Full entry}
• Class Informer - IDA Pro plugin that scans Microsoft Visual C++ binaries for virtual function tables (vftables) through their C++ run-time type information (RTTI), names, labels and comments the vftables it finds, defines the RTTI data structures and identifies single, multiple and virtual inheritance in each class hierarchy. _{Tool · Full entry}
• Kam1n0 - Server platform from McGill University's Data Mining and Security Lab that indexes collections of disassembled binaries into shared repositories and searches them for cloned assembly functions. _{Tool · Full entry}
• iblessing - Toolkit for analyzing iOS apps and arm64 Mach-O binaries, built on Capstone, Unicorn and Keystone. _{Tool · Also: App · Full entry}
• SiMBA - Research tool from Denuvo that simplifies linear mixed Boolean-arithmetic (MBA) expressions, which combine bitwise and integer operations and are used in code obfuscation. _{Tool · Full entry}
• GTIRB - GrammaTech's intermediate representation for passing disassembly, analysis and rewriting results between binary tools, modeled on the role LLVM-IR plays for compilers. _{Tool · Library · Full entry}
• Quokka - Quarkslab’s binary exporter, inspired by BinExport, saves a disassembler’s analysis to a protobuf .quokka file so functions, basic blocks, data, cross-references, segments and optionally decompiled code can be used later without the disassembler. _{Tool · Full entry}
• knife - Static reverse-engineering toolkit in Rust, installed as the knife command, that parses PE, ELF, Mach-O and WebAssembly files without running them. _{Tool · Full entry}
• BARF - Python binary analysis framework that loads ELF and PE programs, disassembles 32- and 64-bit x86 and 32-bit ARM code with Capstone and translates it into the REIL intermediate language, so its analyses do not depend on the source architecture. _{Tool · Library · Full entry}
• rabbitizer - MIPS instruction decoder written in C that never allocates on the heap, with Python, C++ and Rust bindings in the same repository and the stated aim of producing matching assembly. _{Tool · Library · Also: Game · Full entry}
• ghidrecomp - Python command-line decompiler that drives Ghidra through pyghidra to decompile every function of a binary into separate C files, or into one C file and header with Ghidra's C++ exporter, keeping the Ghidra project so later runs can reuse the analysis. _{Tool · Full entry}
• Vivisect - Pure-Python reverse-engineering framework that combines the vivisect static analyzer, the vtrace debugging library and the vdb debugger. _{Tool · Also: Firmware · Full entry}
• r2pipe - radare2's official scripting interface, with implementations for more than two dozen languages in one repository. _{Tool · Full entry}
• GREASE - Galois's command-line tool, Ghidra plug-in and Haskell library for checking properties of binaries with under-constrained symbolic execution. _{Tool · Full entry}
• PLASMA - Interactive terminal disassembler, formerly named Reverse, for x86 and x86-64 with partial ARM and MIPS/MIPS64 support, reading ELF, PE and raw binaries. _{Tool · Full entry}
• mobdevim - Derek Selander's macOS command-line utility for inspecting and controlling iOS devices connected over USB or Wi-Fi through Apple's private MobileDevice framework. _{Tool · Also: App · Full entry}
• XPEViewer - Qt-based PE file viewer and editor for Windows, Linux and macOS by horsicq, the author of the catalog's Detect It Easy. _{Tool · Full entry}
• Fermion - Ruben Boonen's Electron desktop application that wraps frida-node and the Monaco editor into one window for writing, injecting and refining Frida scripts. _{Tool · Also: App · Full entry}
• Ghidrathon - Mandiant FLARE's Ghidra extension that embeds the user's local CPython 3 interpreter in Ghidra through Jep, as an alternative to Ghidra's Jython-based Python 2.7 scripting. _{Tool · Full entry}
• diStorm3 - Lightweight x86/AMD64 disassembler library in C that the README describes as a decomposer: besides formatted text, distorm_decompose returns a binary structure per instruction with its opcode, operands, prefixes, flow-control class and optionally affected CPU flags. _{Tool · Library · Full entry}
• ProbeDroid - Dynamic Java-method instrumentation kit for Android 5.0 that lets analysts write their own tracing and profiling tools for apps whose source code they do not have. _{Tool · Also: App · Full entry}
• Fridump - Small Python command-line tool that attaches to a running process through Frida and writes its accessible memory ranges to files, run from a Windows, Linux or macOS host against iOS, Android or Windows applications. _{Tool · Also: App · Full entry}
• Redress - Command-line tool, built on the GoRE library, that recovers metadata from stripped binaries produced by the Go compiler. _{Tool · Full entry}
• ghidra-nanomips - Ghidra processor module that adds nanoMIPS disassembly and decompilation through a SLEIGH specification of the little-endian 32-bit nanoMIPS instruction set, including its multithreading instructions. _{Tool · Also: Firmware · Full entry}
• SMDA - Python recursive disassembler library built on Capstone that recovers control-flow graphs from PE, ELF and Mach-O files, .NET assemblies, raw DEX files and memory dumps with a known base address, through x86/x64, AArch64, 32-bit ARM/Thumb, CIL and Dalvik backends. _{Tool · Library · Full entry}
• frida-trace (NowSecure library) - JavaScript library for Frida agents that traces native functions from a declarative description: each function is listed with its return type and input and output arguments, including pointers, UTF-8 and UTF-16 strings and byte arrays whose length is bound to another argument or the return value, with conditions such as reading an output pointer only when the call succeeds. _{Tool · Also: App · Full entry}
• BTD (Bin To DNN) - Research artifact for the USENIX Security 2023 paper “Decompiling x86 Deep Neural Network Executables”. _{Tool · Full entry}
• Boomerang Decompiler - Fork of the SourceForge Boomerang project, a general machine-code decompiler that translates executables into C. _{Tool · Full entry}
• ktool - Pure-Python toolkit for static Mach-O and Objective-C analysis, used as the ktool command line, a terminal browser (ktool open) or a library, with no compiled dependencies. _{Tool · Also: App · Full entry}
• Brida - Burp Suite extension by Federico Dotta and Piergiovanni Cipolloni that bridges Burp and Frida, so an analyst can run an app's own functions on the HTTP messages it exchanges with its backend instead of reimplementing its encryption, encoding or signing. _{Tool · Also: App, Protocol · Full entry}
• Qu1cksc0pe - All-in-one malware triage tool that statically analyses Windows PE, Linux ELF (including Go binaries), macOS Mach-O and Android APK, JAR and DEX files as well as Office and PDF documents, scripts, shortcuts, archives, e-mails and PCAPs, reporting imports and API categories, sections, strings and IOCs, packers, embedded executables, Android permission risk, YARA matches and, for Windows and Linux, MITRE ATT&CK mappings. _{Tool · Also: App · Full entry}
• AppMon - Frida-based framework by Nishant Das Patnaik, shown at Black Hat Arsenal 2016, for watching the system API calls that native macOS, iOS and Android apps make. _{Tool · Also: App · Full entry}
• Yagi - Airbus CERT plugin that embeds Ghidra's native decompiler in IDA Pro and IDA Free: pressing F3 on a function shows Ghidra's C output inside IDA, and edits made there, covering global symbols such as function prototypes and the names and types of stack and register variables, are saved to the IDA database. _{Tool · Full entry}
• frida-scripts (0xdea) - Marco Ivaldi's (raptor) collection of Frida JavaScript instrumentation scripts for reverse engineering mobile apps and Linux programs. _{Tool · Also: App · Full entry}
• System Informer - Windows process viewer and system inspector, formerly Process Hacker, for examining running programs and the system around them. _{Tool · Full entry}
• CyberChef - GCHQ's browser-based workbench for decoding, decrypting, decompressing, parsing and carving data by chaining operations into a recipe, with all processing done client-side. _{Tool · Also: Protocol · Full entry}
• YARA - VirusTotal's pattern-matching tool for identifying and classifying files such as malware samples with rules that combine text, hex and regular-expression strings with a Boolean condition. _{Tool · Full entry}
• Cheat Engine - Memory scanner, debugger, disassembler and assembler for inspecting and changing running games and other applications; its README calls it a development environment focused on modding games and applications for personal use. _{Tool · Also: Game · Full entry}
• Noriben - Python script that drives Sysinternals Process Monitor to record what a program does while it runs, filters out routine system activity and writes a text report of the processes it created and its file, registry and network activity. _{Tool · Full entry}
• QEMU - Machine and user-space emulator that runs code built for one CPU architecture on another through its TCG dynamic translator. _{Tool · Also: Firmware · Full entry}
• Hex Fiend - Open-source macOS hex editor that inspects and edits binary files of any size without loading them into memory. _{Tool · Full entry}
• ScyllaHide - User-mode (ring 3) anti-anti-debug library for 32- and 64-bit Windows programs that hooks system functions so the program being debugged cannot detect the debugger. _{Tool · Full entry}
• YARA-X - VirusTotal's Rust rewrite of YARA for identifying and classifying files with pattern-matching rules. _{Tool · Full entry}
• ReClass.NET - Memory structure editor for reconstructing the classes and data structures of a running x86 or x64 process, a .NET port of ReClass with many additions. _{Tool · Also: Game · Full entry}
• Keypatch - IDA Pro plugin built on the Keystone assembler engine that patches a binary from typed assembly, fills an address range with instructions or raw bytes and searches the loaded binary for assembly instructions. _{Tool · Full entry}
• edb-debugger - Qt-based graphical debugger for AArch32, x86 and x86-64 programs, inspired by OllyDbg, with Linux as its only officially supported platform. _{Tool · Full entry}
• BinNavi - Google's open-sourced binary analysis IDE for inspecting, navigating, editing and annotating the control-flow graphs and call graphs of disassembled code. _{Tool · Full entry}
• flare-emu - Mandiant FLARE Python library that pairs IDA Pro, Rizin or Radare2 with the Unicorn emulator so analysts can script emulation of the binary they are analyzing, for 32- and 64-bit x86, ARM and ARM64. _{Tool · Library · Full entry}
• IDA Pro - Hex-Rays' commercial interactive disassembler, decompiler and debugger, which turns compiled code for more than 70 processor families into annotated, cross-referenced assembly and decompiled pseudocode. _{Tool · Also: Game, App, Firmware · Full entry}
• Binary Ninja - Vector 35's commercial interactive disassembler, decompiler and debugger, whose decompiler is built on the BNIL family of intermediate languages and shows either C or BNIL for every officially supported architecture. _{Tool · Also: Firmware · Full entry}
• Hopper Disassembler - Cryptic Apps' commercial disassembler, decompiler and debugger for macOS and Linux, which reads Mach-O (macOS and iOS), PE and ELF executables built for 32- and 64-bit Intel, ARMv6, ARMv7, ARM64 and PowerPC processors. _{Tool · Also: App · Full entry}
• WinDbg - Microsoft's WinDbg debugger and the Debugging Tools for Windows, documented on Microsoft Learn, for debugging live user-mode and kernel-mode code, analyzing crash dumps and examining CPU registers and memory. _{Tool · Full entry}
• 010 Editor - SweetScape Software's commercial hex and text editor whose Binary Templates, C/C++-like struct definitions with control flow and functions, parse binary files into hierarchical, editable structures. _{Tool · Full entry}
• pestudio - Winitor's Windows tool for initial malware assessment, which statically inspects Windows executable files and reports key indicators such as hard-coded URLs and IP addresses, flagged imports, resources and overlay data. _{Tool · Full entry}
• OllyDbg - 32-bit assembler-level analyzing debugger for Windows that emphasizes binary code analysis for programs without source; its site says development is frozen, and the newest version it lists is 2.01 of 27 September 2013. _{Tool · Full entry}
• Tenet - IDA Pro plugin for exploring execution traces of a binary: it loads an externally recorded trace and lets the analyst step forwards and backwards through time while the disassembly shows the execution flow in both directions. _{Tool · Full entry}
• findcrypt-yara - IDA Pro plugin that scans the loaded database with YARA rules for cryptographic constants and similar signatures, lists the matches in a results window and names each matching address after its rule. _{Tool · Full entry}
• deREferencing - IDA Pro plugin that adds register and stack views to the debugger in which pointers are dereferenced and colored, similar to the context displays of GDB plugins such as PEDA, GEF and pwndbg. _{Tool · Full entry}
• HexRays Toolbox - IDAPython scripts that find code patterns in Hex-Rays decompiler output, independent of the binary's processor architecture, by running user-written lambda queries over the decompiled ctree. _{Tool · Full entry}
• Virtuailor - IDAPython tool that reconstructs C++ virtual tables in IDA Pro for 32- and 64-bit Intel and AArch64 code by observing indirect calls while the program runs under IDA's debugger. _{Tool · Also: Firmware · Full entry}
• xAnalyzer - x64dbg plugin that annotates the static code of the debugged x86 or x64 executable with function-call, argument and loop analysis. _{Tool · Full entry}
• Voltron - Extensible Python debugger UI toolkit that attaches utility views to LLDB, GDB, VDB and WinDbg/CDB sessions. _{Tool · Full entry}
• Remill - Static binary translation library that lifts AArch64, SPARC32, SPARC64, x86 and amd64 machine code, including AVX and AVX512, into LLVM bitcode, with AArch32 support underway. _{Tool · Library · Full entry}
• iaito - Official Qt-based graphical interface for the radare2 reverse-engineering framework, aiming for parity with radare2's commands, features and keybindings so that existing r2 plugins and scripts keep working. _{Tool · Full entry}
• HexRaysCodeXplorer - Hex-Rays decompiler plugin for navigating and reconstructing C++ code in IDA's pseudocode window. _{Tool · Full entry}
• GDB dashboard - Standalone .gdbinit file written with GDB's Python API that shows a modular status interface each time the debugged program stops, reducing the commands needed to inspect its state. _{Tool · Full entry}
• REHex - Cross-platform hex editor for reverse engineering that handles files over 1 TB. _{Tool · Full entry}
• Dobby - Lightweight, modular hook framework for Windows, macOS, iOS, Android and Linux on x86, x86-64, ARM and ARM64. _{Tool · Full entry}
• XLMMacroDeobfuscator - Command-line tool and Python library that extracts and decodes obfuscated Excel 4.0 (XLM) macros from xls, xlsm and xlsb files. _{Tool · Full entry}
• PE Tree - Python module that shows Portable Executable files in a tree view using pefile and PyQt5, as a standalone application and as a plugin for IDA Pro, Ghidra, Volatility, Rekall and minidump. _{Tool · Full entry}
• RpcView - Open-source Windows tool that explores and decompiles the RPC functionality present on a Microsoft system. _{Tool · Full entry}
• amoco - Python package for symbolic analysis of binaries. _{Tool · Library · Full entry}
• Chisel - Collection of LLDB commands for debugging iOS apps. _{Tool · Also: App · Full entry}
• gdbgui - Browser-based frontend to the GNU debugger, gdb. _{Tool · Full entry}
• Porosity - Decompiler that turns Ethereum Virtual Machine bytecode into readable Solidity-syntax contracts, supported on Linux and macOS. _{Tool · Full entry}
• Xori - Automation-ready disassembly and static analysis library for shellcode and PE binaries that outputs disassembly, functions and imports as JSON. _{Tool · Full entry}
• binglide - Visual reverse-engineering tool that gives a quick overview of the data types present in a file. _{Tool · Full entry}
• ERESI - Reverse Engineering Software Interface built around ELFsh, an interactive and scriptable shell for reading and modifying ELF objects, and e2dbg, an embedded ELF debugger. _{Tool · Full entry}
• pixd - Terminal tool that visualises binary data like a hexdump, but draws each octet as a coloured square from a palette. _{Tool · Full entry}
• Universal Extractor 2 - Unofficial, extended continuation of Universal Extractor that unpacks files from standard archives, application installers, disk images and game archives. _{Tool · Also: Game · Full entry}
• ElleKit - Function hooking toolkit for arm64 XNU devices: a C function hooker that patches memory pages directly, an Objective-C function hooker, an arm64 assembler, JIT inline assembly for Swift and a reimplementation of the Substrate and libhooker APIs. _{Tool · Full entry}
• ProcDump for Linux and macOS - Linux and macOS reimagining of the Sysinternals ProcDump tool that writes process dumps in response to performance, runtime, signal and resource-tracking triggers, including native dumps through a Rust ELF writer and managed dumps through .NET diagnostics IPC. _{Tool · Full entry}
• fishhook - Small library that dynamically rebinds symbols in Mach-O binaries running on iOS, on device and in the simulator, by updating the lazy and non-lazy symbol pointers that dyld uses. _{Tool · Also: App · Full entry}
• pcode2code - VBA p-code decompiler based on pcodedmp, written for Office documents whose macro source has been stomped to leave only bytecode. _{Tool · Full entry}
• rust-deobf - rust-deobf analyzes compiled, mainly Rust, ELF, PE and Mach-O binaries to recover hidden strings and related artifacts. _{Tool · Full entry}
• CFG Visualizer - CFG Visualizer extracts function control-flow graphs from ELF, PE and Mach-O binaries with radare2 and presents them in an interactive 3D browser view. _{Tool · Full entry}
• Cpp2CS - Cpp2CS recovers managed methods from Android ARM64 Unity IL2CPP ELF binaries and matching metadata, emitting CIL assemblies, C# source and per-method diagnostics. _{Tool · Full entry}
• ghidra-c6000 - ghidra-c6000 adds Texas Instruments C64x, C67x and C674x DSP support to Ghidra 12.x. _{Tool · Full entry}
• cocos2d-dumper - cocos2d-dumper extracts defined function symbols from ELF shared libraries and demangles C++ names with GNU binutils. _{Tool · Full entry}
• Binary Ninja Security Analysis Plugin - Binary Ninja Security Analysis Plugin batches binary analysis from a Rust plugin and exports Parquet reports. _{Tool · Full entry}
• Human-Readable Decompilation - Human-Readable Decompilation restructures C produced by Ghidra's binary decompiler using an ANTLR parser and AST transformations. _{Tool · Full entry}
• BinStruct Inspector - BinStruct Inspector is a GUI for examining binary file layouts through user-defined field trees. _{Tool · Library · Full entry}
• SimpleParserPE - SimpleParserPE is a C++ command-line inspector for PE32 Windows executables. _{Tool · Full entry}
• tenet_tracer - tenet_tracer uses Intel Pin to record instruction-level execution traces for Tenet. _{Tool · Full entry}
• BinScan - BinScan scans files in bulk and emits per-file JSON containing format identification, structural metadata, hashes and entropy. _{Tool · Full entry}
• Patch-0xC0000022 - Patch-0xC0000022 instruments the running Windows SysMain service by changing its NtCreateFile response to STATUS_ACCESS_DENIED. _{Tool · Also: App · Full entry}
• iMonitor - iMonitor is a Windows endpoint activity monitor for examining running software. _{Tool · Also: App · Full entry}
• m68kdasm - m68kdasm disassembles Motorola 68000-family machine code in Go and returns assembly with structured instruction metadata. _{Tool · Full entry}
• IR Lifting Benchmark - IR Lifting Benchmark compares binary lifting workflows across Ghidra P-code, angr VEX, BAP BIL and optional LLVM IR paths. _{Tool · Full entry}
• Bin-Hunter - Bin-Hunter is a Python command-line tool for initial static inspection of binary files. _{Tool · Full entry}
• BinaryInsight - BinaryInsight inspects ELF, PE, and Mach-O executables and libraries in an interactive terminal view or a text-report CLI. _{Tool · Full entry}
• rust-sig-gen - rust-sig-gen generates IDA FLAIR library signatures from compiled Rust crates for executable analysis. _{Tool · Full entry}
• 1C 7.7 Configuration Parser (MD Parser) - 1C 7.7 Configuration Parser inspects 1C:Enterprise 7.7 1cv7.md configuration containers. _{Tool · Library · Also: App · Full entry}
• x64dbg-tenet - x64dbg-tenet is a native x64dbg plugin that records execution steps in Tenet trace format. _{Tool · Full entry}
• NullSec BinGaze - NullSec BinGaze analyses ELF executables by parsing headers, listing sections and calculating entropy. _{Tool · Full entry}
• pdbinspector - pdbinspector analyzes Microsoft PDB files to list structures, classes, enums, functions, public symbols and exports. _{Tool · Library · Full entry}
• 8086 Register Command Debugger - 8086 Register Command Debugger is an MS-DOS machine-code inspection tool written in 8086 assembly. _{Tool · Full entry}
• advantage - advantage is a Windows research tool for inspecting Lenovo Vantage and add-in RPC commands. _{Tool · Also: App · Full entry}
• Valkyrie - Valkyrie analyzes suspect binaries through static inspection and Docker-based execution. _{Tool · Full entry}
• PE Disassembler - PE Disassembler is a WPF application that extracts the .text section of 32-bit Windows PE executables and displays decoded x86 instructions. _{Tool · Full entry}
• SIC/XE Disassembler and Linking Loader - SIC/XE Disassembler and Linking Loader converts SIC/XE object code into assembly listings and reconstructed symbols. _{Tool · Full entry}
• Malware Deobfuscator - Malware Deobfuscator analyzes obfuscated malware scripts and generates code, behavior and indicator reports. _{Tool · Also: App · Full entry}
• flashkit - flashkit is a Python toolkit for examining Adobe Flash SWF files and AVM2 bytecode. _{Tool · Library · Full entry}
• Kaiju - Kaiju is a Rust reverse-engineering framework with a headless CLI for binary loading and analysis. _{Tool · Full entry}
• sqlce - sqlce reads SQL Server Compact .sdf database files using a cross-platform C++ parser informed by analysis of decompiled SQL CE components. _{Tool · Library · Also: App · Full entry}
• inkterop - inkterop converts native handwriting files from note apps and e-ink devices through a documented intermediate representation. _{Tool · Library · Also: App · Full entry}
• wMatcher - wMatcher compares two Java archives to match classes renamed or obfuscated between releases. _{Tool · Full entry}
• tasm-rs - tasm-rs implements TVM bytecode assembly and disassembly in Rust, with a tdisasm CLI, instruction tables, Fift parsing and trace and coverage reports. _{Tool · Full entry}
• Sogen Dart bindings - Sogen Dart bindings expose Windows and Linux binary emulation through a Dart FFI package and native bridge. _{Tool · Full entry}
• cupertino-files - cupertino-files is a TypeScript library for reading and writing modern Apple Pages, Numbers, and Keynote documents. _{Tool · Library · Also: App · Full entry}
• PackerScope - PackerScope scans Windows PE executables for packer signatures and structural indicators, including entropy, sections, imports and entry-point instructions. _{Tool · Full entry}
• imprint - imprint analyzes Windows PE files by parsing import, delay-import and export directories without executing the image. _{Tool · Full entry}
• kdemulator - kdemulator executes Windows x86-64 kernel-driver binaries outside a live kernel for IOCTL analysis. _{Tool · Full entry}
• angr-management - Cross-platform graphical binary analysis tool powered by the angr platform, with disassembly and decompilation views. _{Tool · Full entry}
• QIRA - QIRA is a tool for examining program execution traces. _{Tool · Full entry}
• Dependencies - Dependencies is a Windows PE dependency analysis tool with command-line and graphical interfaces. _{Tool · Full entry}
• Hachoir - Hachoir is a Python library for viewing and editing binary streams as trees of fields, down to individual bits. _{Tool · Library · Full entry}
• Pigaios - Pigaios is a tool that matches C source code against binaries in IDA. _{Tool · Full entry}
• MachOExplorer - MachOExplorer is a desktop and command-line tool for inspecting Mach-O binaries, Universal binaries, static archives, and dyld shared caches. _{Tool · Full entry}
• FLEX - FLEX is an in-app tool for exploring and debugging running iOS applications. _{Tool · Also: App · Full entry}
• classdump-dyld - classdump-dyld is a command-line tool that generates Objective-C headers from Mach-O app binaries, libraries, frameworks, bundles, and images in the dyld shared cache. _{Tool · Also: App · Full entry}
• Process Dump - Process Dump is a Windows command-line tool that saves code from running processes to disk for malware analysis. _{Tool · Full entry}
• mal_unpack - mal_unpack is a Windows dynamic unpacker based on PE-sieve. _{Tool · Full entry}
• Bloaty - Bloaty is a binary size profiler that attributes file and memory usage to sources such as symbols, compilation units, and sections. _{Tool · Full entry}
• bingrep - bingrep is a command-line tool for inspecting and colorizing binary files. _{Tool · Full entry}
• libPeConv - libPeConv is a Windows library for loading and manipulating PE files. _{Tool · Library · Full entry}
• Viper - Viper is a framework for binary analysis and for organizing malware samples, exploit samples, and research scripts. _{Tool · Full entry}
• Cuckoo3 - Cuckoo3 is a malware analysis tool that tests suspicious files and links in sandboxed platform emulators. _{Tool · Also: Website · Full entry}
• Cuckoo Sandbox - Cuckoo Sandbox is an automated malware analysis system that executes suspicious files in an isolated environment and reports their behavior. _{Tool · Full entry}
• fq - fq is a command-line tool and query language for inspecting and decoding binary formats. _{Tool · Also: Protocol · Full entry}
• innoextract - Unpacks Inno Setup installers on non-Windows systems without running them. _{Tool · Full entry}
• Metasm - Metasm is a Ruby suite for assembling, disassembling, debugging, and modifying executable binaries. _{Tool · Library · Full entry}

Firmware and Hardware

↑ Contents

19 case studies. The 10 newest are below. Full case list.

Case studies

• Hisense AEH-W41H1: local A/C control over a reconstructed RS-485 bus - Hisense AEH-W41H1 local control replaces the air conditioner's cloud-connected Wi-Fi module with ESPHome firmware for an ESP32 board or the stock RTL8710C module. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• nRF52 e-paper tag: reconstructing an undocumented display interface - nRF52 e-paper tag reconstructs control of an undocumented electronic shelf label with an nRF52832 board and SSD1675A-class panel. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• open-picpak: reconstructing the PicPak frame's BLE protocol and device behavior - open-picpak documents the PicPak 4.2-inch e-ink frame's stock firmware behavior, BLE GATT protocol, and image conversion pipeline. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• OpenJooki: replacing the Jooki 2 software and recovery path - OpenJooki replaces the Jooki 2 music speaker's embedded Linux core and provides phone-based control, updates and SD-card recovery. _{Case study · Independent reconstruction · Full entry}
• OSIRIS: replacing Onkyo receiver firmware through MCU protocol research - OSIRIS replaces the DSP-board software of Onkyo TX-NR515 and TX-NR717 receivers with its own boot loader, Linux services and DSP code. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• sony-bravia-linux: pre-Android BRAVIA platform and media behavior - sony-bravia-linux investigates the Linux-based, pre-Android Sony BRAVIA platform and reconstructs selected media and portal behavior for owner-run services. _{Case study · Independent reconstruction · Full entry}
• Stickwalker: porting Pokéwalker firmware to the Stick S3 - Stickwalker ports a matching reconstruction of Pokéwalker firmware to the M5Stack Stick S3. _{Case study · Independent reconstruction · Full entry}
• VanMoof BLE: a client for S5, A5 and S6 bicycle protocols - VanMoof BLE implements a Python client for the S5, A5 and S6 bicycle BLE protocols. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• Virtual MPC Sample: rehosting Akai MPC Sample firmware in QEMU - Virtual MPC Sample rehosts Akai MPC Sample 1.3.0.12 firmware in QEMU using a custom lab kernel and a browser panel for the device controls. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• EchoMuse: replacement software that turns the Echo Dot 2nd gen into a Home Assistant voice satellite - Replaces the software on an unlocked second-generation Amazon Echo Dot (2016, codename biscuit) so it works as a local Home Assistant voice satellite over the ESPHome API: EchoMuse's own Go firmware drives the microphones, speaker, LED ring and buttons, and a controller on the LAN handles wake words, devices and a dashboard. _{Case study · Independent reconstruction · Full entry}

Tools, projects and integrations

• Binwalk - Identifies embedded formats and optionally extracts their contents, with entropy analysis for firmware triage. _{Tool · Full entry}
• unblob - Recursively extracts archives and filesystems from binary blobs while reporting chunk boundaries and unknown regions. _{Tool · Full entry}
• Ghidra Firmware Utilities - Ghidra loaders and helpers for PCI option ROMs, UEFI firmware volumes, Intel flash descriptors and coreboot images. _{Tool · Full entry}
• EMBA - Extract firmware, combine static checks with emulation-based analysis, inventory software components, and generate web reports and SBOMs for further investigation. _{Tool · Full entry}
• Firmware Analysis and Comparison Tool (FACT) - Unpack and analyze firmware through an extensible platform whose web interface and HTTP API make component contents and analysis results searchable and comparable across samples. _{Tool · Full entry}
• OFRAK - Recursively identify, unpack, analyze, modify, and repack firmware and binary formats using a resource-tree GUI and Python API, with optional disassembler backends. _{Tool · Also: Binary · Full entry}
• FirmAE - Emulate router and IP-camera firmware to inspect network services and runtime behavior, with automated emulation checks and separate analysis, run, and debugging modes. _{Tool · Full entry}
• PulseView - Examine captured logic and analog waveforms with sigrok's graphical frontend. _{Tool · Also: Protocol · Full entry}
• UEFITool - Parse UEFI firmware images into an inspectable tree and check their structure. _{Tool · Full entry}
• Glasgow Interface Explorer - Use FPGA-based open hardware and Python applets to read and write SPI flash, I2C EEPROM and parallel memory chips, determine JTAG pinouts, debug supported processors and analyze UART, SPI and QSPI transactions on physical devices. _{Tool · Also: Protocol · Full entry}
• Penguin - Rehost embedded Linux firmware from an extracted root filesystem using a generated, editable configuration of emulation transformations, then refine it through a guest root shell, forwarded network services and recorded dynamic-analysis output. _{Tool · Full entry}
• ipsw - Command-line toolkit for Apple firmware research and reverse engineering. _{Tool · Also: App, Binary · Full entry}
• avatar² - Python framework from EURECOM's S3 group that orchestrates emulators, debuggers and physical devices for dynamic analysis of embedded firmware. _{Tool · Full entry}
• efiXplorer - IDA Pro plugin and loader that automate static analysis of UEFI firmware. _{Tool · Full entry}
• vmlinux-to-elf - Rebuild an analyzable ELF with function and variable symbols from a Linux kernel image, whether a raw or compressed vmlinux, vmlinuz, zImage or bzImage blob, certain Android boot.img files or a stripped kernel ELF, by locating and decoding the embedded kallsyms symbol table. _{Tool · Also: Binary · Full entry}
• Sony-PMCA-RE - USB tool built from reverse engineering Sony digital cameras. _{Tool · Also: Protocol · Full entry}
• cpu_rec - Statistically recognize the CPU instruction set in an arbitrary binary file, such as an unknown firmware image, by comparing Markov-chain byte statistics with a default corpus covering dozens of architectures, from 6502 and 8051 to ARM, MIPS, PowerPC, RISC-V, x86-64 and WebAssembly. _{Tool · Also: Binary · Full entry}
• ME Analyzer - Parse Intel Management Engine (CS)ME, TXE and SPS firmware, Graphics System Controller firmware and their independent PMC, PCHC, PHY and option-ROM images to report family, version, release, SKU, platform, size and health status. _{Tool · Full entry}
• CHIPSEC - Platform security assessment framework, with Intel Corporation copyright notices, for analyzing PC hardware configuration, BIOS/UEFI system firmware and platform components from Windows, Linux or the UEFI shell. _{Tool · Full entry}
• binbloom - Quarkslab command-line tool that infers basic properties of a headerless raw firmware image from simple statistics on its content, which is why the README says it works with any architecture. _{Tool · Full entry}
• m1n1 - Asahi Linux's bootloader and hardware-research environment for Apple Silicon Macs. _{Tool · Full entry}
• SVD-Loader for Ghidra - Ghidra script from leveldown security that reads a CMSIS-SVD file, the XML format describing a microcontroller's memory-mapped peripherals and their registers, and applies it to firmware already loaded in Ghidra. _{Tool · Full entry}
• UEFI Firmware Parser - Python library and uefi-firmware-parser command for identifying, parsing and extracting PC firmware images: UEFI firmware volumes, capsules, firmware file systems, files and sections, Intel PCH flash descriptors, Intel ME modules and Dell PFS update packages. _{Tool · Full entry}
• ESP32 Bit Pirate - Open-source firmware that turns ESP32-S3 boards into a Bus Pirate-inspired multi-protocol hardware tool, operated from a USB serial terminal, a Wi-Fi web CLI or the M5 Cardputer's own keyboard and screen. _{Tool · Also: Protocol · Full entry}
• Firmware Analysis Toolkit (FAT) - Attify's firmware security toolkit, rewritten for version 2 as a Rust command-line tool built around per-image projects. _{Tool · Also: Binary · Full entry}
• FujiHack - Research codebase for reverse engineering Fujifilm cameras so that custom code can run on them under a patched firmware. _{Tool · Full entry}
• efiSeek - Ghidra analyzer extension from Digital Security for individual UEFI modules, enabled by default during auto-analysis of x86 and x64 PE images with an EFI subsystem. _{Tool · Full entry}
• FwAnalyzer - Rule-based checker for filesystem images taken from firmware: it reads ext2/3/4, FAT/VFAT, SquashFS and UBIFS images, cpio archives or a directory, and writes a JSON report of every file that breaks the rules in a TOML configuration. _{Tool · Full entry}
• FwHunt Community Scanner (fwhunt-scan) - Binarly's Python scanner that checks UEFI firmware modules against FwHunt rules, the YAML detection format for known UEFI firmware vulnerabilities whose rules are kept in the separate fwhunt repository. _{Tool · Full entry}
• sniffROM - Python tool that reconstructs serial flash contents from passive bus captures: it parses SPI or I²C analyzer exports from Saleae Logic, recorded while a device reads and writes its own flash chip, and writes the observed data into a binary image at the original memory addresses. _{Tool · Also: Protocol · Full entry}
• Pawn - Linux command-line tool from Google that reads the BIOS/UEFI firmware image out of the SPI flash of Intel-based workstations and laptops. _{Tool · Full entry}
• EMBArk - Web-based enterprise interface for the EMBA firmware security scanner, which it installs and runs as its scanning backend. _{Tool · Full entry}
• IDAPython Embedded Toolkit - Maddie Stone's IDAPython scripts for triaging and annotating embedded-device firmware images in IDA Pro, presented at RECON Montreal and DerbyCon in 2017. _{Tool · Also: App · Full entry}
• fiano - LinuxBoot's Go tools and libraries for parsing and modifying UEFI firmware images. _{Tool · Full entry}
• Pyrrha - Quarkslab's firmware cartography tool, which indexes an extracted firmware filesystem into a database browsed with NumbatUI, Quarkslab's fork of the Sourcetrail code explorer. _{Tool · Also: Binary · Full entry}
• RETracker - Python reverse-engineering framework for the Polyend Tracker music device that patches the vendor's stock firmware, replacing an unused USB RAWHID handler with its own command handler. _{Tool · Full entry}
• Titan M tools (Quarkslab) - Tools Quarkslab published from its research on Google's Titan M security chip in Pixel phones: a Ghidra loader for Titan M (Citadel) firmware files, nosclient for tracing and sending the chip's protobuf-based commands from Android with a black-box fuzzer built on libprotobuf-mutator, a parser for sigrok SPI captures, and scripts that convert firmware images to the rec files of the chip's SPI rescue feature. _{Tool · Also: Protocol · Full entry}
• uefi_retool - Python command-line tool and IDA Pro plugin for UEFI firmware reverse engineering. _{Tool · Full entry}
• Shannon Modem Loader for IDA Pro - IDA Pro loader and post-processing scripts for Samsung Exynos "Shannon" baseband modem images that carry a TOC header, including crash dumps. _{Tool · Full entry}
• IMSProg - Qt desktop programmer that reads, writes, erases and verifies I2C, SPI and MicroWire EEPROMs, FeRAM, DataFlash and SPI NOR/NAND flash chips through low-cost CH341A, CH347T and FT232H USB programmers. _{Tool · Full entry}
• rbasefind - Multithreaded Rust command-line tool that brute-forces the load address of a flat 32-bit firmware image, reimplementing mncoppola's basefind.py and rsaxvc's basefind.cpp. _{Tool · Full entry}
• Aptio V UEFI Editor - Browser-based editor for the setup menus of AMI Aptio V UEFI firmware, offered as an alternative to AMIBCP. _{Tool · Full entry}
• FirmLoader - IDA plugin that applies a microcontroller's memory map to a raw firmware image: once the analyst picks an MCU model, it creates RAM and other memory segments, adds peripheral segments with named registers and, where a vector table is described, labels its entries and turns the handlers they point to into functions. _{Tool · Full entry}
• IFDA (IoT Firmware Deep Analysis) - Static analysis pipeline for extracted IoT firmware: pointed at one ELF or an unpacked root filesystem, it disassembles binaries with Capstone for x86, ARM/Thumb-2, AArch64 and MIPS, recovers functions, call graphs and exploit mitigations, and reports candidate issues from dangerous-function calls, call-graph taint paths, CVE correlation through cve-bin-tool, embedded secrets, script injection patterns and filesystem hardening checks. _{Tool · Also: Binary · Full entry}
• basefind2 - Python script that estimates the load address of a flat 32-bit little-endian firmware image without brute-forcing every candidate base, building on mncoppola's basefind.py and rbasefind. _{Tool · Full entry}
• JTAGulator - Joe Grand's open-source hardware tool and Parallax Propeller firmware for locating on-chip debug interfaces among an unfamiliar board's test points, vias, component pads or connectors. _{Tool · Full entry}
• BIOSUtilities - Python collection of 16 parsers and extractors for vendor BIOS/UEFI update formats, including AMI BIOS Guard (PFAT) and UCP, Dell PFS, Insyde iFlash/iFdPacker, Phoenix TDK Packer, Award, Fujitsu, Panasonic, Portwell, Toshiba and VAIO packages and several Apple EFI containers. _{Tool · Full entry}
• allyourbase - Python script that estimates a firmware image's base address by comparing string addresses with the targets of every possible pointer, for any pointer size and either endianness. _{Tool · Full entry}
• ghidra_kernelcache - Ghidra script framework for reverse engineering Apple kernelcaches and kernel extensions on iOS and macOS. _{Tool · Also: Binary · Full entry}
• esp32_image_parser - Tenable's Python command-line tool, described in its repository as a toolkit for reverse engineering ESP32 firmware, that reads the partition table of an ESP32 flash dump and rebuilds an app partition such as factory or ota_0 as an Xtensa ELF file. _{Tool · Full entry}
• Tigard - Open-hardware board built around the FTDI FT2232H that connects a computer to a target device's UART, SPI, I2C, JTAG and SWD interfaces through level shifters that operate from 1.8 to 5.5 V. _{Tool · Also: Protocol · Full entry}
• UBI Reader - Python module and command-line scripts that read UBI and UBIFS images, including ones inside raw NAND dumps, by locating the first UBI or UBIFS data in a file. _{Tool · Full entry}
• payload-dumper-go - Go command-line tool and library that extracts partition images from Android A/B OTA payloads, reading either a raw payload.bin or the OTA zip that contains it in place. _{Tool · Full entry}
• mithril - Offline C++ scanner for the contents of firmware and IoT software, pointed at a single file or an already unpacked root filesystem, that reports embedded secrets, a software bill of materials, known CVEs, open-source licenses, boot-security configuration and weak or publicly known keys, each finding with its evidence and a confidence level. _{Tool · Full entry}
• img4tool - tihmstar's command-line tool and C++ library for Apple's IMG4 firmware container format. _{Tool · Full entry}
• payload dumper - Python script that extracts the partition images, such as boot.img and system.img, from the payload.bin inside an Android OTA update package. _{Tool · Full entry}
• PMCA-RE RELOADED - PMCA-RE RELOADED is a Rust desktop and CLI toolkit for Sony cameras that includes experimental analysis of where menu settings reside in camera settings memory. _{Tool · Full entry}
• ThisFirmwareDoesNotExist - ThisFirmwareDoesNotExist maps Arturia MicroFreak firmware 5.0.0.2084 and provides freakpatch to modify a user's official update file. _{Tool · Full entry}
• intel_ma - intel_ma inspects PC management firmware in ME/TXE/CSME region images and full SPI dumps. _{Tool · Full entry}
• qemu-rtd2841 - qemu-rtd2841 adds a Realtek RTD2841/RTK284x TV machine model to QEMU for bare-metal diagnostics and local firmware experiments. _{Tool · Full entry}
• MS4X - MS4X analyzes Siemens MS42 and MS43 engine-control firmware for BMW M52TU and M54 engines. _{Tool · Full entry}
• AC46 Firmware Tool - AC46 Firmware Tool unpacks firmware images for JieLi AC4600/BT15 devices. _{Tool · Full entry}
• Bin X-ray - Bin X-ray visualizes byte patterns in unknown files and firmware blobs through a 256×256 byte-pair matrix and a 3D byte-trigram plot. _{Tool · Full entry}
• PIC microcontrollers disassembler - PIC microcontrollers disassembler converts Intel HEX dumps for MidRange and Enhanced MidRange PIC12/PIC16 devices into disassembly listings, HI-TECH PICC assembly files, or both. _{Tool · Full entry}
• premium5 - premium5 emulates the Volkswagen Premium 5 car radio at the register and signal level so its original firmware can run without patches. _{Tool · Full entry}
• SPRD Flash Tool - SPRD Flash Tool implements the SPRD/UNISOC PAC download protocol in Rust for RDA8910 and UIS8910 devices. _{Tool · Also: Protocol · Full entry}
• PCM Explorer - PCM Explorer is a read-only Python browser for Porsche PCM and Audi MMI head-unit images. _{Tool · Full entry}
• me_cleaner - me_cleaner is a Python script that modifies Intel ME firmware images to reduce the firmware's ability to interact with the system. _{Tool · Full entry}
• Black Magic Debug - Black Magic Debug is a self-contained debugger for microcontrollers. _{Tool · Full entry}
• OpenOCD - OpenOCD is a tool for programming and debugging embedded targets through hardware debug adapters. _{Tool · Full entry}

Protocol

↑ Contents

91 case studies. The 10 newest are below. Full case list.

Case studies

• A.O. Smith water heater: local CTA-2045 control and protocol findings - The A.O. Smith water-heater project implements local monitoring and demand-response control of an HPS10-50H45DV over its CTA-2045 RS-485 port, publishing readings to MQTT. _{Case study · Independent reconstruction · Full entry}
• ACiQ K18W: reconstructing a mini split's UART protocol - ACiQ K18W documents the UART protocol between a mini split's indoor board and TCL WBR1 Wi-Fi module. _{Case study · Independent reconstruction · Full entry}
• ak820: reconstructing AJAZZ AK820 Pro HID control on macOS - ak820 implements macOS control of the AJAZZ AK820 Pro keyboard through its vendor HID feature-report protocol. _{Case study · Independent reconstruction · Full entry}
• akp02: reconstructing the Ajazz AKP02 display protocol - akp02 reconstructs the Ajazz AKP02 secondary display's USB HID protocol as a Linux Python library. _{Case study · Independent reconstruction · Full entry}
• aw5d-linux: driving an iBUYPOWER cooler LCD from USB-HID research - aw5d-linux drives the round LCD on an iBUYPOWER AW5/AW5D cooler from Linux using a 64-byte USB-HID output report. _{Case study · Independent reconstruction · Full entry}
• BikeStation: local Echelon Connect control over Bluetooth LE - BikeStation is a local Windows client for Echelon Connect exercise bikes built on community research into their proprietary Bluetooth LE protocol. _{Case study · Independent reconstruction · Full entry}
• BMS RS485 Service Suite: reconstructing a battery-service bus protocol - BMS RS485 Service Suite documents an observed ASCII RS485 protocol for battery-management services and implements frame building and decoding in Node-RED. _{Case study · Independent reconstruction · Full entry}
• Centerpiece Projects: decoding Finalmouse Centerpiece USB control - Centerpiece Projects documents observed USB control messages for the Finalmouse Centerpiece keyboard and implements scripts around them. _{Case study · Independent reconstruction · Full entry}
• claude-rc-api: reconstructing Claude Code Remote Control endpoints - claude-rc-api reconstructs the private HTTP interface used to control local Claude Code sessions from claude.ai/code. _{Case study · Independent reconstruction · Full entry}
• Cooper Hunter AC: UART and infrared protocol investigation - Cooper Hunter AC documents the COM1 UART and infrared control messages of CH-IF140RK and CH-IF140RK2 units with a Gree GRZQ3-R V1 board. _{Case study · Independent reconstruction · Full entry}

Tools, projects and integrations

• Wireshark - Inspect captured application and device traffic as decoded protocol fields, with filtering and shared GUI/TShark dissection. _{Tool · Also: App, Firmware · Full entry}
• Netzob - Model communication protocols and infer message layouts from traces, with configured active learning for protocol state machines. _{Tool · Full entry}
• Scapy - Script packet dissection, construction, request/reply matching and capture-file analysis in Python. _{Tool · Full entry}
• Universal Radio Hacker (URH) - Demodulate and decode signals captured with software-defined radios, with automatic modulation-parameter detection and customizable decodings. _{Tool · Full entry}
• SavvyCAN - Capture or load CAN bus traffic and investigate frames with sniffer, graphing, file-comparison and ISO-TP/UDS decoding views; loaded or analyst-edited DBC files map raw bytes to named signals. _{Tool · Full entry}
• AALpy - General-purpose Python automata-learning library that infers deterministic, non-deterministic, stochastic and pushdown models of black-box systems from active queries or passive traces. _{Tool · Full entry}
• rtl_433 - Receives and decodes transmissions from ISM-band devices such as weather sensors, remote controls, doorbells and alarm sensors, using RTL-SDR or SoapySDR receivers or recorded I/Q files, and emits decoded fields as JSON, CSV, MQTT and other outputs. _{Tool · Full entry}
• Blackbox Protobuf - NCC Group's tools for decoding and re-encoding Protocol Buffers messages without the matching .proto definition. _{Tool · Also: App · Full entry}
• furiousMAC Continuity - Reverse-engineering notes and a Wireshark dissector for Apple's proprietary Continuity Bluetooth LE advertisements, continuing the authors' PETS 2019 privacy study. _{Tool · Full entry}
• opendbc - comma.ai's repository of DBC files describing the CAN messages and signals of many car makes, with a Python library that parses and builds CAN messages from those definitions; its porting guide has contributors reverse engineer new messages from recorded drives in the cabana tool. _{Tool · Full entry}
• FISSURE - GNU Radio-based RF framework that carries a signal from survey and detection through IQ capture, inspection, conditioning, feature extraction and classification into a protocol discovery workflow. _{Tool · Full entry}
• friTap - Frida-based tool that hooks TLS libraries such as OpenSSL, BoringSSL, NSS and GnuTLS inside a running process and writes NSS key logs and decrypted payloads as PCAP, so analysts can inspect an application's encrypted traffic in Wireshark. _{Tool · Also: App · Full entry}
• pbtk - Recover Protobuf message definitions from compiled programs as readable .proto files. _{Tool · Also: App · Full entry}
• SteamKit - .NET library that implements the client side of Valve’s Steam network protocol: connection-manager sessions, authentication, friends, unified service and Game Coordinator messages, Web API calls and CDN depot downloads. _{Tool · Also: Game · Full entry}
• protobuf-inspector - Parses Protocol Buffers blobs (proto2 or proto3) without their .proto definition and prints a colored view of the fields in wire order, trying each length-delimited chunk as a nested message, then a packed array, a string and finally a hexdump. _{Tool · Full entry}
• libimobiledevice - C library and command-line tools that speak iOS devices' native service protocols without Apple's proprietary libraries or a jailbreak. _{Tool · Also: App · Full entry}
• Sniffle - NCC Group's sniffer for Bluetooth 5 and 4.x Low Energy, made of firmware for TI CC1352/CC26x2 radio boards and Python host tools. _{Tool · Full entry}
• Packetry - Great Scott Gadgets' USB 2.0 protocol analysis application for live capture with the Cynthion analyzer or for exploring previously captured traffic, working from physical-layer packet data at High, Full and Low Speed. _{Tool · Full entry}
• Caring Caribou - Python automotive security exploration tool, begun in the HEAVENS research project, that the README describes as a zero-knowledge tool to drop onto a CAN network and collect information about the services present. _{Tool · Full entry}
• protodump - Go command-line utility that recovers Protocol Buffers schemas from a compiled binary or any other file: it scans the raw bytes for serialized FileDescriptorProto records embedded by generated code, locating them through their .proto file names, and writes each one back out as a .proto source file under its original descriptor path. _{Tool · Also: Binary · Full entry}
• CAN Commander - A Flipper Zero app and earlier Arduino sketches for reverse engineering CAN bus traffic, chiefly in vehicles. _{Tool · Full entry}
• Automated CAN Payload Reverse Engineering - Research Python and R scripts that automate reverse engineering of Controller Area Network (CAN) payloads recorded from passenger vehicles, implementing the pipeline from Brent Stone's AFIT dissertation. _{Tool · Full entry}
• Deluder - Frida-based interceptor for the traffic of proxy-unaware applications. _{Tool · Also: App · Full entry}
• PiCCANTE - Raspberry Pi Pico firmware and hardware designs for a low-cost CAN bus interface aimed at exploring and reverse engineering vehicle networks. _{Tool · Full entry}
• VanBus - Arduino library for ESP8266/ESP8285 and ESP32 boards that receives and transmits packets on the VAN (Vehicle Area Network) comfort bus that PSA fitted to Peugeot and Citroën models until about 2009. _{Tool · Full entry}
• Apple Continuity Reverse Engineering Toolkit - Three macOS helpers from SEEMOO Lab that the Open Wireless Link project used to study Apple wireless services such as AirDrop, Wi-Fi Password Sharing, Handoff and Offline Finding from the host side. _{Tool · Full entry}
• Cabana (standalone openpilot-cabana) - Qt desktop CAN and CAN FD analyzer for decoding signals and reverse engineering unknown messages, split out of openpilot's cabana by Dean Lee, a frequent contributor to it, and now maintained on its own. _{Tool · Full entry}
• eCapture - eBPF-based Linux and Android tool that attaches uprobes to TLS libraries such as OpenSSL, BoringSSL, GnuTLS and NSS, and to Go's TLS stack, recording the plaintext a process sends and receives without a proxy or an installed CA certificate, so analysts can inspect an application's encrypted traffic on a host they control. _{Tool · Also: App · Full entry}
• USBPcap - Tomasz Moń's open-source USB packet capture for Windows. _{Tool · Full entry}
• cantools - Python 3 library and command-line tool for CAN bus databases that parses DBC, KCD, SYM, ARXML 3/4 and CDD files and encodes and decodes CAN messages, including simple and extended signal multiplexing and diagnostic DIDs. _{Tool · Full entry}
• inspectrum - Desktop analyzer for recorded radio signals, primarily captures from software-defined radio receivers, which the README says handles files of 100 GB and more. _{Tool · Full entry}
• PULSAR - Research prototype by Hugo Gascon and colleagues that learns a model of an unknown network protocol from recorded traffic. _{Tool · Full entry}
• CanLab - PyQt6 desktop workstation and command-line tool for reverse-engineering CAN bus captures offline. _{Tool · Full entry}
• Facedancer - Python library for implementing USB devices in software, with a hardware peripheral such as Cynthion or GreatFET acting as a remote-controlled USB controller attached to the target host. _{Tool · Full entry}
• Mirage - Python framework from IoT-security research at LAAS-CNRS for analysing wireless communications, with lightweight protocol stacks for Bluetooth Low Energy, Bluetooth, Enhanced ShockBurst, Mosart, Zigbee, Wi-Fi and infrared that a command-line interpreter drives through chainable modules. _{Tool · Full entry}
• Protobuf Decoder - Pawit Pornkitprasan's React web application for decoding Protocol Buffers data without the original .proto files, offered as a hosted page or run locally, with all decoding done in the browser. _{Tool · Full entry}
• gr-lora - GNU Radio out-of-tree module by Pieter Robyns and co-authors for receiving and decoding LoRa physical-layer frames with a software-defined radio, implementing the modulation features described in patents and blog posts. _{Tool · Full entry}
• termshark - Graham Clark's terminal user interface for tshark, inspired by Wireshark and aimed at inspecting captures on a remote machine, for example over SSH, without copying them back to a desktop. _{Tool · Full entry}
• SigDigger - Qt graphical digital signal analyzer by Gonzalo José Carracedo Carballal, built on his Suscan and Sigutils libraries; its user manual names reverse engineering of radio signals with unknown parameters as the main use. _{Tool · Full entry}
• grpc-tools - Bradley Kemp's suite of gRPC debugging tools, described as Fiddler or Charles for gRPC. _{Tool · Also: App · Full entry}
• Holley EFI Parser - Holley EFI Parser decodes Holley DL and DLZ data logs and live ECU CAN messages. _{Tool · Full entry}
• CAN Bus Parser - CAN Bus Parser decodes VanMoof SA5 and later bicycle CAN captures from CSV or candump input. _{Tool · Full entry}
• Lutron Protocols - Lutron Protocols researches CCA radio packets, CCX Thread and CoAP messages, the LEAP processor API and IPL Designer integration frames for Lutron lighting systems. _{Project · Also: App, Binary, Firmware · Full entry}
• Hermes - Hermes is a Flipper Zero app for identifying unknown UART settings and inspecting a device's serial console. _{Tool · Full entry}
• RoflLens - RoflLens is a Python library and CLI for analysing League of Legends ROFL v2 replay containers and network transport. _{Tool · Also: Game, Binary · Full entry}
• LogicAnalyzer - LogicAnalyzer is a hardware and software tool for capturing digital signals and decoding communication protocols. _{Tool · Full entry}
• BtleJuice - BtleJuice is a framework for intercepting Bluetooth Low Energy GATT operations between devices. _{Tool · Full entry}
• NearDrop - macOS menu bar app that partially implements Nearby Share and Quick Share to exchange files and links with Android devices. _{Tool · Full entry}
• Impacket - Impacket is a Python library for constructing and parsing network packets and working with protocol implementations. _{Tool · Full entry}

Agents and MCP

↑ Contents

Also in target sections: Website: Chrome DevTools MCP, Playwright MCP, Burp Suite MCP Server, Spectral · Game: RenderDoc MCP, Cheat Engine MCP Bridge · App: JADX-AI-MCP, apktool-mcp-server, frida-mcp (yfe404), Super Trouper

• REA — Reverse Engineer Anything - The upstream CLI and MCP server for evidence-based investigations of shipped software and runtime behavior. _{Project · Official REA · Targets: Website, Game, App, Binary, Firmware, Protocol · Full entry}
• Official reverse-engineer-anything skill - Target routing, connection recovery and evidence practices for agents using REA. _{Integration · Official REA · Targets: Website, Game, App, Binary, Firmware, Protocol · Full entry}
• dsh-mcp-rea - A community MCP bridge presents a smaller selected tool surface and forwards explicit commands to the REA CLI. _{Integration · Community REA · Targets: Website, Game, App, Binary, Firmware · Full entry}
• rea-jev - A Claude Code plugin adds Jev-based routing and evidence checks around a pinned REA MCP integration. _{Integration · Community REA · Targets: Website, App · Full entry}
• rea-casebook - A Claude Code mod collects received REA Evidence, tracks unknowns and records findings that cite delivered evidence IDs. _{Integration · Community REA · Targets: Binary · Full entry}
• Eleven - An agent-first desktop reverse-engineering app that opens Mach-O, ELF and PE binaries, Android packages and GPU kernels, and lets any Agent Client Protocol agent read code, rename functions, add notes and propose patches in a shared window. _{Integration · Community REA · Targets: App, Binary · Full entry}
• REA plugin for Hermes Agent - Nous Research’s Hermes Agent plugin package for REA. _{Integration · Community REA · Targets: Website, App, Binary, Firmware · Full entry}
• crashlens - A crash-triage tool that turns Linux core dumps, runtime panics, exception traces and sanitizer reports into Markdown bug reports naming the crash type, the first frame in the user’s code and a stable signature. _{Integration · Community REA · Targets: Binary · Full entry}
• REA Workspace Template - A clone-first Chinese workspace template for analyzing one target per workspace with REA from Claude Code or Codex. _{Integration · Community REA · Targets: Website, App, Binary · Full entry}
• REA Reconstruction Companion - A third-party Agent Skill that works alongside REA’s own skill to turn reverse-engineering evidence into scoped requirements, design, staged implementation and validation, from one feature or format to a whole app. _{Integration · Community REA · Targets: App, Binary · Full entry}
• App X-Ray - Builds evidence-linked HTML/JSON reports, summary cards and diffs from REA analysis of app packages, native build metadata and model files. _{Integration · Community REA · Targets: App, Binary · Full entry}
• Hex-Rays IDA MCP - Official Hex-Rays MCP server for agent access to IDA databases, with headless operation and optional GUI integration. _{Integration · Independent MCP · Targets: Binary · Full entry}
• GhidraMCP - Ghidra extension and MCP bridge exposing decompilation, symbol navigation and renaming to agents, with GUI and headless modes. _{Integration · Independent MCP · Targets: Binary · Full entry}
• Binary Ninja MCP (official) - Binary Ninja's own MCP interface exposes functions, symbols, disassembly, intermediate languages and decompiled text to agents. _{Integration · Independent MCP · Targets: Binary · Full entry}
• Binary Ninja MCP (fosdickio) - Community Binary Ninja plugin and bridge for MCP clients, including workflows that switch among multiple open binaries. _{Integration · Independent MCP · Targets: Binary · Full entry}
• IDA Pro MCP (mrexodia) - Community IDA integration useful for existing setups and migration context; its maintainer now recommends the official Hex-Rays MCP server. _{Integration · Independent MCP · Targets: Binary · Full entry}
• Radare2 MCP Server - Native radare2 MCP server offering binary-analysis tools, reusable sessions and configurable read-only access. _{Integration · Independent MCP · Targets: Binary · Full entry}
• r2ai - AI plugins inside radare2 for function explanations, naming suggestions and model-assisted decompilation using local or remote models. _{Integration · Independent agent · Targets: Binary · Full entry}
• DAILA - Decompiler-independent AI assistant for function summaries and naming across IDA, Ghidra, Binary Ninja and angr-management. _{Integration · Independent agent · Targets: Binary · Full entry}
• RevEng.AI Ghidra Plugin - Connects Ghidra to RevEng.AI for function similarity, recovered names, AI explanations and agent-assisted annotation. _{Integration · Independent agent · Targets: Binary · Full entry}
• LLDB MCP - LLDB's official MCP interface gives agents debugger sessions and commands for breakpoints, memory inspection and stepping. _{Integration · Independent MCP · Targets: App, Binary · Full entry}
• Claude Reverse Engineering Skill - Community agent skill for triage, headless exports and evidence-based RE reports; explicitly documents workflows with REA and other MCP servers. _{Integration · Independent agent · Targets: App, Binary · Full entry}
• SpecterOps Reverse Engineering Skills - Focused Binary Ninja and Ghidra analysis skills that describe MCP tool use, analysis recipes and annotation practices. _{Integration · Independent agent · Targets: Binary · Full entry}
• pyghidra-mcp - PyGhidra-based MCP server that analyzes every binary in a Ghidra project and exposes decompilation, cross-references, call graphs, symbol and string search, indexed semantic code search, and renaming, typing and comment edits. _{Integration · Independent MCP · Targets: Binary · Full entry}
• LeanREA - An independent agent skill that routes application and binary investigations through ordinary command-line tools. _{Integration · Independent agent · Targets: App, Binary · Full entry}
• Universal Modder - Packages agent skills, three role briefs, a Python CLI and preconfigured fal MCP settings for modding PC games the user owns. _{Integration · Independent agent · Targets: Game · Full entry}
• ReVa (Reverse Engineering Assistant) - Ghidra extension that runs an MCP server inside Ghidra, giving agents decompilation with namespace and cross-reference context, symbol, string, data-type, structure and call-graph tools, program diffing, renaming and PyGhidra scripting. _{Integration · Independent MCP · Targets: Binary · Full entry}
• x64dbg-MCP Server - Native x64dbg plugin, written in Zig for both x32dbg and x64dbg, that serves an MCP endpoint over streamable HTTP and SSE from inside the debugger. _{Integration · Independent MCP · Targets: Binary · Full entry}
• mcp-windbg - Independent, community-built MCP server that runs Microsoft's cdb.exe and kd.exe headless, so agents can open and triage user-mode and kernel crash dumps, attach to cdb remote debug servers and KD kernel targets, and run arbitrary debugger commands in separately addressed sessions. _{Integration · Independent MCP · Targets: Binary · Full entry}
• Wireshark MCP - MCP server that wraps tshark, and optionally other Wireshark command-line tools, so agents can query saved captures through Wireshark's dissectors: packet lists and details, stream following, arbitrary field extraction, protocol hierarchies and conversations, decode-as rules for non-standard ports, protocol preferences, TLS and WPA decryption with user-supplied keys, and one tool that applies preset fields and filters for 25 protocols such as Modbus, S7comm, MQTT, Zigbee and BLE. _{Integration · Independent MCP · Targets: Protocol · Full entry}
• BINNY - An open-source terminal agent harness from OpenBin that runs a user-chosen hosted or local model over binary-analysis data. _{Integration · Independent agent · Targets: App, Binary, Firmware · Full entry}
• decomp.wtf - A discontinued local app and MCP server that hands AI coding agents one function of a user-owned console game at a time, compiles each C attempt with the game’s period compiler and accepts it only when the linked result matches the original bytes. _{Integration · Independent agent · Targets: Game · Full entry}
• Claude Intercept - A local man-in-the-middle proxy and dashboard that captures HTTP/S traffic from the user’s own computer and devices, stores it in SQLite and hands it to Claude Code through an /intercept skill and CLI. _{Integration · Independent agent · Targets: App, Protocol · Full entry}
• Ghidra MCP Server (bethington) - A Ghidra GUI plugin, standalone headless server and Python MCP bridge exposing a 209-tool catalog: decompilation, cross-references, renaming, typing, structures, comments and batch edits, plus P-code emulation, live debugging through Ghidra’s TraceRmi framework, shared Ghidra Server repository and version-control operations, and hash-based transfer of function documentation between binary versions. _{Integration · Independent MCP · Targets: Binary · Full entry}
• DecompilerServer - Stdio MCP server built on the ICSharpCode.Decompiler engine that lets agents load managed .NET assemblies, including a Unity game's Assembly-CSharp.dll located from its game directory, then search symbols, string literals and attributes, read decompiled C# or IL, and trace callers, callees, usages and inheritance. _{Integration · Independent MCP · Targets: Game, App · Full entry}
• Gepetto - IDA Pro plugin that sends Hex-Rays pseudocode to a hosted or local language model the user selects, to explain a function, comment it or propose new variable and function names, which the user picks from before they are applied. _{Integration · Independent agent · Targets: Binary · Full entry}
• GhidrAssistMCP - Ghidra extension that runs an MCP server inside Ghidra over streamable HTTP and legacy SSE, with 100 explicitly named tools (93 enabled by default) for pseudocode, disassembly, P-code, control-flow and call graphs, cross-references, strings, imports and exports, plus renaming, retyping, comments and structure inference. _{Integration · Independent MCP · Targets: Binary · Full entry}
• Android Reverse Engineering Skill - Claude Code plugin and agent skill that drives jadx and Fernflower/Vineflower to decompile Android APK, XAPK, JAR and AAR files and document their HTTP APIs. _{Integration · Independent agent · Targets: App · Full entry}
• Reverify - Python CLI and stdio MCP server that checks a model’s structured claims about a binary, such as bytes or typed values at an offset, strings, imports and exports, instruction mnemonics, emulation results and tested or Z3-proved equivalence, and returns VERIFIED, REFUTED or INCONCLUSIVE with the evidence the tools observed. _{Integration · Independent agent · Targets: Binary · Full entry}
• DecompAI - Gradio chat application whose LangGraph ReAct agent analyses an uploaded x86 Linux ELF binary: it lists and disassembles functions, decompiles them with Ghidra, drives radare2 and gdb, and runs shell commands and Python scripts in a privileged Kali Linux runner container. _{Integration · Independent agent · Targets: Binary · Full entry}
• Kong - Command-line pipeline that runs Ghidra in-process through PyGhidra and asks Claude, OpenAI or OpenAI-compatible models to name the functions, types and parameters of a stripped binary, working bottom-up through the call graph so callers see already-named callees. _{Integration · Independent agent · Targets: Binary · Full entry}
• Co-op Anything - Agent playbook, skill set and stdio MCP server for adding online or split-screen co-op to single-player games the players already have installed. _{Integration · Community REA · Targets: Game · Full entry}
• DeepExtract (DeepExtractIDA) - IDA Pro 9.x plugin and PowerShell batch extractor that turn Windows PE files into material AI coding agents can read: a per-binary SQLite database of PE metadata, signatures, disassembly, Hex-Rays pseudocode, cross-references, strings, stack frames, loops and dangerous API calls, plus optional grouped C++ and assembly files with per-function caller, callee and string headers and JSON indexes. _{Integration · Independent agent · Targets: Binary · Full entry}
• Mizuchi - Plugin pipeline for matching decompilation that loops over functions in an existing decomp project: m2c drafts C, decomp-permuter mutates it, Claude rewrites it through a compile-and-diff tool, and objdiff accepts a result only when the compiled object matches the target assembly. _{Integration · Independent agent · Targets: Game, Binary · Full entry}
• ReAgent - An open-source Python agent, published on PyPI as auto-re-agent, that drafts C/C++ implementations of functions in a compiled program from Ghidra evidence and has a separately configurable checker model review each draft in a bounded fix loop. _{Integration · Independent agent · Targets: Game, Binary · Full entry}
• lisa.py - LLDB extension that adds an MCP bridge to a debugging session, adapted from ida-pro-mcp: the plugin's mcp start command serves 18 debugger functions over local JSON-RPC, and a FastMCP stdio server generated from those functions exposes them to MCP clients such as Claude Desktop. _{Integration · Independent MCP · Targets: Binary · Full entry}
• WireMCP - Node.js MCP server that runs Wireshark's tshark for LLM clients, aimed in its README at threat hunting, network diagnostics and anomaly detection. _{Integration · Independent MCP · Targets: Protocol · Full entry}
• ReverserAI - Binary Ninja plugin that suggests function names from HLIL decompiler output with a language model run locally through llama.cpp; the README says it operates entirely offline once the model is downloaded. _{Integration · Independent agent · Targets: Binary · Full entry}
• WPeGPT - IDA plugin, formerly WPeChatGPT and inspired by Gepetto, that sends the Hex-Rays pseudocode of a function to an OpenAI-compatible model (OpenAI, DeepSeek or another compatible endpoint) and writes the model's analysis back into IDA as comments. _{Integration · Independent agent · Targets: Binary · Full entry}
• IDAssist - IDA Pro plugin by Jason Tang, who also wrote GhidrAssist, that adds a dockable PySide6 panel for LLM-assisted analysis of the open database. _{Integration · Independent agent · Targets: Binary · Full entry}
• GhidraGPT - Ghidra extension that sends one function’s decompiled C to a hosted or local language model the user selects and streams the answer into a GhidraGPT console. _{Integration · Independent agent · Targets: Binary · Full entry}
• GhidrAssist - Ghidra extension by Jason Tang, who also wrote GhidrAssistMCP, that adds a tabbed GhidrAssist window to CodeBrowser for LLM-assisted analysis of the open program. _{Integration · Independent agent · Targets: Binary · Full entry}
• Rikugan - IDA Pro and Binary Ninja plugin that runs its own agent loop inside the disassembler: a model the user chooses streams its answers and calls more than 60 in-process tools for navigation, decompilation, disassembly, cross-references, strings, types, annotations, scripting and host IL or microcode edits. _{Integration · Independent agent · Targets: Binary · Full entry}
• bn - Agent-oriented command-line interface for the Binary Ninja database already open in the GUI, reached through a companion plugin that listens on a local Unix-domain socket. _{Integration · Independent agent · Targets: Binary · Full entry}
• IDA Pro MCP Server (fdrechsler) - An IDA Pro plugin and a TypeScript MCP server by Florian Drechsler: the plugin starts an HTTP server inside IDA on 127.0.0.1:9045, and the stdio MCP server forwards agent requests to it. _{Integration · Independent MCP · Targets: Binary · Full entry}
• Ghidra Headless MCP - Headless-only MCP server that drives Ghidra through PyGhidra and is meant to share a container with the agent rather than attach to a Ghidra GUI. _{Integration · Independent MCP · Targets: Binary · Full entry}
• Binary Ninja Headless MCP - A third-party, headless-only MCP server by Ruben Marks (mrphrazer) that gives agents a large Binary Ninja tool surface the project counts as 181 tools across 36 feature groups, including disassembly, intermediate languages, cross-references, types, search, patching with undo/redo transactions, and arbitrary scripting through binja.eval and binja.call. _{Integration · Independent MCP · Targets: Binary · Full entry}
• IDA-Skill - Agent skill that has an AI agent triage malware samples statically in IDA Pro through headless idat. _{Integration · Independent agent · Targets: Binary · Full entry}
• BinAssist - Binary Ninja plugin by Jason Tang, who also wrote GhidrAssist and IDAssist, that adds a BinAssist sidebar for LLM-assisted analysis of the open binary. _{Integration · Independent agent · Targets: Binary · Full entry}
• Reversecore MCP - MCP server that puts radare2 with r2ghidra, LIEF, Capstone, YARA, CAPA, Detect It Easy, binwalk, angr, Volatility3, Scapy, Sleuth Kit and other engines behind 177 typed tools for AI clients such as Claude and Cursor. _{Integration · Independent MCP · Targets: Binary · Full entry}
• AutoProber - Flying-probe control stack meant to let a coding agent or an operator take a circuit board on a GRBL 3018-style CNC from locating it on the plate, through XYZ-tagged USB-microscope frames and an annotated map of pads, pins and chips, to probing targets the operator has approved. _{Integration · Independent agent · Targets: Firmware · Full entry}
• ToCode - Python CLI that exports a binary, IDA database, Android APK, .NET assembly or whole application folder into a source-like project tree for coding agents: recovered C (Java for APKs, C# and IL for .NET) with matching assembly and function summaries, recovered headers and types, section dumps, JSON indexes of functions, strings, imports, exports, reachability and call-graph clusters, and generated AGENTS.md and CLAUDE.md files. _{Integration · Independent agent · Targets: App, Binary · Full entry}
• Reverse API Engineer - Python CLI that turns the HTTP traffic a website actually produces into a typed API client. _{Integration · Independent agent · Targets: Website · Full entry}
• OpenBaud - Rust MCP server and Codex plugin that gives coding agents audited access to local serial devices, from identifying ports by USB metadata and sending framed requests to recording every received and transmitted byte in lossless .obcap captures. _{Integration · Independent MCP · Targets: Protocol · Full entry}
• JADX MCP Server (Qtty) - MCP server for Android APK analysis in which a Python FastMCP process talks to the agent over stdio and drives a long-lived local JVM daemon that embeds JADX 1.5.6 as a library, so no JADX GUI is involved and a loaded APK stays warm between sessions. _{Integration · Independent MCP · Targets: App · Full entry}
• usb-rea - Python CLI and stdio MCP server for inferring the USB protocol of a device whose only control software is a vendor app. _{Integration · Independent MCP · Targets: Protocol · Full entry}
• IDA NO MCP - IDA Pro exporter that turns an analyzed binary into plain files for AI coding tools such as Cursor or Claude Code instead of serving it over MCP. _{Integration · Independent agent · Targets: Binary · Full entry}
• ida-mcp-rs - Headless MCP server written in Rust that drives IDA Pro through idalib, so agents such as Claude Code, Codex CLI, Gemini CLI or Cursor can open and analyze binaries without the IDA GUI. _{Integration · Independent MCP · Targets: Binary · Full entry}
• ida-multi-mcp - MCP server that lets an agent analyze several IDA Pro databases at once through one endpoint. _{Integration · Independent MCP · Targets: Binary · Full entry}
• x64dbg MCP (x64dbgMCP) - MCP server that connects LLM clients to the x64dbg and x32dbg debuggers through a native plugin and a Python MCP script. _{Integration · Independent MCP · Targets: Binary · Full entry}
• IDASQL - SQL interface to IDA Pro databases that exposes a binary's analysis as more than 30 live virtual tables for agents and scripts. _{Integration · Independent agent · Targets: Binary · Full entry}
• Exoproc - Exoproc exposes Windows x64 process inspection and instrumentation to agents through a CLI and MCP server. _{Integration · Independent MCP · Targets: Binary · Full entry}
• OpenOCD SPI Dump Plugin - OpenOCD SPI Dump Plugin guides an agent through extracting SPI flash or EEPROM contents using a target MCU's SWD/JTAG debug connection. _{Integration · Independent agent · Targets: Firmware · Full entry}
• dos-mcp - dos-mcp connects AI agents to DOS programs running in js-dos for interactive reverse engineering. _{Integration · Independent MCP · Targets: Game, Binary · Full entry}
• x64dbg MCP - x64dbg MCP gives agents debugger control over Windows binaries through a native x64dbg plugin and a C# stdio MCP server. _{Integration · Independent MCP · Targets: Binary · Full entry}
• adb-mcp - adb-mcp gives agents structured Android Debug Bridge tools for investigating app behavior on a device. _{Integration · Independent MCP · Targets: App · Full entry}
• website-to-cli - website-to-cli is an agent skill for deriving terminal clients from captured website traffic. _{Integration · Independent agent · Targets: Website · Full entry}
• reverse-workbench-skill - reverse-workbench-skill is a multi-agent-harness skill bundle that routes investigations to workflows for APKs, native binaries, firmware, frontend JavaScript, and network traffic. _{Integration · Independent agent · Targets: Website, App, Binary, Firmware · Full entry}
• MindNode MCP Server - MindNode MCP Server connects agents to MindNode Next mind maps on macOS. _{Integration · Independent MCP · Targets: App · Full entry}
• OGhidra - OGhidra is an AI integration for analyzing binaries with Ghidra through natural language. _{Integration · Independent MCP · Targets: Binary · Full entry}
• aiDAPal - aiDAPal is an IDA Pro plugin that uses a locally hosted language model trained for Hex-Rays pseudocode to assist with code analysis. _{Integration · Independent agent · Targets: Binary · Full entry}
• x64dbg MCP Server Plugin - An MCP server plugin for x64dbg and x32dbg that lets external applications and AI agents control debugging through HTTP. _{Integration · Independent MCP · Targets: Binary · Full entry}
• JEB-MCP - JEB-MCP is an MCP server and JEB Pro script that lets MCP clients inspect and rename elements of Android apps in JEB. _{Integration · Independent MCP · Targets: App · Full entry}
• re-shell - re-shell is a Nix flake development environment that provides Claude Code with reverse engineering tools and workflows. _{Integration · Independent agent · Targets: Website, App, Binary, Protocol · Full entry}
• ghidra-rpc - ghidra-rpc is a CLI integration that lets AI coding assistants use a persistent Ghidra session for binary analysis. _{Integration · Independent agent · Targets: Binary · Full entry}
• r0idamcp - r0idamcp is a single-file MCP server that connects IDA Pro to an MCP-capable assistant for automated reverse engineering. _{Integration · Independent MCP · Targets: Binary · Full entry}
• SOMCP - SOMCP is an Android MCP server for analyzing and modifying native SO libraries. _{Integration · Independent MCP · Targets: App, Binary · Full entry}

Related Collections

↑ Contents

• Awesome Reverse Engineering - A task-oriented reverse-engineering resource list by REA's maintainer, useful for broader tools and foundations. _{Collection · REA maintainer · Targets: Website, Game, App, Binary, Firmware, Protocol · Full entry}
• Awesome REA Cases - A bilingual collection of REA and other AI-assisted reverse engineering cases, with source links and explicit distinctions between reported and reproduced outcomes. _{Collection · Community REA · Targets: Website, Game, App, Binary, Firmware, Protocol · Full entry}
• awesome-rea (yibie): verification-focused projects and practice reports - Organizes AI-assisted game decompilation, native ports, static recompilation and tooling around stated acceptance checks, alongside a separate track of practitioner write-ups and discussions. _{Collection · Community REA · Targets: Game, Binary · Full entry}
• Reversed with AI - A moderated website directory of AI-assisted reverse-engineering projects across games, firmware, file formats, APIs and protocols, apps and legacy software. _{Collection · Community REA · Targets: Game, App, Binary, Firmware, Protocol · Full entry}
• Awesome Malware Analysis - A long-running single-README list of malware analysis tools and resources, grouped into 17 top-level sections covering open-source threat intelligence, detection and classification, online scanners and sandboxes, document and shellcode analysis, deobfuscation, debugging and reverse engineering, network, memory forensics, Windows artifacts, plus books and other references. _{Collection · Targets: Binary · Full entry}
• Awesome Connected Things Security - A single-README list of security-research references for IoT, embedded, industrial and automotive systems, organized into sections on hardware attacks, wireless protocols (BLE, Zigbee/Z-Wave, LoRa, Matter/Thread, cellular, NFC/RFID, Wi-Fi, USB), firmware security including extraction, static and dynamic analysis and secure boot, network and web protocols, cloud backends, mobile apps, and industrial and automotive topics. _{Collection · Targets: Firmware, Protocol · Full entry}
• Awesome CAN Bus - A single-README list of CAN bus tools, hardware and resources for automotive and embedded work, grouped into sections for reverse-engineering tools, test equipment and simulators, higher-layer protocols (OBD-II, UDS, ISO-TP, J1939, J2534), general and Linux utilities, CAN database formats (DBC, KCD) with converters, and hardware for ARM, Arduino, ESP32, single-board computers and FPGA cores. _{Collection · Targets: Firmware, Protocol · Full entry}
• Awesome CAN ID - A single-README list that gathers links to CAN message identifier and payload decodings in one place, grouped by vehicle make and model under about 30 car brands and brand groups plus BMW, Ducati and KTM motorcycles. _{Collection · Targets: Protocol · Full entry}
• Awesome REA: Reverse Engineer Anything with AI (AIshihzong) - An unofficial, bilingual awesome list of what AI agents have reverse-engineered and rebuilt, tagged by whether each case's own sources show that REA was used. _{Collection · Community REA · Targets: Game, App, Binary, Protocol · Full entry}
• AI Rebuilds - A website and GitHub list of 81 projects that rebuild existing software or games without the original source: AI-built clean-room apps such as the ArtCraft suite, software rewritten with coding agents, AI-assisted game decompilations, game engine reimplementations, human-led decompilations and ports, clean-room classics such as Wine and ReactOS, and tools for rebuilders. _{Collection · Community REA · Targets: Game, App, Binary · Full entry}
• awesome-game-decompilations - A single-README list of about 480 game decompilation, recompilation and disassembly projects, grouped by console from the NES and Game Boy to the Xbox 360, PC and mobile, with a large uncategorised section. _{Collection · Targets: Game · Full entry}
• Awesome Decomp Games - A generated, rated index of public game reconstruction projects: decompilations, disassemblies, static recompilations, source ports, engine remakes and browser ports. _{Collection · Targets: Game · Full entry}
• awesome-unofficial-pc-ports - A single-README guide to unofficial PC ports of console games built from decompilations or recompilations and chosen for easy installation by players. _{Collection · Targets: Game · Full entry}
• awesome-decompilation - A short, link-only reading list on decompiling machine code, last updated in 2023. _{Collection · Targets: Binary · Full entry}
• Remade - The source repository of remade.wiki, a community-curated directory of open-source reimplementations of closed-source software, mostly creative, productivity and engineering applications. _{Collection · Targets: App · Full entry}
• Reverse Engineering resources (wtsxDev) - A single-README awesome list, started in January 2017 and maintained under the KaliTut name, of 139 reverse-engineering links in 16 sections: books, courses, practice targets, hex editors, binary-format tools, disassemblers, binary analysis, bytecode analysis, import reconstruction, dynamic analysis, debugging, Mac decryption, document analysis, scripting, Android and YARA. _{Collection · Targets: App, Binary · Full entry}
• Awesome Android Reverse Engineering - An awesome list of Android reverse-engineering training, tools and resources started in 2023 by James Stevenson, with 92 one-line entries, 16 of them starred as great and up to date. _{Collection · Targets: App · Full entry}
• Awesome Frida - An awesome list of libraries, scripts, tools, talks and articles built on or about Frida, the dynamic instrumentation toolkit, started by David Weinstein in May 2016. _{Collection · Targets: App, Binary · Full entry}
• Awesome Ghidra - An awesome list of Ghidra scripts, plugins, extensions, learning materials and related services, kept by the Allsafe GitHub organization since December 2019. _{Collection · Targets: Binary · Full entry}
• PRE-list - A table-based reading list of 71 research papers on automatic protocol reverse engineering for network protocols, from the Protocol Informatics project (2004) to NetPlier (2021). _{Collection · Targets: Protocol · Full entry}
• awesome-reverse-engineering (alphaSeclab) - Large reverse-engineering link list, auto-exported in 2019 in English and Chinese, with abridged and full README versions. _{Collection · Targets: App, Binary · Full entry}
• awesome-mobile-security - A single-README list of Android and iOS application security resources, about 245 links in all, divided by platform into blogs, papers and how-tos, books, courses, tools, deliberately vulnerable lab apps, talks and miscellany. _{Collection · Targets: App · Full entry}
• Awesome Executable Packing - A single-README list of resources on executable packing, meaning the bundling, compression, encryption, mutation, protection or virtualization of PE, ELF and other executables, including Android apps, and on detecting and unpacking packed files. _{Collection · Targets: App, Binary · Full entry}
• Awesome AI Reverse Engineering - A single-README, Chinese-language list of AI-assisted reverse-engineering projects, grouped into JavaScript reversing, binary and native analysis, Android and iOS security, and browser automation and traffic analysis. _{Collection · Targets: Website, App, Binary · Full entry}
• Interactive IDA Plugin List - A sortable, filterable list of 618 plugins, loaders, processor modules and scripts for Hex-Rays' IDA Pro, published as a GitHub Pages table with a static copy generated into the README. _{Collection · Targets: Binary · Full entry}
• Awesome RE-MCP - A single-README list, written in July 2025, of 28 MCP servers for reverse-engineering tools, grouped into disassemblers and decompilers (IDA Pro, Ghidra, Binary Ninja and others), debuggers, static and dynamic analysis, network analysis, Android and security testing, with a one-line note per entry. _{Collection · Targets: App, Binary · Full entry}
• RE list (extremecoders-re) - A single-README list of 71 open-source reverse-engineering tools with a focus on binary analysis, kept as one alphabetical list from Amoco to X86isa. _{Collection · Targets: Binary · Full entry}
• awesome-te - A public-domain directory, started in June 2026, of hacking projects for Teenage Engineering devices: custom firmware, reverse-engineering notes and protocol documentation, tools, hardware mods, teardown and recovery guides and community hubs for the OP-1, OP-Z, OP-XY, TP-7, SP-1 Stem Player, EP series, Pocket Operators and other gear. _{Collection · Targets: Firmware, Protocol · Full entry}
• Awesome UEFI Security - A single-README awesome list of UEFI and BIOS security material, which its maintainer describes as a personal and not comprehensive collection. _{Collection · Targets: Firmware · Full entry}
• Firmware-Analysis-Papers - A single-README reading list of 28 academic security papers on firmware and embedded-system analysis, grouped by year from 2013 to 2021. _{Collection · Targets: Firmware · Full entry}
• OpenDeviceDB - OpenDeviceDB indexes devices with existing firmware or protocol reverse-engineering work and links back to source projects. _{Collection · Targets: Firmware, Protocol · Full entry}
• Malware Analysis & CTI Reports - Malware Analysis & CTI Reports collects ten PDF investigations of malware, security tools and binaries with disputed detections. _{Collection · Targets: Binary · Full entry}

References and Learning

↑ Contents

• Installation and client setup - Reviewed setup plans, client registration, provider prerequisites and scoped readiness checks. _{Documentation · Official REA · Targets: Website, Game, App, Binary, Firmware · Full entry}
• CLI and Evidence - CLI workflows for saving Evidence and projecting smaller views from completed analysis. _{Documentation · Official REA · Targets: Website, Game, App, Binary, Firmware · Full entry}
• MCP contracts and generated catalog - Canonical tool contracts, provider discovery and Evidence semantics for integration authors. _{Documentation · Official REA · Targets: Website, Game, App, Binary, Firmware · Full entry}
• Native binary investigation - Locate a function, inspect instructions and pseudocode, and follow references with a selected native provider. _{Documentation · Official REA · Targets: Game, Binary · Full entry}
• Cross-layer JavaScript application workflows - Trace features and compare authenticated JavaScript application graphs while preserving static-analysis limits. _{Documentation · Official REA · Targets: Website, App · Full entry}
• Static Android APK analysis - Inspect Android package identity, classes, methods and references through REA's JADX integration. _{Documentation · Official REA · Targets: App · Full entry}
• Managed-code analysis - Read PE/CLI metadata and CIL, compare managed members and inspect declared native boundaries without loading the assembly. _{Documentation · Official REA · Targets: App · Full entry}
• Historical web network captures - Inspect saved web captures offline; recorded URLs are not fetched and no proxy is started. _{Documentation · Official REA · Targets: Website, App, Protocol · Full entry}
• Firmware analysis - Inspect firmware regions with Binwalk and explicitly extract with Unblob, retaining tool and artifact identity. _{Documentation · Official REA · Targets: Firmware · Full entry}
• Recorded packet capture inspection - Select TShark fields, display filters and decode-as rules over an existing network, USB or Bluetooth capture, and look up installed field names. _{Documentation · Official REA · Targets: Protocol · Full entry}
• Packet capture summaries - Summarize a saved pcap or pcapng file’s endpoints, DNS questions and addresses, TLS SNI, protocol stacks and HTTP URIs into paged Evidence views. _{Documentation · Official REA · Targets: Protocol · Full entry}
• Recorded signal decoding - Run caller-chosen sigrok protocol decoders, such as UART or I2C, over an existing logic-signal recording and keep annotation text with sample ranges. _{Documentation · Official REA · Targets: Firmware, Protocol · Full entry}
• Browser observation guide - Follow a user-triggered export request in the supplied Notes browser example and connect it to the downloaded result. _{Documentation · Official REA · Targets: Website · Full entry}
• JavaScript and Electron: follow a CSV export - A source-owned Notes fixture teaches the renderer, preload, IPC and CSV path with linked analysis evidence. _{Documentation · Official REA · Targets: App · Full entry}
• rea-playbook - An Electron practice target, Evidence extractor and MCP probe; offline fixture mode is distinguished from real REA analysis. _{Learning resource · Community REA · Targets: App · Full entry}
• rea-lab - A Windows REA/Ghidra lab with seeded challenges, published studies, upstream contributions and recorded limitations. _{Research · Community REA · Targets: Binary · Full entry}
• Flutter build identification - Identifies a Flutter APK’s Dart snapshot hash, per-ABI library digests and engine build provenance, then inspects one ABI’s AOT snapshot sections, through REA’s pure-parsing CLI and MCP tools. _{Documentation · Official REA · Targets: App · Full entry}
• Static HarmonyOS package inventory - Inventories HarmonyOS HAP, HSP and App Pack files through REA’s hardened ZIP reader and projects an execution-free application graph: component paths, IDs and hashes, Stage/FA packaging hints, runtime-family hints and path-based native-bridge hypotheses. _{Documentation · Official REA · Targets: App · Full entry}
• MIPS ELF analysis through Ghidra - Documents REA’s Ghidra lane for MIPS ELF executables, relocatable objects and MIPS16 shared images, including a pinned 32-bit language for recordless legacy firmware executables that Ghidra would otherwise import as 64-bit. _{Documentation · Official REA · Targets: Binary, Firmware · Full entry}
• PSP static ELF analysis through Ghidra - Documents REA’s bounded Ghidra profile for static PSP ELF executables, which leaves Allegrex instructions, PSP loading and calling conventions to a caller-installed ghidra-allegrex extension while reusing REA’s CLI, MCP, Evidence and snapshot workflows. _{Documentation · Official REA · Targets: Game, Binary · Full entry}
• NativeAOT metadata recovery with Ghidra - Recovers .NET 8 NativeAOT metadata from x64 PE executables during REA’s Ghidra analysis: MethodTable relationships, virtual slots and frozen strings from RTR 9.1 data, through a built-in read-only parser or an optional headless adapter that annotates the Ghidra database. _{Documentation · Official REA · Targets: Binary · Full entry}
• REA & AI RE Tools Guide (unofficial) - An unofficial, independently run guide to installing REA and connecting it to coding agents, in 32 pages: install paths for npx, npm and Bun including Windows, MCP setup for Claude Code and Desktop, Codex, Cursor, Windsurf and Gemini CLI, a config generator for 24 clients, Ghidra, IDA and JADX provider setup, and troubleshooting pages that match exact error text to upstream REA issues. _{Learning resource · Community REA · Targets: Website, App, Binary · Full entry}
• OpenSecurityTraining2 - Free self-paced security courses with learning paths for reverse engineering, firmware and systems foundations. _{Learning resource · Targets: Binary · Full entry}
• pwn.college: Reverse Engineering - Hands-on reverse-engineering module covering functions, data access, static tools and dynamic tools with hosted exercises. _{Learning resource · Targets: Binary · Full entry}
• Reverse Engineering for Beginners - Dennis Yurichev's free book on understanding compiled programs and assembly, available in multiple languages. _{Learning resource · Targets: Binary · Full entry}
• The Official Radare2 Book - Official practical reference for radare2 analysis, disassembly, scripting, debugging and related plugins. _{Learning resource · Targets: Binary · Full entry}
• Finding Jingle Town: Debugging an N64 Game without Symbols - A walkthrough from the Snowboard Kids 2 decompilation project on attaching gdb-multiarch to the Ares emulator while the matching build still cannot carry debug information. _{Learning resource · Targets: Game · Full entry}
• JPCERT/CC: APK analysis and API probing on attack servers - JPCERT/CC’s 15 October 2026 blog post on the infrastructure behind a series of unauthorized-access incidents in Japan. _{Learning resource · Targets: App · Full entry}
• Reverse Engineering (mytechnotalent) - A free, English lesson index by mytechnotalent that grows almost daily: 490 numbered lessons, most of which have learners write small programs and then debug and patch ("hack") them, across x86, x64, 32/64-bit ARM, RISC-V and AVR. _{Learning resource · Targets: Binary, Firmware · Full entry}
• Z0FCourse Reverse Engineering - A free English course by Z0F on reverse engineering 64-bit Windows programs, which its README pitches as taking learners from beginner to intermediate. _{Learning resource · Targets: Binary · Full entry}
• OWASP Mobile Application Security Testing Guide (MASTG) - OWASP’s open manual for Android and iOS app security testing and reverse engineering, published at mas.owasp.org. _{Learning resource · Targets: App · Full entry}
• The Decompilation Wiki - Community wiki explaining how decompilers work, from disassembly, lifting and control-flow recovery to type recovery, control-flow structuring, quality evaluation and neural decompilation, citing the research behind each technique. _{Learning resource · Targets: Game, Binary · Full entry}
• Frontkick vs Rikugan: a CREBench agent comparison - Matthieu Breuil’s Synacktiv article explains tool-calling and code-executing agent designs and describes Frontkick, a CodeAct agent that runs generated Python inside Binary Ninja. _{Learning resource · Targets: Binary · Full entry}
• FLARE Learning Hub - Free English reverse-engineering and malware-analysis modules from Mandiant's FLARE team, published as Google Docs, with lab binaries, IDA databases and scripts kept in this repository. _{Learning resource · Targets: Binary · Full entry}
• Nintendo Switch Reverse Engineering - Notes begun by dekuNukem in 2017 and extended by contributors on how the Joy-Con, Pro Controller and parts of the Switch console and dock work, worked out from teardowns, logic-analyzer captures and packet logs. _{Learning resource · Targets: Firmware, Protocol · Full entry}
• Android App Reverse Engineering 101 - Maddie Stone's free English workshop introducing static reverse engineering of Android apps, published as GitHub Pages. _{Learning resource · Targets: App, Binary · Full entry}
• Reverse Engineering iOS Applications - Ivan Rodriguez's free English course (version 1.1) on reverse engineering iOS applications, aimed at beginners in iOS app security. _{Learning resource · Targets: App, Binary · Full entry}
• tiny-dec - Zhuo Zhang's small educational decompiler for 32-bit RISC-V (RV32I) ELF files, written in Python to teach how decompilation works rather than to compete with production decompilers. _{Learning resource · Targets: Binary · Full entry}
• Reverse Engineering Reading List - A short reading list, compiled by One Thawt mostly in 2015–2016, of about 58 links to reverse-engineering tools, books, papers, talks and blog posts, kept in a README and a separate malware-analysis page. _{Learning resource · Targets: Binary · Full entry}
• Decomp Academy - A free, English, in-browser course in matching decompilation maintained by Jack Price-Burns: learners read a function's target assembly, write C, and the original console compiler grades the result byte for byte. _{Learning resource · Targets: Game, Binary · Full entry}
• OWASP Firmware Security Testing Methodology (FSTM) - A free English methodology, maintained by Aaron Guzman and published on GitBook, for security testing and reverse engineering embedded-device firmware. _{Learning resource · Targets: Firmware · Full entry}
• Emproof workshop: Firmware Reverse Engineering - Slides and 14 self-contained exercises from Emproof's firmware reverse-engineering workshop at ScapyCon Automotive 2025, designed by Tim Blazytko for a technical audience with little security experience. _{Learning resource · Targets: Binary, Firmware · Full entry}
• iOS App Reverse Engineering - Freely published 2015 book by snakeninny and hangcom on reverse engineering iOS apps, distributed in its repository as a 442-page English PDF. _{Learning resource · Targets: App · Full entry}
• Frida Snippets - A single large README that collects hand-written Frida instrumentation examples, grouped into Native, Android and iOS sections, for observing how a running app behaves. _{Learning resource · Targets: App · Full entry}
• iOSRE: iOS Reverse Engineering reference - A community-maintained reference on iOS reverse engineering started by kpwn, built from a wiki, a curated index of public technical papers and talks, and a few environment-setup scripts. _{Learning resource · Targets: App, Binary, Firmware · Full entry}
• linux-re-101 - Michal Malik’s single-README reading list for Linux reverse engineering, with about 230 links and book titles that run from quick references on system calls, ELF and processor ABIs through 101 and 201 tiers on program start-up, linking and relocations. _{Learning resource · Targets: Binary · Full entry}
• Frida Labs - Eleven Android challenge apps with step-by-step write-ups for learning Frida instrumentation, progressing from setting up frida-server and hooking a Java method through calling static methods, changing fields, creating instances and hooking constructors to hooking, calling and patching native functions. _{Learning resource · Targets: App · Full entry}
• osx & ios re 101 - A single-README reading list for macOS (OS X) and iOS reverse engineering, kept by Michal Malik from 2015 to 2019 and labelled a work in progress. _{Learning resource · Targets: App, Binary · Full entry}
• AndroidReverse101 - A Chinese-language Android reverse-engineering course by Evil0ctal, planned as 100 daily lessons. _{Learning resource · Targets: App · Full entry}
• Ghidra Snippets - A single-page collection of 30 commented Python examples for scripting Ghidra, grouped by task: projects, programs, functions and cross-references, basic blocks, instructions, stack variables, decompiler output, comments, P-code emulation and dumps, call graphs and program slices. _{Learning resource · Targets: Binary · Full entry}
• Frida Boot: a beginner binary instrumentation workshop - A beginner workshop by leonjza on binary instrumentation with Frida, served as offline pages from a Docker container that has gdb with GEF and frida-tools preinstalled. _{Learning resource · Targets: Binary · Full entry}
• Embedded Hacking (mytechnotalent) - A free English course by mytechnotalent on developing, debugging and reverse engineering firmware for the Raspberry Pi Pico 2 (RP2350, Arm Cortex-M33). _{Learning resource · Targets: Firmware · Full entry}
• Reverse-Engineering a Bluetooth-Enabled Radar Detector - Write-up of how the author decoded the Bluetooth RFCOMM protocol of a Cobra iRAD 900 radar detector so that a Raspberry Pi 3 could receive alerts without the iOS or Android app. _{Learning resource · Targets: Protocol · Full entry}
• Link Pi ENCx encoders (unofficial documentation) - A single-README notebook, kept since 2021 by an owner with no ties to the vendor, on the internals of LinkPi ENC-series video encoders and the TBS 2603SE, which share one firmware line; the author's first units use the F3520D board with a HiSilicon Hi3520DV400. _{Learning resource · Targets: Firmware · Full entry}
• Supplementary AST-Based Deobfuscation Materials - Companion code for the ReverseJS blog's 2022 series on deobfuscating JavaScript by manipulating abstract syntax trees with Babel. _{Learning resource · Targets: Website · Full entry}
• MCP Reversing Dataset (mrexodia) - Three worked examples by mrexodia of a language model reverse-engineering crackme binaries in IDA Pro through his IDA Pro MCP server. _{Learning resource · Targets: Binary · Full entry}
• ICSim (Instrument Cluster Simulator) - OpenGarages' Instrument Cluster Simulator for practising CAN bus reverse engineering on a Linux virtual CAN interface instead of a car. _{Learning resource · Targets: Protocol · Full entry}
• CNNPRE (IEEE Access 2023) - Research code and data for CNNPRE, a message-type identification method for protocol reverse engineering by Javad Garshasbi and Mehdi Teimouri, published in IEEE Access in 2023. _{Research · Targets: Protocol · Full entry}
• RPISEC Malware Analysis course (CSCI 4976) - Materials from the student-run Malware Analysis course that RPISEC taught at Rensselaer Polytechnic Institute in Fall 2015, built around the book Practical Malware Analysis. _{Learning resource · Targets: Binary · Full entry}
• Corkami pics - Collection of posters and diagrams that dissect file formats byte by byte, published as PNG and PDF images. _{Learning resource · Targets: Binary · Full entry}
• Practical Malware Analysis - No Starch Press book, published in February 2012, that teaches hands-on malware analysis from basic static and dynamic techniques in virtual machines through x86 disassembly with IDA Pro, debugging with OllyDbg and kernel debugging with WinDbg. _{Learning resource · Targets: Binary · Full entry}
• Windows Malware Analysis training, volume 1 (malware_training_vol1) - Slides and exercises for a Windows malware analysis training that builds an understanding of common malware techniques through programming, reverse engineering and Windows internals, and shows how analysis tools are used for particular goals. _{Learning resource · Targets: Binary · Full entry}
• esp-idf-injection-ng - esp-idf-injection-ng documents an investigation of ESP-IDF's compiled libnet80211.a frame-type check. _{Research · Targets: Binary · Full entry}
• RE-Workstation - RE-Workstation is a Chinese reference library for reverse-engineering workflows and related security research. _{Learning resource · Targets: Website, App, Binary, Firmware · Full entry}
• Walksnail Ascent VRX UART Protocol - Walksnail Ascent VRX UART Protocol documents serial control messages for Walksnail video receivers and supplies a C reference transmitter with an STM32 example. _{Documentation · Targets: Protocol · Full entry}
• T2 platform research - T2 platform research maps Apple T2 firmware, hardware and Linux-facing interfaces using static analysis, hardware observations and driver comparisons. _{Research · Targets: Firmware, Protocol · Full entry}
• Glaurung Models - Glaurung Models contains tokenizer and model experiments for executable analysis. _{Research · Targets: Binary · Full entry}
• CrackMes - CrackMes is a set of walkthroughs for purpose-built crackme binaries from crackmes.one. _{Learning resource · Targets: Binary · Full entry}
• Binary BPE Tokenizer for Executable Analysis - Binary BPE Tokenizer for Executable Analysis studies byte-pair encoding of ELF, PE, Mach-O and APK files for transformer-based binary analysis. _{Research · Targets: App, Binary · Full entry}
• Assassin's Creed III online service docs - Assassin's Creed III online service docs record method IDs and request and response fields for the PC game's online services. _{Documentation · Targets: Game, Protocol · Full entry}
• AC4 docs - AC4 docs records online service interfaces for the PC version of Assassin's Creed IV Black Flag. _{Documentation · Targets: Game, Protocol · Full entry}
• eRepublik API Documentation - eRepublik API Documentation maps endpoints observed in the browser-based strategy game's web client. _{Documentation · Targets: Website, Game · Full entry}
• Garmin Strength Workout API - Garmin Strength Workout API documents payloads for creating strength workouts through Garmin Connect's undocumented API. _{Documentation · Targets: Website, Protocol · Full entry}
• Substack API Reference (Unofficial) - Substack API Reference documents the web app's undocumented JSON API using curl probes and captured browser requests. _{Documentation · Targets: Website, Protocol · Full entry}
• hyperscan-homebrew - hyperscan-homebrew documents Mattel HyperScan hardware behavior for homebrew and emulation work. _{Documentation · Targets: Protocol · Full entry}
• Локальный аудиостриминг на Яндекс.Станцию - Local audio streaming on Yandex Station is a technical guide to the device’s Glagol WebSocket control channel and its HTTP audio-stream behavior. _{Documentation · Targets: Protocol · Full entry}
• Hacking the Xbox — 日本語訳 - Hacking the Xbox — 日本語訳 publishes a Japanese translation of a book on Xbox reverse engineering. _{Learning resource · Targets: Firmware · Full entry}
• Spelunking - Spelunking studies Apple apps, private frameworks and system services with Swift and Objective-C probes. _{Research · Targets: App, Binary · Full entry}
• whatsapp-docs - whatsapp-docs records findings from static decompilation of the WhatsApp Android APK, covering app internals and communication formats. _{Documentation · Android · Targets: App, Protocol · Full entry}
• RtG-Format - RtG-Format documents the observed save and construction format of the Roblox game Road To Gramby's. _{Documentation · Targets: Game · Full entry}

Papers

235 papers, grouped by topic and ordered newest first in the full paper list. The 10 most recent are below; each line shows the study’s opening sentence, venue, publication status and first author.

Full paper list · Browse the paper directory · Complete bibliography JSON · Suggest a paper

By topic: Agent evaluation (14) · Decompilation (110) · Websites (31) · Games (15) · Apps (16) · Firmware (27) · Protocols (22)

Each paper’s “Full entry” holds its complete summary, scope and limitations, all authors and citation.

Most recent papers

↑ Contents

• Locate, Then Reason: End-to-End Patch Presence Testing in Stripped Binaries - Locates patch-relevant code in stripped binaries using instruction-aligned retrieval and caller/callee context, then uses an LLM to screen candidate matches and compare patch-specific behavior with vulnerable and patched references. _{arXiv 2026 · Preprint · Huaijin Wang et al. · PDF · Full entry}
• Recall-Oriented Precise Binary-to-Source Function Matching - BScout matches decompiled functions to a source corpus using chunked embeddings and inlining-aware training. _{arXiv 2026 · Preprint · Junlin Li et al. · PDF · Full entry}
• Decoding What iOS Location Services Send to Apple: An LLM Is an Unreliable Analyst but a Useful Toolmaker - Compares direct LLM recovery of Apple PBCodable schemas with an AI-written Extractor checked against compiled synthetic fixtures, published descriptors and captured traffic. _{arXiv 2026 · Preprint · Douglas Leith · PDF · Code · Full entry}
• PrismaCoder: Pushing the Boundaries of Open Multimodal Code Intelligence through Decomposed Rubric Synthesis - Trains visual-code models using separate code and rendered-output rubrics for data filtering and reinforcement learning. _{arXiv 2026 · Preprint · Qiushi Sun et al. · PDF · Full entry}
• State-Aware Generation of Deployable Websites from Visual Prototypes and Requirements - VisStateCoder links visual prototype elements, project files, interaction requirements and render evidence in a project state graph, then uses those links to generate websites and limit subsequent repairs to selected files. _{arXiv 2026 · Preprint · Ruwei Pan et al. · PDF · Full entry}
• Humans vs. Machines: A Comparison With AI Agents in Software Reverse Engineering - Compares human and LLM-agent understanding and navigation on the same static reverse-engineering challenges, then studies how binary representations consume context windows. _{arXiv 2026 · Preprint · Samuele Doria et al. · PDF · Full entry}
• SoK: Are LLMs Reliable at Source Code Recovery? A Taxonomy and Empirical Evaluation - This SoK organizes LLM-assisted source-recovery designs and separates compilation, readability, structural and behavioral metrics. _{arXiv 2026 · Preprint · Varun Kohli et al. · PDF · Code · Full entry}
• The CodeInverter Suite: Structure- and Data-Aware Binary Decompilation with Efficient LLMs - CodeInverter studies function-level LLM decompilation using control-flow graphs and memory-to-data mappings extracted with IDA/objdump. _{ASE 2026 · Conference paper · Peipei Liu et al. · PDF · Code · Full entry}
• TaoD2C-Bench: Benchmarking MLLMs for Industrial UI Code Generation Beyond Visual Fidelity - TaoD2C-Bench reconstructs interfaces from design images, layer metadata and component-library documentation. _{arXiv 2026 · Preprint · Chengwei Shi et al. · PDF · Full entry}
• Beyond Text Matching: Towards Reference-Free Evaluation for Human-Oriented Binary Reverse Engineering - BinJudgeBench collects expert judgments for function naming, binary-code summaries and decompilation refinement. _{ASE 2026 · Conference paper · Xiuwei Shang et al. · PDF · Full entry}

Full Repository Index

This published selection contains 3,500 captured repository records and 3,309 browsable entries. 187 scope-excluded entries and 4 whose upstream repository is no longer available remain in the published JSON. These entries are discovered automatically and unreviewed.

Browse by category on GitHub · Search website · Full bilingual index JSON · Curated catalog JSON

The resource list above is curated from primary sources. Detailed requirements, original evidence, and review dates are available in the catalog data.

Contributing

Help improve an entry or share a useful source. Start with the contribution guide, then suggest a resource, recommend a paper, correct a translation or report an outdated entry.

About

REA (Reverse Engineer Anything) is a separate upstream CLI and MCP project, and this collection takes its name from it. “REA” in entry tags and labels such as “Official REA documentation” refers to that project.

Original descriptions and code are MIT licensed; linked projects retain their own licenses.

To cite the collection itself, use its citation metadata. Cite listed papers, tools and other works from their own primary sources, and give the commit or snapshot date with any scan-derived counts.

For AI-built software and agent training or evaluation resources, explore AI Can What? across games, websites and applications.

Star History

Explore the interactive star history.

---

Catalog format · Scan methodology · Build status · Back to top