Reverse-engineering case studies.

Valeton GP180 Reverse Engineering investigates the guitar processor's USB MIDI SysEx traffic, firmware and companion Suite software. Its capture analysis reassembles fragmented SysEx messages and records framing, transaction fields and observed message families for presets, effects, settings and file transfers.

fiilpod reconstructs FIIL earbud control protocols and integrates their battery, noise-control, EQ, and spatial-audio state into Xiaomi HyperOS. Its LSPosed module injects into Bluetooth and settings processes, communicates over SPP or BLE GATT, and documents GAIA, Mate, Airoha, and other command families.

upright reconstructs Lightroom Classic's Upright perspective correction from catalog transforms, controlled application runs, and selected CameraRaw binary observations. It publishes a two-camera homography model, measured Auto-mode behavior, evidence files, and an MIT-licensed Python port; the author reports that the port performs poorly on real photographs.

studio3svg reconstructs readable parts of Silhouette Studio .studio3 documents and converts their cut outlines to millimetre-based SVG. Its format specification records section structure, shapes, page size and stored previews, while a CLI, library and browser converter implement the reader.

technics-az100 reimplements control of Technics EAH-AZ100 earbuds on Windows through the Airoha RACE Bluetooth RFCOMM channel. A tray app and CLI set noise cancellation and ambient modes and read battery and codec status; a protocol log records frames and command IDs recovered from Android app analysis and Bluetooth captures.

SberBoom Remote implements Android and Windows clients for local control of SberBoom speakers over StarOS WebSocket messages. It ports the TLV protocol from a credited Home Assistant integration, then records pairing behaviour, opcodes and responses measured on a SberBoom Mini. An accompanying investigation examines the official Салют APK for device settings and their transport.

Curiosity Daily API documents endpoint paths recovered by decompiling version 3.21.6 of the Curiosity Android app. Its tables group GET, POST and DELETE routes for feeds, content, subscriptions, likes and authentication.

prism_connect implements the remote-control protocol of PRISM Live Studio v4.0.0+ as a Dart library. Its protocol notes describe the QR-code connection data, raw TCP session, message layout and commands; the example connects, sends commands and handles server messages.

qcywatch-android replaces the QCY companion app for the QCY Watch GT2 using BLE frames derived from the vendor app and captured watch traffic. It forwards notifications and weather, exports health data to Health Connect and saves workouts as TCX files; frame handling and parsers are implemented in Kotlin.

Tabelog API reconstructs an OpenAPI 3.0.3 description of the Tabelog Inbound 2.24.1 app backend from decompiled smali. Its scripts extract API definitions and serializers into YAML and JSON specifications, while notes cover endpoint paths, token handling, and selected live checks reported by the author.

Platinenlupe reconstructs an EarVision Wi-Fi ear camera's communication for browser-based PCB inspection. The author documents APK and firmware analysis that recovered BLE wake-up, Wi-Fi access, UDP JPEG framing and light control, then implements a two-board ESP bridge and local viewer.

Wuwa Tappo Linux reimplements the Windows-only shell of the Wuwa Tappo desktop pet as a Qt 6 application for Linux. It loads the web frontend extracted locally from the user's own 1.0.1 installer and supplies native window, input and WebSocket components; the author reports tests mainly in a nested Fedora Asahi Remix Wayland session.

Ocypus Digital Controller implements a Linux daemon and CLI for Ocypus digital cooler displays using USB HID communication recovered from the Ocypus Digital Elite Windows utility. Its documentation maps standard 64-byte reports and a YCC variant, including temperature, utilization, fan and display mode fields.

dvpn-decrypter reconstructs a mnemonic export path for the SOLAR Labs dVPN app. Its Go utility signs in with account credentials, requests the encrypted app key and mnemonic from the service, and uses Themis to decrypt the key and then the mnemonic.

OpenCfMoto for iOS reimplements the PXC dashboard exchange used by Carbit and EasyConnect motorcycle displays. The Swift app joins the bike's Wi-Fi, performs the control handshake, streams an H.264 navigation interface, and receives dashboard touch events. Its specifications trace behavior extracted from the Android OpenCfMoto app.

MechControl replaces the OEM Control Center on Uniwill-built MECHREVO, XMG and Eluktronics laptops with a native Windows application. It uses recovered embedded-controller registers, encodings and write sequences to manage CPU and GPU power, fans, battery modes and lighting. The author reports hardware testing on one MECHREVO IDY_7Y board; other model profiles derive from OEM data.

codex-app for macOS reconstructs the Codex desktop workspace as an Electron, React and TypeScript client for the official Codex app-server. Its study combines source and asset inspection, recorded interactions, layout measurements and protocol traces; the client implements chats, editing, diffs, terminals and browser tabs.

The FIIL headphone study reconstructs Bluetooth control framing and command behavior from FIIL+ 3.5.2 analysis and headset captures. Its documents cover GAIA, Mate and Doubao command spaces, SPP and BLE GATT transport, connection handshakes and response parsing.

The 喜鹊儿 App notes reconstruct login, timetable and attendance API behavior from packet captures, app decompilation and active server probes. They describe school routing, action/step requests, timetable day buckets and attendance checks, and pair those findings with a small Python client. The request-envelope encoder remains a version-specific placeholder.

BtCarKey implements an Android client for a keyless car box using a reconstructed FTK BLE interface. Its protocol notes map advertising data, GATT UUIDs, a 16-byte frame header, checksums, challenge authentication and car control commands. The client uses those messages to pair with and operate the box.

printer-craft reconstructs the CUPS printing pipeline identified in PdfCraft.app as a Python library and CLI. Its analysis maps Mach-O symbols and disassembly to printer discovery through lpstat, PPD option parsing through lpoptions, argument assembly and print submission through lp.

studo.js implements a TypeScript client for the Studo app's REST and socket.io chat interfaces after APK and network-packet analysis. Its endpoint notes cover request headers and API paths, while the client handles SMS login, channels, tabs, topics and messages.

MAL Private API documents the private MyAnimeList JSON interface recovered from version 0.11.8 of its Android app and supplies a Node.js client. Its reference describes request encoding, selected endpoint fields, and client-ID use for the examined app version.

Better Essential Space reconstructs access to Nothing's Essential Space in a native macOS client after studying its Android app and undocumented APIs. It implements the five-step account login, request signing, record and collection retrieval, audio downloads, and edits to record titles, summaries, and topics; research notes and Frida scripts document the findings.

The EasyKit investigation reconstructs local access to a BTicino / Legrand door station from companion-app analysis and SIP-TLS traffic. Its scripts recover the owner's TLS client identity; the author reports a successful handshake and accepted SIP registration. The author also reports a separate home service for ring photos and lock release, whose implementation remains unpublished.

Bull MosHome implements a Python client and Home Assistant integration using MosHome cloud behavior analyzed from the Android app and network requests. Its protocol notes cover x-ca HMAC-SHA256 signing, login encryption, HTTPS controls and MQTT state updates for supported switches, lights, curtains and chargers.

xperia-firmware-toolkit documents how Xperia Companion stores and downloads Sony Xperia firmware. Its investigation covers the app's Java/OSGi bundles, the ESS API request sequence and the SIN boot-image layout. PowerShell scripts capture firmware downloaded by Companion, and a separate guide covers Xperia 1 IV rooting and data migration.

FABA on Linux reconstructs how the FABA speaker stores and plays songs by examining the myFaba Electron app and files on the device. It documents MKI folder naming and XOR plus bit-rotation audio encoding, then provides Python tools to convert, encode, and load user-provided MP3s from Linux.

Voicemeeter Audio Callback research maps callback modes, command codes, buffer layouts, and calling conventions observed in Voicemeeter Potato. Python ctypes examples explore modes, preserve audio passthrough, and measure channel levels. The author reports testing on Potato 3.1.3.0.

lidl-plus-reverse documents Lidl Pay requests observed between the Lidl Plus app and its server. Its endpoint reference records authentication headers, methods, and bodies for loyalty lookup, payment methods, PIN validation, QR generation, and activation in the Spain region.

open-cardi reconstructs BLE control of Cardi K3 and K4 Active Ultra lighting kits in Android and web clients. The author derived GATT services, packet framing, and command behavior from decompiled vendor apps and HCI snoop replay, including color, zone, pattern, and reset operations.

Pool Comfort / Galaxywind implements a local Python client and Home Assistant component for pool heat pumps using UDP behavior recovered from the vendor Android app and LAN captures. It documents discovery on port 8818, sessions on port 1194, login, state attributes and control commands.

Mondeer Bluetooth scale reconstructs the BLE exchange used by Mondeer and WanKa C1 bathroom scales and implements a Python listener that publishes weighing data to Home Assistant over MQTT. The documented work combines decompilation of the original Android app with traffic observation; a separate Android companion app displays readings and exports to Health Connect.

Smartboard notebook Exporter documents the .notebook file format produced by a SMART Board MX065 iQ and converts whiteboard pages to SVG, PNG or PDF. It treats the document as a ZIP container, reads page SVGs and their order from the manifest, then adjusts page canvases before export.

The WeChat export investigation recovers chat data from WeChat 4.x for macOS. A Frida hook captures keys passed to CommonCrypto's CCCryptorCreate; Python scripts match the per-database keys to SQLCipher stores, decrypt the files, parse contact and message tables, and generate browser-readable HTML. The documentation records database paths and message-layout differences.

led-hue-cycle reconstructs LED LAMP's BLE commands for LEDDMX-family light strips in a native Android app and Python scripts. Its protocol reference specifies the FFE0 service, FFE1 write characteristic and nine-byte frames for color, power, brightness and patterns; the clients use those commands to cycle one or more strips through hues.

OPPO 移动电源助手 reconstructs power bank control on macOS from analysis of a Windows .NET assistant and its USB serial exchange. Its reports describe 0x5A packet headers, command IDs, and CRC8, while the Avalonia client displays battery and port status and synchronizes the clock.

LaMetric TIME Recovery Toolkit reconstructs the clock's Wi-Fi provisioning exchange from its Android APK and implements it in Linux scripts. It documents the setup AP's HTTP endpoints, account and Wi-Fi payloads, authentication and status codes, with DEX inspection helpers for examining the app.

AvellSucks is a Windows control app for an Avell gaming laptop’s fan, power settings and devices. The author recovered fan and power EC registers and WMI ACPI calls from the decompiled OEM app and hardware probes; the WPF app uses read-back checks and an audit log for EC writes. Other device controls use Windows APIs.

PodFlick reconstructs iTunesDB editing for fifth-generation iPod Video devices in a macOS video-transfer app. It converts clips to H.264 Baseline and AAC with ffmpeg, then writes video records directly into the device database without iTunes. The repository includes a format specification, Python reference implementation and database fixtures.

Vcf-compiler reconstructs the binary VCF file format used by Ruida VCutWorks. It compares native files with generated variants, documents header, layer, geometry and trailer fields, and implements a Python writer that converts DXF input or a specification into VCF. The author reports that generated files load in VCutWorks with geometry and cutting parameters displayed.

podscribe reconstructs old-format iTunesDB writing for the 5.5-generation iPod Video in TypeScript. Its format notes map the little-endian chunk tree and playlist references, while the library writes track and playlist records and includes a reader for comparison with an iTunes-generated database.

GameSir Connect share-code research reconstructs the desktop app's controller-profile export format and supplies a Python codec for editing and reimporting profiles. The documented GAMESIR: pipeline combines JSON, gzip, Base64 and AES-256-CBC, with a derived key and IV; the author reports testing on a GameSir G7 Pro.

sperax-rm01 reconstructs the Sperax RM-01 walking pad's BLE controls as a Python library and CLI. Analysis of the Sperax Fitness Android app's Dart AOT binary informed its documented FFF0 service, F5-framed messages, CRC-16 variant and start, stop and speed commands for model WLT6200.

UNAR6 reconstructs the AR6 archive format used by the Manažer M602 DOS file manager from observed archives. Its format notes specify record headers, directory entries, checksums and PKWARE DCL compression, while C, Pascal and Python implementations list, test and extract archive contents.

The BlackBerry 10 Assistant reference reconstructs the Dragon speech-service and Maluuba intent-service exchanges needed by the phone's original Assistant. It documents multipart audio and NLSML messages, JSON classifications, plugin intent fields and dialogue turns, along with the device settings and patches needed to direct the client to a replacement server.

The Packet Tracer .pkt/.pka project reconstructs Cisco Packet Tracer's encrypted lab-file containers and their XML payloads. Its Python codec and CLI decode, re-encode, inspect, diff and export files, while a builder generates lab topologies and scored activities using documented cipher, compression and schema details.

mihealth-api reconstructs access to personal Mi Fitness health data from the com.mi.health client API. Its Python client implements session handling and encrypted requests, synchronizes records into SQLite, and exposes local HTTP queries and a dashboard; API notes document endpoint and field behavior.

garmin-proto-lab reconstructs Garmin watch-facing GFDI communication in a Python compatibility client using findings from Garmin Connect's Android package. Its specification covers BLE routing, pairing, authentication, MultiLink transport, file access and FIT validation; the author reports offline implementation and tests, with live watch checks remaining.

Dorado reconstructs a Zune HD application runtime for .zcp and .ccgame packages. It parses NX and cabinet containers, remaps .NET Compact Framework identities and runs managed XNA 3.1 applications against a clean-room compatibility layer; the implemented desktop host also tests game rendering.

eJay statically recompiles the audio and graphics libraries of Dance eJay titles for a new cross-platform host. Its tools lift user-supplied DLLs to C for Linux and macOS, while a host drives the original libraries on Windows; the documented eJay 2 workspace supports sample browsing, block placement and playback.

vclights reconstructs VC-BLELIGHT lamp control from the Raingel Android app's BLE commands. Its Python client sets power, brightness, color and firmware modes, while protocol notes identify GATT services, write characteristics and opcode payloads; camera-based observations document device responses and color limits.

ilo2ctl rebuilds HP iLO 2 remote-console and management controls in C++, including DVC video decoding, keyboard and mouse input, RIBCL power and health operations, and ISO virtual media. The author reports comparing ported applet components byte for byte with recorded outputs from HP's Java classes.

gpcli reconstructs the MyGP Android subscriber app's API behavior as a Python command-line client. Based on decompiled APK and smali analysis, it implements authentication, balances, packs, purchases, recharge, billing and other account flows; the author reports live validation of read paths and selected transactions.

Atmoph Window 2 Remote implements local Home Assistant control of an Atmoph Window 2 through BLE commands recovered from the vendor Android app. Its documentation maps GATT characteristics, control tokens and quick settings, and records which behavior remains to be checked on AW102 hardware.

Antigravity session interoperability reconstructs a subset of Antigravity CLI 1.1.16's local SQLite and protobuf session format on Linux x86-64. Its Python generator creates synthetic conversation and summary databases; the author reports that the CLI displayed and resumed the generated session.

MIRO SmartHome reconstructs control of devices registered in the MIRO SmartHome app through a Home Assistant integration. It uses the app-derived cloud API and server model definitions to create fan, humidifier, sensor and switch entities. The author reports hardware tests on the MF03 fan and NR07 humidifier; other listed models were checked against definitions.

ScanStudio provides a native macOS scanning workflow for the Nikon SUPER COOLSCAN 5000 ED. It combines documented observation of Nikon Scan 4 with a Swift app, Rust engine and optional CoolscanPy hardware bridge for previewing film, selecting frames and capturing scans; the author reports testing real scans on one Mac and scanner setup.

tc01a reconstructs Fluke iSee TC01A camera control from the Android app and native library behavior. Its Python libusb driver streams thermal video, decodes per-pixel temperatures and sends vendor USB commands for shutter, gain and emissivity settings.

YouTubeClient adapts a decompiled Windows Phone 7 YouTube client XAP into a UWP application for Windows 10 Mobile and desktop. The port replaces WP7 navigation, settings storage, and dialogs with UWP equivalents while retaining the original page structure. The author reports an early draft with broken interface elements and nonworking search and top-video display.

wuibi reconstructs enough of Quibi’s mobile API to provide search and playback in a browser WebExtension. The author captured iOS and Android traffic, decompiled the Android APK, and recovered readable .proto definitions from embedded Protocol Buffer descriptors. The client then used those definitions to request playback information and hand streaming to Shaka Player; the service’s shutdown has left the client inoperative.

Smart Life cloud plug CLI reconstructs the Smart Life Android 7.10.6 signing and login flow for cloud-connected plugs. It extracts app signing material from the user's APK, selects a compatible signature form, and sends signed requests to list devices, read status and switch a plug.

timeline-export reconstructs Google Maps Timeline retrieval and decoding to export on-device location history as JSON. It calls Geller BatchSync, decrypts AES-256-GCM payloads, decodes SemanticSegment records and converts stored FeatureId values to Maps place IDs.

waze-stuff investigates Waze map-tile files through hex patterns and Python, TypeScript and C code for parsing and partial tile generation. It documents WZM/MAP_PKG, WZDF and WZT structures, including geometry, street labels and tile coordinates.

Notepad Tabs maps the binary format of Windows Notepad’s saved and unsaved tab files. It documents NP headers, paths, content, selection positions, SHA-256 and CRC fields, plus unsaved edit chunks, and supplies sample dumps and an ImHex pattern.

MovieOkeAI investigates the discontinued MovieBot animation app and builds a partial Python revival. The author describes APK inspection and MitMProxy captures to trace story prompts, the former web API, voice generation and animation settings, then implements basic generator, store and backend components.

xLamp reconstructs LampSmartPro 1.4.0's pairing and lamp-control flow in a Flutter Android app. It documents a 31-byte command frame with AES-128, XOR, and CRC-16/CCITT processing, then broadcasts encoded commands through 13 Bluetooth service UUIDs to control pairing, power, brightness, color temperature, and scenes.

Slovak Telekom App API documents HTTP requests recovered from the operator's mobile app. Its reference covers PIN verification, access and refresh tokens, account profiles, dashboard data and billing calls, with a Python example client.

dyson-lamp-ble reconstructs local control of a Dyson BLE lamp from MyDyson Android app analysis and device observations. Its Python library and CLI obtain an account-issued long-term key, perform the BLE session handshake and send power or synchronized-mode commands. The protocol notes describe GATT characteristics, HKDF-SHA256 key derivation and message framing.

MiFit-Hack-API documents Mi Fit Android app requests observed through mitmproxy and provides Python access scripts. Its notes map registration and login tokens, a band-data endpoint, and Base64-encoded step and sleep summaries.

The Foreca S60 weather server reconstructs the legacy HTTP service expected by Foreca Weather 1.4.x on Nokia Symbian phones. A Python bridge translates location and forecast requests to the current Foreca API and other map sources, while a SIS patcher changes the server host in a user's app package. Protocol notes describe the search and weather-package endpoints.

XY Remote reconstructs BLE control for XinYi Sinilink amplifier boards in an iOS app and Swift library. Protocol notes derived from the vendor Android app's Hermes bytecode describe GATT service AE00, frame assembly, checksums, commands and the connection handshake. The author reports testing against app logic and a simulated amplifier.

RideLink reconstructs TVS SmartXonnect scooter communication in an Android companion app. Protocol notes derived from static analysis of TVS Connect 8.13.2 map BLE GATT characteristics, connection steps and navigation and telemetry frames. The app forwards map directions and phone events to the display and records ride data.

lumalou reconstructs local Bluetooth LE control of the Fisher-Price Lumalou bedtime device after its companion app was discontinued. Python and TypeScript implementations perform the MPID handshake with P-256 key exchange and AES-128-CTR framing, then control lights, audio, schedules and routines. The repository includes protocol documentation, shared test vectors and a browser client.

Scarlett MixControl replaces Focusrite's MixControl 1.10.6 on modern macOS for first-generation Scarlett interfaces. The Swift app exposes matrix mixing, output and capture routing, metering and presets through USB control requests. Its command mapping comes from signal tables extracted from the original application and disassembly of routing functions.

Mi Fitness Sync reconstructs workout retrieval from the Mi Fitness Android app and implements a Python CLI for activity export and Strava uploads. Its JADX-based notes map Xiaomi Passport authentication, activity API calls and FDS download handling. The client decrypts workout blobs and exports available data as GPX, TCX or FIT.

SSL Console Control implements Python control of SSL Matrix-family and Sigma mixing consoles over their native UDP protocols. The author derived Matrix behavior from a Java control app and packet captures, and Sigma behavior from Android APK decompilation and ARM Thumb2 analysis. A terminal interface and CLI expose channels, routing and session controls.

logitech-ipc-protocol reconstructs the Logi Options+ agent's local IPC messages for querying devices and changing their active host. Its notes specify binary framing, JSON request paths and protobuf payload types across macOS sockets and Windows named pipes. The repository includes client scripts and records a Windows 2.7 change that routes access through the app's renderer relay.

samsung-notes-format reconstructs the handwriting geometry stored in Samsung Notes .sdocx files. Its Python reader parses page objects and pen-stroke deltas, then renders strokes to SVG; accompanying notes describe the ZIP container and structures traced through a jadx decompilation of the Android app.

cam-server implements a backend for the Digicam Print Channel, producing responses in the format the client expects and rendering images from its templates. Its Python code serializes response fields as key-value lines and parses page, image, text and background settings for output.

bline investigates an earlier LINE voice-call stack and supplies tools for its custom ZLIB-compressed SIP data. The repository includes a compression and decompression library, a command-line pipe utility and a Kaitai Struct definition for heartbeat messages.

WazeTripper connects Waze navigation to a Royal Enfield Tripper Pod by patching a Waze Android APK and sending commands over a reconstructed BLE interface. Its protocol notes cover the Pod's GATT transport, packet fields and confidence levels, while the build scripts download Waze and inject Java hooks for navigation events.

device-reveng investigates a Choiceway GT6-EAU Android car head unit and rebuilds its launcher and operating-system layer. Findings on OEM applications, AIDL interfaces, camera behavior and the MCU serial link support a Kotlin/Compose launcher and Riposte OS images assembled from the owner's firmware backup.

VTech Baby Pro Bridge reconstructs local streaming from an RM-series camera through TUTK/Kalay and VTech's X25519 and ChaCha20-Poly1305 layer. Its C bridge serves video through RTSP, WebRTC and HLS, while companion scripts probe the owner's paired Android app for connection values and use SDK libraries extracted from that app.

Reengineering Project for ibisPaint investigates the app's IPV artwork, IPCF configuration and IPBZ brush QR formats. It records IPV chunk fields, provides a hex pattern and Python parsing scripts, and notes version data and deflate-compressed brush content in IPBZ QR data.

caniOn Rebirth reconstructs the Mitsubishi ZEV CAN protocol used by the caniOn v152 Android app for the i-MiEV, iOn and C-Zero. It documents frame identifiers and signal scaling, implements a JVM protocol engine with CLI and Android clients, and supplies a script that patches a user-provided APK to use standard ELM327 commands.

AionLink Open investigates ICCOA CarLink connectivity for the GAC AION i60 through static analysis of Android APKs and an independently written Android client. Its Kotlin modules cover BLE discovery and GATT inspection, experimental Wi-Fi Direct and USB transport, UCar framing and authentication probes; the author reports that an ICCOA session and projection on the vehicle remain unconfirmed.

claude-peer reconstructs the local Unix socket peer exchange used by Claude Code and Claude Desktop. Its protocol notes describe session registration, token authentication and line-delimited JSON frames; a Node.js CLI and SDK discover active sessions, send messages and register external peers.

Nona investigates the Redmi Note 10 Pro Max camera's 108 MP remosaic behavior and implements a Camera2 app around the observed ISO and AecLux conditions. The research log describes vendor stream configurations, empty full-resolution RAW buffers and the processed YUV path; the app exposes live status, exposure assistance and image-processing controls.

elevenlabs-reader-cli is a Python command-line client for creating ElevenLabs Reader documents and streaming their audio through the Reader WebSocket. It follows the mobile app’s captured authentication flow, using Firebase tokens for account access and an App Check token and device ID for WebSocket streaming, with playback and optional live text preview.

Yi M1 wireless protocol research reconstructs the camera’s BLE pairing, Wi-Fi handoff, HTTP remote-control commands and UDP live-view frame format. Python scripts demonstrate pairing, starting remote control and extracting JPEG previews with accompanying settings from findings based on Yi Mirrorless Android decompilation and traffic captures.

TelloPython implements Python control of Tello drone functions available through its mobile app beyond the documented API. Its notes describe recovering command IDs and packet fields through Android app decompilation and Xposed hooks, then using those findings for joystick movement and flip commands.

Humax-CLI implements terminal control of the Humax IR4000HD receiver from findings the author attributes to reversing its Android app. A Python script sends button commands to the receiver over UDP and exposes listed codes for navigation, recording, playback and device controls.

Swish QR format documents QR-code payloads for Swish payments. It describes type prefixes A, B and C, their number, amount and message fields, and the bit flags that mark fields as editable. Type D is listed but its format remains undocumented.

baseus-desktop reconstructs Baseus earbuds control in a Windows and Linux desktop client. Frida scripts and Bluetooth captures inform packet tables for the Bass BP1 Pro ANC and BP1 Ultra; Rust crates implement framing, per-model decoding and BLE transport. The app exposes battery status, noise controls, EQ presets and other supported device settings.

Samsung Cloud Notes reconstructs access to Samsung's private note-sync services in Mac, iOS, Android and command-line clients. Its research documents static analysis and runtime observation of Windows components, observed cloud endpoints and XML structures. The clients browse and edit supported typed-text notes, keep local caches and export note content.

Music Tag Desktop reconstructs the behavior of Android Music Tag 1.2.5.2 as a Windows music-tag editor. Its investigation traces Java code, the native libmain.so library, resources, and music-service request logic; the Python and PySide6 app handles local tags, lyrics, artwork, and metadata matching.

vector-studio-re reconstructs the automation interface of Vector Studio 0.1.11 from its shipped Linux AppImage. Extraction scripts unpack app.asar and split the Electron bundle into modules; protocol notes document the loopback JSON RPC endpoint, authentication and operations. A standard-library Python client and stdio MCP bridge call the recovered interface.

AirTray reconstructs an Elgin Air app client as a Windows system-tray controller for compatible air conditioners. It signs in with the owner's account, discovers registered devices, reads their state and sends temperature, mode and power commands through the cloud service. The author reports live validation on one authorized device and account.

HikVision QR export decoder reconstructs the format of Hik-Connect device export QR codes and provides a Python decoder and renewal command. The author traces Base64 and zlib layers, field separators, device credentials, and expiration data, then describes using Ghidra to identify the native library’s encryption routine.

ShatteredGlass reconstructs SwiftUI's Liquid Glass appearance on macOS using a layered Core Animation view. Its documented hierarchy combines CABackdropLayer, CASDFLayer, CASDFElementLayer, SDFPortalLayer and filters for backdrop distortion and edge highlights.

Grok3API implements a Python client for Grok’s mobile gRPC interface. It serializes protobuf requests, wraps them in gRPC frames, and parses streamed response chunks into Pydantic models. The repository includes protobuf definitions and examples for sending messages and continuing conversations.

The Things Cloud Python client reconstructs part of the service's request behavior from traffic produced by the Mac app. It implements account login and creation or editing of to-dos and projects, while documenting that some exchanged field meanings remain unknown.

NVFC implements undocumented NvAPI interfaces for NVIDIA GPU monitoring and configuration. The author recovered the interfaces by observing nvapi_QueryInterface calls in existing utilities; the C++ tool reads clocks, voltage, temperature and fan state and can set fan behavior.

SingStar Mic documentation reconstructs the Android and iOS app's local discovery, catalogue and game-service exchanges. It specifies UDP and HTTP ports, packet structure, commands, audio format and acknowledgement behavior, with a Python proof-of-concept server.

Techstream for Linux reconstructs selected Toyota and Lexus diagnostic resource formats, command behavior and transport handling in a Python GTK4 workbench. It browses local CT and DDB data, decodes recordings and replays diagnostic sessions using synthetic fixtures. The author reports that physical vehicle communication remains unconfirmed.

The Fluval Plant Pro 4.0 project reconstructs the light's CBOR-over-BLE control protocol from the FluvalConnect Android app. An ESP32 ESPHome configuration sends commands through vendor service FFF0 and exposes power, five color channels, schedules and state updates to Home Assistant.

xtractedott reconstructs portions of Xfer Records' OTT VST multiband compressor in C. Its source covers three-band crossover filters, upward and downward compression, envelope following and parameter mapping. The author describes the code as partly incorrect and unable to build.

OpenApe reimplements the Call of Duty 4 mod tools' asset_manager.exe as a C++20 desktop editor. The author attributes its format knowledge to machine-assisted analysis of decompiled binaries. It reads GDF definitions and GDT game data, and previews models, animations and materials using the game's compiled shaders.

EOO reconstructs the Nintendo DS Wii connection utility stored in Pokémon Diamond and Pearl. Its ARM7 and ARM9 assembly and C sources build an NDS image identified by SHA-1. Contributor guidance describes replacing extracted assembly with C that compiles to the same instructions.

PictoChat's standalone DSi system title is being reconstructed as matching C source for its ARM components. The workflow extracts a player's own title and BIOS dumps, compiles candidate functions with mwccarm and compares bytes with relocation awareness. The author reports 1,048 matched functions out of a current estimate of 1,551.

Implements the proprietary protocol that AirPods use with Apple devices, which the author reports reverse-engineering, so that Android and Linux apps can switch noise-control modes, read ear detection and accurate battery levels, and use conversational awareness, head gestures and hearing-aid settings. The repository documents captured packet formats, opcodes and control commands alongside the Android app and the Linux app. Several features need root on Android or remain experimental.

OpenHaystack uses a reconstructed Apple Find My protocol to build personal Bluetooth tracking tags and a Mac app that queries their location reports.

A cross-platform interpreter for GW-BASIC, BASICA, PCjr Cartridge BASIC, and Tandy 1000 GWBASIC. Release v2.0.8 is commit 6a3a035b0a1c1029d48bc9284e642b6b4bd64fb5; the shipped program tests/basic/gwbasic/PRINT_USING_scientific/TEST.BAS is compared byte for byte with model/OUTPUT.TXT.

Builds an open operating system intended to run applications and drivers written for the Windows NT family. The README focuses compatibility work on Windows Server 2003 and installs onto a FAT16 or FAT32 boot partition.

A Linux RSS reader in Rust and GTK4 that the README calls a port of NetNewsWire. A local OPML file is the account input; cargo build --release writes target/release/viaduct, and the CI workflow runs cargo test --workspace.

Repackages VNG's Zalo desktop app for Linux from the official macOS installer. The harness builds a .deb, and a headless smoke script expects the extracted bundle to open a window.

Free-BBN recreates the PlayStation Broadband Navigator dashboard as a PS2 homebrew application built with ps2sdk and gsKit. Its source implements the execution core, menu rendering, music and sound effects, with partial FMV playback. The author describes the project as a paused proof of concept.

Serato Tags reconstructs the GEOB metadata structures that Serato DJ stores in audio files. Its investigation and field notes cover version data, BPM and gain, beat grids, hot cues, saved loops and waveform overviews, with sample tag dumps and Python inspection scripts.

lsdj-decomp reconstructs Little Sound Dj 9.4.2 using tracked symbol maps, ROM analysis tools and C translations substituted into locally generated RGBDS assembly. The author reports an exact full-image comparison from a user-supplied ROM and 174 C functions matching 12,918 original bytes.

Moonlight Windows recreates NVIDIA Shield GameStream access on Windows and Windows Phone 8.1 after reverse engineering the Shield streaming software. Its WinRT client discovers compatible PCs, pairs with them and streams games from a host PC.

sas7bdat reconstructs the binary layout of SAS7BDAT database files by examining sample databases for interoperability with R. Its format study covers headers, pages, subheaders, packed data, platform differences and compression, alongside a prototype R reader.

The Outlook drag-and-drop investigation decodes the RenPrivateMessages OLE clipboard stream to recover identifiers of the original Outlook message. It records field lengths, MAPI folder and store IDs, message class, subject and entry ID, with a C# WPF example that reads the data.

hbkit reconstructs the Synology Hyper Backup .hbk archive format and implements a Python file-recovery tool. Its specification separates layouts established by file reconstruction from those read from HyperBackupExplorer disassembly or inferred from observations. The CLI and terminal interface browse, extract and check archived files against stored MD5 and CRC32 values.

Murmelbahn decodes GraviTrax course data obtained through the Ravensburger app API and presents course details and bills of materials in a web app. The author used ImHex to work out changing file formats and includes a schema and parser for recent course versions.

LSDisJ disassembles Little Sound DJ Game Boy ROM versions 9.2.L and 8.5.1 from user-provided copies. It generates assembly using rgbds, keeps symbol and annotation files, and includes Python helpers for comparing ROM bytes and counting unresolved calls.

The h3maped project reconstructs C++ classes from the HoMM3 Horn of the Abyss map editor's executable. It uses IDA disassembly, RTTI, MFC message maps and dialog resources to recover class relationships, handlers and fields, recording original addresses alongside the reconstructed files.

Wii Motion Plus Demo Video Player reconstructs a Wii video-player program found in several games. The repository contains C++ source, symbols and split configuration, with instructions for building from a user's game copy and inspecting object differences with objdiff.

Cordial hosts the unmodified Roblox Android client on Linux through a ported bionic linker, ELF import resolution and substitutes for Android JNI and framework calls. Its Rust and C++ runtime supports x86-64 and aarch64 builds, with Wayland as the primary display backend.

The LSDj project reconstructs Little Sound Dj 9.4.0 with symbol maps, matching C functions and an RGBDS assembly tree generated from the user's ROM. Its tools trace reachable code, recover code/data boundaries and compare rebuilt bytes; documentation covers the music data model, save format and link-cable synchronization.

VitalWear recreates Bandai Vital Bracelet BE gameplay as a Wear OS watch app with a phone companion. It loads user-supplied 1.0.B firmware and DIM or BE Memory card images, validates cards against a physical bracelet, and implements character training, battles and adventures.

Moonglow Toolset reimplements the Aurora module editor for Neverwinter Nights: Enhanced Edition in Rust, egui and wgpu. It reads game data from a local installation and edits areas, blueprints, scripts and modules; its authors compare output against Aurora and the game and publish findings on GFF, 2DA and editor behavior.

cpr2rpp documents the empirically recovered Cubase 12 CPR project format and converts selected project data into REAPER RPP files. Its parser extracts audio-event timing and sources, mixer faders, pan, EQ bands, sends and pool clip metadata. Format notes describe the named-record grammar and compact arrangement-event encoding.

wii-news-channel reconstructs the USA v7 Wii News Channel as C/C++ source intended to build a byte-identical main.dol. Its symbol and split maps support function-level comparison with objdiff, while a separate branch adapts the channel to a native PC runtime.

TraktorMappingFileFormat documents the controller-mapping data stored in Traktor Pro 2.x TSI files. A 010 Editor script extracts the encoded mapping payload, while a binary template describes big-endian record headers, devices, MIDI definitions, ports and mapping settings. Sample TSI files accompany the tools.

AvatarEditorRecomp statically recompiles the Fall 2010 Kinect-preview Xbox 360 Avatar Editor into a PC application with ReXGlue. Its code provides a native D3D12 renderer, avatar asset handling, item-catalog search and keyboard or XInput control. The build uses a user-provided editor executable and matching dashboard assets.

perception-pnrf documents the reverse-engineered PNRF measurement file format used by HBK Perception and provides Python and C# parsers. Its specification covers the NSS container, waveform and event channels, calibration and metadata. A command-line dump tool displays recording structure and sample previews.

metars_cgi reconstructs the data server used by NCAR's Java METAR viewer. Its PHP scripts answer the viewer applet's requests from a MySQL or MariaDB METAR database, while a Python script fetches updates from NOAA. The author uses decompiled applet binaries to guide the reconstruction and notes unresolved handling of cloud-layer chunks.

Xbox Demos Decompilation reconstructs the Xbox application that launches videos and demos from the North American BLiNX: The Time Sweeper disc. Its nonmatching source aims to reproduce the launcher's behavior and documents Bink video support, an unused animated background and unfinished alternative graphics code.

ag-psd reconstructs reading and writing of Photoshop PSD documents in JavaScript and TypeScript using format references and trial and error. It handles document structure, layer and composite image data, masks and selected metadata, with examples for Node.js and browsers.

locus-poi-db investigates the POI database format used with LocusMaps LoMaps. Its project page lists a format document and SQL schema.

An official educational challenge investigation connects binary checks to equations and records an original-program validation.

An unofficial field study that reads REA's source and then drives the running server through 1,012 recorded calls across 27 artifact classes, measuring its content-addressed Evidence records, revision-chained unknown ledger, typed refusals, cold starts and response limits. The author maps those mechanisms onto vulnerability-research agents as an argument for not overclaiming. It evaluates REA's tool surface.

Fedele Mantuano reports using Codex with REA in an offline Docker lab to statically analyze a public Windows malware sample without executing it. The article separates behavior supported by the extracted JavaScript bundle from claims that would depend on remote components that were never obtained, and reclassifies a suspected infostealer as a loader. It is a defensive static analysis case built on an author-reviewed agent report; reconstruction and dynamic detonation were outside its scope.

A REA/Ghidra report studies the Ubuntu netcat-openbsd 1.234-1 ELF binary and publishes evidence envelopes, decompiled functions and a function inventory. Its output is a static investigation, rather than a rebuilt netcat application.

The authors describe Woxi as a Rust interpreter for a subset of the Wolfram Language, focused on CLI scripting and Jupyter notebooks. The README does not claim full Mathematica compatibility.

uniswap-v2-reborn reconstructs Uniswap v2 factory, pair and Router02 behavior from deployed EVM runtime bytecode using REA interface inspection, storage probing and written specifications. It provides a TypeScript model, Solidity 0.8 contracts and a differential harness that compares both with the original bytecode; the author reports 4,800 fuzzed operations without mismatches and exact replay of 426 historical swaps.

Ports Eidolon, Poo-Brain’s winning PC 64k intro from Revision 2017, from its packed 60,928-byte Windows executable to Rust, with chapters on how the original binary works and a separate size-optimized build. The author reports that coordinated OpenCode and Claude Code agents, using Ghidra through the REA MCP server among other tools, captured a controlled-clock reference of the original and matched all 27,000 frame hashes and the full PCM. Exactness rests on the project’s own GPU-specific captures, and the port embeds the original’s data.

The m0rph investigation examines an obfuscated x86-64 ELF CTF flag checker with readelf, strings, Cutter and Radare2. Its write-up traces indirect CALL RAX execution into allocated memory and describes recovering expected characters by breaking at the call and inspecting RDI during each loop iteration.

CPQ IO Scheduler reconstructs Xiaomi's proprietary cpq.ko Linux block scheduler from a stripped ARM64 kernel module. Its out-of-tree C implementation combines priority classes, thread-group queues, deadline handling, and blk-mq elevator integration, with a whitepaper and author-reported benchmarks.

A malware investigation examines njRAT and a UPX-packed Casdet executable with PEStudio static triage and ANY.RUN sandbox telemetry, alongside a malicious PDF and benign comparison files. The author reports process, registry and network behavior, extracted indicators and MITRE ATT&CK mappings in a report and screenshots.

An FSR 4.1.1 INT8 investigation reconstructs the upscaler’s GPU passes in HLSL and compares their outputs with AMD’s compiled kernels through a D3D12 harness. The author reports byte-identical offline results for the documented passes and supplies an FFX-compatible provider build that obtains network weights from a user-supplied official DLL. Colour-mode paths and live frames have narrower comparison evidence.

bcwc_pcie audits the community FaceTime HD Linux driver against Apple's AppleCameraInterface.kext for Broadcom PCI 14e4:1570 cameras. Its scripts trace MMIO register accesses through the kext and compare offsets, masks and sequencing with the vendored driver; the author reports finding 19 registers the Linux implementation does not cover.

XexTool-RE reimplements the closed XexTool utility from analysis of its binary and processes Xbox 360 .xex executables. Its C++ CLI and GUI inspect headers, extract basefiles and resources, convert compression or encryption, and document XEX layout and digest behavior. The author reports byte-identical output for most compared operations, with stated exceptions.

slopgs reconstructs the behavior of the Windows XP SP3 Microsoft GS Wavetable Synth driver in a portable C synthesizer. Its engine renders MIDI using gm.dls, with native and WebAssembly builds. MIDI probes and spectrogram comparisons against reference recordings guide refinements to synthesis behavior.

SP11X1e-audio reconstructs Surface Pro 11 speaker and internal microphone behavior on Linux from Windows runtime observations and binary analysis. Its patches and AudioReach topology address SoundWire amplifiers, LPASS microphone clocks and capture routing; reproduction scripts rebuild the accepted topology and kernel artifacts.

uniq-reconstruction rebuilds GNU coreutils 9.7 uniq in C from black-box observations of a stripped ELF executable. The author records 51 probes covering flags, grouping, delimiters and error behavior, then implements argument parsing and stream processing. The author reports that the candidate passed all 43 comparison tests for output, exit code, stderr and file effects.

Watcom C 6.5 run-time library restoration rebuilds damaged CLIBS.LIB and CLIBC.LIB from surviving archive modules. It maps sector loss, converts modules from intact memory-model libraries, reconstructs selected C routines from machine code and records provenance for each result; the author reports matching every surviving byte used for comparison.

IOReport decompile investigates Apple’s IOReport dylib, which provides calls for reading system reports and counters. The author describes disassembling powermetrics to understand its use of IOReport and provides an incomplete Objective-C reconstruction with a Makefile-built test program.

dargh reconstructs the Dynamic Animation Replacer DLL for Skyrim Special Edition in C++ from analysis of versions 1.1.2 and 1.1.3. Its replacement uses hooks and trampolines for animation replacement and implements condition functions. The author reports apparent operation with Skyrim GOG 1.6.659 after limited testing.

ndec-re investigates an old MS-DOS COM encryption program through debugger-assisted assembly analysis and implements its encryption behavior in Go. The write-up traces the program's copied code, password-derived gamma and hashes, self-modifying instruction choice, initialization byte and mixing rounds. The repository also contains the original COM file and Go tests.

re-sysinternals-suite records an educational rebuild of the Sysinternals strings.exe executable. Its first episode contains C++ source, comments on the implementation, a Windows XP build patch and a link to a video walkthrough of the reverse-engineering process. The repository documents one rebuilt utility.

ExCrypt reconstructs Xbox 360 XeCrypt functions as a C and C++ replacement for use with existing console code and data. It aims to match externally visible state and return values for functions exported by the kernel or used during boot and in games or apps.

L1J-Encode-CLI reconstructs the Lineage 1 launcher's ServerData encoding as a Python encoder and decoder for IP addresses, ports, and feature flags. Its report describes disassembly, memory inspection, and differential analysis of Encode v3.63; the author reports byte-for-byte agreement in 106 comparisons with Encode.exe.

Wirenet Reverse Engineering investigates the Wirenet Linux trojan through recovered source code and an Italian analysis report. The report covers the malware's workings, while an accompanying article focuses on its keylogger implementation.

SNES Station Decompilation reconstructs the PlayStation 2 SNES Station v0.23 WIP executable through source recovery, historical toolchain matching and image comparison. Its analysis covers the emulator core, PS2 runtime, renderer and SJCRUNCH container. The author reports a byte-identical rebuilt packed ELF against a user-supplied reference.

RFL reconstructs the Wii library responsible for handling Miis from an original game image. The build targets the 20080306 version from Challenge Me: Word Puzzles, and objdiff compares built objects; the author reports matching release builds and two unmatched debug functions.

cod4map reconstructs the BSP compiler shipped with the 2007 Call of Duty 4 mod tools from its executable. Its C and C++ source builds a 32-bit Windows cod4map.exe; the project uses x87-oriented compiler flags because SSE2 floating-point generation changes BSP output bytes.

The project reconstructs AGS Aging Cartridge 7.0 from a user-supplied Game Boy Advance ROM as assembly and C source. Its build targets an aging.gba image with a published SHA-1 and uses devkitARM and pokeruby-tools.

OtterSec researchers describe an agent pipeline that reconstructed Rust source for the closed-source GoonFi V2 Solana program until a rebuild with the original toolchain reproduced the deployed ELF. Per-function instruction scoring, a deterministic merge judge and bans on assembly and other score-gaming constructs steered the agents; matching function order and panic-location paths closed the last differences. The article and a companion repository document the method and a verification script, while the internal tooling and agent transcripts remain unpublished.

Statically recompiles HyperCard 1.2.2, a classic Mac application. The user supplies the file named HyperCard; tools/corpus.json records 2642 covered call sites out of 3166, and tools/conformance.py fails if that count drops.

A from-scratch C reimplementation of the Berkeley Speech Technologies formant synthesizer sold as BeSTspeech and shipped in HumanWare Keynote GOLD. The original binaries are the comparison input and are not in the repository; make selftest checks tests/golden.txt, and make test compares the engine with those binaries.

Rebuilds Centigram TruVoice, the 1997 text-to-speech engine, as portable C. tools/difftest.py compares PCM from the C build with the original DLL across the corpus checked in that script.

Rebuilds Lernout & Hauspie TruVoice 6.00 build 10, the SAPI 4 American English engine in tv_enua.dll, as C99. The port reads that DLL's tables at run time and checks PCM against the running engine.

Rebuilds Microsoft Anna, the Windows Vista and Windows 7 TTS20 voice, as C99 that reads the original voice data files. The README reports bit-exact PCM against the real engine on its test lines.

Rebuilds the Windows OneCore text-to-speech engine MSTTSEngine_OneCore.dll 10.3, the David, Zira, and Mark voices, as C99 that reads the original voice files. The README reports sample-for-sample PCM on its corpus, with two Zira lines excepted.

Rebuilds the Windows XP SAPI 5 engine spttseng.dll for Microsoft Sam, Mike, and Mary as C99 that reads the original voice files. The README reports audio of the same length with every sample within ±1 LSB of the 16-bit engine.

Rebuilds ETI Eloquence 6.1.0.2, the US English ECI.DLL plus ENU.SYN, as C with a drop-in ECI.DLL for x86 and x64. This is KamiKitsune420/eloquence-decomp, a different tree from Mudb0y/openevv.

Decompiles the Speech Plus and Telesensory Systems Prose 2000 text-to-speech firmware, an 8086 host plus an NEC uPD7720 DSP, into C. The README says the build does not need an emulator or ROM files.

Reorganized cc65 source for GEOS 2.0 on the Commodore 64 and 128. The README says a standard compile generates binaries identical to the GEOS 64 2.0 and GEOS 128 2.0 distribution binaries, and make regress compares the bsw and wheels builds with the reference tree.

Reverse-engineered cc65 source for geoWrite 2.1, the GEOS word processor, in English and German. The README says a standard compile generates binaries identical to the English and German geoWrite 2.1 distribution binaries. The orig tree holds the collected original versions.

A C99 library of the E-mu SP-1200 and SP-12 sampler audio path: pitch playback, filters, and the dynamic filter. The README says firmware behavior comes from running E-mu's operating-system code in a Z80 emulator, and make check runs the shipped suite.

A drop-in dsound.dll that reimplements Creative ALchemy and DirectSound behavior, including DirectMusic pieces the README names. ./build.sh builds the DLL and runs the native unit tests. The README says comparisons with Microsoft's DLLs are line-by-line and event-by-event.

Konami's Game Master reconstructs the Japanese RC-735 MSX utility cartridge as annotated assembly. The cartridge adds save and load functions, cheats and rankings to other Konami MSX1 games. The author reports that sjasmplus assembles the source into a bit-perfect copy of the original 16 KB ROM.

dolnetbp reconstructs the GameCube Dolphin Network Base Package eth, mdm and netcfg libraries in C. Its objdiff configuration pairs release and debug build outputs with original library objects for comparison.

Dolphin SDK 2004 Libraries reconstructs the built code libraries of the April 20, 2004 Dolphin SDK as C and assembly sources. Its build process extracts the user's .a archives with DTK and builds the supported libraries; the project reports several libraries still in progress.

dolsocketlibrary reconstructs the Dolphin Network Base Package ip and dvdeth libraries in C. Its build configuration generates Ninja and objdiff inputs for comparing release and debug objects with the original GameCube library objects.

open_rvl reconstructs the Wii SDK version found in Wii Sports as C source for reuse in game decompilations. It draws names from game debugging information and uses SHA-256 records generated from assembly or object files to check selected functions and data.

NW Eft decompiles the NintendoWare for Cafe Eft library found in the Wii U game New Super Mario Bros. U. Its C++ source and headers cover emitters, rendering and related library components. Exact byte matching is outside the project's current priority.

libgpu2 reconstructs Sony's 1998 PlayStation 2 Graphics Synthesizer software model from 23 ELF32/i386 objects as buildable C++. The project documents the recovered pipeline and compares VRAM output from replayed graphics streams with the original model and PS2 hardware. The author reports bit-identical output to the original model on its dump corpus.

re_nfpii reimplements the Wii U nn_nfp.rpl library for amiibo emulation and research. Its module replaces the library's exports and redirects tag reads and writes to SD-card dumps, while a companion plugin provides selection and configuration. The author describes the work as experimental and says it currently covers the major parts of the library.

MWCC reconstructs six Windows x86 versions of the GameCube CodeWarrior compiler mwcceppc.exe. It maintains C and C++ source for the driver, frontend, optimizer and backend, then compares rebuilt objects, functions or executable hashes with the original version according to each build configuration.

GA330-libretro reconstructs the Gemei A330 runtime as a libretro core using Unicorn to execute ARM application binaries. A minimal replacement OS loads programs and supplies file, input, and timing handlers; the author reports that 7days reaches gameplay.

linker_pc reconstructs the fastfile linker distributed with the Call of Duty 4 mod tools from its shipped 2008 executable. The recovered source builds a 32-bit Windows tool that reads zone CSV files and writes .ff fastfiles, using specified MSVC flags to preserve x87 floating-point behavior.

EGG Library is a work-in-progress decompilation of a Wii software library, aiming to share one source set across multiple games and applications. Users supply a supported game's disc image, build with Ninja and compare generated objects through objdiff.

NitroSDK Decompilation reconstructs Nintendo DS SDK library source from code extracted from supported game ROMs. It organizes C source, headers and symbol maps around an objdiff workflow and uses stable identifiers to track functions shared across games.

Hagi decompiles the GameCube and Wii emulator executable included with Super Mario Sunshine in Super Mario 3D All-Stars version 1.0.0. Its build workflow starts from the user's original main NSO and uses CMake, Ninja, Python and a Rust toolchain.

Character Pipeline April 2001 Libraries reconstructs C source for the component's built code libraries. It covers actor, animation, control, geometry palette, lighting, shader and skinning libraries; make extract uses DTK to disassemble user-provided .a archives into source files.

This repository disassembles BIOS images from 8088 machines: the Tandy 1000, Tandy 1000A, Tandy 1000 HX, IBM PCjr, and IBM PC 5150. The README says the original images are in roms/ and the disassembly is in the subfolders, made with IDA Pro freeware.

lv0pen rebuilds PlayStation 3 boot-chain programs and isolated SPU modules with the original compilers. The table lists lv0 4.93 at 100 percent, bootldr 1.0.0 at 458 of 458, metldr at 182 of 182, isoldr 4.93 at 273 of 273, and appldr 4.93 at 446 of 446. lv0ldr.2 3.6.5 is 472 of 474, and lv1ldr 4.93 is 293 of 300. Build steps are in BUILDING.md.