Runtime and debugging.

An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.

Main repo for hosting release binaries

Record and Replay Framework

A True Instrumentable Binary Emulation Framework

Dynamic Instrumentation Tool Platform

x64dbg-MCP Server is a native MCP (Model Context Protocol) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Connect any MCP-compatible AI assistant and control x64dbg programmatically: set breakpoints, step through code, read memory, dump registers, and more. Built with Zig — zero dependencies, single-binary output, cros

ret-sync is a set of plugins that helps to synchronize a debugging session (WinDbg/GDB/LLDB/OllyDbg2/x64dbg) with IDA/Ghidra/Binary Ninja disassemblers.

A Dynamic Binary Instrumentation framework based on LLVM.

Radare2 and Frida better together.

A collection of excellent reverse engineering articles I have read, well worth a look.

Most usable tools for iOS penetration testing

Open-source AI reverse-engineering agent platform and MCP server for Ghidra, Frida, x64dbg and Rizin — automated PE/APK/binary analysis, CTF and malware research, with 100+ MCP tools and a 194-article runnable knowledge base.

A tool that helps you easy trace classes, functions, and modify the return values of methods on iOS platform

Reversense (Dexcalibur2) is a fully rewriting and rethinking of Dexcalibur. Reversense is a binary intelligence platform that automates the reverse engineering of mobile and embedded applications.

Cross-platform decryption of QQ chat databases

Cross-platform instrumentation and introspection library written in C

Go all-in on AI-powered reverse engineering.

DyninstAPI: Tools for binary instrumentation, analysis, and modification.

Notes on interesting things I encounter while learning Android reverse engineering.

Frida core library

Labeless is a multipurpose IDA Pro plugin system for labels/comments synchronization with a debugger backend, with complex memory dumping and interactive Python scripting capabilities.

Wechaty Puppet WeChat Windows Protocol

tool to extract passwords from TeamViewer memory using Frida

Bidirectional XPC message interception and more. Powered by Frida

Run a more undetectable frida server on boot using magisk 🔐✅

Work in progress...

A persistence solution for Frida

A comprehensive binary emulation and instrumentation platform.

Patch iOS Apps, The Easy Way, Without Jailbreak.

A low-overhead dynamic binary instrumentation and modification tool for ARM (both AArch32 and AArch64 support) and RISC-V (RV64GC).

Cycript fork powered by Frida.

Human-friendly cross-platform system call tracing and hooking library based on Frida's Stalker

Use Frida to retrieve functions dynamically registered through JNI RegisterNatives.

Java Dynamic Reverse Engineering and Debugging Tool

gdbghidra - a visual bridge between a GDB session and GHIDRA

Frida Boot 👢- A binary instrumentation workshop, with Frida, for beginners!

A Python library to debug binary executables, your own way.

fpicker is a Frida-based fuzzing suite supporting various modes (including AFL++ in-process fuzzing)

frick - aka the first debugger built on top of frida

Data Visualization Plugin for IDA Pro

Use angr in the IDA Pro debugger generating a state from the current debug session

Script to Automate installtion of Apps ,frida server and moving Burpsuite certificate to root folder

frida runtime (no python required, only a single file),One-click support for ios dump

Trace APIs declaratively through Frida.

Package your Frida script into an executable.

WinDbg-like kernel debugger for Windows, from Linux and macOS

Deluder is a tool for intercepting traffic of proxy unaware applications. Currently, Deluder supports OpenSSL, GnuTLS, SChannel, WinSock and Linux Sockets out of the box. ⚡

This repo aims at providing practical examples on how to use r2frida

An AI-agent skill system for mobile reverse engineering: Frida hooks, one-click unpacking, anti-detection bypasses, in-memory DEX dumps, and symbol/structure recovery through Ghidra MCP.

Tool to decrypt iOS apps using r2frida

iOS library (SDK) providing app security and threat monitoring. Shield your app with free RASP. Detect reverse engineering, jailbreak, Frida, emulators, bots, signature and integrity issues, VPN usage, and monitor device identification and more.

GUI for Frida -Scripts

disassembler, decompiler and debugger in one, with a built-in mcp server: point an ai at a binary and it can debug it, not just read it. ida-style listing, pseudocode (f5), x64dbg-style debugger (windows and linux), binary diff, lua plugins. reads pe, elf and mach-o. runs on windows, linux and macos.

An interactive disassembler for the CPU 6502, focused on Commodore 8-bit computers. Features a TUI with modern features like x-ref, undo/redo, flow arrows, keyboard-driven, MCP server for auto analysis, VICE debugger and more!

SDA is a rich cross-platform tool for reverse engineering that focused firstly on analysis of computer games. I'm trying to create a mix of the Ghidra, Cheat Engine and x64dbg. My tool will combine static and dynamic analysis of programs. Now SDA is being developed.

Random things

A set of plugins for Ghidra and x64Dbg synchronization. A faster, more flexible ret-sync.

SherlockElf is a powerful tool designed for both static and dynamic analysis of Android ELF binaries and dynamic iOS Macho-O binaries (experimental).

Extension for GDB

Full-stack mobile game-security research (Honor of Kings / sgame): kernel-mode cross-process memory reading (KernelPatch KPM), Tencent ACE anti-cheat & IL2CPP/native engine reverse engineering, and a real-time ESP overlay. Educational / research only; no proprietary binaries.

XDV is disassembler or debugger that works based on the extension plugin.

MCP server for Frida.

Use angr inside the radare2 debugger. Create an angr state from the current debugger state.

The Native Reverse Engineering IDE. Zero-overhead binary analysis, full CPU emulation (PE/ELF), and headless automation. Powered by Capstone, Unicorn, LLVM & Remill via N-API.

MCP server for Frida 17 dynamic instrumentation

A reverse-engineering toolkit for iOS and Android applications (Frida, mitmproxy, Ghidra, Theos)

Reverse-engineering skills for AI coding agents, with IDA/MCP integration, APK and JavaScript workflows, bounded agent swarms, and routing evaluation.

Custom-built for dsh (DeepSeek Harness): a persistent Ghidra headless daemon and reverse-engineering agent skills (triage/unpack/decompile/pwn/pcap/APK), with circuit breakers against agent failure loops and skills that evolve through retrospectives.

Dart AOT snapshot analyzer: exports blutter-compatible symbols and structs for IDA / radare2 / Frida, and decompiles functions into dart-analyze-clean Dart. Desktop and real-device mobile (compressed pointers), Dart 2.7-3.14. No Dart SDK, never runs the target.

Dynamic branch-divergence finder for native code -- traces two Frida executions and finds the exact instruction where they diverge.

Personal reverse engineering toolbox with custom tools, scripts, and malware analysis notes.

Expert reverse engineer specializing in binary analysis, malware research, and low-level system internals. Experienced in dissecting complex software, uncovering vulnerabilities, and understanding code beyond source-level abstraction

🛡️ Mobile-first Interactive Disassembler & Decompiler Framework — IDA Pro / Ghidra-class RE on Android. APK · ELF · PE · DEX · ARM64 · x86-64 · IR decompiler · call graph · ptrace debugger · SakoScript plugins. Created by Maxamed Xasan Muse 🇸🇴

Offset Zero: A free, open-source field guide to digital forensics, reverse engineering, and detection engineering. Start at the first byte. YEAHH, ITS MORE OF A MINDSET!

An Electron-based AI workbench for CTF reverse-engineering challenges on Windows. It combines an AI tool loop with local validation, connects to IDA, JEB, and Burp through MCP, and automatically tackles APK, PE, ELF, PYC, DEX, JAR, Mach-O, Lua, and Web-JS challenges. Includes 11 methodology skills, a 54-page structured knowledge base, and self-improvement from experience.

Deterministic binary analysis, runtime instrumentation & protocol reverse-engineering skill for AI coding agents.

Give your reverse-engineering agent a memory, a map, and receipts.

Reverse engineer APKs and analyze native binaries directly on your Android device without a PC or ADB.

Give a coding agent evidence, not screenshots: local workbench to reverse Android, iOS, desktop and web protocol clients with JADX, radare2, ADB, Frida and live HTTP probes.

An AI-assisted, multi-platform reverse engineering workbench integrating Ghidra, Frida, and MCP. Features zero-dependency triage for APK/ELF/PE, entropy-based packer detection, and strict default-deny authorization for secure, reproducible analysis.

AI-agent-driven mobile reverse-engineering skills: Frida hooks, one-click unpacking, anti-detection bypasses, in-memory DEX dumping, and symbol/structure recovery through Ghidra MCP.

AI-agent-driven mobile reverse-engineering skills: Frida hooks, one-click unpacking, anti-detection bypasses, in-memory DEX dumping, and symbol/structure recovery through Ghidra MCP.

AI-agent-driven mobile reverse-engineering skills: Frida hooks, one-click unpacking, anti-detection bypasses, in-memory DEX dumping, and symbol/structure recovery through Ghidra MCP.

Open-source Android security auditing and ethical hacking toolkit for authorized ADB inspection, APK analysis, reverse engineering, network test Ethical Hacker Toolkit for Android security auditing, reverse engineering, dynamic analysis, network inspection, and APK analysis using ADB, JADX, Apktool, Ghidra, Frida, MobSF and TShark.