Native binaries.

Ghidra is a software reverse engineering (SRE) framework

🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.

UNIX-like reverse engineering framework and command-line toolset

Free and Open Source Reverse Engineering Platform powered by rizin

A FREE comprehensive reverse engineering tutorial covering x86, x64, 32-bit/64-bit ARM, 8-bit AVR and 32-bit RISC-V architectures.

AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.

Program for determining types of files for Windows, Linux and MacOS.

MCP Server for Ghidra

Exploit Development and Reverse Engineering with GDB & LLDB Made Easy

Unicorn CPU emulator framework (ARM, AArch64, M68K, Mips, Sparc, PowerPC, RiscV, S390x, TriCore, X86)

A powerful and user-friendly binary analysis platform!

Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.

GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux

Reverse Engineering: Decompiling Binary Code with Large Language Models

The FLARE team's open-source tool to identify capabilities in executable files.

Reverse engineering focusing on x64 Windows.

Ghidra MCP Server — 200+ MCP tools for AI-powered reverse engineering. GUI plugin + headless server, lazy tool loading, convention enforcement, batch operations, Ghidra Server integration, and Docker deployment.

LIEF - Library to Instrument Executable Formats (C++, Python, Rust)

Disassembly of Pokémon Red/Blue

C++ python bytecode disassembler and decompiler

This tool lets you search your gadgets on your binaries to facilitate your ROP exploitation. ROPgadget supports ELF, PE and Mach-O format on x86, x64, ARM, ARM64, PowerPC, SPARC, MIPS, RISC-V 64, and RISC-V Compressed architectures.

Analyze ELF binaries like a boss 😼🕵️‍♂️

Diaphora, the most advanced Free and Open Source program diffing tool.

Fast and lightweight x86/x86-64 disassembler and code generation library

Triton is a dynamic binary analysis library. Build your own program analysis tools, automate your reverse engineering, perform software verification or just emulate code.

Reverse engineering framework in Python

UNIX-like reverse engineering framework and command-line toolset.

Open-source code analysis platform for C/C++/Java/Binary/Javascript/Python/Kotlin based on code property graphs. Discord https://discord.gg/vv4MH284Hc

IDA plugin which queries language models to speed up reverse-engineering

Agent skills for solving CTF challenges - web exploitation, binary pwn, crypto, reverse engineering, forensics, OSINT, and more

DIE engine

Quickly find differences and similarities in disassembled code

Plasma is an interactive disassembler for x86/ARM/MIPS. It can generates indented pseudo-code with colored syntax.

Powerful automated tool for reverse engineering Unity IL2CPP binaries

Binary Analysis Platform

Reconstruct and validate C/C++ code from compiled programs with AI.

IDA Pro plugin with a rich set of features: decryption, deobfuscation, patching, lib code recognition and various pseudocode transformations

An Agent Skill for designing cross-platform desktop apps that feel native — distilled from Raycast's 2.0 deep-dive and reverse engineering of Raycast Beta.app. Eight architectural tenets, four-layer architecture, WebKit/WebView2 survival guide, 75-item ship audit.

Binary code static analyser, with IDA integration. Performs value and taint analysis, type reconstruction, use-after-free and double-free detection

The Open Source Disassembler

Automated static analysis tools for binary programs

BinAbsInspector: Vulnerability Scanner for Binaries

IDA 2016 plugin contest winner! Symbolic Execution just one-click away!

Heimdall is an advanced EVM smart contract toolkit specializing in bytecode analysis and extracting information from unverified contracts.

Firmware security research platform combining binary analysis, taint tracing, and emulation across IoT, edge AI, mobile devices, and robotics.

An impish, cross-platform binary parsing crate, written in Rust

IDA Pro plugin which improves work with HexRays decompiler and helps in process of reconstruction structures and classes

Free educational content on reverse engineering and malware analysis from the FLARE team

Agent-Native multi-platform reverse engineering and CWE-602 client-side authorization audit workbench.

This project has been moved to:

BARF : A multiplatform open source Binary Analysis and Reverse engineering Framework

Make your IDA Lazy!

A curated list of awesome Ghidra materials

An IDA plugin for binary file analysis, powered by AI models such as OpenAI and DeepSeek.

cwe_checker finds vulnerable patterns in binary executables

Powerful Disassembler Library For x86/AMD64

Public API, examples, documentation and issues for Binary Ninja

Stop your AI from making things up — it proposes, deterministic tools decide, every claim checked against ground truth with evidence. Grounded facts and context survive resets. Reverse engineering is the proving ground. MCP server + CLI.

Advanced Game Hacking Library for C, Modern C++, Rust and Python (Windows/Linux/FreeBSD) (Process/Memory Hacking) (Hooking/Detouring) (Cross Platform) (x86/x64) (DLL/SO Injection) (Internal/External) (Assembler/Disassembler)

PE file viewer/editor for Windows, Linux and MacOS.

The world's first agentic reverse engineer.

Export disassemblies into Protocol Buffers

A reverse engineering tool for decompiling and disassembling the React Native Hermes bytecode

PE Tools - Portable executable (PE) manipulation toolkit

Official Hex-Rays IDA MCP Server.

Scripts for the Ghidra software reverse engineering suite.

A powerful static binary rewriting tool

IDA plugin and loader for UEFI firmware analysis and reverse engineering automation

bddisasm is a fast, lightweight, x86/x64 instruction decoder. The project also features a fast, basic, x86/x64 instruction emulator, designed specifically to detect shellcode-like behavior.

An open source interactive disassembler

No description supplied by the upstream repository.

An integration for IDA and VS Code which connects both to easily execute and debug IDAPython scripts.

Deep ghidra decompiler and sleigh disassembler integration for rizin

Reverse Engineering and Malware Analysis Roadmap

The Official Radare2 Book

Karta - source code assisted fast binary matching plugin for IDA

Deobfuscation via optimization with usage of LLVM IR and parsing assembly.

Python snippets for Ghidra's Program and Decompiler APIs

Vulnerability detection framework by Binarly's REsearch team

An OSINT tool to quickly extract IP and URL endpoints from APKs by disassembling and decompiling

AI-Powered Reverse Engineering Plugin for IDA Pro

A fast and accurate disassembler

MCP server for reverse engineering tasks in Ghidra 👩‍💻

CTF Cheat Sheet + Writeups / Files for some of the Security CTFs that I've done

IDA7.0_SP is ida's bugfix

IPython console integration for IDA Pro

DECAF (short for Dynamic Executable Code Analysis Framework) is a binary analysis platform based on QEMU. This is also the home of the DroidScope dynamic Android malware analysis platform. DroidScope is now an extension to DECAF.

Integrate LLM models directly into Ghidra for AI-enhanced reverse engineering.

No description supplied by the upstream repository.

Python Command-Line Ghidra Binary Diffing Engine

The PE file analysis toolkit

IDA Pro plugin that implements more user-friendly register and stack views

An native MCP server extension for Ghidra

IDA Pro plugin to examine the glibc heap, focused on exploit development

An optimizing decompiler

An LLM extension for Ghidra to enable AI assistance in RE.

Recognize cpu instructions in an arbitrary binary file

A reversing plugin for cross-decompiler collaboration, built on git.

RetroWrite -- Retrofitting compiler passes through binary rewriting

A curated list of awesome projects, articles and the other materials powered by Radare2

RISC-V simulator for x86-64

Disassemble any file on Android, including .so (NDK, JNI), Windows PE (EXE, DLL, SYS, etc.), Linux binaries and libraries, and even pictures, audio, and other files for fun. A Capstone-based Android disassembler and reversing app for Android NDK shared libraries, Windows binaries, and more.

A curated list of awesome game decompilations, recompilations and disassemblies.

A collection of pwn/CTF related utilities for Ghidra

An Interactive Hex-Rays Microcode Explorer

An intelligent reverse engineering and AI-assisted analysis tool for HarmonyOS NEXT (HAP/APP/ABC), Android (APK/AAB), iOS (IPA), and native PE/ELF/Mach-O binaries.

IDApython Scripts for Analyzing Golang Binaries

IDA Pro plugin for query based searching within the binary useful mainly for vulnerability research.

IDAPython Made Easy

A comprehensive collection of cheatsheets for reverse engineering, binary analysis, and assembly programming tools. This repository serves as a one-stop reference for security researchers, reverse engineers, and low-level programmers.

A decompiler targeting MIPS, PowerPC, ARM, and SuperH.

BinData - Reading and Writing Binary Data in Ruby

The Kam1n0 Assembly Analysis Platform

Use angr in Ghidra

An agent-first decompiler designed to be refined by other agents. Kuna is written in Rust and was originally ported from Ghidra.

r2dec-js is a JavaScript-based decompiler that converts assembly code into pseudo-C. It aids users in understanding assembly by providing readable high-level explanations, making low-level programming more accessible and facilitating debugging across diverse hardware platforms.

Ghidra extension for exporting relocatable object files

A Binary Genetic Traits Lexer Framework

Binary Analysis Framework in Rust

Pintool example and PoC for dynamic binary analysis

🔍 Go binary size SVG treemap

Raw binary firmware analysis software

Python core of avatar²

IDA Pro's FindCrypt ported to Ghidra, with an updated and customizable signature database

BeaEngine disasm project

Framework for Automating Fuzzable Target Discovery with Static Analysis.

OpenHarmony reverse engineering toolkit with preliminary decompilation support.

Binee: binary emulation environment

A series of tutorials about radare2 framework from https://www.megabeets.net

The multiplayer AI offensive security OS - open, self-improving, extensible. Find, verify, and fix vulnerabilities.

Yet Another Ghidra Integration for IDA

Rust implementation of SPIR-V module processing functionalities

IFL - Interactive Functions List (plugin for IDA Pro)

Port of devttyS0's IDA plugins to the Ghidra plugin framework, new plugins as well.

Components of a decompilation pipeline.

A VBA p-code disassembler

SHAREM is a shellcode analysis framework, capable of emulating more than 45,000 WinAPIs and virutally all Windows syscalls. It also contains its own custom disassembler, with many innovative features, such as being able to show the deobfuscated disassembly of an encoded shellcode, or integrating emulation data to enhance the disassembly.

An interactive list of plugins for hex-rays' IDA Pro

LLM-based reversing for radare2

Enhanced IDA Pro signature generator plugin.

Hexrays Toolbox - Find code patterns within the Hexrays ctree

Signature maker plugin for IDA 9.x and 8.x

Agent-first reverse engineering for macOS, Windows and Linux: any ACP agent reads, renames and patches binaries, Android apps and GPU kernels next to you.

Driver Buddy Reloaded is an IDA Pro Python plugin that helps automate some tedious Windows Kernel Drivers reverse engineering tasks

The dissection of a simple "hello world" ELF binary.

Access radare2 via pipe from any programming language!

IDAPython plugin that synchronizes disassembler and decompiler views

:notebook: Some security related notes

Precompiled Decompyle++ (pycdc) binaries for Windows & Linux

A Binary Ninja plugin containing an MCP server that enables seamless integration with your favorite LLM/MCP client.

:wolf: Malware analysis platform

Remove OLLVM control-flow flattening obfuscation using Binary Ninja.

HexRays ctree visualization plugin

A Full-Featured HexEditor compatible with Linux/Windows/MacOS

A collection of types & functions definitions useful for iOS/macOS binaries analysis.

an ida plugin used to decompile vmp

Opcode calculator / ASM calculator

Easily retargetable and hackable interactive disassembler with IDAPython-compatible plugin API

Boomerang Decompiler - Fighting the code-rot :)

GptHidra is a Ghidra plugin that uses the OpenAI Chat GPT to explain functions. With GptHidra, you can easily understand the purpose and behavior of functions in your codebase. Now with GPT4 Support!

a multi-threads tool for decompile exe,elf,pyz,pyc packed by python which is base on pycdc and uncompyle6.

radare2-based decompiler and symbol executor

A :zap: lightweight Go package to parse, analyze and extract metadata from Portable Executable (PE) binaries. Designed for malware analysis tasks and robust against PE malformations.

idenLib - Library Function Identification [This project is not maintained anymore]

A binary lifter and analysis framework for Ethereum smart contracts

GhidRust: Rust decompiler plugin for Ghidra

Intermediate Representation for Binary analysis and transformation

A terminal-first reverse engineering toolkit in Rust: PE/ELF/Mach-O analysis through CLI, TUI, and MCP. Installs as knife.

LLVM based static binary analysis framework

Companion source code for the book macOS Software Security and Reverse Engineering.

Nintendo Switch loader for Ghidra

A guide that explains how programs transform from source code to executables. Deep dive into ELF format, linking processes, and binary optimization techniques. Perfect for systems programmers, C developers, and anyone interested in low-level programming concepts.

Python cross-version bytecode library and disassembler

A binary splitting tool to assist with decompilation and modding projects

Analysis scripts for Ghidra to work with Android NDK libraries.

Python 3 bridge to Ghidra's Python scripting

Unity IL2CPP Disassembler (for apk)

Coefficient-Based Reconstruction of Arithmetic — a Mixed Boolean-Arithmetic (MBA) expression simplifier for deobfuscation

ClassInformer backported for IDA Pro 7.0

IDA ClassInformer PlugIn

abyss - augmentation of Hexrays decompiler output

Reverse Engineering Tools (deobf, decompiler etc..)

A Super NES ROM Disassembler

Plugin for Ghidra to assist reversing Golang binaries

A plugin based on IDAPython for a functional DWIM interface. Current development against most recent IDA is in the "persistence-refactor" branch, ancient (but stable) work is in "master", so... create an issue if you want/need something backported. Use "Wiki" or "Discussions" for examples, and smash that "Star" button if you like this.

An AVX Lifter for the Hex-Rays Decompiler

Debug Child Process Tool (auto attach)

Game Boy ROM disassembler with RGBDS compatible output

Security analysis of the hypervisor drm method used to bypass denuvo. Reverse engineering of the driver loaders and boot components using Ghidra

MCP stdio server for radare2

D810-ng (Next Generation) is an updated, tested, refactored, and optimized IDA Pro plugin used to deobfuscate code at decompilation time by modifying IDA Pro microcode.

FLARE Team's Binary Navigator

A Nintendo GameCube binary loader for Ghidra

x86 malware emulator

Ghidra Analysis Enhancer 🐉

Scripts for the Ghidra.

Medigate plugin for c++ reverse engineering and other utils

Native Pcode emulator

A collection of my Ghidra scripts to facilitate reverse engineering and vulnerability research.

Ghidra analysis plugin to locate cryptographic constants

Articles and tools related to research in the Apple environment (mainly macOS).

*Decompile All the Things* - IDA Batch Decompile plugin and script for Hex-Ray's IDA Pro that adds the ability to batch decompile multiple files and their imports with additional annotations (xref, stack var size) to the pseudocode .c file

Ghidra Extension to integrate BinDiff for function matching

A modern, modular, and robust TUI hex editor.

REPL-integrated Clojure-to-Java decompiler

Obfuscator-llvm Control Flow Flattening Deobfuscator

DrSemu - Sandboxed Malware Detection and Classification Tool Based on Dynamic Behavior

📡🐧 Linux kernel syscall implementation tracker

IDAPython loader to help with AArch64 iBoot, iBEC, and SecureROM reverse engineering

SMDA is a minimalist recursive disassembler library that is optimized for accurate Control Flow Graph (CFG) recovery from memory dumps.

Ghidra Client/Server Docker Image

IDA Pro plugin to make bitfield accesses easier to grep

Analyze Golang with Ghidra

Source graveyard and random candy for radare2

A list of open source reverse engineering tools with a focus on binary analysis

sleigh craft!

Open source binary analysis tools.

An extension for Ghidra that adds support for the PlayStation 2.

IDA Pro plugin that speeds up the initial binary auto analysis through a caching technique

Yara rule making tool (IDA Pro & Binary Ninja & Cutter & Ghidra Plugin)

Quarkslab Bindiffer but not only !

Automate Ghidra reverse engineering from the command line — headless analysis, decompilation, and structured JSON output for AI agents like Claude Code

Book: Reverse Engineering — Fundamentals and Practice

An AI agent skill for automated malware analysis with IDA Pro, enabling agents to analyze malicious samples like a security analyst.

eBPF Processor for Ghidra

Code and exercises for a workshop on z3 and angr

A research decompiler implemented as a Binary Ninja plugin.

A fast and lightweight decoder for x86 and x86-64 and encoder for x86-64.

ChatGPT Agent analyses your IDA pseudocode

A Ghidra script to save small patches back to the executable file

No description supplied by the upstream repository.

Binary & scripts associated with "The Poor Man's Obfuscator" presentation

A Nintendo DS binary loader for Ghidra

Native multi-arch disassembler & decompiler - PE/ELF/Mach-O, x86/x64/ARM64, Lua scripting, RTTI recovery

Quokka: A Fast and Accurate Binary Exporter

🐉 Export ghidra decompiled code to dwarf sections inside ELF binary

sigmaker is a zero-dependency IDA Pro 9.0+ cross-platform signature maker plugin with optional SIMD (e.g. AVX2/NEON/SSE2) speedups that works on MacOS/Linux/Windows. It allows configurable wildcard operand patterns, nibbles, and signature generation just by right clicking.

An ethereum evm bytecode disassembler and static/dynamic analysis tool

Decompiler, deminifier and deobfuscator for Bun-compiled standalone JavaScript binaries

Python bindings to Ghidra's SLEIGH library for disassembly and lifting to P-Code IR

ScanCode.io is a server to script and automate software composition analysis with pipelines. This project is sponsored by the European Commission, NLnet NGI0, the Google Summer of Code, nexB and others generous sponsors!

Decompiler for x86 and x86-64 ELF binaries

Apply IDA FLIRT signatures for Ghidra

Pyhidra is a Python library that provides direct access to the Ghidra API within a native CPython interpreter using jpype.

A workbench for developing 6502 code.

A security-first MCP server that empowers AI agents to perform automated reverse engineering, malware analysis, forensics, vulnerability research, and SAST — powered by Radare2, YARA, LIEF, Capstone, and more.

A lightweight ARM64 dynamic tracing and emulation tool based on Unicorn, supporting IDA Pro, Tenet log generation, native code emulation, memory dumps, register-state tracking, and instruction-level logging.

A plugin for IDA that renames functions by system call numbers.

AI-Assisted Reverse Engineering with Ghidra

Arkose Labs / FunCaptcha solver for Go, Python and Node — produces sup=1 suppressed tokens. The site RSA key is derived from api.js on every solve: no capture, no replay, no headless browser. Includes a full VM disassembly.

RevEng.AI Ghidra Plugin

Decompilation of snowboard kids 2 (N64)

Unofficial CMake build for Ghidra's C++ SLEIGH code

Delphi debug framework

Plugin to ease reversing iOS projects

A Pythonic Ghidra standard library

Hex-Rays Decompiler Enhanced View

A binary analysis framework written in Rust.

IdaClu is a version agnostic IDA Pro plugin for grouping similar functions. Pick an existing grouping algorithm or create your own.

Binary Code Similarity Analysis (BCSA) Benchmark

Useful Scripts for helping in reverse engeenering

MIPS instruction decoder

Slides & Hands-on for the reverse engineering workshop

Automatically identify and extract potential anti-debugging techniques used by malware.

Let's document Emacs Lisp Bytecode (Lisp Assembly Program) instructions

PE32 (x86) and PE32+ (x64) binaries analysis tool, resources viewer/extractor.

An IDA MIPS static scanning script to assist assembly-code auditing.

DelphiHelper is a python IDA Pro plugin aiming to help the analysis of x86/x86_64 binaries written in Delphi programming language.

Library for parsing internal structures of PE32/PE32+ binary files.

Modern dark theme based on the original ghidra-dark

Reverse engineering of Panzer Dragoon Saga

Deep memory analysis for Windows processes — the tool that saves you hours of debugging

An unofficial implementation of asm2vec as a standalone python package

A six-stage orchestration skill for mobile security analysis, coordinating APK static reconnaissance, traffic-to-code alignment, in-depth SO/JNI analysis, combined cryptography and vulnerability analysis, validation design, and report delivery. Supports JADX MCP, Burp/Yakit MCP, and IDA/Ghidra MCP.

Reverse engineering TikTok's JavaScript VM - 77 opcodes mapped, string deobfuscation, bytecode disassembly, and crypto function identification. Educational VM analysis toolkit.

A suite of tools for creating disassemblies of ZX Spectrum games.

Control-flow-flattening and string deobfuscator

AI-Powered Malware Analysis & Threat Intelligence for Ghidra Transform your static analysis workflow with cutting-edge AI capabilities, comprehensive malware detection, and advanced threat intelligence.

RevEng.AI IDA Pro Plugin

Disassembler for Windows executables. Supports 16-bit NE (New Executable), MZ (DOS), and PE (Portable Executable, i.e. Win32) files.

Yet another IDA Pro/Home plugin for deobfuscating stack strings

Make your Ghidra Lazy!

A binary to LLVM translator

Python Command-Line Ghidra Decompiler

Classic Mac OS resource fork and application disassembler, with reverse-engineering tools for specific applications

WIP Decompilation of Kirby & The Amazing Mirror (USA)

This repository contains writeups for various CTFs I've participated in (Including Hack The Box).

Graphical disassembler for multiple architectures for easy navigation

REmatch, a complete binary diffing framework that is free and strives to be open source and community driven.

A Ghidra script that enables the analysis of selected functions and instructions using Large Language Models (LLMs). It aims to make reverse-engineering more efficient by using Ollama's API directly within Ghidra.

A Java Class File Disassembler

IDA Plugin that fills in missing indirect CALL & JMP target information

"Just Another ReVersIng Suite" or whatever other bullshit you can think of

Automatic vtable detection, inheritance analysis, and function override tracking for reverse engineering compiled C++ binaries. Supports IDA Pro 9+ on any OS

CERT Kaiju is a binary analysis framework extension for the Ghidra software reverse engineering suite. This repository is a "mirror" -- please file tickets, bug reports, or pull requests at the upstream home in @CERTCC: https://github.com/certcc/kaiju

hotspot disassembler hsdis

An improved nm + Objective-C & Swift class-dump

Package Manager for Radare2

Some useful books related to Cybersecurity, Linux and more.

IDA plugin to pinpoint obfuscated code

A Python Bytecode Disassembler helping reverse engineers in dissecting Python binaries by disassembling and analyzing the compiled python byte-code(.pyc) files across all python versions (including Python 3.10.*)

Hexrays decompiler plugin that colorizes and filters the decompiler's output based on regular expressions

Ghidra scripts for recovering string definitions in Go binaries

A collection of over 200 Ghidra themes to make long hours of reverse-engineering even more enjoyable!

Decyx: AI-powered Ghidra extension for enhanced reverse engineering and binary analysis.

r2con2019 - slides and materials

Vulnerability research assistant that locates calls to potentially insecure API functions in a binary file.

Bindings of the r2 api for Valabind and friends

Ghidra language definition for the Gekko and Broadway CPU variant used in the Nintendo GameCube and Nintendo Wii respectively

QtREAnalyzer, a Ghidra extension to reverse-engineer Qt binaries.

Vulnerability research assistant that extracts pseudocode from the IDA Hex-Rays decompiler.

IDAPython plugin for finding function strings recursively

Ghidra processor module adding support for the Allegrex CPU (PSP)

LummaC2 extracted binaries by reversing & LummaC2 Stealer Analysis

Run real Windows 98 apps and games in your browser. An x86 emulator and Win32 layer written directly in WebAssembly Text, no OS image, no source ports.

DarkNight theme for Ghidra

An IDA Pro plugin that display cross-references to functions or variables across the entire binary in Hex-Rays pseudocode

Android reverse engineering entirely on-device. Radare2 binary analysis, 8 Java decompilers, Flutter & Unity il2cpp support.

A CHIP-8 interpreter, assembler and disassembler in C

Hextor - Hexadecimal editor and binary data analyzing toolkit

Xbox Executable Format (XBE) Loader Extension for Ghidra SRE framework

Reverse engineering assistant that extracts strings and related pseudocode from a binary file.

ASM2HEX is a powerful tool for bidirectional conversion between assembly language and hexadecimal machine code. Its intuitive graphical interface makes conversion easy and provides accurate, reliable results for ARM64, ARM, and Thumb instruction sets.

An installer and compiler for Ghidra for MacOS ARM64 or "Apple Silicon"

Ghidra decompiler plugin for LLDB

Extract labels from IDA, Ghidra, Binary Ninja, and Relyze files and export x64dbg database. Including radare2 main address.

IDA Pro plugin to show functions in a tree view

A Symbolic Ethereum Virtual Machine (EVM) bytecode interpreter, parser and decompiler, along with several other utils for programmatically extracting information from EVM bytecode.

Radare2 cheat-sheet

IDA Migrator is an IDA Pro plugin which helps migrate existing work from one database instance to another. It Conveniently migrates function names, structures and enums.

Automation tool for locating symbols & structs in binary (primary IDA focused)

Just a simple radare2 Jupyter kernel

Speculative disassembly, CFG recovery, and call-graph recovery from stripped binaries.

No description supplied by the upstream repository.

Stash for Binary Exploitation and Reverse Engineering Resources

An IntelliJ IDEA plugin for working on Ghidra Extensions.

A collection of IDA loaders for various game console ELF's. (PS3, PSVita, WiiU)

Binary rewriter for 64-bit PE files.

Ghidra scripts for malware analysis

Dive into Python code

radare2 + miasm2 = ♥

Headless AI agent for deterministic reverse engineering.

A Model Context Protocol (MCP) server that enables AI assistants to interact with IDA Pro for reverse engineering and binary analysis tasks.

webui repository for radare2

A plugin for IDA that can dump the ELF file easily.

Ghidra analysis plugin to locate cryptographic constants

Binary Ninja plugin for loading VTIL routines and lifting VTIL instructions to LLIL for analysis.

Symbol Recovery Tool for Nuitka Binaries

Discord rich presence plugin for IDA Pro 7.0

Usermode NT Explorer - Query kernel addresses, translate virtual to physical addresses, inspect the PFN database, and more.

A verified map of reverse engineering and malware analysis. Disassemblers, unpacking, exploit dev, fuzzing, DFIR, and the deep-cut writeups other lists miss.

Watcom Disassembly Tool (wcdatool) - Tool to aid disassembling DOS applications created with the Watcom Toolchain

An IDA pro plugin to display user-added comments in disassembly and pseudocode views.

Control Flow Flattening Deobfuscator for Obfuscator-LLVM as a plugin for IDA Pro.

An IDA Pro plugin to export data better

Unofficial YARA IDA Pro plugin, along with an unparalleled crypto/hash/compression rule set based on Luigi Auriemma's signsrch signatures.

Exynos Modem / Shannon baseband firmware loader for IDA Pro 8.x/9.x

ida plugin to parse qt meta data

Software reverse engineering tool for Java

A collection of modules and scripts to help with analyzing Nim binaries

IDA Pro plugin to display and search comments in the database

AI-Powered Autonomous Binary Reverse Engineering CLI — the native reverse engine from Innora-Sentinel. Local LLM inference (MLX), MPS GPU acceleration, multi-round iterative analysis, zero API cost.

Inlay hints for hex-rays

IDA plugin to support automatic reverse engineering

Have you ever wondered: what if IDA had great Ctrl+F search support for Pseudocode windows? No longer!

Executables created while writing "Introduction to Manual Backdooring".

Ubuntu on QNAP TS-453Be

Hide function calls to prevent reverse-engineering

A command line tool for extracting machine learning ready data from software binaries powered by Radare2

An AI-powered reverse-engineering copilot for assisting tedious malware analysis in IDA Pro.

Tools for creating, modifying, assembling and disassembling RemObjects PascalScript files.

Easy-to-use IDA plugin for code emulation

Ghidra plugin to communicate with radare2

Solutions to some crackmes that I have done.

IDA plugin that displays the P-code for the current function

RAIR: RAdare In Rust

IDA Pro plugin to aid PS4 user mode ELF reverse engineering.

a IDA 7.0 plugins that helps to attach process created by pwntools and debug pwn

A deobfuscation plugin for IDA

libil2cpp symbol parser for ida

The reverse-engineering framework you can run anywhere, with nothing installed, and actually trust.

Binary Ninja plugin that can be used to apply Triton's dead store eliminitation pass on basic blocks or functions.

Block Redo & Undo To Achieve Legacy IDA

Corewars but within r2

IDA-names automatically renames pseudocode windows with the current function name.

Image preview plugin for IDA disassembler.

Hex-Rays Block Highlighter plugin for IDA to highlight if/for/do/switch/while blocks

No description supplied by the upstream repository.

Install and browse 100+ community themes for IDA Pro (Dracula, Monokai, Solarized and more)

bsdiff is a library for building and applying patches to binary files.

Magical Princess Trainer 2026 macOS Apple Silicon M1 M2 M3 M4 ARM64 Native Edition

Parse and disassemble .metallib files in browser

match functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.

r2inspect is a professional malware analysis framework that automates deep static inspection for PE, ELF, and Mach-O binaries using the radare2 ecosystem. It combines format parsing, detection heuristics, and rich reporting to support reverse engineers, incident responders, and threat analysts.

Access radare2 from anywhere, anytime.

A metamorphic binary transformation engine based on r2pipe and radare2.

High Level API on top of the R2Pipe interface

Proof of concept for reverse engineering and exploiting Android Unity IL2CPP games by patching assembly at runtime.

IDA, Ghidra and Radare2 scripts. Also Android scripts to make your life easier.

Chameleon is a polymorphic engine for x86_64 position independent shellcode that has been created out of the need to evade signature-based detections in red team environments.

A book on learning radare2.

A simple library focusing on demangling symbols for different programing languages

Track and analyze binary size and memory footprint in embedded firmware

Example code for the online course Introduction to x86/x64 Software Reverse Engineering.

Rust crate for r2pipe

Transform binaries into source-code-like projects that coding agents can traverse, analyze, and use as an oracle for large binaries. Supports IDA Pro, radare2, angr and Binary Ninja.

Use binaryninja workflow to deflat ollvm cff

Reverse engineer Unity games with radare2

genpatch is IDA plugin that generates a python script for patching binary

Helper script for Linux kernel disassemble or debugging with IDA Pro on VMware + GDB stub (including some symbols helpers)

JavaScript bindings for Ghidra with AI agent support

An IDA plugin which demangles Rust function names

An old CLI tool to parse Intel/Motorola formatted HEX ASCII firmware files into binary blobs

Binary blob analyzer and extractor based on C++

A visual and colorized diff for binary files.

deollvm arm64 based unicorn

Standalone static version of Triton's x86/x64 translator

a radare2 plugin that decodes packets with Scapy

Supplement to radare2-explorations.

A repository of example plugins for Relyze Desktop.

msp430 Architecture plugin for Binary Ninja

Conversational black-box reverse-engineering agent on the pi coding agent — analyzes apk/.o/.hex/exe with a self-provisioning toolchain (radare2 · Ghidra · angr · jadx). Static analysis. Claude Code & Codex compatible.

A radare2 Python script to dump a raw IA32 binary to an NASM source file

Collection of malware analysis, binary exploitation and reverse engineering related resources

Open source release of the dirtyJOE - editor for the compiled java .class files.

A collection of useful radare2 scripts!

self-contained il2cpp to windows pdb generator (rust, x64, metadata v39)

BSimVis is a tool to analyze similarities across a collection of binaries, based on Ghidra analyzers and the BSim (Behavioral Similarity) plugin. It provides an API and Web interface to upload large quantities of decompiled binaries and BSim feature vectors to a Kvrocks database for similarity analysis, function diffing, and family clustering.

yara and radare2, better together

Tools to reverse the Toshiba FlashAir SD cards

rune - radare2 based symbolic emulator

Golang wrapper for @mendsley's bsdiff C library.

Discover similar functions structures in binaries using graph theory.

An unofficial French-language educational guide to REA (Reverse Engineer Anything): analyze applications and binaries with a coding agent through MCP and CLI, Hopper or Ghidra, backed by evidence. Includes the legal framework for reverse engineering. Upstream project: morluto/rea.

Import il2cppdumper data into a Binary Ninja plugin.

Launch radare2 like a boss from pwntools in tmux

Vagrant setup for building a machine for CTF/exploit development

BomLens — a local-first SBOM generator & open-source risk assessor (CycloneDX). Produce an SBOM, an open-source notice, and a security/license risk report from source code, containers, binaries, firmware, or an SBOM you received. CLI or web UI, no SaaS.

Agentic binary reverse engineering for ELF binaries on ARM64, ARMv7, x86_64 - hypothesis-driven analysis with radare2, Ghidra, GDB, QEMU

A practical handbook on reverse engineering. Covers embedded firmware (ARM Cortex-M, Xtensa/ESP32, RISC-V, 8051, MIPS), Linux userland, kernel modules and device trees, plus hardware attacks (fault injection, side-channel analysis). Uses radare2 as the primary tool example. PDF + web book.

MCP server for automated binary diffing.

Scrape files for sensitive information, and generate an interactive HTML report. Based on Rabin2.

Binary, Analysis, and Disassembler Radare2 Plugins for Dan32 architechture binaries

r2 the Rhme3! The RHme (Riscure Hack me) is a low level hardware CTF that comes in the form of an Arduino board (AVR architecture). It involves a set of SW and HW challenges to test your skills in different areas such as side channel analysis, fault injection, reverse-engineering and software exploitation. In our talk we will briefly recap RHme2 and introduce the upcoming RHme3. This year we decided to create a special target called the Riscurino board which features CAN controllers for a real automotive hacking experience! During the r2con we challenge you to solve as many challenges as you can using radare2. Are you up to the task? By the time the r2con takes place the registration for RHme3 will be closed. However, we reserved 5 Riscurino boards for giving away during the conference. Be at r2con and win one of these boards by solving the qualification challenge(s) using radare2!

PoC code and tools for Black Hat EU 2020

ARM 32-bit Raspberry Pi Hacking Hello World example in Kali Linux.

Sample radare2 project templates

Reverse-engineering Legend of Legaia (PSX, 1999): Ghidra-traced format documentation, Rust extractors for every asset on the disc, and an engine reimplementation targeting wgpu/SDL3 with optional WASM. BYO-disc model, no assets distributed.

RevEng.AI Radare2 Plugin

Learning assembly x86 programming and reverse engineering

PICO8 Extractor is a user-friendly tool designed to convert PICO-8 JavaScript cart exports into binary .p8.rom files that can be directly loaded in the PICO-8 fantasy console.

Local-first, deterministic MCP server for IDA Pro/Home: 109 strict-schema reverse-engineering operations, evidence-backed findings, and policy-gated IDB edits.

C++ tool that converts WebAssembly (`.wasm`) binaries to JavaScript, with an optional AI-powered pass using the Gemini API to rename variables and summarize functions.

Beyond Dark Castle (1987, Mac) game disassembly, in Motorola 68000 assembly language.

Reverse engineering exchange format

Multi-LLM iOS reverse-engineering toolkit. 10-phase workflow with adapters for Claude Opus/Code, Cursor, Qwen Coder, MiniMax, Codex/GPT-5, Aider, Cline. Adapted from incogbyte/iOS-reverse-engineering-claude-skill (Unlicense).

ARM 32-bit Raspberry Pi Hacking Int example in Kali Linux.

Hexagon disassembler code generator from the official instruction manual.

Dump ntoskrnl.exe important offsets for building your navigation system in the Windows Kernel, using Radare2 and Rust

A learning-focused PE analysis engine with modular detectors, heuristic analysis, and HTML reporting.

A little commandline tool to start PowerPoint in merge mode.

Evaluating function diffing existing techniques

radare2 script to help on COM objects reverse engineering

Rust library to interface with BinDiff

A cross platform framework to recover driver's communication interface.

Reverse-engineering suite for omp: radare2 tools, evidence store, signed audit log, RE status band, and report generator.

A library for creating and patching binary diffs. Based on bsdiff.

A Radare2 based Python module for Binary Analysis and Reverse Engineering.

radare2 based alternative to apktool

A toolsuite of advanced WASM static binary analysis tools designed to reverse engineer WebAssembly binaries.

r2 plugin to add MSDN documentation URLs and parameter names to imported function calls

Build and apply binary patches to Docker Images

Notes on Reverse Engineering EVM Bytecode

🔎 Function Change Differ | A diffing tool for binary files when comparing obfuscated and changed function contents between versions 🛠️

An open-source Python implementation and protocol mapping for the Even Realities G2 smart glasses, enabling full third-party interoperability, native dashboard control, and raw LC3 audio streaming via BlueZ.

A program diffing extension for Ghidra.

Version Control Tool for Binary Format Files.

Radare2's ESIL in Rust

Writeups, scripts and solutions for CTFs, Hack the Box, Vulnhub, exploit challenges, pwnables, crackmes, etc. Anything goes.

TriCore decompiler plugin for IDA Pro 9.2+

Go package to interface with BinDiff

FASM .fas symbolic debug information loader for radare2

Binwalk plugin for IDA Pro and Binary Ninja

A Raspberry Pi Pico RP2040 debug template repo with step-by-step instructions on how to freeze your MicroPython files into C firmware and reverse engineer the binary with OpenOCD and GDB.

Catch22 Hex Editor

Browse, extract and preview Black Desert Online .paz archives, with parsers for BDO binary formats.

Now you can 'disassemble' Reddit!

resource for learning & playing with radare

Fast & clean & simple binary diffing plugin for IDA Pro 9.x – finds patched functions in seconds. No Diaphora slowness, no crashes, no bloat. Made by Sin.

Reverse engineering and analysis of binary data

Reverse-engineering toolchain for Denso SH705x ECUs featuring Ghidra scripts for calibration map extraction and a standalone PyQt6 viewer

radare2 script to fix disasm with call tricks for strings

I created r2-syscall-printer (radare r2pipe script) because I need now Linux-kernel interface call convention support (x86 & x86_64): %rdi, %rsi, %rdx, %r10, %r8, %r9. Also you can use this tool as standalone-app to print syscall table info

Hacked script to show similarities between two samples using radare2 framework.

A cargo subcommand that displays ghidra function output through the use of the {rizin, radare2}-ghidra project

Performs firmware analysis on a given binary file.

Run OFRAK remotely to modify and repack binaries from your browser

Repository to contain my notes from my self-study of binary exploitation and reverse engineering.

This repository contains the dumped and deobfuscated version of GandCrabv5 JS Binary Dropper, along with the webpage files dropped on a GandCrab v5.1 infected system. The goal of this Repository is to attempt to make the files easier to work with and understand.

Windows x64 Unity IL2CPP metadata workbench for static dumping, package inspection, cross-version migration, and deterministic C++20 SDK generation with UniResolver.

Reverse engineering the Star NX-1020 9-pin dot-matrix printer: extracted resident fonts, labeled firmware disassembly, ROM maps, and full documentation

⚡ Autonomous reverse engineering engine & Model Context Protocol (MCP) server for binaries and applications in Systems Rust

Open-source Windows app for ECU binary analysis and editing: automatic map and axis detection, hex/2D/3D views, supported checksum correction, and RomRaider / TunerPro XDF / CSV / JSON export.

Native C++/Win32 PE analysis & binary triage toolkit. Inspects headers/entropy, strips ASLR/NX, inverts branch logic (Jcc/RET), scans AOB signatures, and generates instant .1337 patches, Cheat Engine scripts, or trampoline DLL hooks

SmartFoxServer 2X binary protocol implementation for Python

Reverse engineering with AI agents on Windows: verifying, measuring and visualising the tools agents use, with rea and Ghidra

Simple binary diffing tool written in python and built on top of angr.

Enable full Ghidra support for the ESP32-P4 RISC-V microcontroller with custom Sleigh processor definitions, peripheral memory maps, and ROM symbol loading.

Lightweight PE/ELF binary analyzer written in C++17.

An all-in-one binary designed to help with locating, extracting and identifying changes between APK versions

Hand-translating console games from disassembly into readable, modifiable JavaScript, not emulation. Every ROM routine becomes a JS function you own, verified frame-by-frame against the real ROM running in an emulator. Batman (Game Boy) complete; Gradius (NES) plays end to end; DoDonPachi DaiOuJou (arcade) in progress. No ROM included.

Divide-and-conquer binary diffing framework

A personal project aiming to solve real systems problems within a specific domain: a modular desktop and cloud systems platform for automated crash diagnostics (SAGE RAG), content-addressed storage (Aduana), static JVM bytecode security, and binary NBT recovery.

Reverse engineer anything. Port it anywhere. One CLI and MCP server that lets any coding agent take apart apps, games, binaries and websites — and port them to Godot, Unity, Unreal, three.js or any language.

A native C++ CLI toolkit for reverse engineering binaries.

Binary reverse engineering toolkit in C - file analysis, ELF/PE parsing, entropy scanning, string extraction, and optional disassembly.

Decompile the web's bleeding edge. The premier Ghidra processor module for reverse-engineering Wasmtime's portable Pulley ISA.

Reassembles split Qualcomm firmware for Ghidra, and recovers source file and line from the debug metadata left in the binary

A Claude Code mod that keeps a live casebook of the Evidence rea gives the agent: Ghidra cold start, findings that must cite real evidence_id values, Markdown export.

WebAssembly analysis and decompilation support for Ghidra, developed and maintained for Ghidra 12.1.4.

Patched PEDA for modern Python and GDB environments

Identifies machine code in binary files.

Visualize binary data and C struct memory layouts as interactive SVG diagrams in Obsidian

MCP server exposing the ghidriff Ghidra binary-diffing engine as tools for AI agents

A file-first editor with a native macOS shell and shared Rust core. Markdown today, broader document editing over time.

Generate intelligent wildcard byte signatures from x86 disassembly. Supports x64dbg, Cheat Engine, and raw hex formats.

BinExport for Ghidra 12.x (12.1.2). Patched build of google/binexport that fixes the NoSuchFieldError LabelString$LabelType.CODE_LABEL crash (issue #166) blocking BinExport + BinDiff on Ghidra 12.0+. Prebuilt Ghidra extension + headless export. Ghidra → BinExport → BinDiff pipeline restored.

Windows ChatGPT/Codex frontend reverse-engineering workspace: recovered UI contracts, original-runtime demos, evidence, and a deferred native Rust port.

Reverse-engineering Anarchy Sound Software's SwarmSynth (2003) by measuring it, not disassembling it. Wine-hosted VST2 rig, JUCE recreation, WebAssembly build.

IDA static analysis and runtime memory verification for classic WinMine

BinaryPacketsDSL is a domain-specific language and toolkit for describing, parsing, and analyzing binary protocol packets. It is designed for clarity, robustness, and testability, with support for structured definitions, modifiers, and dynamic field handling.

Fast, zero-dependency, no_std Rust crate for scanning PE signatures with IDA-style patterns

Local web dashboard unifying OSINT, reverse engineering, binary exploitation, web/directory recon, and cryptography tools for CTF and authorized security research — upload a file, click Run, get a result.

Static security analyzer for Android APK and iOS IPA packages (authorized review, static only). Built-in binary AXML decoder, manifest and Info.plist checks, JSON and SARIF output.

Compare binaries inside Binary Ninja with synchronized graph and linear diffs, corpus comparisons, and symbol transfer.

Automated vulnerability assessment and risk analysis platform with Nmap scanning, CVE intelligence, binary analysis, YARA threat detection, and PDF security reporting

An in-depth technical investigation of REA: source-code mechanisms, original papers, reproducible experiments, and evidence-driven behavior reconstruction.

Fast, open binary diff for ELF/PE — reports structural changes and, for x86-64, which functions were added, removed, or modified. Rust CLI + library.

Complete static reconstruction of vgui2.dll (GoldSrc) from its binary: our own code, the original ABI, 349/349 methods, 18 tests, GPL v3.

100% client-side multi-architecture static disassembler

Ghidra for local AI models — decompile, inspect, and patch GGUF / LoRA / Ollama models in a visual workbench, and build new ones from modular "sector" adapters. No retraining required.

Reverse-engineer runnable targets (websites, SPAs, browser apps, mini programs, Electron, binaries) into evidence-backed mechanism notes, then distill them into build-ready functional specs.

Interactive WebAssembly binary decompiler, CFG visualizer, and linear memory inspector

Real-world reverse engineering with AI agents. Explore REA case studies, software reconstructions, demos, source code, and the evidence behind each result.

Learn assembly from zero: ARM64 on Apple Silicon, plus x86-64, RISC-V, reverse engineering, WebAssembly, and hands-on projects — served as a clean Astro course site.

Open, local-first reverse engineering platform — PE/ELF/Mach-O, x86/x64/AArch64 disassembly, graphs, pseudocode. Rust engine, desktop app.

Ω Zero-dependency JS security scanner — deobfuscates webpack bundles, AST taint tracking, SW analysis, chunk graph. 273 findings on Juice Shop in 10.7s. Termux-native.

A blog post on how i reverse engineered the osu!collector app

Play EA Sports Rugby 08 (PC, 2007) in the browser: static recompilation of the x86 game to WebAssembly, Direct3D 8 on WebGL 2. Installable PWA. Bring your own copy.

Academic security project demonstrating an Android repackaging attack, where a legitimate APK is disassembled, modified with malicious smali code, re-signed, and redeployed to perform privacy-invasive actions such as contact deletion and location tracking (Information Technology Security, UNIWA).

A single-file, offline analyzer for source code, binaries, packages, documents, SBOMs, and security metadata — entirely in your browser.

A byte-oriented matching language for finding meaning in changing binaries. MAML stands for Mahmoud's Address Matching Language

Marimo notebook to compare and search the binary diffing results.

Preserve compiled ARM64 code and initialized objects as portable Node and browser APIs.

Learn binary file structure from examples and build guarded standalone editors, entirely in your browser.

Unofficial Zalo Linux port (x86_64) — every native module ported: file-utils, file-utilities, zwalker, zfile, v8-profiles, mp4thumb, zimage, zjxl, zcall wire bridge + live call recon

Scriptable multi-format disassembler & decompiler — a browser-based Hopper alternative

A security-first, API-driven data workbench being built in Rust. Inspired by CyberChef, designed for encoding, decoding, cryptography, and binary analysis through composable recipes, with browser-based WebAssembly and optional server execution.

See inside a Windows DLL: colour-coded memory map, explained PE headers, imports/exports, PDB symbols and live disassembly - 100% in your browser.

Picture Man 1.55 (1991-1993), the true-color image editor for Windows 3.x, rebuilt in Rust from its binaries - runs on the desktop and in the browser

Unofficial REA tutorials and comparisons for installing and using Reverse Engineer Anything with coding agents.