THE REPOSITORY DIRECTORY

General tools and collections

Browse 367 repositories with project descriptions, upstream links, and license information.

Search repositoriesCurated resources 99Download full JSON ↓
About this index

1,979 repositories are available to browse from 2,000 successful README scans. The 21 out-of-scope records remain in the full JSON.

This automatically discovered repository index has not been individually curated or execution-tested. Categories come from metadata; descriptions have AI-assisted translations. Stars are collection-time snapshots.

Scan methodology ↗ · Scope exclusions ↗

367 repositories

Scan snapshot: 2026-10-16 UTC

morluto/rea

271,152 stars

Reverse engineer anything with agents, from app behavior down to native binaries.

xtekky/gpt4free

66,872 stars

The official gpt4free repository | various collection of powerful language models | opus 4.6 gpt 5.3 kimi 2.5 deepseek v3.2 gemini 3

Reverse engineering, authorized penetration testing, and security research skill router pack: AI-powered routing, on-demand toolchain bootstrapping, and a self-evolving knowledge base. Supports Claude Code, Kiro, Cursor, Cline, and other AI coding clients.

This repository is maintained by Omar Santos (@santosomar) and includes thousands of resources related to ethical hacking, bug bounties, digital forensics and incident response (DFIR), AI security, vulnerability research, exploit development, reverse engineering, and more. 🔥 Also check: https://hackertraining.org

Build your own 'AirTags' 🏷 today! Framework for tracking personal Bluetooth devices via Apple's massive Find My network.

majd/ipatool

11,709 stars

Command-line tool that allows you to search for iOS, iPadOS, tvOS, watchOS, visionOS, and macOS apps on the App Store, and download .ipa or macOS .pkg app packages.

A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.

An Information Security Reference That Doesn't Suck; https://rmusser.net/git/admin-2/Infosec_Reference for non-MS Git hosted version.

JPEXS Free Flash Decompiler (FFDec) is open-source Flash SWF decompiler and editor. Extract and edit ActionScript, images, sounds, shapes, fonts, and other SWF resources.

wux1an/wxapkg

4,261 stars

Cross-platform GUI tool for decompiling WeChat mini programs, with .wxapkg file scanning, decryption, and unpacking.

An effort to build a single place for all useful android and iOS security related stuff. All references and tools belong to their respective owners. I'm just maintaining it.

Blackbox tool to disable SSL certificate validation - including certificate pinning - within iOS and macOS applications.

An AI-agent-first MCP server for JavaScript reverse engineering: headed Chrome debugging, breakpoints, network/WebSocket analysis, Patchright anti-detection, and optional CloakBrowser.

Modern Java decompiler aiming to be as accurate as possible, with an emphasis on output quality. Fork of the Fernflower decompiler.

zeldaret/botw

2,236 stars

Decompilation of The Legend of Zelda: Breath of the Wild (Switch 1.5.0)

ainfosec/FISSURE

2,069 stars

The RF and reverse engineering framework for everyone. Follow and ★ to show your support!

Reverse engineering of Validity/Synaptics 138a:0090, 138a:0094, 138a:0097, 06cb:0081, 06cb:009a fingerprint readers protocol

Low-level Direct Memory Access (DMA) framework for CS2, designed for memory acquisition, entity-state parsing, synchronization, and PCIe/reverse-engineering research.

core-lib/xjar

1,811 stars

A tool for securely encrypting and running Spring Boot JARs, with support for native JARs.

A collection of Python web-scraping projects, from the basics to JavaScript reverse engineering, with sections on fundamentals, automation, advanced techniques, and CAPTCHAs. Examples cover major websites including Xiaohongshu, Douyin, Weibo, Instagram, boss job, JD, and more, teaching web scraping, anti-scraping, automation, and CAPTCHAs.

zeldaret/mm

1,743 stars

Decompilation of The Legend of Zelda: Majora's Mask

A curated list of public-source, research, and commercial tools for AI security and AI-assisted cybersecurity — autotriage, agent security, AI/ML supply chain, pentest agents, AI SAST, LLM-driven fuzzing, threat intelligence, SOC/SIEM triage, reverse engineering, LLM red-teaming, and more.

This repository preserves source materials and related documentation about GenP. For archival and research purposes only.

Bixilon/Minosoft

1,309 stars

An open source Minecraft reimplementation written from scratch. Mirror of https://gitlab.bixilon.de/bixilon/minosoft

Python decompiler for 3.7-3.8 Stripped down from uncompyle6 so we can refactor and start to fix up some long-standing problems

Provides automated reverse engineering assistance through the use of local large language models (LLMs) on consumer hardware.

CAN Commander is a comprehensive tool designed for the reverse engineering of CAN (Controller Area Network) bus systems. This project aims to provide a robust platform for automotive enthusiasts, engineers, and security researchers to interact with and analyze CAN networks, facilitating a deeper understanding and manipulation of communication.

ent0n29/polybot

1,024 stars

Reverse-engineering of every polymarket strategy and high-frequency trading infrastructure for Polymarket

The PCSX-Redux project is a collection of tools, research, hardware design, and libraries aiming at development and reverse engineering on the PlayStation 1. The core product itself, PCSX-Redux, is yet another fork of the Playstation emulator, PCSX.

Fadi002/de4py

1,009 stars

The ultimate AI-powered toolkit for python reverse engineering

BYOVD research use cases featuring vulnerable driver discovery and reverse engineering methodology. (CVE-2025-52915, CVE-2025-1055, CVE-2026-3609, CVE-2026-8501).

Playing with the Tigress software protection. Break some of its protections and solve their reverse engineering challenges. Automatic deobfuscation using symbolic execution, taint analysis and LLVM.

Rated, auto-refreshed list of decompiled, recompiled & reverse-engineered games: decomps, static recomps, source ports, engine remakes, browser ports.

mahaloz/DAILA

711 stars

A decompiler-agnostic plugin for interacting with AI in your decompiler. GPT-4, Claude, and local models supported!

Combines chrome-devtools-mcp capabilities with Skill specifications to automate frontend JavaScript reverse-engineering analysis using JSRPC, Flask, and autoDecoder, improving reverse-engineering efficiency.

Minecraft Decompiler. A useful tool/library to deobfuscate and decompile Minecraft(or any jar file) through popular mappings and various decompilers. Or use it as a lib to process obfuscation mappings such as converting a mapping to another format

ModSDK - a modding toolkit to create mods for Crash Team Racing in C. This repository also houses an effort to fully decompile and reverse-engineer CTR in C.

halo-re/halo

451 stars

Halo: Combat Evolved (for original Xbox) Decompilation Research Project

A free Grok API wrapper that allows you to use Grok without API access or Account.

pret/pmd-red

286 stars

Decompilation of Pokémon Mystery Dungeon: Red Rescue Team

A playable PC port of Sly Cooper and the Thievius Raccoonus, rebuilt through reverse engineering.

A macOS port of QQ Pet (Retro): reverse engineering, telemetry removal, Ruffle Flash, and an automated pet-care CLI.

From-scratch, byte-matching decompilation of Super Mario 64 DS into C/C++, with a live progress atlas and matching tools.

Tweego is a free (gratis and libre) command line compiler for Twine/Twee story formats, written in Go.

A collection of scripts for Agent. Feel free to submit a pull request to add your script.

ruDevolution — The first decompiler that understands code semantically, recovers original names with AI, proves every transformation with cryptographic witness chains, and gets smarter with every run.

IoCreateDriver Implementation, it can be useful if you're trying to bypass anticheats

A work-in-progress matching decompilation of the 0.3.7 version of San Andreas Multiplayer

Reverse engineer obfuscated JavaScript visually. Chain transforms, inspect AST changes, write reusable deobfuscation plugins.

The cheapest, clock-accurate FPGA replacement for PPU, created using reverse engineering.

pgarba/SiMBA-

115 stars

Port of MBA Solver SiMBA to C/C++ (MBA deobfuscation in real world applications)

My API wrapper for ChatGPT making it possible to use ChatGPT via API for free instead of paying for their API.

Decompiler and deobfuscator that offers support to track discord webhooks inside: blank stealer, luna grabber, thiefcat, Creal and all unobfuscated grabbers

Curated list of games rebuilt inside other games — cross-game mechanics, engine/runtime mashups, playable ports, and verified viral projects.

Proxy patch for Google Antigravity that intercepts internal Cloud Code API and adds support for OpenAI, Claude, Ollama, Gemini and any custom LLM provider.

JavaScript Reverse Engineering Toolkit (JSRETK) - Experimental tools for analyzing (minified/obfuscated) JavaScript

VTIL2 is a ground-up reimagination of the VTIL Project, completely rewritten in modern C# with enterprise-grade architecture, performance optimizations, and developer experience enhancements. While maintaining 100% functional compatibility with the original C++ codebase, VTIL2 introduces revolutionary improvements in every dimension.

k0imet/CTFs

50 stars

A compilation of writeups from past CTFs covering various topics and categories available in CTFs.all levels of skill accounted for

WslinkVMAnalyzer is a tool to facilitate analysis of code protected by a virtual machine featured in Wslink malware

A highly clock-accurate FPGA clone of the NES 2A03(7) APU (pAPU), created on the basis of reverse engineering.

A highly clock-accurate FPGA clone of the NES 2C02(7) PPU, created on the basis of reverse engineering.

Download Windows 10 Spotlight Lock screen images anywhere using Content Delivery Management

A tool that modifies the reverse-engineered Windows 10 Calculator.exe (UWP application). A patch that adds Hangul and Classical Chinese support to Windows Calculator.

Don't reverse engineer it twice. 12,000+ open-source tools built by reverse engineering closed apps, APIs, devices, protocols, file formats, games and AI tools. Search site + agent skill, refreshed nightly.

4qzs/4qzs

24 stars

Maintained to help track, debug, and support analysis of various applications.

The open-source, local-first UML editor for students and developers. Design software architecture, generate code, and learn system design.

ejfkdev/jscd

23 stars

Reverse bytenode .jsc (V8 code cache) to JavaScript — static, pure Rust, no patched V8/Node. Node 8→26 / V8 5.8–14.6; 25k .jsc tested, 0 fail.

Multiple ChatGPT subscriptions in one Codex desktop app — switch accounts, per-account usage, original app untouched. macOS.

A highly clock-accurate FPGA clone of the NMOS processor 6502, created on the basis of reverse engineering.

Production-grade JavaScript reverse-engineering skill: evidence-driven workflows, verbatim sandbox harnesses, 19 battle-tested playbooks, 136 scripts, public benchmarks

MCP server exposing WinDbg/DbgEng (live user-mode, kernel, crash dumps, Time Travel Debugging) to AI agents over stdio or over HTTP with --listen

Reverse-engineering analysis of credential storage in the TRAE SOLO CN (TraeWork CN) desktop client: 4/4 decryptions succeeded, 98 APIs discovered, ECDSA P-256 token refresh, and daily check-ins. Pure Node.js/TypeScript.

A fully working Proof of Concept (PoC) that demonstrates how to reconstruct CyberSource Credit/Debit Card encryption as used on websites such as pokemoncenter.com. The implementation mirrors CyberSource’s Flex Microform flow and produces a valid payment token (jti) that can be used during checkout automation.

AGENT Pojia is an AI skill management tool that deploys 65 AI skills to Claude Code, Codex, Kimi Code, or Cursor in one click.

SpeakMore: open-source voice input for macOS. Press a hotkey to speak and paste the cleaned-up text into the current input field using your own Gemini API key. Includes reverse engineering of Typeless.

Decrypt answers for any assignment and save collaboration links in codehs.com. Made this to skip doing easy/boring assignments in my computer programming 11 class.

Go reconstruction of TransUnion iovation's snare.js device-fingerprinting pipeline: data collection, serialization and encryption of the ioBlackBox payload. Published as reverse-engineering research.

A comprehensive collection of Frida scripts and Python tools for Android dynamic analysis. Includes PoCs for bypassing SSL pinning, root detection, obfuscation, and client-side cryptographic integrity checks.

A JavaScript reverse engineering and asset analysis pipeline for security auditing. Crawls targets, deobfuscates bundles , and extracts hidden endpoints and secrets.

An unofficial source-level reconstruction of the publicly released Grok Bot 0.18.0 macOS app, producing readable TypeScript with two inference routes through Codex and OpenRouter, a local Docker sandbox, and local usage statistics. For research only.

Chrome DevTools extension for intercepting, modifying & reverse engineering HTTP requests. Real-time request log, rules engine, mock responses, replay, rate-limit bypass, WebSocket monitor — all in a dark-theme DevTools panel.

JavaScript parser, AST and oxc-compatible code printer for Go — byte-exact output, zero dependencies.

Protocol documentation for the ASUS ROG Ryuo IV AIO cooler screen, reverse-engineered from the shipped firmware — with a Python reference client (Linux and Windows, no ASUS software).

VS Code extensions and translators to generate PlantUML from source code and generate code skeletons from PlantUML for Java and Protobuf.

Verified tools and workflows for runtime JavaScript reverse engineering of modern defended SPAs (2024-2026 anti-bot landscape). Every entry checked against the GitHub API.

BLEIOT — a scientific and technical startup and research center for BLE, IoT, AI, and debug-testing. We publish analytical articles, videos, and tools to protect people from radiation, unauthorized control, and abuses of modern technologies.

The Unpacker class offers methods for detecting and unraveling obfuscated JavaScript code. It scans for a specific pattern commonly employed in obfuscation and attempts to reverse the obfuscation process.

A collection of analysis functions for reverse engineering RF protocols

Tools and a technical reference for P2 ("Protocol II"), the Siemens APOGEE building-automation protocol over TCP: a Wireshark dissector, a read-only scanner, a virtual PXC panel to develop against, and a P2→BACnet/IP bridge — for owner-operators working with their own legacy equipment.

RoseGPT is a Node.js class that provides access to 15 different Language Models (LLMs) for natural language processing and conversation generation.

Local reverse-engineering workbench: evidence ledger, version diffs, dependency maps, offline reports and REA-powered MCP tools.

WeChat 4.0 local-data research and archiving toolkit (WeMemo). This repository contains only sanitized development documentation and the frontend shell (rendering layer, theme engine, and wxgf original-image decoding). The Python decryption engine, reverse-engineering scripts, key material, and build artifacts are excluded.

☰ FutЯøn ☰ | Reverse-engineer, customize, and add features to any installed app. Patches compiled code, injects custom UI, translates code between 30+ languages. LLM-agnostic — works with Ollama, Claude Code, OpenClaw, or any AI assistant. Zero cloud cost.

SCPI command reference for ZOYI ZT-DQ02 LCR meter — extracted from firmware and verified on real hardware

Reverse-engineering an obfuscated Chrome extension: static Babel AST deobfuscator + 8 write-ups on how it reads the board, drives Stockfish and phones home

A reverse-engineering helper for finding serial output while probing undocumented boards (hardware+software)

Version-by-version reverse engineering of 55 ZCode IDE releases (v2.2.0–v3.12.3): signature snapshots, per-version diffs, and a 25-page analysis of the workspace-snapshot upload mechanism.

This script’s main purpose is to speed up the process of replacing functions that have been added into an array and replace them inside code that is calling upon their index level. Please see below the demonstration.

Reverse-engineering toolkit. Turn minified React bundles into readable code and extract their API: endpoints, params, bodies, routes, env vars. Vite, webpack, CRA, Next. Static analysis.

Print from Windows to the LX-D02 Bluetooth thermal mini printer (Funny Print) — adds it as a regular Windows printer. Based on rusq/thermoprint.

MCP thin-shell bridge exposing REA (reverse-engineering CLI) to MCP hosts: 21 curated tools + CLI escape hatch, ~6.7 KB schema instead of 1.83 MB

A complete reverse-engineering method for AI agents: two kits (local apps and SaaS thin clients), 12 phases, a dedicated validation gate, and the SEM-TRAVA gate that prevents the agent from stopping halfway. Installs in Claude Code, Codex, Hermes, or any chat environment with a shell. MIT.

Curated REA (Reverse Engineer Anything / rea-agents) use cases, examples, and AI reverse-engineering case studies with primary sources. Covers game ports, app analysis, hardware compatibility, and tool reviews.

Clean-room open-source Obsidian alternative. Local-first Markdown vault with wikilinks, backlinks, graph view and a plugin API. Reverse-engineered with REA.

Reverse-engineer UI animations from screen recordings into specs, demos, and a searchable local pattern library for Claude Code.

One command that rates how exposed your shipped app is to AI reverse-engineering agents such as rea, and closes what can be closed.

Desktop obfuscator for Luau scripts — custom VM, control-flow flattening, string encryption

Pattern-based deobfuscator for string-array (obfuscator.io-style) JavaScript obfuscation — recovers strings, strips decoys, and survives per-build regeneration.

Reverse engineering, security audit, and policy violation evidence for M4 Spider Notebook (OpenCode clone & Chrome DPAPI cookie extraction)

Ariadne traces a variable through JavaScript and extracts the code needed to reproduce its value, statically, without executing the target.

Dead-code and obfuscation analyzer for JavaScript and TypeScript, with a hardened Docker sandbox for dynamic analysis