{"meta":{"site_url":"https://awesomerea.org","repository_url":"https://github.com/reacher-z/Awesome-REA","resource_count":588,"independent_integration_count":43,"latest_review":"2026-10-20","verification_note":"Curated resource descriptions are reviewed against primary sources. The broader repository index is collected automatically.","source_index":{"available":true,"resource_count":3309,"scanned_count":3500,"excluded_count":191,"status":"published-selection","publication_schema_version":2,"published_at":"2026-10-20T10:49:31Z","full_export":"source-published.json","verification":"automated-readme-scan"},"paper_count":167},"topic_labels":{"reverse-engineering":{"en":"Reverse engineering","zh":"逆向工程"},"binary-analysis":{"en":"Binary analysis","zh":"二进制分析"},"decompiler":{"en":"Decompiler","zh":"反编译器"},"malware-analysis":{"en":"Malware analysis","zh":"恶意软件分析"},"disassembler":{"en":"Disassembler","zh":"反汇编器"},"decompilation":{"en":"Decompilation","zh":"反编译"},"deobfuscation":{"en":"Deobfuscation","zh":"去混淆"},"static-analysis":{"en":"Static analysis","zh":"静态分析"},"firmware-analysis":{"en":"Firmware analysis","zh":"固件分析"},"protocol-analysis":{"en":"Protocol analysis","zh":"协议分析"},"cybersecurity":{"en":"Cybersecurity","zh":"网络安全"},"mobile-security":{"en":"Mobile security","zh":"移动安全"},"apk-analysis":{"en":"APK analysis","zh":"APK 分析"},"android-security":{"en":"Android security","zh":"Android 安全"},"security-tools":{"en":"Security tools","zh":"安全工具"},"android-reverse-engineering":{"en":"Android reverse engineering","zh":"Android 逆向工程"},"penetration-testing":{"en":"Penetration testing","zh":"渗透测试"},"reverse-engineering-tools":{"en":"Reverse engineering tools","zh":"逆向工程工具"},"dynamic-analysis":{"en":"Dynamic analysis","zh":"动态分析"},"security-research":{"en":"Security research","zh":"安全研究"},"obfuscation":{"en":"Obfuscation","zh":"代码混淆"},"ai-agents":{"en":"AI agents","zh":"AI 智能体"},"mcp-server":{"en":"MCP server","zh":"MCP 服务"},"binary-diffing":{"en":"Binary diffing","zh":"二进制差异分析"},"bytecode":{"en":"Bytecode","zh":"字节码"},"cli":{"en":"CLI","zh":"命令行工具"},"emulator":{"en":"Emulator","zh":"模拟器"},"game":{"en":"Game","zh":"游戏"},"games":{"en":"Games","zh":"游戏"},"assembly":{"en":"Assembly","zh":"汇编"},"automation":{"en":"Automation","zh":"自动化"},"awesome-list":{"en":"Awesome list","zh":"精选资源列表"},"binary":{"en":"Binary","zh":"二进制"},"firmware":{"en":"Firmware","zh":"固件"},"firmware-tools":{"en":"Firmware tools","zh":"固件工具"},"vulnerability-research":{"en":"Vulnerability research","zh":"漏洞研究"},"debugger":{"en":"Debugger","zh":"调试器"},"malware-research":{"en":"Malware research","zh":"恶意软件研究"},"debugging":{"en":"Debugging","zh":"调试"},"modding":{"en":"Modding","zh":"模组制作"},"analysis":{"en":"Analysis","zh":"分析"},"ghidra-extension":{"en":"Ghidra extension","zh":"Ghidra 扩展"},"ai-agent":{"en":"AI agent","zh":"AI 智能体"},"iot":{"en":"IoT","zh":"物联网"},"cryptography":{"en":"Cryptography","zh":"密码学"},"forensics":{"en":"Forensics","zh":"取证"},"network-analysis":{"en":"Network analysis","zh":"网络分析"},"program-analysis":{"en":"Program analysis","zh":"程序分析"},"plugin":{"en":"Plugin","zh":"插件"},"network-security":{"en":"Network security","zh":"网络安全"},"developer-tools":{"en":"Developer tools","zh":"开发者工具"},"model-context-protocol":{"en":"Model Context Protocol","zh":"模型上下文协议"},"ios-security":{"en":"iOS security","zh":"iOS 安全"},"hooking":{"en":"Hooking","zh":"钩子技术"},"game-reversing":{"en":"Game reversing","zh":"游戏逆向"},"trainer":{"en":"Trainer","zh":"修改器"},"symbolic-execution":{"en":"Symbolic execution","zh":"符号执行"},"vulnerability-scanner":{"en":"Vulnerability scanner","zh":"漏洞扫描器"},"agent-skills":{"en":"Agent skills","zh":"智能体技能"},"fuzzing":{"en":"Fuzzing","zh":"模糊测试"},"exploit-development":{"en":"Exploit development","zh":"漏洞利用开发"},"instrumentation":{"en":"Instrumentation","zh":"插桩"},"security-audit":{"en":"Security audit","zh":"安全审计"},"unpacking":{"en":"Unpacking","zh":"脱壳"},"compiler":{"en":"Compiler","zh":"编译器"},"threat-intelligence":{"en":"Threat intelligence","zh":"威胁情报"},"tools":{"en":"Tools","zh":"工具"},"packet-analysis":{"en":"Packet analysis","zh":"数据包分析"},"embedded":{"en":"Embedded","zh":"嵌入式"},"bug-bounty":{"en":"Bug bounty","zh":"漏洞赏金"},"research":{"en":"Research","zh":"研究"},"framework":{"en":"Framework","zh":"框架"},"mobile":{"en":"Mobile","zh":"移动端"},"iot-security":{"en":"IoT security","zh":"物联网安全"},"game-decompilation":{"en":"Game decompilation","zh":"游戏反编译"},"artificial-intelligence":{"en":"Artificial intelligence","zh":"人工智能"},"machine-learning":{"en":"Machine learning","zh":"机器学习"},"deep-learning":{"en":"Deep learning","zh":"深度学习"},"llm":{"en":"LLM","zh":"大语言模型"},"llms":{"en":"LLMs","zh":"大语言模型"},"ai":{"en":"AI","zh":"人工智能"},"agent":{"en":"Agent","zh":"智能体"},"agents":{"en":"Agents","zh":"智能体"},"mcp-servers":{"en":"MCP servers","zh":"MCP 服务"},"mcp-tools":{"en":"MCP tools","zh":"MCP 工具"},"mcp":{"en":"MCP","zh":"MCP"},"browser":{"en":"Browser","zh":"浏览器"},"web":{"en":"Web","zh":"网站"},"website":{"en":"Website","zh":"网站"},"web-security":{"en":"Web security","zh":"网站安全"},"web-scraping":{"en":"Web scraping","zh":"网页抓取"},"scraping":{"en":"Scraping","zh":"数据抓取"},"network":{"en":"Network","zh":"网络"},"networking":{"en":"Networking","zh":"网络通信"},"protocol":{"en":"Protocol","zh":"协议"},"protocols":{"en":"Protocols","zh":"协议"},"packet-capture":{"en":"Packet capture","zh":"抓包"},"packet-sniffer":{"en":"Packet sniffer","zh":"数据包嗅探器"},"traffic-analysis":{"en":"Traffic analysis","zh":"流量分析"},"proxy":{"en":"Proxy","zh":"代理"},"http-proxy":{"en":"HTTP proxy","zh":"HTTP 代理"},"security":{"en":"Security","zh":"安全"},"hacking":{"en":"Hacking","zh":"黑客技术"},"pentesting":{"en":"Pentesting","zh":"渗透测试"},"ctf":{"en":"CTF","zh":"CTF 竞赛"},"ctf-tools":{"en":"CTF tools","zh":"CTF 工具"},"ctf-writeups":{"en":"CTF write-ups","zh":"CTF 题解"},"ctf-challenges":{"en":"CTF challenges","zh":"CTF 题目"},"cheatsheet":{"en":"Cheat sheet","zh":"速查表"},"cheat-sheet":{"en":"Cheat sheet","zh":"速查表"},"awesome":{"en":"Awesome","zh":"精选资源"},"awesome-lists":{"en":"Awesome lists","zh":"精选资源列表"},"list":{"en":"List","zh":"列表"},"collection":{"en":"Collection","zh":"资源合集"},"resources":{"en":"Resources","zh":"资源"},"learning":{"en":"Learning","zh":"学习资源"},"tutorial":{"en":"Tutorial","zh":"教程"},"tutorials":{"en":"Tutorials","zh":"教程"},"book":{"en":"Book","zh":"书籍"},"books":{"en":"Books","zh":"书籍"},"documentation":{"en":"Documentation","zh":"文档"},"education":{"en":"Education","zh":"教育"},"reversing":{"en":"Reversing","zh":"逆向分析"},"reverse":{"en":"Reverse","zh":"逆向"},"reverseengineering":{"en":"Reverse engineering","zh":"逆向工程"},"re":{"en":"RE","zh":"逆向工程"},"reverse-engineer":{"en":"Reverse engineer","zh":"逆向分析"},"binary-rewriting":{"en":"Binary rewriting","zh":"二进制重写"},"binary-exploitation":{"en":"Binary exploitation","zh":"二进制漏洞利用"},"binary-instrumentation":{"en":"Binary instrumentation","zh":"二进制插桩"},"binary-parser":{"en":"Binary parser","zh":"二进制解析器"},"binary-format":{"en":"Binary format","zh":"二进制格式"},"binary-diff":{"en":"Binary diff","zh":"二进制差异"},"hex-editor":{"en":"Hex editor","zh":"十六进制编辑器"},"hex":{"en":"Hex","zh":"十六进制"},"disassembly":{"en":"Disassembly","zh":"反汇编"},"decompile":{"en":"Decompile","zh":"反编译"},"deobfuscator":{"en":"Deobfuscator","zh":"去混淆工具"},"obfuscator":{"en":"Obfuscator","zh":"混淆器"},"code-analysis":{"en":"Code analysis","zh":"代码分析"},"code-generation":{"en":"Code generation","zh":"代码生成"},"source-code":{"en":"Source code","zh":"源代码"},"source-code-analysis":{"en":"Source code analysis","zh":"源代码分析"},"source-code-recovery":{"en":"Source code recovery","zh":"源码恢复"},"control-flow":{"en":"Control flow","zh":"控制流"},"control-flow-graph":{"en":"Control flow graph","zh":"控制流图"},"control-flow-flattening":{"en":"Control flow flattening","zh":"控制流平坦化"},"data-flow-analysis":{"en":"Data flow analysis","zh":"数据流分析"},"taint-analysis":{"en":"Taint analysis","zh":"污点分析"},"abstract-interpretation":{"en":"Abstract interpretation","zh":"抽象解释"},"emulation":{"en":"Emulation","zh":"模拟执行"},"virtualization":{"en":"Virtualization","zh":"虚拟化"},"virtual-machine":{"en":"Virtual machine","zh":"虚拟机"},"virtual-machines":{"en":"Virtual machines","zh":"虚拟机"},"symbolic-analysis":{"en":"Symbolic analysis","zh":"符号分析"},"concolic-execution":{"en":"Concolic execution","zh":"混合符号执行"},"memory":{"en":"Memory","zh":"内存"},"memory-analysis":{"en":"Memory analysis","zh":"内存分析"},"memory-forensics":{"en":"Memory forensics","zh":"内存取证"},"memory-scanner":{"en":"Memory scanner","zh":"内存扫描器"},"memory-editing":{"en":"Memory editing","zh":"内存编辑"},"memory-dump":{"en":"Memory dump","zh":"内存转储"},"dump":{"en":"Dump","zh":"转储"},"dumper":{"en":"Dumper","zh":"转储工具"},"patching":{"en":"Patching","zh":"补丁修改"},"patch":{"en":"Patch","zh":"补丁"},"malware":{"en":"Malware","zh":"恶意软件"},"ransomware":{"en":"Ransomware","zh":"勒索软件"},"rootkit":{"en":"Rootkit","zh":"根套件"},"antivirus":{"en":"Antivirus","zh":"反病毒"},"anti-debugging":{"en":"Anti-debugging","zh":"反调试"},"anti-analysis":{"en":"Anti-analysis","zh":"反分析"},"anti-cheat":{"en":"Anti-cheat","zh":"反作弊"},"anticheat":{"en":"Anti-cheat","zh":"反作弊"},"sandbox":{"en":"Sandbox","zh":"沙箱"},"sandboxing":{"en":"Sandboxing","zh":"沙箱隔离"},"vulnerability":{"en":"Vulnerability","zh":"漏洞"},"vulnerabilities":{"en":"Vulnerabilities","zh":"漏洞"},"vulnerability-detection":{"en":"Vulnerability detection","zh":"漏洞检测"},"vulnerability-analysis":{"en":"Vulnerability analysis","zh":"漏洞分析"},"exploit":{"en":"Exploit","zh":"漏洞利用"},"exploits":{"en":"Exploits","zh":"漏洞利用"},"exploitation":{"en":"Exploitation","zh":"漏洞利用"},"pwn":{"en":"Pwn","zh":"二进制漏洞利用"},"shellcode":{"en":"Shellcode","zh":"载荷代码"},"payload":{"en":"Payload","zh":"载荷"},"red-team":{"en":"Red team","zh":"红队"},"redteam":{"en":"Red team","zh":"红队"},"red-teaming":{"en":"Red teaming","zh":"红队测试"},"blueteam":{"en":"Blue team","zh":"蓝队"},"blue-team":{"en":"Blue team","zh":"蓝队"},"digital-forensics":{"en":"Digital forensics","zh":"数字取证"},"incident-response":{"en":"Incident response","zh":"事件响应"},"threat-hunting":{"en":"Threat hunting","zh":"威胁狩猎"},"osint":{"en":"OSINT","zh":"开源情报"},"privacy":{"en":"Privacy","zh":"隐私"},"reconnaissance":{"en":"Reconnaissance","zh":"侦察"},"recon":{"en":"Recon","zh":"侦察"},"encryption":{"en":"Encryption","zh":"加密"},"decryption":{"en":"Decryption","zh":"解密"},"crypto":{"en":"Crypto","zh":"密码学"},"cryptanalysis":{"en":"Cryptanalysis","zh":"密码分析"},"password":{"en":"Password","zh":"密码"},"password-cracking":{"en":"Password cracking","zh":"密码破解"},"api":{"en":"API","zh":"API"},"api-security":{"en":"API security","zh":"API 安全"},"api-reverse-engineering":{"en":"API reverse engineering","zh":"API 逆向工程"},"websocket":{"en":"WebSocket","zh":"WebSocket"},"webassembly":{"en":"WebAssembly","zh":"WebAssembly"},"wasm":{"en":"Wasm","zh":"Wasm"},"android":{"en":"Android","zh":"Android"},"ios":{"en":"iOS","zh":"iOS"},"macos":{"en":"macOS","zh":"macOS"},"windows":{"en":"Windows","zh":"Windows"},"linux":{"en":"Linux","zh":"Linux"},"javascript":{"en":"JavaScript","zh":"JavaScript"},"typescript":{"en":"TypeScript","zh":"TypeScript"},"python":{"en":"Python","zh":"Python"},"java":{"en":"Java","zh":"Java"},"csharp":{"en":"C#","zh":"C#"},"c-sharp":{"en":"C#","zh":"C#"},"dotnet":{"en":".NET","zh":".NET"},"rust":{"en":"Rust","zh":"Rust"},"golang":{"en":"Go","zh":"Go"},"c":{"en":"C","zh":"C"},"cpp":{"en":"C++","zh":"C++"},"c-plus-plus":{"en":"C++","zh":"C++"},"llvm":{"en":"LLVM","zh":"LLVM"},"frida":{"en":"Frida","zh":"Frida"},"ghidra":{"en":"Ghidra","zh":"Ghidra"},"ida":{"en":"IDA","zh":"IDA"},"ida-pro":{"en":"IDA Pro","zh":"IDA Pro"},"idapro":{"en":"IDA Pro","zh":"IDA Pro"},"ida-plugin":{"en":"IDA plugin","zh":"IDA 插件"},"ghidra-plugin":{"en":"Ghidra plugin","zh":"Ghidra 插件"},"frida-scripts":{"en":"Frida scripts","zh":"Frida 脚本"},"frida-script":{"en":"Frida script","zh":"Frida 脚本"},"frida-hook":{"en":"Frida hook","zh":"Frida 钩子"},"radare2":{"en":"radare2","zh":"radare2"},"rizin":{"en":"Rizin","zh":"Rizin"},"cutter":{"en":"Cutter","zh":"Cutter"},"x64dbg":{"en":"x64dbg","zh":"x64dbg"},"x64dbg-plugin":{"en":"x64dbg plugin","zh":"x64dbg 插件"},"gdb":{"en":"GDB","zh":"GDB"},"lldb":{"en":"LLDB","zh":"LLDB"},"lldb-plugin":{"en":"LLDB plugin","zh":"LLDB 插件"},"unity":{"en":"Unity","zh":"Unity"},"unity3d":{"en":"Unity 3D","zh":"Unity 3D"},"unreal-engine":{"en":"Unreal Engine","zh":"虚幻引擎"},"il2cpp":{"en":"IL2CPP","zh":"IL2CPP"},"electron":{"en":"Electron","zh":"Electron"},"apk":{"en":"APK","zh":"APK"},"dex":{"en":"DEX","zh":"DEX"},"elf":{"en":"ELF","zh":"ELF"},"pe":{"en":"PE","zh":"PE"},"x86":{"en":"x86","zh":"x86"},"x64":{"en":"x64","zh":"x64"},"arm":{"en":"Arm","zh":"Arm"},"arm64":{"en":"Arm64","zh":"Arm64"},"riscv":{"en":"RISC-V","zh":"RISC-V"},"mips":{"en":"MIPS","zh":"MIPS"},"jvm":{"en":"JVM","zh":"JVM"},"kernel":{"en":"Kernel","zh":"内核"},"driver":{"en":"Driver","zh":"驱动"},"drivers":{"en":"Drivers","zh":"驱动"},"operating-system":{"en":"Operating system","zh":"操作系统"},"embedded-systems":{"en":"Embedded systems","zh":"嵌入式系统"},"hardware":{"en":"Hardware","zh":"硬件"},"hardware-hacking":{"en":"Hardware hacking","zh":"硬件破解"},"hardware-security":{"en":"Hardware security","zh":"硬件安全"},"file-format":{"en":"File format","zh":"文件格式"},"file-formats":{"en":"File formats","zh":"文件格式"},"file-analysis":{"en":"File analysis","zh":"文件分析"},"parser":{"en":"Parser","zh":"解析器"},"parsing":{"en":"Parsing","zh":"解析"},"serialization":{"en":"Serialization","zh":"序列化"},"deserialization":{"en":"Deserialization","zh":"反序列化"},"compression":{"en":"Compression","zh":"压缩"},"extraction":{"en":"Extraction","zh":"提取"},"extractor":{"en":"Extractor","zh":"提取工具"},"asset-extraction":{"en":"Asset extraction","zh":"资源提取"},"game-assets":{"en":"Game assets","zh":"游戏资源"},"game-hacking":{"en":"Game hacking","zh":"游戏修改"},"game-modding":{"en":"Game modding","zh":"游戏模组"},"game-development":{"en":"Game development","zh":"游戏开发"},"game-engine":{"en":"Game engine","zh":"游戏引擎"},"game-tools":{"en":"Game tools","zh":"游戏工具"},"cheat":{"en":"Cheat","zh":"作弊工具"},"cheats":{"en":"Cheats","zh":"作弊工具"},"graphics":{"en":"Graphics","zh":"图形"},"rendering":{"en":"Rendering","zh":"渲染"},"gpu":{"en":"GPU","zh":"GPU"},"opengl":{"en":"OpenGL","zh":"OpenGL"},"vulkan":{"en":"Vulkan","zh":"Vulkan"},"directx":{"en":"DirectX","zh":"DirectX"},"reimplementation":{"en":"Reimplementation","zh":"重新实现"},"reconstruction":{"en":"Reconstruction","zh":"重建"},"compatibility":{"en":"Compatibility","zh":"兼容性"},"preservation":{"en":"Preservation","zh":"保存"},"software-preservation":{"en":"Software preservation","zh":"软件保存"},"software":{"en":"Software","zh":"软件"},"software-engineering":{"en":"Software engineering","zh":"软件工程"},"software-analysis":{"en":"Software analysis","zh":"软件分析"},"software-security":{"en":"Software security","zh":"软件安全"},"code-review":{"en":"Code review","zh":"代码审查"},"testing":{"en":"Testing","zh":"测试"},"unit-testing":{"en":"Unit testing","zh":"单元测试"},"integration":{"en":"Integration","zh":"集成"},"plugins":{"en":"Plugins","zh":"插件"},"extension":{"en":"Extension","zh":"扩展"},"extensions":{"en":"Extensions","zh":"扩展"},"command-line":{"en":"Command line","zh":"命令行"},"command-line-tool":{"en":"Command-line tool","zh":"命令行工具"},"gui":{"en":"GUI","zh":"图形界面"},"visualization":{"en":"Visualization","zh":"可视化"},"interactive":{"en":"Interactive","zh":"交互式"},"cross-platform":{"en":"Cross-platform","zh":"跨平台"},"open-source":{"en":"Open source","zh":"开源"},"python3":{"en":"Python 3","zh":"Python 3"},"chatgpt":{"en":"ChatGPT","zh":"ChatGPT"},"claude":{"en":"Claude","zh":"Claude"},"claude-code":{"en":"Claude Code","zh":"Claude Code"},"codex":{"en":"Codex","zh":"Codex"},"cursor":{"en":"Cursor","zh":"Cursor"},"copilot":{"en":"Copilot","zh":"Copilot"},"llm-agent":{"en":"LLM agent","zh":"大模型智能体"},"llm-agents":{"en":"LLM agents","zh":"大模型智能体"},"ai-tools":{"en":"AI tools","zh":"AI 工具"},"ai-powered":{"en":"AI-powered","zh":"AI 辅助"},"agentic":{"en":"Agentic","zh":"智能体"},"agentic-ai":{"en":"Agentic AI","zh":"AI 智能体"},"agentic-workflows":{"en":"Agentic workflows","zh":"智能体工作流"},"prompt-engineering":{"en":"Prompt engineering","zh":"提示词工程"},"skills":{"en":"Skills","zh":"技能"},"skill":{"en":"Skill","zh":"技能"},"benchmark":{"en":"Benchmark","zh":"基准测试"},"benchmarks":{"en":"Benchmarks","zh":"基准测试"},"dataset":{"en":"Dataset","zh":"数据集"},"datasets":{"en":"Datasets","zh":"数据集"},"paper":{"en":"Paper","zh":"论文"},"papers":{"en":"Papers","zh":"论文"},"academic":{"en":"Academic","zh":"学术"},"research-paper":{"en":"Research paper","zh":"研究论文"},"analyzer":{"en":"Analyzer","zh":"分析器"},"decompiler-engine":{"en":"Decompiler engine","zh":"反编译引擎"},"commandline":{"en":"Command line","zh":"命令行"},"aiagent":{"en":"AI agent","zh":"AI 智能体"},"detect":{"en":"Detection","zh":"检测"},"detector":{"en":"Detector","zh":"检测器"},"cpu-emulator":{"en":"CPU emulator","zh":"CPU 模拟器"},"cross-architecture":{"en":"Cross-architecture","zh":"跨架构"},"diffing":{"en":"Diffing","zh":"差异比较"},"bundle":{"en":"Bundle","zh":"打包"},"debundle":{"en":"Debundle","zh":"解包"},"radare2-plugin":{"en":"radare2 plugin","zh":"radare2 插件"},"idapython-plugin":{"en":"IDAPython plugin","zh":"IDAPython 插件"},"hook":{"en":"Hook","zh":"钩子"},"pentest":{"en":"Penetration testing","zh":"渗透测试"},"assembler":{"en":"Assembler","zh":"汇编器"},"infosec":{"en":"Information security","zh":"信息安全"},"mod":{"en":"Mod","zh":"模组"},"il2cpp-hacking":{"en":"IL2CPP hacking","zh":"IL2CPP 修改"},"ghidra-scripts":{"en":"Ghidra scripts","zh":"Ghidra 脚本"},"bugbounty":{"en":"Bug bounty","zh":"漏洞赏金"},"apk-decompiler":{"en":"APK decompiler","zh":"APK 反编译器"},"malware-detection":{"en":"Malware detection","zh":"恶意软件检测"},"unpacker":{"en":"Unpacker","zh":"脱壳工具"},"ethical-hacking":{"en":"Ethical hacking","zh":"道德黑客技术"},"internal":{"en":"Internal","zh":"内部"},"dfir":{"en":"Digital forensics and incident response","zh":"数字取证与事件响应"},"android-pentesting":{"en":"Android penetration testing","zh":"Android 渗透测试"},"hack":{"en":"Hacking","zh":"黑客技术"},"offensive-security":{"en":"Offensive security","zh":"进攻性安全"},"java-decompiler":{"en":"Java decompiler","zh":"Java 反编译器"},"patcher":{"en":"Patcher","zh":"补丁工具"},"portable-executable":{"en":"Portable Executable","zh":"可移植可执行文件"},"yara-rules":{"en":"YARA rules","zh":"YARA 规则"},"jadx-plugin":{"en":"JADX plugin","zh":"JADX 插件"},"ai-security":{"en":"AI security","zh":"AI 安全"},"cyber-security":{"en":"Cybersecurity","zh":"网络安全"},"android-malware":{"en":"Android malware","zh":"Android 恶意软件"},"injection":{"en":"Injection","zh":"注入"},"debugging-tool":{"en":"Debugging tool","zh":"调试工具"},"firmware-security":{"en":"Firmware security","zh":"固件安全"},"ssl-pinning":{"en":"SSL pinning","zh":"SSL 证书锁定"},"malware-development":{"en":"Malware development","zh":"恶意软件开发"},"trace":{"en":"Trace","zh":"跟踪"},"dynamic-instrumentation":{"en":"Dynamic instrumentation","zh":"动态插桩"},"game-preservation":{"en":"Game preservation","zh":"游戏保存"},"android-reverse":{"en":"Android reverse engineering","zh":"Android 逆向工程"},"sast":{"en":"Static application security testing","zh":"静态应用安全测试"},"appsec":{"en":"Application security","zh":"应用安全"},"javascript-deobfuscation":{"en":"JavaScript deobfuscation","zh":"JavaScript 去混淆"},"android-application":{"en":"Android application","zh":"Android 应用"},"embedded-linux":{"en":"Embedded Linux","zh":"嵌入式 Linux"},"application-security":{"en":"Application security","zh":"应用安全"},"steganography":{"en":"Steganography","zh":"隐写术"},"android-hacking":{"en":"Android hacking","zh":"Android 破解"},"network-forensics":{"en":"Network forensics","zh":"网络取证"},"mobile-penetration-testing":{"en":"Mobile penetration testing","zh":"移动端渗透测试"},"decomp":{"en":"Decompilation","zh":"反编译"},"devirtualization":{"en":"Devirtualization","zh":"去虚拟化"},"educational":{"en":"Educational","zh":"教学"},"il2cpp-modding":{"en":"IL2CPP modding","zh":"IL2CPP 模组制作"},"reverse-engineering-tool":{"en":"Reverse engineering tool","zh":"逆向工程工具"},"network-monitoring":{"en":"Network monitoring","zh":"网络监控"},"malware-analyzer":{"en":"Malware analyzer","zh":"恶意软件分析器"},"il2cpp-metadata":{"en":"IL2CPP metadata","zh":"IL2CPP 元数据"},"ast":{"en":"Abstract syntax tree","zh":"抽象语法树"},"9patch":{"en":"9-patch","zh":"9-patch"},"apktool":{"en":"Apktool","zh":"Apktool"},"vala":{"en":"Vala","zh":"Vala"},"cpu":{"en":"CPU","zh":"CPU"},"bpf":{"en":"BPF","zh":"BPF"},"dalvik":{"en":"Dalvik","zh":"Dalvik"},"odex":{"en":"ODEX","zh":"ODEX"},"art":{"en":"ART","zh":"ART"},"bindiff":{"en":"BinDiff","zh":"BinDiff"},"binexport":{"en":"BinExport","zh":"BinExport"},"browserify":{"en":"Browserify","zh":"Browserify"},"uefi":{"en":"UEFI","zh":"UEFI"},"nodejs":{"en":"Node.js","zh":"Node.js"},"react":{"en":"React","zh":"React"},"chrome-extension":{"en":"Chrome extension","zh":"Chrome 扩展"},"unity2d":{"en":"Unity 2D","zh":"Unity 2D"},"emscripten":{"en":"Emscripten","zh":"Emscripten"},"anti-bot":{"en":"Anti-bot","zh":"反机器人检测"},"threejs":{"en":"three.js","zh":"three.js"},"devtools":{"en":"Developer tools","zh":"开发者工具"},"cdp":{"en":"CDP","zh":"CDP"},"asar":{"en":"ASAR","zh":"ASAR"},"js":{"en":"JavaScript","zh":"JavaScript"},"retro-gaming":{"en":"Retro gaming","zh":"复古游戏"},"rea":{"en":"REA","zh":"REA"},"webgl":{"en":"WebGL","zh":"WebGL"},"playwright":{"en":"Playwright","zh":"Playwright"},"playstation":{"en":"PlayStation","zh":"PlayStation"},"manifest-v3":{"en":"Manifest V3","zh":"Manifest V3"},"babel":{"en":"Babel","zh":"Babel"},"chrome-devtools-protocol":{"en":"Chrome DevTools Protocol","zh":"Chrome 开发者工具协议"},"browser-automation":{"en":"Browser automation","zh":"浏览器自动化"},"jadx":{"en":"JADX","zh":"JADX"},"flutter":{"en":"Flutter","zh":"Flutter"},"idapython":{"en":"IDAPython","zh":"IDAPython"},"nintendo-ds":{"en":"Nintendo DS","zh":"Nintendo DS"},"x86-64":{"en":"x86-64","zh":"x86-64"},"matching-decompilation":{"en":"Matching decompilation","zh":"匹配反编译"},"hacktoberfest":{"en":"Hacktoberfest","zh":"Hacktoberfest"},"smali":{"en":"smali","zh":"smali"},"lua":{"en":"Lua","zh":"Lua"},"docker":{"en":"Docker","zh":"Docker"},"adb":{"en":"ADB","zh":"ADB"},"ds-decomp-studio":{"en":"DS Decomp Studio","zh":"DS Decomp Studio"},"bluetooth-low-energy":{"en":"Bluetooth Low Energy","zh":"低功耗蓝牙"},"mono":{"en":"Mono","zh":"Mono"},"objective-c":{"en":"Objective-C","zh":"Objective-C"},"gameboy-advance":{"en":"Game Boy Advance","zh":"Game Boy Advance"},"binwalk":{"en":"Binwalk","zh":"Binwalk"},"wireshark":{"en":"Wireshark","zh":"Wireshark"},"go":{"en":"Go","zh":"Go"},"pokemon":{"en":"Pokémon","zh":"宝可梦"},"kotlin":{"en":"Kotlin","zh":"Kotlin"},"apple":{"en":"Apple","zh":"Apple"},"ue5":{"en":"Unreal Engine 5","zh":"虚幻引擎 5"},"dart":{"en":"Dart","zh":"Dart"},"jailbreak":{"en":"Jailbreak","zh":"越狱"},"ble":{"en":"Bluetooth Low Energy (BLE)","zh":"低功耗蓝牙（BLE）"},"swift":{"en":"Swift","zh":"Swift"},"bluetooth":{"en":"Bluetooth","zh":"蓝牙"},"theos":{"en":"Theos","zh":"Theos"},"static-recompilation":{"en":"Static recompilation","zh":"静态重编译"},"mach-o":{"en":"Mach-O","zh":"Mach-O"},"metal":{"en":"Metal","zh":"Metal"},"mitm":{"en":"Man-in-the-middle","zh":"中间人"},"gamemaker":{"en":"GameMaker","zh":"GameMaker"},"frontend":{"en":"Frontend","zh":"前端"},"ue4":{"en":"Unreal Engine 4","zh":"虚幻引擎 4"},"unreal-engine-5":{"en":"Unreal Engine 5","zh":"虚幻引擎 5"},"swiftui":{"en":"SwiftUI","zh":"SwiftUI"},"iphone":{"en":"iPhone","zh":"iPhone"},"esp32":{"en":"ESP32","zh":"ESP32"},"blutter":{"en":"Blutter","zh":"Blutter"},"video-streaming":{"en":"Video streaming","zh":"视频流传输"},"nds":{"en":"Nintendo DS (NDS)","zh":"Nintendo DS（NDS）"},"hid":{"en":"Human interface devices (HID)","zh":"人机接口设备（HID）"},"private-server":{"en":"Private servers","zh":"私有服务器"},"sqlite":{"en":"SQLite","zh":"SQLite"},"webpack":{"en":"webpack","zh":"webpack"},"digital-preservation":{"en":"Digital preservation","zh":"数字保存"},"html":{"en":"HTML","zh":"HTML"},"steam":{"en":"Steam","zh":"Steam"},"ue4ss":{"en":"UE4SS","zh":"UE4SS"},"dom":{"en":"Document Object Model (DOM)","zh":"文档对象模型（DOM）"},"event-replay":{"en":"Event replay","zh":"事件重放"},"state-reconstruction":{"en":"State reconstruction","zh":"状态重建"},"apple-silicon":{"en":"Apple silicon","zh":"Apple 芯片"},"ios-reverse":{"en":"iOS reverse engineering","zh":"iOS 逆向工程"},"ios-tweak":{"en":"iOS tweaks","zh":"iOS 功能调整插件"},"can-bus":{"en":"CAN bus","zh":"CAN 总线"},"extract":{"en":"Extraction","zh":"提取"},"react-native":{"en":"React Native","zh":"React Native"},"mqtt":{"en":"MQTT","zh":"MQTT"},"flex":{"en":"FLEX","zh":"FLEX"},"tweak":{"en":"Tweaks","zh":"功能调整插件"},"kingdom-hearts":{"en":"Kingdom Hearts","zh":"王国之心"},"bluetooth-le":{"en":"Bluetooth LE","zh":"低功耗蓝牙"},"usb":{"en":"USB","zh":"USB"},"usb-hid":{"en":"USB HID","zh":"USB 人机接口设备"},"tkinter":{"en":"Tkinter","zh":"Tkinter"},"game-server":{"en":"Game servers","zh":"游戏服务器"},"codewarrior":{"en":"CodeWarrior","zh":"CodeWarrior"},"ds-decomp":{"en":"Nintendo DS decompilation","zh":"Nintendo DS 反编译"},"sdl2":{"en":"SDL2","zh":"SDL2"},"ai-assisted":{"en":"AI-assisted","zh":"AI 辅助"},"save-editor":{"en":"Save editor","zh":"存档编辑器"},"datamining":{"en":"Data mining","zh":"数据挖掘"},"modding-tools":{"en":"Modding tools","zh":"模组制作工具"},"fmod":{"en":"FMOD","zh":"FMOD"},"userscript":{"en":"Userscripts","zh":"用户脚本"},"source-maps":{"en":"Source maps","zh":"源码映射"},"css":{"en":"CSS","zh":"CSS"},"web-platform":{"en":"Web platform","zh":"Web 平台"},"recompilation":{"en":"Recompilation","zh":"重编译"},"pc-port":{"en":"PC port","zh":"PC 移植"},"rexglue":{"en":"ReXGlue","zh":"ReXGlue"},"ipa":{"en":"IPA","zh":"IPA"},"n64":{"en":"Nintendo 64","zh":"Nintendo 64"},"xbox360":{"en":"Xbox 360","zh":"Xbox 360"}},"category_labels":{"core":["Official REA: core and setup","REA 官方：核心与配置"],"workflow-guides":["Official REA: investigation guides","REA 官方：调查指南"],"official-case-studies":["Official REA: case studies","REA 官方：案例"],"community-integrations":["Community REA integrations","REA 社区集成"],"community-labs":["Community REA labs","REA 社区练习"],"community-case-studies":["Community REA investigations","REA 社区调查案例"],"reconstruction-cases":["Independent reconstruction cases","独立重建案例"],"agent-mcp":["Independent MCP integrations","独立 MCP 集成"],"agent-workflows":["Independent agent workflows","独立智能体工作流"],"game-analysis":["Game analysis tools","游戏分析工具"],"web-analysis":["Website analysis tools","网站分析工具"],"protocol-analysis":["Protocol analysis tools","协议分析工具"],"native-analysis":["Native analysis tools","原生分析工具"],"dynamic-analysis":["Debugging and dynamic analysis","调试与动态分析"],"android":["Android tools","Android 工具"],"dotnet":[".NET tools",".NET 工具"],"jvm":["JVM bytecode tools","JVM 字节码工具"],"javascript-electron":["JavaScript and Electron tools","JavaScript 与 Electron 工具"],"webassembly":["WebAssembly tools","WebAssembly 工具"],"firmware":["Firmware tools","固件工具"],"binary-libraries":["Binary analysis libraries","二进制分析库"],"binary-diffing":["Binary comparison tools","二进制对比工具"],"learning":["Learning resources","学习资源"],"related-lists":["Related resource lists","相关资源目录"]},"resources":[{"id":"rea-upstream","name":"REA — Reverse Engineer Anything","name_zh":"REA — Reverse Engineer Anything","url":"https://github.com/morluto/rea","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/README.md","description_en":"The upstream CLI and MCP server for evidence-based investigations of shipped software and runtime behavior.","description_zh":"REA 官方 CLI 与 MCP 服务，连接分析工具并保留调查证据及限制。","kind":"project","category":"core","group":"rea","relationship":"official-core","targets":["app","binary","firmware","game","protocol","website"],"verified_at":"2026-10-15"},{"id":"rea-official-skill","name":"Official reverse-engineer-anything skill","name_zh":"官方 reverse-engineer-anything 技能","url":"https://github.com/morluto/rea/tree/main/.agents/skills/reverse-engineer-anything","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/.agents/skills/reverse-engineer-anything/SKILL.md","description_en":"Target routing, connection recovery and evidence practices for agents using REA.","description_zh":"官方面向使用者的调查技能，包含目标路由、连接恢复与证据工作流。","kind":"integration","category":"core","group":"rea","relationship":"official-skill","targets":["app","binary","firmware","game","protocol","website"],"verified_at":"2026-10-15"},{"id":"rea-installation","name":"Installation and client setup","name_zh":"安装与客户端配置","url":"https://github.com/morluto/rea/blob/main/docs/installation.md","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/installation.md","description_en":"Reviewed setup plans, client registration, provider prerequisites and scoped readiness checks.","description_zh":"安装、客户端配置、分析引擎依赖及按任务检查就绪状态的官方入口。","kind":"documentation","category":"core","group":"rea","relationship":"official-documentation","targets":["app","binary","firmware","game","website"],"verified_at":"2026-10-15"},{"id":"rea-cli-evidence","name":"CLI and Evidence","name_zh":"CLI 与 Evidence","url":"https://github.com/morluto/rea/blob/main/docs/cli.md","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/cli.md","description_en":"CLI workflows for saving Evidence and projecting smaller views from completed analysis.","description_zh":"保存完整 Evidence，再提取摘要或模块视图，适合脚本与可复现记录。","kind":"documentation","category":"core","group":"rea","relationship":"official-documentation","targets":["app","binary","firmware","game","website"],"verified_at":"2026-10-15"},{"id":"rea-mcp-contracts","name":"MCP contracts and generated catalog","name_zh":"MCP 接口约定与生成目录","url":"https://github.com/morluto/rea/blob/main/docs/mcp-contracts.md#generated-catalog","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/mcp-contracts.md","description_en":"Canonical tool contracts, provider discovery and Evidence semantics for integration authors.","description_zh":"官方工具协议、能力发现和 Evidence 语义；适合集成与核对实际工具边界。","kind":"documentation","category":"core","group":"rea","relationship":"official-documentation","targets":["app","binary","firmware","game","website"],"verified_at":"2026-10-15"},{"id":"rea-native-workflow","name":"Native binary investigation","name_zh":"原生二进制调查","url":"https://github.com/morluto/rea/blob/main/docs/native-investigation.md","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/native-investigation.md","description_en":"Locate a function, inspect instructions and pseudocode, and follow references with a selected native provider.","description_zh":"从函数清单到指令、伪代码和引用链的原生二进制调查流程。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["binary","game"],"verified_at":"2026-10-15"},{"id":"rea-js-workflows","name":"Cross-layer JavaScript application workflows","name_zh":"跨层 JavaScript 应用工作流","url":"https://github.com/morluto/rea/blob/main/docs/javascript-application-workflows.md","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/javascript-application-workflows.md","description_en":"Trace features and compare authenticated JavaScript application graphs while preserving static-analysis limits.","description_zh":"从 JavaScript 应用图追踪功能、比较版本，同时保留静态分析的不确定性。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["app","website"],"verified_at":"2026-10-15"},{"id":"rea-android-guide","name":"Static Android APK analysis","name_zh":"Android APK 静态分析","url":"https://github.com/morluto/rea/blob/main/docs/android-analysis.md","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/android-analysis.md","description_en":"Inspect Android package identity, classes, methods and references through REA's JADX integration.","description_zh":"经 REA 的 JADX 集成检查 APK、类、方法与引用；结果不等于运行时验证。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["app"],"verified_at":"2026-10-15"},{"id":"rea-managed-guide","name":"Managed-code analysis","name_zh":"托管代码分析","url":"https://github.com/morluto/rea/blob/main/docs/managed-code-analysis.md","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/managed-code-analysis.md","description_en":"Read PE/CLI metadata and CIL, compare managed members and inspect declared native boundaries without loading the assembly.","description_zh":"静态读取 .NET 元数据与 CIL，比较成员并检查声明的原生代码边界。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["app"],"verified_at":"2026-10-15"},{"id":"rea-web-captures","name":"Historical web network captures","name_zh":"历史网站网络记录","url":"https://github.com/morluto/rea/blob/main/docs/web-network-captures.md","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/web-network-captures.md","description_en":"Inspect saved web captures offline; recorded URLs are not fetched and no proxy is started.","description_zh":"离线检查已有 HAR、SAZ 等网页流量记录；不会自动抓包或访问记录中的 URL。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["app","protocol","website"],"verified_at":"2026-10-15"},{"id":"rea-firmware-guide","name":"Firmware analysis","name_zh":"固件分析","url":"https://github.com/morluto/rea/blob/main/docs/firmware-analysis.md","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/firmware-analysis.md","description_en":"Inspect firmware regions with Binwalk and explicitly extract with Unblob, retaining tool and artifact identity.","description_zh":"用 Binwalk 检查固件区域、用 Unblob 显式提取，并记录工具与制品身份。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["firmware"],"verified_at":"2026-10-15"},{"id":"rea-packet-captures","name":"Recorded packet capture inspection","name_zh":"抓包记录检查","url":"https://github.com/morluto/rea/blob/main/docs/packet-captures.md","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/packet-captures.md","description_en":"Select TShark fields, display filters and decode-as rules over an existing network, USB or Bluetooth capture, and look up installed field names. It does not capture traffic, open an interface or control a device.","description_zh":"用 TShark 字段、显示过滤器和 decode-as 规则检查已有的网络、USB 或蓝牙抓包，并可查询已安装的字段名；不抓取流量、不打开网络接口，也不控制设备。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["protocol"],"verified_at":"2026-10-17"},{"id":"rea-pcap-summaries","name":"Packet capture summaries","name_zh":"抓包摘要","url":"https://github.com/morluto/rea/blob/main/docs/pcap-analysis.md","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/pcap-analysis.md","description_en":"Summarize a saved pcap or pcapng file’s endpoints, DNS questions and addresses, TLS SNI, protocol stacks and HTTP URIs into paged Evidence views. It does not capture traffic or fetch recorded targets.","description_zh":"把已保存 pcap/pcapng 文件中的端点、DNS 查询与地址、TLS SNI、协议栈和 HTTP URI 汇总为可分页的 Evidence 视图；不抓取流量，也不访问记录中的目标。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["protocol"],"verified_at":"2026-10-17"},{"id":"rea-signal-recordings","name":"Recorded signal decoding","name_zh":"信号记录解码","url":"https://github.com/morluto/rea/blob/main/docs/signal-recordings.md","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/signal-recordings.md","description_en":"Run caller-chosen sigrok protocol decoders, such as UART or I2C, over an existing logic-signal recording and keep annotation text with sample ranges. It does not acquire samples or communicate with hardware.","description_zh":"用调用方指定的 sigrok 协议解码器（如 UART、I2C）解码已有的逻辑信号记录，并保留带采样区间的注释文本；不采集样本，也不与硬件通信。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["firmware","protocol"],"verified_at":"2026-10-17"},{"id":"rea-browser-guide","name":"Browser observation guide","name_zh":"浏览器观察指南","url":"https://rea.tools/guides/browser/","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/website/evidence/guide-examples.md","description_en":"Follow a user-triggered export request in the supplied Notes browser example and connect it to the downloaded result.","description_zh":"通过官方 Notes 示例关联用户点击、导出请求与下载结果；REA 负责观察。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-guide","targets":["website"],"verified_at":"2026-10-15"},{"id":"rea-aegis-case","name":"Aegis: trace a login-code calculation","name_zh":"Aegis：追踪登录验证码计算","url":"https://rea.tools/showcase/aegis/","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/website/evidence/aegis-login-code.md","description_en":"An official APK investigation follows TOTP methods in Aegis and publishes artifact identities and selected Evidence.","description_zh":"追踪 Aegis APK 的 TOTP 计算，官方公开目标指纹与选取的调查证据。","kind":"case-study","category":"official-case-studies","group":"rea","relationship":"official-case-study","targets":["app"],"verified_at":"2026-10-15"},{"id":"rea-ctf-case","name":"DownUnderCTF: masked-squares flag checker","name_zh":"DownUnderCTF：masked-squares 校验器","url":"https://rea.tools/showcase/ctf/","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/website/evidence/ctf-masked-squares.md","description_en":"An official educational challenge investigation connects binary checks to equations and records an original-program validation.","description_zh":"官方教育 CTF 案例：从检查函数得到方程，并记录原程序验证过程。","kind":"case-study","category":"official-case-studies","group":"rea","relationship":"official-case-study","targets":["binary"],"verified_at":"2026-10-15"},{"id":"rea-dxball-case","name":"DX-Ball: reconstruct sound panning","name_zh":"DX-Ball：重建声音声像计算","url":"https://rea.tools/showcase/dx-ball/","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/website/evidence/dx-ball-sound-pan.md","description_en":"Recover one sound-pan function from instructions and constants; upstream cites 3,205 cases and a 63-byte match.","description_zh":"根据指令与常量重建单个声像函数；上游报告 3,205 例与 63 字节匹配。","kind":"case-study","category":"official-case-studies","group":"rea","relationship":"official-case-study","targets":["binary","game"],"verified_at":"2026-10-15"},{"id":"rea-notion-case","name":"Notion: trace the clipboard bridge","name_zh":"Notion：追踪剪贴板桥接","url":"https://rea.tools/showcase/notion/","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/website/evidence/notion-clipboard.md","description_en":"Trace a packaged Electron clipboard path using REA findings and separate source inspection; the dynamic wrapper remains a stated limit.","description_zh":"结合 REA 发现与独立源码阅读追踪剪贴板桥；动态包装器仍有明确限制。","kind":"case-study","category":"official-case-studies","group":"rea","relationship":"official-case-study","targets":["app"],"verified_at":"2026-10-15"},{"id":"rea-th04-case","name":"TH04: recover a DOS bullet-ring helper","name_zh":"TH04：恢复 DOS 子弹环辅助函数","url":"https://rea.tools/showcase/th04/","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/website/evidence/th04-bullet-ring.md","description_en":"Inspect a 16-bit PC-98 DOS helper and relate its angle calculation to a pinned reconstruction and historical compiler checks.","description_zh":"检查 PC-98 DOS 的 16 位弹幕角度辅助函数，并关联固定版本重建与历史编译器检查。","kind":"case-study","category":"official-case-studies","group":"rea","relationship":"official-case-study","targets":["binary","game"],"verified_at":"2026-10-15"},{"id":"rea-electron-guide","name":"JavaScript and Electron: follow a CSV export","name_zh":"JavaScript 与 Electron：追踪 CSV 导出","url":"https://rea.tools/guides/javascript/","evidence_url":"https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/website/evidence/guide-examples.md","description_en":"A source-owned Notes fixture teaches the renderer, preload, IPC and CSV path with linked analysis evidence.","description_zh":"官方自建 Notes 样例，从 renderer、preload、IPC 到 CSV 导出建立证据链。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-guide","targets":["app"],"verified_at":"2026-10-15"},{"id":"rea-playbook","name":"rea-playbook","name_zh":"rea-playbook","url":"https://github.com/jinshi666888/rea-playbook","evidence_url":"https://github.com/jinshi666888/rea-playbook/blob/0ad65a85139025f32402be13ed64c8003e39b00a/README.md","description_en":"An Electron practice target, Evidence extractor and MCP probe; offline fixture mode is distinguished from real REA analysis.","description_zh":"提供 Electron 练习目标、Evidence 提取与 MCP 探测，区分离线展示和真正调用 REA。","kind":"learning-resource","category":"community-labs","group":"learn","relationship":"community-learning-resource","targets":["app"],"verified_at":"2026-10-15"},{"id":"dsh-mcp-rea","name":"dsh-mcp-rea","name_zh":"dsh-mcp-rea","url":"https://github.com/Ersith/dsh-mcp-rea","evidence_url":"https://github.com/Ersith/dsh-mcp-rea/blob/74e82f09e3f78fc945e07321d729e2e6b56406a8/README.md","description_en":"A community MCP bridge presents a smaller selected tool surface and forwards explicit commands to the REA CLI.","description_zh":"社区 MCP 适配桥，以精选工具和 CLI 转发缩小宿主需要处理的工具面。","kind":"integration","category":"community-integrations","group":"rea","relationship":"community-integration","targets":["app","binary","firmware","game","website"],"verified_at":"2026-10-15"},{"id":"rea-jev","name":"rea-jev","name_zh":"rea-jev","url":"https://github.com/juan-viox/rea-jev","evidence_url":"https://github.com/juan-viox/rea-jev/blob/236f149638971d1c98399fc9de864378b2011bfd/README.md","description_en":"A Claude Code plugin adds Jev-based routing and evidence checks around a pinned REA MCP integration.","description_zh":"Claude Code 社区插件，在固定版本 REA MCP 外增加 Jev 路由和证据检查。","kind":"integration","category":"community-integrations","group":"rea","relationship":"community-integration","targets":["app","website"],"verified_at":"2026-10-17T12:48:42Z"},{"id":"rea-lab","name":"rea-lab","name_zh":"rea-lab","url":"https://github.com/pablodiazjorge/rea-lab","evidence_url":"https://github.com/pablodiazjorge/rea-lab/blob/c96b76b75046fc884b8d7526205f1adb9497a5d7/README.md","description_en":"A Windows REA/Ghidra lab with seeded challenges, published studies, upstream contributions and recorded limitations.","description_zh":"Windows REA/Ghidra 实验室，提供已知答案挑战、公开研究、上游贡献与限制说明。","kind":"research","category":"community-labs","group":"learn","relationship":"community-learning-resource","targets":["binary"],"verified_at":"2026-10-17"},{"id":"rea-casebook","name":"rea-casebook","name_zh":"rea-casebook","url":"https://github.com/pablodiazjorge/rea-casebook","evidence_url":"https://github.com/pablodiazjorge/rea-casebook/blob/311c29688c82048971b2ef86df59e0ed78310fd8/README.md","description_en":"A Claude Code mod collects received REA Evidence, tracks unknowns and records findings that cite delivered evidence IDs.","description_zh":"Claude Code mod 汇集收到的 REA Evidence、追踪 unknown，并校验发现所引用的证据 ID。","kind":"integration","category":"community-integrations","group":"rea","relationship":"community-integration","targets":["binary"],"verified_at":"2026-10-15"},{"id":"picoprint-rea-investigation","name":"PicoPrint: LX-D02 printer investigation","name_zh":"PicoPrint：LX-D02 打印机调查","url":"https://github.com/bigtower17/picoprint","evidence_url":"https://github.com/morluto/rea/discussions/4152","description_en":"The author describes REA-assisted Android investigation followed by separate Hermes decompilation to support a Windows BLE printer.","description_zh":"作者报告以 REA 开始 Android 调查，再借助独立 Hermes 工具实现 Windows BLE 打印。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app","protocol"],"verified_at":"2026-10-15"},{"id":"morluto-awesome-re","name":"Awesome Reverse Engineering","name_zh":"Awesome Reverse Engineering","url":"https://github.com/morluto/awesome-reverse-engineering","evidence_url":"https://github.com/morluto/awesome-reverse-engineering/blob/901e752191ebdff4f1b8e1a2f15c82fef2de77e7/README.md","description_en":"A task-oriented reverse-engineering resource list by REA's maintainer, useful for broader tools and foundations.","description_zh":"REA 维护者整理的通用逆向资源目录，适合查找基础知识与相邻工具。","kind":"collection","category":"related-lists","group":"learn","relationship":"upstream-maintainer-companion-list","targets":["app","binary","firmware","game","protocol","website"],"verified_at":"2026-10-17T12:48:42Z"},{"id":"awesome-rea-cases","name":"Awesome REA Cases","name_zh":"Awesome REA Cases","url":"https://github.com/songshikang0111/awesome-REA-cases","evidence_url":"https://github.com/songshikang0111/awesome-REA-cases/blob/afea8a6c6ea29559533cf5ba4063e15b6649e0af/README.md","description_en":"A bilingual collection of REA and other AI-assisted reverse engineering cases, with source links and explicit distinctions between reported and reproduced outcomes.","description_zh":"中英双语的 REA 与其他 AI 辅助逆向案例合集，附来源并区分作者报告、进行中的工作和复现状态。","kind":"collection","category":"related-lists","group":"learn","relationship":"community-learning-resource","targets":["app","binary","firmware","game","protocol","website"],"verified_at":"2026-10-17T12:48:42Z"},{"id":"reacut-reconstruction","name":"ReaCut: video-editor reconstruction","name_zh":"ReaCut：视频编辑器重建案例","url":"https://github.com/Xiangyu-CAS/rea-capcut","evidence_url":"https://github.com/Xiangyu-CAS/rea-capcut/blob/da6f2f81473d90ad18d2c0d90220f21429f0c96f/README.md","description_en":"An independent video editor whose authors document REA-assisted investigation of Jianying/CapCut behavior and project formats. The public implementation includes a local timeline, FFmpeg export and an experimental, lossy draft importer.","description_zh":"独立视频编辑器，作者公开了利用 REA 研究剪映／CapCut 行为与项目格式的过程。实现包含本地时间线、FFmpeg 导出，以及实验性的有损草稿导入。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app"],"verified_at":"2026-10-16"},{"id":"open-appleremote-case","name":"open-appleremote: Siri Remote protocol reconstruction","name_zh":"open-appleremote：Siri Remote 协议重建","url":"https://github.com/a-funk/open-appleremote","evidence_url":"https://github.com/a-funk/open-appleremote/blob/1e6e190c3c29a3d2d8cad2c38c09f8953e9633e3/README.md","description_en":"Reconstructs first-generation Siri Remote Bluetooth reports for Linux, decoding buttons, touch and tvOS-style gestures. The Python implementation and protocol notes distinguish measured behavior, historical reports and inferred meanings.","description_zh":"重建第一代 Siri Remote 在 Linux 上的蓝牙报告，解析按键、触摸与 tvOS 风格手势。Python 实现和协议文档区分实测行为、历史报告与推测含义。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-17"},{"id":"gamekb-k17-case","name":"GAMEKB-K17: reconstructing a macropad configuration protocol","name_zh":"GAMEKB-K17：重建宏键盘配置协议","url":"https://github.com/dvdarkin/gamekb-k17","evidence_url":"https://github.com/dvdarkin/gamekb-k17/blob/e61f444793857c0e10a31692674335ee4ee9c89e/README.md","description_en":"Implements the vendor HID configuration protocol for the GAMEKB-K17/HCY-K017 macropad. It writes key mappings, firmware macros and RGB settings, then reads them back; protocol notes separate tested commands from unconfirmed observations and other-device findings.","description_zh":"实现 GAMEKB-K17/HCY-K017 宏键盘的厂商 HID 配置协议，写入按键映射、固件宏和 RGB 设置后再读回核对。协议文档区分已测试命令、未确认观察和其他设备的研究结果。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-17"},{"id":"cf632ble-case","name":"CF632BLE: a local client from scale-protocol research","name_zh":"CF632BLE：基于体脂秤协议研究的本地客户端","url":"https://github.com/guyru/cf632ble","evidence_url":"https://github.com/guyru/cf632ble/blob/c029ef5cfefbd323ffe2a194a75db5cc47aa6d5c/README.md","description_en":"Reimplements the CF632BLE scale’s BLE protocol and body-composition calculations from research on the vendor’s Unique Health Android app. A static Web Bluetooth client receives measurements, manages device profiles and keeps its history in browser storage.","description_zh":"根据对厂商 Unique Health 安卓应用的研究，重实现 CF632BLE 体脂秤的 BLE 协议和体成分计算。静态 Web Bluetooth 客户端接收测量数据、管理设备档案，并将历史记录保存在浏览器中。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-17"},{"id":"zee-rp-case","name":"zee-rp: reconstructing supported Axure RP 11 document operations","name_zh":"zee-rp：重建 Axure RP 11 的受支持文档操作","url":"https://github.com/LilZeeCN/zee-rp","evidence_url":"https://github.com/LilZeeCN/zee-rp/blob/473761e6a08f051e1666944db690332ef27a6038/README.md","description_en":"Reads and rewrites supported native Axure RP 11 documents through a binary-record codec, reference-aware cloning and constrained interaction writers. CLI and MCP interfaces expose inspected edits while keeping offline structure checks separate from native application acceptance.","description_zh":"通过二进制记录编解码、考虑引用关系的克隆和受约束的交互写入器，读取并修改受支持的 Axure RP 11 原生文档。CLI 与 MCP 接口提供可检查的编辑操作，并区分离线结构检查和原生应用验收。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-10-17"},{"id":"sm64ds-decomp-case","name":"Super Mario 64 DS: matching decompilation with relocation checks","name_zh":"Super Mario 64 DS：带重定位核对的匹配反编译","url":"https://github.com/tangosdev/sm64ds-decomp","evidence_url":"https://github.com/tangosdev/sm64ds-decomp/blob/af8636d638322b88738ef7ad4b4f28ed9c5be24f/README.md","description_en":"Reconstructs Super Mario 64 DS functions as C/C++ and permitted assembly primitives, comparing compiled output with a user-supplied cartridge dump. Independent relocation-destination checks strengthen the matching gate; integration into the PC port is tracked separately.","description_zh":"将 Super Mario 64 DS 函数重建为 C/C++ 和规则允许的汇编原语，并将编译结果与用户提供的卡带转储对比。独立的重定位目标核对强化匹配检查；PC 移植中的集成进度另行统计。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"goldeneye-pc-port-case","name":"GoldenEye 007: an agent-assisted native port from a decompilation","name_zh":"GoldenEye 007：基于反编译成果的智能体辅助原生移植","url":"https://github.com/jkdansereau/goldeneye-pc-port","evidence_url":"https://github.com/jkdansereau/goldeneye-pc-port/blob/fda76b69837e6c5aae436e0d3e798989e49b06d2/README.md","description_en":"Builds a native PC port on the existing GoldenEye 007 decompilation, with a host platform layer and assets extracted from the user’s ROM. The project documents agent collaboration, rendering comparisons, playtest scope and unresolved platform support.","description_zh":"在已有 GoldenEye 007 反编译成果之上构建原生 PC 移植，提供宿主平台适配层，并从用户自己的 ROM 提取资产。项目记录智能体协作、渲染对比、试玩范围和尚未解决的平台支持。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"ssbu-recomp-case","name":"ssbu-recomp: static recompilation with explicit mode limits","name_zh":"ssbu-recomp：明确玩法边界的静态重编译","url":"https://github.com/Denkishi/ssbu-recomp","evidence_url":"https://github.com/Denkishi/ssbu-recomp/blob/938e66bb7be0ba4123e291211895412da421b705/README.md","description_en":"Translates Super Smash Bros. Ultimate 13.0.4 AArch64 code ahead of time and supplies a Windows runtime with Vulkan/OpenGL rendering. It also reconstructs selected fighter scripts as editable C++ and compares translated/source behavior through differential and deterministic tests.","description_zh":"将 Super Smash Bros. Ultimate 13.0.4 的 AArch64 代码提前转换，并提供带 Vulkan/OpenGL 渲染的 Windows 运行时。项目还将部分角色脚本重建为可编辑 C++，通过差分与确定性测试对比转换代码和源码行为。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"kartpad-case","name":"KartPad: platform integration for a Mario Kart Wii recompilation","name_zh":"KartPad：Mario Kart Wii 重编译的平台集成","url":"https://github.com/chrissotraidis/kartpad","evidence_url":"https://github.com/chrissotraidis/kartpad/blob/7e99c6776263caa85dccde2de6281cb092778877/README.md","description_en":"Builds Apple and Android integration around WiiCompiled’s ahead-of-time translation of Mario Kart Wii, with native graphics, input and optional Retro Rewind support. Its status and rights documents distinguish platform acceptance, unresolved device defects and game-content requirements.","description_zh":"围绕 WiiCompiled 对 Mario Kart Wii 的提前转换实现 Apple 与 Android 平台集成，提供原生图形、输入及可选 Retro Rewind 支持。状态和权利文档区分平台验收、未解决的设备缺陷及游戏内容要求。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"battleship-port-case","name":"BattleShip: an AI-assisted Super Smash Bros. native port","name_zh":"BattleShip：AI 辅助的 Super Smash Bros. 原生移植","url":"https://github.com/JRickey/BattleShip","evidence_url":"https://github.com/JRickey/BattleShip/blob/39e978fbffe06a24f718bdf1ca740f27ad6a7dec/README.md","description_en":"Ports the existing Super Smash Bros. N64 decompilation using libultraship and Torch. The author’s earlier README describes agent-built graphics/audio comparison tools and differential debugging against emulator behavior, rather than claiming AI recovered the game from a cartridge without prior community work.","description_zh":"使用 libultraship 和 Torch 移植已有的 Super Smash Bros. N64 反编译成果。作者早期的 README 介绍了智能体构建的图形、音频对比工具和对照模拟器行为的差分调试，并未将其说成脱离社区既有成果、仅靠卡带自动恢复游戏。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"agent-decompilation-oracle-case","name":"Agent decompilation: a byte-matching retrospective","name_zh":"智能体反编译：字节匹配验收复盘","url":"https://momo5502.com/posts/2026-10-09-game-decompilation/","evidence_url":"https://momo5502.com/posts/2026-10-09-game-decompilation/","description_en":"Maurice Heumann describes replacing plausible-looking agent output with compiler-based checks of reconstructed functions, relocations, data and types. The retrospective reports 99% function presence and 83% of all functions byte-exact, while keeping the reconstruction code private.","description_zh":"Maurice Heumann 介绍如何用基于编译器的函数、重定位、数据和类型检查，取代看似合理的智能体输出。复盘报告 99% 的函数已进入重建源码，全部函数中 83% 达到字节一致；重建代码仍不公开。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"snowboardkids2-decomp-case","name":"Snowboard Kids 2: an LLM-assisted N64 matching decompilation","name_zh":"Snowboard Kids 2：大模型辅助的 N64 匹配反编译","url":"https://github.com/cdlewis/snowboardkids2-decomp","evidence_url":"https://github.com/cdlewis/snowboardkids2-decomp/blob/352a26fae08b3394e11f5e2b589e41a572d53288/README.md","description_en":"A public matching decompilation of the N64 game Snowboard Kids 2, begun in 2024 with community decompilation tools. The author’s dated posts document Claude, Codex and GLM workflows, including headless one-shot loops, similarity-based function scheduling and hook-guarded, hash-checked builds, through a reported complete function match.","description_zh":"N64 游戏 Snowboard Kids 2 的公开匹配反编译项目，2024 年借助社区反编译工具启动。作者在按日期发布的文章中记录了 Claude、Codex 和 GLM 的使用流程，包括无界面的一次性匹配循环、按函数相似度安排任务，以及由钩子约束、经哈希校验的构建，直至报告全部函数完成匹配。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"yibie-awesome-rea","name":"awesome-rea (yibie): verification-focused projects and practice reports","name_zh":"awesome-rea（yibie）：关注验证的项目与实践报告","url":"https://github.com/yibie/awesome-rea","evidence_url":"https://github.com/yibie/awesome-rea/blob/6df1bc922ac6b92dcd1b2f905c94d8cc4f3b5a3e/README.md","description_en":"Organizes AI-assisted game decompilation, native ports, static recompilation and tooling around stated acceptance checks, alongside a separate track of practitioner write-ups and discussions. Useful for finding primary reports and comparing how projects define correctness.","description_zh":"围绕明确的验收检查整理 AI 辅助游戏反编译、原生移植、静态重编译和工具，并另设实践文章与讨论分类。适合寻找一手报告，比较不同项目如何定义正确性。","kind":"collection","category":"related-lists","group":"learn","relationship":"community-learning-resource","targets":["binary","game"],"verified_at":"2026-10-17"},{"id":"cooler-lcd-case","name":"cooler-lcd: a Thermalright display protocol implementation","name_zh":"cooler-lcd：Thermalright 显示屏协议实现","url":"https://github.com/kristjaningi/cooler-lcd","evidence_url":"https://github.com/kristjaningi/cooler-lcd/blob/9a343678ba102de784b2302f79c53fd6ddc31ab9/README.md","description_en":"Implements a USB picture-transfer driver for Thermalright Vision cooler displays, with a Rust dashboard replacing the vendor display application. The documented protocol sends a header and JPEG frames, with periodic resends to prevent the device reverting to its logo.","description_zh":"为 Thermalright Vision 散热器显示屏实现 USB 图像传输驱动，并用 Rust 仪表盘替代厂商显示应用。文档所述协议发送报头和 JPEG 帧，通过定期重发避免设备退回品牌标志画面。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-17"},{"id":"isaacrecomp-case","name":"IsaacRecomp: translating Flash game bytecode to native C++","name_zh":"IsaacRecomp：将 Flash 游戏字节码转换为原生 C++","url":"https://github.com/whylurking/IsaacRecomp","evidence_url":"https://github.com/whylurking/IsaacRecomp/blob/7736f3d2961051b66cd315bcf5a719e9024d889d/README.md","description_en":"Translates The Binding of Isaac’s Flash AVM1 bytecode into C++ functions and supplies a native rendering/input runtime. The project reads graphics and audio from the user’s original game and documents deterministic input, headless runs and screenshot regression checks.","description_zh":"将 The Binding of Isaac 的 Flash AVM1 字节码转换为 C++ 函数，并提供原生渲染与输入运行时。项目从用户自己的原游戏读取图像和音频，并记录了确定性输入、无界面运行和截图回归检查。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"vd-streamer-linux-case","name":"Virtual Desktop Streamer: rehosting the platform layer on Linux","name_zh":"Virtual Desktop Streamer：在 Linux 上重建平台适配层","url":"https://github.com/cudanexus/vd-streamer-linux","evidence_url":"https://github.com/cudanexus/vd-streamer-linux/blob/e65c302f13639f044742bdc4951ab1a424c1c929/README.md","description_en":"An author-reported Claude Code and REA workflow replaces the macOS streamer’s capture, encoding, audio and input layer with Linux implementations while reusing vendor protocol libraries. The documented result targets desktop streaming and video playback, not Windows-only VR game streaming.","description_zh":"作者报告通过 Claude Code 与 REA，将 macOS 串流端的捕获、编码、音频和输入层替换为 Linux 实现，同时复用厂商协议库。文档中的目标是桌面串流和视频播放，而非仅 Windows 串流端提供的 VR 游戏串流。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app"],"verified_at":"2026-10-17"},{"id":"open-claude-ui-case","name":"Open Claude UI: REA-informed interface reference components","name_zh":"Open Claude UI：基于 REA 调查的界面参考组件","url":"https://github.com/Caho1/open-claude-ui","evidence_url":"https://github.com/Caho1/open-claude-ui/blob/ddf3aea1711db62fd6d24343bbab500a5ae69f64/README.md","description_en":"Publishes React components, motion helpers and design-system notes derived from the author’s reported REA investigation of Claude Desktop. It is useful as an interface-reconstruction case, with version-specific observations rather than proof of a complete assistant application or backend clone.","description_zh":"发布 React 组件、动效辅助模块和设计系统笔记，作者将其归因于使用 REA 调查 Claude Desktop。它可作为界面重建案例；观察结果受版本约束，不能证明已完整复刻助手应用或后端。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app"],"verified_at":"2026-10-17"},{"id":"nanolathe-case","name":"Nanolathe: a documented Total Annihilation engine reimplementation","name_zh":"Nanolathe：附研究文档的 Total Annihilation 引擎重实现","url":"https://github.com/nanolathe-gg/nanolathe","evidence_url":"https://github.com/nanolathe-gg/nanolathe/blob/5007ba75354c06fc9752a2822d37ff1e1443b77b/README.md","description_en":"Reimplements a Total Annihilation-compatible strategy-game engine in Go, with public file-format research and separate gameplay profiles. It distinguishes intended retail 3.1 behavior from community-patch research and deliberate modern changes, and separates synthetic checks from tests requiring original game data.","description_zh":"用 Go 重实现兼容 Total Annihilation 的策略游戏引擎，公开文件格式研究并提供不同玩法配置。项目区分拟复现的零售版3.1行为、社区补丁研究和有意加入的现代改动，也区分合成检查与依赖原始游戏数据的测试。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"haozhe-awesome-rea-games","name":"Awesome REA/Decompiled Games","name_zh":"Awesome REA/Decompiled Games：按游戏组织的重建项目目录","url":"https://github.com/HaozheH3/awesome-rea-games","evidence_url":"https://github.com/HaozheH3/awesome-rea-games/blob/4316a4ce86fdd851f0180ffee87dc336851bf5b6/README.md","description_en":"Groups game decompilations, source reconstructions, recompilations, native ports and demos by original game, with comparison rows linking related projects. It distinguishes launchers, engine work and creator-shared showcases from source-reconstruction efforts.","description_zh":"按原游戏整理反编译、源码重建、重编译、原生移植和演示，通过对照表链接相关项目，并区分启动器、引擎工作、作者分享的展示与源码重建成果。","kind":"collection","category":"related-lists","group":"learn","relationship":"community-learning-resource","targets":["game"],"verified_at":"2026-10-17"},{"id":"plx-native-case","name":"PlxNative: reconstructing a native webOS media-client interface","name_zh":"PlxNative：重建原生 webOS 媒体客户端接口","url":"https://github.com/GLinnik21/plx-native","evidence_url":"https://github.com/GLinnik21/plx-native/blob/0b0b22092b204432834c75f32148dbd16ec3493b/README.md","description_en":"An unofficial Plex client built after the author investigated LG webOS native media interfaces with Ghidra and coding agents. It draws its own Rust/OpenGL interface and uses the television’s decoder, with documented host, simulator and real-device test tiers.","description_zh":"作者用 Ghidra 和编程智能体调查 LG webOS 原生媒体接口后构建的非官方 Plex 客户端。它自行绘制 Rust/OpenGL 界面并使用电视解码器，文档区分宿主测试、模拟器测试和实体设备测试。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-10-17"},{"id":"th08-reconstruction-case","name":"TH08: exact-source reconstruction and separately tested ports","name_zh":"TH08：精确源码重建与单独验证的移植","url":"https://github.com/N0zoM1z0/th08","evidence_url":"https://github.com/N0zoM1z0/th08/blob/08c7f00f81e35db8206d917b14f47883930beef6/README.md","description_en":"Reconstructs the original Japanese Touhou 8 version 1.00d against its binary and original compiler, then adapts the recovered code for other platforms. Source presence, strict function matching, whole-executable identity and playable-port checks are recorded as different milestones.","description_zh":"依据原二进制和原编译器重建日版 Touhou 8 的 1.00d 版本，再将恢复的代码适配到其他平台。项目分别记录源码存在、严格函数匹配、完整可执行文件一致性和移植可玩性里程碑。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"rea-dinosaur-speed-case","name":"Dinosaur runner: recovering one acceleration rule","name_zh":"恐龙跑酷：恢复一条加速规则","url":"https://github.com/morluto/rea/blob/c360cfcd6d7901514b16dd6113eba2e0b0fdf422/website/evidence/calculator-and-dino.md#dinosaur-speed","evidence_url":"https://github.com/morluto/rea/blob/c360cfcd6d7901514b16dd6113eba2e0b0fdf422/website/evidence/calculator-and-dino.md","description_en":"REA’s documented teaching case inspects the HTTP t-rex-runner edition and reconstructs its speed-update rule. A separate controlled original-game check and a new demonstration compare update counts, including the floating-point step that crosses the nominal speed threshold.","description_zh":"REA 的教学案例检查 HTTP 版 t-rex-runner，并重建其速度更新规则。单独进行的受控原游戏检查与新演示对比更新次数，包含浮点递增越过名义速度阈值的一步。","kind":"case-study","category":"official-case-studies","group":"rea","relationship":"official-case-study","targets":["game","website"],"verified_at":"2026-10-17"},{"id":"rea-calculator-percent-case","name":"Windows Calculator: reconstructing percentage rules","name_zh":"Windows Calculator：重建百分比规则","url":"https://github.com/morluto/rea/blob/c360cfcd6d7901514b16dd6113eba2e0b0fdf422/website/evidence/calculator-and-dino.md#windows-calculator","evidence_url":"https://github.com/morluto/rea/blob/c360cfcd6d7901514b16dd6113eba2e0b0fdf422/website/evidence/calculator-and-dino.md","description_en":"REA’s case traces the installed Windows Calculator model DLL to explain different percentage behavior for multiplication/division and other operations. An analyst-selected function is interpreted against public Microsoft source and demonstrated with fixed browser examples.","description_zh":"REA 案例追踪已安装 Windows Calculator 的模型 DLL，解释乘除运算与其他运算中不同的百分比行为。分析人员选定函数后，对照微软公开源码解释，并通过固定输入的浏览器示例演示。","kind":"case-study","category":"official-case-studies","group":"rea","relationship":"official-case-study","targets":["app","binary"],"verified_at":"2026-10-17"},{"id":"feishu-dual-instance-case","name":"Feishu: an author-reported isolated second app instance","name_zh":"飞书：作者报告的隔离第二应用实例","url":"https://benx.ai/blog/posts/rea-reverse-engineer-feishu-dual-instance/","evidence_url":"https://benx.ai/blog/posts/rea-reverse-engineer-feishu-dual-instance/","description_en":"The author reports using Codex and REA analysis to adapt a separate macOS Feishu copy with its own application identity, data directory and single-instance lock. The account describes local signing and separation checks while retaining the original app unchanged.","description_zh":"作者报告借助 Codex 与 REA 分析，修改独立的 macOS 飞书副本，为其设置不同的应用身份、数据目录和单实例锁。文章描述本地签名与隔离检查，并称原应用保持不变。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app"],"verified_at":"2026-10-17"},{"id":"zelda64recomp-case","name":"Zelda 64: Recompiled — a native Majora’s Mask port without a full source decompilation","name_zh":"Zelda 64: Recompiled：无需完整源码反编译的《姆吉拉的假面》原生移植","url":"https://github.com/Zelda64Recomp/Zelda64Recomp","evidence_url":"https://github.com/Zelda64Recomp/Zelda64Recomp/blob/b65c482ed672258eb684ab94a4e8c8aa662615ee/README.md","description_en":"Uses N64Recomp to translate Majora’s Mask into a native application and RT64 for rendering. The project separates static recompilation from source decompilation while reusing decompilation headers and selected functions for patches and enhancements.","description_zh":"通过 N64Recomp 将《姆吉拉的假面》转为原生应用，并使用 RT64 渲染。项目区分静态重编译与源码反编译，同时借用反编译项目的头文件和部分函数实现补丁与增强功能。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"opengoal-jak-case","name":"OpenGOAL: recovering GOAL code and rebuilding the Jak games","name_zh":"OpenGOAL：恢复 GOAL 代码并重建 Jak 系列游戏","url":"https://github.com/open-goal/jak-project","evidence_url":"https://github.com/open-goal/jak-project/blob/32c3cf73970f885c0a588623208232db72a74a58/README.md","description_en":"Reconstructs readable GOAL code from the original Jak binaries and compiles it with a new GOAL compiler for modern PCs. Its workflow combines a specialized decompiler, manually supplied type information, asset extraction and an interactive development runtime.","description_zh":"从 Jak 原二进制重建可读的 GOAL 代码，再用新编写的 GOAL 编译器为现代 PC 编译。流程结合专用反编译器、人工补充的类型信息、素材提取和交互式开发运行时。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"lego-island-decomp-case","name":"LEGO Island: source reconstruction with separately reported exact rebuilds","name_zh":"LEGO Island：源码重建与单独记录的精确重构建","url":"https://github.com/isledecomp/isle","evidence_url":"https://github.com/isledecomp/isle/blob/8119bd013645972c72480e4de21529f1e91ce5c7/README.md","description_en":"Reconstructs the English LEGO Island 1.1 source for its original 32-bit Windows target. The project distinguishes function-comparison reports, ReproBit’s reported byte-identical retail rebuilds and ordinary developer builds; its modern portable adaptation is a separate repository.","description_zh":"针对英文版 LEGO Island 1.1 的原始 32 位 Windows 目标重建源码。项目区分函数对比报告、ReproBit 报告的零售版逐字节一致重构建，以及普通开发构建；现代跨平台适配位于另一仓库。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"snowball-war-rea-case","name":"Snowball War: a bounded REA-assisted minigame reconstruction","name_zh":"Snowball War：范围明确的 REA 辅助小游戏重建","url":"https://github.com/tuunanet/rea-ski-or-die-reconstruction","evidence_url":"https://github.com/tuunanet/rea-ski-or-die-reconstruction/blob/0eac0671c90e21a16e663da7772b60710101ef7f/README.md","description_en":"The author uses REA’s Ghidra workflow to investigate the DOS Ski or Die binary, document Snowball War rules and rebuild that one minigame in Rust with SDL2. The public notes distinguish recovered tables and mechanics from approximations and deliberate presentation changes.","description_zh":"作者通过 REA 的 Ghidra 工作流调查 DOS 版 Ski or Die 二进制，记录 Snowball War 的规则，再用 Rust 与 SDL2 重建这一小游戏。公开笔记区分恢复的数据表和机制、近似实现以及有意调整的表现效果。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["game"],"verified_at":"2026-10-17"},{"id":"space-cadet-pinball-case","name":"SpaceCadetPinball: decompiled game logic adapted to SDL2","name_zh":"SpaceCadetPinball：将反编译游戏逻辑适配到 SDL2","url":"https://github.com/k4zmu2a/SpaceCadetPinball","evidence_url":"https://github.com/k4zmu2a/SpaceCadetPinball/blob/cb9b7b886244a27773f66b0b19fdc2998392565e/README.md","description_en":"Converts the reverse-engineered Space Cadet pinball game into compilable C++ for desktop platforms. The README identifies the Windows XP executable and public PDB, a Full Tilt executable, and the work of recovering structures, naming variables and adapting the decompiled routines.","description_zh":"将逆向分析后的 Space Cadet 弹球游戏转为可编译的 C++，面向桌面平台。README 标明 Windows XP 可执行文件及公开 PDB、Full Tilt 可执行文件，并描述恢复结构、命名变量和适配反编译例程的工作。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"sm64-decomp-case","name":"Super Mario 64: ROM reconstruction with explicit comparison gates","name_zh":"Super Mario 64：带明确比较开关的 ROM 重建","url":"https://github.com/n64decomp/sm64","evidence_url":"https://github.com/n64decomp/sm64/blob/9921382a68bb0c865e5e45eb594d9c64db59b1af/README.md","description_en":"Reconstructs Super Mario 64 source for Japanese, North American, European, Shindou and iQue releases. Its build files distinguish original-ROM hash comparison from nonmatching or modified configurations, while source naming and documentation remain ongoing.","description_zh":"为日版、北美版、欧洲版、Shindou 版和 iQue 版 Super Mario 64 重建源码。构建文件区分原 ROM 哈希比较与非匹配或修改配置；源码命名和文档工作仍在推进。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"unleashed-recompiled-case","name":"Unleashed Recompiled: translating Xbox 360 game code and shaders","name_zh":"Unleashed Recompiled：转换 Xbox 360 游戏代码与着色器","url":"https://github.com/hedge-dev/UnleashedRecomp","evidence_url":"https://github.com/hedge-dev/UnleashedRecomp/blob/cf829a9eca8fb680fba4b0409ddeb6ca92f22e3c/README.md","description_en":"Builds an unofficial Sonic Unleashed PC port by statically recompiling Xbox 360 PowerPC code with XenonRecomp and Xenos shaders with XenosRecomp. The port adds modern display and modding options while documenting original-engine limits and remaining compatibility issues.","description_zh":"使用 XenonRecomp 静态重编译 Xbox 360 PowerPC 代码，并用 XenosRecomp 转换 Xenos 着色器，构建非官方 Sonic Unleashed PC 移植。项目增加现代显示与模组选项，同时记录原引擎限制和仍存在的兼容性问题。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"openmw-engine-case","name":"OpenMW: replacing Morrowind’s engine while reusing original content","name_zh":"OpenMW：复用原内容并替代 Morrowind 引擎","url":"https://github.com/OpenMW/openmw","evidence_url":"https://github.com/OpenMW/openmw/blob/5fdc0f1c4d1d07575f9b360b8cf1d6562232bf8e/README.md","description_en":"Provides an independent engine for playing Morrowind and an alternative editor, OpenMW-CS. It loads original game content through its own runtime and documents script and mod compatibility differences; it is an engine replacement rather than a recovered Bethesda source tree.","description_zh":"提供用于运行 Morrowind 的独立引擎和替代编辑器 OpenMW-CS，通过自己的运行时加载原游戏内容，并记录脚本及模组兼容性差异。这是引擎替代实现，而非恢复出的 Bethesda 源码树。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"redriver2-case","name":"REDRIVER2: reconstructing Driver 2 through a PlayStation compatibility layer","name_zh":"REDRIVER2：借助 PlayStation 兼容层重建 Driver 2","url":"https://github.com/OpenDriver2/REDRIVER2","evidence_url":"https://github.com/OpenDriver2/REDRIVER2/blob/b2d8857426f815007486def9bd23f9a6007a2c64/README.md","description_en":"Translates reverse-engineered Driver 2 MIPS routines into C/C++ and uses Psy-X/Psy-Cross to adapt PlayStation interfaces for desktop systems. The project documents symbol-assisted Ghidra/IDA work alongside intentional bug fixes and gameplay changes.","description_zh":"将逆向分析的 Driver 2 MIPS 例程转为 C/C++，并用 Psy-X/Psy-Cross 将 PlayStation 接口适配到桌面系统。项目记录借助符号的 Ghidra/IDA 分析，同时明确包含有意修复的错误和玩法改动。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"photocraft-case","name":"PhotoCraft: editor workflow reconstruction and PSD round-trip boundaries","name_zh":"PhotoCraft：编辑流程重建与 PSD 往返边界","url":"https://github.com/storytold/photocraft","evidence_url":"https://github.com/storytold/photocraft/blob/5f65579ecb44047c2a619036c18ff273202e1389/README.md","description_en":"The authors describe this Rust image editor as a clean-room reimplementation of Photoshop-style workflows. Its document engine, UI and automation interfaces share editing commands, while the source distinguishes PSD editor round trips from byte preservation in the standalone file codec.","description_zh":"作者将这款 Rust 图像编辑器描述为 Photoshop 风格流程的净室重实现。文档引擎、界面与自动化接口共用编辑命令；源码区分编辑器中的 PSD 往返处理与独立文件编解码器的字节保留。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-10-17"},{"id":"wordcraft-case","name":"WordCraft: document workflow reconstruction and bounded DOCX compatibility","name_zh":"WordCraft：文档流程重建与有限范围 DOCX 兼容","url":"https://github.com/storytold/wordcraft","evidence_url":"https://github.com/storytold/wordcraft/blob/eae242176108d328c5dd81fbc10370c51ab90706/README.md","description_en":"The authors describe WordCraft as a clean-room Rust implementation of familiar Microsoft Word workflows. It provides its own document model, layout engine and DOCX reader/writer, with desktop and browser interfaces; source tests exercise selected editing and file-preservation behavior.","description_zh":"作者将 WordCraft 描述为以 Rust 净室重实现熟悉的 Microsoft Word 流程。项目提供自己的文档模型、排版引擎和 DOCX 读写器，以及桌面与浏览器界面；源码测试覆盖选定的编辑与文件保留行为。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-10-17"},{"id":"gridcraft-case","name":"GridCraft: spreadsheet workflow reconstruction and XLSX round-trip limits","name_zh":"GridCraft：电子表格流程重建与 XLSX 往返边界","url":"https://github.com/storytold/gridcraft","evidence_url":"https://github.com/storytold/gridcraft/blob/f1894c6da64d4326022ae644c767581816a23c2c/README.md","description_en":"The authors describe GridCraft as a clean-room Rust implementation of Excel-style spreadsheet workflows. A workbook model, formula parser and dependency-driven recalculation are connected to XLSX I/O and a shared editing-command layer for desktop, browser and automation interfaces.","description_zh":"作者将 GridCraft 描述为以 Rust 净室重实现 Excel 风格的电子表格流程。工作簿模型、公式解析器与依赖驱动的重新计算连接到 XLSX 读写，以及供桌面、浏览器和自动化接口共用的编辑命令层。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-10-17"},{"id":"deckcraft-case","name":"DeckCraft: presentation workflow reconstruction and bounded PPTX interchange","name_zh":"DeckCraft：演示文稿流程重建与有限范围 PPTX 交换","url":"https://github.com/storytold/deckcraft","evidence_url":"https://github.com/storytold/deckcraft/blob/1dc69720db64323370dda061226becb09ad79fd4/README.md","description_en":"The authors describe DeckCraft as a clean-room Rust implementation of PowerPoint-style presentation workflows. Its slide model, rendering and command layers support desktop/browser editing and PPTX interchange; reviewed source tests check constructed decks and selected preserved package parts.","description_zh":"作者将 DeckCraft 描述为以 Rust 净室重实现 PowerPoint 风格的演示文稿流程。其幻灯片模型、渲染与命令层支撑桌面／浏览器编辑及 PPTX 交换；所审阅源码测试检查构造的文稿和选定的保留包部件。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-10-17"},{"id":"devilutionx-case","name":"DevilutionX: porting Diablo’s reconstructed engine","name_zh":"DevilutionX：移植重建后的 Diablo 引擎","url":"https://github.com/diasurgical/DevilutionX","evidence_url":"https://github.com/diasurgical/DevilutionX/blob/94433061f847d22863e5d705c398f7c13d7bab85/README.md","description_en":"Builds a modern Diablo and Hellfire port on the Devilution reconstruction, with platform support, bug fixes and optional quality-of-life features. The project documents the original symbol-assisted reconstruction and includes selected dungeon-generation and saved-game regression checks.","description_zh":"基于 Devilution 重建成果提供现代平台上的 Diablo 与 Hellfire 移植，加入平台支持、错误修复及可选便利功能。项目记录了早期借助符号信息的重建过程，并包含特定地牢生成与存档回归检查。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-17"},{"id":"thinkpad-imx471-camera-case","name":"ThinkPad IMX471: recovering camera tuning for Linux","name_zh":"ThinkPad IMX471：为 Linux 恢复相机调校信息","url":"https://github.com/cschalle/mipi-fixes-x1-aura","evidence_url":"https://github.com/cschalle/mipi-fixes-x1-aura/blob/533d995b7acbd6965e5b0b85c97f8bafab9fed4e/README.md","description_en":"Recovers selected camera-tuning structures from an Intel Windows driver package and uses them to repair Linux image capture on one ThinkPad model. Public CPFF/AIQB parsers, kernel patches and libcamera changes accompany the author’s Claude-assisted investigation and bounded before/after measurements.","description_zh":"从 Intel Windows 驱动包中恢复选定的相机调校结构，用于修复一个 ThinkPad 型号在 Linux 下的图像采集。公开的 CPFF／AIQB 解析器、内核补丁及 libcamera 修改，配有作者报告的 Claude 辅助调查和有限范围的前后测量。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware"],"verified_at":"2026-10-17"},{"id":"ledger-reborn-accounting-case","name":"Ledger Reborn: an independent accounting app informed by QuickBooks study","name_zh":"Ledger Reborn：基于 QuickBooks 研究的独立记账实现","url":"https://github.com/lxistired/ledger-reborn","evidence_url":"https://github.com/lxistired/ledger-reborn/blob/d7f6b8a1f4ad6c4ae8b10100d1c93cf15940c21d/docs/CASE_STUDY.md","description_en":"The maintainer reports using REA and Ghidra to study selected QuickBooks Desktop for Mac behavior, then independently implements a local accounting application. Its Python/SQLite engine persists double-entry journals, invoices, inventory and payments, while public synthetic fixtures test bounded accounting and rollback behavior.","description_zh":"维护者报告使用 REA 与 Ghidra 研究 QuickBooks Desktop for Mac 的选定行为，随后独立实现本地记账应用。Python／SQLite 引擎持久保存复式分录、发票、库存和付款；公开合成样例检查有限范围的记账与回滚行为。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app"],"verified_at":"2026-10-17"},{"id":"rauchg-rsc-reconstruction-case","name":"rauchg.com: rebuilding an RSC blog from captured Flight output","name_zh":"rauchg.com：根据捕获的 Flight 输出重建 RSC 博客","url":"https://github.com/boyang-hu/website-rebuild-skill/blob/ac60c9d8a2ab40045a89b5403c3457f1404e92b3/skills/website-rebuild/references/rsc-reconstruction.md","evidence_url":"https://github.com/boyang-hu/website-rebuild-skill/blob/ac60c9d8a2ab40045a89b5403c3457f1404e92b3/skills/website-rebuild/references/rsc-reconstruction.md","description_en":"Documents a website-rebuild-skill case that decodes browser-delivered React Server Component Flight streams, reconstructs a buildable Next project and compares its output with a captured site. The reported rauchg.com campaign uses route-tree comparison and module-reference mapping; the new server source is inferred from observable output.","description_zh":"记录 website-rebuild-skill 的一个案例：解码浏览器收到的 React 服务端组件 Flight 流，重建可构建的 Next 项目，再与捕获站点的输出比较。作者报告的 rauchg.com 重建过程采用路由树比较与模块引用映射；新服务端源码由可观察输出推断。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["website"],"verified_at":"2026-10-17"},{"id":"njfe-ear-camera-bridge-case","name":"NJFE: a Soulear camera protocol bridge for desktop inspection","name_zh":"NJFE：用于电脑检查的 Soulear 相机协议桥接","url":"https://github.com/WildweaselMS/NJFE","evidence_url":"https://github.com/WildweaselMS/NJFE/blob/992866c6609f8c813f459ff79840cf04d5883f8e/README.md","description_en":"Reuses otoscope's reverse-engineered i4season/Soulear protocol in an ESP32-C3 bridge and Python desktop viewer. The author credits Claude Code for implementation and reports streaming one Hopefox Find T to a Windows PC, with recording, orientation and LED controls.","description_zh":"在 ESP32-C3 桥接器与 Python 电脑查看器中复用 otoscope 经逆向得到的 i4season／Soulear 协议。作者将实现归功于 Claude Code 辅助，报告把一台 Hopefox Find T 的视频传到 Windows 电脑，并提供录像、方向调整及 LED 控制。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-17"},{"id":"baocut-slides-editor-case","name":"BaoCut Slides: adapting an interactive web editor","name_zh":"BaoCut Slides：交互式网页编辑器改编","url":"https://github.com/JimLiu/baocut/tree/b8585e0c8d7a82bdee9f0ed019cf6edb075e41c1/packages/slides-runtime","evidence_url":"https://github.com/JimLiu/baocut/blob/b8585e0c8d7a82bdee9f0ed019cf6edb075e41c1/docs/design/slides/slides-design.md","description_en":"Documents BaoCut’s interactive slide editor, whose author says the implementation draws on Claude Slides. It adds a local deck store, HTML/CSS compiler and annotation-to-agent bridge for browser and desktop hosts; the design reports a Web-flow check, without establishing original backend recovery or full behavioral parity.","description_zh":"记录 BaoCut 交互式幻灯片编辑器，作者称其实现借鉴自 Claude Slides。它为浏览器与桌面宿主加入本地文稿存储、HTML/CSS 编译器及标注到智能体的桥接；设计说明报告了 Web 流程检查，但未确立原有后端恢复或完整行为一致性。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","website"],"verified_at":"2026-10-17"},{"id":"pocket-tasks-reconstruction-case","name":"Pocket Tasks: reconstructing task state and persistence","name_zh":"Pocket Tasks：重建任务状态与持久保存行为","url":"https://github.com/ShadowSwaps/REA-Reconstruction-Companion/tree/main/evals/reference/reconstruction","evidence_url":"https://github.com/ShadowSwaps/REA-Reconstruction-Companion/blob/590e65dd99596c7fb66598eaa5d6c051c2ec9a5f/evals/reference/reconstruction/README.md","description_en":"A teaching case with disclosed prior source access carries a REA-assisted investigation of a small command-line app into a separate Node implementation. It preserves observed task editing, persistence and selection behavior, then compares scoped outputs against fixed expectations and captured reference sessions.","description_zh":"此教学案例明确披露作者先前接触过源码，将一次 REA 辅助的小型命令行应用调查推进为另行编写的 Node 实现。它保留所观察到的任务编辑、持久保存及选择行为，再将限定范围的输出与固定期望值及捕获的参考会话比较。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app"],"verified_at":"2026-10-17"},{"id":"open-scrantic-screensaver-case","name":"Open Scrantic: reconstructing the Johnny Castaway screensaver engine","name_zh":"Open Scrantic：重建 Johnny Castaway 屏幕保护程序引擎","url":"https://github.com/glauberlima/open-scrantic","evidence_url":"https://github.com/glauberlima/open-scrantic/blob/2db75008931eb744f79d0c3fb12e0d89950466ff/README.md","description_en":"Reconstructs the Johnny Castaway screensaver engine in Rust, with author-disclosed REA and Claude Code use. It reads original files to run recovered animation scripts and calendar-based story state on modern desktops; documented deviations and limited tests stop short of complete behavioral equivalence.","description_zh":"以 Rust 重建 Johnny Castaway 屏幕保护程序引擎，作者明确披露使用 REA 与 Claude Code。它读取原始文件，在现代桌面上运行恢复的动画脚本及按日历推进的故事状态；文档保留实现差异与有限测试范围，未确立完整行为等价。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app"],"verified_at":"2026-10-18"},{"id":"eleven-agent-re-workbench","name":"Eleven","name_zh":"Eleven","url":"https://github.com/Zfinix/eleven","evidence_url":"https://github.com/Zfinix/eleven/blob/94760718dfd741ba93fcc9b591eb39a96c034103/README.md","description_en":"An agent-first desktop reverse-engineering app that opens Mach-O, ELF and PE binaries, Android packages and GPU kernels, and lets any Agent Client Protocol agent read code, rename functions, add notes and propose patches in a shared window. Native code is decompiled by Ghidra through a bundled REA build, with Rizin and jadx as alternative engines. It is a workbench around existing engines, not a new decompiler or a reconstruction case.","description_zh":"以智能体为核心的桌面逆向工程应用，可打开 Mach-O、ELF、PE 二进制、Android 安装包和 GPU 内核，让任何支持 Agent Client Protocol 的智能体在同一窗口中阅读代码、重命名函数、添加笔记并提出补丁。原生代码通过内置的 REA 构建交由 Ghidra 反编译，也可改用 Rizin 和 jadx。它是围绕现有引擎的工作台，并非新的反编译器或重建案例。","kind":"integration","category":"community-integrations","group":"rea","relationship":"community-integration","targets":["app","binary"],"verified_at":"2026-10-18"},{"id":"rea-flutter-guide","name":"Flutter build identification","name_zh":"Flutter 构建识别","url":"https://github.com/morluto/rea/blob/main/docs/flutter-analysis.md","evidence_url":"https://github.com/morluto/rea/blob/c12d9eda87aa5a022ee7e18ea96d8d03bfd12e96/docs/flutter-analysis.md","description_en":"Identifies a Flutter APK’s Dart snapshot hash, per-ABI library digests and engine build provenance, then inspects one ABI’s AOT snapshot sections, through REA’s pure-parsing CLI and MCP tools. The string-pool output is a bounded byte-pattern projection of package and SDK URIs, not deserialized Dart classes or recovered source.","description_zh":"通过 REA 的纯解析命令行与 MCP 工具，识别 Flutter APK 的 Dart 快照哈希、各 ABI 库摘要与引擎构建来源，再检查单个 ABI 的 AOT 快照段。字符串池输出是对 package 与 SDK URI 的有界字节模式投影，并非反序列化的 Dart 类或恢复的源码。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["app"],"verified_at":"2026-10-18"},{"id":"rea-harmony-guide","name":"Static HarmonyOS package inventory","name_zh":"HarmonyOS 应用包静态清点","url":"https://github.com/morluto/rea/blob/main/docs/harmony-analysis.md","evidence_url":"https://github.com/morluto/rea/blob/093ce695f0a7c3407c7fde520ed8b20c0981b408/docs/harmony-analysis.md","description_en":"Inventories HarmonyOS HAP, HSP and App Pack files through REA’s hardened ZIP reader and projects an execution-free application graph: component paths, IDs and hashes, Stage/FA packaging hints, runtime-family hints and path-based native-bridge hypotheses. Every claim rests on path presence; manifests, Ark bytecode, resources and signatures are not decoded or verified.","description_zh":"通过 REA 加固的 ZIP 读取器清点 HarmonyOS 的 HAP、HSP 与 App Pack 文件，并投影出无需执行的应用图：组件路径、ID 与哈希、Stage／FA 打包模型提示、运行时类别提示，以及基于路径的原生桥接假设。所有结论仅基于路径存在；清单、Ark 字节码、资源和签名均未被解码或验证。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["app"],"verified_at":"2026-10-18"},{"id":"rea-ghidra-mips-guide","name":"MIPS ELF analysis through Ghidra","name_zh":"通过 Ghidra 分析 MIPS ELF","url":"https://github.com/morluto/rea/blob/main/docs/ghidra-mips.md","evidence_url":"https://github.com/morluto/rea/blob/c12d9eda87aa5a022ee7e18ea96d8d03bfd12e96/docs/ghidra-mips.md","description_en":"Documents REA’s Ghidra lane for MIPS ELF executables, relocatable objects and MIPS16 shared images, including a pinned 32-bit language for recordless legacy firmware executables that Ghidra would otherwise import as 64-bit. Admission is bounded by declared header and ABI-record facts, and verification compares source-owned fixtures with independent readelf output rather than executing or rehosting firmware.","description_zh":"说明 REA 通过 Ghidra 分析 MIPS ELF 可执行文件、可重定位目标文件与 MIPS16 共享镜像的流程，包括为缺少 ABI 记录的旧式固件可执行文件固定 32 位语言，以免 Ghidra 将其按 64 位导入。准入以文件头声明和 ABI 记录为界；验证将项目自有的测试样本与独立的 readelf 输出对照，而不执行或重新托管固件。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["binary","firmware"],"verified_at":"2026-10-18"},{"id":"rea-ghidra-psp-guide","name":"PSP static ELF analysis through Ghidra","name_zh":"通过 Ghidra 静态分析 PSP ELF","url":"https://github.com/morluto/rea/blob/main/docs/ghidra-psp.md","evidence_url":"https://github.com/morluto/rea/blob/c12d9eda87aa5a022ee7e18ea96d8d03bfd12e96/docs/ghidra-psp.md","description_en":"Documents REA’s bounded Ghidra profile for static PSP ELF executables, which leaves Allegrex instructions, PSP loading and calling conventions to a caller-installed ghidra-allegrex extension while reusing REA’s CLI, MCP, Evidence and snapshot workflows. It admits one PSPSDK header and ABI declaration on Linux x64 and verifies selected static facts on a self-built fixture, not commercial games or PRX modules.","description_zh":"说明 REA 针对静态 PSP ELF 可执行文件的受限 Ghidra 配置：Allegrex 指令、PSP 加载与调用约定交由使用者安装的 ghidra-allegrex 扩展处理，同时沿用 REA 的命令行、MCP、证据与快照流程。它仅在 Linux x64 上接受一种 PSPSDK 文件头与 ABI 声明，并在自行构建的测试样本上验证选定的静态事实，不涉及商业游戏或 PRX 模块。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"rea-touhou-reconstruction-method-case","name":"Touhou reconstructions: an agent-driven method across three games","name_zh":"东方 Project 重建：贯穿三款游戏的智能体驱动方法","url":"https://rea.tools/blog/touhou-reconstruction/","evidence_url":"https://github.com/morluto/rea/blob/c12d9eda87aa5a022ee7e18ea96d8d03bfd12e96/website/evidence/touhou-reconstruction-method.md","description_en":"An essay published on REA’s site, with pinned evidence notes, describes one author’s agent-driven reconstructions of TH08, TH095 and TH04. It dates milestones from public commits and progress ledgers, separates exact-comparison and playable-build oracles, and documents a TH08 check that missed wrong floating-literal data. Project results remain author-reported, and REA is credited with supplying analysis evidence, not the reconstructions themselves.","description_zh":"REA 网站发表的一篇文章及其固定版本的证据说明，介绍一位作者以智能体驱动重建 TH08、TH095 与 TH04 的过程。文章依据公开提交与进度记录标注里程碑，区分精确比对与可游玩构建两类判定依据，并记录 TH08 一项检查漏查错误浮点字面量数据的问题。项目结果仍为作者报告；REA 的作用是为智能体提供分析证据，而非完成重建本身。","kind":"case-study","category":"official-case-studies","group":"rea","relationship":"official-case-study","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"rea-engine-tictactoe-case","name":"TicTacToe-AI: a bounded REA-fork reconstruction of one game method","name_zh":"TicTacToe-AI：REA 分叉对单个游戏方法的有限重建","url":"https://github.com/heaven-hm/re-agent/tree/develop/benchmarks/tictactoe","evidence_url":"https://github.com/heaven-hm/re-agent/blob/a84c61e8baa65d445485722420a57ff4132b90d3/benchmarks/native-windows-ports/reports/targets/tictactoe.md","description_en":"The author’s REA fork, posted as rea-engine and since renamed RE-Agent, decompiles the shipped .NET executable of the GPL-licensed TicTacToe-AI game, recompiles the recovered C# and resources, and repairs one decompiler error against the original IL. A differential probe runs original and rebuilt code on all 19,683 board assignments for one status method and compares six form renders. The report passes only that method; the whole game remains partial.","description_zh":"作者的 REA 分叉（发帖时名为 rea-engine，后更名为 RE-Agent）反编译 GPL 许可的 TicTacToe-AI 游戏所发布的 .NET 可执行文件，重新编译恢复出的 C# 与资源，并依据原始 IL 修复一处反编译错误。差分探针在一个状态判定方法的全部 19,683 种棋盘赋值上运行原版与重建代码，并比较六张窗体渲染图。报告只判定该方法通过，整个游戏仍属部分重建。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["game"],"verified_at":"2026-10-18"},{"id":"rea-claude-code-isolated-ab-case","name":"REA in Claude Code: an isolated static-analysis A/B trial","name_zh":"Claude Code 中的 REA：隔离配置下的静态分析 A/B 试验","url":"https://zenn.dev/keigoly/articles/8738d8d241b5a1","evidence_url":"https://zenn.dev/keigoly/articles/8738d8d241b5a1","description_en":"A Japanese field report connects REA 6.4.0 to Claude Code in a separate project directory, denies 43 of its 170 tools and common shell launch forms, and compares REA-enabled and REA-disabled runs on two real tasks: an Electron terminal’s packaged files and a saved HAR capture. Both arms answered correctly, while the REA arm took up to 2.00× the time and 1.67× the API-equivalent cost. It is an analysis-evaluation and safety-configuration case, not a reconstruction.","description_zh":"一篇日文实践报告在单独的项目目录中把 REA 6.4.0 接入 Claude Code，屏蔽其 170 个工具中的 43 个以及常见的命令行启动方式，并在两个真实任务上比较启用与禁用 REA 的运行：一个 Electron 终端的分发文件，以及一份保存的 HAR 通信记录。两组都给出正确答案，而启用 REA 的一组耗时最多为 2.00 倍、按 API 计价的费用最多为 1.67 倍。这是分析评估与安全配置案例，而非重建案例。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app","website"],"verified_at":"2026-10-18"},{"id":"rea-ghidra-nativeaot-guide","name":"NativeAOT metadata recovery with Ghidra","name_zh":"借助 Ghidra 恢复 NativeAOT 元数据","url":"https://github.com/morluto/rea/blob/main/docs/ghidra-nativeaot.md","evidence_url":"https://github.com/morluto/rea/blob/093ce695f0a7c3407c7fde520ed8b20c0981b408/docs/ghidra-nativeaot.md","description_en":"Recovers .NET 8 NativeAOT metadata from x64 PE executables during REA’s Ghidra analysis: MethodTable relationships, virtual slots and frozen strings from RTR 9.1 data, through a built-in read-only parser or an optional headless adapter that annotates the Ghidra database. Generated names, inferred prototypes and recovered native pseudocode stay separate from the unknown original C# names, fields and source.","description_zh":"在 REA 的 Ghidra 分析中，从 x64 PE 可执行文件恢复 .NET 8 NativeAOT 元数据：通过内置只读解析器或可选的无界面适配器（会为 Ghidra 数据库添加注释），从 RTR 9.1 数据中取得 MethodTable 关系、虚表槽位与冻结字符串。生成的名称、推断的原型和恢复的原生伪代码，与未知的原始 C# 名称、字段和源码明确区分。","kind":"documentation","category":"workflow-guides","group":"rea","relationship":"official-documentation","targets":["binary"],"verified_at":"2026-10-18"},{"id":"ultrasunnymoon-rea-case","name":"UltraSunnyMoon: a partial, REA-led Pokémon Ultra Sun reconstruction","name_zh":"UltraSunnyMoon：以 REA 主导的部分《宝可梦 究极之日》重建","url":"https://github.com/tylergraydev/UltraSunnyMoon","evidence_url":"https://github.com/tylergraydev/UltraSunnyMoon/blob/913eed4969163ea15e354dacb8e2bfe0a2439de5/README.md","description_en":"The author uses a pinned REA build with Ghidra to analyze a user-supplied Pokémon Ultra Sun base executable, rebuild it byte for byte from split objects, and swap in two small compiled C runtime routines. Both replacements are behavior-tested but nonmatching and every other byte stays original; one recorded input movie drives the original and hybrid builds to the same bedroom movement in the Azahar emulator. Retail compiler identity, exact matching, module loading and broader gameplay remain open.","description_zh":"作者使用固定版本的 REA 与 Ghidra，分析使用者自备的《宝可梦 究极之日》基础版可执行文件，由拆分出的对象逐字节重建该文件，并替换进两个编译后的小型 C 运行时例程。两处替换均经行为测试但与原字节不一致，其余字节均保持原样；同一段录制输入在 Azahar 模拟器中让原版与混合构建到达相同的卧室移动场景。零售编译器识别、精确匹配、模块加载及更广泛的游戏行为仍待解决。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["game"],"verified_at":"2026-10-18"},{"id":"reversed-with-ai-directory","name":"Reversed with AI","name_zh":"Reversed with AI：AI 辅助逆向项目目录","url":"https://reversedwithai.com/","evidence_url":"https://reversedwithai.com/about","description_en":"A moderated website directory of AI-assisted reverse-engineering projects across games, firmware, file formats, APIs and protocols, apps and legacy software. Each entry links to its primary source and records the author-reported model, tools, time, cost and outcome, with four checks for public source, reproduction steps, real-hardware testing and third-party confirmation.","description_zh":"经人工审核的网站目录，收录游戏、固件、文件格式、API 与协议、应用及旧软件领域的 AI 辅助逆向项目。每个条目链接一手来源，记录作者报告的模型、工具、耗时、费用与结果，并标注源码公开、复现步骤、真实硬件测试和第三方确认四项检查。","kind":"collection","category":"related-lists","group":"learn","relationship":"community-learning-resource","targets":["app","binary","firmware","game","protocol"],"verified_at":"2026-10-18"},{"id":"hermes-rea-plugin","name":"REA plugin for Hermes Agent","name_zh":"Hermes Agent 的 REA 插件","url":"https://github.com/NousResearch/hermes-official-plugins/tree/main/rea","evidence_url":"https://github.com/NousResearch/hermes-official-plugins/blob/6dacaaddbfd8e98dfc524096c44f712f743246b8/rea/README.md","description_en":"Nous Research’s Hermes Agent plugin package for REA. One catalog install registers REA’s MCP server, pinned to rea-agents 6.4.0 and launched through npx over stdio, with REA’s workflow skill adapted for Hermes and a separate crash-triage skill. About 170 REA tools stay behind Hermes’ on-demand tool search, and the adapted skill asks before tools that run programs, drive apps or change a connected Android device.","description_zh":"Nous Research 在 Hermes Agent 官方插件库中发布的 REA 插件包。一次目录安装即可注册 REA 的 MCP 服务（固定为 rea-agents 6.4.0，经 npx 以 stdio 启动），并附带为 Hermes 改编的 REA 工作流技能和独立的崩溃分诊技能。约 170 个 REA 工具通过 Hermes 的按需工具检索提供；改编技能要求在运行程序、驱动应用或改动已连接 Android 设备的工具前先征得同意。","kind":"integration","category":"community-integrations","group":"rea","relationship":"community-integration","targets":["app","binary","firmware","website"],"verified_at":"2026-10-18"},{"id":"crashlens-rea-crash-triage","name":"crashlens","name_zh":"crashlens 崩溃分诊工具","url":"https://github.com/mingleiw/crashlens","evidence_url":"https://github.com/mingleiw/crashlens/blob/7188611a506e058a8f4937acf3dfd3035545f2d1/README.md","description_en":"A crash-triage tool that turns Linux core dumps, runtime panics, exception traces and sanitizer reports into Markdown bug reports naming the crash type, the first frame in the user’s code and a stable signature. Its core-dump path calls the REA CLI to read the recorded crash and the binary layout, and can ask REA’s Ghidra provider for pseudocode of stripped functions; a Claude Code plugin bundles a skill and read-only MCP tools. It is a debugging integration around REA, not a reconstruction case, and its diagnostic accuracy remains author-reported.","description_zh":"崩溃分诊工具，将 Linux 核心转储、运行时 panic、异常堆栈和 sanitizer 报告整理为 Markdown 缺陷报告，指出崩溃类型、首个用户代码帧和稳定签名。核心转储分析通过 REA 命令行读取崩溃记录与二进制布局，并可调用 REA 的 Ghidra 引擎为无符号函数生成伪代码；附带的 Claude Code 插件包含技能与只读 MCP 工具。它是围绕 REA 的调试集成，不是重建案例，诊断准确性仍为作者报告。","kind":"integration","category":"community-integrations","group":"rea","relationship":"community-integration","targets":["binary"],"verified_at":"2026-10-18"},{"id":"rea-dino-runner-community-case","name":"Dinosaur runner: an REA-inspected speed rule rebuilt with Codex","name_zh":"恐龙跑酷：经 REA 检查、由 Codex 重建的速度规则","url":"https://github.com/zhxunzh84/rea-dino-reverse-engineering","evidence_url":"https://github.com/zhxunzh84/rea-dino-reverse-engineering/blob/1fa0ae9faae97d65754f2abf89d3e8326aea9525/README.md","description_en":"The author uses REA’s MCP browser tools to passively capture the JavaScript loaded by wayou’s open-source T-Rex Runner page, then has Codex rebuild its acceleration rule in one self-contained HTML5 Canvas game. The report identifies the captured script by SHA-256 and separates verified source facts from reconstruction choices; only the speed rule is claimed, not full gameplay equivalence.","description_zh":"作者使用 REA 的 MCP 浏览器工具被动捕获 wayou 开源 T-Rex Runner 页面已加载的 JavaScript，再由 Codex 在一个自包含的 HTML5 Canvas 游戏中重建其加速规则。报告以 SHA-256 标识所捕获的脚本，并区分已核实的源码事实与重建选择；只主张速度规则一致，不主张完整玩法等价。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["game","website"],"verified_at":"2026-10-18"},{"id":"screen-studio-auto-zoom-case","name":"Screen Studio: an author-reported REA study of auto-zoom rules","name_zh":"Screen Studio：作者报告的 REA 自动缩放规则研究","url":"https://x.com/i/article/2109834677343432704","evidence_url":"https://x.com/i/article/2109834677343432704","description_en":"The author reports using REA to map Screen Studio’s Electron package, reading six auto-zoom and cursor rules from its obfuscated code with Claude Code’s help, and having Claude Code write an independent recorder and renderer from those rules. The article describes the commands, evidence, a cursor-alignment check and the clone’s gaps; neither the clone nor the decoded code is published.","description_zh":"作者报告借助 REA 梳理 Screen Studio 的 Electron 安装包，在 Claude Code 协助下从混淆代码中读出六条自动缩放与光标规则，再让 Claude Code 依据这些规则编写独立的录屏和渲染程序。文章介绍了所用命令、证据、光标对齐检查以及复刻版的不足；复刻版和解出的代码均未公开。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app"],"verified_at":"2026-10-18"},{"id":"claude-code-background-lab-case","name":"Claude Code background lab: an REA-informed reimplementation of a desktop animation","name_zh":"Claude Code 背景动画实验室：基于 REA 调查的桌面动画重新实现","url":"https://github.com/Henry-fan88/claude-code-background","evidence_url":"https://github.com/Henry-fan88/claude-code-background/blob/3dbd1065835508be6027137927deeddb8c30fe55/docs/PROVENANCE.md","description_en":"Reimplements the glyph-wind background of the Claude desktop app’s Claude Code New session view as an offline WebGL2 page with a 38-slider control panel. The author reports a static REA investigation of the desktop shell and its remote web bundle, followed by a newly written renderer that reuses recovered timing and layout values. It shares the original’s visual vocabulary and interaction model but is not a pixel-identical extraction.","description_zh":"将 Claude 桌面应用中 Claude Code“新会话”界面的字符风场背景，重新实现为可离线运行的 WebGL2 页面，并附带 38 个滑块的控制面板。作者报告先用 REA 对桌面外壳及其远程网页包进行静态调查，再以新编写的渲染器复用恢复出的时序与布局参数。它与原效果的视觉语言和交互方式相近，但不是逐像素一致的提取。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app"],"verified_at":"2026-10-18"},{"id":"dx-ball-rea-reconstruction-case","name":"DX-Ball: an REA-guided function-level reconstruction with Codex","name_zh":"DX-Ball：借助 REA 并由 Codex 完成的函数级重建","url":"https://github.com/N0zoM1z0/dx-ball","evidence_url":"https://github.com/N0zoM1z0/dx-ball/blob/d1251ea4bd000c7204c895c029194cae1d269731/README.md","description_en":"The author has Codex use REA’s Ghidra tools to inspect the English DX-Ball 1.07 executable and recover it as typed C/C++, then compiles each function with the original-era Visual C++ 4.0 and compares it byte for byte with the original after mapping relocations. The same source also builds a MinGW Windows game and a portable core library. Exact reconstruction is still in progress; REA’s separate sound-pan showcase covers just one function.","description_zh":"作者让 Codex 通过 REA 的 Ghidra 工具检查英文版 DX-Ball 1.07 可执行文件并恢复为带类型的 C/C++，再用同时代的 Visual C++ 4.0 编译每个函数，在映射重定位后与原文件逐字节比较。同一套源码还可构建 MinGW Windows 游戏和可移植核心库。精确重建仍在进行中；REA 另行发布的声像展示只覆盖其中一个函数。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"re2ds-nds-engine-case","name":"re2ds: a native Nintendo DS engine for Resident Evil 2","name_zh":"re2ds：Resident Evil 2 的原生 Nintendo DS 引擎","url":"https://github.com/eray1605/re2ds","evidence_url":"https://github.com/eray1605/re2ds/blob/f1e120ec50f6b072d7283a2d3dd35611d656c9b7/README.md","description_en":"Reimplements Resident Evil 2’s PS1 game rules in a native Nintendo DS engine, with converters that turn data from the user’s own disc into DS formats. A helper wraps the PS1 executable as an ELF for REA’s Ghidra lane, analysis notes name the PS1 functions and tables each part follows, and the Reddit post linking it credits REA and Claude Code. Leon’s disc 1 is reported playable, while Claire’s disc, most enemy types and some menus remain unfinished.","description_zh":"在原生 Nintendo DS 引擎中重新实现 Resident Evil 2 PS1 版的游戏规则，并用转换工具把使用者自有光盘中的数据转为 DS 格式。辅助脚本把 PS1 可执行文件包装成 ELF，供 REA 的 Ghidra 通道分析；分析笔记注明各部分所依据的 PS1 函数与数据表，链接该项目的 Reddit 帖称其借助 REA 和 Claude Code 完成。据报告 Leon 第一张光盘已可游玩，Claire 光盘、多数敌人类型和部分菜单仍未完成。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["game"],"verified_at":"2026-10-18"},{"id":"rea-workspace-template","name":"REA Workspace Template","name_zh":"REA 工作区模板","url":"https://github.com/dobest1024/rea-workspace-template","evidence_url":"https://github.com/dobest1024/rea-workspace-template/blob/fc15b9a4ba2a8b40510d19a2dd80209f665711c5/README.md","description_en":"A clone-first Chinese workspace template for analyzing one target per workspace with REA from Claude Code or Codex. It ships project-level REA MCP settings, agent rules that require CONFIRMED/GUESS labels with evidence locations, seven task prompts and standard-library scripts that hash imported originals, stage writable copies and strip values from HAR captures. It organizes analysis rather than performing it, and its acceptance run used only synthetic samples.","description_zh":"一个可直接克隆的中文工作区模板，用于在 Claude Code 或 Codex 中借助 REA，按“一个目标一个工作区”开展分析。它提供项目级 REA MCP 配置、要求结论标注 CONFIRMED／GUESS 并附证据位置的智能体规则、七套任务提示词，以及仅依赖标准库的脚本：为导入的原件生成哈希基线、创建可写分析副本，并去除 HAR 抓包中的取值。它负责组织分析而非完成分析，其验收只使用了合成样本。","kind":"integration","category":"community-integrations","group":"rea","relationship":"community-integration","targets":["app","binary","website"],"verified_at":"2026-10-19"},{"id":"rea-reconstruction-companion","name":"REA Reconstruction Companion","name_zh":"REA Reconstruction Companion 重建配套技能","url":"https://github.com/ShadowSwaps/REA-Reconstruction-Companion","evidence_url":"https://github.com/ShadowSwaps/REA-Reconstruction-Companion/blob/9daa5c8b3b8871fd643df636413f7d9e74520669/README.md","description_en":"A third-party Agent Skill that works alongside REA’s own skill to turn reverse-engineering evidence into scoped requirements, design, staged implementation and validation, from one feature or format to a whole app. An optional installer can add a marked routing block to the user’s REA SKILL.md so that relevant reconstruction requests load both skills. Its bundled evaluation kit consists of source-exposed, maintainer-authored examples with literal oracles, not a model benchmark.","description_zh":"第三方 Agent Skill，与 REA 自身的技能配合使用，把逆向分析证据整理成限定范围的需求、设计、分阶段实现与验证，范围可从单个功能或格式扩展到整个应用。可选安装程序能在用户的 REA SKILL.md 中加入带标记的路由段落，使相关重建请求同时加载两个技能。附带的评估套件由维护者编写、已接触源码的示例及字面预期值组成，并非模型基准。","kind":"integration","category":"community-integrations","group":"rea","relationship":"community-integration","targets":["app","binary"],"verified_at":"2026-10-18"},{"id":"noflag-rea-evidence-architecture-study","name":"Show Your Work: a measured dissection of REA's evidence architecture","name_zh":"Show Your Work：对 REA 证据架构的实测剖析","url":"https://no-flag.com/2026/10/18/REA-paper/","evidence_url":"https://no-flag.com/2026/10/18/REA-paper/","description_en":"An unofficial field study that reads REA's source and then drives the running server through 1,012 recorded calls across 27 artifact classes, measuring its content-addressed Evidence records, revision-chained unknown ledger, typed refusals, cold starts and response limits. The author maps those mechanisms onto vulnerability-research agents as an argument for not overclaiming. It evaluates REA's tool surface; it is not a reconstruction or a vulnerability finding.","description_zh":"一篇非官方的实测研究：先阅读 REA 源码，再在 27 类分析对象上对运行中的服务器发出 1,012 次有记录的调用，测量其按内容寻址的 Evidence 记录、按修订串联的未知项台账、带类型的拒绝、冷启动及响应上限。作者把这些机制对应到漏洞研究智能体上，论证为何不应过度声称结论。它评估的是 REA 的工具接口，而非重建案例或漏洞发现。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["binary"],"verified_at":"2026-10-18"},{"id":"rea-notes-csv-oracle-mutation-case","name":"Notes CSV export: an author-reported REA check of reconstruction oracles","name_zh":"Notes CSV 导出：作者报告的 REA 重建验收器检查","url":"https://x.com/i/article/2110962506604929025","evidence_url":"https://x.com/i/article/2110962506604929025","description_en":"A Chinese article breaks three versions of a Python CSV exporter that reproduces the Notes teaching app shipped with REA. It shows that a simple export-and-read-back test passes all three, while byte comparisons against the official JavaScript formatter on 215 fixed inputs catch each one. The author also connects REA 6.5.0 over MCP, reruns its JavaScript analysis and checks that an edited evidence record is rejected on import; this is a study of acceptance checks, not a new reconstruction.","description_zh":"一篇中文文章把复刻 REA 自带 Notes 教学应用的 Python CSV 导出器故意改坏三个版本，展示简单的“导出再读回”测试能让三者全部通过，而以官方 JavaScript 格式化函数为参照、在 215 组固定输入上逐字节比较则能逐一识破。作者还通过 MCP 连接 REA 6.5.0，重新运行其 JavaScript 分析，并验证被改动的证据记录在导入时会被拒绝；这是对验收检查的研究，而非新的重建。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["app"],"verified_at":"2026-10-18"},{"id":"windows-loader-static-analysis-case","name":"Windows loader: static malware analysis with REA and Codex","name_zh":"Windows 加载器：借助 REA 与 Codex 的静态恶意软件分析","url":"https://codegeeksai.github.io/en/blog/static-malware-analysis-rea-codex/","evidence_url":"https://codegeeksai.github.io/en/blog/static-malware-analysis-rea-codex/","description_en":"Fedele Mantuano reports using Codex with REA in an offline Docker lab to statically analyze a public Windows malware sample without executing it. The article separates behavior supported by the extracted JavaScript bundle from claims that would depend on remote components that were never obtained, and reclassifies a suspected infostealer as a loader. It is a defensive analysis case built on an author-reviewed agent report, not a reconstruction or a dynamic detonation.","description_zh":"Fedele Mantuano 报告在离线 Docker 实验环境中让 Codex 借助 REA，对一个公开的 Windows 恶意软件样本做静态分析，全程不执行样本。文章区分了提取出的 JavaScript 代码包能够支持的行为与依赖从未获取的远程组件的推断，并将原本疑为信息窃取程序的样本重新归类为加载器。这是以作者审阅过的智能体报告为基础的防御性分析案例，不是重建，也不是动态引爆分析。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["binary"],"verified_at":"2026-10-18"},{"id":"horizon-minecraft-rust-rewrite-case","name":"Horizon: a Rust rewrite of Minecraft: Java Edition 26.3 with REA bytecode queries","name_zh":"Horizon：借助 REA 字节码查询的 Minecraft: Java Edition 26.3 Rust 重写","url":"https://github.com/ludovic111/horizon","evidence_url":"https://github.com/ludovic111/horizon/blob/d500f28ee4939d83d9796931b7079632b72dc948/README.md","description_en":"Rewrites Minecraft: Java Edition 26.3 as a native Rust client, dedicated server and launcher that prepare their resources from the user’s own copy of the game. Contributors are told to read the vanilla code first, and tools/rea_vanilla.py runs a pinned REA release with a headless JADX engine over the shipped client and server jars to inspect classes, methods and callers. Differential harnesses run Java oracles against the real game and Rust probes against Horizon; README reports all 281 passing, which covers only what they compare.","description_zh":"以原生 Rust 客户端、专用服务器和启动器重写 Minecraft: Java Edition 26.3，资源均由使用者自有的游戏副本生成。项目要求贡献者先阅读原版代码，tools/rea_vanilla.py 会调用固定版本的 REA，配合无界面 JADX 引擎分析官方发布的客户端与服务器 jar，查询类、方法及调用方。差分测试工具分别对真实游戏运行 Java 对照程序、对 Horizon 运行 Rust 探针；README 称全部 281 个测试通过，但这只涵盖它们所比较的内容。","kind":"case-study","category":"community-case-studies","group":"rea","relationship":"community-reported-mixed-workflow","targets":["game"],"verified_at":"2026-10-19"},{"id":"hex-rays-ida-mcp","name":"Hex-Rays IDA MCP","name_zh":"Hex-Rays IDA MCP","url":"https://github.com/HexRaysSA/ida-mcp","evidence_url":"https://github.com/HexRaysSA/ida-mcp/blob/a03842843d6972eb8780f5b3d2f4e8b6d0c9589e/README.md","description_en":"Official Hex-Rays MCP server for agent access to IDA databases, with headless operation and optional GUI integration.","description_zh":"Hex-Rays 官方 MCP 服务，让智能体操作 IDA 数据库，支持无界面分析和可选 GUI 联动。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-15"},{"id":"ghidramcp","name":"GhidraMCP","name_zh":"GhidraMCP","url":"https://github.com/LaurieWired/GhidraMCP","evidence_url":"https://github.com/LaurieWired/GhidraMCP/blob/1e980252087b2479a21b9ca6d82d5829538651a7/README.md","description_en":"Ghidra extension and MCP bridge exposing decompilation, symbol navigation and renaming to agents, with GUI and headless modes.","description_zh":"通过 Ghidra 扩展和 MCP 桥接提供反编译、符号导航与重命名，支持 GUI 和无界面运行。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-17"},{"id":"binary-ninja-official-mcp","name":"Binary Ninja MCP (official)","name_zh":"Binary Ninja MCP（官方）","url":"https://docs.binary.ninja/guide/mcp.html","evidence_url":"https://docs.binary.ninja/guide/mcp.html","description_en":"Binary Ninja's own MCP interface exposes functions, symbols, disassembly, intermediate languages and decompiled text to agents.","description_zh":"Binary Ninja 自带的 MCP 接口向智能体提供函数、符号、反汇编、中间语言和反编译文本。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-17"},{"id":"binary-ninja-community-mcp","name":"Binary Ninja MCP (fosdickio)","name_zh":"Binary Ninja MCP（fosdickio）","url":"https://github.com/fosdickio/binary_ninja_mcp","evidence_url":"https://github.com/fosdickio/binary_ninja_mcp/blob/eaf8a980050bee123f1be30334e74b15d21c009c/README.md","description_en":"Community Binary Ninja plugin and bridge for MCP clients, including workflows that switch among multiple open binaries.","description_zh":"社区维护的 Binary Ninja 插件与 MCP 桥接，支持在多个已打开的二进制目标间切换。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-15"},{"id":"ida-pro-mcp-community","name":"IDA Pro MCP (mrexodia)","name_zh":"IDA Pro MCP（mrexodia）","url":"https://github.com/mrexodia/ida-pro-mcp","evidence_url":"https://github.com/mrexodia/ida-pro-mcp/blob/c133c3853faa111a9b00ee615c013b720d0c4acd/README.md","description_en":"Community IDA integration useful for existing setups and migration context; its maintainer now recommends the official Hex-Rays MCP server.","description_zh":"已有工作流可参考的社区 IDA 集成；维护者目前推荐迁移到 Hex-Rays 官方 MCP 服务。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-17"},{"id":"radare2-mcp","name":"Radare2 MCP Server","name_zh":"Radare2 MCP Server","url":"https://github.com/radareorg/radare2-mcp","evidence_url":"https://github.com/radareorg/radare2-mcp/blob/562c0cf23c42b65b3052f0b294d8778c20facbde/README.md","description_en":"Native radare2 MCP server offering binary-analysis tools, reusable sessions and configurable read-only access.","description_zh":"基于 radare2 原生接口的 MCP 服务，提供二进制分析、会话复用和可配置的只读访问。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-17"},{"id":"r2ai","name":"r2ai","name_zh":"r2ai","url":"https://github.com/radareorg/r2ai","evidence_url":"https://github.com/radareorg/r2ai/blob/312921c2a1a39cc6934160f416baecf1330d679e/README.md","description_en":"AI plugins inside radare2 for function explanations, naming suggestions and model-assisted decompilation using local or remote models.","description_zh":"在 radare2 内使用本地或远程模型，辅助解释函数、改善命名和反编译结果。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-15"},{"id":"daila","name":"DAILA","name_zh":"DAILA","url":"https://github.com/mahaloz/DAILA","evidence_url":"https://github.com/mahaloz/DAILA/blob/af4d6491a327af85f9e0aae0ffa7b7a5acbbbfb8/README.md","description_en":"Decompiler-independent AI assistant for function summaries and naming across IDA, Ghidra, Binary Ninja and angr-management.","description_zh":"跨 IDA、Ghidra、Binary Ninja 与 angr-management 的 AI 助手，用于函数摘要和命名辅助。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-15"},{"id":"revengai-ghidra","name":"RevEng.AI Ghidra Plugin","name_zh":"RevEng.AI Ghidra 插件","url":"https://github.com/RevEngAI/plugin-ghidra","evidence_url":"https://github.com/RevEngAI/plugin-ghidra/blob/7d386f772530905222c8aa9276de06995b289930/README.md","description_en":"Connects Ghidra to RevEng.AI for function similarity, recovered names, AI explanations and agent-assisted annotation.","description_zh":"将 Ghidra 接入 RevEng.AI，用于函数相似性匹配、名称恢复、AI 解释及辅助标注。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-17"},{"id":"jadx-ai-mcp","name":"JADX-AI-MCP","name_zh":"JADX-AI-MCP","url":"https://github.com/zinja-coder/jadx-ai-mcp","evidence_url":"https://github.com/zinja-coder/jadx-ai-mcp/blob/ce64f2261b1d17083210ec87bf52f738c50dc48d/README.md","description_en":"JADX plugin paired with a Python MCP server to inspect decompiled Android classes, resources, cross-references and debugger context.","description_zh":"结合 JADX 插件与 Python MCP 服务，读取 Android 反编译代码、资源、交叉引用和调试上下文。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["app"],"verified_at":"2026-10-15"},{"id":"apktool-mcp-server","name":"apktool-mcp-server","name_zh":"apktool-mcp-server Apktool MCP 服务","url":"https://github.com/zinja-coder/apktool-mcp-server","evidence_url":"https://github.com/zinja-coder/apktool-mcp-server/blob/12bb33134af905923a0a58643dcc35fd694ad6f6/README.md","description_en":"Python MCP server that drives a local Apktool install so agents can decode APKs; list, read, search and edit smali and resource files; read AndroidManifest.xml and apktool.yml; and rebuild the project.","description_zh":"基于 Python 的 MCP 服务，调用本地安装的 Apktool，使智能体能够解码 APK，列出、读取、搜索和修改 smali 与资源文件，读取 AndroidManifest.xml 与 apktool.yml，并重新构建项目。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["app"],"verified_at":"2026-10-17"},{"id":"frida-mcp-yfe404","name":"frida-mcp (yfe404)","name_zh":"frida-mcp (yfe404)","url":"https://github.com/yfe404/frida-mcp","evidence_url":"https://github.com/yfe404/frida-mcp/blob/fb7d6c7c74bd249dbc86b8a3c14df79d9486b114/README.md","description_en":"Frida MCP server with persistent instrumentation sessions, runtime inspection and Android static-to-dynamic navigation.","description_zh":"Frida MCP 服务，提供持久插桩会话、运行时检查和 Android 静态代码与动态现场之间的导航。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["app","game"],"verified_at":"2026-10-17"},{"id":"super-trouper","name":"Super Trouper","name_zh":"Super Trouper","url":"https://github.com/crissyfield/super-trouper","evidence_url":"https://github.com/crissyfield/super-trouper/blob/b3d31adbdb4be2f1a456dc9108ef25655ea206fe/README.md","description_en":"Single-binary Frida MCP server for discovering devices, managing process sessions and loading instrumentation scripts.","description_zh":"单个可执行文件形式的 Frida MCP 服务，用于发现设备、管理进程会话和加载插桩脚本。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["app","game"],"verified_at":"2026-10-17"},{"id":"lldb-mcp","name":"LLDB MCP","name_zh":"LLDB MCP","url":"https://lldb.llvm.org/use/mcp.html","evidence_url":"https://lldb.llvm.org/use/mcp.html","description_en":"LLDB's official MCP interface gives agents debugger sessions and commands for breakpoints, memory inspection and stepping.","description_zh":"LLDB 官方 MCP 接口提供调试会话与命令，使智能体可以设置断点、检查内存和单步执行。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["app","binary"],"verified_at":"2026-10-17"},{"id":"claude-reverse-engineering-skill","name":"Claude Reverse Engineering Skill","name_zh":"Claude 逆向工程技能","url":"https://github.com/EncidXVII/claude-reverse-engineering-skill","evidence_url":"https://github.com/EncidXVII/claude-reverse-engineering-skill/blob/bf4605e92b06511d9d0e2e958ecd00e1f6856c3a/README.md","description_en":"Community agent skill for triage, headless exports and evidence-based RE reports; explicitly documents workflows with REA and other MCP servers.","description_zh":"社区智能体技能，覆盖分诊、无界面导出和证据报告，并明确说明 REA 及其他 MCP 服务的工作流。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["app","binary"],"verified_at":"2026-10-15"},{"id":"specterops-re-skills","name":"SpecterOps Reverse Engineering Skills","name_zh":"SpecterOps 逆向工程技能","url":"https://github.com/SpecterOps/skills/tree/main/plugins/reverse-engineering","evidence_url":"https://github.com/SpecterOps/skills/blob/a78853eaeaed9fb40aba52a0e52ab43785515318/plugins/reverse-engineering/README.md","description_en":"Focused Binary Ninja and Ghidra analysis skills that describe MCP tool use, analysis recipes and annotation practices.","description_zh":"针对 Binary Ninja 与 Ghidra 的分析技能，提供 MCP 工具使用、分析步骤和标注方法。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-15"},{"id":"ghidra","name":"Ghidra","name_zh":"Ghidra","url":"https://github.com/NationalSecurityAgency/ghidra","evidence_url":"https://github.com/NationalSecurityAgency/ghidra/blob/864999d7ca67cd3f533be600860f102e54370661/README.md","description_en":"Open-source analysis suite for disassembly, decompilation, graphs and Java/Python automation across executable formats.","description_zh":"开源二进制分析套件，提供反汇编、反编译、图形分析及 Java/Python 自动化接口。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","firmware","game"],"verified_at":"2026-10-15"},{"id":"radare2","name":"radare2","name_zh":"radare2","url":"https://github.com/radareorg/radare2","evidence_url":"https://github.com/radareorg/radare2/blob/6ac96f50eafef46c1ac75a478a1460819968c66f/README.md","description_en":"Scriptable command-line framework for inspecting, disassembling, debugging and modifying binaries across many architectures.","description_zh":"可脚本化的命令行逆向框架，支持多架构二进制检查、反汇编、调试和修改。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-15"},{"id":"cutter","name":"Cutter","name_zh":"Cutter","url":"https://github.com/rizinorg/cutter","evidence_url":"https://github.com/rizinorg/cutter/blob/734acd17061a4527d9a89668537e3bc64a475e54/README.md","description_en":"Rizin-powered graphical reverse-engineering workspace with extensible views and Ghidra decompiler integration.","description_zh":"基于 Rizin 的图形逆向工作台，提供可扩展视图及 Ghidra 反编译器集成。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-15"},{"id":"frida","name":"Frida","name_zh":"Frida","url":"https://github.com/frida/frida","evidence_url":"https://github.com/frida/frida/blob/e598d053f4154fa78a26bb60d4f6cbc407ea387c/README.md","description_en":"Dynamic instrumentation toolkit for observing and scripting the behavior of live native and managed processes.","description_zh":"动态插桩工具，用脚本观察和分析运行中的原生及托管进程行为。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app","game"],"verified_at":"2026-10-15"},{"id":"jadx","name":"JADX","name_zh":"JADX","url":"https://github.com/skylot/jadx","evidence_url":"https://github.com/skylot/jadx/blob/c4c45fde27b4f3386dc2ff016ff187229a60a716/README.md","description_en":"Dex-to-Java decompiler with CLI/GUI navigation, resource decoding and cross-reference search for Android packages.","description_zh":"将 Dex 反编译为 Java 的 CLI/GUI 工具，提供 Android 资源解码、代码导航和引用搜索。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-17"},{"id":"apktool","name":"Apktool","name_zh":"Apktool","url":"https://github.com/iBotPeaches/Apktool","evidence_url":"https://github.com/iBotPeaches/Apktool/blob/0312d212c713c9ebc568b7d9295eec0f47858bfa/README.md","description_en":"Decodes Android resources and smali into a project-like tree and can rebuild modified packages.","description_zh":"将 Android 资源与 smali 解码为项目目录，并支持重新构建修改后的安装包。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-15"},{"id":"androguard","name":"Androguard","name_zh":"Androguard","url":"https://github.com/androguard/androguard","evidence_url":"https://github.com/androguard/androguard/blob/90e7b42940a8f73228368e761bb20227d3d9249a/README.md","description_en":"Python toolkit for APK/DEX metadata, bytecode and reference analysis; the v5 source branch also documents agent skills and MCP.","description_zh":"用于 APK/DEX 元数据、字节码及引用分析的 Python 工具集；v5 源码分支还提供智能体技能和 MCP 文档。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-15"},{"id":"ilspy","name":"ILSpy","name_zh":"ILSpy","url":"https://github.com/icsharpcode/ILSpy","evidence_url":"https://github.com/icsharpcode/ILSpy/blob/729b5dc4d12b8bc08c2a0b1294bbb161098a6211/README.md","description_en":".NET assembly browser and C# decompiler with whole-project export, metadata inspection and a scriptable command-line frontend.","description_zh":".NET 程序集浏览器与 C# 反编译器，支持完整项目导出、元数据检查和命令行处理。","kind":"tool","category":"dotnet","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-15"},{"id":"dnspyex","name":"dnSpyEx","name_zh":"dnSpyEx","url":"https://github.com/dnSpyEx/dnSpy","evidence_url":"https://github.com/dnSpyEx/dnSpy/blob/de5a83051161e0becc70f32834c2596db6239fbd/README.md","description_en":"Community continuation of dnSpy for debugging and editing .NET assemblies without the original source.","description_zh":"dnSpy 的社区延续项目，可在没有原始源码时调试和编辑 .NET 程序集。","kind":"tool","category":"dotnet","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-15"},{"id":"electron-asar","name":"@electron/asar","name_zh":"@electron/asar","url":"https://github.com/electron/asar","evidence_url":"https://github.com/electron/asar/blob/01bc908255640c544ac68ea2fe14926a7b80da37/README.md","description_en":"Electron's archive tool lists and extracts ASAR contents so packaged JavaScript and application assets can be inspected.","description_zh":"Electron 官方归档工具，可列出和提取 ASAR 内容，便于检查打包后的 JavaScript 与应用资源。","kind":"tool","category":"javascript-electron","group":"tools","relationship":"foundation","targets":["app","website"],"verified_at":"2026-10-15"},{"id":"webcrack","name":"webcrack","name_zh":"webcrack","url":"https://github.com/j4k0xb/webcrack","evidence_url":"https://github.com/j4k0xb/webcrack/blob/0d83a6f2b04e86fa2e87ee4cb6853848cc719308/README.md","description_en":"Improves JavaScript readability by reversing supported obfuscation patterns and unpacking webpack/Browserify bundles.","description_zh":"识别支持的 JavaScript 混淆模式，并拆解 webpack/Browserify 打包文件，改善代码可读性。","kind":"tool","category":"javascript-electron","group":"tools","relationship":"foundation","targets":["app","website"],"verified_at":"2026-10-15"},{"id":"humanify","name":"humanify","name_zh":"humanify JavaScript 标识符重命名工具","url":"https://github.com/jehna/humanify","evidence_url":"https://github.com/jehna/humanify/blob/65b90bc4743b23317f13d01894776643dbde7fdb/README.md","description_en":"Rename identifiers in minified JavaScript with LLM-suggested names, applied through scope-aware AST rewriting so the program structure stays unchanged. The new names are model suggestions, not recovered original identifiers.","description_zh":"借助 LLM 为压缩后的 JavaScript 标识符建议名称，并通过遵循作用域的 AST 改写完成重命名，程序结构保持不变。新名称是模型给出的推测，并非恢复出的原始标识符。","kind":"tool","category":"javascript-electron","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-17"},{"id":"wabt","name":"WABT","name_zh":"WABT","url":"https://github.com/WebAssembly/wabt","evidence_url":"https://github.com/WebAssembly/wabt/blob/806787e92904571c4628065277344f42c55ece05/README.md","description_en":"WebAssembly tools for binary-to-text conversion, section inspection, validation, interpretation and C translation.","description_zh":"WebAssembly 二进制与文本转换、节区检查、验证、解释执行及 C 转换工具集。","kind":"tool","category":"webassembly","group":"tools","relationship":"foundation","targets":["binary","website"],"verified_at":"2026-10-15"},{"id":"wasm-tools","name":"wasm-tools","name_zh":"wasm-tools","url":"https://github.com/bytecodealliance/wasm-tools","evidence_url":"https://github.com/bytecodealliance/wasm-tools/blob/a56e8d3d2a0b754e0465c668f8e4b68bad97590f/README.md","description_en":"Bytecode Alliance CLI and Rust libraries for inspecting WebAssembly modules, metadata, components and WIT interfaces.","description_zh":"Bytecode Alliance 提供的 CLI 与 Rust 库，用于检查 WebAssembly 模块、元数据、组件和 WIT 接口。","kind":"tool","category":"webassembly","group":"tools","relationship":"foundation","targets":["binary","website"],"verified_at":"2026-10-15"},{"id":"binwalk","name":"Binwalk","name_zh":"Binwalk","url":"https://github.com/ReFirmLabs/binwalk","evidence_url":"https://github.com/ReFirmLabs/binwalk/blob/e0a4434159f22ff926c1baa3872d93a5f8dbf87e/README.md","description_en":"Identifies embedded formats and optionally extracts their contents, with entropy analysis for firmware triage.","description_zh":"识别固件中的嵌入格式并按需提取内容，辅以熵分析帮助初步分诊。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-15"},{"id":"unblob","name":"unblob","name_zh":"unblob","url":"https://github.com/onekey-sec/unblob","evidence_url":"https://github.com/onekey-sec/unblob/blob/3b470cd1c33e10a3ae977a6caaab5dbcbf2d5ce8/README.md","description_en":"Recursively extracts archives and filesystems from binary blobs while reporting chunk boundaries and unknown regions.","description_zh":"递归提取二进制数据中的归档与文件系统，同时报告数据块边界和未识别区域。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-15"},{"id":"ghidra-firmware-utils","name":"Ghidra Firmware Utilities","name_zh":"Ghidra 固件工具集","url":"https://github.com/al3xtjames/ghidra-firmware-utils","evidence_url":"https://github.com/al3xtjames/ghidra-firmware-utils/blob/f54438b90a0effc0a89ef7c0ea3053e5086f422f/README.md","description_en":"Ghidra loaders and helpers for PCI option ROMs, UEFI firmware volumes, Intel flash descriptors and coreboot images.","description_zh":"面向 PCI Option ROM、UEFI 固件卷、Intel Flash Descriptor 和 coreboot 镜像的 Ghidra 加载器与辅助脚本。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-15"},{"id":"qiling","name":"Qiling","name_zh":"Qiling","url":"https://github.com/qilingframework/qiling","evidence_url":"https://github.com/qilingframework/qiling/blob/206b90fd891cee4bc0056d2198ddf85678b55f96/README.md","description_en":"Python emulation framework that adds OS, filesystem and API behavior around CPU emulation for instrumented binary analysis.","description_zh":"在 CPU 仿真之上补充操作系统、文件系统和 API 行为的 Python 框架，用于可插桩的二进制分析。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-15"},{"id":"unicorn","name":"Unicorn Engine","name_zh":"Unicorn Engine","url":"https://github.com/unicorn-engine/unicorn","evidence_url":"https://github.com/unicorn-engine/unicorn/blob/c24c9ebe773ce6fbecb0e39f68ffb23b7326b17f/README.md","description_en":"Multi-architecture CPU emulator for executing selected instruction ranges with register, memory and hook control.","description_zh":"多架构 CPU 仿真引擎，可控制寄存器、内存和钩子，执行选定的指令片段。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary","firmware","game"],"verified_at":"2026-10-15"},{"id":"angr","name":"angr","name_zh":"angr","url":"https://github.com/angr/angr","evidence_url":"https://github.com/angr/angr/blob/ae9f5786fd94410ca400063bf21719aa8b564d3e/README.md","description_en":"Python binary-analysis framework combining control-flow recovery, symbolic execution, data-flow analysis and decompilation.","description_zh":"结合控制流恢复、符号执行、数据流分析和反编译的 Python 二进制分析框架。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-17"},{"id":"lief","name":"LIEF","name_zh":"LIEF","url":"https://github.com/lief-project/LIEF","evidence_url":"https://github.com/lief-project/LIEF/blob/b68429c52d5f704e34445e92890fd801937f10e3/README.md","description_en":"Library for structured parsing and modification of executable formats including ELF, PE and Mach-O.","description_zh":"对 ELF、PE、Mach-O 等可执行文件格式进行结构化解析与修改的库。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-15"},{"id":"capstone","name":"Capstone","name_zh":"Capstone","url":"https://github.com/capstone-engine/capstone","evidence_url":"https://github.com/capstone-engine/capstone/blob/d7ef910bc6e76561e705511db4db964ffde015e2/README.md","description_en":"Disassembly library with architecture-neutral APIs and instruction details for custom binary-analysis pipelines.","description_zh":"提供统一 API 和指令细节的多架构反汇编库，适合构建自定义二进制分析流程。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-15"},{"id":"imhex","name":"ImHex","name_zh":"ImHex","url":"https://github.com/WerWolv/ImHex","evidence_url":"https://github.com/WerWolv/ImHex/blob/fddad83966128b96dc1a8c9d55ba0ccd0721e276/README.md","description_en":"Hex editor with a binary-pattern language, structured data inspection and visual tools for understanding file formats.","description_zh":"带二进制模式语言、结构化数据检查及可视化功能的十六进制编辑器，适合理解文件格式。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","firmware","game"],"verified_at":"2026-10-15"},{"id":"x64dbg","name":"x64dbg","name_zh":"x64dbg","url":"https://github.com/x64dbg/x64dbg","evidence_url":"https://github.com/x64dbg/x64dbg/blob/ac4db12e133a3b2a91756fd2fbe864aa8dd1c453/README.md","description_en":"Windows binary debugger with disassembly, memory views and plugins for analyzing programs without source code.","description_zh":"Windows 二进制调试器，通过反汇编、内存视图和插件分析没有源码的程序。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-15"},{"id":"gdb","name":"GDB","name_zh":"GDB","url":"https://sourceware.org/gdb/","evidence_url":"https://www.sourceware.org/gdb/","description_en":"Native and remote debugger for controlling execution and inspecting live or crashed program state.","description_zh":"支持本地与远程调试，可控制执行并检查运行中或崩溃后的程序状态。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-15"},{"id":"rr","name":"rr","name_zh":"rr","url":"https://github.com/rr-debugger/rr","evidence_url":"https://github.com/rr-debugger/rr/blob/7ff9786535d6b6bfab78a22bd7bb2570287b44a1/README.md","description_en":"Records process execution and replays it under GDB, enabling repeatable inspection and reverse execution.","description_zh":"记录进程执行并在 GDB 下重放，便于重复检查现场和反向执行。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-15"},{"id":"diaphora","name":"Diaphora","name_zh":"Diaphora","url":"https://github.com/joxeankoret/diaphora","evidence_url":"https://github.com/joxeankoret/diaphora/blob/a7e15949942e13e3343615c3959e3326e78aa325/README.md","description_en":"IDA-based binary diffing that matches functions and transfers names, comments and types between analyzed versions.","description_zh":"基于 IDA 的二进制差异分析工具，可匹配函数并迁移名称、注释与类型信息。","kind":"tool","category":"binary-diffing","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-15"},{"id":"bindiff","name":"BinDiff","name_zh":"BinDiff","url":"https://github.com/google/bindiff","evidence_url":"https://github.com/google/bindiff/blob/882333b463b9d98e1e5ddf221921f5622b3936e9/README.md","description_en":"Compares disassembled binaries to find matching functions and changed code across versions.","description_zh":"比较反汇编后的二进制文件，定位不同版本中的对应函数与代码变化。","kind":"tool","category":"binary-diffing","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-15"},{"id":"detect-it-easy","name":"Detect It Easy","name_zh":"Detect It Easy","url":"https://github.com/horsicq/Detect-It-Easy","evidence_url":"https://github.com/horsicq/Detect-It-Easy/blob/bd693a6c31f4e2748ca14ed01da05e055eb2b0c7/README.md","description_en":"Format-aware file identification and static inspection using parsers, signatures and programmable heuristics.","description_zh":"结合格式解析器、签名和可编程启发式规则进行文件识别与静态检查。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-15"},{"id":"ost2","name":"OpenSecurityTraining2","name_zh":"OpenSecurityTraining2","url":"https://ost2.fyi/","evidence_url":"https://ost2.fyi/Learning-Paths.html","description_en":"Free self-paced security courses with learning paths for reverse engineering, firmware and systems foundations.","description_zh":"免费的自主学习课程，提供逆向工程、固件和系统基础等学习路线。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-15"},{"id":"pwn-college-re","name":"pwn.college: Reverse Engineering","name_zh":"pwn.college：逆向工程","url":"https://pwn.college/program-security/reverse-engineering/","evidence_url":"https://pwn.college/program-security/reverse-engineering/","description_en":"Hands-on reverse-engineering module covering functions, data access, static tools and dynamic tools with hosted exercises.","description_zh":"包含托管练习的逆向工程课程，覆盖函数、数据访问、静态工具和动态工具。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-15"},{"id":"re-for-beginners","name":"Reverse Engineering for Beginners","name_zh":"逆向工程入门","url":"https://beginners.re/","evidence_url":"https://beginners.re/","description_en":"Dennis Yurichev's free book on understanding compiled programs and assembly, available in multiple languages.","description_zh":"Dennis Yurichev 编写的免费逆向入门书，以汇编与编译后程序理解为核心，提供多语言版本。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-15"},{"id":"radare2-book","name":"The Official Radare2 Book","name_zh":"radare2 官方手册","url":"https://book.rada.re/","evidence_url":"https://book.rada.re/","description_en":"Official practical reference for radare2 analysis, disassembly, scripting, debugging and related plugins.","description_zh":"radare2 官方实践参考，覆盖分析、反汇编、脚本、调试及相关插件。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-15"},{"id":"renderdoc","name":"RenderDoc","name_zh":"RenderDoc","url":"https://github.com/baldurk/renderdoc","evidence_url":"https://github.com/baldurk/renderdoc/blob/5ce2e4ae6dd54f0c8455103a2c984540614020bf/README.md","description_en":"Inspect frame captures, draw calls, shaders, and graphics resources in your own game or graphics application.","description_zh":"检查自己游戏或图形应用的帧捕获、绘制调用、着色器和图形资源。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["app","game"],"verified_at":"2026-10-16T01:05:01Z"},{"id":"assetripper","name":"AssetRipper","name_zh":"AssetRipper","url":"https://github.com/AssetRipper/AssetRipper","evidence_url":"https://github.com/AssetRipper/AssetRipper/blob/62ec21e916b7dec29b10c2020ecead186773438b/README.md","description_en":"Analyze Unity game files, inspect asset dependencies, and convert supported assets into Unity project formats.","description_zh":"分析 Unity 游戏文件，检查资源依赖并将支持的资源转换为 Unity 工程格式。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-16T01:05:01Z"},{"id":"cpp2il","name":"Cpp2IL","name_zh":"Cpp2IL","url":"https://github.com/SamboyCoding/Cpp2IL","evidence_url":"https://github.com/SamboyCoding/Cpp2IL/blob/7fd44cac62d39914d81e10c07600ffd4110d29a9/README.md","description_en":"Recover managed representations from Unity IL2CPP builds using binary and metadata analysis; reconstruction remains a work in progress.","description_zh":"结合二进制与元数据分析，从 Unity IL2CPP 构建恢复托管表示；重建能力仍在开发中。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["app","binary","game"],"verified_at":"2026-10-16T01:05:01Z"},{"id":"il2cppdumper","name":"Il2CppDumper","name_zh":"Il2CppDumper","url":"https://github.com/Perfare/Il2CppDumper","evidence_url":"https://github.com/Perfare/Il2CppDumper/blob/101f3c62ef3dd3183aad4ab0b547ead63ffb45d0/README.md","description_en":"Recover IL2CPP metadata and dummy assemblies, and generate helper scripts for native analysis tools; method code is not restored.","description_zh":"恢复 IL2CPP 元数据及占位程序集，为原生分析工具生成辅助脚本；不会还原方法代码。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["app","binary","game"],"verified_at":"2026-10-16T01:05:01Z"},{"id":"renderdoc-mcp","name":"RenderDoc MCP","name_zh":"RenderDoc MCP","url":"https://github.com/scarletfantasy/renderdoc-mcp","evidence_url":"https://github.com/scarletfantasy/renderdoc-mcp/blob/ea360049b2add5e5f783bee2c084dfccf8337051/README.md","description_en":"Expose existing RenderDoc captures to an agent for bounded frame, pipeline, resource, and shader inspection.","description_zh":"向智能体开放已有 RenderDoc 捕获文件，分步检查帧、管线、资源和着色器。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["app","game"],"verified_at":"2026-10-16T01:05:01Z"},{"id":"chrome-devtools-mcp","name":"Chrome DevTools MCP","name_zh":"Chrome DevTools MCP","url":"https://github.com/ChromeDevTools/chrome-devtools-mcp","evidence_url":"https://github.com/ChromeDevTools/chrome-devtools-mcp/blob/5463101120f94fc7c79d43c44c01a4ab57835279/README.md","description_en":"Connect an agent to Chrome for live page inspection, network debugging, and performance traces.","description_zh":"连接智能体与 Chrome，检查实时页面、调试网络并记录性能轨迹。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["website"],"verified_at":"2026-10-16T01:05:01Z"},{"id":"mitmproxy","name":"mitmproxy","name_zh":"mitmproxy","url":"https://github.com/mitmproxy/mitmproxy","evidence_url":"https://github.com/mitmproxy/mitmproxy/blob/7458ea26ccec7d06ffdc434f878e8d92973aec7e/README.md","description_en":"Inspect and record HTTP traffic with an interactive proxy, web interface, or scriptable command-line tools.","description_zh":"通过交互代理、Web 界面或可脚本化命令行检查和记录 HTTP 流量。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["app","protocol","website"],"verified_at":"2026-10-16T01:05:01Z"},{"id":"playwright-mcp","name":"Playwright MCP","name_zh":"Playwright MCP","url":"https://github.com/microsoft/playwright-mcp","evidence_url":"https://github.com/microsoft/playwright-mcp/blob/ea00e62b711700733a9eff05b149b48cd3eb1b48/README.md","description_en":"Drive browser interactions through structured accessibility snapshots to investigate reproducible web behavior.","description_zh":"通过结构化无障碍快照驱动浏览器交互，调查可复现的网页行为。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["website"],"verified_at":"2026-10-16T01:05:01Z"},{"id":"burp-suite-mcp-server","name":"Burp Suite MCP Server","name_zh":"Burp Suite MCP Server 扩展","url":"https://github.com/PortSwigger/mcp-server","evidence_url":"https://github.com/PortSwigger/mcp-server/blob/5f76126409780ecba2b766c7f7388f465c5b5f94/README.md","description_en":"PortSwigger's Burp Suite extension serves an MCP endpoint, plus a packaged stdio proxy, so agents can query proxy HTTP and WebSocket history, send HTTP/1.1 or HTTP/2 requests, and open Repeater or Intruder tabs.","description_zh":"PortSwigger 官方 Burp Suite 扩展，提供 MCP 端点并附带 stdio 代理，使智能体可以查询代理中的 HTTP 与 WebSocket 历史记录、发送 HTTP/1.1 或 HTTP/2 请求，并打开 Repeater 或 Intruder 标签页。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["app","website"],"verified_at":"2026-10-17"},{"id":"wakaru","name":"Wakaru","name_zh":"Wakaru","url":"https://github.com/pionxzh/wakaru","evidence_url":"https://github.com/pionxzh/wakaru/blob/d77ed638d7af07500be39f512e2f058fd8d53cd1/README.md","description_en":"Recover readable modules from shipped JavaScript bundles by reversing recognized minifier and transpiler patterns. Supports bundle splitting and modern-syntax recovery for inspecting production frontend code.","description_zh":"通过还原已识别的压缩与转译模式，从发布后的 JavaScript 包中恢复可读模块，支持拆包与现代语法恢复，便于分析生产环境前端代码。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-16"},{"id":"spectral-mcp","name":"Spectral","name_zh":"Spectral","url":"https://github.com/spectral-mcp/spectral","evidence_url":"https://github.com/spectral-mcp/spectral/blob/4c0367a1e88849acfe80f3d49ba0cfc649d405c5/README.md","description_en":"Analyze captured application HTTP traffic with an LLM to generate MCP tools, OpenAPI 3.1 specifications, or GraphQL schemas. Generated tools call the observed API directly after capture and authentication setup.","description_zh":"用 LLM 分析捕获的应用 HTTP 流量，生成 MCP 工具、OpenAPI 3.1 规范或 GraphQL 模式；完成抓包与认证配置后，生成的工具可直接调用已观察到的 API。","kind":"integration","category":"web-analysis","group":"agents","relationship":"independent-agent-integration","targets":["app","protocol","website"],"verified_at":"2026-10-16"},{"id":"jsdeob-workbench","name":"jsdeob-workbench","name_zh":"jsdeob-workbench","url":"https://github.com/Owl4444/jsdeob-workbench","evidence_url":"https://github.com/Owl4444/jsdeob-workbench/blob/e51a8281cb2ee11e95c5f7cafaa2090569a91abf/README.md","description_en":"Inspect JavaScript ASTs and variable scopes while building visual chains of Babel transforms. Save analysis projects and reusable plugins to iteratively simplify obfuscated scripts.","description_zh":"在查看 JavaScript AST 和变量作用域的同时，可视化编排 Babel 转换链；保存分析项目与可复用插件，逐步简化混淆脚本。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-17"},{"id":"undertalemodtool","name":"UndertaleModTool","name_zh":"UndertaleModTool","url":"https://github.com/UnderminersTeam/UndertaleModTool","evidence_url":"https://github.com/UnderminersTeam/UndertaleModTool/blob/f43e12c445c37d50dc6244caa12ccab232983f3f/README.md","description_en":"Browse and modify supported GameMaker data files, extract assets, and decompile or compile GML VM code. Includes room editing, scripted changes, a CLI, and the reusable UndertaleModLib library.","description_zh":"浏览和修改受支持的 GameMaker 数据文件、提取资源，以及反编译或编译 GML VM 代码；提供房间编辑、脚本化修改、CLI 和可复用的 UndertaleModLib 库。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-16"},{"id":"frida-il2cpp-bridge","name":"frida-il2cpp-bridge","name_zh":"frida-il2cpp-bridge","url":"https://github.com/vfsfitvnm/frida-il2cpp-bridge","evidence_url":"https://github.com/vfsfitvnm/frida-il2cpp-bridge/blob/af361f544de8c0016d7cc24be7a87e83b3c4029d/README.md","description_en":"Inspect IL2CPP classes, methods, and fields in a live process, and trace or intercept method calls without supplying global-metadata.dat. Complements static IL2CPP dumpers with runtime observation.","description_zh":"在运行中的进程里检查 IL2CPP 类、方法和字段，无需提供 global-metadata.dat 即可跟踪或拦截方法调用，为静态 IL2CPP 转储工具补充运行时观察能力。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["app","game"],"verified_at":"2026-10-16"},{"id":"objdiff","name":"objdiff","name_zh":"objdiff","url":"https://github.com/encounter/objdiff","evidence_url":"https://github.com/encounter/objdiff/blob/eed74b99c4e94dd154882259931201badc6fdbd1/README.md","description_en":"Compare functions and data in reference and rebuilt object files to guide matching decompilation. Displays instruction-level differences, demangles C++ symbols, and can rebuild when source files change.","description_zh":"比较参考目标文件与重新编译目标文件中的函数和数据，辅助匹配反编译；显示指令级差异、还原 C++ 符号，并可在源码变更时自动重新构建。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-16"},{"id":"decomp-permuter","name":"decomp-permuter","name_zh":"decomp-permuter","url":"https://github.com/simonlindholm/decomp-permuter","evidence_url":"https://github.com/simonlindholm/decomp-permuter/blob/8556c81d80d1c1af98a858c8f4dc951357f29139/README.md","description_en":"Randomly or systematically permutes one C function, recompiling each variant and scoring it against a target object file to search for matching compiler output. PERM macros specify manual alternatives, and the optional permuter@home mode distributes runs to other workers.","description_zh":"随机或系统地改写单个 C 函数，逐个重新编译变体并与目标文件评分对比，以寻找与原编译输出一致的写法。可用 PERM 宏指定手动备选写法，可选的 permuter@home 模式能把运行分发给其他工作节点。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-17"},{"id":"asm-differ","name":"asm-differ","name_zh":"asm-differ","url":"https://github.com/simonlindholm/asm-differ","evidence_url":"https://github.com/simonlindholm/asm-differ/blob/0dd09af8f8008f1f880327cf0aca3b26d2562ea2/README.md","description_en":"Diffs original and rebuilt assembly for one function or ROM address to guide matching decompilation; its watch mode can rerun make when sources change. The README describes it as decomp.me’s default diff viewer and points to objdiff as a modern alternative.","description_zh":"对比单个函数或 ROM 地址的原始汇编与重新编译后的汇编，辅助匹配反编译；监视模式可在源码变更时重新运行 make。README 称它是 decomp.me 的默认差异查看器，并推荐 objdiff 作为现代替代方案。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-17"},{"id":"ue-explorer","name":"UE Explorer","name_zh":"UE Explorer","url":"https://github.com/UE-Explorer/UE-Explorer","evidence_url":"https://github.com/UE-Explorer/UE-Explorer/blob/9ef6670933da6154e26a9631a9e22ce9e7d3333f/README.md","description_en":"Explore Unreal packages through class, property, and dependency trees; decompile and export UnrealScript classes, inspect bytecode, and examine structured binary data.","description_zh":"通过类、属性与依赖树浏览 Unreal 包，反编译和导出 UnrealScript 类、检查字节码，并查看结构化二进制数据。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-16"},{"id":"garbro","name":"GARbro","name_zh":"GARbro","url":"https://github.com/morkt/GARbro","evidence_url":"https://github.com/morkt/GARbro/blob/b09ee4570ccb1daf6ac56710ee8934dc0b8baeb0/README.md","description_en":"Browse recognized visual-novel resource archives as folders, preview their contents, and extract images or audio with conversion to common formats.","description_zh":"像浏览文件夹一样查看已识别的视觉小说资源归档，预览内容，并在提取图像或音频时转换为常用格式。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-16"},{"id":"mobsf","name":"Mobile Security Framework (MobSF)","name_zh":"Mobile Security Framework（MobSF）","url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF","evidence_url":"https://github.com/MobSF/docs/blob/d3dc0f64b0767914c5dc6e42c8427ee645532623/running_mobsf_docker.md","description_en":"Inspect mobile application packages with static analysis and supported-device dynamic testing, including runtime behavior and network traffic, through a web interface and APIs.","description_zh":"通过 Web 界面与 API 检查移动应用包，结合静态分析及受支持设备上的动态测试，分析运行时行为与网络流量。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-16"},{"id":"objection","name":"objection","name_zh":"objection","url":"https://github.com/sensepost/objection","evidence_url":"https://github.com/sensepost/objection/blob/35c4e2c9e68a0354b21db4833252e0c4acd5bd28/pyproject.toml","description_en":"Explore running Android and iOS apps with a Frida-backed command interface for inspecting app storage, memory, runtime objects, and instrumented behavior.","description_zh":"通过基于 Frida 的命令界面探索运行中的 Android 与 iOS 应用，检查应用存储、内存、运行时对象和插桩后的行为。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-16"},{"id":"grapefruit","name":"Grapefruit","name_zh":"Grapefruit 移动应用动态插桩工具","url":"https://github.com/ChiChou/grapefruit","evidence_url":"https://github.com/ChiChou/grapefruit/blob/b7176b409793a1395503fe78153e3b0ba888f77d/README.md","description_en":"Inspect and hook running iOS and Android apps from a Frida-based web interface, with method and crypto-API hooks, filesystem and SQLite browsers, iOS keychain and UI-hierarchy views, and HTTP capture from common networking libraries.","description_zh":"通过基于 Frida 的 Web 界面检查并 Hook 运行中的 iOS 与 Android 应用，提供方法与加密 API 拦截、文件系统与 SQLite 浏览、iOS 钥匙串与界面层级查看，以及常见网络库的 HTTP 流量捕获。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-17"},{"id":"r2frida","name":"r2frida","name_zh":"r2frida","url":"https://github.com/nowsecure/r2frida","evidence_url":"https://github.com/nowsecure/r2frida/blob/4f1f8d7b1096ed0ca29778688d0f164461d56f05/README.md","description_en":"Use radare2 commands and Frida instrumentation together to inspect local or remote process memory, symbols, classes, and runtime calls on desktop and mobile targets.","description_zh":"结合 radare2 命令与 Frida 插桩，检查桌面和移动目标中本地或远程进程的内存、符号、类及运行时调用。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-16"},{"id":"emba","name":"EMBA","name_zh":"EMBA","url":"https://github.com/e-m-b-a/emba","evidence_url":"https://github.com/e-m-b-a/emba/wiki/Installation/35b42245dc59e3545a07dcc209e9ee58f8cf2590","description_en":"Extract firmware, combine static checks with emulation-based analysis, inventory software components, and generate web reports and SBOMs for further investigation.","description_zh":"提取固件，结合静态检查与仿真分析，整理软件组件清单，并生成 Web 报告和 SBOM，供进一步调查。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-16"},{"id":"fact-core","name":"Firmware Analysis and Comparison Tool (FACT)","name_zh":"固件分析与比较工具（FACT）","url":"https://github.com/fkie-cad/FACT_core","evidence_url":"https://github.com/fkie-cad/FACT_core/blob/dc594e8f2ed120b1e04aaf3c52dda201be967dff/README.md","description_en":"Unpack and analyze firmware through an extensible platform whose web interface and HTTP API make component contents and analysis results searchable and comparable across samples.","description_zh":"通过可扩展平台解包和分析固件，使用 Web 界面与 HTTP API 搜索组件内容和分析结果，并比较不同样本。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-16"},{"id":"ofrak","name":"OFRAK","name_zh":"OFRAK","url":"https://github.com/redballoonsecurity/ofrak","evidence_url":"https://github.com/redballoonsecurity/ofrak/blob/1e1ef750222c1a842248ae7bdcae576bfdedae65/README.md","description_en":"Recursively identify, unpack, analyze, modify, and repack firmware and binary formats using a resource-tree GUI and Python API, with optional disassembler backends.","description_zh":"通过资源树图形界面与 Python API，递归识别、解包、分析、修改和重新打包固件及二进制格式，并可接入可选反汇编后端。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-16"},{"id":"firmae","name":"FirmAE","name_zh":"FirmAE","url":"https://github.com/pr0v3rbs/FirmAE","evidence_url":"https://github.com/pr0v3rbs/FirmAE/blob/653565b5d14e6d69a1dd242aa88ecfb4b090a74a/README.md","description_en":"Emulate router and IP-camera firmware to inspect network services and runtime behavior, with automated emulation checks and separate analysis, run, and debugging modes.","description_zh":"仿真路由器与 IP 摄像机固件，检查网络服务和运行时行为，提供自动仿真检查，以及独立的分析、运行和调试模式。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-16"},{"id":"llm4decompile-paper","name":"LLM4Decompile (EMNLP 2024)","name_zh":"LLM4Decompile（EMNLP 2024）","url":"https://aclanthology.org/2024.emnlp-main.203/","evidence_url":"https://aclanthology.org/2024.emnlp-main.203/","description_en":"Research on direct binary decompilation and refinement of Ghidra output with language models. Evaluates re-executability on HumanEval and ExeBench; useful for distinguishing readable output from functional recovery.","description_zh":"研究使用语言模型直接反编译二进制，以及改进 Ghidra 输出。在 HumanEval 与 ExeBench 上评估重新执行能力，可用于区分代码可读性与功能恢复。","kind":"research","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-16"},{"id":"decompilebench-paper","name":"DecompileBench (Findings of ACL 2025)","name_zh":"DecompileBench（Findings of ACL 2025）","url":"https://aclanthology.org/2025.findings-acl.1194/","evidence_url":"https://aclanthology.org/2025.findings-acl.1194/","description_en":"A benchmark combining functions from real programs, runtime-aware validation, and LLM-assisted assessment of decompiled-code usability. Helps separate functional correctness from perceived understandability when comparing decompilers.","description_zh":"结合真实程序函数、运行时验证与 LLM 辅助可用性评判的反编译基准，用于比较反编译器的功能正确性与代码可理解性。","kind":"research","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-16"},{"id":"resym-paper","name":"ReSym (CCS 2024)","name_zh":"ReSym（CCS 2024）","url":"https://doi.org/10.1145/3658644.3670340","evidence_url":"https://github.com/lt-asset/resym/tree/437b4acac21a5a60edecf0c4423f7172f991271f","description_en":"Combines language models and program analysis to recover variable and user-defined data-structure symbols from stripped binaries. The authors provide training, inference, evaluation, and posterior-reasoning artifacts.","description_zh":"结合语言模型与程序分析，从去符号二进制中恢复变量和用户定义数据结构的符号信息。作者提供训练、推理、评测与后验推理材料。","kind":"research","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-16"},{"id":"lasrecomp","name":"LASRecomp: Link’s Awakening static recompilation","name_zh":"LASRecomp：《织梦岛》静态重编译案例","url":"https://github.com/peiikai/LASRecomp","evidence_url":"https://github.com/peiikai/LASRecomp/blob/6244eb9d4d3497094e21cac7dabe998ded1f2800/README.md","description_en":"A native desktop reconstruction of the 2019 Switch version of Link’s Awakening using static recompilation. The author attributes most code, tooling and reverse-engineering work to Claude Code with human direction and review.","description_zh":"通过静态重编译，将 2019 年 Switch 版《塞尔达传说：织梦岛》重建为原生桌面程序。作者称大部分代码、工具与逆向工作由 Claude Code 完成，人类负责指导和复核。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-16"},{"id":"godot-re-tools","name":"Godot RE Tools","name_zh":"Godot 逆向工程工具","url":"https://github.com/GDRETools/gdsdecomp","evidence_url":"https://github.com/GDRETools/gdsdecomp/blob/e2780fcc73ab14083967d3945e513d1f6af1dbd0/README.md","description_en":"Recover supported Godot project files, GDScript and imported resources from exported games. Includes PCK inspection and extraction, script decompilation, and resource conversion for examining and rebuilding project structure.","description_zh":"从已导出的游戏中恢复受支持的 Godot 工程文件、GDScript 与导入资源，提供 PCK 检查与提取、脚本反编译及资源转换，便于分析和重建工程结构。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-16"},{"id":"ue4ss","name":"UE4SS","name_zh":"UE4SS（虚幻引擎脚本系统）","url":"https://github.com/UE4SS-RE/RE-UE4SS","evidence_url":"https://github.com/UE4SS-RE/RE-UE4SS/blob/1ba38db4b5faf5cfad9d058a6843c12e815bc60b/README.md","description_en":"Inspect Unreal Engine games at runtime through live UObject property views, reflected C++ header dumps, property mappings and actor dumps. Lua and C++ APIs support experiments while reconstructing game structures.","description_zh":"通过实时 UObject 属性视图、反射 C++ 头文件导出、属性映射和 Actor 转储分析虚幻引擎游戏；Lua 与 C++ API 可辅助实验和重建游戏结构。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-16"},{"id":"fmodel","name":"FModel","name_zh":"FModel 游戏资源浏览器","url":"https://github.com/4sval/FModel","evidence_url":"https://github.com/4sval/FModel/blob/05cfbdd1648afe2928109b70ab63880a4bc8f7b4/README.md","description_en":"Explore Unreal Engine game archives with CUE4Parse-backed package and property inspection, asset previews and export. The 2026 summer release adds USD world export for reconstructing supported scene content.","description_zh":"基于 CUE4Parse 浏览虚幻引擎游戏归档，检查资源包和属性，预览并导出资源；2026 年夏季发行版新增 USD 世界导出，可辅助重建受支持的场景内容。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-16"},{"id":"blutter","name":"Blutter","name_zh":"Blutter","url":"https://github.com/worawit/blutter","evidence_url":"https://github.com/worawit/blutter/blob/4a60ac648bf448c5a7596437243bcd0b9376fdf0/README.md","description_en":"Analyze Flutter Android ARM64 AOT binaries using the matching Dart runtime. Produces annotated assembly, object-pool dumps and a target-specific Frida script template for investigating compiled Dart application logic.","description_zh":"利用匹配的 Dart 运行时分析 Flutter Android ARM64 AOT 二进制，生成带符号的汇编、对象池转储及面向目标的 Frida 脚本模板，辅助研究编译后的 Dart 应用逻辑。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-16"},{"id":"hermes-dec","name":"hermes-dec","name_zh":"hermes-dec","url":"https://github.com/P1sec/hermes-dec","evidence_url":"https://github.com/P1sec/hermes-dec/blob/2e796663e1fedb93dca51060797ebf3327b3fedb/README.md","description_en":"Parse, disassemble and partially decompile React Native Hermes bytecode bundles. Makes HBC headers and instructions inspectable and emits pseudocode for understanding compiled application logic.","description_zh":"解析、反汇编并部分反编译 React Native 的 Hermes 字节码包，展示 HBC 文件头和指令，并生成伪代码以帮助理解编译后的应用逻辑。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-16"},{"id":"recaf","name":"Recaf","name_zh":"Recaf 字节码分析与编辑工具","url":"https://github.com/Col-E/Recaf","evidence_url":"https://github.com/Col-E/Recaf/blob/7ce7b5d2c077d5ebaa895915df8d372b9477d5cc/README.md","description_en":"Inspect and modify compiled JVM applications with integrated decompilers, bytecode assembly, reference search, mappings and deobfuscation tools. The reviewed 4.0 preview also provides basic read-only Android bytecode inspection.","description_zh":"通过集成反编译器、字节码汇编、引用搜索、映射与去混淆工具检查和修改已编译的 JVM 应用；所审阅的 4.0 预览版还提供基础的只读 Android 字节码分析。","kind":"tool","category":"jvm","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-16"},{"id":"kaitai-struct","name":"Kaitai Struct","name_zh":"Kaitai Struct 二进制格式描述与解析工具","url":"https://github.com/kaitai-io/kaitai_struct","evidence_url":"https://github.com/kaitai-io/kaitai_struct/blob/5ca6630c7761d7f0d9c57fd8a4af1cc8adb75a6c/README.md","description_en":"Turn documented binary layouts into reusable parsers for files and network packets. A .ksy specification can be inspected with visualizers and compiled to multiple languages, helping preserve reverse-engineered format knowledge in interoperable implementations.","description_zh":"将已描述的二进制布局转换为可复用的文件与网络报文解析器；同一份 .ksy 规范可通过可视化工具检查，并编译为多种语言，便于把逆向获得的格式知识落实为可互操作的实现。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary","firmware","protocol"],"verified_at":"2026-10-16"},{"id":"wireshark","name":"Wireshark","name_zh":"Wireshark 协议分析工具","url":"https://gitlab.com/wireshark/wireshark","evidence_url":"https://gitlab.com/wireshark/wireshark/-/blob/e1087b1870cfc7686b229836dda8838c8f45ea0f/README.md","description_en":"Inspect captured application and device traffic as decoded protocol fields, with filtering and shared GUI/TShark dissection. Custom dissectors let an analyst encode newly understood packet formats and compare protocol implementations.","description_zh":"将捕获的应用与设备流量解析为协议字段，支持过滤，并由 GUI 与 TShark 共用解析逻辑；自定义解析器可将新识别的报文格式固化下来，辅助比较协议实现。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["app","firmware","protocol"],"verified_at":"2026-10-16"},{"id":"pulseview","name":"PulseView","name_zh":"PulseView 信号与协议分析工具","url":"https://github.com/sigrokproject/pulseview","evidence_url":"https://github.com/sigrokproject/pulseview/blob/af02198741b4e57c9f9b796bd5e6c0f2ae9f2f2b/README","description_en":"Examine captured logic and analog waveforms with sigrok's graphical frontend. Protocol decoders and decoder stacking expose bus messages and higher-level device operations, making hardware communication traces useful for firmware and interoperability investigations.","description_zh":"通过 sigrok 的图形前端检查逻辑与模拟波形；协议解码器及分层解码可展示总线消息和更高层的设备操作，便于利用硬件通信记录开展固件与互操作性分析。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware","protocol"],"verified_at":"2026-10-16"},{"id":"uefitool","name":"UEFITool","name_zh":"UEFITool 固件镜像分析工具","url":"https://github.com/LongSoft/UEFITool","evidence_url":"https://github.com/LongSoft/UEFITool/blob/dac91b26733ca21cb204e41614c1b8c81cc50860/README.md","description_en":"Parse UEFI firmware images into an inspectable tree and check their structure. Companion UEFIExtract and UEFIFind tools extract parsed contents and locate patterns, supporting analysis of firmware components and vendor formats.","description_zh":"将 UEFI 固件镜像解析为可检查的树状结构，并检查其结构；配套的 UEFIExtract 与 UEFIFind 可提取解析后的内容、查找模式，辅助分析固件组件与厂商格式。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-16"},{"id":"browser-reverse-engineering-toolkit","name":"Browser Reverse Engineering Toolkit","name_zh":"Browser Reverse Engineering Toolkit 浏览器逆向工程工具集","url":"https://github.com/Dvurechensky/Browser.Reverse.Engineering.Toolkit","evidence_url":"https://github.com/Dvurechensky/Browser.Reverse.Engineering.Toolkit/blob/ecbe61af5004f6efa493749a623fbd98ab307a37/README.md","description_en":"Capture browser-session evidence, crawl websites in a persistent Chromium session, and generate offline architecture/API reports plus OpenAPI, SDK and mock-server drafts from saved captures.","description_zh":"采集浏览器会话证据，在持久 Chromium 会话中抓取网站，并根据已保存的捕获数据生成离线架构／API 报告，以及 OpenAPI、SDK 和模拟服务器草稿。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-16"},{"id":"screenshot-to-code","name":"screenshot-to-code","name_zh":"screenshot-to-code 截图转前端代码工具","url":"https://github.com/abi/screenshot-to-code","evidence_url":"https://github.com/abi/screenshot-to-code/blob/a8139779f7c5ae231b7f2a86fa7f83ddc5f7badc/README.md","description_en":"Generate HTML/CSS, Tailwind, React, Vue, Bootstrap or Ionic front-end code from screenshots, mockups, Figma designs or screen recordings with multimodal models; an optional headless-browser preview lets the model check its rendered output. The result is a visual reconstruction of the interface, not recovered original source or backend behavior.","description_zh":"借助多模态模型，根据截图、设计稿、Figma 设计或屏幕录像生成 HTML/CSS、Tailwind、React、Vue、Bootstrap 或 Ionic 前端代码；可选的无头浏览器预览可让模型渲染并自查输出。结果是对界面外观的视觉重建，并非恢复原始源码或后端行为。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-17"},{"id":"nibkit","name":"nibkit","name_zh":"nibkit 原生界面结构分析工具","url":"https://github.com/tokenbleed/nibkit","evidence_url":"https://github.com/tokenbleed/nibkit/blob/fcf4670db8ba5d5d94ab62951a971be949b7b21f/README.adoc","description_en":"Decode compiled iOS/macOS interface archives into object trees, Outlet/Action connections, custom classes and navigation relationships. Exports JSON or Mermaid diagrams and exposes read-only inspection commands through MCP.","description_zh":"将已编译的 iOS/macOS 界面归档解码为对象树、Outlet／Action 连接、自定义类及导航关系，可导出 JSON 或 Mermaid 图，并通过 MCP 提供只读检查命令。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-16"},{"id":"psp-web-recomp","name":"PSP Web Recomp","name_zh":"PSP Web Recomp 浏览器游戏重编译项目","url":"https://github.com/snuri00/psp-web-recomp","evidence_url":"https://github.com/snuri00/psp-web-recomp/blob/37826ab881d9a593efb842fe47adfae2e9118b5d/README.md","description_en":"Translate PSP MIPS executables into C++ and WebAssembly, backed by a PSP high-level emulation runtime and WebGL2 renderer. Native tracing, frame capture and audio tools support investigating missing behavior during game porting.","description_zh":"将 PSP MIPS 可执行文件转换为 C++ 与 WebAssembly，配合 PSP 高层仿真运行时和 WebGL2 渲染器；原生跟踪、画面捕获及音频工具可辅助调查游戏移植中缺失的行为。","kind":"project","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game","website"],"verified_at":"2026-10-16"},{"id":"n64recomp","name":"N64: Recompiled","name_zh":"N64: Recompiled","url":"https://github.com/N64Recomp/N64Recomp","evidence_url":"https://github.com/N64Recomp/N64Recomp/blob/ffb39cdad1da5de07eaaa48bd1db4a89a7986771/README.md","description_en":"Statically recompiles N64 MIPS binaries into C functions from symbol metadata, emitting function lookups and relocation macros so a runtime can handle statically linked and relocatable overlays. The output needs a runtime such as N64ModernRuntime; the repository also includes RSP microcode and mod tooling.","description_zh":"依据符号元数据将 N64 MIPS 二进制静态重编译为 C 函数，并生成函数查找与重定位宏，供运行时处理静态链接和可重定位的覆盖段。输出需配合 N64ModernRuntime 等运行时；仓库还包含 RSP 微码重编译与模组工具。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-17"},{"id":"xenonrecomp","name":"XenonRecomp","name_zh":"XenonRecomp","url":"https://github.com/hedge-dev/XenonRecomp","evidence_url":"https://github.com/hedge-dev/XenonRecomp/blob/ddd128bcca99fe8bfbb99bea583c972351fa6ace/README.md","description_en":"Converts Xbox 360 PowerPC executables into C++ that can be compiled for other platforms, with the XenonAnalyse companion detecting jump tables and function boundaries. Output is a literal instruction translation rather than decompiled code and needs a runtime that the project does not supply.","description_zh":"将 Xbox 360 PowerPC 可执行文件转换为可在其他平台编译的 C++ 代码，配套的 XenonAnalyse 负责检测跳转表和函数边界。输出是逐条指令的直译而非反编译代码，并需要项目本身不提供的运行时。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-17"},{"id":"aotopsy","name":"AOTopsy","name_zh":"AOTopsy Flutter/Dart 静态分析工具","url":"https://github.com/BroNils/aotopsy","evidence_url":"https://github.com/BroNils/aotopsy/blob/01011df108eaf5a0c1757cf5842115f9fb8b6303/README.md","description_en":"Statically inspect Flutter/Dart AOT libapp.so files to recover available metadata, class structures, call edges and pseudocode without embedding a Dart VM or compiling a matching SDK. Supports ARM64 and x86_64 analysis paths.","description_zh":"静态检查 Flutter/Dart AOT libapp.so 文件，恢复可用元数据、类结构、调用关系及伪代码，无需嵌入 Dart VM 或编译匹配的 SDK，提供 ARM64 与 x86_64 分析路径。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-16"},{"id":"hbctool","name":"hbctool","name_zh":"hbctool Hermes 字节码汇编与反汇编工具","url":"https://github.com/bongtrop/hbctool","evidence_url":"https://github.com/bongtrop/hbctool/blob/389b351bfdd988e93da5cce1a9e3bfd860548e7a/README.md","description_en":"Disassemble and reassemble supported React Native Hermes bytecode bundles through HASM files, enabling bytecode inspection and editing for the explicitly supported legacy HBC versions.","description_zh":"通过 HASM 文件反汇编和重新汇编受支持的 React Native Hermes 字节码包，为明确支持的旧版 HBC 提供字节码检查与修改能力。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-16"},{"id":"kef-lsx-volume-case","name":"LSX II Volume Fixer: reconstructing volume behavior","name_zh":"LSX II 音量修正器：重建音量行为","url":"https://github.com/roberdorfer/kef-lsx-volume","evidence_url":"https://github.com/roberdorfer/kef-lsx-volume/blob/6fbd7f76c63bf6d7da0979db4a1b312a064e0b4b/README.md","description_en":"Uses measured USB-volume behavior and a macOS audio proxy to map volume keys to a KEF LSX II’s LAN control. The project reports more even steps while forwarding USB audio; the speaker firmware is unchanged.","description_zh":"根据实测 USB 音量行为，通过 macOS 音频代理将音量键映射到 KEF LSX II 的局域网控制。项目报告音量步进更均匀，同时转发 USB 音频；扬声器固件未修改。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-10-16"},{"id":"arkweb-two-game-case","name":"ArkWeb: a two-game movement and collision experiment","name_zh":"ArkWeb：双游戏动作与碰撞桥接实验","url":"https://github.com/luki-1/ArkWeb","evidence_url":"https://github.com/luki-1/ArkWeb/blob/17ec697bd431fce96a60fff1075f7e399d296058/README.md","description_en":"Runs Spider-Man Remastered and Arkham Knight together, streaming Gotham collision into Spider-Man’s physics world and compositing his rendered frame into Arkham. This experimental runtime bridge is not a recovered standalone game or new engine.","description_zh":"同时运行《漫威蜘蛛侠：重制版》与《蝙蝠侠：阿卡姆骑士》，将哥谭碰撞数据传入蜘蛛侠的物理世界，再将其渲染画面合成到阿卡姆中。这是实验性的运行时桥接，并非恢复出的独立游戏或新引擎。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-16"},{"id":"hw-harness-reference-case","name":"hw-harness: scanner USB protocol investigation","name_zh":"hw-harness：扫描仪 USB 协议调查","url":"https://github.com/cschalle/hw-harness","evidence_url":"https://github.com/cschalle/hw-harness/blob/093afc5c576c200f29b771d01624a327d0ff1806/examples/plustek-film-scanner/README.md","description_en":"Documents an author-reported scanner investigation comparing vendor-driver USB control transfers with Linux-driver traces to infer initialization, timing and resolution parameters. The released harness organizes reference capture and comparison; it does not automatically recover a complete protocol specification.","description_zh":"记录作者报告的扫描仪调查：比较厂商驱动的 USB 控制传输与 Linux 驱动的记录，推断初始化、时序及分辨率参数。公开工具负责组织参考采集与比较，并不自动恢复完整协议规范。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-17T02:37:34.781877Z"},{"id":"netzob","name":"Netzob","name_zh":"Netzob 协议建模与推断框架","url":"https://github.com/netzob/netzob","evidence_url":"https://github.com/netzob/netzob/blob/088fe769e98e0bfbd3ed99e66b3982446bf8d197/README.rst","description_en":"Model communication protocols and infer message layouts from traces, with configured active learning for protocol state machines. Python APIs expose message fields, symbols and automata for parsing, traffic generation and fuzzing.","description_zh":"对通信协议建模并从流量记录推断报文布局，通过配置主动学习来推断协议状态机。Python API 提供报文字段、符号和自动机，用于解析、流量生成及模糊测试。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-17T02:53:06.350416Z"},{"id":"scapy","name":"Scapy","name_zh":"Scapy 报文分析与构造工具","url":"https://github.com/secdev/scapy","evidence_url":"https://github.com/secdev/scapy/blob/e2e35c07bce2f40e7513e1b29a6d300d5329dbc3/README.md","description_en":"Script packet dissection, construction, request/reply matching and capture-file analysis in Python. Custom packet fields and layer bindings let analysts encode understood wire formats and investigate protocol behavior.","description_zh":"使用 Python 编写报文解析、构造、请求／响应匹配及捕获文件分析流程；自定义报文字段与层绑定可将已理解的线格式编码为可操作模型，辅助研究协议行为。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-17T02:53:06.350416Z"},{"id":"universal-radio-hacker","name":"Universal Radio Hacker (URH)","name_zh":"Universal Radio Hacker（URH）无线协议分析工具","url":"https://github.com/jopohl/urh","evidence_url":"https://github.com/jopohl/urh/blob/1403d92987cc3d01d41aff64250955ce455dabd2/README.md","description_en":"Demodulate and decode signals captured with software-defined radios, with automatic modulation-parameter detection and customizable decodings. Analysts assign protocol fields and message types by hand or review rule-based automatic field inference; a fuzzer targets stateless protocols and a simulator supports stateful exchanges.","description_zh":"解调并解码通过软件无线电捕获的信号，支持自动检测调制参数和自定义解码。分析者可手动标注协议字段与消息类型，或复核基于规则的字段自动推断结果；模糊测试组件面向无状态协议，仿真环境则用于有状态交互。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-17"},{"id":"savvycan","name":"SavvyCAN","name_zh":"SavvyCAN CAN 总线分析工具","url":"https://github.com/collin80/SavvyCAN","evidence_url":"https://github.com/collin80/SavvyCAN/blob/3166d8cc6c8d12c2c7db78d96b24fc0f8bced1ef/README.md","description_en":"Capture or load CAN bus traffic and investigate frames with sniffer, graphing, file-comparison and ISO-TP/UDS decoding views; loaded or analyst-edited DBC files map raw bytes to named signals. Separate custom-sender, fuzzing and UDS-scan windows transmit frames on a live bus.","description_zh":"捕获或载入 CAN 总线流量，通过嗅探、绘图、文件比对及 ISO-TP／UDS 解码视图分析帧；借助载入或由分析者编辑的 DBC 文件，将原始字节映射为具名信号。自定义发送、模糊测试和 UDS 扫描则是独立窗口，会主动向实时总线发送帧。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-17"},{"id":"aalpy","name":"AALpy","name_zh":"AALpy 自动机学习库","url":"https://github.com/DES-Lab/AALpy","evidence_url":"https://github.com/DES-Lab/AALpy/blob/335c50a1b4b5a830d788f86b7c30a8cb6c73ecc0/README.md","description_en":"General-purpose Python automata-learning library that infers deterministic, non-deterministic, stochastic and pushdown models of black-box systems from active queries or passive traces. Its README links a separate Bluetooth Low Energy study whose repository reports learned connection and legacy-pairing state machines; message formats are not inferred.","description_zh":"通用的 Python 自动机学习库，可通过主动查询或被动轨迹数据，推断黑盒系统的确定性、非确定性、随机及下推自动机模型。其 README 链接了一项独立的低功耗蓝牙（BLE）研究，该研究的仓库报告了学习得到的设备连接与传统配对（legacy pairing）状态机；该库本身不推断报文格式。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-17"},{"id":"glasgow-interface-explorer","name":"Glasgow Interface Explorer","name_zh":"Glasgow Interface Explorer 数字接口探索工具","url":"https://github.com/GlasgowEmbedded/glasgow","evidence_url":"https://github.com/GlasgowEmbedded/glasgow/blob/d51713b2141bba7958a073e99166ad01f5024c42/docs/manual/src/intro.rst","description_en":"Use FPGA-based open hardware and Python applets to read and write SPI flash, I2C EEPROM and parallel memory chips, determine JTAG pinouts, debug supported processors and analyze UART, SPI and QSPI transactions on physical devices.","description_zh":"借助基于 FPGA 的开源硬件和 Python 小程序（applet），读写 SPI 闪存、I2C EEPROM 及并行存储芯片，自动确定 JTAG 引脚，调试受支持的处理器，并分析实体设备上的 UART、SPI 和 QSPI 事务。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware","protocol"],"verified_at":"2026-10-17"},{"id":"penguin","name":"Penguin","name_zh":"Penguin 固件重托管工具","url":"https://github.com/rehosting/penguin","evidence_url":"https://github.com/rehosting/penguin/blob/b645cd23852a41781181a651779b82a48c0c3fd3/README.md","description_en":"Rehost embedded Linux firmware from an extracted root filesystem using a generated, editable configuration of emulation transformations, then refine it through a guest root shell, forwarded network services and recorded dynamic-analysis output.","description_zh":"以提取出的根文件系统为输入，生成可编辑的仿真变换配置来重托管嵌入式 Linux 固件，再借助客户机 root shell、转发到主机的网络服务和记录下的动态分析输出，逐步完善配置。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-17"},{"id":"pyghidra-mcp","name":"pyghidra-mcp","name_zh":"pyghidra-mcp 项目级 Ghidra MCP 服务器","url":"https://github.com/clearbluejar/pyghidra-mcp","evidence_url":"https://github.com/clearbluejar/pyghidra-mcp/blob/323fbdb29dfed42241e6574806223a3454aca908/README.md","description_en":"PyGhidra-based MCP server that analyzes every binary in a Ghidra project and exposes decompilation, cross-references, call graphs, symbol and string search, indexed semantic code search, and renaming, typing and comment edits. A separate HTTP CLI client and an optional mode driving a Ghidra GUI it launches are included.","description_zh":"基于 PyGhidra 的 MCP 服务器，可分析 Ghidra 项目中的全部二进制，提供反编译、交叉引用、调用图、符号与字符串搜索、基于索引的语义代码检索，以及重命名、类型和注释编辑。另附基于 HTTP 的独立命令行客户端，以及可选的图形界面模式：由服务器自行启动 Ghidra 图形界面并加以操控。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-17"},{"id":"goresym","name":"GoReSym","name_zh":"GoReSym Go 符号恢复工具","url":"https://github.com/mandiant/GoReSym","evidence_url":"https://github.com/mandiant/GoReSym/blob/722897e0a80da0a06c00c5e40591a253a551f04e/README.md","description_en":"Recover Go build metadata, function names and address ranges, source file and line tables, embedded types and strings from Go binaries, including stripped and some malformed unpacked samples. JSON output can be imported into IDA Pro with the included IDAPython script.","description_zh":"从 Go 二进制中恢复构建元数据、函数名与地址范围、源文件和行号表、内嵌类型及字符串，也可处理已剥离符号以及部分经 UPX 等脱壳后结构异常的样本。JSON 输出可借助附带的 IDAPython 脚本导入 IDA Pro。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-17"},{"id":"revng","name":"rev.ng","name_zh":"rev.ng 二进制分析框架与反编译器","url":"https://github.com/revng/revng","evidence_url":"https://github.com/revng/revng/blob/57d81a3b0d946ccaa9fed8a13c9871dc36b94747/share/doc/revng/what-is-revng.md","description_en":"Open-source decompilation pipeline that lifts x86-64, AArch64, i386, ARM and MIPS code with QEMU, runs LLVM-based analyses and emits C designed to be valid and recompilable. Data layout analysis infers structures from pointer use; an editable YAML model and Python or TypeScript wrappers support automation. Its VSCode-based UI is a separate closed-beta product, with commercial plans announced.","description_zh":"开源反编译流水线：借助 QEMU 将 x86-64、AArch64、i386、ARM 和 MIPS 代码提升为与架构无关的表示，以 LLVM 进行分析，并输出以合法、可重新编译为设计目标的 C 代码。数据布局分析可根据指针用法推断数据结构；可编辑的 YAML 模型及 Python、TypeScript 封装便于自动化。基于 VSCode 的界面是单独的产品，目前处于封闭测试阶段，并计划推出商业方案。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-17"},{"id":"leanrea-skill","name":"LeanREA","name_zh":"LeanREA 命令行逆向分析技能","url":"https://github.com/aicodeking/leanrea","evidence_url":"https://github.com/aicodeking/leanrea/blob/09ba4aa0217f82cd880f855a60b877f59f39b22b/README.md","description_en":"An independent agent skill that routes application and binary investigations through ordinary command-line tools. It supplies batched triage recipes, targeted source/disassembly reading and explicit seen/inferred/unknown evidence labels, accompanied by a small author-reported comparison against an REA MCP workflow.","description_zh":"独立智能体技能，使用普通命令行工具开展应用与二进制调查，提供批量初查、针对性源码／反汇编阅读，以及明确的已观察／推断／未知证据标记，并附有作者报告的 REA MCP 工作流小规模对照。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["app","binary"],"verified_at":"2026-10-17"},{"id":"uu-remote-linux-protocol-case","name":"UU Remote on Linux: an unofficial protocol implementation","name_zh":"Linux 上的 UU 远程：非官方协议实现","url":"https://github.com/VallierDev/uu-remote-linux","evidence_url":"https://github.com/VallierDev/uu-remote-linux/blob/696cf10e334b2e7fe1afcb698b354c09ee328447/README.en.md","description_en":"Implements an unofficial native Linux host for NetEase UU Remote, using protocol behavior the maintainer says was recovered from official-client traffic and shipped programs. The Rust implementation connects selected desktop, input and auxiliary-tool channels to Linux services; an additional Linux viewer remains experimental. The author attributes development to Claude and Codex, without establishing REA use.","description_zh":"实现网易 UU 远程的非官方原生 Linux 被控端；维护者称协议行为来自对官方客户端流量及已发布程序的调查。Rust 实现将选定的桌面、输入和辅助工具通道连接到 Linux 服务，另有仍处于实验阶段的 Linux 控制端。作者将开发归因于 Claude 与 Codex，未确立 REA 使用。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-18"},{"id":"perfect-dark-matching-decomp-case","name":"Perfect Dark: matching Nintendo 64 decompilation","name_zh":"Perfect Dark：生成一致 ROM 的 Nintendo 64 反编译重建","url":"https://github.com/n64decomp/perfect_dark","evidence_url":"https://github.com/n64decomp/perfect_dark/blob/169ed48bdcbfb3b568b028bd5bebb27680073514/README.md","description_en":"Reconstructs Perfect Dark’s Nintendo 64 code with a documented matching-ROM build. The project combines reconstructed source with assets from a user-supplied original ROM, then checks version-specific artifact hashes. It is a reproducible-build research case, distinct from the separate native PC port; matching results remain project-reported here.","description_zh":"重建 Perfect Dark 的 Nintendo 64 代码，并提供生成一致 ROM 的构建流程。项目将重建源码与使用者自备原 ROM 中的素材结合，再检查各版本产物的哈希。这是可复现构建研究案例，与独立的原生 PC 移植不同；此处的一致性结果仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"tclimate-cloud-controls-case","name":"TCLimate: reconstructing selected TCL Home cloud controls","name_zh":"TCLimate：重建选定的 TCL Home 云端控制","url":"https://github.com/umarz317/TCLimate","evidence_url":"https://github.com/umarz317/TCLimate/blob/2a33c2013dbf3f297238131ca9eb6e287b2beb67/Docs/Investigation.md","description_en":"Implements selected TCL Home air-conditioner controls and electricity reporting in a native macOS menu-bar app. It adapts earlier community protocol work and documents an Android-module investigation to recover a separate statistics request. Reported validation checks cloud state, not independent physical operation or complete device equivalence.","description_zh":"在原生 macOS 菜单栏应用中实现选定的 TCL Home 空调控制与用电量报告。项目改编既有社区协议实现，并记录通过调查 Android 模块恢复另一条统计请求的过程。报告的验证检查云端状态，不等于独立核实设备实际运行或完整设备等价性。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-18"},{"id":"universal-modder-agent-toolkit","name":"Universal Modder","name_zh":"Universal Modder 游戏模组智能体工具包","url":"https://github.com/rehan-remade/universal-modder","evidence_url":"https://github.com/rehan-remade/universal-modder/blob/6a8865ae171b406f50892c7f46fc5f45655269eb/README.md","description_en":"Packages agent skills, three role briefs, a Python CLI and preconfigured fal MCP settings for modding PC games the user owns. Its reverse-engineering guidance sends managed, native and data-format work to external decompilers and debuggers, and requires a round-trip check before a reverse-engineered file format is used; one worked example ships an Age of Empires II sprite writer built this way. It is a modding toolkit with agent-written field notes, not a game decompilation, and its example results remain project-reported.","description_zh":"为修改用户自有的 PC 游戏打包智能体技能、三份角色说明、Python 命令行工具及预配置的 fal MCP 设置。其逆向分析指南把托管代码、原生代码和数据格式工作交给外部反编译器与调试器，并要求逆向得到的文件格式先通过往返检查再投入使用；其中一个示例附带按此方法实现的 Age of Empires II 精灵写入器。它是附带智能体实践笔记的模组工具包，不是游戏反编译重建，示例结果仍为项目报告。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["game"],"verified_at":"2026-10-18"},{"id":"browserbase-claude-chrome-bridge-case","name":"Browserbase plugin: re-hosting Claude in Chrome’s browser bridge","name_zh":"Browserbase 插件：将 Claude in Chrome 浏览器桥接转接到云端","url":"https://github.com/browserbase/claude-code-plugin","evidence_url":"https://github.com/browserbase/claude-code-plugin/blob/b399af34a1b1cc365d1e1c0089823c4fa5e10ea5/forwarding-server.js","description_en":"Stands in for the Claude in Chrome extension side of Claude Code’s local browser bridge and runs the requested actions in Browserbase cloud browsers. The author’s thread describes the reverse-engineered framing, a 4-byte little-endian length before each JSON tool call, and the plugin maps 17 named tools onto Stagehand/CDP operations. It is an archived interoperability shim with several placeholder tools, not recovered Anthropic code or a verified equivalent of the extension.","description_zh":"在 Claude Code 本地浏览器桥接中替代 Claude in Chrome 扩展一端，把请求的操作交给 Browserbase 云端浏览器执行。作者的帖子串描述了逆向得到的消息格式，即每条 JSON 工具调用前加 4 字节小端长度；插件则将 17 个具名工具映射为 Stagehand／CDP 操作。这是已归档的互操作适配层，部分工具仅为占位实现，并非恢复出的 Anthropic 代码，也未经验证与扩展等价。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-18"},{"id":"visor-ray-ban-meta-client-case","name":"Visor: an independent Ray-Ban Meta glasses client","name_zh":"Visor：独立的 Ray-Ban Meta 眼镜客户端","url":"https://github.com/macedonga/visor","evidence_url":"https://github.com/macedonga/visor/blob/8caaa12df919c014c249efb71fdfa32b263f6c3e/README.md","description_en":"Implements an Android replacement for the Meta AI companion app that speaks the Ray-Ban Meta glasses’ own Bluetooth and Wi-Fi Direct protocol, imports media, exposes settings and answers “Hey Meta” with a model the user chooses. The project wiki documents the link layers, encryption, services and Meta-side ownership steps, and lists 153 open questions. Testing is on real glasses rather than test suites, so behavior beyond the stated model and firmware remains unverified.","description_zh":"实现可替代 Meta AI 配套应用的 Android 客户端：直接使用 Ray-Ban Meta 眼镜自有的蓝牙与 Wi-Fi Direct 协议，导入媒体、提供设置，并用用户选择的模型回应“Hey Meta”。项目 wiki 记录了链路分层、加密、服务及 Meta 端的所有权流程，并列出 153 个未解问题。项目以实机试用代替测试套件，因此所述型号和固件之外的行为仍未经验证。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-18"},{"id":"sms-pc-port-case","name":"Super Mario Sunshine: a native PC port from an AI-assisted decompilation","name_zh":"Super Mario Sunshine：基于 AI 辅助反编译的原生 PC 移植","url":"https://github.com/chasem-dev/sms-pc-port","evidence_url":"https://github.com/chasem-dev/sms-pc-port/blob/a2ff4eef099b22b2af487d1b5e3ac09ffe667d31/README.md","description_en":"Builds a native PC port of Super Mario Sunshine’s North American release from a pinned matching-decompilation fork, adding a host platform layer for graphics, disc, audio, input and OS services. The fork’s README says AI was used extensively to reconstruct and match its code; the port documents scripted regression hashes and lockstep comparisons with retail captures. Functions that do not yet match can still behave differently from retail, and the game must come from the user’s own disc image.","description_zh":"以固定版本的一致性反编译分支为基础，构建 Super Mario Sunshine 北美版的原生 PC 移植，并为图形、光盘、音频、输入和系统服务提供宿主平台层。该分支的 README 称，其代码的重建与匹配大量借助 AI；移植项目记录了脚本化回归哈希，以及与原版捕获数据的逐步对照。尚未匹配的函数仍可能与原版行为不同，游戏数据须来自使用者自己的光盘镜像。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"zelda-mm-decomp-case","name":"Majora’s Mask: matching US N64 decompilation","name_zh":"《姆吉拉的假面》：生成一致美版 N64 ROM 的反编译重建","url":"https://github.com/zeldaret/mm","evidence_url":"https://github.com/zeldaret/mm/blob/bf6bd9d0d3a90fe2f8960e034fbfd328e8bdef22/README.md","description_en":"Recreates a C source base for The Legend of Zelda: Majora’s Mask from information in the game and static or dynamic analysis, then rebuilds the US Nintendo 64 ROM. The build takes assets and assembly from a user-supplied ROM and checks the output against stored MD5 checksums. The team states it will not produce a PC port; the separately curated Zelda 64: Recompiled only credits it for headers and some functions.","description_zh":"依据游戏内信息和静态或动态分析，为《塞尔达传说：姆吉拉的假面》重建 C 源码库，并重新构建美版 Nintendo 64 ROM。构建流程从使用者自备的 ROM 中取得素材和汇编，再用仓库保存的 MD5 校验输出。团队声明不会制作 PC 移植；另行收录的 Zelda 64: Recompiled 只注明借用了其头文件和部分函数。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"wine-uwp-store-apps-case","name":"wine-uwp: running packaged Windows Store apps on a patched Wine","name_zh":"wine-uwp：在修改版 Wine 上运行打包的 Windows 商店应用","url":"https://github.com/designgears/wine-uwp","evidence_url":"https://github.com/designgears/wine-uwp/blob/1cf79d025e0c18167de803820345a1c5f82fd17d/README.md","description_en":"Extends Wine 11.17 so that signed MSIX Store apps, with Shapr3D as the main target, install and run on Linux without their source or symbols. About 49,000 changed lines add a DirectComposition implementation, composition swap chains and an app-model host, while Microsoft’s own XAML and app-model DLLs, harvested from a Windows 11 image on the user’s machine, run unmodified. The author says Claude did most of the reverse engineering and code; app support is uneven and checked by a project regression suite.","description_zh":"扩展 Wine 11.17，使已签名的 MSIX 商店应用（主要目标为 Shapr3D）无需源码或符号即可在 Linux 上安装运行。约 49,000 行改动新增了 DirectComposition 实现、合成交换链和应用模型宿主；微软自己的 XAML 与应用模型 DLL 则在使用者机器上从 Windows 11 镜像中提取后原样运行。作者称大部分逆向工程和代码由 Claude 完成；各应用支持程度不一，由项目回归测试检查。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-10-18"},{"id":"dlssnr-amd-neural-rendering-case","name":"DLSSNR-AMD: reimplementing DLSS 5 neural rendering for RDNA4","name_zh":"DLSSNR-AMD：为 RDNA4 重新实现 DLSS 5 神经渲染","url":"https://github.com/mochizuki0323/DLSSNR-AMD","evidence_url":"https://github.com/mochizuki0323/DLSSNR-AMD/blob/ab00d2b23584de0f42ac91eca4d7d2d2fad11465/README.md","description_en":"Reimplements the neural-rendering network of NVIDIA’s DLSS 5 library as Vulkan compute shaders for AMD RX 9000 (RDNA4) cards and supplies it to games through an NGX-compatible core and ReShade or Vulkan-layer routes. The weights are not distributed: installers extract them, hash-checked, from the user’s own nvngx_dlssnr.dll 310.9.16 or 310.8.0. The project compares its output with NVIDIA’s DLL on an RTX 5090 and reports close, not bit-identical, pictures.","description_zh":"将 NVIDIA DLSS 5 库中的神经渲染网络重新实现为面向 AMD RX 9000（RDNA4）显卡的 Vulkan 计算着色器，并通过兼容 NGX 的核心模块以及 ReShade 或 Vulkan 层等途径提供给游戏。项目不分发权重：安装程序从使用者自己的 nvngx_dlssnr.dll 310.9.16 或 310.8.0 中提取权重并核对哈希。项目将输出与 NVIDIA DLL 在 RTX 5090 上的结果对比，报告画面接近但并非逐位一致。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"botw-decomp-case","name":"Breath of the Wild: per-function matching decompilation of the Switch executable","name_zh":"《旷野之息》：Switch 主程序的逐函数一致性反编译","url":"https://github.com/zeldaret/botw","evidence_url":"https://github.com/zeldaret/botw/blob/e78c02499d0f108ae9c00158198289764c5980fe/README.md","description_en":"Reimplements part of Breath of the Wild’s Switch v1.5.0 main executable in C++ and checks each function against the original machine code. The project calls itself a hybrid decompilation/reimplementation: it contains no assets, its ELF holds only reimplemented functions and cannot run the game, and porting is an explicit non-goal.","description_zh":"以 C++ 重新实现《塞尔达传说 旷野之息》Switch v1.5.0 主程序的部分代码，并逐个函数与原始机器码比对。项目自称是反编译与重新实现的混合体：不含游戏素材，生成的 ELF 仅包含已重新实现的函数、无法运行游戏，移植到其他平台也明确不是目标。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"skyward-sword-decomp-case","name":"Skyward Sword: Wii decompilation with hash-checked relinking","name_zh":"《天空之剑》：以哈希校验重新链接的 Wii 版反编译","url":"https://github.com/zeldaret/ss","evidence_url":"https://github.com/zeldaret/ss/blob/d3d8e3cbf3d353b2231f06690965cac5366e28a1/README.md","description_en":"Reconstructs C++ source for The Legend of Zelda: Skyward Sword’s Wii main.dol and REL modules, starting from the user’s NTSC-U 1.0 (SOUE01) disc files. Objects marked matching are compiled from source and linked with objects split from the original, and the result is checked against SHA-1 hashes; the repository ships no assets or assembly and is not a port.","description_zh":"以使用者自备的 NTSC-U 1.0（SOUE01）光盘文件为起点，为《塞尔达传说 天空之剑》Wii 版的 main.dol 和 REL 模块重建 C++ 源码。标为一致的对象由源码编译，再与从原文件拆分出的其余对象链接，并以 SHA-1 哈希校验结果；仓库不含素材或汇编，也不是移植。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"2ship2harkinian-mm-port-case","name":"2 Ship 2 Harkinian: a native Majora’s Mask port built on the decompilation","name_zh":"2 Ship 2 Harkinian：基于反编译的《姆吉拉的假面》原生移植","url":"https://github.com/2ship2harkinian/2ship2harkinian","evidence_url":"https://github.com/2ship2harkinian/2ship2harkinian/blob/f1dda4c28cb9ed7cc80d8c78337ee31a8d2c7d0e/README.md","description_en":"Builds native Windows, Linux and macOS versions of The Legend of Zelda: Majora’s Mask from an adapted copy of the zeldaret/mm decompilation, with libultraship reimplementing N64 SDK functions. Game data comes from a user-supplied ROM and is packed into an archive that custom asset packs can override. It targets a playable PC port with enhancements, not a byte-identical ROM.","description_zh":"以改编自 zeldaret/mm 反编译的源码为基础，构建《塞尔达传说：姆吉拉的假面》的原生 Windows、Linux 和 macOS 版本，并由 libultraship 重新实现 N64 SDK 函数。游戏数据来自使用者自备的 ROM，打包为可被自定义素材包覆盖的存档文件。它面向带增强功能的可玩 PC 移植，而不是逐字节一致的 ROM。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"ship-of-harkinian-oot-port-case","name":"Ship of Harkinian: a native Ocarina of Time port built on the decompilation","name_zh":"Ship of Harkinian：基于反编译源码的《时之笛》原生移植","url":"https://github.com/HarbourMasters/Shipwright","evidence_url":"https://github.com/HarbourMasters/Shipwright/blob/dd702b0679f2240209763d00277e7343ee1424b9/README.md","description_en":"Builds Ocarina of Time as a native PC application from the OoT decompilation’s source, with libultraship standing in for the N64 libultra SDK and DirectX 11, OpenGL or Metal rendering. No game assets are shipped: they are converted from the user’s supported ROM into an .o2r archive, and the port adds save states, alternate and custom assets and other enhancements.","description_zh":"以《时之笛》反编译项目的源码为基础，将游戏构建为原生 PC 程序，用 libultraship 替代 N64 的 libultra SDK，并以 DirectX 11、OpenGL 或 Metal 渲染。不随附游戏素材，而是从使用者自备的受支持 ROM 转换生成 .o2r 归档；移植版还加入了即时存档、替换与自定义素材等增强功能。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"zelda-tmc-decomp-case","name":"The Minish Cap: a GBA decompilation targeting five ROMs","name_zh":"《缩小帽》：面向五个 ROM 的 GBA 反编译重建","url":"https://github.com/zeldaret/tmc","evidence_url":"https://github.com/zeldaret/tmc/blob/6fb6dfb4a7efbe24d0fd1dda5097af6131faacde/README.md","description_en":"Recreates a C source base for The Legend of Zelda: The Minish Cap from information in the game and static or dynamic analysis, building five Game Boy Advance ROMs: USA, EU, JP and two demos. Each version takes its assets from a user-supplied original ROM, and normal builds check the output’s SHA-1 hash. The project remains a work in progress, and some parts of the ROM may not yet be shiftable.","description_zh":"依据游戏内信息和静态或动态分析，为《塞尔达传说：缩小帽》重建 C 源码库，可构建美版、欧版、日版及两个演示版共五个 Game Boy Advance ROM。每个版本的素材都来自使用者自备的原始 ROM，常规构建会核对产物的 SHA-1 哈希。项目仍在进行中，ROM 的部分内容可能尚不能移动。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"ocarina-of-time-decomp-case","name":"Ocarina of Time: decompilation with MD5-checked ROM builds for 16 versions","name_zh":"《时之笛》：16 个版本均以 MD5 校验 ROM 构建的反编译","url":"https://github.com/zeldaret/oot","evidence_url":"https://github.com/zeldaret/oot/blob/8a3634ca774a9b58d822cbc2cc09309f31eac6a4/README.md","description_en":"Recreates a C source base for Ocarina of Time that rebuilds 16 Nintendo 64, GameCube and iQue Player ROM versions, using information from the game and static and dynamic analysis. Assets come from the user’s own ROM and each default build is checked against that version’s MD5; README states the project is not producing a PC port and still calls the repository a work in progress.","description_zh":"借助游戏本身的信息以及静态与动态分析，为《时之笛》重建 C 源码库，可重新构建 Nintendo 64、GameCube 和 iQue Player 共 16 个 ROM 版本。素材取自使用者自备的 ROM，默认构建会以对应版本的 MD5 校验；README 说明项目不制作 PC 移植，并仍称仓库处于开发中。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"baocut-design-canvas-case","name":"BaoCut Design: porting reconstructed canvas and design-system editors","name_zh":"BaoCut Design：移植重建的设计稿与设计系统编辑器","url":"https://github.com/JimLiu/baocut/tree/7aa049e82e1367da013b7aba80f0b79033fa04ad/packages/design-runtime","evidence_url":"https://github.com/JimLiu/baocut/blob/7aa049e82e1367da013b7aba80f0b79033fa04ad/packages/design-runtime/README.md","description_en":"Documents BaoCut’s design-canvas and design-system editors, which the project says it ported 1:1 from TypeScript reconstructions of Claude Design’s editors and hosts in agent sessions with annotation and export. Its runtime notes record identifier fixes checked against the original scripts and a structural comparison matching 19,111 of 20,463 canvas main-page functions. Unreviewed differences, the unpublished reconstruction record and reuse rights remain open; no hosted-backend recovery is claimed.","description_zh":"记录 BaoCut 的设计稿（画布）与设计系统编辑器；项目称其按 1:1 移植自 Claude Design 编辑器的 TypeScript 重建，并在智能体会话中提供标注与导出。运行时说明记录了对照原脚本修正的标识符，以及画布主页面 20463 个函数中有 19111 个结构完全一致的比对结果。未审阅的差异、未公开的重建记录及复用权利仍待确认；不主张恢复任何托管后端。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","website"],"verified_at":"2026-10-18"},{"id":"project-arwing-star-fox-recomp-case","name":"Project Arwing: Star Fox recompiled from a matching disassembly","name_zh":"Project Arwing：由一致性反汇编重编译的 Star Fox","url":"https://github.com/carlosrmz009/arwing","evidence_url":"https://github.com/carlosrmz009/arwing/blob/d8fe7aaf67e0f4ba77c9814852d2ffaccd7d63c7/README.md","description_en":"Disassembles Star Fox’s 65816 and SuperFX code from runtime coverage and recursive descent, reassembles it into the original ROM, then translates it statically to C on a from-scratch SNES runtime for Windows, macOS and Linux. Code never reached in recorded sessions, and RAM code that no longer matches the ROM, falls back to an interpreter; the README reports identical per-frame hashes for both paths. The generated C is a mechanical translation rather than hand-decompiled source, and results remain project-reported.","description_zh":"依据运行覆盖率和递归下降反汇编 Star Fox 的 65816 与 SuperFX 代码，重新汇编出与原 ROM 一致的文件，再静态翻译为 C，运行于从零编写的 SNES 运行时，支持 Windows、macOS 和 Linux。录制会话中未执行到的代码，以及与 ROM 不再一致的 RAM 代码，回退到解释器执行；README 报告两条路径的逐帧哈希一致。生成的 C 是机械翻译而非手工反编译的源码，结果仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"project-arwing-2-star-fox-2-recomp-case","name":"Project Arwing (2): Star Fox 2 recompiled from a matching disassembly","name_zh":"Project Arwing (2)：由一致性反汇编重编译的 Star Fox 2","url":"https://github.com/carlosrmz009/arwing2","evidence_url":"https://github.com/carlosrmz009/arwing2/blob/15af0bfd85d00a79e8913094f7242e1b938f093f/README.md","description_en":"Rebuilds Star Fox 2 from a coverage-seeded 65816 and SuperFX disassembly that reassembles to the original ROM, then translates it statically to C for native Windows, macOS and Linux builds. Unreached code and RAM code that differs from the ROM run through an interpreter, and the README reports identical per-frame hashes against interpreted runs. It accepts the SNES Classic release image, not the 1995 prototypes; results remain project-reported.","description_zh":"从以运行覆盖率为种子的 65816 与 SuperFX 反汇编重建 Star Fox 2：反汇编可重新汇编为与原 ROM 一致的文件，再静态翻译为 C，生成原生 Windows、macOS 和 Linux 版本。未执行到的代码及与 ROM 不一致的 RAM 代码由解释器执行，README 报告其与解释运行的逐帧哈希一致。项目接受 SNES Classic 版映像，不支持 1995 年的原型版；结果仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"little-planet-sonic-cd-recomp-case","name":"Little Planet: Sonic CD recompiled from a matching disassembly","name_zh":"Little Planet：由一致性反汇编重编译的 Sonic CD","url":"https://github.com/carlosrmz009/littleplanet","evidence_url":"https://github.com/carlosrmz009/littleplanet/blob/658d834d53d90baf6a899fa1e5d81a6fee187bbb/README.md","description_en":"Disassembles every executable file on the Sonic CD disc from runtime coverage and recursive descent, reassembles them byte-identically, and translates the code statically to C on a from-scratch Mega-CD runtime that replaces the BIOS with a high-level implementation. Recompiled blocks run only where memory still holds the code they came from, and a script compares 96 stage runs frame by frame against the interpreter. The project also patches in widescreen and per-zone saves; results remain project-reported.","description_zh":"依据运行覆盖率和递归下降，反汇编 Sonic CD 光盘上的全部可执行文件并逐字节一致地重新汇编，再将代码静态翻译为 C，运行于从零编写、以高层实现替代 BIOS 的 Mega-CD 运行时。重编译代码块只在内存仍为其来源代码时执行，并有脚本以 96 段关卡运行逐帧对照解释器。项目还以补丁加入宽屏和逐区存档；结果仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"vf2-decomp-differential-recovery-case","name":"vf2-decomp: differentially validated Virtua Fighter 2 recovery","name_zh":"vf2-decomp：经差分验证的 Virtua Fighter 2 代码恢复","url":"https://github.com/celsowm/vf2-decomp","evidence_url":"https://github.com/celsowm/vf2-decomp/blob/9a9f7270f090cfa0f38b0ec6a22c3e53dae4bd18/README.md","description_en":"Recovers Virtua Fighter 2 Version 2.1’s Sega Model 2A i960 program into portable, non-matching C17, accepting each recovered path only when it matches a reference i960 executor at controlled boundaries. The repository adds ROM validation, i960 and 68000 analysis tools, a bounded Model 2A hardware model and snapshot-based differential runners. README states that it is not yet a playable port; match flow, combat, physics, AI, rasterization and much of the audio remain open.","description_zh":"将 Virtua Fighter 2 Version 2.1 的 Sega Model 2A i960 程序恢复为可移植、非一致性的 C17 代码，每条恢复路径须在受控边界上与参考 i960 执行器一致才被接受。仓库还提供 ROM 校验、i960 与 68000 分析工具、有限范围的 Model 2A 硬件模型，以及基于快照的差分运行器。README 说明它尚不是可游玩的移植；对战流程、格斗、物理、AI、光栅化及大部分音频仍未完成。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"z2rs-zelda2-reconstruction-case","name":"z2rs: an incremental Rust reconstruction of Zelda II checked against an emulator","name_zh":"z2rs：以模拟器对照逐步重建《塞尔达传说 II》的 Rust 项目","url":"https://github.com/troyedwardsjr/z2rs","evidence_url":"https://github.com/troyedwardsjr/z2rs/blob/4fe7a35f8ccfdccdf32421badf97b48b02d0127f/README.md","description_en":"Rebuilds Zelda II: The Adventure of Link (NES) in Rust for desktop, browser and Android by replacing the game’s 6502 routines one at a time. A built-in interpreter still runs the user’s ROM and hands ported routines to Rust, while a verifier compares RAM, sprites, palette and frames with a reference emulator. It is a behavioral, clean-room-style reconstruction guided by a community disassembly, not a decompilation or a finished standalone engine.","description_zh":"以 Rust 重建 NES 游戏《塞尔达传说 II：林克的冒险》，逐个替换游戏的 6502 例程，可运行于桌面、浏览器和 Android。内置解释器仍执行使用者的 ROM，并把已移植例程交给 Rust 实现；验证工具将 RAM、精灵、调色板和画面与参考模拟器逐帧比较。它是参考社区反汇编、以行为为准的类净室重建，而不是反编译，也还不是独立完整的引擎。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"sm64ex-pc-port-case","name":"sm64ex: an enhanced Super Mario 64 PC port from the decompilation","name_zh":"sm64ex：基于反编译成果的 Super Mario 64 增强版 PC 移植","url":"https://github.com/sm64pc/sm64ex","evidence_url":"https://github.com/sm64pc/sm64ex/blob/d7ca2c04364a6dd0dac58b47151e04e26887e6f0/README.md","description_en":"Builds native Super Mario 64 executables from decompiled source, extending the sm64-port fork of the n64decomp reconstruction with renderer, input, camera, save-format and external-data options. Game assets are extracted from the user’s own ROM at build time. It is a non-matching enhanced port, not a byte-identical ROM reconstruction.","description_zh":"基于反编译源码构建原生 Super Mario 64 可执行文件，在 n64decomp 重建成果的 sm64-port 分支之上，增加渲染器、输入、视角、存档格式和外部数据等选项。游戏素材在构建时从使用者自备的 ROM 中提取。这是非一致性的增强移植，而不是逐字节一致的 ROM 重建。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"ghostship-sm64-port-case","name":"Ghostship: a libultraship native port of Super Mario 64","name_zh":"Ghostship：基于 libultraship 的 Super Mario 64 原生移植","url":"https://github.com/HarbourMasters/Ghostship","evidence_url":"https://github.com/HarbourMasters/Ghostship/blob/40eef13823a954a466574dc78e73187a17a2dd42/README.md","description_en":"Builds Super Mario 64 as a native PC, Switch and Android program by compiling decompilation-style game source against the libultraship platform library. A bundled extractor converts the user’s US or Japanese ROM into an O2R archive at first launch or build time. The project ships modern renderers, configuration menus and mod-archive loading, not a matching ROM.","description_zh":"将反编译风格的游戏源码编译到 libultraship 平台库上，把 Super Mario 64 构建为原生 PC、Switch 和 Android 程序。附带的提取工具会在首次启动或构建时，把使用者自备的美版或日版 ROM 转换为 O2R 存档。项目提供现代渲染器、配置菜单和模组存档加载，而不是生成一致的 ROM。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"sms-matching-decomp-case","name":"Super Mario Sunshine: an in-progress matching GameCube decompilation","name_zh":"Super Mario Sunshine：仍在推进的 GameCube 一致性反编译重建","url":"https://github.com/doldecomp/sms","evidence_url":"https://github.com/doldecomp/sms/blob/b2350a119b0e113e6cebc389fda9af00328ee85e/README.md","description_en":"Reconstructs Super Mario Sunshine’s C++ source so that the original Metrowerks compiler reproduces byte-identical object files for four GameCube releases and the Switch 3D All-Stars build. The target binary comes from the user’s own disc image, and objdiff compares rebuilt objects function by function. The work is incomplete, and the repository publishes contribution rules for AI agents alongside its human workflow.","description_zh":"重建 Super Mario Sunshine 的 C++ 源码，目标是让原版 Metrowerks 编译器为四个 GameCube 发行版本及 Switch 版 3D All-Stars 生成逐字节一致的目标文件。目标二进制取自使用者自备的光盘镜像，objdiff 按函数比对重建出的目标文件。工作尚未完成，仓库在人工流程之外还发布了面向 AI 智能体的贡献规则。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"dusklight-twilight-princess-port-case","name":"Dusklight: a native Twilight Princess port built on the decompilation","name_zh":"Dusklight：基于反编译的《黄昏公主》原生移植","url":"https://github.com/TwilitRealm/dusklight","evidence_url":"https://github.com/TwilitRealm/dusklight/blob/34a144a493b7f57adeb4034d382317c826eb5c8d/README.md","description_en":"Reimplements Twilight Princess as a native application for desktop and mobile platforms, building on the zeldaret/tp decompilation and the Aurora GameCube/Wii compatibility layer. It runs from the user’s own disc image with no bundled assets and aims to stay accurate to the original while adding options, enhancements and mods.","description_zh":"以 zeldaret/tp 反编译项目和 Aurora GameCube／Wii 兼容层为基础，将《塞尔达传说 黄昏公主》重新实现为桌面与移动平台的原生应用。程序读取使用者自备的光盘镜像运行，不附带任何素材；项目力求忠于原作，同时加入新选项、增强功能和模组。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"metaforce-metroid-prime-case","name":"Metaforce: a Metroid Prime engine reimplementation rebuilt on the decompilation","name_zh":"Metaforce：在反编译之上重建的《密特罗德 Prime》引擎重实现","url":"https://github.com/AxioDL/metaforce","evidence_url":"https://github.com/AxioDL/metaforce/blob/de8fc69bd7f345d6cf5f0c8fc2798295e22522d3/README.md","description_en":"Started in 2015 as a reverse-engineered reimplementation of the Metroid Prime engine, Metaforce has been rewritten on top of the PrimeDecomp matching decompilation. Its native app compiles that game code as non-matching C++ for desktop and mobile through the Aurora GameCube compatibility layer and loads a user-selected disc image. The README says builds are unavailable while the rewrite stabilizes.","description_zh":"Metaforce 于 2015 年作为《密特罗德 Prime》引擎的逆向重实现项目启动，现已在 PrimeDecomp 一致性反编译之上重写。其原生应用借助 Aurora GameCube 兼容层，将这些游戏代码以非一致模式编译为桌面和移动端程序，并读取使用者选择的光盘镜像。README 表示重写稳定之前暂不提供构建版本。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"sms-english-gmse01-decomp-case","name":"Super Mario Sunshine (USA): an AI-assisted matching decompilation fork","name_zh":"Super Mario Sunshine（美版）：AI 辅助的一致性反编译分支","url":"https://github.com/chasem-dev/sms-english","evidence_url":"https://github.com/chasem-dev/sms-english/blob/d5f4eb3eb54ac49638b5513efb1fc368068805da/README.md","description_en":"Extends the doldecomp Super Mario Sunshine decompilation to the North American GMSE01 release. The README says AI was used extensively, and the repository’s agent rules, work order and progress files describe batch-based Claude and Codex orchestration. Its rebuilt DOL is reported byte-identical, but unfinished objects are still linked from code extracted from the user’s disc.","description_zh":"将 doldecomp 的 Super Mario Sunshine 反编译工作扩展到北美 GMSE01 版本。README 称大量使用了 AI，仓库中的智能体规则、工作顺序和进度文件也记录了按批次编排 Claude 与 Codex 的方式。项目报告重建的 DOL 逐字节一致，但尚未完成的目标文件仍取自使用者光盘中提取的代码。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"dk64-recompiled-case","name":"Donkey Kong 64: Recompiled — an N64Recomp native port","name_zh":"Donkey Kong 64: Recompiled：基于 N64Recomp 的原生移植","url":"https://github.com/Rainchus/Donkey-Kong-64-Recompiled","evidence_url":"https://github.com/Rainchus/Donkey-Kong-64-Recompiled/blob/3b0c36d3fbfeb0b5d2c47923f35cf84b31edcbf7/README.md","description_en":"Uses N64Recomp to statically recompile the US Nintendo 64 release of Donkey Kong 64 into a native port, with RT64 as the renderer. The port is not built from decompiled source, but borrows headers and some functions from the in-progress DK64 decompilation for patches and enhancements. Its recompiler configuration reads a checked-in symbol dump and the ROM rather than a decompilation ELF.","description_zh":"使用 N64Recomp 将美版 Nintendo 64《大金刚 64》静态重编译为原生移植版，并以 RT64 作为渲染器。该移植并非基于反编译源码构建，但借用仍在进行中的 DK64 反编译项目的头文件和部分函数来实现补丁与增强。其重编译配置读取仓库内的符号转储和 ROM，而非反编译生成的 ELF。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"twilight-princess-decomp-case","name":"Twilight Princess: a decompilation with fully matching GameCube code","name_zh":"《黄昏公主》：GameCube 版代码完全一致的反编译","url":"https://github.com/zeldaret/tp","evidence_url":"https://github.com/zeldaret/tp/blob/c8fa8c9e2aab72cf4e5db0e5d1c84a9ea6ee6eb0/README.md","description_en":"Reconstructs Twilight Princess source that compiles back to binaries identical to the originals, building GameCube, Wii and Nvidia Shield releases from one codebase through conditional compilation. README reports the GameCube code as completely matching but not every translation unit linked yet, with Debug and Wii alignment ongoing; the repository ships no assets or assembly and will not produce a port.","description_zh":"重建《塞尔达传说 黄昏公主》的源码，使其能重新编译出与原版一致的二进制文件；GameCube、Wii 与 Nvidia Shield 各版本通过条件编译共用同一套代码。README 报告 GameCube 版代码已完全一致，但尚未链接全部翻译单元，调试版与 Wii 版的对齐仍在进行；仓库不含素材或汇编，也不会制作移植。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"sotn-matching-decomp-case","name":"Castlevania: Symphony of the Night: matching decompilation across PlayStation, PSP and Saturn builds","name_zh":"Castlevania: Symphony of the Night：覆盖 PlayStation、PSP 与 Saturn 版本的一致性反编译","url":"https://github.com/Xeeynamo/sotn-decomp","evidence_url":"https://github.com/Xeeynamo/sotn-decomp/blob/eddaf22fe86f5189b85fd34915afe6564f19df20/README.md","description_en":"Recreates C source for Castlevania: Symphony of the Night from its PlayStation, PSP and Saturn binaries, aiming for code that compiles byte for byte to the original game files. The work-in-progress build combines decompiled code with assets and assembly extracted from a user-supplied disc image, then checks per-version SHA-1 hashes. Native PC experiments in the same tree are documented as unfinished and are not a released port.","description_zh":"从《恶魔城 月下夜想曲》的 PlayStation、PSP 和 Saturn 版二进制重建 C 源码，目标是逐字节编译出与原游戏文件一致的产物。这一进行中的构建将已反编译代码与从使用者自备光盘镜像提取的素材和汇编结合，再按版本检查 SHA-1 哈希。同一仓库中的原生 PC 实验被文档说明为尚未完成，并不是已发布的移植。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"lego-island-portable-case","name":"LEGO Island, portable: a multi-platform port of the decompiled source","name_zh":"LEGO Island 可移植版：反编译源码的多平台移植","url":"https://github.com/isledecomp/isle-portable","evidence_url":"https://github.com/isledecomp/isle-portable/blob/d0bf04fe605d7ec2a291e65df08bf26712452379/README.md","description_en":"Adapts the LEGO Island decompilation into a portable build for desktop, mobile, console, DOS and Web targets. Windows-only subsystems are replaced with SDL3, miniaudio, iniparser and a custom Direct3D Retained Mode re-implementation, while core gameplay is meant to stay unchanged. It ports reconstructed source rather than checking byte-identical binaries, so it is distinct from the exact-rebuild decompilation case.","description_zh":"将 LEGO Island 反编译源码改造为可在桌面、移动设备、游戏主机、DOS 及 Web 上构建的移植版本。项目以 SDL3、miniaudio、iniparser 和自行重新实现的 Direct3D Retained Mode 替代仅限 Windows 的子系统，并力求保持核心玩法不变。它移植的是重建源码，而不校验与原版逐字节一致的二进制文件，因此有别于精确重构建的反编译案例。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"crash-bandicoot-c1-port-case","name":"c1: a C port of PlayStation Crash Bandicoot","name_zh":"c1：PlayStation 版《古惑狼》的 C 语言移植","url":"https://github.com/wurlyfox/c1","evidence_url":"https://github.com/wurlyfox/c1/blob/256fdcef59f15a190290cc19db3fa9a707843b69/README.md","description_en":"Ports the original PlayStation Crash Bandicoot game code to C function by function; its coding standard labels functions with the addresses of their original implementations. Only the PC build, using OpenGL, SDL2 and FluidSynth, currently works; it loads asset files from the user’s game disc and is only partially playable.","description_zh":"将 PlayStation 版《古惑狼》的原始游戏代码逐函数移植为 C 语言；其编码规范要求为函数标注原实现的地址。目前只有基于 OpenGL、SDL2 和 FluidSynth 的 PC 构建可用；它读取用户自备游戏光盘中的素材文件，仅能部分游玩。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"metroid-prime-port-case","name":"Metroid Prime Port: an AI-assisted native port of the PrimeDecomp decompilation","name_zh":"Metroid Prime Port：AI 辅助完成的 PrimeDecomp 反编译原生移植","url":"https://github.com/Odrannnn/MetroidPrimePort","evidence_url":"https://github.com/Odrannnn/MetroidPrimePort/blob/26febe4e09685ab68e7e0a9822934c0daa306a22/README.md","description_en":"Compiles the PrimeDecomp decompilation of Metroid Prime’s game and engine code as native C++20 for Linux, Windows and Android, with an experimental macOS build. Aurora supplies the GameCube SDK compatibility layer and rendering, and the port reads a user-supplied disc image at run time. The author states that parts were written with AI coding assistants under their oversight.","description_zh":"将 PrimeDecomp 对《密特罗德 Prime》游戏与引擎代码的反编译结果编译为原生 C++20 程序，支持 Linux、Windows 和 Android，另有实验性 macOS 版本。Aurora 提供 GameCube SDK 兼容层和渲染，移植版在运行时读取使用者自备的光盘镜像。作者声明部分代码是在其监督下借助 AI 编程助手编写的。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"wind-waker-decomp-case","name":"The Wind Waker: a GameCube decompilation with hash-checked relinking","name_zh":"《风之杖》：以哈希校验重新链接的 GameCube 版反编译","url":"https://github.com/zeldaret/tww","evidence_url":"https://github.com/zeldaret/tww/blob/8b93b372dc8e841f12ddfb7e0215626f62b05417/README.md","description_en":"Reconstructs source for The Wind Waker’s GameCube executable and REL modules across the USA/Korea, PAL and Japanese releases and a Japanese kiosk demo. Matched units are compiled from source and linked with objects split from the user’s disc, then checked against per-version SHA-1 hashes; the repository ships no assets or assembly and covers the GameCube game, not the HD remaster.","description_zh":"为《塞尔达传说 风之杖》GameCube 版的可执行文件和 REL 模块重建源码，涵盖美版／韩版、PAL 版、日版及日本体验版。已匹配的单元由源码编译，再与从使用者光盘中拆分出的对象链接，并按各版本的 SHA-1 哈希校验；仓库不含素材或汇编，范围是 GameCube 版而非 HD 重制版。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"sonic-mania-decomp-case","name":"Sonic Mania: a game-code decompilation for the RSDKv5 engine","name_zh":"Sonic Mania：面向 RSDKv5 引擎的游戏代码反编译重建","url":"https://github.com/RSDKModding/Sonic-Mania-Decompilation","evidence_url":"https://github.com/RSDKModding/Sonic-Mania-Decompilation/blob/9dc699428420d752af9767bdb13f585ee0881bc0/README.md","description_en":"Reconstructs Sonic Mania’s game code in C and builds it with the separately decompiled RSDKv5 or RSDKv5U engine for Windows, Linux, Switch and Android. Assets must come from an official Sonic Mania (Plus) release; the project adds a mod loader and can build several retail versions. Its license describes the code as mostly functionally the same as the original, not byte-matching.","description_zh":"以 C 重建《索尼克狂欢》的游戏代码，并与另行反编译的 RSDKv5 或 RSDKv5U 引擎一起构建，支持 Windows、Linux、Switch 和 Android。素材必须来自官方发行的 Sonic Mania (Plus)；项目加入了模组加载器，并可构建多个零售版本。其许可证称代码大多在功能上与原作相同，而不是逐字节一致。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"medievil-recomp-case","name":"MediEvil Recomp: a PlayStation static recompilation to C#","name_zh":"MediEvil Recomp：PlayStation 游戏静态重编译为 C#","url":"https://github.com/BlackLabelHQ/MediEvilRecomp","evidence_url":"https://github.com/BlackLabelHQ/MediEvilRecomp/blob/b9e46db34db40d6e5c8e19b538e4d517299a4012/README.md","description_en":"Statically recompiles the North American PlayStation release of MediEvil into C# with the RecompOne recompiler and runtime. The runtime stands in for BIOS, GPU, CD-ROM and other hardware services, and project patches change rendering, widescreen and terrain behavior. README stresses that this is a recompilation, not a decompilation, and labels it an open beta.","description_zh":"使用 RecompOne 重编译器及运行时，将北美版 PlayStation《MediEvil》静态重编译为 C# 代码。运行时代为提供 BIOS、GPU、CD-ROM 等硬件服务，项目补丁则修改渲染、宽屏和地形表现。README 强调这是重编译而非反编译，并将其标为公开测试版。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"crash2recomp-case","name":"Crash Bandicoot 2 Recompiled: a PSXRecomp native build","name_zh":"Crash Bandicoot 2 Recompiled：基于 PSXRecomp 的原生构建","url":"https://github.com/Zumbo06/Crash2Recomp","evidence_url":"https://github.com/Zumbo06/Crash2Recomp/blob/48036cf3b49dfe4343e5c093d1df8a7b12617f81/README.md","description_en":"A Windows launcher that uses the PSXRecomp recompiler and runtime to translate the user’s Crash Bandicoot 2: Cortex Strikes Back disc to C and compile it locally, so the game runs as native code with an emulated PlayStation hardware layer. The repository holds the launcher, a patched vendored runtime and a long bring-up log; it distributes no game code or data.","description_zh":"一个 Windows 启动器，借助 PSXRecomp 重编译器与运行时，将用户自备的《古惑狼 2》光盘转换为 C 代码并在本地编译，使游戏以原生代码配合模拟的 PlayStation 硬件层运行。仓库包含启动器、打过补丁的内置运行时以及详细的调试记录，不分发任何游戏代码或数据。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"petari-smg-decomp-case","name":"Petari: a matching Super Mario Galaxy decompilation","name_zh":"Petari：Super Mario Galaxy 一致性反编译重建","url":"https://github.com/SMGCommunity/Petari","evidence_url":"https://github.com/SMGCommunity/Petari/blob/86ae7a3d3241adf07d5d3f9949e0462cccc583c1/README.md","description_en":"Reconstructs Super Mario Galaxy’s Wii code as C++ that rebuilds, object by object, against main.dol files extracted from the user’s own Japanese, North American, PAL or Korean disc. Matched objects are linked from source and checked with objdiff and a target hash. The project describes itself as a work in progress, separate from any PC port, and says it does not accept AI-generated decompilation.","description_zh":"将 Super Mario Galaxy 的 Wii 代码重建为 C++，并以使用者从自有日版、北美版、PAL 版或韩版光盘中提取的 main.dol 为目标，逐个目标文件重建。已匹配的目标文件由源码链接，并通过 objdiff 和目标哈希检查。项目自称仍在进行中，与任何 PC 移植无关，并表示不接受 AI 生成的反编译代码。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"wind-waker-hd-recomp-case","name":"Wind Waker HD Recomp: a native port by static recompilation of the Wii U game","name_zh":"Wind Waker HD Recomp：通过静态重编译实现的 Wii U 游戏原生移植","url":"https://github.com/ZeldaWWHDRecomp/ZeldaWWHDRecomp","evidence_url":"https://github.com/ZeldaWWHDRecomp/ZeldaWWHDRecomp/blob/f10b56621ed13e0053e7cf8190e740834377e45a/README.md","description_en":"Statically recompiles The Wind Waker HD’s Wii U PowerPC code to C ahead of time, reimplements the Cafe OS libraries the game uses and implements GX2 graphics on Metal or Vulkan, producing native macOS, Linux, Windows and Android builds without a Cemu runtime. All game code and data are generated locally from the user’s own dump; an experimental macOS-only build can instead run functions from the separate ZeldaWWHDDecomp/wwhd decompilation.","description_zh":"将《塞尔达传说 风之杖 HD》Wii U 版的 PowerPC 代码预先静态重编译为 C，原生重新实现游戏所用的 Cafe OS 库，并在 Metal 或 Vulkan 上实现 GX2 图形，生成无需 Cemu 运行时的 macOS、Linux、Windows 和 Android 原生版本。所有游戏代码和数据都由使用者自己的转储在本地生成；另有仅限 macOS 的实验性构建，可改为运行独立的 ZeldaWWHDDecomp/wwhd 反编译中的函数。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"cv64-recompiled-case","name":"Castlevania 64: Recompiled — a beta static-recompilation port","name_zh":"Castlevania 64: Recompiled：测试版静态重编译移植","url":"https://github.com/RevoSucks/CV64Recomp","evidence_url":"https://github.com/RevoSucks/CV64Recomp/blob/141b35d8902a6c74e247988df26d394822f8026c/flatpak/io.github.cv64recomp.cv64recomp.metainfo.xml","description_en":"Uses N64Recomp to statically recompile the US 1.0 Nintendo 64 release of Castlevania into a native PC port rendered with RT64. Game-specific C patches build against headers from a separate Castlevania 64 decompilation. A beta release tagged at the reviewed commit reports a working build with known issues, while the README there still describes an unfinished project.","description_zh":"使用 N64Recomp 将 Nintendo 64 版 Castlevania 美版 1.0 静态重编译为原生 PC 移植，并以 RT64 渲染。游戏专用的 C 补丁基于另一个 Castlevania 64 反编译项目的头文件构建。在所审提交上标记的测试版发布报告构建可用并列出已知问题，而同一提交的 README 仍称项目尚未完成。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"rsdkv5-engine-decomp-case","name":"RSDKv5 Decompilation: reconstructing Retro Engine v5 and v5U","name_zh":"RSDKv5 Decompilation：重建 Retro Engine v5 与 v5U","url":"https://github.com/RSDKModding/RSDKv5-Decompilation","evidence_url":"https://github.com/RSDKModding/RSDKv5-Decompilation/blob/191d7aea6c262d891244172a8609ac69fbfd7571/README.md","description_en":"Reconstructs the Retro Engine (RSDK) v5 and v5 Ultimate runtime, the engine that runs Sonic Mania’s game code, and builds it for Windows, Linux, Switch and Android. RSDKv5U can also run RSDKv3 and RSDKv4 games such as Sonic CD and Sonic 1 & 2. The project adds a mod loader, a shader compiler and extra Windows backends, and ships no game data.","description_zh":"重建 Retro Engine（RSDK）v5 及 v5 Ultimate 运行时，即运行《索尼克狂欢》游戏代码的引擎，可构建 Windows、Linux、Switch 和 Android 版本。RSDKv5U 还能运行 RSDKv3 与 RSDKv4 游戏，例如 Sonic CD 和 Sonic 1 & 2。项目增加了模组加载器、着色器编译器和额外的 Windows 后端，且不附带任何游戏数据。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"c2c-crash2-hybrid-recompilation-case","name":"C2C: hybrid recompilation and hand decompilation of Crash Bandicoot 2","name_zh":"C2C：《古惑狼 2》的混合重编译与手工反编译","url":"https://github.com/ughman/c2c","evidence_url":"https://github.com/ughman/c2c/blob/2e9535fb0c59e37bf42316cb768be80c5e8073d4/README.md","description_en":"An early reverse-engineering effort on PlayStation Crash Bandicoot 2 that converts the engine’s MIPS machine code directly into a very large C file and runs it against a modified PCSX-R emulator library for hardware I/O. Translated functions are meant to be decompiled by hand and moved into ordinary C, gradually replacing the mechanical translation.","description_zh":"一个早期的 PlayStation《古惑狼 2》逆向工程项目：把引擎的 MIPS 机器码直接转换为一个体量巨大的 C 文件，并调用改造后的 PCSX-R 模拟器库处理硬件 I/O。转换出的函数计划逐个手工反编译为普通 C 代码，逐步替换机械转换的部分。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"medievil-decomp-case","name":"MediEvil decompilation: an early checksum-gated PlayStation project","name_zh":"MediEvil 反编译：早期阶段、以校验值把关的 PlayStation 项目","url":"https://github.com/MediEvilDecompilation/medievil-decomp","evidence_url":"https://github.com/MediEvilDecompilation/medievil-decomp/blob/6afe6fe35d5ddf0ce1bebdb2e72f8215b5b5b407/README.md","description_en":"Decompiles the US PlayStation release of MediEvil toward C source that rebuilds its main executable, game executable and 26 overlays. splat splits the user's own disc files, and the default build compares all 28 outputs with SHA-1 checksums. README describes the project as a work in progress and publishes no progress figure.","description_zh":"将美版 PlayStation《MediEvil》逐步反编译为 C 源码，目标是重新生成其主程序、游戏程序及 26 个覆盖模块。splat 拆分使用者自备的光盘文件，默认构建会将全部 28 个产物与 SHA-1 校验值比较。README 称项目仍在进行中，未公布进度数据。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"cbfd-recompiled-case","name":"Conker's Bad Fur Day: Recompiled — an N64Recomp native port","name_zh":"Conker's Bad Fur Day: Recompiled：基于 N64Recomp 的原生移植","url":"https://github.com/sciaschi/CBFD-Recompiled","evidence_url":"https://github.com/sciaschi/CBFD-Recompiled/blob/ed1b8bb7f3f036334124ec27eb28efa64e400178/README.md","description_en":"Statically recompiles the US Nintendo 64 release of Conker’s Bad Fur Day with N64Recomp into a native Windows, Linux and macOS port on N64ModernRuntime and RT64. Function names and boundaries come from a vendored, still mostly assembly decompilation, while the recompiled code is taken from the user’s ROM so unmatched decompiled C cannot change behavior. The author reports heavy use of Claude Code across the project.","description_zh":"使用 N64Recomp 将美版 Nintendo 64《Conker's Bad Fur Day》静态重编译为基于 N64ModernRuntime 和 RT64 的原生 Windows、Linux 与 macOS 移植版。函数名称与边界来自仓库内置、仍以汇编为主的反编译项目，而重编译的代码取自用户的 ROM，因此尚未匹配的反编译 C 代码不会改变游戏行为。作者称整个项目大量使用了 Claude Code。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"projectcane-sly1-pc-port-case","name":"ProjectCane: a native PC port of Sly Cooper and the Thievius Raccoonus","name_zh":"ProjectCane：《Sly Cooper and the Thievius Raccoonus》原生 PC 移植","url":"https://github.com/theclub654/ProjectCane","evidence_url":"https://github.com/theclub654/ProjectCane/blob/d8e34caf5edd2a0e2d4ec292b69145425ec6201c/README.md","description_en":"Rebuilds the NTSC PlayStation 2 release of Sly Cooper and the Thievius Raccoonus as a native C++ game for Windows and Linux, running on data extracted from the player's own disc image. The README reports the full game as playable while work continues on accuracy and remaining differences from the original. It does not describe its reverse-engineering method or relate the port to the separate sly1 decompilation.","description_zh":"将 PlayStation 2 版《Sly Cooper and the Thievius Raccoonus》美版重建为 Windows 和 Linux 上的原生 C++ 游戏，运行时使用从玩家自有光盘镜像中提取的数据。README 报告整部游戏均可游玩，同时仍在改进准确性并处理与原版的剩余差异。项目未说明其逆向工程方法，也未说明与另一个 sly1 反编译项目的关系。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"firefighter-rust-port-case","name":"Firefighter: a decompiled DOS game ported to Rust","name_zh":"Firefighter：将反编译的 DOS 游戏移植为 Rust","url":"https://gitlab.com/esr/firefighter","evidence_url":"https://gitlab.com/esr/firefighter/-/blob/84861db110928202571af2042cb9762720dc2c3e/history.adoc","description_en":"Eric S. Raymond’s terminal port of Firefighter, Eben Sprinsock’s 1985 DOS shareware game. The project history says ChatGPT 5.5 decompiled the DOS binary to Borland Pascal and translated it to Rust, after which Raymond modernized the interface and corrected a scoring mismatch. Unchanged gameplay is the author’s statement; the intermediate Pascal and any comparison runs are not published.","description_zh":"Eric S. Raymond 将 Eben Sprinsock 于 1985 年发布的 DOS 共享软件游戏 Firefighter 移植为终端游戏。项目历史记载，ChatGPT 5.5 先将 DOS 二进制反编译为 Borland Pascal，再译为 Rust；之后 Raymond 改进了界面，并修正一处计分不符。玩法未变是作者的说法；中间 Pascal 代码及任何对照运行均未公开。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"flipper-telink-tuya-remote-firmware-case","name":"flipper-telink: replacement firmware for Tuya Zigbee remotes","name_zh":"flipper-telink：Tuya Zigbee 遥控器的替换固件","url":"https://github.com/ngxson/flipper-telink","evidence_url":"https://github.com/ngxson/flipper-telink/blob/d58aef2e65b30f33f560474ce460127c6f18ca30/custom_fw/ss6400zb/README.md","description_en":"A Flipper Zero app that bit-bangs Telink’s SWire debug interface to dump and reflash TLSR825x Zigbee devices, with static-analysis notes on the dumps and freshly written firmware for two of them. For Tuya TS0044/TS0046 scene remotes, the notes trace the stock ~500 ms single-click delay to a double-click window; the replacement firmware drops that window while presenting the stock model IDs to Zigbee2MQTT. The latest Zigbee build is marked unverified for pairing, actions and battery reporting.","description_zh":"一款 Flipper Zero 应用，以位操作驱动 Telink 的 SWire 调试接口，用于转储并重刷 TLSR825x Zigbee 设备；仓库还附有对转储固件的静态分析笔记，以及为其中两款设备全新编写的固件。针对 Tuya TS0044/TS0046 场景遥控器，笔记将原厂约 500 ms 的单击延迟追溯到双击判定窗口；替换固件取消该窗口，同时向 Zigbee2MQTT 呈现原厂型号标识。最新 Zigbee 版本的配对、动作及电量上报被标注为尚未验证。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware"],"verified_at":"2026-10-18"},{"id":"khdays-native-pc-port-case","name":"Kingdom Hearts 358/2 Days: native PC port built on a matching decompilation","name_zh":"Kingdom Hearts 358/2 Days：基于一致性反编译的原生 PC 移植","url":"https://github.com/Yokimitsuro/khdays-port","evidence_url":"https://github.com/Yokimitsuro/khdays-port/blob/8e0ad0b04d97d869c53f301bc40987f0ab929799/README.md","description_en":"Compiles the C of the khdays-decomp matching decompilation for Windows x64 and supplies a native platform layer for the Nintendo DS hardware, SDK services and sound driver. README reports the whole game running without an ARM interpreter; its rendering, controls, mod support and network multiplayer are the port’s own additions. This is a decompilation-based port, distinct from the byte-matching DS reconstruction it builds on.","description_zh":"将 khdays-decomp 一致性反编译的 C 代码编译为 Windows x64 程序，并以原生平台层替代 Nintendo DS 硬件、SDK 服务及声音驱动。README 报告整款游戏无需 ARM 解释器即可运行；渲染、操作、模组支持与网络联机均为移植自身新增。这是基于反编译的移植，与其所依托的逐字节一致 DS 重建并非同一产物。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"ico-pc-port-case","name":"ico-pc: a native ICO port compiled from the PS2 decompilation","name_zh":"ico-pc：由 PS2 反编译源码编译而成的《ICO》原生移植","url":"https://github.com/nathanialf/ico-pc","evidence_url":"https://github.com/nathanialf/ico-pc/blob/4c29ac4c121a357092dea6ee12f6d715ce6cf1f9/README.md","description_en":"Compiles the decompiled C of the PlayStation 2 game ICO natively for Windows, Linux, Android, iPhone and Apple-silicon Macs, with host code standing in for the PS2 hardware and Sony libraries. No PS2 code is interpreted or recompiled, and the program reads the player's PAL disc image on first start. It is a native port of a separately byte-matched decompilation, with documented divergences and optional enhancements.","description_zh":"将 PlayStation 2 游戏《ICO》的反编译 C 源码原生编译到 Windows、Linux、Android、iPhone 及 Apple 芯片 Mac 上，并以宿主代码替代 PS2 硬件和 Sony 函数库。项目不解释执行或重编译任何 PS2 代码，程序在首次启动时读取玩家自备的 PAL 光盘镜像。它是另一个逐字节匹配的反编译项目的原生移植，记录了与原版的差异，并提供可选增强功能。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"sly1-matching-decomp-case","name":"Sly Cooper and the Thievius Raccoonus: matching PlayStation 2 decompilation","name_zh":"Sly Cooper and the Thievius Raccoonus：PlayStation 2 一致性反编译","url":"https://github.com/TheOnlyZac/sly1","evidence_url":"https://github.com/TheOnlyZac/sly1/blob/ea5e2d77ac2a083df1efeafcee178f895943b13d/README.md","description_en":"Reconstructs source code for SCUS_971.98, the NTSC-U PlayStation 2 executable of Sly Cooper and the Thievius Raccoonus, as a work-in-progress matching decompilation. Functions not yet matched are still assembled from code split out of the user's own executable, and the build checks the linked ELF's SHA-1. The result runs in PCSX2 with the original disc for assets; it is not a native PC port.","description_zh":"将《Sly Cooper and the Thievius Raccoonus》PlayStation 2 美版可执行文件 SCUS_971.98 重建为源码，属于进行中的一致性反编译。尚未匹配的函数仍由从使用者自备可执行文件中拆分出的汇编构建，构建会检查链接后 ELF 的 SHA-1。产物需在 PCSX2 中配合原版光盘素材运行，并不是原生 PC 移植。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"pokemon-emerald-decomp-case","name":"Pokémon Emerald: a matching Game Boy Advance decompilation","name_zh":"《宝可梦 绿宝石》：生成一致 ROM 的 Game Boy Advance 反编译重建","url":"https://github.com/pret/pokeemerald","evidence_url":"https://github.com/pret/pokeemerald/blob/731ad5bfd6e6f265508d0efcca0ba42f9dcf5881/README.md","description_en":"Reconstructs Pokémon Emerald for the Game Boy Advance as buildable C source, with game scripts and data kept as assembler directives. The default agbcc build produces pokeemerald.gba, and make compare checks it against the SHA-1 of the original English ROM; an optional modern-GCC build is not hash-checked. Graphics and audio sources are committed in the tree, so the documented build reads no base ROM.","description_zh":"为 Game Boy Advance 版《宝可梦 绿宝石》重建可构建的 C 源码，游戏脚本和数据以汇编指令形式保存。默认的 agbcc 构建生成 pokeemerald.gba，make compare 将其与英文原版 ROM 的 SHA-1 比对；可选的现代 GCC 构建不做哈希校验。图像和音频源文件已提交在仓库中，因此文档所述的构建流程不读取原 ROM。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"paper-mario-matching-decomp-case","name":"Paper Mario: matching Nintendo 64 decompilation for four releases","name_zh":"Paper Mario：覆盖四个版本的一致性 Nintendo 64 反编译","url":"https://github.com/pmret/papermario","evidence_url":"https://github.com/pmret/papermario/blob/1104f1f71b824042a5fa1f958f2d861b603320fd/README.md","description_en":"Reconstructs Paper Mario’s Nintendo 64 code as C source that rebuilds the US, Japanese, PAL and iQue ROMs. The build takes assets and comparison inputs from a user-supplied original ROM, then checks each output against a recorded SHA-1. Mutable project reports list no remaining nonmatching functions, while the README still calls the decompilation work in progress; it is distinct from the PaperBoat native port.","description_zh":"将 Paper Mario 的 Nintendo 64 代码重建为 C 源码，可重新构建美版、日版、PAL 版和 iQue 版 ROM。构建流程从使用者自备的原 ROM 取得素材和比较输入，再将每个产物与记录的 SHA-1 比对。项目可变的进度报告显示已无未匹配函数，但 README 仍称反编译在进行中；该项目与 PaperBoat 原生移植不同。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"tenkaichi3-pc-port-case","name":"Budokai Tenkaichi 3: a native PC port built on a matching decompilation","name_zh":"Budokai Tenkaichi 3：基于一致性反编译的原生 PC 移植","url":"https://github.com/z3xox/Tenkaichi3Decomp","evidence_url":"https://github.com/z3xox/Tenkaichi3Decomp/blob/ec3c85a98cffd9cd22c22ac14cd62fb584d23664/README.md","description_en":"Compiles the decompiled code of Dragon Ball Z: Budokai Tenkaichi 3 (PS2, USA release SLUS-21678) for PC on a new renderer, sound, input and platform layer rather than an emulator. The game code comes from the separate BT3-Decompiled matching decompilation, and the game's data is read from the user's own disc image. The README reports the full game loop and experimental online play and says AI helped make the project; these results remain project-reported.","description_zh":"将 Dragon Ball Z: Budokai Tenkaichi 3（PS2 美版 SLUS-21678）的反编译代码编译到 PC，运行在新的渲染、音频、输入和平台层上，而非借助模拟器。游戏代码来自独立的 BT3-Decompiled 一致性反编译项目，游戏数据从使用者自备的光盘镜像读取。README 报告完整游戏流程可运行、联网对战处于实验阶段，并称项目借助 AI 完成；这些结果仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"d2r-mobile-switch-rehost-case","name":"D2R Mobile: rehosting Diablo II: Resurrected’s Switch program on Apple devices","name_zh":"D2R Mobile：在 Apple 设备上重新托管 Diablo II: Resurrected 的 Switch 程序","url":"https://github.com/jhaizhou-ops/d2r-mobile","evidence_url":"https://github.com/jhaizhou-ops/d2r-mobile/blob/9393b00ea9aca52d9254214da93738f26582562f/README.md","description_en":"Runs the Nintendo Switch release’s own aarch64 program natively on iPhone, iPad and Apple silicon Macs, rewriting only instructions that depend on the Horizon kernel and supplying its system services and the NVN graphics API on Metal. Shaders are translated offline from the user’s files, and the project adds its own touch interface and endgame features. It is a rehosting compatibility layer, not a decompilation or recompiled source.","description_zh":"在 iPhone、iPad 和 Apple 芯片 Mac 上原生运行 Nintendo Switch 版自身的 aarch64 程序，仅改写依赖 Horizon 内核的指令，并以 Metal 提供其系统服务与 NVN 图形 API。着色器由使用者自有文件离线转译，项目另行加入触控界面与终局玩法。这是重新托管的兼容层，不是反编译或重编译出的源码。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"rac1-matching-decomp-case","name":"Ratchet & Clank: a matching PS2 decompilation with a documented agent workflow","name_zh":"Ratchet & Clank：记录了代理流程的 PS2 一致性反编译","url":"https://github.com/OpenRAC/rac1-decomp","evidence_url":"https://github.com/OpenRAC/rac1-decomp/blob/7f5d3ff56701b611ac0e2c2589ef1f49cf8ac8fe/README.md","description_en":"Reconstructs C source for SCES_509.16, the PAL v2.00 PlayStation 2 executable of Ratchet & Clank (2002), with every function linked at its retail address. Functions not yet decompiled are still built from disassembly generated from the user's own executable, and the build audits functions, layout and the whole image against retail. The project documents an LLM-agent matching workflow and written build-fidelity rules for what counts as a match.","description_zh":"为 2002 年《Ratchet & Clank》PlayStation 2 欧版 v2.00 可执行文件 SCES_509.16 重建 C 源码，每个函数都链接在零售版的原地址。尚未反编译的函数仍由从使用者自备可执行文件生成的反汇编构建，构建会对照零售版审核函数、布局和整个映像。项目记录了由 LLM 代理执行匹配的流程，并以成文的构建保真规则界定何为匹配。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"banjo-recompiled-case","name":"Banjo: Recompiled — an N64Recomp Banjo-Kazooie native port","name_zh":"Banjo: Recompiled：基于 N64Recomp 的《Banjo-Kazooie》原生移植","url":"https://github.com/BanjoRecomp/BanjoRecomp","evidence_url":"https://github.com/BanjoRecomp/BanjoRecomp/blob/dbd52154bc1e00e56867b1fac94a8f907052f41b/README.md","description_en":"Uses N64Recomp to statically recompile the US 1.0 Nintendo 64 release of Banjo-Kazooie into a native port on N64ModernRuntime, rendered by RT64 and extended with mod support. Like Zelda 64: Recompiled, it is not built from decompiled source; a symbols repository generated from the Banjo-Kazooie decompilation supplies function names for locating code in the ROM and writing patches.","description_zh":"使用 N64Recomp 将美版 1.0 Nintendo 64《Banjo-Kazooie》静态重编译为基于 N64ModernRuntime 的原生移植版，由 RT64 渲染并加入模组支持。与 Zelda 64: Recompiled 一样，它并非基于反编译源码构建；由《Banjo-Kazooie》反编译项目生成的符号仓库提供函数名称，用于在 ROM 中定位代码和编写补丁。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"pokemon-firered-leafgreen-decomp-case","name":"Pokémon FireRed and LeafGreen: a matching Game Boy Advance decompilation","name_zh":"《宝可梦 火红／叶绿》：生成一致 ROM 的 Game Boy Advance 反编译重建","url":"https://github.com/pret/pokefirered","evidence_url":"https://github.com/pret/pokefirered/blob/037335f4c725d7c9aecdac87066f2002b4bd7e14/README.md","description_en":"Reconstructs the English Game Boy Advance releases of Pokémon FireRed and LeafGreen as buildable C source, with game scripts and data kept as assembler directives. Default agbcc builds produce six ROM images, covering both games' 1.0 and 1.1 releases and two variants labeled switch, each checked against its own SHA-1 manifest. Graphics and audio sources are committed in the tree, so the documented build reads no base ROM.","description_zh":"为 Game Boy Advance 英文版《宝可梦 火红／叶绿》重建可构建的 C 源码，游戏脚本和数据以汇编指令形式保存。默认的 agbcc 构建可生成六个 ROM 镜像，涵盖两款游戏的 1.0 与 1.1 版本及两个标为 switch 的变体，并分别按各自的 SHA-1 清单校验。图像和音频源文件已提交在仓库中，因此文档所述的构建流程不读取原 ROM。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"paperboat-paper-mario-port-case","name":"PaperBoat: a native Paper Mario port built on the decompilation","name_zh":"PaperBoat：基于反编译成果的 Paper Mario 原生移植","url":"https://github.com/HarbourMasters/PaperBoat","evidence_url":"https://github.com/HarbourMasters/PaperBoat/blob/d98b4b630f0674548067f59019fffef6885766e8/README.md","description_en":"Compiles Paper Mario decompilation sources, credited to the pmret and Paper Mario DX projects, into a native US-version application on libultraship. Torch converts the user’s own ROM into a local asset archive, and the port adds rendering backends, enhancements and archive-based mods. Desktop releases are published, while Android, iOS and web builds are documented on the development branch.","description_zh":"以 pmret 和 Paper Mario DX 项目为基础，将 Paper Mario 反编译源码编译为基于 libultraship 的原生美版应用。Torch 把使用者自己的 ROM 转换为本地素材归档，移植另加入多种渲染后端、增强功能和归档式模组。桌面版已有正式发布；Android、iOS 和网页构建则在开发分支中有文档说明。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"halo2-matching-decomp-case","name":"Halo 2: an agent-assisted matching decompilation of an LTCG Xbox build","name_zh":"Halo 2：智能体辅助的 LTCG Xbox 版一致性反编译","url":"https://github.com/kirklandsig/halo2-decompiled","evidence_url":"https://github.com/kirklandsig/halo2-decompiled/blob/e25e96f9236a74b15ab0f0acaa7af53918ca1233/README.md","description_en":"A work-in-progress matching decompilation of Halo 2 for the original Xbox: contributors write C and C++ that the period compiler, building the whole program with link-time code generation, must turn back into the retail executable's bytes function by function. The README reports just under half of the game-function bytes matched and leaves a native port for a later stage. It discloses that much of the maintainer's work runs in Claude and Codex coding-agent lanes.","description_zh":"Halo 2（初代 Xbox）的进行中一致性反编译：贡献者编写 C 与 C++ 代码，由原时代编译器以链接时代码生成方式构建整个程序，须逐函数还原出零售版可执行文件的字节。README 报告游戏函数字节的匹配比例接近一半，原生移植留待后续阶段。项目披露维护者的大量工作在 Claude 与 Codex 编程智能体流水线中进行。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"diabloweb-devilution-wasm-port-case","name":"DiabloWeb: a WebAssembly browser port built on Devilution","name_zh":"DiabloWeb：基于 Devilution 的 WebAssembly 浏览器移植","url":"https://github.com/d07RiV/diabloweb","evidence_url":"https://github.com/d07RiV/diabloweb/blob/c61ef19c54ea646aed328bd8cc82c8a5f1ebd81d/README.md","description_en":"Runs Diablo in web browsers by compiling a stripped-down fork of Devilution, the community reconstruction of the game’s original source, to WebAssembly behind a React front end. The fork removes the Storm, DiabloUI, DirectX and Windows dependencies and reworks event handling for the browser. It is a port built on a reconstruction and reports no matching or behavior-equivalence checks of its own.","description_zh":"将社区重建 Diablo 原始源码的 Devilution 精简分支编译为 WebAssembly，并配合 React 前端，使 Diablo 可在网页浏览器中运行。该分支移除了 Storm、DiabloUI、DirectX 和 Windows 依赖，并为浏览器改写事件处理。这是基于重建成果的移植，本身未报告一致性或行为等价检查。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"pokered-disassembly-case","name":"pokered: a matching Pokémon Red and Blue disassembly","name_zh":"pokered：一致构建的《精灵宝可梦 红／蓝》反汇编","url":"https://github.com/pret/pokered","evidence_url":"https://github.com/pret/pokered/blob/af519899719f0754965776faac0e836a3b906e6d/README.md","description_en":"Reconstructs the Game Boy games Pokémon Red and Blue as RGBDS assembly, with graphics and data kept as editable source files. One tree builds the USA/Europe Red and Blue ROMs, a Blue debug build and patches for the Virtual Console releases, each checked against a recorded SHA-1. It is a full disassembly rather than a decompilation into a higher-level language.","description_zh":"以 RGBDS 汇编重建 Game Boy 游戏《精灵宝可梦 红／蓝》，图像和数据以可编辑的源文件保存。同一源码树可构建美版／欧版红、蓝 ROM、一个蓝版调试构建以及 Virtual Console 版本的补丁，并逐一与记录的 SHA-1 比对。它是完整的反汇编项目，而非反编译为高级语言的源码。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"lighthouse-banjo-kazooie-port-case","name":"Lighthouse: a Banjo-Kazooie PC port built on the decompilation","name_zh":"Lighthouse：基于反编译项目的《Banjo-Kazooie》PC 移植","url":"https://github.com/HarbourMasters/Lighthouse","evidence_url":"https://github.com/HarbourMasters/Lighthouse/blob/4e8dfd23c64b143eb93ae9ee9fbae832cae2a2ef/README.md","description_en":"A native Windows, Linux and macOS port of Banjo-Kazooie that compiles game C sources, many tagged with their Banjo-Kazooie decompilation file paths, against libultraship, a reimplementation of the N64 SDK. Torch extracts the user’s ROM into an asset archive, and the port adds Anchor multiplayer, romhack and language-pack support and a randomizer. Unlike Banjo: Recompiled, it builds from decompiled source rather than statically recompiling the ROM’s code.","description_zh":"一个面向 Windows、Linux 和 macOS 的《Banjo-Kazooie》原生移植，将游戏 C 源码（其中许多标注了《Banjo-Kazooie》反编译项目中的文件路径）与重新实现 N64 SDK 的 libultraship 一起编译。Torch 将用户的 ROM 提取为素材归档；移植版还加入了 Anchor 联机、ROM 修改版与语言包支持以及随机器。与 Banjo: Recompiled 不同，它基于反编译源码构建，而非对 ROM 代码进行静态重编译。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"lost-odyssey-recomp-case","name":"Lost Odyssey Recomp: statically recompiling an Xbox 360 RPG into native ports","name_zh":"Lost Odyssey Recomp：将 Xbox 360 角色扮演游戏静态重编译为原生移植","url":"https://github.com/freefrank/LostOdysseyRecomp","evidence_url":"https://github.com/freefrank/LostOdysseyRecomp/blob/32fb6f73efef0e34ac05913b8521bad026b4ff65/README.md","description_en":"Translates Lost Odyssey’s Xbox 360 PowerPC executable with patched XenonRecomp tooling and runs the generated code on a native runtime that renders through Direct3D 12, Vulkan or Metal. Windows, Linux, macOS and Android packages import the user’s own disc data. The maintainer documents development with Claude Code and Codex CLI and records each release separately from validation and acceptance.","description_zh":"使用打过补丁的 XenonRecomp 工具转换 Lost Odyssey 的 Xbox 360 PowerPC 可执行文件，并在原生运行时上运行生成代码，经 Direct3D 12、Vulkan 或 Metal 渲染。Windows、Linux、macOS 和 Android 安装包导入使用者自己的光盘数据。维护者记录了借助 Claude Code 与 Codex CLI 的开发过程，并把每次发布与验证、验收分开记录。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"melee-matching-decomp-case","name":"Super Smash Bros. Melee: a matching GameCube decompilation with a shiftable build","name_zh":"Super Smash Bros. Melee：可移位构建的 GameCube 一致性反编译","url":"https://github.com/doldecomp/melee","evidence_url":"https://github.com/doldecomp/melee/blob/f0cdbb0a7046aea44c7177fd72abf33c3d2af4d4/.github/README.md","description_en":"A matching decompilation of Super Smash Bros. Melee's US 1.02 release (GALE01) that rebuilds main.dol from C with the original Metrowerks compilers and checks it against the retail SHA-1. decomp.dev reports the code fully decompiled and linked at the reviewed commit, and the README says current work is mostly naming and cleanup. Because the build can be shifted, a separate non-matching mode lets modders add code to a DOL run with their own disc dump.","description_zh":"Super Smash Bros. Melee 美版 1.02（GALE01）的一致性反编译：使用原版 Metrowerks 编译器从 C 代码重建 main.dol，并与零售版的 SHA-1 比对。decomp.dev 报告所审提交的代码已完全反编译并链接，README 称目前工作主要是命名与清理。由于构建可以移位，另有非一致性模式，供模组作者加入代码，再配合自己转储的光盘运行生成的 DOL。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"pokecrystal-disassembly-case","name":"pokecrystal: a matching Pokémon Crystal disassembly","name_zh":"pokecrystal：一致构建的《精灵宝可梦 水晶》反汇编","url":"https://github.com/pret/pokecrystal","evidence_url":"https://github.com/pret/pokecrystal/blob/3bc8daa4173e96a7f4011dad3922eb6fa5dad5c6/README.md","description_en":"Reconstructs the Game Boy Color game Pokémon Crystal as RGBDS assembly, with graphics, maps and data stored as editable sources. One tree builds the international 1.0 and 1.1 releases, the Australian release, two debug builds and a Virtual Console patch, each checked against a recorded SHA-1. Companion documentation covers script command formats and known bugs in the original game.","description_zh":"以 RGBDS 汇编重建 Game Boy Color 游戏《精灵宝可梦 水晶》，图像、地图和数据以可编辑的源文件保存。同一源码树可构建国际版 1.0 与 1.1、澳大利亚版、两个调试构建以及一个 Virtual Console 补丁，并逐一与记录的 SHA-1 比对。配套文档说明脚本命令格式以及原版游戏中的已知错误。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"pokemon-heartgold-soulsilver-disassembly-case","name":"Pokémon HeartGold and SoulSilver: a work-in-progress, checksum-matched DS disassembly","name_zh":"《宝可梦 心金／魂银》：校验一致的进行中 DS 反汇编项目","url":"https://github.com/pret/pokeheartgold","evidence_url":"https://github.com/pret/pokeheartgold/blob/5bb4b3b4961cbf0f8a42360c58a3c045d8535069/README.md","description_en":"Rebuilds the US Nintendo DS releases of Pokémon HeartGold and SoulSilver from a work-in-progress disassembly in which part of the code has been decompiled to C. Each default build checks the ARM9 and ARM7 binaries, the filesystem and the complete ROM against per-game SHA-1 manifests. README warns that, because decompilation is incomplete, edits that change code or data layout can crash the game.","description_zh":"以进行中的反汇编项目重建美版 Nintendo DS《宝可梦 心金／魂银》，其中部分代码已反编译为 C。每次默认构建都会按各游戏的 SHA-1 清单校验 ARM9 与 ARM7 二进制、文件系统及完整 ROM。README 提醒，由于反编译尚未完成，改变代码或数据布局的修改可能导致游戏崩溃。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"fftarecomp-gba-static-recomp-case","name":"FFTARecomp: static recompilation of Final Fantasy Tactics Advance","name_zh":"FFTARecomp：Final Fantasy Tactics Advance 的静态重编译","url":"https://github.com/Jorge262007/FFTARecomp","evidence_url":"https://github.com/Jorge262007/FFTARecomp/blob/7af625665d40ef3d39b3730a3c591ff66f7b2929/README.md","description_en":"Recompiles the user’s Final Fantasy Tactics Advance (USA) Game Boy Advance ROM ahead of time into native code for Windows, Linux and Steam Deck, building on JRickey’s gba-recomp toolkit. ARM and Thumb code is translated to C and compiled locally, while a Rust runtime models the console’s graphics, sound, DMA, timers and BIOS calls. The port adds widescreen, zoom, fast-forward and remappable controls.","description_zh":"基于 JRickey 的 gba-recomp 工具链，将使用者自有的 Final Fantasy Tactics Advance（美版）Game Boy Advance ROM 预先重编译为可在 Windows、Linux 和 Steam Deck 上运行的原生代码。ARM 与 Thumb 代码被转译为 C 并在本地编译，Rust 运行时则模拟主机的图形、声音、DMA、定时器及 BIOS 调用。移植另行加入宽屏、缩放、快进和可重映射操作。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"symphonyrecomp-case","name":"SymphonyRecomp: a RecompOne static recompilation of Symphony of the Night","name_zh":"SymphonyRecomp：用 RecompOne 静态重编译《恶魔城：月下夜想曲》","url":"https://github.com/BlackLabelHQ/SymphonyRecomp","evidence_url":"https://github.com/BlackLabelHQ/SymphonyRecomp/blob/c94a9096bab25bf513cceea50d6838a4c8d7bf5b/README.md","description_en":"Statically recompiles the North American PlayStation release of Castlevania: Symphony of the Night into C# with BlackLabelHQ’s RecompOne, whose runtime simulates the BIOS, memory-mapped I/O, GPU and CD-ROM so the game runs natively without a console BIOS. Per-overlay function maps and patches add widescreen, quality-of-life, randomizer and cheat features. References from the SOTN decompilation help name functions, but the project stresses that it is a recompilation, not a decompilation.","description_zh":"使用 BlackLabelHQ 的 RecompOne 将北美 PlayStation 版《恶魔城：月下夜想曲》静态重编译为 C#；其运行时模拟 BIOS、内存映射 I/O、GPU 和光驱，使游戏无需主机 BIOS 即可原生运行。按覆盖段划分的函数映射与补丁加入了宽屏、便利性改进、随机器和作弊功能。项目借助 SOTN 反编译项目的资料为函数命名，但强调它是重编译而非反编译。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"two-towers-recompiled-case","name":"The Two Towers Recompiled: an original Xbox static-recompilation port","name_zh":"The Two Towers Recompiled：初代 Xbox 静态重编译移植","url":"https://github.com/Gumpolas/TooTawersRecomp","evidence_url":"https://github.com/Gumpolas/TooTawersRecomp/blob/6fce430797ec0573634fa6be18a08f73957efa63/README.md","description_en":"Statically recompiles the x86 code of The Lord of the Rings: The Two Towers (Xbox, USA, 2002) into C with the bundled xboxrecomp toolkit, producing native Windows, Linux and experimental macOS builds. The recompiled sources are generated locally from the player's own default.xbe, and game data comes from their disc image or extracted folder. README reports the game as fully playable, with visual, frame-rate and mod issues listed.","description_zh":"使用随附的 xboxrecomp 工具包，将《The Lord of the Rings: The Two Towers》（Xbox 美版，2002）的 x86 代码静态重编译为 C，生成原生 Windows、Linux 及实验性 macOS 构建。重编译源码由玩家自己的 default.xbe 在本地生成，游戏数据来自其光盘镜像或已提取的文件夹。README 报告游戏可以完整游玩，并列出画面、帧率和模组方面的问题。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"melee-unlocked-case","name":"Melee Unlocked: a Windows source port and static recompilation of Melee","name_zh":"Melee Unlocked：Melee 的 Windows 源码移植与静态重编译","url":"https://github.com/Hero88go/melee-unlocked","evidence_url":"https://github.com/Hero88go/melee-unlocked/blob/589415b70123e699226f1925ad7a59ef8203a71c/README.md","description_en":"A beta Windows build of Super Smash Bros. Melee (NTSC 1.02) with two engines: a source port that compiles the doldecomp decompilation as a native library, and a static recompilation that translates the retail DOL's PowerPC code and Slippi's Gecko codes into C++. Both run on a native runtime with Direct3D rendering, unlocked display rates and natively implemented Slippi rollback play. The user's own ISO supplies all game data, and the README says the work was AI-assisted.","description_zh":"Super Smash Bros. Melee（NTSC 1.02）的 Windows 测试版构建，包含两套引擎：源码移植将 doldecomp 反编译编译为原生库，静态重编译则将零售版 DOL 的 PowerPC 代码及 Slippi 的 Gecko 代码转换为 C++。两者都运行在原生运行时上，提供 Direct3D 渲染、解锁的显示帧率和原生实现的 Slippi 回滚对战。全部游戏数据来自使用者自备的 ISO，README 称开发借助了 AI。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"pokeruby-decomp-case","name":"pokeruby: a matching Pokémon Ruby and Sapphire decompilation","name_zh":"pokeruby：一致构建的《精灵宝可梦 红宝石／蓝宝石》反编译","url":"https://github.com/pret/pokeruby","evidence_url":"https://github.com/pret/pokeruby/blob/5784633ce4ef7ade1a7f2d2d0c288e3d5e6cdd7f/README.md","description_en":"Reconstructs the Game Boy Advance games Pokémon Ruby and Sapphire as C source built with pret's agbcc compiler, alongside assembly data scripts and editable graphics. Matching builds cover the English 1.0, 1.1 and 1.2 revisions, debug builds and the first German editions, each checked against a stored SHA-1. A separate modern-GCC target is not expected to match.","description_zh":"以 C 源码重建 Game Boy Advance 游戏《精灵宝可梦 红宝石／蓝宝石》，使用 pret 的 agbcc 编译器构建，并附有汇编数据脚本和可编辑图像。一致构建涵盖英文版 1.0、1.1、1.2 修订版、调试构建以及德文初版，并逐一与保存的 SHA-1 比对。另有使用现代 GCC 的构建目标，不以一致为目标。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"vandal-hearts-pc-port-case","name":"Vandal Hearts: native PC port built on matching decompilations","name_zh":"Vandal Hearts：基于一致性反编译的原生 PC 移植","url":"https://github.com/HalmyLyseas/VandalHearts-PcPort","evidence_url":"https://github.com/HalmyLyseas/VandalHearts-PcPort/blob/14552fffa0e0b47e02b57592e274fc6e7a649923/README.md","description_en":"Builds on shao113’s matching decompilation of PlayStation Vandal Hearts, adds a Japanese matching tree, and carries both through to a native Windows and Linux port. SDL2, OpenGL or Metal and OpenAL backends replace the console’s GPU, GTE, CD-ROM/XA, SPU, MDEC and pad interfaces, and one executable runs the USA, Asia and Japan discs. The matching builds are still checked on every change; PC-only features such as Tactical Mode and HD packs are opt-in.","description_zh":"以 shao113 的 PlayStation 版 Vandal Hearts 一致性反编译为基础，新增日版一致性代码树，并将两者延伸为原生 Windows 与 Linux 移植。SDL2、OpenGL 或 Metal 及 OpenAL 后端替代主机的 GPU、GTE、CD-ROM／XA、SPU、MDEC 和手柄接口，同一可执行文件可运行美版、亚洲版和日版光盘。每次修改仍须通过一致性构建检查；Tactical Mode、高清包等 PC 专属功能均为可选。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"pokemon-platinum-decomp-case","name":"Pokémon Platinum: a checksum-matched Nintendo DS decompilation","name_zh":"《宝可梦 白金》：校验一致的 Nintendo DS 反编译重建","url":"https://github.com/pret/pokeplatinum","evidence_url":"https://github.com/pret/pokeplatinum/blob/1dc13dcea40c04ab53f1f607de46023dc409ef20/README.md","description_en":"Reconstructs the US Nintendo DS release of Pokémon Platinum as C source that rebuilds revision 1 by default and revision 0 on request. The default make target runs Meson checks of the code binaries, filesystem and complete ROM against SHA-1 manifests. README still calls the project work in progress; its contributing guide says the code is entirely C but much of it remains obfuscated, leaving documentation and tooling as the main work.","description_zh":"将美版 Nintendo DS《宝可梦 白金》重建为 C 源码，默认重建修订版 1，也可按需构建修订版 0。默认的 make 目标会运行 Meson 检查，按 SHA-1 清单校验代码二进制、文件系统及完整 ROM。README 仍称项目在进行中；贡献指南表示代码已全部为 C，但其中大量仍晦涩难懂，因此主要工作是文档和工具。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"saints-reborn-recomp-case","name":"Saints Reborn: a ReXGlue static recompilation of Saints Row","name_zh":"Saints Reborn：基于 ReXGlue 的 Saints Row 静态重编译","url":"https://github.com/whompay/SaintsReborn","evidence_url":"https://github.com/whompay/SaintsReborn/blob/cb09c54cf9ff5c19a9c1cb8e080f465a322bd0eb/README.md","description_en":"An unofficial native Windows port of Saints Row (Xbox 360, 2006) that statically recompiles the game's PowerPC executable to C++ for x86-64 with the ReXGlue SDK, which also reimplements the console's kernel, GPU (on Direct3D 12), audio and input. A recompiler manifest, game-specific function overrides and an SDK patch make the result run, and each user builds it locally from their own disc. The README reports the game fully playable with built-in co-op and lists known issues.","description_zh":"Saints Row（Xbox 360，2006）的非官方原生 Windows 移植：借助 ReXGlue SDK 将游戏的 PowerPC 可执行文件静态重编译为面向 x86-64 的 C++ 代码，该 SDK 还重新实现了主机的内核、GPU（基于 Direct3D 12）、音频与输入。重编译清单、游戏专用的函数替换和 SDK 补丁使结果得以运行，每位使用者都用自己的光盘在本地构建。README 报告游戏可完整通关、内置合作模式，并列出已知问题。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"pokemon-platinum-pc-port-case","name":"Pokémon Platinum PC Port: a native port built on the pret decompilation","name_zh":"Pokémon Platinum PC Port：基于 pret 反编译的原生移植","url":"https://github.com/cybervisi0n/pokeplatinum","evidence_url":"https://github.com/cybervisi0n/pokeplatinum/blob/35067868f64f23d25d17ac3e536cfdd9a7f40523/README.md","description_en":"Builds native 64-bit Windows and Linux executables of Pokémon Platinum from a fork of pret’s decompilation, replacing NitroSDK with the author’s libntr libraries; the same tree keeps the DS ROM build and an experimental Switch target. README says the game should be playable from start to finish but may crash or show graphical bugs. Prebuilt binaries require the player’s own US ROM, and the fork’s default build no longer runs pret’s checksum tests.","description_zh":"基于 pret 反编译项目的分支，为《宝可梦 白金》构建原生 64 位 Windows 和 Linux 可执行文件，并以作者的 libntr 库替代 NitroSDK；同一源码树仍保留 DS ROM 构建和实验性的 Switch 目标。README 称游戏应可从头玩到尾，但可能出现崩溃和图形错误。预构建程序需要玩家自备美版 ROM，且该分支的默认构建不再运行 pret 的校验测试。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"mikupan-fatal-frame-port-case","name":"MikuPan: a native Fatal Frame PC port built on the Himuro decompilation","name_zh":"MikuPan：基于 Himuro 反编译的 Fatal Frame 原生 PC 移植","url":"https://github.com/Mikompilation/MikuPan","evidence_url":"https://github.com/Mikompilation/MikuPan/blob/ec204d75441e98d8bd43ddd95cae744eb683f00c/README.md","description_en":"Ports the PS2 game Fatal Frame to native PC builds without emulation; its repository description names the Himuro decompilation as its basis. Stubs replace PS2 kernel calls and a new SDL3-based layer handles rendering, audio and UI, while game data comes from the user’s own disc. The README calls the port very early work and publishes no matching or fidelity checks.","description_zh":"将 PS2 游戏 Fatal Frame（《零》）移植为无需模拟器的原生 PC 版本；仓库简介称其基于 Himuro 反编译项目。PS2 内核调用由桩函数替代，渲染、音频和界面由基于 SDL3 的新层实现，游戏数据则来自使用者自有的光盘。README 称移植仍处于很早期阶段，未发布一致性或还原度检查。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"starfox64-recompiled-case","name":"Starfox 64: Recompiled — an N64Recomp static-recompilation port","name_zh":"Starfox 64: Recompiled：基于 N64Recomp 的静态重编译移植","url":"https://github.com/sonicdcer/Starfox64Recomp","evidence_url":"https://github.com/sonicdcer/Starfox64Recomp/blob/f2996555d73ca480f3dc3639f375c50818847bfc/README.md","description_en":"Uses N64: Recompiled to statically recompile the US 1.1 (Rev A) Nintendo 64 release of Star Fox 64 into a native port for Windows, Linux and macOS, rendered with RT64. Its patches and enhancements draw on headers and some functions from the separate sf64 decompilation, but the port is not compiled from that decompilation's source. The README reports high-frame-rate, widescreen and mod support, with assets loaded from the user's own ROM.","description_zh":"使用 N64: Recompiled 将 Nintendo 64 版 Star Fox 64 美版 1.1（Rev A）静态重编译为面向 Windows、Linux 和 macOS 的原生移植，并以 RT64 渲染。补丁与增强功能借用独立的 sf64 反编译项目中的头文件和部分函数，但移植本身并非由该反编译源码编译而成。README 报告支持高帧率、宽屏与模组，素材从使用者自备的 ROM 载入。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"syphon-filter-omega-strain-decomp-case","name":"Syphon Filter: The Omega Strain — matching PS2 executable decompilation","name_zh":"Syphon Filter: The Omega Strain：可逐字节重建 PS2 可执行文件的一致性反编译","url":"https://github.com/zm2283145/syphon-filter-omega-strain-decomp","evidence_url":"https://github.com/zm2283145/syphon-filter-omega-strain-decomp/blob/d41eacc6dd89befed75fec21a02faaa2b5a4750c/README.md","description_en":"Reconstructs much of the NTSC-U PlayStation 2 executable of Syphon Filter: The Omega Strain as C; with the remaining functions kept as split assembly, the build reproduces the retail SCUS_972.64 byte for byte. Committed objdiff reports track per-function matching against the user’s own executable. This is a matching-decompilation case, not a PC port; progress figures remain project-reported.","description_zh":"将 Syphon Filter: The Omega Strain 北美版 PlayStation 2 可执行文件的大部分代码重建为 C；其余函数保留为拆分出的汇编，整体构建可逐字节重现零售版 SCUS_972.64。仓库提交的 objdiff 报告以使用者自备的可执行文件为基准，追踪逐函数的匹配进度。这是一致性反编译案例，不是 PC 移植；进度数字仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"animal-crossing-pc-port-case","name":"Animal Crossing: a native PC port of the GameCube decompilation","name_zh":"Animal Crossing：基于 GameCube 反编译成果的原生 PC 移植","url":"https://github.com/flyngmt/ACGC-PC-Port","evidence_url":"https://github.com/flyngmt/ACGC-PC-Port/blob/4099d246c927e75b4fd342ca13f4ac4395c55af5/README.md","description_en":"Runs Animal Crossing’s decompiled GameCube C code natively on 32-bit x86, replacing the GX graphics API with an OpenGL 3.3 translation layer and console services with SDL2-based platform code. Game assets are read at startup from the user’s own disc image instead of being shipped. It is a port built on ACreTeam’s ac-decomp, not a matching rebuild of the original executable.","description_zh":"让 Animal Crossing 反编译所得的 GameCube C 代码在 32 位 x86 上原生运行，用转换层把 GX 图形 API 映射到 OpenGL 3.3，并以基于 SDL2 的平台代码替代主机服务。游戏素材在启动时从使用者自己的光盘镜像读取，不随项目分发。这是基于 ACreTeam ac-decomp 的移植，而非与原可执行文件一致的重建。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"goldeneye-007-matching-decomp-case","name":"GoldenEye 007: matching Nintendo 64 decompilation for three releases","name_zh":"GoldenEye 007：覆盖三个版本的一致性 Nintendo 64 反编译","url":"https://github.com/n64decomp/007","evidence_url":"https://github.com/n64decomp/007/blob/c4356466796c697dfd298010b9bed261f9ed8c6a/readme.md","description_en":"Reconstructs GoldenEye 007’s Nintendo 64 code as C source that rebuilds the US, Japanese and PAL ROMs. Assets come from a user-supplied US ROM, with Japanese and PAL differences taken from their own ROMs, and the default build compares each output with a recorded SHA-1. The README still calls the project work in progress, while a mutable status page reports all 208 files done; it is distinct from the separately curated PC port.","description_zh":"将 GoldenEye 007 的 Nintendo 64 代码重建为 C 源码，可重新构建美版、日版和 PAL 版 ROM。素材取自使用者自备的美版 ROM，日版与 PAL 版的差异部分则取自各自的 ROM；默认构建会将每个产物与记录的 SHA-1 比对。README 仍称项目在进行中，而可变的状态页报告全部 208 个文件已完成；它与另行收录的 PC 移植不同。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"starship-sf64-pc-port-case","name":"Starship: a Star Fox 64 PC port built from the decompilation","name_zh":"Starship：基于反编译的 Star Fox 64 PC 移植","url":"https://github.com/HarbourMasters/Starship","evidence_url":"https://github.com/HarbourMasters/Starship/blob/3322643f0bbf80d2f8f7e1c0d2c4c578515f6c90/README.md","description_en":"A native PC port of Star Fox 64 that compiles the game's decompiled C code against libultraship, an N64 porting library that reimplements libultra and renders through Fast3D. On first run it uses the Torch tool to turn the user's US ROM into an asset archive, and it ships for Windows, Linux, macOS and Switch. The README of the separate Starfox 64: Recompiled static recompilation calls this port its sibling, built with different technology.","description_zh":"Star Fox 64 的原生 PC 移植：将游戏的反编译 C 代码与 libultraship 一同编译，该 N64 移植库重新实现了 libultra，并通过 Fast3D 渲染。首次运行时借助 Torch 工具把使用者的美版 ROM 转换为素材资源包，提供 Windows、Linux、macOS 和 Switch 版本。独立的静态重编译项目 Starfox 64: Recompiled 在其 README 中称本移植为采用不同技术的姊妹项目。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"ctr-turbocharged-port-case","name":"CTR Turbocharged: a PC sourceport built on the Crash Team Racing decompilation","name_zh":"CTR Turbocharged：基于 Crash Team Racing 反编译成果的 PC 移植","url":"https://github.com/CameronRedmore/Crash-Team-Racing-Turbocharged","evidence_url":"https://github.com/CameronRedmore/Crash-Team-Racing-Turbocharged/blob/07d0c49f01d62dcb9887b455be27ce65728ee893/README.md","description_en":"Extends the Crash Team Racing: High Octane sourceport, which derives from the CTR Native port of the CTR-ModSDK PlayStation decompilation, into Windows and Linux builds with a native 3D renderer, selectable aspect ratios and frame rates up to 240 FPS. The decompiled game code still assumes 32-bit pointers and loads assets from the player’s own NTSC-U disc image. Renderer, timing and option tests exist, but device coverage and fidelity remain project-reported.","description_zh":"在 Crash Team Racing: High Octane 移植版基础上扩展而成；High Octane 源自基于 CTR-ModSDK PlayStation 反编译成果的 CTR Native 移植。本分支面向 Windows 与 Linux，提供原生 3D 渲染器、可选画面比例及最高 240 FPS 帧率。反编译游戏代码仍假定 32 位指针，并从玩家自备的 NTSC-U 光盘镜像读取素材。项目附有渲染、计时和选项测试，但设备覆盖与还原度仍为项目自述。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"the-darkness-recomp-case","name":"The Darkness Recomp: an Xbox 360 static recompilation with a native D3D11 renderer","name_zh":"The Darkness Recomp：配有原生 D3D11 渲染器的 Xbox 360 静态重编译","url":"https://github.com/portingpete/The-Darkness-Recomp","evidence_url":"https://github.com/portingpete/The-Darkness-Recomp/blob/98f0bcd49dfee90dfee968a3b75fd40e892c91e7/README.md","description_en":"Builds a native Windows x64 port of The Darkness by translating its Xbox 360 executable to C++ ahead of time with a patched XenonRecomp. A D3D11 renderer draws from the engine’s original geometry, shader sources and device state instead of interpreting console GPU packets. Gameplay coverage and Linux results are project-reported, and the author discloses OpenAI Codex assistance.","description_zh":"使用打过补丁的 XenonRecomp 将 Xbox 360 可执行文件提前转换为 C++，构建 The Darkness 的原生 Windows x64 移植。D3D11 渲染器直接使用引擎原有的几何数据、着色器源码和设备状态绘制，而不解释主机 GPU 命令包。游戏覆盖范围与 Linux 测试结果均为项目报告，作者披露开发中使用了 OpenAI Codex 辅助。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"mariokart64-recompiled-case","name":"MarioKart 64: Recompiled — a native port through N64Recomp static recompilation","name_zh":"MarioKart 64: Recompiled：通过 N64Recomp 静态重编译实现的原生移植","url":"https://github.com/sonicdcer/MarioKart64Recomp","evidence_url":"https://github.com/sonicdcer/MarioKart64Recomp/blob/3f72d2385cc995fea79e8fca81d886cb2bdce1de/README.md","description_en":"Statically recompiles the US Nintendo 64 release of Mario Kart 64 into a native Windows, Linux and macOS application with N64Recomp, rendering through RT64. The README distinguishes this from a source port: game code is translated from the user’s ROM, while headers and some functions from a decompilation fork support patches and enhancements. Enhancement, fidelity and input-lag claims are project-reported.","description_zh":"使用 N64Recomp 将北美版 Nintendo 64《马力欧卡丁车 64》静态重编译为 Windows、Linux 与 macOS 原生应用，并通过 RT64 渲染。README 将其与源码移植区分开：游戏代码由使用者提供的 ROM 转换而来，反编译分支中的头文件和部分函数用于实现补丁与增强。增强功能、还原度和输入延迟等说法均为项目自述。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"animal-crossing-gamecube-decomp-case","name":"Animal Crossing: matching GameCube decompilation","name_zh":"Animal Crossing：生成一致产物的 GameCube 反编译重建","url":"https://github.com/ACreTeam/ac-decomp","evidence_url":"https://github.com/ACreTeam/ac-decomp/blob/09ca8e8b5b24e6ab44047ee980cf0088ad7ecb4c/README.md","description_en":"Reconstructs Animal Crossing’s GameCube code as C and C++ source that rebuilds the USA release’s main executable and its foresta.rel module. The dtk-template build reads the original binaries and assets from a user-supplied disc image, then checks both outputs against SHA-1 hashes. A separate native PC port builds on it; completeness figures remain project-reported here.","description_zh":"将 Animal Crossing 的 GameCube 代码重建为 C 与 C++ 源码，可重新构建美版的主可执行文件及 foresta.rel 模块。基于 dtk-template 的构建从使用者自备的光盘镜像读取原始二进制与素材，再用 SHA-1 哈希校验两个产物。另有原生 PC 移植以它为基础；此处的完成度数字仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"kingdom-hearts-days-matching-decomp-case","name":"Kingdom Hearts 358/2 Days: a matching Nintendo DS decompilation","name_zh":"《王国之心 358/2 Days》：逐字节一致的 Nintendo DS 反编译重建","url":"https://github.com/Yokimitsuro/khdays-decomp","evidence_url":"https://github.com/Yokimitsuro/khdays-decomp/blob/261a89eaa8f65dd566ae0828b0b57c85c847a6ee/README.md","description_en":"Reconstructs the ARM9 program and overlays of the EU Nintendo DS release of Kingdom Hearts 358/2 Days as C that recompiles byte for byte with CodeWarrior. README reports all 306 modules byte-identical, with about 99.5% of functions in real C and library assembly counted separately; the ARM7 binary is outside its scope. The repository holds no ROM, game assets or extracted disassembly and produces no playable build.","description_zh":"将 Nintendo DS 欧版《王国之心 358/2 Days》的 ARM9 程序及覆盖模块重建为 C 源码，以 CodeWarrior 重新编译后逐字节一致。README 报告全部 306 个模块字节一致，约 99.5% 的函数为真正的 C，库自身的汇编另行统计；ARM7 二进制不在范围内。仓库不含 ROM、游戏素材或提取的反汇编，也不生成可玩版本。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"rtl-433","name":"rtl_433","name_zh":"rtl_433 ISM 频段设备无线协议解码器","url":"https://github.com/merbanan/rtl_433","evidence_url":"https://github.com/merbanan/rtl_433/blob/80f7bcc3a3dc6edf537544593bf367241a225215/README.md","description_en":"Receives and decodes transmissions from ISM-band devices such as weather sensors, remote controls, doorbells and alarm sensors, using RTL-SDR or SoapySDR receivers or recorded I/Q files, and emits decoded fields as JSON, CSV, MQTT and other outputs. For signals no built-in decoder recognizes, a pulse analyzer reports OOK/FSK timings and hints for a flexible -X decoder that slices frames into bits; its analysis guide leaves mapping those bits to values to the analyst, working from known readings.","description_zh":"接收并解码 ISM 频段设备（如气象传感器、遥控器、门铃和报警传感器）的无线传输，可使用 RTL-SDR 或 SoapySDR 接收机，也可读取录制的 I/Q 文件，并以 JSON、CSV、MQTT 等格式输出解码字段。对内置解码器无法识别的信号，脉冲分析器会报告 OOK/FSK 时序，并给出灵活 -X 解码器的提示，用于将帧切分为比特；按其分析指南，把这些比特对应到具体数值仍需分析者依据已知读数完成。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-18"},{"id":"decomp-me","name":"decomp.me","name_zh":"decomp.me 协作匹配反编译平台","url":"https://decomp.me","evidence_url":"https://github.com/decompme/decomp.me/blob/f5850753ef561a3d79e6eb7e96ff08e78154b91d/README.md","description_en":"Collaborative decompilation website for matching work: its compile service builds candidate source with a selected platform compiler, assembles the target assembly and diffs the two objects with asm-differ. m2c drafts initial decompilations for its MIPS, PowerPC, ARM and SuperH platforms. The 18 platform definitions span N64, PlayStation, PS2, PSP, GameCube/Wii, Wii U, DS, GBA, 3DS, Switch, Saturn, Dreamcast and Xbox 360 plus IRIX, Mac OS X, MS-DOS, Win32 and Android x86.","description_zh":"面向匹配反编译的协作网站：其编译服务用选定平台的编译器编译候选源码，汇编目标汇编代码，并用 asm-differ 对比两个目标文件。对其 MIPS、PowerPC、ARM 和 SuperH 平台，m2c 可生成初步反编译代码。18 个平台定义涵盖 N64、PlayStation、PS2、PSP、GameCube/Wii、Wii U、DS、GBA、3DS、Switch、Saturn、Dreamcast 和 Xbox 360，以及 IRIX、Mac OS X、MS-DOS、Win32 和 Android x86。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"thps1-decomp-native-port-case","name":"TonyWasAProSkater: a THPS1 native port forked from a matching decompilation","name_zh":"TonyWasAProSkater：派生自一致性反编译的 THPS1 原生移植","url":"https://github.com/LANCommander/TonyWasAProSkater","evidence_url":"https://github.com/LANCommander/TonyWasAProSkater/blob/23968e91391ccdeb35f45e1fe987a8a40085aa5f/README.md","description_en":"Ports Tony Hawk’s Pro Skater (PlayStation, USA) to native Windows and Linux builds from a fork of an in-progress matching decompilation of the retail executable. The decompilation recompiles reconstructed functions with a Psy-Q toolchain and compares them byte for byte with the user’s retail executable, while the port replaces PlayStation hardware and libraries with SDL2 and OpenGL services. Play needs the user’s own disc image; matching and gameplay results remain project-reported.","description_zh":"从一个仍在进行中的零售版可执行文件一致性反编译项目派生分支，将 Tony Hawk’s Pro Skater（PlayStation 美版）移植为原生 Windows 与 Linux 程序。反编译部分用 Psy-Q 工具链重新编译已重建的函数，并与使用者自备的零售可执行文件逐字节比对；移植部分则以 SDL2 和 OpenGL 服务取代 PlayStation 硬件和库。运行需使用者自备光盘镜像；一致性与可玩性结果仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"pt-pc-port-case","name":"P.T. for PC: a behavior-based engine reimplementation that reads the PS4 data","name_zh":"P.T. PC 版：基于行为重新实现、读取 PS4 数据的引擎","url":"https://github.com/LoreanXavier/pt-pc","evidence_url":"https://github.com/LoreanXavier/pt-pc/blob/d0a9b8f8969588a9ab2b1db03a35854d3af63f2e/README.md","description_en":"Reimplements P.T.’s game logic in C++ on a new Vulkan engine that reads levels, models, textures, sounds, scripts and cutscenes from the user’s own PS4 copy at run time. The author documents reverse-engineered file formats and used the shadPS4 emulator as a behavior and frame reference. Fidelity to the original is author-reported, and the use of AI coding tools is disclosed.","description_zh":"在新的 Vulkan 引擎上用 C++ 重新实现 P.T. 的游戏逻辑，运行时从使用者自有的 PS4 版本读取关卡、模型、贴图、声音、脚本和过场动画。作者记录了逆向得出的文件格式，并以 shadPS4 模拟器作为行为与画面的对照参考。与原作的一致程度为作者报告，项目也披露使用了 AI 编程工具。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"spaghettikart-mk64-port-case","name":"SpaghettiKart: a native Mario Kart 64 port built on decompiled source","name_zh":"SpaghettiKart：基于反编译源码的《马力欧卡丁车 64》原生移植","url":"https://github.com/HarbourMasters/SpaghettiKart","evidence_url":"https://github.com/HarbourMasters/SpaghettiKart/blob/5073d2e3636cdb2794f4c845ee3bdec5ac4718c4/README.md","description_en":"Builds a native Mario Kart 64 port for Windows, Linux, macOS and Switch from source that keeps the Mario Kart 64 decompilation’s file layout, running on libultraship’s reimplemented N64 SDK. Its bundled Torch extractor converts the user’s US ROM into an asset archive, and the port adds mods, custom tracks and an editor. The README does not name its upstream decompilation, and no matching or fidelity checks are published.","description_zh":"基于沿用《马力欧卡丁车 64》反编译项目文件结构的源码，构建适用于 Windows、Linux、macOS 和 Switch 的原生移植，运行在 libultraship 重新实现的 N64 SDK 之上。随附的 Torch 提取器将使用者自备的美版 ROM 转换为素材归档，移植还增加了模组、自定义赛道和编辑器。README 未写明其上游反编译项目，也未发布一致性或还原度检查。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"animal-crossing-wild-world-decomp-case","name":"Animal Crossing: Wild World: matching Korean DS decompilation with differential runtime checks","name_zh":"Animal Crossing: Wild World：附差分运行检查的韩版 DS 一致性反编译重建","url":"https://github.com/banatic/acww-decomp","evidence_url":"https://github.com/banatic/acww-decomp/blob/c7e3256743367fe04ed1a47f9a0f57e2ab57a24f/README.md","description_en":"Reconstructs the ARM9 game code of Animal Crossing: Wild World’s Korean DS release as one C or C++ source per function, checked against the user’s ROM with the original Metrowerks compiler and linker. Each function also has a readable Clean rewrite, and an included DS interpreter compares the ROM code, natively compiled sources and rewrites on recorded play. Data sections, the ARM7 binary, the linked SDK libraries and regrouping into original source files remain outside the reconstruction.","description_zh":"将 Animal Crossing: Wild World 韩版 DS 游戏的 ARM9 游戏代码重建为每个函数一个 C 或 C++ 源文件，并用原版 Metrowerks 编译器和链接器对照使用者自己的 ROM 校验。每个函数另有可读的 Clean 改写版本，仓库自带的 DS 解释器在录制的游玩过程中比较 ROM 代码、原生编译的源码和改写版本。数据段、ARM7 程序、链接的 SDK 库及按原始源文件重新归组仍不在重建范围内。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"king-kong-recompiled-case","name":"King Kong Recompiled: an AI-developed Xbox 360 static recompilation","name_zh":"King Kong Recompiled：由 AI 开发的 Xbox 360 静态重编译","url":"https://github.com/TekRantGaming/king-kong-recompiled","evidence_url":"https://github.com/TekRantGaming/king-kong-recompiled/blob/c852d9f467201e9a02c1aaf099b65522535b3473/README.md","description_en":"Translates the Xbox 360 release of Peter Jackson's King Kong into native Windows code with the ReXGlue static-recompilation SDK, adding a launcher and display, control and graphics options. Project code completes streamed disc reads the way the console does, which README credits with getting past an opening freeze seen under Xenia. The author discloses that the port was made almost entirely with Claude Code, directed and tested by the repository owner.","description_zh":"借助 ReXGlue 静态重编译 SDK，将 Xbox 360 版 Peter Jackson's King Kong 转译为原生 Windows 代码，并加入启动器以及显示、操控和图形选项。项目代码按主机的方式完成流式光盘读取；README 称这使游戏越过了在 Xenia 中出现的开场卡死。作者披露，该移植几乎完全由 Claude Code 完成，仓库所有者负责指导和测试。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"reva-ghidra-mcp","name":"ReVa (Reverse Engineering Assistant)","name_zh":"ReVa 面向大模型工具设计的 Ghidra MCP 扩展","url":"https://github.com/cyberkaida/reverse-engineering-assistant","evidence_url":"https://github.com/cyberkaida/reverse-engineering-assistant/blob/a05a6b0a18649efd6d74ec8447bdadf8d468c365/README.md","description_en":"Ghidra extension that runs an MCP server inside Ghidra, giving agents decompilation with namespace and cross-reference context, symbol, string, data-type, structure and call-graph tools, program diffing, renaming and PyGhidra scripting. Its README attributes the project's distinction to tool design for LLM use: many small tools whose schemas tolerate other input, redirect correctable mistakes and return short fragments linked to related information. Assistant mode serves an open Ghidra project to several clients at once; headless mode starts Ghidra itself with session-scoped projects.","description_zh":"在 Ghidra 内运行 MCP 服务器的 Ghidra 扩展，为智能体提供附带命名空间与交叉引用上下文的反编译、符号、字符串、数据类型、结构体与调用图工具，以及程序比对、重命名和 PyGhidra 脚本执行。其 README 将项目的特点归于面向大模型使用的工具设计：提供许多小工具，其模式在给定结构之外也能容忍其他输入，把可纠正的错误反馈给模型，并返回附带相关信息链接的简短片段。助手模式可让多个客户端同时连接已打开的 Ghidra 项目；无界面模式则由 ReVa 自行启动 Ghidra，项目仅在会话期间存在。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-18"},{"id":"splat","name":"splat","name_zh":"splat 二进制拆分工具","url":"https://github.com/ethteck/splat","evidence_url":"https://github.com/ethteck/splat/blob/7548b9771e6f8418507b23434187fb07741af6d4/README.md","description_en":"Binary splitter for decompilation and modding projects: a YAML config says where and how to cut an N64 ROM or PSX, PS2 or PSP binary into code, data and asset segments. A scan phase disassembles code and data, with MIPS handled by spimdisasm; a split phase writes the files and a linker script for rebuilding the input. Custom segment types can extend the pipeline.","description_zh":"面向反编译与模组项目的二进制拆分工具：由 YAML 配置指定在何处、以何种方式把 N64 ROM 或 PSX、PS2、PSP 二进制切分为代码、数据和素材段。扫描阶段反汇编代码与数据，MIPS 部分由 spimdisasm 处理；拆分阶段写出文件以及用于重新构建输入文件的链接脚本。可编写自定义段类型扩展该流程。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"mario-party-4-decomp-case","name":"Mario Party 4: matching GameCube decompilation of the USA releases","name_zh":"Mario Party 4：美版 GameCube 一致性反编译重建","url":"https://github.com/mariopartyrd/marioparty4","evidence_url":"https://github.com/mariopartyrd/marioparty4/blob/5b01c79b4910525e3fc5aa312eddd6d014e7f337/README.md","description_en":"Reconstructs Mario Party 4’s GameCube main executable and REL modules as C source that rebuilds both USA releases. The build analyzes the user’s own disc image and checks every linked output against version-specific SHA-1 lists. PAL and Japanese work is stale and no PC port exists yet; matching results remain project-reported here.","description_zh":"将 Mario Party 4 的 GameCube 主程序和 REL 模块重建为 C 源码，可重新构建两个美版发行版本。构建会分析使用者自备的光盘镜像，并按各版本的 SHA-1 清单检查每个链接产物。欧版和日版工作已停滞，也尚无 PC 移植；此处的一致性结果仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"speedbreaker-nfs-most-wanted-case","name":"SpeedBreaker: statically recompiling Need for Speed: Most Wanted for Xbox 360","name_zh":"SpeedBreaker：对 Xbox 360 版《极品飞车：最高通缉》的静态重编译","url":"https://github.com/SpeedBreakerProject/speedbreaker","evidence_url":"https://github.com/SpeedBreakerProject/speedbreaker/blob/31849f5f1d275bf21987440cdc27d94071013656/README.md","description_en":"Translates the Xbox 360 executable of Need for Speed: Most Wanted (2005) into native C++ with a patched XenonRecomp and runs it on a project runtime that stands in for the console’s kernel, Xenos GPU, XMA audio and controllers. Releases target SteamOS, Linux and Apple silicon Macs, with an experimental iPhone and iPad build, while all game data comes from the player’s own US disc. Rendering and frame-pacing improvements are project-reported.","description_zh":"使用打过补丁的 XenonRecomp 将 Xbox 360 版《极品飞车：最高通缉》（2005）的可执行文件转换为原生 C++，并在项目自建的运行时上执行，由运行时代替主机的内核、Xenos GPU、XMA 音频和控制器。发布版面向 SteamOS、Linux 和 Apple 芯片 Mac，另有实验性的 iPhone 与 iPad 版本，所有游戏数据均来自玩家自有的美版光盘。渲染与帧节奏方面的改进均为项目自述。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"x64dbg-mcp-server","name":"x64dbg-MCP Server","name_zh":"x64dbg-MCP Server 调试器 MCP 插件","url":"https://github.com/duty1g/x64dbg-mcp-server","evidence_url":"https://github.com/duty1g/x64dbg-mcp-server/blob/18be30ab417a371fd441de68d7252d2bc1830f11/README.md","description_en":"Native x64dbg plugin, written in Zig for both x32dbg and x64dbg, that serves an MCP endpoint over streamable HTTP and SSE from inside the debugger. Agents can load or attach to a process, set software, hardware, memory and conditional breakpoints, step and trace, read registers, call stacks, threads, memory maps, imports, strings and cross-references, and run arbitrary x64dbg commands. A bundled SKILL.md guide tells agents to confirm the debugger state before every action.","description_zh":"以 Zig 编写、同时支持 x32dbg 与 x64dbg 的原生 x64dbg 插件，在调试器内部通过 streamable HTTP 和 SSE 提供 MCP 端点。智能体可以加载或附加进程，设置软件、硬件、内存及条件断点，单步与跟踪执行，读取寄存器、调用栈、线程、内存映射、导入表、字符串和交叉引用，并执行任意 x64dbg 命令。随附的 SKILL.md 指南要求智能体在每次操作前先确认调试器状态。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-18"},{"id":"sims-bustin-out-gba-decomp-case","name":"The Sims: Bustin' Out: an AI-driven partial GBA matching decompilation","name_zh":"The Sims: Bustin' Out：AI 驱动的部分 GBA 一致性反编译重建","url":"https://github.com/DaBrown95/tsbodp","evidence_url":"https://github.com/DaBrown95/tsbodp/blob/0beb04fdc3142a9860059600d1037725f1bc6c77/README.md","description_en":"Rebuilds the USA/Europe Game Boy Advance release of The Sims: Bustin' Out byte for byte while gradually replacing ROM regions with matching C compiled by agbcc. The README calls it an AI-driven experiment in which almost all code, analysis and tooling are AI-generated. Most of the ROM is still copied from the user’s dump, so whole-ROM equality does not mean the game has been decompiled.","description_zh":"逐字节重建 The Sims: Bustin' Out 的 Game Boy Advance 美欧版，并逐步用 agbcc 编译、结果一致的 C 代码替换 ROM 区域。README 称这是由 AI 驱动的实验，几乎所有代码、分析与工具都由 AI 生成。ROM 的大部分仍从使用者的转储中复制，因此整个 ROM 一致并不代表游戏已完成反编译。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"m2c","name":"m2c","name_zh":"m2c 匹配反编译器","url":"https://github.com/matt-kempster/m2c","evidence_url":"https://github.com/matt-kempster/m2c/blob/708d2d2cb2698f091a92492b328f73b24209f72d/README.md","description_en":"Decompiler for matching projects that turns GNU as-format 32-bit MIPS, ARM, PowerPC and SuperH assembly into draft C, with partial C++ support. A target combines platform, compiler (IDO, GCC or MetroWerks CodeWarrior) and language; context files supply types, and it can infer unknown struct fields and emit global initializers. The README places it alongside splat, asm-differ and decomp-permuter, and decomp.me calls it for initial decompilations.","description_zh":"面向匹配反编译项目的反编译器，将 GNU as 格式的 32 位 MIPS、ARM、PowerPC 和 SuperH 汇编转换为 C 代码初稿，并部分支持 C++。目标由平台、编译器（IDO、GCC 或 MetroWerks CodeWarrior）和语言组成；上下文文件提供类型信息，还能推断未知的结构体字段并生成全局变量初始化代码。README 将它与 splat、asm-differ 和 decomp-permuter 并列使用，decomp.me 也调用它生成初步反编译结果。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"destiny2-build-86657-reconstruction-report-case","name":"Destiny 2 build 86657: Sunrise/Dawn reconstruction research report","name_zh":"Destiny 2 build 86657：Sunrise／Dawn 重建研究报告","url":"https://github.com/isinternets/d2-research","evidence_url":"https://github.com/isinternets/d2-research/blob/9a5b58f1f8408ed48b01705e0138ee25050669f2/README.md","description_en":"A dated research report on the Sunrise/Dawn reconstruction of the archived Destiny 2 build 86657 client, which emulates platform sign-on and the examined Bungie service contracts locally and adds reconstructed mission host policy. It records transport, decoding, object creation, presentation and gameplay results separately, and keeps superseded conclusions with their cited sources. It documents the case rather than shipping the runtime implementation or a recovered Bungie backend; playthroughs and native results remain project-reported.","description_zh":"一份注明版本日期的研究报告，记录已归档 Destiny 2 build 86657 客户端的 Sunrise／Dawn 重建：在本地模拟平台登录与所考察的 Bungie 服务契约，并补充重建的任务主机策略。报告把传输、解码、对象创建、呈现与游戏玩法结果分开记录，并连同所引来源保留已被推翻的结论。它记录案例本身，不提供运行时实现，也不是恢复出的 Bungie 后端；通关与原生实验结果仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game","protocol"],"verified_at":"2026-10-18"},{"id":"svr2011-recomp-case","name":"SVR2011-Recomp: a ReXGlue recompilation of WWE SmackDown vs. Raw 2011","name_zh":"SVR2011-Recomp：借助 ReXGlue 重编译 WWE SmackDown vs. Raw 2011","url":"https://github.com/shaneomac1337/SVR2011-Recomp","evidence_url":"https://github.com/shaneomac1337/SVR2011-Recomp/blob/6a12d52d0e32adfca092b6474d584b97d459b148/README.md","description_en":"Translates the Xbox 360 executable of WWE SmackDown vs. Raw 2011 to C++ ahead of time with ReXGlue and builds it as a Windows program on a Vulkan runtime derived from Xenia. A hand-maintained manifest adds function entry points the automatic pass misses, and project patches address frame pacing, a music-player delay and pipeline stalls. Exhibition play is author-tested on one AMD GPU; career mode and online remain untested.","description_zh":"借助 ReXGlue 将 WWE SmackDown vs. Raw 2011 的 Xbox 360 可执行文件提前转换为 C++，并在源自 Xenia 的 Vulkan 运行时上构建为 Windows 程序。手工维护的清单补充自动分析遗漏的函数入口，项目补丁则处理帧节奏、音乐播放器延迟和渲染管线卡顿。作者仅在一款 AMD GPU 上测试了表演赛等模式；生涯模式与在线功能仍未测试。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"mcp-windbg","name":"mcp-windbg","name_zh":"mcp-windbg WinDbg 调试 MCP 服务器","url":"https://github.com/svnscha/mcp-windbg","evidence_url":"https://github.com/svnscha/mcp-windbg/blob/48e4350d57c44a38068be4f64e89a0fe60fe5c04/README.md","description_en":"Independent, community-built MCP server that runs Microsoft's cdb.exe and kd.exe headless, so agents can open and triage user-mode and kernel crash dumps, attach to cdb remote debug servers and KD kernel targets, and run arbitrary debugger commands in separately addressed sessions. Its README points users who want AI inside WinDbg to Microsoft's official WinDbg MCP and positions this project as an alternative for other MCP clients, remote HTTP use and batch dump triage; it calls itself a wrapper that runs real debugger commands, not an automatic fix.","description_zh":"由社区独立开发的 MCP 服务器，以无界面方式运行微软的 cdb.exe 和 kd.exe，使智能体能够打开并初步分析用户态与内核崩溃转储，连接 cdb 远程调试服务器和 KD 内核目标，并在可分别寻址的会话中执行任意调试器命令。其 README 建议希望在 WinDbg 内使用 AI 的用户选择微软官方的 WinDbg MCP，并把本项目定位为面向其他 MCP 客户端、远程 HTTP 使用和批量转储分析的替代方案；项目自称只是执行真实调试器命令的封装，而非自动修复工具。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-18"},{"id":"decomp-toolkit","name":"decomp-toolkit","name_zh":"decomp-toolkit GameCube/Wii 反编译工具包","url":"https://github.com/encounter/decomp-toolkit","evidence_url":"https://github.com/encounter/decomp-toolkit/blob/0645e16511814920ffb05b25615dd71f1af73e4c/README.md","description_en":"GameCube/Wii matching-decompilation toolkit that analyzes DOL and REL executables and, from a project configuration, splits them into relocatable objects plus an ldscript.lcf for CodeWarrior's linker, so decompiled objects can replace original ones while the relinked binary is checked against the original. Analysis covers function boundaries, a Metrowerks/SDK signature database, relocations, sections and data objects, and objects are written without an assembler. Its CLI also handles disc images, archives, compression formats, CodeWarrior demangling and DWARF dumps.","description_zh":"面向 GameCube/Wii 匹配反编译的工具包：分析 DOL 和 REL 可执行文件，按项目配置将其拆分为可重定位目标文件，并为 CodeWarrior 链接器生成 ldscript.lcf，使反编译出的目标文件可逐个替换原有部分，同时将重新链接的二进制与原版核对。分析涵盖函数边界、Metrowerks/SDK 签名库、重定位、节区和数据对象，且无需汇编器即可直接写出目标文件。其命令行还可处理光盘镜像、归档、压缩格式、CodeWarrior 符号还原和 DWARF 转储。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"snap64-recomp-case","name":"Snap64 Recomp: a static-recompilation port of Pokémon Snap","name_zh":"Snap64 Recomp：Pokémon Snap 的静态重编译移植","url":"https://github.com/JackandBeans/Snap64Recomp","evidence_url":"https://github.com/JackandBeans/Snap64Recomp/blob/cf53b89272b9db19059dd97eed2690ea1dd94844/README.md","description_en":"Uses N64Recomp to statically recompile the US Nintendo 64 release of Pokémon Snap into a native Windows, Linux, Steam Deck and macOS port rendered with RT64. The recompiler reads a relocatable ELF linked from the matching ethteck/pokemonsnap decompilation together with the user’s ROM, and game-side patches are modified copies of decompiled functions. The author reports building the port with Claude Code; results remain project-reported.","description_zh":"使用 N64Recomp 将 Pokémon Snap 美版 Nintendo 64 发行版静态重编译为原生 Windows、Linux、Steam Deck 和 macOS 移植，由 RT64 负责渲染。重编译器读取从一致性 ethteck/pokemonsnap 反编译项目链接出的可重定位 ELF 及使用者自备的 ROM，游戏侧补丁则是反编译函数的修改副本。作者报告借助 Claude Code 完成移植；各项结果仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"dead-rising-2-case-zero-recomp-case","name":"Dead Rising 2: Case Zero — an Xbox 360 XBLA static recompilation port","name_zh":"Dead Rising 2: Case Zero：Xbox 360 XBLA 游戏的静态重编译移植","url":"https://github.com/wivi514/Dead_Rising_2_Case_Zero_Xenon_Recomp","evidence_url":"https://github.com/wivi514/Dead_Rising_2_Case_Zero_Xenon_Recomp/blob/a1feb9dd7a61e23b4bcbb1afab8edf3439ee86ac/README.md","description_en":"Builds a native Windows, Linux, Steam Deck and Apple Silicon port of the XBLA game Dead Rising 2: Case Zero by statically recompiling its Xbox 360 code with patched XenonRecomp and translating its shaders with patched XenosRecomp. A purpose-built runtime supplies a Vulkan renderer, XMA audio, keyboard/mouse input and online co-op through the author’s XenonLive service. Completion and platform results are project-reported.","description_zh":"使用打过补丁的 XenonRecomp 静态重编译 Xbox 360 代码，并用打过补丁的 XenosRecomp 转换着色器，为 XBLA 游戏 Dead Rising 2: Case Zero 构建可在 Windows、Linux、Steam Deck 和 Apple Silicon Mac 上运行的原生移植。专门编写的运行时提供 Vulkan 渲染器、XMA 音频、键鼠输入，以及通过作者的 XenonLive 服务实现的在线合作。通关情况与各平台结果均为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"openra-engine-case","name":"OpenRA: an engine reimplementation reimagining early Westwood RTS games","name_zh":"OpenRA：重新诠释早期 Westwood 即时战略游戏的引擎重新实现","url":"https://github.com/OpenRA/OpenRA","evidence_url":"https://github.com/OpenRA/OpenRA/blob/e180e3225f3930272dd451917467631618f8976f/README.md","description_en":"Provides a C# engine for early Westwood real-time strategy games, with mods that reimagine Command & Conquer: Red Alert, Tiberian Dawn and Dune 2000. It loads the original games’ content through its own file-system, MiniYAML rules and Lua mission layers rather than running or recovering Westwood code. Gameplay and interface deliberately follow OpenRA’s own design, so it is not a faithful recreation of the original executables.","description_zh":"为早期 Westwood 即时战略游戏提供以 C# 编写的引擎，并以模组形式重新诠释 Command & Conquer: Red Alert、Tiberian Dawn 和 Dune 2000。它通过自己的文件系统、MiniYAML 规则和 Lua 任务层加载原游戏内容，而不是运行或恢复 Westwood 的代码。玩法和界面有意遵循 OpenRA 自身的设计，因此并非对原可执行文件的忠实重现。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"rizin","name":"Rizin","name_zh":"Rizin 逆向工程框架","url":"https://github.com/rizinorg/rizin","evidence_url":"https://github.com/rizinorg/rizin/blob/db112e55614b8635b42d7515a2790ca9fb4e5d05/README.md","description_en":"Command-line reverse-engineering framework that began as a fork of radare2. The rizin shell analyzes and disassembles binaries, debugs programs and works as a scriptable hex editor, while rz-* tools cover binary-format information, assembly, diffing, hashing, pattern search and FLIRT signatures. The README lists dozens of architectures, bytecode formats and file formats from ELF, PE and Mach-O to dyld caches and BIOS/UEFI images; rzpipe scripts it from Python, Rust, Go and other languages. Cutter is the separate GUI built on it.","description_zh":"源自 radare2 分支的命令行逆向工程框架。rizin 交互环境可分析和反汇编二进制、调试程序，并可用作可脚本化的十六进制编辑器；rz-* 系列工具提供二进制格式信息、汇编、差异比较、哈希、模式搜索和 FLIRT 签名等功能。README 列出数十种架构、字节码格式和文件格式，从 ELF、PE、Mach-O 到 dyld 缓存和 BIOS/UEFI 镜像；可通过 rzpipe 用 Python、Rust、Go 等语言编写脚本。Cutter 是基于它的独立图形界面。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"cheatengine-mcp-bridge","name":"Cheat Engine MCP Bridge","name_zh":"Cheat Engine MCP Bridge 进程内存分析桥接","url":"https://github.com/miscusi-peek/cheatengine-mcp-bridge","evidence_url":"https://github.com/miscusi-peek/cheatengine-mcp-bridge/blob/6bd7ce90479250a9b4b75e7944df9c105ecb2572/README.md","description_en":"Connects MCP clients to Cheat Engine through a Lua bridge script and a Python MCP server, so an agent can inspect a process the user runs under Cheat Engine: memory reads and value scans, pointer-chain resolution, structure dissection, RTTI class names, disassembly, cross-references and hardware or DBVM breakpoints. Further tool groups write memory, inject DLLs or code, automate input and use Cheat Engine's kernel-mode driver. The README limits it to educational and research use and disclaims multiplayer cheating and Terms of Service violations.","description_zh":"通过 Lua 桥接脚本和 Python MCP 服务器把 MCP 客户端连接到 Cheat Engine，使智能体能够检查用户在 Cheat Engine 下运行的进程：读取内存与扫描数值、解析指针链、剖析结构体、识别 RTTI 类名、反汇编、查找交叉引用，以及设置硬件或 DBVM 断点。另有工具组可写入内存、注入 DLL 或代码、自动化输入，并调用 Cheat Engine 的内核模式驱动。README 将其限定于教学和研究用途，并声明不支持多人游戏作弊或违反服务条款的行为。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"dead-rising-2-case-west-recomp-case","name":"Dead Rising 2: Case West — a sibling Xbox 360 XBLA static recompilation port","name_zh":"Dead Rising 2: Case West：同系列的 Xbox 360 XBLA 静态重编译移植","url":"https://github.com/wivi514/Dead_Rising_2_Case_West_Xenon_Recomp","evidence_url":"https://github.com/wivi514/Dead_Rising_2_Case_West_Xenon_Recomp/blob/cb7dc0f46cfc71961e37f8a20b07ad143a3e161a/README.md","description_en":"Builds a native Windows, Linux, Steam Deck and Apple Silicon port of the XBLA epilogue Dead Rising 2: Case West by statically recompiling its Xbox 360 code with patched XenonRecomp and translating its shaders with patched XenosRecomp. It shares most of its runtime with the author’s separate Case Zero port, executing the console GPU command stream on Vulkan with XMA audio and keyboard/mouse input. Completion and platform results are project-reported.","description_zh":"使用打过补丁的 XenonRecomp 静态重编译 Xbox 360 代码，并用打过补丁的 XenosRecomp 转换着色器，为 XBLA 尾声篇 Dead Rising 2: Case West 构建可在 Windows、Linux、Steam Deck 和 Apple Silicon Mac 上运行的原生移植。它与作者另一个 Case Zero 移植共用大部分运行时，在 Vulkan 上执行主机 GPU 命令流，并提供 XMA 音频和键鼠输入。通关情况与各平台结果均为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"decompiler-explorer","name":"Decompiler Explorer","name_zh":"Decompiler Explorer 反编译器对比服务","url":"https://dogbolt.org","evidence_url":"https://github.com/decompiler-explorer/decompiler-explorer/blob/a7b8381b610478f67b6dd35b6812878f08636c54/README.md","description_en":"Web service at dogbolt.org that runs one small uploaded executable through many decompilers and shows their C-like output side by side, described as Compiler Explorer in reverse. The pinned source has runners for angr, Binary Ninja, Boomerang, dewolf, Ghidra, Hex-Rays, Kuna, REC Studio, Reko, Relyze, RetDec, rev.ng and Snowman, which helps compare how different decompilers render the same code.","description_zh":"位于 dogbolt.org 的网络服务：将上传的单个小型可执行文件交给多款反编译器处理，并排显示它们输出的类 C 代码，自称“反向的 Compiler Explorer”。所固定版本的源码包含 angr、Binary Ninja、Boomerang、dewolf、Ghidra、Hex-Rays、Kuna、REC Studio、Reko、Relyze、RetDec、rev.ng 和 Snowman 的运行器，便于比较不同反编译器如何呈现同一段代码。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-18"},{"id":"wireshark-mcp","name":"Wireshark MCP","name_zh":"Wireshark MCP 基于 tshark 的协议解析服务器","url":"https://github.com/bx33661/Wireshark-MCP","evidence_url":"https://github.com/bx33661/Wireshark-MCP/blob/0e1b6595a2dcfe097133deb1c0c3128fb7a110d4/README.md","description_en":"MCP server that wraps tshark, and optionally other Wireshark command-line tools, so agents can query saved captures through Wireshark's dissectors: packet lists and details, stream following, arbitrary field extraction, protocol hierarchies and conversations, decode-as rules for non-standard ports, protocol preferences, TLS and WPA decryption with user-supplied keys, and one tool that applies preset fields and filters for 25 protocols such as Modbus, S7comm, MQTT, Zigbee and BLE. Separate security-heuristic, live-capture and capture-editing tools sit beside the dissection tools.","description_zh":"封装 tshark 及可选的其他 Wireshark 命令行工具的 MCP 服务器，使智能体能借助 Wireshark 的解析器查询已保存的抓包文件：数据包列表与详情、流追踪、任意字段提取、协议层级与会话统计、针对非标准端口的 decode-as 规则、协议首选项、使用用户提供的密钥进行 TLS 与 WPA 解密，以及一个为 Modbus、S7comm、MQTT、Zigbee、BLE 等 25 种协议套用预设字段和过滤器的工具。解析类工具之外，另有安全启发式检测、实时抓包和抓包文件编辑等独立工具。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["protocol"],"verified_at":"2026-10-18"},{"id":"simpsons-wrestling-recompiled-case","name":"The Simpsons Wrestling Recompiled: a psxrecomp PlayStation static recompilation","name_zh":"The Simpsons Wrestling Recompiled：基于 psxrecomp 的 PlayStation 静态重编译","url":"https://github.com/TekRantGaming/simpsons-wrestling-recompiled","evidence_url":"https://github.com/TekRantGaming/simpsons-wrestling-recompiled/blob/1aaee1a999f4dcc60dbf965a9ed9944373528469/README.md","description_en":"Translates the PlayStation game’s MIPS code to C with a pinned psxrecomp fork and builds Windows and Linux programs on its hardware-modelling runtime, with a launcher and a game-specific plugin. Without patching game code, the plugin adds 16:9 matches, 60 FPS by raising the emulated CPU clock and rescaling movement, intro skipping and unlocks. The user’s own NTSC-U disc image is required, and the measurements are author-reported.","description_zh":"借助固定版本的 psxrecomp 分支，将这款 PlayStation 游戏的 MIPS 代码转换为 C，并基于其模拟硬件行为的运行时构建 Windows 与 Linux 程序，另附启动器和专用插件。插件在不修补游戏代码的前提下，实现比赛中的 16:9 画面、通过提高模拟 CPU 频率并修正移动量达到 60 FPS、跳过片头及全部解锁。需使用者自备 NTSC-U 光盘镜像；测量结果为作者报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"openrct2-engine-case","name":"OpenRCT2: an open re-implementation of RollerCoaster Tycoon 2","name_zh":"OpenRCT2：RollerCoaster Tycoon 2 的开源重新实现","url":"https://github.com/OpenRCT2/OpenRCT2","evidence_url":"https://github.com/OpenRCT2/OpenRCT2/blob/53bbc400e28be44d3c2e56fa514d5f65b61a64d4/readme.md","description_en":"Re-implements RollerCoaster Tycoon 2, originally written in x86 assembly, as a C++ engine that runs on the original game’s data. It loads RCT2 saves and scenarios, and RCT1 scenarios when those files are present, while saving to its own documented park format. Modern-platform support, interface and AI changes, higher limits and multiplayer are deliberate extensions, not reproductions of the original.","description_zh":"以 C++ 引擎重新实现原本用 x86 汇编编写的 RollerCoaster Tycoon 2，并在原游戏数据上运行。它可载入 RCT2 存档和场景，具备相应文件时也能载入 RCT1 场景，而保存时使用自己有文档说明的乐园格式。现代平台支持、界面与 AI 改动、更高上限和多人游戏都是有意扩展，并非对原版的复现。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"th06-decomp-case","name":"Touhou 6: reconstructing Embodiment of Scarlet Devil 1.02h source","name_zh":"Touhou 6：重建东方红魔乡 1.02h 版源码","url":"https://github.com/GensokyoClub/th06","evidence_url":"https://github.com/GensokyoClub/th06/blob/e840ab447f38579c2ea877e16a5d91a49adf016e/README.md","description_en":"Reconstructs C++ source for the Windows executable of Touhou 6: Embodiment of Scarlet Devil version 1.02h, aiming at an exact rebuild with the original Visual Studio .NET 2002 and DirectX 8 toolchain. reccmp and objdiff compare the rebuilt binary with the user’s original executable function by function. The committed progress badge reports every function implemented but 98.03% byte accuracy, so whole-binary identity is not claimed.","description_zh":"为 Touhou 6：东方红魔乡 1.02h 版的 Windows 可执行文件重建 C++ 源码，目标是用原版 Visual Studio .NET 2002 与 DirectX 8 工具链精确重新构建。reccmp 和 objdiff 将重建的二进制与使用者自备的原可执行文件逐函数比较。仓库内的进度徽章报告函数已全部实现、字节准确率为 98.03%，因此不主张整个二进制完全一致。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"binny-agent-harness","name":"BINNY","name_zh":"BINNY 逆向分析智能体框架","url":"https://github.com/openbin-ai/binny","evidence_url":"https://github.com/openbin-ai/binny/blob/000b6aca8c9d266b38252470102ac16c98575cd8/README.md","description_en":"An open-source terminal agent harness from OpenBin that runs a user-chosen hosted or local model over binary-analysis data. It reads decompiled functions, strings, imports and data from an OpenBin or OpenAPK project or a local Ghidra container run, follows triage, investigation and drafting playbooks, and saves a draft malware-analysis or vulnerability-research report for human review. It is an analysis harness with draft outputs, not a reconstruction project.","description_zh":"OpenBin 推出的开源终端智能体框架，让使用者自选的托管或本地模型处理二进制分析数据。它从 OpenBin 或 OpenAPK 项目、或本地 Ghidra 容器的分析结果中读取反编译函数、字符串、导入表和数据，按分诊、调查与起草流程工作，并保存恶意软件分析或漏洞研究报告草稿供人工审阅。它是输出草稿的分析框架，而非重建项目。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["app","binary","firmware"],"verified_at":"2026-10-18"},{"id":"rkd-telemetry-extractor-case","name":"RKD Telemetry Extractor: decoding Race-Keeper track-day recordings","name_zh":"RKD Telemetry Extractor：解读 Race-Keeper 赛道日录制数据","url":"https://github.com/sam-dumont/rkd-telemetry-extractor","evidence_url":"https://github.com/sam-dumont/rkd-telemetry-extractor/blob/8db9f373e1a7162d3f2efa297986bdfa86d9400f/RESEARCH_NOTES.md","description_en":"Documents the proprietary .rkd telemetry format written by Race-Keeper “Instant Video” recorders, whose bundled player runs only on Windows, and implements matching Python and Go parsers that export GPS and IMU channels as Telemetry Overlay CSV and GPX. The author credits Claude Code with the hex-dump analysis and hypothesis testing, anchored by known car IDs, circuit location and speeds. Field meanings rest on physical cross-checks from the author’s own recordings, and several record types remain partly unknown.","description_zh":"记录 Race-Keeper “Instant Video” 记录仪所写的专有 .rkd 遥测格式（随附播放器仅支持 Windows），并以结果一致的 Python 与 Go 解析器把 GPS 和 IMU 通道导出为 Telemetry Overlay CSV 与 GPX。作者称十六进制分析和假设检验由 Claude Code 协助完成，并以已知车辆编号、赛道位置和车速作为锚点。字段含义依据作者自有录制数据的物理交叉核对得出，若干记录类型仍未完全解读。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-10-18"},{"id":"pwndbg","name":"pwndbg","name_zh":"pwndbg GDB/LLDB 调试增强插件","url":"https://github.com/pwndbg/pwndbg","evidence_url":"https://github.com/pwndbg/pwndbg/blob/3044ccdf938221e04241e85fe02961ef174ef975/README.md","description_en":"Python plug-in that loads into GDB, or runs as a REPL around LLDB, to make live program state easier to inspect. Each stop prints a context of registers, stack, call frames and annotated disassembly with recursively dereferenced pointers; commands cover memory maps, search, telescoping, heap allocators and Go values, with Capstone/Unicorn emulation and decompiler integration for IDA, Binary Ninja, Ghidra and angr-management. The README lists Linux ELF, macOS Mach-O, QEMU user/system and embedded Cortex-M or RISC-V/32 debugging.","description_zh":"可加载到 GDB 中、或作为 LLDB 外层 REPL 运行的 Python 插件，使运行中程序的状态更易检查。每次停下时都会打印寄存器、栈、调用帧和带注释的反汇编等上下文，并递归解引用指针；命令涵盖内存映射、搜索、内存链式查看、堆分配器和 Go 值，还借助 Capstone/Unicorn 模拟执行指令，并可与 IDA、Binary Ninja、Ghidra 和 angr-management 反编译器集成。README 列出 Linux ELF、macOS Mach-O、QEMU 用户态／系统态以及嵌入式 Cortex-M 或 RISC-V/32 调试场景。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-18"},{"id":"driver-recomp-setup-host-case","name":"Driver Recompiled: a psxrecomp setup host that builds the game locally","name_zh":"Driver Recompiled：在本地构建游戏的 psxrecomp 安装宿主","url":"https://github.com/alexbeavs-ps1-ports/driver-recomp","evidence_url":"https://github.com/alexbeavs-ps1-ports/driver-recomp/blob/11e9a4a8c8fcf931e4ef70121d231a5a3cb5c42b/README.md","description_en":"Packages a psxrecomp static-recompilation project for Driver (PlayStation, USA) as a setup host: releases carry the recompiler, runtime and a recomp-ui launcher, and the player’s machine generates and compiles the game from the user’s own disc image. The repository holds configuration, Ghidra-derived function seeds and release automation rather than game code. Its documented status is thin: an operator-confirmed private build reaches gameplay, while package release gates remain open.","description_zh":"将 Driver（PlayStation 美版）的 psxrecomp 静态重编译项目打包为“安装宿主”：发布包含重编译器、运行时和 recomp-ui 启动器，再由玩家电脑依据使用者自备的光盘镜像生成并编译游戏。仓库只包含配置、来自 Ghidra 的函数种子和发布自动化脚本，不含游戏代码。文档记录的状态较为有限：维护者确认一个私有构建可以进入游戏，而发布包的验收门槛仍未完成。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"himuro-fatal-frame-decomp-case","name":"Himuro: a matching Fatal Frame PS2 decompilation","name_zh":"Himuro：Fatal Frame（《零》）PS2 一致性反编译","url":"https://github.com/Mikompilation/Himuro","evidence_url":"https://github.com/Mikompilation/Himuro/blob/595b082aef19c329a25dc6926e4ac638d13ed75d/README.md","description_en":"Reconstructs Fatal Frame’s PS2 executable as C for the US, EU and Japanese releases, built with the original EE-GCC 2.9 toolchain and checked by SHA-1 against the user’s own executables. Committed objdiff reports list the US and EU code as fully matched and the Japanese code as partial, and a few routines still rely on assembly or byte patches. Porting to modern hardware is a stated later goal, not part of this repository.","description_zh":"将 Fatal Frame（《零》）PS2 可执行文件的美版、欧版和日版重建为 C，使用原始的 EE-GCC 2.9 工具链构建，并以使用者自备可执行文件的 SHA-1 校验结果。仓库提交的 objdiff 报告显示美版和欧版代码已全部匹配、日版仅部分匹配，少数例程仍依赖汇编或字节补丁。移植到现代硬件是项目声明的后续目标，不在本仓库范围内。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"doaxvb-native-port-case","name":"DOAXVB Native PC Port: statically recompiling Dead or Alive Xtreme Beach Volleyball","name_zh":"DOAXVB Native PC Port：对《Dead or Alive Xtreme Beach Volleyball》的静态重编译","url":"https://github.com/NoRain211/doaxvb-re","evidence_url":"https://github.com/NoRain211/doaxvb-re/blob/e282a3fc15c793e621098fc0a5d9e70aa6a6e9c2/README.md","description_en":"Lifts the original Xbox executable of Dead or Alive Xtreme Beach Volleyball to C with a fork of xboxrecomp and links it with a hand-written runtime that replaces kernel imports, audio and key Direct3D 8 and DirectSound APIs. Setup builds the runner locally from the user’s USA disc image and checks generated files against hashes in an authenticated recipe; releases carry only tools and source. Rewriting game logic as readable source has so far reached only the startup thread entry.","description_zh":"借助 xboxrecomp 的分支将原版 Xbox《Dead or Alive Xtreme Beach Volleyball》可执行文件提升为 C 代码，并与手写运行时链接，由运行时替代内核导入、音频以及关键的 Direct3D 8 和 DirectSound API。安装程序依据使用者自有的美版光盘镜像在本地构建运行程序，并按经认证配方中的哈希校验生成文件；发布包只含工具和源码。将游戏逻辑改写为可读源码的工作目前只完成了启动线程入口。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"elgato-hdr-uvc-capture-case","name":"Elgato HDR: a userspace capture path for the Elgato 4K X’s 10-bit mode","name_zh":"Elgato HDR：为 Elgato 4K X 的 10 位模式提供用户态采集通路","url":"https://github.com/talkaboutdesign/elgato-hdr","evidence_url":"https://github.com/talkaboutdesign/elgato-hdr/blob/7799d3c53520bcc3dd049211244bfaf49b905cb0/README.md","description_en":"A native macOS app that reaches the Elgato 4K X capture card’s 10-bit P010 video mode, which the project says Apple’s built-in webcam driver does not expose to apps. A root helper detaches that driver and runs the card’s USB Video Class streaming directly through libusb, feeding a Metal HDR viewer, an HDR10 recorder and an editor. Latency figures and device coverage remain author-reported.","description_zh":"一款原生 macOS 应用，用于获取 Elgato 4K X 采集卡的 10 位 P010 视频模式；项目称苹果内置的摄像头驱动不会向应用开放该模式。一个 root 权限辅助程序卸下该驱动，通过 libusb 直接执行采集卡的 USB 视频类（UVC）串流，为 Metal HDR 预览、HDR10 录制和编辑器提供画面。延迟数据和设备覆盖范围仍为作者报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-18"},{"id":"ido-static-recomp","name":"ido-static-recomp","name_zh":"ido-static-recomp IRIX IDO 编译器静态重编译工具","url":"https://github.com/decompals/ido-static-recomp","evidence_url":"https://github.com/decompals/ido-static-recomp/blob/d5aec59932034b8a20f23f471297a55c45dcbc45/README.md","description_en":"Statically recompiles the IRIX MIPS programs of SGI's IDO 5.3 and 7.1 C toolchain, such as cc, cfe, uopt, ugen and as1, into native Linux, macOS and Windows executables, so matching decompilation projects can build with the original compiler code on modern hosts. It recompiles compilers, not games: it neither decompiles nor translates game code.","description_zh":"将 SGI IDO 5.3 与 7.1 C 工具链中的 IRIX MIPS 程序（如 cc、cfe、uopt、ugen 和 as1）静态重编译为原生 Linux、macOS 和 Windows 可执行文件，使匹配式反编译项目能在现代主机上以原始编译器代码进行构建。它重编译的是编译器而非游戏，本身既不反编译也不转换游戏代码。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"th08-web-wasm-port-case","name":"TH08 Web: a WebAssembly port built from reconstructed source","name_zh":"TH08 Web：基于重建源码的 WebAssembly 移植","url":"https://github.com/N0zoM1z0/th08-web","evidence_url":"https://github.com/N0zoM1z0/th08-web/blob/e3485ab9a9af3b5a90ce51841667bbdf5a867e5c/README.md","description_en":"Compiles the reconstructed C++ source of the Japanese Touhou 8 1.00d release to WebAssembly with Emscripten, adding WebGL 2 rendering, Web Audio, browser input and IndexedDB saves behind the game’s D3D8-, DirectSound- and DirectInput-shaped interfaces. Players select their own retail DAT files locally. The web build makes no binary-exact claim and is a separate port from the curated TH08 reconstruction.","description_zh":"使用 Emscripten 将日版 Touhou 8 1.00d 的重建 C++ 源码编译为 WebAssembly，并在游戏原有的 D3D8、DirectSound 与 DirectInput 形态接口之后接入 WebGL 2 渲染、Web Audio、浏览器输入和 IndexedDB 存档。玩家在本地选择自备的正版 DAT 文件。网页构建不主张与原二进制逐字节一致，是独立于已收录 TH08 重建的移植。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"ipsw","name":"ipsw","name_zh":"ipsw Apple 固件研究工具包","url":"https://github.com/blacktop/ipsw","evidence_url":"https://github.com/blacktop/ipsw/blob/a9eae76e8b1e901e4a03dd530defac8a1b33f91a/README.md","description_en":"Command-line toolkit for Apple firmware research and reverse engineering. It downloads and unpacks IPSWs, OTAs and KDKs and compares builds; inspects Mach-O load commands, symbols, signatures and entitlements with ARM64 disassembly; finds symbols and cross-references in dyld shared caches, extracts dylibs and dumps Objective-C headers and Swift metadata; extracts KEXTs and compares kernelcaches; and parses IMG4, decrypts AEA archives and inspects iBoot and coprocessor firmware.","description_zh":"面向 Apple 固件研究与逆向工程的命令行工具包。可下载并解包 IPSW、OTA 和 KDK 并比较不同构建；检查 Mach-O 的加载命令、符号、签名和权限，并反汇编 ARM64 代码；在 dyld 共享缓存中查找符号和交叉引用、提取 dylib、导出 Objective-C 头文件并查看 Swift 元数据；提取 KEXT 并比较 kernelcache；还能解析 IMG4、解密 AEA 归档，以及检查 iBoot 和协处理器固件。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["app","binary","firmware"],"verified_at":"2026-10-18"},{"id":"openxcom-engine-case","name":"OpenXcom: an open-source clone of X-COM: UFO Defense and Terror from the Deep","name_zh":"OpenXcom：X-COM: UFO Defense 与 Terror from the Deep 的开源克隆","url":"https://github.com/OpenXcom/OpenXcom","evidence_url":"https://github.com/OpenXcom/OpenXcom/blob/4a4bae5fa2e5a09282928e84943fc84b093e34ff/README.md","description_en":"Reimplements MicroProse’s UFO: Enemy Unknown (X-COM: UFO Defense) and X-COM: Terror from the Deep as a C++/SDL engine that runs on the user’s original game resources. Game data such as items, craft, research and missions is expressed in YAML rulesets, which also carry its standard mods and a wider modding ecosystem. It is a clone that reuses original content, not recovered MicroProse code.","description_zh":"以 C++/SDL 引擎重新实现 MicroProse 的 UFO: Enemy Unknown（X-COM: UFO Defense）与 X-COM: Terror from the Deep，并在使用者自己的原游戏资源上运行。物品、飞行器、研究和任务等游戏数据以 YAML 规则集表达，这些规则集也承载其标准模组及更广泛的模组生态。这是复用原内容的克隆实现，而非恢复出的 MicroProse 代码。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"skate3-recomp-case","name":"Skate 3 Recomp: a native Xbox 360 recompilation through ReXGlue","name_zh":"Skate 3 Recomp：通过 ReXGlue 实现的 Xbox 360 原生重编译","url":"https://github.com/mchughalex/skate3recomp","evidence_url":"https://github.com/mchughalex/skate3recomp/blob/f6e0ae87fdfecbadb5c1e36c55d66a744187a3cd/README.md","description_en":"Recompiles the Xbox 360 version of Skate 3 into native Windows, Linux and macOS builds with a Skate-specific fork of the ReXGlue SDK. Since v2.0.0 a native Direct3D 12 and Vulkan renderer with ports of the game’s own material shading replaces emulation of the Xbox 360 GPU, which remains as a fallback. Game files come from the user’s disc image; the author calls the native renderer early and has not tested the game end to end.","description_zh":"借助 ReXGlue SDK 的 Skate 专用分支，将 Xbox 360 版《Skate 3》重编译为 Windows、Linux 与 macOS 原生版本。自 v2.0.0 起，基于 Direct3D 12 和 Vulkan、移植了游戏自身材质着色的原生渲染器取代对 Xbox 360 GPU 的模拟，模拟渲染器保留为后备。游戏文件来自使用者的光盘镜像；作者称原生渲染器尚处早期，且尚未完整测试整个游戏。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"decomp-wtf-agent-decompilation","name":"decomp.wtf","name_zh":"decomp.wtf 智能体反编译工具","url":"https://github.com/i12bp8/decomp.wtf","evidence_url":"https://github.com/i12bp8/decomp.wtf/blob/575b4a30ed481ff5497dfb9ce4f599368a95a04a/README.md","description_en":"A discontinued local app and MCP server that hands AI coding agents one function of a user-owned console game at a time, compiles each C attempt with the game’s period compiler and accepts it only when the linked result matches the original bytes. It can start a project from a ROM or disc image, or work inside forks of public decompilation projects listed on decomp.dev, where objdiff judges the result. Its final commit, dated 15 October 2026, marks it discontinued in response to opposition in the decompilation community; the code stays under MIT without further fixes or releases.","description_zh":"一款已停止开发的本地应用与 MCP 服务，把用户自有主机游戏的函数逐个交给 AI 编程智能体，用该游戏当年的编译器编译每次提交的 C 代码，只有链接后的结果与原始字节一致才算通过。它可从 ROM 或光盘镜像新建项目，也可在 decomp.dev 所列公开反编译项目的分叉中工作，由 objdiff 判定结果。其 2026 年 10 月 15 日的最后一次提交宣布停止开发，理由是反编译社区的反对；代码仍以 MIT 许可保留，但不再修复或发布新版本。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["game"],"verified_at":"2026-10-18"},{"id":"uncharted-collection-pc-port-case","name":"Uncharted: The Nathan Drake Collection native Windows port","name_zh":"《神秘海域：内森·德雷克合集》原生 Windows 移植","url":"https://github.com/bc160201983/Uncharted-The-Nathan-Drake-Collection-PC-port","evidence_url":"https://github.com/bc160201983/Uncharted-The-Nathan-Drake-Collection-PC-port/blob/dfc9fb6e70794bc81ae62836e3e5fb993ff50b3e/README.md","description_en":"Runs the PS4 Uncharted: The Nathan Drake Collection’s own x86-64 executables natively on Windows: a runtime supplies the PS4 system libraries and a shadPS4-derived Vulkan renderer executes the GPU work. The port adds a per-game launcher, resolution patches and modern upscaling, and its status table reports all three games playable with listed open issues. It is a compatibility-runtime port rather than a decompilation, and its results remain project-reported.","description_zh":"在 Windows 上原生运行 PS4 版《神秘海域：内森·德雷克合集》自身的 x86-64 可执行文件：由运行时提供 PS4 系统库，并以源自 shadPS4 的 Vulkan 渲染器执行 GPU 工作。该移植提供按游戏保存设置的启动器、分辨率补丁与现代超分辨率技术，其状态表报告三部游戏均可游玩，并列出未解决问题。这是兼容运行时移植而非反编译重建，结果仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"th095-reconstruction-case","name":"TH095: function-level reconstruction of Shoot the Bullet 1.02a","name_zh":"TH095：东方文花帖 1.02a 的函数级重建","url":"https://github.com/N0zoM1z0/th095","evidence_url":"https://github.com/N0zoM1z0/th095/blob/6084b36cfa90ac1720f0cba36caec3ee56fc5e1f/README.md","description_en":"Reconstructs source for the original Japanese Touhou 9.5: Shoot the Bullet 1.02a executable, accepting function exactness only through reproducible byte comparison of pinned Visual C++ .NET 2003 builds against one hash-attested target. The whole program also compiles and links into a playable Windows i386 executable, while README keeps playability, function matching and whole-executable identity as separate statuses.","description_zh":"为日版 Touhou 9.5：东方文花帖 1.02a 原可执行文件重建源码；只有使用固定版本 Visual C++ .NET 2003 构建、并与单一经哈希核验的目标进行可复现字节比较后，才认定函数级一致。整个程序也能编译链接为可游玩的 Windows i386 可执行文件，而 README 将可玩性、函数匹配与整个可执行文件一致性列为相互独立的状态。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"dynamorio","name":"DynamoRIO","name_zh":"DynamoRIO 动态二进制插桩框架","url":"https://github.com/DynamoRIO/dynamorio","evidence_url":"https://github.com/DynamoRIO/dynamorio/blob/6d2165aa485ca91bf10faa64440cfadce850b0bc/README.md","description_en":"Runtime code manipulation system for building dynamic tools that observe or transform any part of an unmodified program while it runs. Its API and IA-32/AMD64/ARM/AArch64 instruction manipulation library allow arbitrary changes to application instructions, not only inserted callouts. The release package bundles tools including drcov for code coverage, drltrace for library-call tracing, drstrace for Windows system calls, drmemtrace instruction and memory traces and the drdisas disassembler. It is a framework for building instrumentation tools, distinct from Frida's scripting of live processes.","description_zh":"运行时代码操作系统，用于构建在未修改程序运行期间观察或变换其任意部分的动态工具。其 API 与 IA-32/AMD64/ARM/AArch64 指令操作库允许任意修改应用指令，而不仅限于插入回调。发布包附带 drcov 代码覆盖率、drltrace 库调用跟踪、drstrace Windows 系统调用跟踪、drmemtrace 指令与内存访问跟踪以及 drdisas 反汇编器等工具。它是用于构建插桩工具的框架，与 Frida 对运行中进程编写脚本的方式不同。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-18"},{"id":"lgwebos-menubar-remote-case","name":"LGwebOS-menubar: a native macOS remote for LG webOS TVs","name_zh":"LGwebOS-menubar：LG webOS 电视的原生 macOS 遥控器","url":"https://github.com/gabrielgreco1/TVmenubar-MacOS","evidence_url":"https://github.com/gabrielgreco1/TVmenubar-MacOS/blob/8482f36aaeb2e6577cf58bba12306ba3701c0fd2/README.md","description_en":"A native macOS menu-bar app that pairs with an LG webOS TV over its local encrypted WebSocket interface to launch apps, switch inputs, adjust volume and picture settings, send pointer input and cast selected media. The project credits the public Connect SDK for webOS protocol behavior and reuses PyWebOSTV’s registration manifest. Testing covers one TV on webOS 5.0.","description_zh":"一款原生 macOS 菜单栏应用，通过 LG webOS 电视在局域网内的加密 WebSocket 接口完成配对，可启动应用、切换输入源、调节音量和画面设置、发送指针输入并投放所选媒体。项目称 webOS 协议行为参考了公开的 Connect SDK，并沿用 PyWebOSTV 的注册清单。测试仅覆盖一台 webOS 5.0 电视。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-10-20"},{"id":"ps2recomp","name":"PS2Recomp","name_zh":"PS2Recomp PlayStation 2 静态重编译器","url":"https://github.com/ran-j/PS2Recomp","evidence_url":"https://github.com/ran-j/PS2Recomp/blob/eb8688b2fd191129f103a39543002c005b33409c/README.md","description_en":"Experimental static recompiler that translates MIPS R5900 code from PlayStation 2 ELF executables into C++ and links it with a bundled runtime. ps2xAnalyzer or a Ghidra export script produces a per-game TOML of functions, stubs, skips and instruction patches; ps2xRecomp emits a literal instruction-by-instruction translation; ps2xRuntime and ps2xIOP supply guest memory, syscall dispatch, IOP module execution with HLE fallbacks and partial, largely stubbed GS/VU hardware. Output is not decompiled source, and getting a game to run remains per-game porting work.","description_zh":"实验性的静态重编译器，将 PlayStation 2 ELF 可执行文件中的 MIPS R5900 代码转换为 C++，并与随附的运行时链接。ps2xAnalyzer 或 Ghidra 导出脚本为每款游戏生成包含函数、存根、跳过项和指令补丁的 TOML 配置；ps2xRecomp 输出逐条指令的直译代码；ps2xRuntime 与 ps2xIOP 提供客户机内存、系统调用分发、带 HLE 回退的 IOP 模块执行，以及仅部分实现、大多为存根的 GS/VU 硬件。输出不是反编译源码，让游戏真正运行仍需针对每款游戏进行移植。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"corsixth-engine-case","name":"CorsixTH: an open reimplementation of Theme Hospital","name_zh":"CorsixTH：Theme Hospital 的开源重新实现","url":"https://github.com/CorsixTH/CorsixTH","evidence_url":"https://github.com/CorsixTH/CorsixTH/blob/e5138ed8de906ccbf6692299b4375f9312df147e/README.md","description_en":"Reimplements the engine of Bullfrog’s 1997 Theme Hospital, with game logic in Lua and C++ for graphics, sound, movies and pathfinding, on top of the original game’s data files. The README reports that the full campaign can be completed, lists features that are still missing, and adds extensions such as high resolutions and a map editor. It recreates the game’s behaviour on original content rather than recovering Bullfrog source code.","description_zh":"重新实现 Bullfrog 1997 年游戏 Theme Hospital 的引擎：游戏逻辑以 Lua 编写，图形、声音、影片和寻路由 C++ 处理，并建立在原游戏数据文件之上。README 报告完整战役已可通关，列出仍缺失的功能，并加入高分辨率和地图编辑器等扩展。它在原内容上重现游戏行为，而不是恢复 Bullfrog 的源码。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"openriseofnations-engine-case","name":"OpenRiseOfNations: a native macOS engine reimplementation","name_zh":"OpenRiseOfNations：原生 macOS 引擎重新实现","url":"https://github.com/ben-wright-1/OpenRiseOfNations","evidence_url":"https://github.com/ben-wright-1/OpenRiseOfNations/blob/2a0dfde8acdb7185c6087b10ef89b4f66731e5a0/README.md","description_en":"Reimplements the Rise of Nations: Extended Edition engine as a native macOS app with a Metal renderer, a deterministic simulation, a computer opponent and a compatible BigHugeScript compiler and virtual machine, loading art, maps, rules and scripts from the user’s own Windows installation. Subsystem specifications written from Ghidra study of the symbol-bearing executable, together with JavaScript reference tools, guided a C++17 implementation built with heavy Claude Code assistance. The alpha plays tutorials and scenarios, and its bit-exactness checks remain project-reported.","description_zh":"以原生 macOS 应用重新实现 Rise of Nations: Extended Edition 引擎，包含 Metal 渲染器、确定性模拟、电脑对手，以及兼容的 BigHugeScript 编译器与虚拟机；美术、地图、规则和脚本均从使用者自有的 Windows 版安装目录读取。项目依据对带调试符号的可执行文件进行 Ghidra 研究后撰写的子系统规范及 JavaScript 参考工具，在大量使用 Claude Code 的情况下编写 C++17 实现。该早期版本可游玩教程与场景，其逐位一致性检查仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"th04-reconstruction-case","name":"TH04: rebuilding Lotus Land Story’s four PC-98 programs from source","name_zh":"TH04：从源码重建东方幻想乡的四个 PC-98 程序","url":"https://github.com/N0zoM1z0/th04","evidence_url":"https://github.com/N0zoM1z0/th04/blob/11577b35392c706f3bd39ff1ea932c003e1eaa6b/README.md","description_en":"Reconstructs source for the Japanese PC-98 Touhou 4: Lotus Land Story and rebuilds all four DOS programs, MAIN.EXE, OP.EXE, MAINE.EXE and ZUN.COM, with a pinned Borland toolchain under Wine. Function acceptance against the original binaries is tracked separately from emulator replays that compare inputs, RNG, object pools and video with the original game. Complete-campaign, original-timing and byte-identity goals remain open.","description_zh":"为日版 PC-98 Touhou 4：东方幻想乡重建源码，并在 Wine 下用固定版本的 Borland 工具链重新构建全部四个 DOS 程序：MAIN.EXE、OP.EXE、MAINE.EXE 和 ZUN.COM。针对原二进制的函数认定，与在模拟器中对照原游戏比较输入、随机数、对象池和画面的回放分开记录。完整流程、原始时序与字节一致性目标仍未完成。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"supermodel-real3d-pro1000-emulation-case","name":"Supermodel: initial Real3D Pro-1000 image-generator emulation","name_zh":"Supermodel：Real3D Pro-1000 图像生成器的初步模拟","url":"https://github.com/trzy/Supermodel","evidence_url":"https://github.com/trzy/Supermodel/blob/4f5d686bbdd4a58d50a9fe66971ae5396626f1a1/Src/Pro1000/Pro1000.cpp","description_en":"Adds emulation of Real3D’s Pro-1000, the SCSI-attached image generator from which Sega’s Model 3 graphics hardware derives, to the Supermodel arcade emulator. It boots user-supplied Pro-1000 firmware from the SDK disc, emulates the board’s interrupt, JTAG and UART hardware, and exposes the firmware’s built-in monitor on the console. Nothing renders yet, and SCSI host communication is unimplemented.","description_zh":"为 Supermodel 街机模拟器加入对 Real3D Pro-1000 的模拟。Pro-1000 是通过 SCSI 连接主机的图像生成器，世嘉 Model 3 的图形硬件即由其衍生。该实现可启动使用者自备的、来自 SDK 光盘的 Pro-1000 固件，模拟板上的中断、JTAG 与 UART 硬件，并在控制台中提供固件内置的监控程序。目前尚无任何画面输出，与 SCSI 主机的通信也尚未实现。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware"],"verified_at":"2026-10-18"},{"id":"blackbox-protobuf","name":"Blackbox Protobuf","name_zh":"Blackbox Protobuf 无定义 Protobuf 解码与重编码工具","url":"https://github.com/nccgroup/blackboxprotobuf","evidence_url":"https://github.com/nccgroup/blackboxprotobuf/blob/b98861e0f732e902923abc36cc08c40917f34127/README.md","description_en":"NCC Group's tools for decoding and re-encoding Protocol Buffers messages without the matching .proto definition. The decoder returns the message data with an editable type definition built from best-effort guesses based on wire types; analysts can name fields, correct types and re-encode edited messages, which protoc --decode_raw cannot do. It ships as a Python library with a bbpb CLI, a Jython Burp Suite extension and a mitmproxy addon, and its README traces it to modifying messages during mobile penetration tests.","description_zh":"NCC Group 推出的工具集，可在没有对应 .proto 定义的情况下解码并重新编码 Protocol Buffers 报文。解码器返回报文数据，以及根据线路类型尽力推测生成、可编辑的类型定义；分析者可以为字段命名、修正类型并重新编码修改后的报文，这是 protoc --decode_raw 做不到的。它提供 Python 库及 bbpb 命令行工具、基于 Jython 的 Burp Suite 扩展和 mitmproxy 插件，README 说明它最初用于在移动应用渗透测试中修改报文。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["app","protocol"],"verified_at":"2026-10-18"},{"id":"claude-intercept-traffic-capture","name":"Claude Intercept","name_zh":"Claude Intercept 流量捕获分析工具","url":"https://github.com/whaesemeyer/claude-intercept","evidence_url":"https://github.com/whaesemeyer/claude-intercept/blob/c2b7d01911e11e063533dbd61a22b404b503b48d/README.md","description_en":"A local man-in-the-middle proxy and dashboard that captures HTTP/S traffic from the user’s own computer and devices, stores it in SQLite and hands it to Claude Code through an /intercept skill and CLI. Exports such as API documentation and traffic summaries support investigating request patterns and undocumented endpoints. It is an agent-facing capture tool for authorized testing, not a reconstruction case, and it has no established REA connection.","description_zh":"本地中间人代理与控制面板，捕获使用者自有电脑和设备的 HTTP/S 流量，存入 SQLite，并通过 /intercept 技能和命令行交给 Claude Code。API 文档、流量摘要等导出模式可用于调查请求模式与未公开接口。这是面向智能体、用于授权测试的抓包工具，不是重建案例，也未确立与 REA 的关联。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["app","protocol"],"verified_at":"2026-10-18"},{"id":"finding-jingle-town-n64-debugging","name":"Finding Jingle Town: Debugging an N64 Game without Symbols","name_zh":"寻找 Jingle Town：在没有调试符号时调试 N64 游戏","url":"https://blog.chrislewis.au/finding-jingle-town-debugging-an-n64-game-without-symbols/","evidence_url":"https://blog.chrislewis.au/finding-jingle-town-debugging-an-n64-game-without-symbols/","description_en":"A walkthrough from the Snowboard Kids 2 decompilation project on attaching gdb-multiarch to the Ares emulator while the matching build still cannot carry debug information. It breaks on a function by its ELF symbol name and reads one structure byte by hand to test whether that byte selects the level overlay. A short method note on checking decompilation hypotheses at runtime, not a reconstruction result.","description_zh":"Snowboard Kids 2 反编译项目的一篇操作说明：在一致性构建仍无法加入调试信息时，把 gdb-multiarch 接到 Ares 模拟器上。文中按 ELF 符号名在函数处设断点，再手动读取结构体中的一个字节，检验它是否决定加载哪个关卡 overlay。这是在运行时检验反编译假设的简短方法记录，而非重建成果。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["game"],"verified_at":"2026-10-18"},{"id":"jpcert-apk-api-attack-infrastructure-report","name":"JPCERT/CC: APK analysis and API probing on attack servers","name_zh":"JPCERT/CC：攻击服务器上的 APK 解析与 API 探测","url":"https://blogs.jpcert.or.jp/ja/2026/10/web_api_attacks.html","evidence_url":"https://blogs.jpcert.or.jp/ja/2026/10/web_api_attacks.html","description_en":"JPCERT/CC’s 15 October 2026 blog post on the infrastructure behind a series of unauthorized-access incidents in Japan. It reports that the attackers used AI for known-vulnerability scanning and API attacks, and that attack servers held APKs, jadx- and Blutter-related files, APK-extraction directories and an SSRF test script used to probe app APIs. It is a defender’s account of observed attacker tooling with mitigation advice, not a published AI-assisted analysis method or reproducible workflow.","description_zh":"JPCERT/CC 于 2026 年 10 月 15 日发布的博客文章，调查日本国内一系列不正当访问事件背后的攻击基础设施。文章报告攻击者利用 AI 扫描已知漏洞并经由 API 发动攻击，攻击服务器上存有 APK 文件、与 jadx 和 Blutter 相关的文件、APK 解包目录，以及用于探测应用 API 的 SSRF 验证脚本。这是防御方对所观察到的攻击者工具的记述并附缓解建议，而非公开的 AI 辅助分析方法或可复现的工作流程。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["app"],"verified_at":"2026-10-18"},{"id":"decomp-compat-kit","name":"Xenosaga I Decomp Compatibility Kit","name_zh":"Xenosaga I 反编译兼容性工具包","url":"https://github.com/LinuxJessi/decomp-compat-kit","evidence_url":"https://github.com/LinuxJessi/decomp-compat-kit/blob/d9bb53dac364ecfaff4f8b00ea44baec60a27abf/README.md","description_en":"Checks a PS2 matching decompilation from outside its own build: the C is recompiled with a stock, unpatched ee-gcc 2.96 and assembler, then each function is byte-compared against the original and every difference is classified by its likely toolchain cause. Companion scripts export ELF symbol tables to CSV and convert them to splat symbol files. Defaults target Xenosaga Episode I; the README says the method generalises but the defaults do not.","description_zh":"在匹配反编译项目自身的构建之外进行检查：用未打补丁的原版 ee-gcc 2.96 及汇编器重新编译其 C 代码，再逐函数与原程序逐字节比较，并按可能的工具链原因对每处差异分类。配套脚本可将 ELF 符号表导出为 CSV，并转换为 splat 符号文件。默认配置针对 Xenosaga Episode I；README 称方法可推广，默认配置则不能。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-18"},{"id":"infamous-second-son-pc-port-case","name":"inFAMOUS Second Son native PC port","name_zh":"《声名狼藉：次子》原生 PC 移植","url":"https://github.com/HayatoG/iss_pc","evidence_url":"https://github.com/HayatoG/iss_pc/blob/d3995feb0cea1e2edc0c71fab139d1e89f0a7305/README.md","description_en":"Runs the PS4 inFAMOUS Second Son’s own x86-64 code natively on Windows and Linux: a runtime reimplements the PS4 system libraries the game uses, and a shadPS4-derived core translates its GPU commands and shaders to Vulkan. The project reports a playable, in-development port that reaches gameplay and the first chapters, with unstable performance and remaining graphics glitches. It is a compatibility-runtime port rather than a decompilation, and its results remain project-reported.","description_zh":"在 Windows 与 Linux 上原生运行 PS4 版《声名狼藉：次子》自身的 x86-64 代码：由运行时重新实现游戏所用的 PS4 系统库，并以源自 shadPS4 的核心将其 GPU 命令与着色器转换为 Vulkan。项目报告该移植可以游玩但仍在开发中，能进入游戏并通过最初几章，性能仍不稳定，也有尚未解决的图形问题。这是兼容运行时移植而非反编译重建，结果仍为项目报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"xoreos-aurora-engine-case","name":"xoreos: an open reimplementation of BioWare’s Aurora engine family","name_zh":"xoreos：BioWare Aurora 引擎家族的开源重新实现","url":"https://github.com/xoreos/xoreos","evidence_url":"https://github.com/xoreos/xoreos/blob/6774724d5c05e09ce0d01e00b8b62f956ddcb74b/README.md","description_en":"Reimplements BioWare’s Aurora engine and its later derivatives as a portable C++ engine that runs on the user’s installed game data, targeting nine games from Neverwinter Nights to Dragon Age II. Resource management, many Aurora file formats, graphics and sound are in place, and every target shows partial in-game areas in a free-flying spectator mode. README states that normal gameplay is not implemented yet, so this is an early-stage engine case, not a playable replacement.","description_zh":"以可移植的 C++ 引擎重新实现 BioWare 的 Aurora 引擎及其后续衍生版本，在使用者已安装的游戏数据上运行，目标涵盖从《无冬之夜》到《龙腾世纪 II》的九款游戏。资源管理、大量 Aurora 文件格式、图形和声音均已实现，所有目标游戏都能在可自由飞行的旁观模式下显示部分游戏内场景。README 说明尚未实现正常的游戏流程，因此这是一个早期阶段的引擎案例，而非可以替代原版游玩的实现。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"ghidra-mcp-bethington","name":"Ghidra MCP Server (bethington)","name_zh":"Ghidra MCP Server（bethington）","url":"https://github.com/bethington/ghidra-mcp","evidence_url":"https://github.com/bethington/ghidra-mcp/blob/cf8b12db27eb139b28b90eaa3488306da910d759/README.md","description_en":"A Ghidra GUI plugin, standalone headless server and Python MCP bridge exposing a 209-tool catalog: decompilation, cross-references, renaming, typing, structures, comments and batch edits, plus P-code emulation, live debugging through Ghidra’s TraceRmi framework, shared Ghidra Server repository and version-control operations, and hash-based transfer of function documentation between binary versions. The bridge loads three tool groups on connect and lets the model search for and load the rest, while naming and type conventions are enforced in the tool layer. Its NOTICE says it began as a derivative of LaurieWired’s GhidraMCP in August 2025 and has since been substantially rewritten and extended.","description_zh":"由 Ghidra 图形界面插件、独立无界面服务器和 Python MCP 桥接组成，提供含 209 个工具的目录：反编译、交叉引用、重命名、类型设定、结构体、注释与批量编辑，另有 P-code 模拟执行、经 Ghidra TraceRmi 框架的实时调试、共享 Ghidra Server 仓库与版本控制操作，以及基于哈希在不同版本二进制之间迁移函数文档。桥接在连接时只加载三组工具，其余由模型按需搜索并加载；命名与类型规范在工具层强制执行。其 NOTICE 说明，项目于 2025 年 8 月由 LaurieWired 的 GhidraMCP 衍生而来，此后已大幅重写和扩展。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-19"},{"id":"librw-renderware-reimplementation-case","name":"librw: a re-implementation of the RenderWare Graphics engine","name_zh":"librw：RenderWare Graphics 引擎的重新实现","url":"https://github.com/aap/librw","evidence_url":"https://github.com/aap/librw/blob/18532c2e13efbc1aa43f0b00b4459831f9414de0/README.md","description_en":"Re-implements a large part of the RenderWare Graphics middleware API as a portable C++ library that reads and writes its DFF model and TXD texture files for PS2, D3D8, D3D9 and Xbox and is meant to convert them between platforms. Direct3D 9 and OpenGL backends render the scenes, while PS2 rendering works only as a test. README names rendering GTA as its use; BSP world files are not supported.","description_zh":"以可移植的 C++ 库重新实现 RenderWare Graphics 中间件 API 的大部分内容，可读写其 PS2、D3D8、D3D9 和 Xbox 平台的 DFF 模型与 TXD 纹理文件，并旨在于各平台格式之间转换。场景由 Direct3D 9 和 OpenGL 后端渲染，PS2 渲染仅作为测试可用。README 称其用途是渲染 GTA 游戏；BSP 世界文件尚不支持。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"awesome-game-decompilations","name":"awesome-game-decompilations","name_zh":"awesome-game-decompilations 游戏反编译项目清单","url":"https://github.com/CharlotteCross1998/awesome-game-decompilations","evidence_url":"https://github.com/CharlotteCross1998/awesome-game-decompilations/blob/31e56f7894761ab48f05b8a1e71770a91cf2ce67/README.md","description_en":"A single-README list of about 480 game decompilation, recompilation and disassembly projects, grouped by console from the NES and Game Boy to the Xbox 360, PC and mobile, with a large uncategorised section. Each entry is a game title linked to its project, mostly on GitHub, and entries with AI involvement are marked with a warning emoji under the maintainer’s disclosure policy.","description_zh":"以单个 README 维护的游戏反编译、重编译和反汇编项目清单，约 480 项，按主机平台分组，从 NES、Game Boy 到 Xbox 360、PC 和移动平台，另有规模较大的未分类部分。每个条目是链接到对应项目的游戏名，大多指向 GitHub；按维护者的披露政策，有 AI 参与的条目以警告符号标出。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["game"],"verified_at":"2026-10-19"},{"id":"vineflower","name":"Vineflower","name_zh":"Vineflower Java 反编译器","url":"https://github.com/Vineflower/vineflower","evidence_url":"https://github.com/Vineflower/vineflower/blob/b8273988af850e8cfb234ca08d129058502b032f/README.md","description_en":"Fernflower-derived decompiler for Java and other JVM languages that continues the ForgeFlower, Fabric and Quiltflower forks, focused on output quality and modern Java, including records, sealed classes, switch expressions and pattern matching through Java 21+. Its command line takes a JAR, ZIP, folder or class file and writes a folder, an archive or console output, with multithreaded decompilation and automatic formatting. It can also be embedded as a library from Maven Central or used in IntelliJ IDEA through a plugin that replaces Fernflower, and the regular release JAR bundles three plugins, including Kotlin support and variable renaming.","description_zh":"源自 Fernflower 的 Java 及其他 JVM 语言反编译器，延续了 ForgeFlower、Fabric 和 Quiltflower 等分支的工作，注重输出质量和对现代 Java 的支持，包括 Java 21+ 的记录、密封类、switch 表达式和模式匹配。其命令行接受 JAR、ZIP、文件夹或 class 文件，可输出到文件夹、归档或控制台，支持多线程反编译和自动格式化。它也可作为 Maven Central 上的库嵌入使用，或通过替换 Fernflower 的插件在 IntelliJ IDEA 中使用；常规发布 JAR 内置三个插件，包括 Kotlin 支持和变量重命名。","kind":"tool","category":"jvm","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"pycdc","name":"Decompyle++ (pycdc)","name_zh":"Decompyle++（pycdc）Python 字节码反编译器","url":"https://github.com/zrax/pycdc","evidence_url":"https://github.com/zrax/pycdc/blob/b4289760970dbc399684f1e155ec6d1ea1cc787e/README.markdown","description_en":"C++ disassembler and decompiler for compiled Python bytecode that aims to support bytecode from any Python version. pycdas prints the disassembly of a .pyc file, and pycdc prints reconstructed Python source to stdout with errors on stderr; both also accept raw marshalled code objects when the Python version is given on the command line. The source carries opcode tables for Python 1.0 through 3.13.","description_zh":"用 C++ 编写的 Python 字节码反汇编器与反编译器，目标是支持任意 Python 版本的字节码。pycdas 输出 .pyc 文件的反汇编结果，pycdc 则把重建出的 Python 源码输出到标准输出，错误信息输出到标准错误；在命令行中指定 Python 版本后，两者也能处理原始的 marshal 代码对象。源码中包含 Python 1.0 至 3.13 的操作码表。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-19"},{"id":"odyssey-decomp-case","name":"Super Mario Odyssey: per-function matching decompilation of the Switch executable","name_zh":"《超级马力欧 奥德赛》：Switch 主程序的逐函数一致性反编译","url":"https://github.com/MonsterDruide1/OdysseyDecomp","evidence_url":"https://github.com/MonsterDruide1/OdysseyDecomp/blob/696db2ff5ed558b053c753de420504b8682f24b0/README.md","description_en":"Reconstructs C++ source for Super Mario Odyssey’s Switch 1.0 main executable and checks each function against the original AArch64 machine code with the shared nx-decomp-tools checker. At the pinned commit its function list marks 18,996 of 74,171 functions matching. The README warns that the build is not a playable game, the repository ships no game assets, and Nintendo libraries such as sead and agl come from open-ead’s separate reconstructions.","description_zh":"为《超级马力欧 奥德赛》Switch 1.0 版主程序重建 C++ 源码，并用共享的 nx-decomp-tools 检查器逐个函数与原始 AArch64 机器码比对。在所审固定提交中，其函数清单将 74,171 个函数中的 18,996 个标为一致。README 提醒构建结果不是可游玩的游戏；仓库不含游戏素材，sead、agl 等任天堂库则来自 open-ead 另行维护的重建项目。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"droid-asc","name":"Droid ASC","name_zh":"Droid ASC Android 反编译器","url":"https://github.com/MG1937/ASC","evidence_url":"https://github.com/MG1937/ASC/blob/60033d1c76bc5904588f24955cae4e83a2ba4f5d/README.md","description_en":"Python Android decompiler that answers queries directly against an APK instead of first unpacking and indexing it. It probes compressed DEX entries in place, uses the layout that the R8 compiler’s constant relocation and instruction deduplication leave behind to search string, type, method and field references across DEX files, and for a requested class rebuilds a minimal, self-consistent DEX in memory that a bundled copy of Androguard’s decompiler turns into Java. The droidasc CLI and Tk GUI list classes, decompile single classes, decode AndroidManifest.xml and find subclasses or interface implementations; the README presents it as a lightweight back end for agents analyzing many APKs.","description_zh":"用 Python 编写的 Android 反编译器，直接对 APK 执行查询，而不必先解包并建立索引。它在压缩的 DEX 条目中就地探测数据，利用 R8 编译器的常量重定位和指令去重所留下的布局，跨 DEX 文件搜索字符串、类型、方法和字段引用；对指定的类，则在内存中重建一个最小且自洽的 DEX，再由内置的 Androguard 反编译器副本转换为 Java 代码。droidasc 命令行和 Tk 图形界面可列出类、反编译单个类、解码 AndroidManifest.xml，并查找子类或接口实现；README 将其定位为供智能体批量分析 APK 的轻量后端。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"apkeditor","name":"APKEditor","name_zh":"APKEditor","url":"https://github.com/REAndroid/APKEditor","evidence_url":"https://github.com/REAndroid/APKEditor/blob/5621fe6750b828ce0bfd99ec7f42ee8b5fe75497/README.md","description_en":"Command-line APK editor built on ARSCLib that decodes an APK's binary resources and DEX into editable JSON, XML or smali and rebuilds a package from them, independent of aapt and aapt2. It also merges split bundles such as XAPK, APKM and APKS, refactors obfuscated resource names, and prints package information.","description_zh":"基于 ARSCLib 的命令行 APK 编辑器，不依赖 aapt 与 aapt2，可将 APK 的二进制资源与 DEX 解码为可编辑的 JSON、XML 或 smali 并重新构建安装包。还能合并 XAPK、APKM、APKS 等分包，还原被混淆的资源名称，并打印包信息。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"avatar2","name":"avatar²","name_zh":"avatar² 多目标固件动态分析编排框架","url":"https://github.com/avatartwo/avatar2","evidence_url":"https://github.com/avatartwo/avatar2/blob/56a90cfe738886236dcbc3653756bdbdec6aaf92/README.md","description_en":"Python framework from EURECOM's S3 group that orchestrates emulators, debuggers and physical devices for dynamic analysis of embedded firmware. An analysis script declares targets, such as a modified QEMU, PANDA, Unicorn, a gdbserver or an OpenOCD or J-Link debug probe, then a memory layout whose ranges can forward accesses from one target to another, and an execution plan. Execution and register or memory state can move between targets, so firmware can run in an emulator while its peripheral accesses go to the real device.","description_zh":"由 EURECOM S3 小组开发的 Python 框架，可协调模拟器、调试器和物理设备，对嵌入式固件进行动态分析。分析脚本先声明目标（如修改版 QEMU、PANDA、Unicorn、gdbserver，或 OpenOCD、J-Link 调试探针），再定义内存布局（其中的内存区间可把访问从一个目标转发到另一个目标）和执行计划。执行过程以及寄存器、内存状态可在目标之间转移，从而让固件在模拟器中运行，同时把外设访问转发给真实设备。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-19"},{"id":"cwe-checker","name":"cwe_checker","name_zh":"cwe_checker 二进制漏洞模式检查工具","url":"https://github.com/fkie-cad/cwe_checker","evidence_url":"https://github.com/fkie-cad/cwe_checker/blob/7288311bbf9d2d1111434f8c07617ce580b9c8c0/README.md","description_en":"Static analyzer from Fraunhofer FKIE that searches binary executables, mainly Linux and Unix ELF files, for code paths matching Common Weakness Enumeration bug classes such as buffer overflows, use-after-free and double free, NULL pointer dereferences, format strings and integer overflows. Ghidra disassembles the binary into a common intermediate representation on which its checks run, from simple heuristics to abstract-interpretation data-flow analysis, so it covers the CPU architectures Ghidra supports, including x86, ARM, MIPS and PowerPC. Warnings are printed as text or JSON, and a bundled Ghidra script annotates them in the disassembly for manual review.","description_zh":"Fraunhofer FKIE 开发的静态分析工具，在二进制可执行文件（主要是 Linux 和 Unix 的 ELF 文件）中查找符合通用缺陷枚举（CWE）漏洞类别的代码路径，例如缓冲区溢出、释放后使用与重复释放、空指针解引用、格式化字符串和整数溢出。它先由 Ghidra 把二进制反汇编为统一的中间表示，再在其上运行从简单启发式到基于抽象解释的数据流分析等各类检查，因此适用于 Ghidra 支持的 CPU 架构，包括 x86、ARM、MIPS 和 PowerPC。告警以文本或 JSON 输出，随附的 Ghidra 脚本可把告警标注在反汇编中，便于人工复核。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-19"},{"id":"jnitrace","name":"jnitrace","name_zh":"jnitrace","url":"https://github.com/chame1eon/jnitrace","evidence_url":"https://github.com/chame1eon/jnitrace/blob/5be47cb52b448bb0f39153d6c2c71b6744ad982a/README.md","description_en":"Frida-based dynamic-analysis tool that traces an Android app's use of the JNI API, similar to frida-trace or strace but for the Java Native Interface. It logs the JNI calls that native libraries make through the JNIEnv and JavaVM structures, with include and exclude filters, backtraces and optional JSON output for later post-processing. The tracing engine is also published as a separate jnitrace-engine library.","description_zh":"基于 Frida 的动态分析工具，用于跟踪 Android 应用对 JNI API 的调用，类似 frida-trace 或 strace，但面向 Java 本地接口。它记录原生库通过 JNIEnv 与 JavaVM 结构发起的 JNI 调用，支持包含/排除过滤、回溯以及可选的 JSON 输出以便后续处理。其跟踪引擎另以 jnitrace-engine 库形式单独发布。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"flare-vm","name":"FLARE-VM","name_zh":"FLARE-VM 恶意软件分析虚拟机安装工具","url":"https://github.com/mandiant/flare-vm","evidence_url":"https://github.com/mandiant/flare-vm/blob/5dc321d336f2d1b0c77343bdfd8cd3ac01ba1b37/README.md","description_en":"Mandiant FLARE installer that sets up and maintains a Windows virtual machine for reverse engineering and malware analysis. Its PowerShell script uses Boxstarter and Chocolatey to install packages from the separate VM-Packages feed and the Chocolatey community feed, chosen in a GUI or a custom config.xml that also sets environment paths, the taskbar layout and post-install registry, service and path settings. The reviewed default configuration lists 137 packages, among them Ghidra, IDA Free, x64dbg, dnSpyEx, capa, FLOSS, PE-sieve, FakeNet-NG and Wireshark; scripts in its virtualbox folder build, snapshot and export FLARE-VM and REMnux VMs in VirtualBox.","description_zh":"Mandiant FLARE 团队的安装脚本，用于搭建并维护一台面向逆向工程和恶意软件分析的 Windows 虚拟机。其 PowerShell 脚本借助 Boxstarter 和 Chocolatey，从独立的 VM-Packages 软件源和 Chocolatey 社区源安装软件包；软件包可在图形界面中选择，也可通过自定义 config.xml 指定，该文件还可设置环境变量路径、任务栏布局以及安装后的注册表、服务和路径设置。所审阅的默认配置列出 137 个软件包，包括 Ghidra、IDA Free、x64dbg、dnSpyEx、capa、FLOSS、PE-sieve、FakeNet-NG 和 Wireshark；virtualbox 目录中的脚本可在 VirtualBox 中构建 FLARE-VM 和 REMnux 虚拟机，并管理和导出其快照。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"b2r2","name":"B2R2","name_zh":"B2R2 二进制分析框架","url":"https://github.com/B2R2-org/B2R2","evidence_url":"https://github.com/B2R2-org/B2R2/blob/37de7a7274b61f7ec679153740955e7f9a94221e/README.md","description_en":"Binary analysis framework written in F# for .NET by KAIST's SoftSec Lab. It parses ELF, PE, Mach-O and WebAssembly files, parses, disassembles and lifts instructions into its own IR, recovers control-flow graphs and assembles code; the README's feature table covers x86/x86-64, ARMv7/AArch64, MIPS, PowerPC, RISC-V, SPARC, S390 and other ISAs as well as CIL, EVM, eBPF, WebAssembly and Python bytecode. Its b2r2 launcher starts a readelf-like format scanner, a linear-sweep disassembler, a recursive-descent explorer with a web GUI, an IR and assembly REPL and an assembler.","description_zh":"KAIST SoftSec 实验室开发的二进制分析框架，以 F# 编写、运行于 .NET。它可解析 ELF、PE、Mach-O 和 WebAssembly 文件，对指令进行解析、反汇编并提升为自有中间表示，还能恢复控制流图和汇编代码；README 的功能表涵盖 x86/x86-64、ARMv7/AArch64、MIPS、PowerPC、RISC-V、SPARC、S390 等指令集，以及 CIL、EVM、eBPF、WebAssembly 和 Python 字节码。其 b2r2 启动器可调用类似 readelf 的格式扫描器、线性扫描反汇编器、带 Web 图形界面的递归下降式探索工具、面向 IR 与汇编的 REPL 以及汇编器。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"rz-ghidra","name":"rz-ghidra","name_zh":"rz-ghidra Rizin 的 Ghidra 反编译器插件","url":"https://github.com/rizinorg/rz-ghidra","evidence_url":"https://github.com/rizinorg/rz-ghidra/blob/0f4e062aca031f63bd97ffcb49ca289049ec2e9d/README.md","description_en":"Rizin plugin that embeds Ghidra's C++ decompiler and Sleigh disassembler, so no Java Ghidra installation is needed. Its pdg commands decompile the current function, optionally side by side with offsets or as XML or JSON, can return the output to Rizin as comments, and list the loaded Sleigh languages; config variables control formatting and can override the auto-detected Sleigh language. The decompiler draws on Rizin's loaded binary, types and comments, and an optional plugin brings it into the Cutter GUI.","description_zh":"Rizin 插件，内嵌 Ghidra 的 C++ 反编译器和 Sleigh 反汇编器，因此无需安装 Java 版 Ghidra。其 pdg 系列命令可反编译当前函数，也可与偏移量并排显示或以 XML、JSON 格式输出，还能把结果作为注释写回 Rizin，并列出已加载的 Sleigh 语言；配置变量可调整输出格式，也可覆盖自动检测到的 Sleigh 语言。反编译器使用 Rizin 已加载的二进制、类型和注释；另有可选插件将其接入 Cutter 图形界面。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"asmresolver","name":"AsmResolver","name_zh":"AsmResolver PE 与 .NET 模块编辑库","url":"https://github.com/Washi1337/AsmResolver","evidence_url":"https://github.com/Washi1337/AsmResolver/blob/0715000c1b3a5104531d5ff189a14ebef0a9d5ac/README.md","description_en":"C# library for reading, modifying and rebuilding Portable Executable files, covering both native Windows images and images with .NET metadata. It offers three levels of abstraction: raw headers and sections (PEFile); interpreted data directories such as imports, exports, TLS, exceptions, debug data and Win32 resources (PEImage); and a System.Reflection-like model of .NET assemblies and modules with managed, native and dynamic method bodies. It also extracts files from AppHost/single-file bundles, supports ReadyToRun images and reads PDB and Portable PDB symbols without DIA, and upstream designs it to stay robust against malformed or obfuscated binaries.","description_zh":"用于读取、修改和重建 PE（可移植可执行）文件的 C# 库，既支持 Windows 原生映像，也支持带 .NET 元数据的映像。它提供三个抽象层次：原始文件头和节区（PEFile）；导入、导出、TLS、异常、调试信息和 Win32 资源等数据目录的解析结果（PEImage）；以及类似 System.Reflection 的 .NET 程序集和模块模型，涵盖托管、原生和动态方法体。它还能从 AppHost／单文件捆绑包中提取文件，支持 ReadyToRun 映像，无需 DIA 即可读取 PDB 和 Portable PDB 符号；上游的设计目标是在面对格式异常或经过混淆的二进制时保持稳健。","kind":"tool","category":"dotnet","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-19"},{"id":"decompilerserver-dotnet-mcp","name":"DecompilerServer","name_zh":"DecompilerServer .NET 反编译 MCP 服务器","url":"https://github.com/pardeike/DecompilerServer","evidence_url":"https://github.com/pardeike/DecompilerServer/blob/42c3f9106c20e5597cd11bcab70c5937d101f03e/README.md","description_en":"Stdio MCP server built on the ICSharpCode.Decompiler engine that lets agents load managed .NET assemblies, including a Unity game's Assembly-CSharp.dll located from its game directory, then search symbols, string literals and attributes, read decompiled C# or IL, and trace callers, callees, usages and inheritance. Several assemblies stay loaded under aliases, so an agent can compare two versions structurally or diff individual method bodies, the README's example being RimWorld mod porting. Modding-oriented tools generate Harmony patch skeletons, detour stubs and transpiler anchor suggestions as text from the inspected members.","description_zh":"基于 ICSharpCode.Decompiler 引擎的 stdio MCP 服务器，智能体可借此加载托管 .NET 程序集（包括从游戏目录中定位到的 Unity 游戏 Assembly-CSharp.dll），继而搜索符号、字符串字面量和特性，阅读反编译得到的 C# 或 IL，并追踪调用方、被调用方、使用位置和继承关系。多个程序集可以用别名同时保持加载，便于智能体对两个版本做结构比较或逐个比对方法体，README 举的例子是 RimWorld 模组移植。面向模组开发的工具还能根据所查看的成员，以文本形式生成 Harmony 补丁骨架、绕行存根和 Transpiler 锚点建议。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["app","game"],"verified_at":"2026-10-19"},{"id":"gepetto","name":"Gepetto","name_zh":"Gepetto：调用大模型辅助逆向的 IDA 插件","url":"https://github.com/JusticeRage/Gepetto","evidence_url":"https://github.com/JusticeRage/Gepetto/blob/f98e4c12decf86eae76ece9d6955bb6dfe472190/README.md","description_en":"IDA Pro plugin that sends Hex-Rays pseudocode to a hosted or local language model the user selects, to explain a function, comment it or propose new variable and function names, which the user picks from before they are applied. A chat console inside IDA also lets the model call tools that read disassembly, decompilation, cross-references, strings and types, rename and comment the database and run Python. The README warns that these general-purpose models may well be wrong and asks users to treat every result critically.","description_zh":"IDA Pro 插件，把 Hex-Rays 伪代码发送给使用者选定的托管或本地大模型，用于解释函数、添加注释或提出新的变量名与函数名，由使用者勾选后再应用。IDA 内的对话控制台还允许模型调用工具，读取反汇编、反编译结果、交叉引用、字符串和类型，对数据库进行重命名和注释，并运行 Python。README 提醒这些通用模型很可能出错，要求使用者审慎对待每一个结果。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-19"},{"id":"ghidrassistmcp","name":"GhidrAssistMCP","name_zh":"GhidrAssistMCP Ghidra 原生 MCP 扩展","url":"https://github.com/symgraph/GhidrAssistMCP","evidence_url":"https://github.com/symgraph/GhidrAssistMCP/blob/b575acc1412cafcfd4dc9fedb7f99ecf219c68ab/README.md","description_en":"Ghidra extension that runs an MCP server inside Ghidra over streamable HTTP and legacy SSE, with 100 explicitly named tools (93 enabled by default) for pseudocode, disassembly, P-code, control-flow and call graphs, cross-references, strings, imports and exports, plus renaming, retyping, comments and structure inference. Since version 3.0.0 the server starts with the project manager, so agents can create, open, save and close projects and open programs before a CodeBrowser exists, while one shared server tracks whichever CodeBrowser window has focus. Six program resource templates, seven analysis prompts and a bundled script for running the server under analyzeHeadless complete the package.","description_zh":"在 Ghidra 内运行 MCP 服务器的 Ghidra 扩展，通过 streamable HTTP 和旧版 SSE 提供 100 个名称明确的工具（默认启用 93 个），涵盖伪代码、反汇编、P-code、控制流图与调用图、交叉引用、字符串、导入表和导出表，以及重命名、修改类型、注释和结构体推断。自 3.0.0 版起，服务器随项目管理器一同启动，智能体在 CodeBrowser 尚未打开时即可创建、打开、保存和关闭项目并打开程序；同一个共享服务器会跟踪当前获得焦点的 CodeBrowser 窗口。扩展另附六个程序资源模板、七个分析提示词，以及在 analyzeHeadless 下运行服务器的脚本。","kind":"integration","category":"agent-mcp","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-19"},{"id":"dewolf","name":"dewolf","name_zh":"dewolf 研究型反编译器","url":"https://github.com/fkie-cad/dewolf","evidence_url":"https://github.com/fkie-cad/dewolf/blob/3c389e18f03cd922f4b424a62d3717dac6fe3eee/README.md","description_en":"Research decompiler from Fraunhofer FKIE, developed with Singapore's DSO National Laboratories between 2019 and 2021, that runs as a Binary Ninja plugin and starts from Binary Ninja's Medium Level IL. A pipeline of preprocessing, SSA, data-flow and control-flow stages restructures code following the DREAM/DREAM++ approach and emits C-like output. Results appear in a Binary Ninja dock widget, or decompile.py prints or writes them for a whole binary or one named function in batch use.","description_zh":"由 Fraunhofer FKIE 与新加坡 DSO 国家实验室在 2019 至 2021 年合作研发的研究型反编译器，以 Binary Ninja 插件形式运行，并以 Binary Ninja 的中级中间语言（Medium Level IL）为起点。它通过预处理、SSA、数据流和控制流等阶段组成的流水线，按照 DREAM/DREAM++ 方法重建控制结构，输出类 C 代码。结果可在 Binary Ninja 的停靠窗口中查看，也可在批量场景下用 decompile.py 对整个二进制或指定函数进行反编译，并输出到终端或文件。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"dembrandt","name":"Dembrandt","name_zh":"Dembrandt 网站设计系统提取工具","url":"https://github.com/dembrandt/dembrandt","evidence_url":"https://github.com/dembrandt/dembrandt/blob/4deb8350b134669dc0251af56e028a7250d86914/README.md","description_en":"Node.js CLI that renders a website in Playwright-driven Chromium or Firefox and reads computed styles from the DOM to extract its design system: logo, color roles with the evidence behind each pick, typography, spacing, borders, shadows, motion, breakpoints and component styles such as buttons and inputs. Results export as W3C design tokens (DTCG), Tailwind v4 or shadcn/ui themes, DESIGN.md, an HTML report or a brand-guide PDF, alongside WCAG contrast checks on real DOM pairs and a CI drift gate against a committed baseline. It also runs as an MCP server for agent clients.","description_zh":"Node.js 命令行工具，通过 Playwright 驱动 Chromium 或 Firefox 渲染网站，并从 DOM 读取计算样式来提取其设计系统：标志、附带判定依据的颜色角色、字体排版、间距、边框、阴影、动效、断点，以及按钮、输入框等组件样式。结果可导出为 W3C 设计令牌（DTCG）、Tailwind v4 或 shadcn/ui 主题、DESIGN.md、HTML 报告或品牌指南 PDF，还能对页面中实际的前景与背景组合做 WCAG 对比度检查，并在 CI 中与已提交的基线比较、拦截设计漂移。它也能作为 MCP 服务器供智能体客户端调用。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-19"},{"id":"android-reverse-engineering-skill","name":"Android Reverse Engineering Skill","name_zh":"Android Reverse Engineering Skill 安卓反编译智能体技能","url":"https://github.com/SimoneAvogadro/android-reverse-engineering-skill","evidence_url":"https://github.com/SimoneAvogadro/android-reverse-engineering-skill/blob/0c7cf89830993df7dfc178498f69952262808bea/README.md","description_en":"Claude Code plugin and agent skill that drives jadx and Fernflower/Vineflower to decompile Android APK, XAPK, JAR and AAR files and document their HTTP APIs. A fingerprint pass first identifies the app's framework, HTTP stack, obfuscation level and native libraries, then shell scripts extract endpoints and authentication patterns across Retrofit, OkHttp, Volley, Ktor and Apollo/GraphQL, trace call flows from UI down to the network layer, and rebuild original Kotlin class names from the metadata R8 leaves behind. It installs through the bundled Claude Code marketplace, and its scripts also run standalone with a /decompile slash command.","description_zh":"Claude Code 插件及智能体技能，驱动 jadx 与 Fernflower/Vineflower 反编译 Android 的 APK、XAPK、JAR 和 AAR 文件并记录其 HTTP 接口。它先用指纹步骤识别应用的框架、HTTP 栈、混淆程度和原生库，再通过 shell 脚本在 Retrofit、OkHttp、Volley、Ktor 和 Apollo/GraphQL 等栈中提取接口与鉴权特征，追踪从界面到网络层的调用链，并利用 R8 无法剥除的元数据还原原始的 Kotlin 类名。技能通过自带的 Claude Code marketplace 安装，其脚本也可独立运行，并提供 /decompile 斜杠命令。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["app"],"verified_at":"2026-10-19"},{"id":"gb-recompiled","name":"GB Recompiled","name_zh":"GB Recompiled Game Boy 静态重编译器","url":"https://github.com/arcanite24/gb-recompiled","evidence_url":"https://github.com/arcanite24/gb-recompiled/blob/9150f87d82fa98abcb6ea22329170463f9702eb8/README.md","description_en":"Static recompiler that turns Game Boy and Game Boy Color ROMs into portable C projects: it decodes and analyzes banked LR35902 code, emits C with machine-readable metadata, and links it with a shared SDL2 runtime for video, audio, input, saves and hardware timing. Jump targets that static analysis missed fall back to an interpreter. The repository also carries differential, replay and frame and audio capture tooling, plus a Pokémon Crystal port that builds native features on hooks into the exact ROM.","description_zh":"将 Game Boy 和 Game Boy Color ROM 转换为可移植 C 项目的静态重编译器：它解码并分析分 bank 的 LR35902 代码，生成 C 代码及机器可读的元数据，再与共享的 SDL2 运行时链接，由运行时处理视频、音频、输入、存档和硬件时序。静态分析未覆盖的跳转目标会回退到解释器执行。仓库还提供差分对比、回放以及画面和音频捕获工具，并附有一个 Pokémon Crystal 移植，借助对特定 ROM 的挂钩实现原生功能。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"codemerxdecompile","name":"CodemerxDecompile","name_zh":"CodemerxDecompile .NET 反编译器","url":"https://github.com/codemerx/CodemerxDecompile","evidence_url":"https://github.com/codemerx/CodemerxDecompile/blob/9ada3065e65112895445745aef888b9fb6fb46a7/README.md","description_en":"Cross-platform desktop .NET decompiler maintained by the original JustDecompile creators as a continuation of their JustDecompile Engine, built with Mono.Cecil and an Avalonia UI. It loads assemblies into a tree of namespaces, types, members and resolved references, shows decompiled C#, VB.NET or IL with go-to-definition and back/forward navigation, and searches names, types, string literals and instructions. A create-project command exports an assembly as a Visual Studio 2015, 2017 or 2019 project.","description_zh":"由 JustDecompile 原班开发者维护的跨平台桌面 .NET 反编译器，是其 JustDecompile 引擎的延续，基于 Mono.Cecil 并采用 Avalonia 界面。它把程序集加载为由命名空间、类型、成员和已解析引用组成的树，以 C#、VB.NET 或 IL 显示反编译结果，支持转到定义和前进／后退导航，并可搜索名称、类型、字符串字面量和指令。“创建项目”命令可将程序集导出为 Visual Studio 2015、2017 或 2019 项目。","kind":"tool","category":"dotnet","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"reverify-claim-verifier","name":"Reverify","name_zh":"Reverify：用确定性工具核验模型二进制分析断言","url":"https://github.com/2akouwu/reverify","evidence_url":"https://github.com/2akouwu/reverify/blob/f32ea84ccd6bb2aff90eca711ccfdbf04e6b8923/README.md","description_en":"Python CLI and stdio MCP server that checks a model’s structured claims about a binary, such as bytes or typed values at an offset, strings, imports and exports, instruction mnemonics, emulation results and tested or Z3-proved equivalence, and returns VERIFIED, REFUTED or INCONCLUSIVE with the evidence the tools observed. Grounded and refuted results are kept in a per-binary ledger on disk, so a reset or later session resumes from them instead of from a summary, and a reconstruct loop has a model propose claims until an informative set verifies. A separate rollover command replaces context compaction in Claude Code, Codex, Gemini CLI or OpenCode with file hand-offs and fresh sessions.","description_zh":"Python 命令行工具和 stdio MCP 服务器，用于检查模型对二进制文件提出的结构化断言，例如某偏移处的字节或类型化数值、字符串、导入与导出、指令助记符、模拟执行结果，以及经测试或经 Z3 证明的等价性，并连同工具实际观察到的证据返回 VERIFIED、REFUTED 或 INCONCLUSIVE。已确证和已驳斥的结果保存在磁盘上按二进制文件划分的台账中，重置后或之后的会话可据此继续，而不依赖摘要；reconstruct 循环则让模型不断提出断言，直至一组有信息量的断言通过验证。另有 rollover 命令，用文件交接和新会话取代 Claude Code、Codex、Gemini CLI 或 OpenCode 的上下文压缩。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-19"},{"id":"wux1an-wxapkg","name":"wxapkg","name_zh":"wxapkg 微信小程序解包工具","url":"https://github.com/wux1an/wxapkg","evidence_url":"https://github.com/wux1an/wxapkg/blob/bae9b0f4c405ae9dfa0474daa54bb97e2074c571/README.md","description_en":"Desktop GUI for Windows and macOS, built with Wails, that unpacks WeChat mini-program .wxapkg packages for study. It scans the mini-program package folders of local WeChat 3.x and 4.x installations, including per-user folders, or takes a file or folder the user selects; packages that the PC client stores encrypted are decrypted first. Each packaged file is written to its recorded path, with optional beautification of JSON, HTML and JavaScript.","description_zh":"基于 Wails 构建的 Windows 与 macOS 桌面图形工具，用于解包微信小程序 .wxapkg 包以供研究。它会扫描本机微信 3.x 和 4.x 安装中的小程序包目录（包括各用户目录），也可处理用户选定的文件或目录；PC 客户端以加密形式存储的包会先行解密。包内每个文件都按其记录的路径写出，并可选择美化 JSON、HTML 和 JavaScript 代码。","kind":"tool","category":"javascript-electron","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"react-native-decompiler","name":"React Native Decompiler","name_zh":"React Native 反编译器","url":"https://github.com/numandev1/react-native-decompiler","evidence_url":"https://github.com/numandev1/react-native-decompiler/blob/77c7b94e986c67b95c9dad5e619b118ef17bbe17/README.md","description_en":"Alpha-stage Node.js CLI that splits a React Native JavaScript bundle (index.android.bundle or main.jsbundle), an unbundled js-modules folder, or Webpack entrypoint and chunk bundles into one readable file per module. Tagger, editor and decompiler plugins working on a Babel AST undo compilation artifacts such as Babel helpers, comma-operator chains and shortened booleans, turn element calls back into JSX and can rewrite modules as ES6 imports and exports, after which ESLint and Prettier tidy the output. Modules recognized as npm packages are skipped unless requested, and one module ID can limit output to that module and its dependencies.","description_zh":"处于 Alpha 阶段的 Node.js 命令行工具，可把 React Native 的 JavaScript 包（index.android.bundle 或 main.jsbundle）、未打包应用的 js-modules 目录，或 Webpack 入口包与分块包拆分为每个模块一个、便于阅读的文件。基于 Babel AST 的标注器、编辑器和反编译器插件会消除 Babel 辅助函数、逗号运算符链和缩写布尔值等编译痕迹，把元素创建调用还原为 JSX，并可将模块改写为 ES6 import／export 形式，最后用 ESLint 和 Prettier 整理输出。被识别为 npm 包的模块默认跳过，也可指定一个模块 ID，只输出该模块及其依赖。","kind":"tool","category":"javascript-electron","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"decompai","name":"DecompAI","name_zh":"DecompAI：在 Kali 容器中分析二进制的对话智能体","url":"https://github.com/louisgthier/decompai","evidence_url":"https://github.com/louisgthier/decompai/blob/0c2398c09e318be1bb6f6a52d13e572fac7c519b/README.md","description_en":"Gradio chat application whose LangGraph ReAct agent analyses an uploaded x86 Linux ELF binary: it lists and disassembles functions, decompiles them with Ghidra, drives radare2 and gdb, and runs shell commands and Python scripts in a privileged Kali Linux runner container. Workspaces are keyed by the binary’s SHA-256, so uploading the same file again restores the session. It came out of a school research project, and its CTF results are the authors’ own report.","description_zh":"Gradio 对话应用，其 LangGraph ReAct 智能体分析使用者上传的 x86 Linux ELF 二进制文件：列出并反汇编函数，用 Ghidra 反编译，调用 radare2 和 gdb，并在特权模式的 Kali Linux 运行容器中执行 shell 命令和 Python 脚本。工作区以二进制文件的 SHA-256 为键，再次上传同一文件即可恢复会话。该项目源自一项学校研究计划，其 CTF 成绩为作者自述。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-19"},{"id":"dtk-template","name":"dtk-template","name_zh":"dtk-template GameCube/Wii 反编译项目模板","url":"https://github.com/encounter/dtk-template","evidence_url":"https://github.com/encounter/dtk-template/blob/95a941f755919ebe50c1725a4ce73524470e7a02/README.md","description_en":"Project template for starting GameCube and Wii matching-decompilation repositories around decomp-toolkit. Its configure.py generates a ninja build that analyzes and splits the game's DOL and REL files from per-version config.yml, symbols.txt and splits.txt files, compiles the decompiled C/C++ with period Metrowerks compilers, relinks the result and checks it against recorded SHA-1 hashes. It also wires in objdiff for per-object diffing, progress reporting for decomp.dev and an example GitHub Actions workflow.","description_zh":"用于围绕 decomp-toolkit 创建 GameCube 和 Wii 匹配反编译仓库的项目模板。其 configure.py 生成 ninja 构建：依据各版本的 config.yml、symbols.txt 和 splits.txt 分析并拆分游戏的 DOL 和 REL 文件，用当年的 Metrowerks 编译器编译反编译出的 C/C++ 代码，重新链接后与记录的 SHA-1 哈希核对。模板还集成了用于逐目标文件比对的 objdiff、面向 decomp.dev 的进度报告，以及一个 GitHub Actions 工作流示例。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-19"},{"id":"hermes-decomp","name":"hermes-decomp","name_zh":"hermes-decomp Hermes 字节码反编译器","url":"https://github.com/SymbioticSec/hermes-decomp","evidence_url":"https://github.com/SymbioticSec/hermes-decomp/blob/ad4c924720848a26136a56688b70339fe9ea7aba/README.md","description_en":"Rust decompiler and analysis toolkit for Hermes bytecode (.hbc), the compiled form React Native apps ship for the Hermes engine; the README lists HBC versions 40 to 99. Its hermes-decomp CLI shows file information, disassembles, decompiles whole bundles or single functions to JavaScript, with a slower deep mode that recovers more names, and provides a terminal UI, cross-references, call graphs, control-flow graphs, Metro module and closure views and bytecode diffing. A separate hermes-mcp server exposes the read and analysis functions as MCP tools, and the hbc-decomp crate offers them as a Rust library.","description_zh":"面向 Hermes 字节码（.hbc）的 Rust 反编译与分析工具包；.hbc 是 React Native 应用为 Hermes 引擎打包的编译格式，README 列出支持 HBC 40 至 99 版本。其 hermes-decomp 命令行可显示文件信息、反汇编，并将整个包或单个函数反编译为 JavaScript，较慢的深度模式还能恢复更多名称；此外提供终端界面、交叉引用、调用图、控制流图、Metro 模块与闭包视图以及字节码差异比较。独立的 hermes-mcp 服务器将读取和分析功能作为 MCP 工具提供，hbc-decomp crate 则以 Rust 库的形式提供这些功能。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"n64modernruntime","name":"N64ModernRuntime","name_zh":"N64ModernRuntime N64 重编译运行时","url":"https://github.com/N64Recomp/N64ModernRuntime","evidence_url":"https://github.com/N64Recomp/N64ModernRuntime/blob/cdf5abbd5026fef5c364c676e4667c45e42b6863/README.md","description_en":"Runtime for N64Recomp static recompilations and traditional source ports of N64 games, made of two libraries. ultramodern reimplements core libultra services (threads, message queues, timers, controllers, audio, RSP task handling and VI timing) and leaves controller input, audio playback and the graphics renderer, with RT64 recommended, to callbacks the host project registers. librecomp bridges N64Recomp-generated code to ultramodern and adds overlay handling, PI DMA ROM reads, and EEPROM, SRAM and Flash RAM saves.","description_zh":"供 N64Recomp 静态重编译项目和传统源码移植使用的 N64 游戏运行时，由两个库组成。ultramodern 重新实现 libultra 的核心服务（线程、消息队列、计时器、控制器、音频、RSP 任务处理和 VI 时序），并将手柄输入、音频播放和图形渲染器（推荐 RT64）交给宿主项目注册的回调处理。librecomp 负责将 N64Recomp 生成的代码与 ultramodern 衔接，并补充覆盖段处理、PI DMA 读取 ROM，以及 EEPROM、SRAM 和 Flash RAM 存档。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-19"},{"id":"redscript","name":"REDscript","name_zh":"REDscript《赛博朋克 2077》脚本编译与反编译工具集","url":"https://github.com/jac3km4/redscript","evidence_url":"https://github.com/jac3km4/redscript/blob/3ca666c8ec14cfc803ef3888aab6ebc7a1c2bb86/README.md","description_en":"Compiler and decompiler toolkit for REDscript, a statically typed, object-oriented language for writing scripts for REDengine, CD Projekt's engine used in Cyberpunk 2077. Its Rust crates parse and analyze source, generate bytecode with monomorphization of generics, decompile .redscripts bytecode bundles back into REDscript source, read and write REDengine's native binary format, and provide a drop-in replacement for CD Projekt's scc script compiler plus a C API with source mapping. The CLI exposes decompile, compile, lint and format commands; the language server and debugger live in a separate redscript-ide repository.","description_zh":"REDscript 的编译器与反编译器工具集。REDscript 是一种静态类型、面向对象的语言，用于为 CD Projekt 在《赛博朋克 2077》中使用的 REDengine 引擎编写脚本。其 Rust crate 负责解析和分析源码、生成字节码并对泛型做单态化、将 .redscripts 字节码包反编译回 REDscript 源码、读写 REDengine 原生二进制格式，并提供可直接替代 CD Projekt scc 脚本编译器的实现，以及带源码映射的 C API。命令行提供 decompile、compile、lint 和 format 命令；语言服务器和调试器位于单独的 redscript-ide 仓库。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-19"},{"id":"kong-agentic-reverse-engineer","name":"Kong","name_zh":"Kong：基于 Ghidra 的大模型去符号二进制分析流水线","url":"https://github.com/amruth-sn/kong","evidence_url":"https://github.com/amruth-sn/kong/blob/8c4ee4bf52e0eb9efc3a0b22ad6da03387543fd2/README.md","description_en":"Command-line pipeline that runs Ghidra in-process through PyGhidra and asks Claude, OpenAI or OpenAI-compatible models to name the functions, types and parameters of a stripped binary, working bottom-up through the call graph so callers see already-named callees. It matches known library and cryptographic signatures first, sends functions whose decompilation looks obfuscated through a tool-using deobfuscation pass with z3-based simplification, applies results to the Ghidra program and exports annotated C and an analysis.json file. Its README calls it the first agentic reverse engineer; that label and its accuracy and cost figures are the author’s claims.","description_zh":"命令行分析流水线，通过 PyGhidra 在进程内运行 Ghidra，请 Claude、OpenAI 或兼容 OpenAI 接口的模型为去符号二进制文件中的函数、类型和参数命名，并沿调用图自底向上处理，使调用者能看到已命名的被调函数。它先匹配已知库函数与密码算法特征，再把反编译结果疑似混淆的函数交给可调用工具、借助 z3 化简的去混淆环节，将结果应用到 Ghidra 程序中，并导出带注释的 C 代码和 analysis.json 文件。README 称其为首个智能体逆向工程师，这一说法以及其中的准确性和成本数据均为作者陈述。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-19"},{"id":"spice86","name":"Spice86","name_zh":"Spice86 实模式 DOS 逆向与重写模拟器","url":"https://github.com/OpenRakis/Spice86","evidence_url":"https://github.com/OpenRakis/Spice86/blob/28a877fc64888f070e2dad95ddb739f3e1fe84a2/README.md","description_en":"PC emulator for executing, reverse engineering and rewriting real-mode DOS programs whose source code is unavailable. While a program runs it builds a control-flow graph, and on exit it dumps memory, execution flow, Ghidra-compatible symbols and a self-contained, runnable C# project whose generated functions override the original assembly, so analysts can rewrite them function by function into readable code while the program keeps working. It also provides a GDB remote server with custom analysis commands, a built-in debugger with a C-header structure viewer, an optional HTTP memory API and an MCP server whose tools cover CPU, memory, breakpoints, CFG and device state; an optional Ghidra plugin imports the dumps.","description_zh":"用于执行、逆向分析并重写无源码实模式 DOS 程序的 PC 模拟器。程序运行时它会构建控制流图，退出时转储内存、执行流、Ghidra 兼容的符号，以及一个可独立运行的 C# 项目，其中生成的函数会覆盖原有汇编代码，分析者可以在程序始终可运行的前提下逐个函数将其改写为可读代码。它还提供带自定义分析命令的 GDB 远程服务器、配有 C 头文件结构查看器的内置调试器、可选的 HTTP 内存 API，以及工具覆盖 CPU、内存、断点、控制流图和设备状态的 MCP 服务器；可选的 Ghidra 插件可导入这些转储。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"ps2-web-recomp","name":"PS2 Web Recomp","name_zh":"PS2 Web Recomp 浏览器游戏重编译工具","url":"https://github.com/snuri00/ps2-web-recomp","evidence_url":"https://github.com/snuri00/ps2-web-recomp/blob/6526f4803d98e10de50bea3af104a4d26e9df033/README.md","description_en":"Statically recompiles PlayStation 2 games for the browser: eerecomp translates the Emotion Engine code of a game's boot executable into C++ that is compiled to WebAssembly, and a runtime emulates the rest of the console, including a high-level EE kernel, an interpreted I/O processor running the disc's IRX modules, the vector units, SPU2 sound and the Graphics Synthesizer on WebGPU compute shaders. Its port script repeats headless runs to find functions reached through pointers and vector-unit microprograms to compile ahead of time, then builds the web page and a native runner.","description_zh":"将 PlayStation 2 游戏静态重编译后在浏览器中运行：eerecomp 把游戏启动程序中的 Emotion Engine 代码转换为 C++，再编译为 WebAssembly；运行时负责仿真主机的其余部分，包括高层仿真的 EE 内核、以解释器运行光盘 IRX 模块的 I/O 处理器、向量单元、SPU2 音频，以及基于 WebGPU 计算着色器的 Graphics Synthesizer。其移植脚本会反复进行无界面运行，找出经指针调用的函数和需要预先编译的向量单元微程序，最后构建网页和原生运行程序。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"shuji","name":"shuji","name_zh":"shuji 源映射源码恢复工具","url":"https://github.com/paazmaya/shuji","evidence_url":"https://github.com/paazmaya/shuji/blob/a97c6df48e2016fde7b072d3e8475dea3d7b872c/README.md","description_en":"Command-line tool that writes the original JavaScript and CSS sources embedded in source maps back out as files. It reads .map files, or JavaScript and CSS files whose sourceMappingURL holds an inline Base64 or URL-encoded map or points to a map in the same folder, and can walk directories with a regular-expression filter. Output is flattened to file names by default, or keeps the map's folder structure with --preserve.","description_zh":"命令行工具，可把源映射（source map）中内嵌的原始 JavaScript 和 CSS 源码重新写出为文件。它能读取 .map 文件，也能读取 sourceMappingURL 中内联了 Base64 或 URL 编码映射、或指向同一目录下映射文件的 JavaScript 和 CSS 文件，并可按正则表达式筛选、递归遍历目录。默认只按文件名平铺输出，使用 --preserve 则保留映射中的目录结构。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-19"},{"id":"xboxrecomp","name":"xboxrecomp","name_zh":"xboxrecomp 初代 Xbox 静态重编译工具包","url":"https://github.com/sp00nznet/xboxrecomp","evidence_url":"https://github.com/sp00nznet/xboxrecomp/blob/eb0aa1d5fcb1ca34cdb6470fcfa471d87f431d73/README.md","description_en":"Static-recompilation toolkit for original Xbox games: a Python pipeline parses a retail XBE, disassembles it, classifies library functions, recovers calling conventions and lifts every x86 function to C. The generated code is compiled in a separate game project that links the toolkit's runtime libraries, which stand in for the Xbox kernel and translate Direct3D 8, NV2A, audio and input to Direct3D 11 and Win32 APIs, or to SDL2 and OpenGL on Linux and macOS.","description_zh":"面向初代 Xbox 游戏的静态重编译工具包：Python 流水线解析零售版 XBE，进行反汇编、识别库函数、恢复调用约定，并将每个 x86 函数提升为 C 代码。生成的代码在独立的游戏项目中编译，并链接工具包的运行时库；这些库替代 Xbox 内核，并将 Direct3D 8、NV2A、音频和输入转换到 Direct3D 11 与 Win32 API，在 Linux 和 macOS 上则转换到 SDL2 与 OpenGL。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"pcsx-redux","name":"PCSX-Redux","name_zh":"PCSX-Redux PlayStation 1 调试模拟器","url":"https://github.com/grumpycoders/pcsx-redux","evidence_url":"https://github.com/grumpycoders/pcsx-redux/blob/e1693b7f756ebdc4ccae1230ed09992079b51f90/README.md","description_en":"PlayStation 1 emulator forked from PCSX and built around development and reverse engineering, with an interpreter and dynamic recompiler, software and OpenGL renderers, a MIPS debugger, VRAM viewer, SPU and GPU debugging tools, and a built-in GDB server that its documentation connects to gdb, IDA Pro and Ghidra's debugger. A LuaJIT API exposes breakpoints, memory and registers, an assembler and an ISO builder, and an optional REST web server can dump RAM and VRAM. The repository also holds the OpenBIOS replacement BIOS, PS-EXE conversion and packing tools, a Psy-Q object-file converter, Ghidra scripts for exchanging symbols and overlays with the emulator, and PS1 hardware designs.","description_zh":"基于 PCSX 分支、面向开发与逆向工程的 PlayStation 1 模拟器，提供解释器与动态重编译器、软件和 OpenGL 渲染器、MIPS 调试器、显存查看器、SPU 与 GPU 调试工具，以及内置 GDB 服务器；其文档说明了如何用 gdb、IDA Pro 和 Ghidra 调试器连接它。LuaJIT API 提供断点、内存与寄存器、汇编器和 ISO 构建器等接口，可选的 REST Web 服务器还能转储内存和显存。仓库另含替代 BIOS OpenBIOS、PS-EXE 转换与打包工具、Psy-Q 目标文件转换器、用于与模拟器交换符号和覆盖段的 Ghidra 脚本，以及 PS1 硬件设计。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"obfuscator-io-deobfuscator","name":"Obfuscator.io Deobfuscator","name_zh":"Obfuscator.io 专用反混淆工具","url":"https://github.com/ben-sb/obfuscator-io-deobfuscator","evidence_url":"https://github.com/ben-sb/obfuscator-io-deobfuscator/blob/42efc019d375f3cc266887ec36e929905836639c/README.md","description_en":"Deobfuscator dedicated to JavaScript produced by Obfuscator.io (javascript-obfuscator), which its README says also handles most forks. Working statically on a Babel AST, it reveals strings hidden in rotated, Base64- or RC4-encoded string arrays, inlines proxy functions, simplifies objects, arithmetic and string concatenation, removes dead code and the obfuscator's anti-tamper wrappers, and reverses control-flow flattening. Its configuration is detected automatically, and the author also hosts an online version.","description_zh":"专门处理 Obfuscator.io（javascript-obfuscator）所生成 JavaScript 的反混淆工具，README 称也能处理其大部分分支版本。它在 Babel AST 上进行静态处理，可还原隐藏在经过轮转、Base64 或 RC4 编码的字符串数组中的字符串，内联代理函数，化简对象、算术表达式和字符串拼接，删除死代码和混淆器的防篡改包装代码，并还原控制流平坦化。配置会自动检测，作者另提供在线版本。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-19"},{"id":"decomp2dbg","name":"decomp2dbg","name_zh":"decomp2dbg 反编译器-调试器符号同步工具","url":"https://github.com/mahaloz/decomp2dbg","evidence_url":"https://github.com/mahaloz/decomp2dbg/blob/416dce4986f90c74876ddb00af18583f8de6e4fe/README.md","description_en":"Decompiler-to-debugger bridge that serves function names, global variables, stack and register variable names and decompiled code from IDA Pro, Binary Ninja, Ghidra or angr-management to GDB over an XML-RPC connection. Synced functions and globals become ordinary GDB symbols for breakpoints and memory examination, local variables appear as convenience variables, and each breakpoint stop prints the decompiled line for the current address. It works with vanilla GDB, GEF and pwndbg, and can map a shared library's symbols once its load range is supplied.","description_zh":"连通反编译器与调试器的桥接工具：通过 XML-RPC 连接，把 IDA Pro、Binary Ninja、Ghidra 或 angr-management 中的函数名、全局变量、栈变量与寄存器变量名以及反编译代码提供给 GDB。同步过来的函数和全局变量成为普通的 GDB 符号，可直接下断点和查看内存；局部变量以便利变量的形式出现，每次在断点处停下时还会打印当前地址对应的反编译代码行。它支持原生 GDB、GEF 和 pwndbg；提供共享库的加载地址范围后，也能为该库映射符号。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"ben-sb-javascript-deobfuscator","name":"javascript-deobfuscator","name_zh":"javascript-deobfuscator 通用 JavaScript 反混淆工具","url":"https://github.com/ben-sb/javascript-deobfuscator","evidence_url":"https://github.com/ben-sb/javascript-deobfuscator/blob/4107a8a59d9a2267f921148cb33d3abf0bf6d128/README.md","description_en":"General-purpose JavaScript deobfuscator for common obfuscation patterns, published on npm as js-deobfuscator and usable as a library or CLI. It unpacks arrays of literals and replaces references to them, removes simple, array and arithmetic proxy functions, simplifies arithmetic and string concatenation, removes dead branches, turns computed member access into static properties, renames hexadecimal identifiers such as _0xca830a and beautifies the result. The author also hosts an online version and maintains a separate deobfuscator for Obfuscator.io output.","description_zh":"通用的 JavaScript 反混淆工具，针对常见混淆手法，以 js-deobfuscator 之名发布在 npm 上，可作为库或命令行工具使用。它能展开字面量数组并替换对其的引用，移除简单代理函数、数组代理函数和算术代理函数，化简算术表达式和字符串拼接，删除死分支，把计算属性访问转为静态属性，重命名 _0xca830a 这类十六进制标识符，并美化输出代码。作者另提供在线版本，并单独维护一个针对 Obfuscator.io 输出的反混淆工具。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-19"},{"id":"il2cppinspector","name":"Il2CppInspector","name_zh":"Il2CppInspector Unity IL2CPP 静态分析工具","url":"https://github.com/djkaty/Il2CppInspector","evidence_url":"https://github.com/djkaty/Il2CppInspector/blob/116c6355e7ee3656eab85ca753f913d428abc7a3/README.md","description_en":"Static analysis tool for Unity IL2CPP applications that reads an IL2CPP binary with its global-metadata.dat and outputs the application's type structure and method addresses as C# stub code, .NET assembly shim DLLs for decompilers such as ILSpy and dnSpy, IDA and Ghidra Python scripts that apply symbols and types, C++ type scaffolding and JSON address maps. Three APIs, also published as a NuGet package, and a plugin SDK expose the binary metadata, .NET type model and C++ model for custom analysis. The README states that it is not a decompiler and does not recover method source code.","description_zh":"面向 Unity IL2CPP 应用的静态分析工具：读取 IL2CPP 二进制及其 global-metadata.dat，将应用的类型结构和方法地址输出为 C# 存根代码、供 ILSpy 和 dnSpy 等反编译器使用的 .NET 程序集垫片 DLL、为 IDA 和 Ghidra 套用符号与类型的 Python 脚本、C++ 类型脚手架以及 JSON 地址映射。三套 API（另以 NuGet 包发布）和插件 SDK 开放二进制元数据、.NET 类型模型和 C++ 模型，供自定义分析使用。README 说明它不是反编译器，不会还原方法源码。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["app","binary","game"],"verified_at":"2026-10-19"},{"id":"whatsapp-web-reveng-legacy-protocol-case","name":"whatsapp-web-reveng: documenting the legacy WhatsApp Web protocol","name_zh":"whatsapp-web-reveng：记录旧版 WhatsApp Web 协议","url":"https://github.com/sigalor/whatsapp-web-reveng","evidence_url":"https://github.com/sigalor/whatsapp-web-reveng/blob/04caed2b23680d23a3f39cf2b017c064ff1e85ed/README.md","description_en":"Documents and reimplements the WebSocket protocol WhatsApp Web used while browser sessions mirrored a paired phone: QR pairing, Curve25519/HKDF key setup, AES/HMAC-protected binary messages, the token-based node encoding and end-to-end media encryption. A Python backend, Node.js relay and browser front end decode a logged-in session’s messages into inspectable JSON, and the README lists independent reimplementations such as Baileys and go-whatsapp. This is an older protocol generation from before WhatsApp’s 2021 multi-device architecture, not a description of current WhatsApp Web.","description_zh":"记录并重新实现 WhatsApp Web 在浏览器会话镜像已配对手机时期使用的 WebSocket 协议：二维码配对、Curve25519/HKDF 密钥建立、经 AES/HMAC 保护的二进制报文、基于字符串令牌表的节点编码，以及端到端媒体加密。Python 后端、Node.js 中继和浏览器前端把已登录会话的报文解码成可查看的 JSON，README 还列出了 Baileys、go-whatsapp 等独立再实现。这是 WhatsApp 2021 年多设备架构之前的旧一代协议，不能当作对当前 WhatsApp Web 的描述。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol","website"],"verified_at":"2026-10-19"},{"id":"e9patch","name":"E9Patch","name_zh":"E9Patch 静态二进制重写工具","url":"https://github.com/GJDuck/e9patch","evidence_url":"https://github.com/GJDuck/e9patch/blob/682ab1f7f0480aa45edf1fd94457e5ee2dd01043/README.md","description_en":"Static binary rewriter for x86-64 Linux ELF executables and shared objects that inserts instrumentation without control-flow recovery and writes a drop-in replacement binary, following the PLDI 2020 paper Binary Rewriting without Control Flow Recovery. The e9tool front end selects instructions with a matching language over disassembly attributes and patches them with built-in trampolines, calls into C or C++ functions compiled with e9compile.sh, or hand-written plugin trampolines; the e9patch back end accepts JSON-RPC commands so other tools can drive it. Optional modes add heuristic control-flow recovery for faster rewritten binaries or SIGILL-based fallbacks for full patch coverage.","description_zh":"面向 x86-64 Linux ELF 可执行文件和共享库的静态二进制重写工具，无需恢复控制流即可插入插桩代码，并生成可直接替换原文件的二进制，方法源自 PLDI 2020 论文 Binary Rewriting without Control Flow Recovery。前端 e9tool 用一套基于反汇编属性的匹配语言选择指令，再通过内置跳板、调用以 e9compile.sh 编译的 C/C++ 函数或手写的插件跳板进行修补；后端 e9patch 接收 JSON-RPC 命令，便于其他工具调用。可选模式包括借助启发式控制流恢复获得更快的重写结果，或借助 SIGILL 回退实现完全的修补覆盖。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"melonloader","name":"MelonLoader","name_zh":"MelonLoader Unity 游戏模组加载器","url":"https://github.com/LavaGang/MelonLoader","evidence_url":"https://github.com/LavaGang/MelonLoader/blob/5aff4d9d7c16ae153aad2f1035114dbc2713bf99/README.md","description_en":"Mod loader for Unity games on both the Mono and IL2CPP runtimes, which loads plugins and mods from folders in a locally installed game; on Windows a proxy DLL, version.dll by default, starts it with the game. For IL2CPP games its assembly generator runs Cpp2IL and Il2CppInterop to produce managed interop assemblies, and HarmonyX and MonoMod are bundled for runtime patching. Its logs can capture Unity player output and Harmony messages, and debug options provide a Mono debug server for Mono games and a wait-for-debugger option for IL2CPP games.","description_zh":"面向 Mono 和 IL2CPP 两种运行时 Unity 游戏的模组加载器，从本地安装游戏目录中的文件夹加载插件和模组；在 Windows 上通过代理 DLL（默认为 version.dll）随游戏一同启动。对于 IL2CPP 游戏，其程序集生成器会调用 Cpp2IL 和 Il2CppInterop 生成托管互操作程序集，并随附 HarmonyX 与 MonoMod 用于运行时修补。其日志可捕获 Unity 播放器输出与 Harmony 消息，调试选项还为 Mono 游戏提供 Mono 调试服务器，为 IL2CPP 游戏提供等待调试器附加的选项。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-19"},{"id":"rellic","name":"Rellic","name_zh":"Rellic LLVM bitcode 转 C 反编译器","url":"https://github.com/lifting-bits/rellic","evidence_url":"https://github.com/lifting-bits/rellic/blob/370abaad86ae5adad82f85b81aff14557462b7f2/README.md","description_en":"Trail of Bits implementation of the pattern-independent structuring algorithm from the No More Gotos paper, turning LLVM bitcode into goto-free C as a small, hackable decompiler back end that interoperates with LLVM and Remill. rellic-decomp translates a bitcode module to C in batch, rellic-xref serves a web interface for choosing refinement passes and linking C AST nodes to the bitcode that produced them, and rellic-headergen emits C layouts of data structures from a module's DWARF metadata. Machine code must first be lifted to bitcode by another tool; a bundled IDA script uses Anvill for that step.","description_zh":"Trail of Bits 对 No More Gotos 论文中模式无关结构化算法的实现，可把 LLVM bitcode 转换为不含 goto 的 C 代码，定位为小巧、易于修改且能与 LLVM 和 Remill 互操作的反编译器后端。rellic-decomp 批量将 bitcode 模块转换为 C；rellic-xref 提供 Web 界面，可选择要应用的细化遍，并将 C AST 节点与生成它的 bitcode 相互对应；rellic-headergen 根据模块中的 DWARF 元数据生成描述数据结构布局的 C 代码。机器码须先由其他工具提升为 bitcode；仓库附带的 IDA 脚本借助 Anvill 完成这一步。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"ghidra-delinker-extension","name":"ghidra-delinker-extension","name_zh":"ghidra-delinker-extension Ghidra 目标文件反链接扩展","url":"https://github.com/boricj/ghidra-delinker-extension","evidence_url":"https://github.com/boricj/ghidra-delinker-extension/blob/b3890c4443e4ab802c26b66d84821d3ac9362c18/README.md","description_en":"Ghidra extension that delinks a selected part of a program back into a relocatable object file. Its relocation table synthesizer analyzer reconstructs, from the Ghidra database, the relocations a linker normally discards, and its exporters write COFF (x86, x86-64), ELF (x86, x86-64, MIPS) or OMF (x86) objects with symbols and relocation tables that a toolchain can link again. The README lists binary patching through the linker, software ports, format conversion, library extraction and decompilation projects that reimplement a program one object file at a time among its uses.","description_zh":"Ghidra 扩展，可把程序中选定的部分“反链接”回可重定位目标文件。其重定位表合成分析器根据 Ghidra 数据库重建链接器通常会丢弃的重定位信息，导出器则写出带符号表和重定位表、可由工具链重新链接的 COFF（x86、x86-64）、ELF（x86、x86-64、MIPS）或 OMF（x86）目标文件。README 列出的用途包括借助链接器打二进制补丁、软件移植、格式转换、提取库，以及逐个目标文件重新实现程序的反编译项目。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"bepinex","name":"BepInEx","name_zh":"BepInEx Unity/.NET 游戏插件与修补框架","url":"https://github.com/BepInEx/BepInEx","evidence_url":"https://github.com/BepInEx/BepInEx/blob/6cea286d204eb3754d3b8363a5a1fd6640164a49/README.md","description_en":"Plugin and patching framework for Unity Mono, Unity IL2CPP and .NET Framework games such as XNA, FNA and MonoGame titles, which loads mods and analysis plugins into a locally installed game. Plugins patch methods at runtime with the bundled HarmonyX and MonoMod.RuntimeDetour, while preloader patchers rewrite managed assemblies with Mono.Cecil before the game loads them; on IL2CPP games it runs Cpp2IL and Il2CppInterop to generate interop assemblies from the game binary and global-metadata.dat. Its guides also cover configuration, logging, and debugging plugins and game assemblies with dnSpy.","description_zh":"面向 Unity Mono、Unity IL2CPP 以及 XNA、FNA、MonoGame 等 .NET Framework 游戏的插件与修补框架，可将模组和分析插件加载到本地安装的游戏中。插件借助随附的 HarmonyX 和 MonoMod.RuntimeDetour 在运行时修补方法，预加载修补器则在游戏加载托管程序集之前用 Mono.Cecil 改写它们；在 IL2CPP 游戏上，它会调用 Cpp2IL 和 Il2CppInterop，从游戏二进制和 global-metadata.dat 生成互操作程序集。其指南还介绍了配置、日志，以及用 dnSpy 调试插件和游戏程序集。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-19"},{"id":"binexport","name":"BinExport","name_zh":"BinExport 反汇编导出插件","url":"https://github.com/google/binexport","evidence_url":"https://github.com/google/binexport/blob/1fc1d734db5924c9bc9067ae244cb9b94c94efcb/README.md","description_en":"The exporter component of BinDiff: plugins for IDA Pro and Binary Ninja and an extension for Ghidra that write an analyzed disassembly to the Protocol Buffer format BinDiff requires. The BinExport2 schema covers instructions with their operands and expressions, basic blocks, flow graphs, the call graph, sections, strings, comments and data references; the exporter can also write a statistics text file or a text dump for debugging. Exports can be scripted through IDC or IDAPython in IDA and through a BinExport.java script that also runs in Ghidra's headless analyzer.","description_zh":"BinDiff 的导出组件：为 IDA Pro 和 Binary Ninja 提供插件、为 Ghidra 提供扩展，把已分析的反汇编结果写成 BinDiff 所需的 Protocol Buffer 格式。BinExport2 模式涵盖带操作数和表达式的指令、基本块、流程图、调用图、节区、字符串、注释和数据引用；导出器还可输出统计文本文件或用于调试的文本转储。在 IDA 中可通过 IDC 或 IDAPython 脚本导出，在 Ghidra 中可使用同样能在无界面分析器中运行的 BinExport.java 脚本。","kind":"tool","category":"binary-diffing","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"karta","name":"Karta","name_zh":"Karta 开源库匹配插件","url":"https://github.com/CheckPointSW/Karta","evidence_url":"https://github.com/CheckPointSW/Karta/blob/7a3d0d302f59b2098b1792f1d4ac881e6c5d21b0/README.md","description_en":"Source-code-assisted IDA Python plugin from Check Point Research that finds and matches open-source libraries compiled into large binaries and firmware. Its identifier script reports which supported libraries, such as OpenSSL, zlib, libpng and net-snmp, are present and fingerprints their versions; the matcher then uses a JSON configuration built from that library version to locate its compiled files by their original function order, match their functions and the external libc functions they call, and export selected matches as IDA names. The bundled Thumbs Up scripts improve IDA's function analysis beforehand, including ARM/Thumb separation in firmware.","description_zh":"Check Point Research 开发的源码辅助 IDA Python 插件，用于在大型二进制和固件中查找并匹配编译进去的开源库。识别脚本会列出二进制中存在哪些受支持的库（如 OpenSSL、zlib、libpng 和 net-snmp），并识别其版本；匹配脚本再借助由该库版本生成的 JSON 配置，按原始函数顺序定位各个编译单元，匹配其中的函数及其调用的外部 libc 函数，并可把选定的匹配结果作为名称导入 IDA。附带的 Thumbs Up 脚本可预先改进 IDA 的函数分析，包括区分固件中的 ARM 与 Thumb 代码。","kind":"tool","category":"binary-diffing","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-19"},{"id":"vtil-core","name":"VTIL-Core","name_zh":"VTIL-Core 虚拟机翻译中间语言核心库","url":"https://github.com/vtil-project/VTIL-Core","evidence_url":"https://github.com/vtil-project/VTIL-Core/blob/9ebee8e890a3a8923cc41f07821f740910e7c9b2/README.md","description_en":"C++20 core of the VTIL (Virtual-machine Translation Intermediate Language) project, an intermediate language and optimizing compiler that the README describes as built for binary de-obfuscation and de-virtualization. Unlike LLVM IR, VTIL keeps the native stack, physical registers and non-SSA form, so code from register or stack machines can be lifted into it, native instructions can stay inline, and code can be emitted back at any virtual address. The library provides the IL with routines, basic blocks and serialization, a symbolic expression engine and simplifier, optimizer passes such as dead-code elimination, propagation and stack pinning, and Capstone/Keystone-based AMD64 and ARM64 disassembly and assembly helpers.","description_zh":"VTIL（Virtual-machine Translation Intermediate Language，虚拟机翻译中间语言）项目的 C++20 核心库。VTIL 是一种中间语言及优化编译器，README 称其专为二进制去混淆与去虚拟化分析而设计。与 LLVM IR 不同，VTIL 保留原生栈、物理寄存器和非 SSA 形式，因此寄存器机或栈机代码都能提升到其中，原生指令可直接嵌入 IL 流，代码也能重新输出到任意虚拟地址。该库提供包含例程、基本块和序列化的 IL、符号表达式引擎与化简器、死代码消除、传播和栈固定等优化遍，以及基于 Capstone/Keystone 的 AMD64 与 ARM64 反汇编和汇编辅助功能。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"efixplorer","name":"efiXplorer","name_zh":"efiXplorer UEFI 固件分析 IDA 插件","url":"https://github.com/REhints/efiXplorer","evidence_url":"https://github.com/REhints/efiXplorer/blob/9e3b40a2ac0524e04dc69540ab4ff911fda13d27/README.md","description_en":"IDA Pro plugin and loader that automate static analysis of UEFI firmware. The plugin annotates Boot, Runtime, SMM and PEI service calls, lists the EFI protocols and known GUIDs a module installs or consumes, applies protocol interface types in the Hex-Rays decompiler, flags suspected SMM callout and GetVariable out-of-bounds write patterns for review and saves a JSON report. The efiXloader module opens a whole firmware image in one IDA database, with driver entry points, navigation between drivers and a DXE driver dependency graph.","description_zh":"用于自动化 UEFI 固件静态分析的 IDA Pro 插件与加载器。插件可标注 Boot、Runtime、SMM 和 PEI 服务调用，列出模块安装或使用的 EFI 协议与已知 GUID，在 Hex-Rays 反编译器中应用协议接口类型，标记疑似 SMM callout 及 GetVariable 越界写入模式供人工复核，并保存 JSON 报告。efiXloader 加载模块可在单个 IDA 数据库中打开整个固件镜像，提供各驱动入口点、驱动间导航和 DXE 驱动依赖关系图。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-19"},{"id":"vscode-frida","name":"Frida Workbench for VSCode","name_zh":"Frida Workbench VS Code 扩展","url":"https://github.com/ChiChou/vscode-frida","evidence_url":"https://github.com/ChiChou/vscode-frida/blob/271aa369fbf8331047184766775a1f1b9332e13b/README.md","description_en":"Unofficial Visual Studio Code extension for Frida work. A sidebar lists apps and processes on local, Apple Simulator, USB and remote devices to attach, spawn or kill, and runtime panels browse an attached process's native modules and exports and its Java and Objective-C classes, methods and protocols; selected items generate Interceptor, Objective-C or Java hook scaffolds, optionally with GitHub Copilot-inferred native signatures, and Objective-C headers or Java class stubs can be dumped. A language server completes class, selector and module names from a live target, and the extension also scaffolds Frida agent and C-module projects, script-debugging configurations, syslog streaming and Android frida-server setup.","description_zh":"非官方的 Visual Studio Code 扩展，用于 Frida 相关工作。侧边栏列出本地、Apple 模拟器、USB 和远程设备上的应用与进程，可附加、启动或结束它们；运行时面板可浏览已附加进程的原生模块与导出函数，以及 Java 和 Objective-C 的类、方法与协议，并根据所选项目生成 Interceptor、Objective-C 或 Java 的 Hook 代码框架（可选用 GitHub Copilot 推断原生函数签名），还能导出 Objective-C 头文件或 Java 类存根。语言服务器根据运行中的目标补全类名、选择器和模块名；扩展还提供 Frida agent 与 C 模块项目脚手架、脚本调试配置、系统日志流以及 Android frida-server 部署。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"ghidriff","name":"ghidriff","name_zh":"ghidriff Ghidra 二进制差异分析引擎","url":"https://github.com/clearbluejar/ghidriff","evidence_url":"https://github.com/clearbluejar/ghidriff/blob/4f5d895fcbb1eacd65efd81145922c15bb7e741d/README.md","description_en":"Command-line binary diffing engine that drives Ghidra headlessly through pyghidra: it imports and analyzes an old and a new binary, then reports added, deleted and modified functions, with patch diffing as its main use. The default VersionTrackingDiff engine combines several Ghidra Version Tracking correlators with BSim matching, alongside simpler symbol-name and structural-graph engines and a GhidraDiffEngine base class for custom differs. Results are written as JSON and Markdown with Mermaid charts and meta diffs of strings, called and calling functions and binary metadata, plus optional side-by-side HTML.","description_zh":"命令行二进制差异分析引擎，通过 pyghidra 以无界面方式驱动 Ghidra：导入并分析新旧两个版本的二进制，列出新增、删除和修改的函数，主要用于补丁比对。默认的 VersionTrackingDiff 引擎组合了多个 Ghidra 版本跟踪关联器和 BSim 匹配，另有基于符号名和结构图的较简单引擎，并提供 GhidraDiffEngine 基类供编写自定义比对器。结果以 JSON 和带 Mermaid 图表的 Markdown 输出，附有字符串、被调用与调用函数及二进制元数据的元差异，也可另外生成并排对照的 HTML。","kind":"tool","category":"binary-diffing","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-19"},{"id":"vmlinux-to-elf","name":"vmlinux-to-elf","name_zh":"vmlinux-to-elf 内核符号恢复工具","url":"https://github.com/marin-m/vmlinux-to-elf","evidence_url":"https://github.com/marin-m/vmlinux-to-elf/blob/2d094bc9c220b6b50f8215cbc3c9e581210ce1a6/README.md","description_en":"Rebuild an analyzable ELF with function and variable symbols from a Linux kernel image, whether a raw or compressed vmlinux, vmlinuz, zImage or bzImage blob, certain Android boot.img files or a stripped kernel ELF, by locating and decoding the embedded kallsyms symbol table. It detects the compression format, instruction set, endianness, word size, entry point and an approximate base address and writes an ELF for IDA Pro or Ghidra; a kallsyms-finder listing, a standalone decompressor and a GTK GUI are included.","description_zh":"通过定位并解码内嵌的 kallsyms 符号表，从 Linux 内核镜像重建带函数与变量符号、可供分析的 ELF 文件；输入可以是原始或压缩的 vmlinux、vmlinuz、zImage、bzImage 数据块，部分 Android boot.img 文件，或已去除符号的内核 ELF。工具会检测压缩格式、指令集、字节序、位宽、入口点和近似基址，并生成可在 IDA Pro 或 Ghidra 中分析的 ELF；另附列出符号的 kallsyms-finder、独立解压工具和 GTK 图形界面。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-19"},{"id":"ddisasm","name":"Ddisasm","name_zh":"Ddisasm Datalog 可重汇编反汇编器","url":"https://github.com/GrammaTech/ddisasm","evidence_url":"https://github.com/GrammaTech/ddisasm/blob/1d17f292e3672078eeb753473847306ca3f0f1ff/README.md","description_en":"GrammaTech's Datalog disassembler, which turns ELF and PE binaries for x86-32, x86-64, ARM32, ARM64 and MIPS32 into the GTIRB intermediate representation. It decodes a superset of possible instructions, then applies Soufflé Datalog rules and weighted heuristics to infer code locations, symbolization and function boundaries; gtirb-pprinter turns the result into reassemblable assembly or a rebuilt binary, and the GTIRB APIs or gtirb-rewriting can modify it in between. User hint files add Datalog facts or change heuristic weights where inference goes wrong.","description_zh":"GrammaTech 开发的 Datalog 反汇编器，可将 x86-32、x86-64、ARM32、ARM64 和 MIPS32 架构的 ELF 与 PE 二进制转换为 GTIRB 中间表示。它先解码所有可能指令的超集，再用 Soufflé Datalog 规则和加权启发式推断代码位置、符号化结果和函数边界；gtirb-pprinter 可将结果输出为可重新汇编的汇编代码或重建的二进制，期间还可借助 GTIRB API 或 gtirb-rewriting 修改程序。推断出错时，用户可通过提示文件添加 Datalog 事实或调整启发式权重。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"pince","name":"PINCE","name_zh":"PINCE GDB 前端与内存分析工具","url":"https://github.com/korcankaraokcu/PINCE","evidence_url":"https://github.com/korcankaraokcu/PINCE/blob/9357ba3d8d96477f9bb81e427a97c57f67725c74/README.md","description_en":"Linux front end for the GNU Debugger (GDB), focused on games but usable for other reverse engineering; the name stands for “PINCE is not Cheat Engine”. It scans process memory and pointers through libmemscan into a typed address table, and its memory view adds disassembly, an on-the-fly assembler, code dissection for referenced calls, jumps and strings, function, region and instruction searches, and structure overlays, including structures generated from Mono/IL2CPP class dissection of native Linux or Wine/Proton processes. Debugging covers chained breakpoints and watchpoints, tracking of the instructions that access an address, tracing and stack traces, alongside a GDB console and the reusable libpince Python library.","description_zh":"面向 Linux 的 GNU 调试器（GDB）前端，以游戏为主要对象，也可用于其他逆向工程；名称意为“PINCE is not Cheat Engine”。它借助 libmemscan 扫描进程内存和指针，并将结果放入带类型的地址表；内存视图提供反汇编、即时汇编、对引用的调用、跳转和字符串进行代码剖析、函数/内存区域/指令搜索以及结构体叠加查看，其中结构体可由对原生 Linux 或 Wine/Proton 进程中 Mono/IL2CPP 类的剖析自动生成。调试功能包括可链式关联的断点与观察点、追踪访问某地址的指令、执行跟踪和调用栈查看，并提供 GDB 控制台和可复用的 libpince Python 库。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"uncompyle6","name":"uncompyle6","name_zh":"uncompyle6 跨版本 Python 字节码反编译器","url":"https://github.com/rocky/python-uncompyle6","evidence_url":"https://github.com/rocky/python-uncompyle6/blob/91298ba80e322cfb8736ab8a697509527297a7a9/README.rst","description_en":"Cross-version decompiler that translates Python bytecode back into equivalent Python source, accepting bytecode from Python 1.0 through 3.8 as well as some PyPy bytecode and Dropbox's Python 2.5. It disassembles code objects with the companion xdis library and parses the instruction stream into a grammar-based tree from which source is printed; it can also deparse just the fragment around a given bytecode offset, which the author's trepan debuggers use for exact location reporting. It succeeds the older decompyle, uncompyle and uncompyle2 forks.","description_zh":"跨版本的 Python 反编译器，可把 Python 字节码还原为等价的 Python 源码，支持 Python 1.0 至 3.8 的字节码，以及部分 PyPy 字节码和 Dropbox 的 Python 2.5 字节码。它借助配套的 xdis 库反汇编代码对象，再把指令流解析成基于语法的树并据此输出源码；它还能只反解析给定字节码偏移附近的代码片段，作者的 trepan 调试器即用此功能精确报告位置。它是早期 decompyle、uncompyle 和 uncompyle2 等分支的后继项目。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-19"},{"id":"ret-sync","name":"ret-sync","name_zh":"ret-sync 调试器与反汇编器同步插件","url":"https://github.com/bootleg/ret-sync","evidence_url":"https://github.com/bootleg/ret-sync/blob/60e7b0fd1bea7bad44da7688801b2bd12fb02040/README.md","description_en":"Reverse-Engineering Tools SYNChronization: plugins that keep IDA, Ghidra or Binary Ninja graph and decompiler views following a live WinDbg, GDB, LLDB, OllyDbg 1.10/2 or x64dbg session, rebasing addresses on the fly so ASLR does not break the mapping. Debugger commands push comments, labels, rebased addresses and command output into the disassembler database and resolve symbols from it, while disassembler hotkeys set breakpoints and step the debugger; several databases can be synced at once and the two sides may run on different hosts. A standalone Python library offers the same position syncing to custom tracing tools.","description_zh":"ret-sync 即“逆向工程工具同步”：一组插件，让 IDA、Ghidra 或 Binary Ninja 的图形与反编译视图跟随运行中的 WinDbg、GDB、LLDB、OllyDbg 1.10/2 或 x64dbg 调试会话，并实时重定基址，使 ASLR 不影响地址对应。调试器命令可将注释、标签、重定基后的地址和命令输出写入反汇编数据库，并从中解析符号；反汇编器中的快捷键则可设置断点、单步执行调试器。可同时同步多个数据库，两端也可运行在不同主机上。独立的 Python 库可为自定义跟踪工具提供同样的位置同步。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"pyinstxtractor","name":"PyInstaller Extractor (pyinstxtractor)","name_zh":"PyInstaller Extractor（pyinstxtractor）PyInstaller 程序提取工具","url":"https://github.com/extremecoders-re/pyinstxtractor","evidence_url":"https://github.com/extremecoders-re/pyinstxtractor/blob/815d31cf26bc71e62f851b2e549452e7b7c9dd98/README.md","description_en":"Single-file Python script that extracts the contents of executables built with PyInstaller, including Linux ELF builds without other tools. It locates the PyInstaller archive in the executable, reports the PyInstaller and Python versions and likely entry-point scripts, and writes out the bundled CArchive files and the modules in the PYZ archive. It fixes the headers of the extracted .pyc files so that Python bytecode decompilers such as uncompyle6 and Decompyle++ (pycdc) recognize them.","description_zh":"单文件 Python 脚本，用于提取由 PyInstaller 构建的可执行文件的内容，Linux ELF 构建也无需借助其他工具即可提取。它在可执行文件中定位 PyInstaller 归档，报告 PyInstaller 和 Python 版本以及可能的入口脚本，并导出打包在 CArchive 中的文件和 PYZ 归档中的模块。它还会修复导出的 .pyc 文件头，使 uncompyle6、Decompyle++（pycdc）等 Python 字节码反编译器能够识别。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-19"},{"id":"bap","name":"Binary Analysis Platform (BAP)","name_zh":"BAP 二进制分析平台","url":"https://github.com/BinaryAnalysisPlatform/bap","evidence_url":"https://github.com/BinaryAnalysisPlatform/bap/blob/034bbd09646a589d5eb1f10b740177d628da80fd/README.md","description_en":"OCaml binary analysis platform from Carnegie Mellon University. Its bap command loads a program, disassembles it, lifts instructions into an architecture-neutral intermediate representation, builds the control-flow graph and runs analysis passes, while objdump, raw-loader and mc modes handle linear disassembly, raw code blobs and single encodings. The README lists x86, x86-64, ARM, MIPS and PowerPC support, an interpreter, a microexecution interpreter, a symbolic executor and the Primus Lisp language for analyses, function stubs and SMT-solver queries; analyses are written as OCaml plugins or by embedding BAP as a library, with C bindings and minimal Python support in separate repositories.","description_zh":"卡内基梅隆大学开发的 OCaml 二进制分析平台。其 bap 命令可加载程序、进行反汇编、将指令提升为与架构无关的中间表示、构建控制流图并运行分析遍；objdump、raw 加载器和 mc 模式分别用于线性反汇编、原始代码块和单条指令编码。README 列出对 x86、x86-64、ARM、MIPS 和 PowerPC 的支持，以及解释器、微执行解释器、符号执行器和 Primus Lisp 语言，后者可用于编写分析、为函数编写桩模型和调用 SMT 求解器；分析以 OCaml 插件形式编写，或将 BAP 作为库嵌入应用，C 绑定和最基本的 Python 支持位于独立仓库。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"furiousmac-continuity","name":"furiousMAC Continuity","name_zh":"furiousMAC Apple Continuity 协议逆向与解析器","url":"https://github.com/furiousMAC/continuity","evidence_url":"https://github.com/furiousMAC/continuity/blob/d9fa98bddafbfa3baafc84e37a417d78a0598546/README.md","description_en":"Reverse-engineering notes and a Wireshark dissector for Apple's proprietary Continuity Bluetooth LE advertisements, continuing the authors' PETS 2019 privacy study. Per-message pages document field layouts and observed values for 14 message types, including AirDrop, Handoff, Proximity Pairing, Nearby Info and Find My, and the dissector replaces Wireshark's packet-bthci_cmd.c so captured advertisements decode into named btcommon.apple fields.","description_zh":"针对 Apple 专有 Continuity 蓝牙低功耗广播的逆向工程笔记与 Wireshark 解析器，是作者 PETS 2019 隐私研究的延续。各报文页面记录了 AirDrop、Handoff、Proximity Pairing、Nearby Info、Find My 等 14 种报文类型的字段布局和观测到的取值；解析器替换 Wireshark 的 packet-bthci_cmd.c，使捕获到的广播能解码为具名的 btcommon.apple 字段。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"reko","name":"Reko","name_zh":"Reko 通用反编译器","url":"https://github.com/uxmal/reko","evidence_url":"https://github.com/uxmal/reko/blob/63c497aef0f3ea23340b1ed560e51b72fd0d4281/README.md","description_en":"General-purpose decompiler that loads executables or raw images, scans their machine code into a machine-independent register transfer language, groups it into procedures and decompiles them into high-level C code. The reviewed source has 64 architecture directories, from 6502, Z80 and PDP-11 to ARM, MIPS, PowerPC, RISC-V and x86, and loaders for formats including ELF, PE/MZ, Mach-O, COFF, Amiga Hunk, VMS, WebAssembly, Xbox XBE and Xbox 360 XEX. It runs as a Windows Forms GUI, a command-line client or a .NET library, and project files and scripts let users add names, types and comments.","description_zh":"通用反编译器：加载可执行文件或原始镜像，把机器码扫描转换为与机器无关的寄存器传输语言，再归并为过程并反编译为高级 C 代码。所审阅的源码包含 64 个架构目录，从 6502、Z80、PDP-11 到 ARM、MIPS、PowerPC、RISC-V 和 x86，并提供 ELF、PE/MZ、Mach-O、COFF、Amiga Hunk、VMS、WebAssembly、Xbox XBE 及 Xbox 360 XEX 等格式的加载器。可作为 Windows Forms 图形界面、命令行客户端或 .NET 库使用，用户还可通过项目文件和脚本补充名称、类型和注释。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-19"},{"id":"dyninst","name":"Dyninst","name_zh":"Dyninst 二进制插桩与分析库","url":"https://github.com/dyninst/dyninst","evidence_url":"https://github.com/dyninst/dyninst/blob/0c083894f16d5ea9beb8ad1eea2b60b5c2f95f86/README.md","description_en":"Binary instrumentation, analysis and modification libraries from the Paradyn project. DyninstAPI inserts and changes instrumentation in a running program, or rewrites an executable or library on disk and writes the patched copy back, through one machine-independent interface that also supports static and dynamic analysis. Separately documented components handle symbol tables, line numbers and types (SymtabAPI), instruction decoding and disassembly (InstructionAPI), parsing into blocks, functions and loops (ParseAPI), dataflow analyses such as slicing (DataFlowAPI), process control, stack walking and patching.","description_zh":"源自 Paradyn 项目的二进制插桩、分析与修改库。DyninstAPI 可在运行中的程序里插入和修改插桩代码，也可改写磁盘上的可执行文件或库并写回修改后的副本；同一套与机器无关的接口还支持静态和动态分析。各组件有独立手册，分别负责符号表、行号与类型（SymtabAPI）、指令解码与反汇编（InstructionAPI）、解析为基本块、函数和循环（ParseAPI）、切片等数据流分析（DataFlowAPI），以及进程控制、栈回溯和代码修补。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"goblin","name":"goblin","name_zh":"goblin 二进制格式解析库","url":"https://github.com/m4b/goblin","evidence_url":"https://github.com/m4b/goblin/blob/24a62600a4a75c145c08ec9dd82964acf1bb833b/README.md","description_en":"Rust crate for zero-copy, endian-aware parsing of ELF32/64, 32/64-bit Mach-O and multi-architecture fat containers, PE32/PE32+, COFF objects, Terse Executable (TE) images and Unix/BSD archives; Object::parse picks the format from its magic bytes. Parsed structures cover ELF headers, sections, symbols, dynamic entries, relocations and notes, Mach-O load commands, imports and exports, and PE imports, exports, relocations, TLS, resources, exception and unwind data, Authenticode certificates and the .NET CLR header. Feature flags can reduce it to std-free #[repr(C)] struct definitions for kernels and other no_std code.","description_zh":"以零拷贝、感知字节序的方式解析二进制格式的 Rust crate，支持 ELF32/64、32/64 位 Mach-O 及多架构 fat 容器、PE32/PE32+、COFF 目标文件、Terse Executable（TE）镜像以及 Unix/BSD 归档；Object::parse 根据魔数自动识别格式。解析结果涵盖 ELF 的文件头、节区、符号、动态段条目、重定位和 note，Mach-O 的加载命令及导入导出，以及 PE 的导入导出、重定位、TLS、资源、异常与展开信息、Authenticode 证书和 .NET CLR 头。借助特性开关，它还可精简为不依赖 std 的 #[repr(C)] 结构体定义，供内核等 no_std 代码使用。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"mitmproxy2swagger","name":"mitmproxy2swagger","name_zh":"mitmproxy2swagger","url":"https://github.com/alufers/mitmproxy2swagger","evidence_url":"https://github.com/alufers/mitmproxy2swagger/blob/f432acafa5907258f0f529ff582c75fefdca00d7/README.md","description_en":"Command-line tool that reverse-engineers undocumented REST APIs from captured traffic. It reads a mitmproxy flow file, or a HAR export from the browser DevTools, and generates an OpenAPI 3.0 specification describing the observed endpoints. Running it again over further captures safely merges the new data into an existing schema.","description_zh":"命令行工具，从捕获的流量还原未公开的 REST API。它读取 mitmproxy 流文件或浏览器 DevTools 导出的 HAR，生成描述所观察端点的 OpenAPI 3.0 规范。对更多捕获再次运行时，会将新数据安全合并到已有规范中。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["protocol","website"],"verified_at":"2026-10-19"},{"id":"opendbc","name":"opendbc","name_zh":"opendbc 汽车 CAN 报文定义库","url":"https://github.com/commaai/opendbc","evidence_url":"https://github.com/commaai/opendbc/blob/48c7f06c6f27c41e7169242acb03ef9775658deb/README.md","description_en":"comma.ai's repository of DBC files describing the CAN messages and signals of many car makes, with a Python library that parses and builds CAN messages from those definitions; its porting guide has contributors reverse engineer new messages from recorded drives in the cabana tool. Per-brand car ports built on it parse vehicle state, identify models from ECU firmware versions and generate openpilot's steering, gas and brake messages, while safety code for comma's panda interface restricts which messages can be sent.","description_zh":"comma.ai 维护的 DBC 文件库，描述多个汽车品牌的 CAN 报文与信号，并附带一个依据这些定义解析和构造 CAN 报文的 Python 库；其车型移植指南要求贡献者在 cabana 工具中利用行车记录逆向分析新的报文。基于它的各品牌车型移植代码可解析车辆状态、根据 ECU 固件版本识别车型，并生成 openpilot 的转向、油门和制动报文；面向 comma panda 接口的安全代码则限制哪些报文可以发出。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"flare-floss","name":"FLOSS (FLARE Obfuscated String Solver)","name_zh":"FLOSS 混淆字符串提取工具","url":"https://github.com/mandiant/flare-floss","evidence_url":"https://github.com/mandiant/flare-floss/blob/e10079080ec5b6fb7584c5331842a94eb4a9b301/README.md","description_en":"Mandiant FLARE string extractor for malware analysis that is used like strings.exe but also recovers obfuscated strings. Besides static ASCII and UTF-16LE strings it extracts stack strings, tight strings and strings decoded by functions: it heuristically identifies decoding routines, recovers their arguments through control-flow analysis, emulates them and diffs memory before and after emulation. It also extracts Go and Rust strings and accepts PE, ELF and raw 32- or 64-bit shellcode; JSON results can be turned into import scripts for IDA Pro, Ghidra, Binary Ninja, radare2 and x64dbg.","description_zh":"Mandiant FLARE 团队的恶意软件字符串提取工具，用法与 strings.exe 相同，但还能还原混淆字符串。除了静态的 ASCII 和 UTF-16LE 字符串，它还能提取栈字符串、紧凑栈字符串（tight strings）以及由函数解码出的字符串：先用启发式方法识别解码函数，通过控制流分析取得调用参数，再模拟执行这些函数，并比较模拟前后的内存状态。它还能提取 Go 和 Rust 字符串，支持 PE、ELF 以及 32 位或 64 位原始 shellcode；JSON 结果可转换为 IDA Pro、Ghidra、Binary Ninja、radare2 和 x64dbg 的导入脚本。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"zydis","name":"Zydis","name_zh":"Zydis x86 反汇编与代码生成库","url":"https://github.com/zyantific/zydis","evidence_url":"https://github.com/zyantific/zydis/blob/a95bb71013436547f689fc0b380f48edf663066e/README.md","description_en":"Lightweight C11 x86/x86-64 disassembler and code-generation library. Its decoder reports each instruction's operands, accessed CPU and FPU flags, ISA set and extension and branch type; the formatter prints Intel, MASM or AT&T syntax, and the encoder assembles instructions from encoder requests, which can also be derived from decoded instructions. ZydisDisasm and ZydisInfo command-line tools are included, and the official Rust and Python 3 bindings live in separate repositories.","description_zh":"轻量级 C11 x86/x86-64 反汇编与代码生成库。解码器可报告每条指令的操作数、所访问的 CPU 与 FPU 标志、ISA 集与扩展以及分支类型；格式化器可输出 Intel、MASM 或 AT&T 语法，编码器则根据编码请求生成指令，请求也可由已解码的指令转换而来。仓库附带 ZydisDisasm 与 ZydisInfo 命令行工具，官方 Rust 与 Python 3 绑定位于独立仓库。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"sony-pmca-re","name":"Sony-PMCA-RE","name_zh":"Sony-PMCA-RE Sony 数码相机逆向工具","url":"https://github.com/ma1co/Sony-PMCA-RE","evidence_url":"https://github.com/ma1co/Sony-PMCA-RE/blob/a82f5baaa8e9c3d9f28f94699e860fb2e48cc8e0/README.md","description_en":"USB tool built from reverse engineering Sony digital cameras. On supported models it reads camera information and installs Android apps through the PlayMemories Camera Apps mechanism, while its firmware-updater and service-mode shells can dump firmware, run Linux commands and change settings. The repository's notes describe the app-installation exchange between the Sony app store, the browser plugin and the camera.","description_zh":"基于逆向 Sony 数码相机而开发的 USB 工具。在受支持的机型上，它可读取相机信息，并借助 PlayMemories Camera Apps 机制安装 Android 应用；其固件更新模式和服务模式下的 shell 可转储固件、执行 Linux 命令并调整设置。仓库中的说明文档记录了 Sony 应用商店、浏览器插件与相机之间的应用安装交互过程。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware","protocol"],"verified_at":"2026-10-19"},{"id":"qbdi","name":"QBDI","name_zh":"QBDI 动态二进制插桩框架","url":"https://github.com/QBDI/QBDI","evidence_url":"https://github.com/QBDI/QBDI/blob/3318580550215a0c7a64e9c2476e02eb5fc55f14/README.rst","description_en":"Quarkslab's modular dynamic binary instrumentation (DBI) framework, which JIT-recompiles a program's basic blocks inside its own process so that an instrumentation tool can register callbacks before or after instructions, on memory reads and writes, and on VM events. The engine is a library that can start an instrumented execution anywhere in a process, scripted from C, C++, Python (PyQBDI) or Frida JavaScript. It has no preferred injection method: it bundles the LD_PRELOAD-based QBDIPreload for Linux and macOS dynamic executables and is integrated with Frida.","description_zh":"Quarkslab 开发的模块化动态二进制插桩（DBI）框架：在目标进程内部按基本块对程序进行 JIT 重编译，使插桩工具可以在指令执行前后、内存读写以及虚拟机事件上注册回调。引擎以库的形式提供，可在进程中任意位置启动插桩执行，并可通过 C、C++、Python（PyQBDI）或 Frida JavaScript 编写脚本。它不绑定特定注入方式：自带基于 LD_PRELOAD 的 QBDIPreload，用于 Linux 和 macOS 动态可执行文件，并已与 Frida 集成。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-19"},{"id":"medusa-framework","name":"MEDUSA","name_zh":"MEDUSA","url":"https://github.com/Ch0pin/medusa","evidence_url":"https://github.com/Ch0pin/medusa/blob/a7bd929f297f0725a5e4d2e3952874a757d4e2fc/README.md","description_en":"Modular Frida-based framework for runtime analysis of Android and iOS apps the analyst is authorized to test. From a single coordinated script it loads plug-in modules to inspect network and WebView activity, trace API calls, examine memory and cryptographic operations, monitor malware behavior, and handle protections such as SSL pinning. The README reports it ships with over 90 reusable modules.","description_zh":"基于 Frida 的模块化框架，用于对分析者有权测试的 Android 与 iOS 应用进行运行时分析。通过单个协调脚本加载插件模块，检查网络与 WebView 活动、跟踪 API 调用、查看内存与加密操作、监控恶意软件行为，并处理 SSL 固定等保护。README 称其内置 90 多个可复用模块。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"binsider","name":"binsider","name_zh":"binsider ELF 二进制分析终端界面","url":"https://github.com/orhun/binsider","evidence_url":"https://github.com/orhun/binsider/blob/7f0633d1a69af15cc3be9e0533cb36dbe67eb598/README.md","description_en":"Terminal user interface for inspecting ELF binaries. It shows file information and linked shared libraries in the manner of stat and ldd, browses ELF headers, notes, sections, segments, symbols, dynamic symbols and relocations much like readelf, extracts strings with an adjustable minimum length, and offers a searchable hexdump view. Optional dynamic analysis runs the binary and traces its system calls like strace, with a summary of time and call counts per system call; the interface can also be embedded as a Rust library in Ratatui applications.","description_zh":"用于查看 ELF 二进制的终端用户界面。它可像 stat 和 ldd 那样显示文件信息和所链接的共享库，像 readelf 那样浏览 ELF 头、注释、节区、段、符号、动态符号和重定位，按可调的最小长度提取字符串，并提供可搜索的十六进制视图。可选的动态分析会运行该二进制，像 strace 那样跟踪其系统调用，并按系统调用汇总耗时和调用次数；该界面还能作为 Rust 库嵌入 Ratatui 应用。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"mytechnotalent-reverse-engineering","name":"Reverse Engineering (mytechnotalent)","name_zh":"逆向工程教程（mytechnotalent）","url":"https://github.com/mytechnotalent/Reverse-Engineering","evidence_url":"https://github.com/mytechnotalent/Reverse-Engineering/blob/8ae661a1cf37fb17afc29981d424f1656dc7741b/README.md","description_en":"A free, English lesson index by mytechnotalent that grows almost daily: 490 numbered lessons, most of which have learners write small programs and then debug and patch (\"hack\") them, across x86, x64, 32/64-bit ARM, RISC-V and AVR. Early courses start from number systems, registers, memory and the stack; later ones cover microcontroller firmware on Raspberry Pi Pico/Pico 2, STM32F401, ESP32-C3, ATmega328P and micro:bit boards, plus Windows, Go, Rust and WebAssembly programs. The README is a table of links; the lesson text lives in a GitBook and in the author's other repositories and PDF books.","description_zh":"mytechnotalent 维护的免费英文课程索引，几乎每天更新：共 490 节编号课程，多数课程让学习者先编写小程序，再对其调试和打补丁（文中称 \"hack\"），覆盖 x86、x64、32/64 位 ARM、RISC-V 和 AVR。前期课程从数制、寄存器、内存和栈讲起；后期转向 Raspberry Pi Pico/Pico 2、STM32F401、ESP32-C3、ATmega328P 和 micro:bit 等开发板上的微控制器固件，以及 Windows、Go、Rust 和 WebAssembly 程序。README 本身只是链接目录，课程正文位于一个 GitBook 以及作者其他仓库中的课程文件和 PDF 书。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary","firmware"],"verified_at":"2026-10-19"},{"id":"coop-anything","name":"Co-op Anything","name_zh":"Co-op Anything：为单人游戏加入合作模式的智能体手册","url":"https://github.com/cranebeaker/coop-anything","evidence_url":"https://github.com/cranebeaker/coop-anything/blob/bffd56f00bdd6063db13fa59c18a74678b121ca0/README.md","description_en":"Agent playbook, skill set and stdio MCP server for adding online or split-screen co-op to single-player games the players already have installed. Agents either revive an existing co-op mod or reverse engineer the game and engine to build one, test it with in-game bots and send their notes back, while the MCP server searches a directory of 223 co-op projects and 32 open gaps, detects a game’s engine from its install folder and records the executable’s identity. Its README and reverse-engineering skill pair it with REA for native code, and two game write-ups report observations made through REA’s Ghidra lane.","description_zh":"为玩家已安装的单人游戏加入联机或分屏合作模式的智能体操作手册、技能集与 stdio MCP 服务器。智能体或修复已有的合作模组，或逆向分析游戏及其引擎从头实现，再用游戏内机器人测试并把笔记回馈给仓库；MCP 服务器则可检索收录 223 个合作项目和 32 处空缺的目录，根据安装目录识别游戏引擎，并记录可执行文件的身份信息。其 README 和逆向分析技能建议原生代码部分搭配 REA 使用，另有两份游戏笔记报告了借助 REA 的 Ghidra 通道得到的观察结果。","kind":"integration","category":"community-integrations","group":"rea","relationship":"community-integration","targets":["game"],"verified_at":"2026-10-19"},{"id":"fissure","name":"FISSURE","name_zh":"FISSURE 射频信号分析与协议发现框架","url":"https://github.com/ainfosec/FISSURE","evidence_url":"https://github.com/ainfosec/FISSURE/blob/75abda154a3f0642df00100d847e51d63d186821/README.md","description_en":"GNU Radio-based RF framework that carries a signal from survey and detection through IQ capture, inspection, conditioning, feature extraction and classification into a protocol discovery workflow. Its demodulation workspace estimates symbol rates for OOK/ASK and binary FSK recordings, and the bitstream and framing stage applies Manchester or differential decoding, sync-pattern and CRC evidence and repeated-message detection to propose message boundaries. A Qt dashboard coordinates local or remote SDR sensor nodes, a library keeps protocol and packet definitions, dissectors and archived recordings, and plugins add inspection modules such as radar pulse analysis.","description_zh":"基于 GNU Radio 的射频框架，可将信号从频谱巡查与检测，经 IQ 采集、检查、调理、特征提取和分类，一路带入协议发现流程。其解调工作区可为 OOK/ASK 和二进制 FSK 录制估计符号速率；比特流与成帧阶段则结合曼彻斯特或差分解码、同步模式与 CRC 证据以及重复报文检测，推断报文边界。Qt 仪表盘负责协调本地或远程的 SDR 传感节点，资料库保存协议与数据包定义、解析器和归档录制，插件还可加入雷达脉冲分析等检查模块。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"android-unpinner","name":"Android Unpinner","name_zh":"Android Unpinner","url":"https://github.com/mitmproxy/android-unpinner","evidence_url":"https://github.com/mitmproxy/android-unpinner/blob/60cbfee4d43cedaff622d72c27d87e418a111413/README.md","description_en":"Tool from the mitmproxy project that removes certificate pinning from an Android APK you own or are authorized to test, without a rooted device. It marks the app debuggable, touching only AndroidManifest.xml, and injects a Frida Gadget over ADB so an interception proxy can read the app's traffic, reusing HTTP Toolkit's unpinning script. It bundles the Android SDK helpers it needs and can also handle split APKs delivered as XAPK.","description_zh":"来自 mitmproxy 项目的工具，可在无需 root 的情况下移除使用者拥有或有权测试的 Android APK 的证书固定。它将应用标记为可调试（仅改动 AndroidManifest.xml），并通过 ADB 注入 Frida Gadget，复用 HTTP Toolkit 的解固定脚本，使检查代理能够读取应用流量。工具自带所需的 Android SDK 辅助程序，并可处理以 XAPK 形式提供的分包。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app","protocol"],"verified_at":"2026-10-19"},{"id":"cpu-rec","name":"cpu_rec","name_zh":"cpu_rec CPU 指令集统计识别工具","url":"https://github.com/airbus-seclab/cpu_rec","evidence_url":"https://github.com/airbus-seclab/cpu_rec/blob/6b192399cd56ad6953e568e1263024dd8a4ef38d/README.md","description_en":"Statistically recognize the CPU instruction set in an arbitrary binary file, such as an unknown firmware image, by comparing Markov-chain byte statistics with a default corpus covering dozens of architectures, from 6502 and 8051 to ARM, MIPS, PowerPC, RISC-V, x86-64 and WebAssembly. It reports a match for the whole file, then the largest chunk that matches one architecture, and shows entropy so that encrypted or compressed regions can be discounted. It runs standalone, as a Python function or as a binwalk module.","description_zh":"对任意二进制文件（例如来历不明的固件镜像）中的 CPU 指令集进行统计识别：把字节的马尔可夫链统计与默认语料库比较，语料库涵盖数十种架构，从 6502、8051 到 ARM、MIPS、PowerPC、RISC-V、x86-64 和 WebAssembly。它先给出整个文件的匹配结果，再找出与单一架构匹配的最大数据块，并显示熵值，以便排除加密或压缩区域。可独立运行，也可作为 Python 函数或 binwalk 模块使用。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-19"},{"id":"iced","name":"iced","name_zh":"iced x86 指令解码与汇编库","url":"https://github.com/icedland/iced","evidence_url":"https://github.com/icedland/iced/blob/8cfc5f57c08fd2e80a4cec9d3d9d36f642b2de31/README.md","description_en":"x86 instruction library for 16-, 32- and 64-bit code that decodes, formats, assembles and encodes instructions, with masm, nasm, GNU AT&T and Intel XED output syntaxes. Its instruction-info API reports the registers, memory operands and RFLAGS bits an instruction reads or writes, its CPUID feature flags and control-flow type, and the encoder can re-encode decoded instructions at any address. Rust, C# (.NET) and Java implementations live in one repository, with Python, JavaScript (WebAssembly) and Lua bindings built on the Rust crate.","description_zh":"面向 16、32 和 64 位 x86 代码的指令库，可解码、格式化、汇编和编码指令，输出支持 masm、nasm、GNU AT&T 和 Intel XED 语法。其指令信息 API 可报告指令读写的寄存器、内存操作数和 RFLAGS 标志位，以及所需的 CPUID 特性标志和控制流类型；编码器还能把已解码的指令重新编码到任意地址。同一仓库维护 Rust、C#（.NET）和 Java 三套实现，另有基于 Rust crate 的 Python、JavaScript（WebAssembly）和 Lua 绑定。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"apk-mitm","name":"apk-mitm","name_zh":"apk-mitm","url":"https://github.com/niklashigi/apk-mitm","evidence_url":"https://github.com/niklashigi/apk-mitm/blob/5a96363fc9112b97d60fc2bd3799d6bbfd8e4e00/README.md","description_en":"Command-line tool that prepares an Android APK you own or are authorized to test for HTTPS traffic inspection. It decodes the package with Apktool, adjusts the network security configuration to trust user-added certificates, disables certificate pinning, then re-encodes and signs the patched APK, so a proxy can read the app's traffic without a rooted device. App bundles supplied as .xapk or .apks are also supported.","description_zh":"命令行工具，为使用者拥有或有权测试的 Android APK 准备 HTTPS 流量检查。它用 Apktool 解码安装包、调整网络安全配置以信任用户添加的证书、关闭证书固定，再重新编码并签名修补后的 APK，使代理无需 root 设备即可读取应用流量。也支持以 .xapk 或 .apks 形式提供的应用捆绑包。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app","protocol"],"verified_at":"2026-10-19"},{"id":"fritap","name":"friTap","name_zh":"friTap TLS 密钥提取与流量解密工具","url":"https://github.com/fkie-cad/friTap","evidence_url":"https://github.com/fkie-cad/friTap/blob/d7398a153755c136005e932414592885348cf83d/README.md","description_en":"Frida-based tool that hooks TLS libraries such as OpenSSL, BoringSSL, NSS and GnuTLS inside a running process and writes NSS key logs and decrypted payloads as PCAP, so analysts can inspect an application's encrypted traffic in Wireshark. For stripped or statically linked libraries it accepts byte patterns or offsets and can scan for renamed libraries, or it can recover TLS secrets by scanning heap memory instead of hooking. A terminal UI, a Python API and a Wireshark extcap integration wrap the same capture.","description_zh":"基于 Frida 的工具，在运行中的进程内挂钩 OpenSSL、BoringSSL、NSS、GnuTLS 等 TLS 库，输出 NSS 格式的密钥日志和解密后的 PCAP 明文，便于分析者在 Wireshark 中检查应用的加密流量。对于去除符号或静态链接的库，可通过字节模式或偏移量定位函数、扫描被重命名的库，也可不挂钩而改为扫描堆内存来恢复 TLS 密钥。终端界面、Python API 和 Wireshark extcap 集成都基于同一套捕获功能。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["app","protocol"],"verified_at":"2026-10-19"},{"id":"hrtng","name":"hrtng","name_zh":"hrtng IDA 反编译增强插件","url":"https://github.com/KasperskyLab/hrtng","evidence_url":"https://github.com/KasperskyLab/hrtng/blob/2c7b78e5772cc8728d8b450fd5a87cb226a683fb/README.md","description_en":"IDA plugin published by Kaspersky that extends the Hex-Rays decompiler with tools its author collected for reverse-engineering work, including malware analysis. It decrypts strings, data and constants with built-in ciphers or in bulk through IDA's Appcall debugger feature, resolves API-name hashes, unflattens control flow and forces decompilation of obfuscated code, and recognizes library code through microcode signatures, inlined-function detection and PAT files built from an IDA database. Pseudocode helpers cover automatic renaming, retyping and enum substitution, structure creation, virtual and indirect call navigation, and patching.","description_zh":"Kaspersky 发布的 IDA 插件，为 Hex-Rays 反编译器加入了作者在包括恶意软件分析在内的逆向工作中积累的各类工具。它可用内置密码算法解密字符串、数据和常量，或借助 IDA 的 Appcall 调试器功能批量解密；还能识别 API 名称哈希、消除控制流平坦化并强制反编译混淆代码，并通过微码签名、内联函数检测和从 IDA 数据库生成的 PAT 文件识别库代码。伪代码辅助功能包括自动重命名、类型修改和枚举替换、结构体创建、虚函数与间接调用导航以及补丁。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"frida-interception-and-unpinning","name":"Frida Mobile Interception Scripts","name_zh":"Frida 移动端拦截脚本","url":"https://github.com/httptoolkit/frida-interception-and-unpinning","evidence_url":"https://github.com/httptoolkit/frida-interception-and-unpinning/blob/560dd29d410fe785f9f390e3c7f86ca8359c8d67/README.md","description_en":"A set of Frida scripts from HTTP Toolkit for inspecting a mobile app's HTTPS traffic while analysing apps you own or are authorized to test. Injected into a running Android or iOS app, they redirect its connections to an interception proxy, add a user-supplied CA certificate to the trust stores, and disable certificate pinning and transparency checks so the proxy can read the traffic. Individual scripts can also be used on their own to hook specific behaviour.","description_zh":"来自 HTTP Toolkit 的一组 Frida 脚本，用于在分析自有或经授权测试的应用时检查移动应用的 HTTPS 流量。将其注入运行中的 Android 或 iOS 应用后，可把连接重定向到检查代理、将用户提供的 CA 证书加入信任库，并关闭证书固定与证书透明度检查，使代理能够读取流量。各脚本也可单独使用以挂钩特定行为。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app","protocol"],"verified_at":"2026-10-19"},{"id":"bincat","name":"BinCAT","name_zh":"BinCAT 二进制静态分析工具包","url":"https://github.com/airbus-seclab/bincat","evidence_url":"https://github.com/airbus-seclab/bincat/blob/5d0ee3b56867059427eb0f4123c4d9de0b8059dd/README.md","description_en":"Static binary code analysis toolkit designed for reverse engineers. Starting from a chosen address and initial state, it computes register and memory values, taint and reconstructed types, with forward and backward analysis and heap use-after-free and double-free detection; bits it cannot determine are shown as unknown. It is driven from an IDA plugin, where analysts can override values or taint, skip functions or replace instructions with NOPs before re-running, or from Python and an .ini configuration for automation.","description_zh":"面向逆向工程人员的二进制代码静态分析工具包。它从选定的地址和初始状态出发，计算寄存器与内存的值、污点和重建出的类型，支持前向与后向分析，并能检测堆上的释放后使用和重复释放；无法确定的位会标为未知。分析可在 IDA 插件中进行，分析人员可覆盖值或污点、跳过函数或把指令替换为 NOP 后重新运行；也可通过 Python 和 .ini 配置文件实现自动化。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"pbtk","name":"pbtk","name_zh":"pbtk Protobuf 逆向工具集","url":"https://github.com/marin-m/pbtk","evidence_url":"https://github.com/marin-m/pbtk/blob/7c5fa2ca4cee9e8a2862c6e3332e7b8a850bb8e8/README.md","description_en":"Recover Protobuf message definitions from compiled programs as readable .proto files. Extractors cover the Java runtimes in JAR, DEX and APK files (including ProGuard-obfuscated code), binaries that embed Protobuf reflection metadata, and web apps using the Protobuf-URL format. A GUI then binds a recovered message type to an HTTP endpoint, decodes hex-encoded captured samples into an editable field tree and resends edited messages, so analysts can relate each field to the response.","description_zh":"从已编译程序中恢复 Protobuf 消息定义，并还原为可读的 .proto 文件。提取器覆盖 JAR、DEX 和 APK 中的各类 Java 运行时（包括经 ProGuard 混淆的代码）、内嵌 Protobuf 反射元数据的二进制文件，以及使用 Protobuf-URL 格式的 Web 应用。随后可在图形界面中把恢复出的消息类型绑定到 HTTP 端点，将十六进制形式的抓包样本解码为可编辑的字段树，并重新发送修改后的消息，帮助分析者把每个字段与响应对应起来。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["app","protocol"],"verified_at":"2026-10-19"},{"id":"reflutter","name":"reFlutter","name_zh":"reFlutter","url":"https://github.com/Impact-I/reFlutter","evidence_url":"https://github.com/Impact-I/reFlutter/blob/846a00033ef39a53502eed8b775b6699fe0fc684/README.md","description_en":"Flutter reverse-engineering framework for apps the analyst is authorized to inspect. It repacks an app with a prebuilt patched Dart engine, or instruments the app's own engine at runtime, to emit a JSONL dump of every function's name, class, library and code offset into the Dart instructions image for Frida or IDA/Ghidra work. It can also route the app's HTTPS traffic through an inspection proxy with Flutter certificate pinning disabled.","description_zh":"面向分析者有权检查的应用的 Flutter 逆向框架。它通过替换为预编译的已打补丁 Dart 引擎（repack 模式）或在运行时插桩应用自带引擎（attach 模式），导出包含每个函数名称、类、库以及其在 Dart 指令镜像中代码偏移的 JSONL 清单，供 Frida 或 IDA/Ghidra 使用。它还能在关闭 Flutter 证书固定的情况下，将应用的 HTTPS 流量路由到检查代理。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app","protocol"],"verified_at":"2026-10-19"},{"id":"ddc","name":"ddc","name_zh":"ddc Android DEX 反编译器","url":"https://github.com/ejfkdev/ddc","evidence_url":"https://github.com/ejfkdev/ddc/blob/e240550669fed51edc8d373654b1883322a60eec/README.md","description_en":"Rust decompiler that turns Android DEX bytecode, versions 035 to 041, from APKs, multi-dex apps and XAPK/APKS/APKM containers into Java, folding lambdas and string concatenation back into Java syntax and giving locals jadx-style names. By default every file also goes through a source-level cleanup pass, described as semantics-preserving, that inlines copy chains, recovers ternaries and for-each loops and drops dead stores; --fast skips it. Alongside full decompilation, 15 query subcommands return app and manifest information, resources, strings, cross-references, class hierarchies, disassembly or single classes and methods on demand, and the same queries are served over REST and MCP.","description_zh":"用 Rust 编写的反编译器，可将 APK、多 DEX 应用以及 XAPK/APKS/APKM 容器中 035 至 041 版本的 Android DEX 字节码转换为 Java，把 lambda 和字符串拼接还原为 Java 语法，并按 jadx 的风格为局部变量命名。默认情况下，每个文件还会经过一道据称保持语义的源码级整理，内联拷贝链、恢复三元表达式和 for-each 循环并删除无用赋值；--fast 可跳过这一步。除完整反编译外，15 个查询子命令可按需返回应用与清单信息、资源、字符串、交叉引用、类层次结构、反汇编以及单个类或方法，同样的查询也可通过 REST 和 MCP 提供。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"me-analyzer","name":"ME Analyzer","name_zh":"ME Analyzer Intel 引擎与图形固件分析工具","url":"https://github.com/platomav/MEAnalyzer","evidence_url":"https://github.com/platomav/MEAnalyzer/blob/d27ccdba0aadbad490f47b5b631c369b682a7ef5/README.md","description_en":"Parse Intel Management Engine (CS)ME, TXE and SPS firmware, Graphics System Controller firmware and their independent PMC, PCHC, PHY and option-ROM images to report family, version, release, SKU, platform, size and health status. Research options print flash partition, BPDT/IFWI and CSE layout tables, validate RSA signatures and checksums, and unpack the supported CSE and GSC code and file systems. A bundled database identifies known images and reports those not yet listed in the community firmware repositories.","description_zh":"解析 Intel 管理引擎 (CS)ME、TXE 和 SPS 固件、图形系统控制器（GSC）固件，以及与之配套的独立 PMC、PCHC、PHY 和 Option ROM 镜像，报告系列、版本、发布类型、SKU、平台、大小和健康状态。研究用参数可显示 Flash 分区表、BPDT/IFWI 和 CSE 布局表，校验 RSA 签名与校验和，并解包所支持的 CSE、GSC 代码及文件系统。附带的数据库能识别已知镜像，并报告社区固件仓库尚未收录的镜像。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-19"},{"id":"deepextract-ida","name":"DeepExtract (DeepExtractIDA)","name_zh":"DeepExtract：把 PE 文件导出给 AI 智能体的 IDA 插件","url":"https://github.com/marcosd4h/DeepExtractIDA","evidence_url":"https://github.com/marcosd4h/DeepExtractIDA/blob/af6b01df3ce5774016f6e3cf336ed0ca2f47b512/README.md","description_en":"IDA Pro 9.x plugin and PowerShell batch extractor that turn Windows PE files into material AI coding agents can read: a per-binary SQLite database of PE metadata, signatures, disassembly, Hex-Rays pseudocode, cross-references, strings, stack frames, loops and dangerous API calls, plus optional grouped C++ and assembly files with per-function caller, callee and string headers and JSON indexes. It runs headless over directories, file lists or the modules of a running process, or interactively on the open IDA database, keeping the analyst’s renames and comments. The agent commands that work on this output come from the separate DeepExtractRuntime project.","description_zh":"IDA Pro 9.x 插件与 PowerShell 批量提取脚本，可把 Windows PE 文件转换为 AI 编程智能体能够读取的材料：每个二进制文件对应一个 SQLite 数据库，内含 PE 元数据、函数签名、反汇编、Hex-Rays 伪代码、交叉引用、字符串、栈帧、循环与危险 API 调用；还可选择输出分组的 C++ 与汇编文件，每个函数附带调用者、被调者与字符串信息头，并生成 JSON 索引。它可以无界面地处理目录、文件列表或正在运行进程加载的模块，也可以在已打开的 IDA 数据库上交互运行，并保留分析者所做的重命名和注释。处理这些输出的智能体命令来自独立的 DeepExtractRuntime 项目。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary"],"verified_at":"2026-10-19"},{"id":"simplify-android-deobfuscator","name":"Simplify","name_zh":"Simplify Android 反混淆工具","url":"https://github.com/CalebFenton/simplify","evidence_url":"https://github.com/CalebFenton/simplify/blob/29fb25d624aecf0b075dea5c6029b2541474ddfe/README.md","description_en":"Generic Android deobfuscator built on smalivm, a sandboxed Dalvik virtual machine that executes each method and records every possible register and class value along all execution paths, taking both branches when a value such as file or network input is unknown. Simplify then repeatedly applies constant propagation, dead-code removal, unreflection and peephole optimizations to the APK or DEX, which can decrypt strings and remove reflection while keeping behaviour the same; it does not rename classes or methods. smalivm can also be used as a library, and the last release adds sdbg, a step-through Smali debugger built on it.","description_zh":"基于 smalivm 的通用 Android 反混淆工具。smalivm 是一个沙箱化的 Dalvik 虚拟机，会逐个执行方法并记录所有执行路径上可能的寄存器与类取值；遇到文件或网络输入等未知值时，两个分支都会执行。Simplify 随后对 APK 或 DEX 反复进行常量传播、死代码删除、反射还原和窥孔优化，可在保持行为不变的前提下解密字符串、去除反射；它不会重命名类或方法。smalivm 也可作为库使用，最新发布版还附带基于它的单步 Smali 调试器 sdbg。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"gda-android-decompiler","name":"GDA (GJoy Dex Analyzer)","name_zh":"GDA Android 反编译器","url":"https://github.com/charles2gan/GDA-android-reversing-Tool","evidence_url":"https://github.com/charles2gan/GDA-android-reversing-Tool/blob/20f8ce8d51b0dc032c08e009e28ea76995d71889/README.md","description_en":"Windows-native Dalvik decompiler and Android analysis workbench written in C++ that opens APK, DEX, ODEX, OAT, JAR, AAR and class files without installation. Besides Java and Smali views with cross-references, renaming and comments, it identifies packers, deobfuscates and decrypts strings, tracks data flow and taint, solves paths, runs rule-based malicious-behaviour, vulnerability and privacy-leak scans, and can dump device memory or hook methods with Frida. Shell and server CLI modes, Python and Java scripting and a sample malware-triage agent skill expose the same analysis to scripts and agents.","description_zh":"以 C++ 编写、原生运行于 Windows 的 Dalvik 反编译器与 Android 分析工作台，无需安装即可打开 APK、DEX、ODEX、OAT、JAR、AAR 和 class 文件。除带交叉引用、重命名和注释的 Java 与 Smali 视图外，它还能识别加固壳、反混淆并解密字符串、追踪数据流与污点、求解路径，运行基于规则的恶意行为、漏洞和隐私泄露扫描，并可转储设备内存或用 Frida 钩挂方法。Shell 与服务器两种命令行模式、Python 和 Java 脚本以及一个恶意软件分诊智能体技能示例，让脚本和智能体也能调用这些分析功能。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"gef","name":"GEF (GDB Enhanced Features)","name_zh":"GEF GDB 增强扩展","url":"https://github.com/hugsy/gef","evidence_url":"https://github.com/hugsy/gef/blob/49c07dc60624f264d40b5c6ea39b2bf3a4e9958f/README.md","description_en":"Single-file Python extension, gef.py, that adds dynamic-analysis commands to GDB. Each stop shows a context view of registers, stack, code, threads and call trace, and commands cover memory maps, pointer dereferencing, searching process memory for patterns, ELF and security-property information, process status and glibc heap inspection. An architecture abstraction layer covers x86-32/64, ARMv5–v7, AArch64, SPARC, MIPS and PowerPC, and gef-remote enriches remote sessions through gdbserver or the GDB stubs of qemu-user and qemu-system.","description_zh":"单文件 Python 扩展 gef.py，为 GDB 增加动态分析命令。每次程序停下时都会显示寄存器、栈、代码、线程和调用轨迹等上下文视图，命令涵盖内存映射、指针解引用、在进程内存中搜索模式、ELF 与安全属性信息、进程状态以及 glibc 堆检查。其架构抽象层覆盖 x86-32/64、ARMv5–v7、AArch64、SPARC、MIPS 和 PowerPC；gef-remote 命令可通过 gdbserver 或 qemu-user、qemu-system 的 GDB stub 增强远程调试会话。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"z0f-reverse-engineering-course","name":"Z0FCourse Reverse Engineering","name_zh":"Z0FCourse 逆向工程课程","url":"https://github.com/0xZ0F/Z0FCourse_ReverseEngineering","evidence_url":"https://github.com/0xZ0F/Z0FCourse_ReverseEngineering/blob/ee4b07095d6f81ba5e5c7e0b70f7cb39e3af83b1/README.md","description_en":"A free English course by Z0F on reverse engineering 64-bit Windows programs, which its README pitches as taking learners from beginner to intermediate. Markdown lessons move from number systems, x64 registers, memory layout and calling conventions to x64dbg and Ghidra, then reverse small samples and an author-written DLL, recovering a Player class and calling the DLL's exports from a program of one's own. The unfinished later chapters introduce Windows internals and reverse ntdll's generic-table functions.","description_zh":"Z0F 编写的免费英文课程，讲解如何逆向 64 位 Windows 程序，README 称目标是帮助学习者从入门进阶到中级。Markdown 课程从数制、x64 寄存器、内存布局和调用约定讲起，过渡到 x64dbg 与 Ghidra，再逆向若干小样本以及作者自己编写的 DLL，还原其中的 Player 类，并在自己编写的程序中调用该 DLL 的导出函数。尚未完成的后续章节介绍 Windows 内部机制，并逆向 ntdll 中的 generic table 系列函数。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-19"},{"id":"apklab","name":"APKLab","name_zh":"APKLab Android 逆向工作台","url":"https://github.com/APKLab/APKLab","evidence_url":"https://github.com/APKLab/APKLab/blob/6ae69b1ba03d65cb78388f7e2fa6a3b8f0081c74/README.md","description_en":"VS Code extension that turns the editor into an Android reverse-engineering workbench around Apktool, Jadx, smali-lsp and uber-apk-signer. It decodes an APK into resources and Smali, decompiles it to Java, gives Smali go-to-definition, references and diagnostics through a language server, and rebuilds, signs and installs the modified app. It can also generate Frida hooks for Smali methods, add a Frida gadget, prepare an app for HTTPS traffic inspection with apk-mitm and produce a Quark-Engine malware-analysis report.","description_zh":"把 VS Code 变成 Android 逆向工作台的扩展，整合 Apktool、Jadx、smali-lsp 和 uber-apk-signer。它可将 APK 解码为资源文件和 Smali 并反编译为 Java，借助语言服务器为 Smali 提供定义跳转、引用查找和诊断，还能重新构建、签名并安装修改后的应用。此外，它可为 Smali 方法生成 Frida 钩子、加入 Frida gadget、借助 apk-mitm 为 HTTPS 流量检查做准备，并生成 Quark-Engine 恶意软件分析报告。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"triton","name":"Triton","name_zh":"Triton 动态二进制分析库","url":"https://github.com/JonathanSalwan/Triton","evidence_url":"https://github.com/JonathanSalwan/Triton/blob/bc84cf745e99768e07d51dcd734eba35c59f1b3e/README.md","description_en":"C++ library with Python bindings for dynamic binary analysis of x86, x86-64, ARM32, AArch64 and RISC-V 32/64 code. Callers process instructions one at a time, optionally with concrete register and memory values; Triton builds symbolic expressions from each instruction's semantics, tracks taint and solves path constraints through Z3 or Bitwuzla. It also synthesizes and simplifies expressions and lifts them to LLVM IR or Z3 and back, for building analysis tools, automating reverse engineering, software verification or emulating code.","description_zh":"面向 x86、x86-64、ARM32、AArch64 和 RISC-V 32/64 代码动态二进制分析的 C++ 库，提供 Python 绑定。调用方逐条处理指令，并可设置具体的寄存器和内存值；Triton 依据每条指令的语义构建符号表达式、进行污点跟踪，并通过 Z3 或 Bitwuzla 求解路径约束。它还能合成与化简表达式，并将其提升为 LLVM IR 或 Z3 表达式后再转换回来，可用于构建分析工具、自动化逆向工程、软件验证或模拟执行代码。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"pylingual","name":"PyLingual","name_zh":"PyLingual Python 字节码反编译器","url":"https://github.com/syssec-utd/pylingual","evidence_url":"https://github.com/syssec-utd/pylingual/blob/509ea92e560b2c2c99b0c9901bd33e404fbfb4b8/README.md","description_en":"Research decompiler for CPython bytecode from Python 3.6 onward that pairs per-version transformer models with control-flow reconstruction. A segmentation model splits bytecode into statements, a statement model translates each into source, and templates rebuild loops, conditionals, exception handlers, with blocks and match statements. The result is recompiled with the target Python version and its control flow compared with the original bytecode, and failing segments are retried with alternative segmentations; the design is described in the IEEE S&P 2025 paper “PyLingual: Toward Perfect Decompilation of Evolving High-Level Languages”.","description_zh":"面向 Python 3.6 及以后版本 CPython 字节码的研究型反编译器，将按版本训练的 Transformer 模型与控制流重建相结合。分段模型把字节码切分为语句，语句模型将每段翻译为源码，再由模板重建循环、条件分支、异常处理、with 块和 match 语句。生成结果会用目标 Python 版本重新编译，并与原字节码比较控制流，未通过的片段会改用其他分段方案重试；其设计见 IEEE S&P 2025 论文《PyLingual: Toward Perfect Decompilation of Evolving High-Level Languages》。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-19"},{"id":"sf64-matching-decomp-case","name":"Star Fox 64: a complete matching Nintendo 64 decompilation","name_zh":"《星际火狐 64》：完整的 Nintendo 64 版一致性反编译","url":"https://github.com/sonicdcer/sf64","evidence_url":"https://github.com/sonicdcer/sf64/blob/4235c59f00b04440e3fd5fec49f0bc80e48cf212/README.md","description_en":"Reconstructs C source for the US 1.1 (Rev A) Nintendo 64 release of Star Fox 64 that, compiled with the IDO compiler through a static recompilation, rebuilds a ROM with the published MD5; the README badge counts all 2,951 functions as matching. Code and assets are split from the user’s own ROM at build time, and the repository contains no assets or assembly. The separately curated Starship PC port compiles this C code, while Starfox 64: Recompiled takes headers and some functions from it for its patches.","description_zh":"为 Nintendo 64 版《星际火狐 64》美版 1.1（Rev A）重建 C 源码；借助静态重编译运行的 IDO 编译器编译后，可重建出 MD5 与公布值一致的 ROM，README 徽章显示全部 2,951 个函数均已一致。构建时从使用者自备的 ROM 中拆分代码与素材，仓库本身不含素材或汇编。另行收录的 Starship PC 移植直接编译这份 C 代码，Starfox 64: Recompiled 则从中取用头文件和部分函数来编写补丁。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"galaxy-buds-client-protocol-case","name":"Galaxy Buds Client: an unofficial manager built on Samsung’s earbud protocol","name_zh":"Galaxy Buds Client：基于三星耳机协议的非官方管理器","url":"https://github.com/timschneeb/GalaxyBudsClient","evidence_url":"https://github.com/timschneeb/GalaxyBudsClient/blob/754b6fdfb1c151b022cece775c8aaad4eb185afa/README.md","description_en":"Reimplements control of Samsung Galaxy Buds over their proprietary RFCOMM serial protocol in a cross-platform desktop and Android manager. The author reports recovering the message format by analyzing the earbuds’ binary stream and disassembling Samsung’s official Android apps, and publishes partial packet notes for the 2019 Buds and the Buds+. Beyond the official app’s settings, it exposes battery statistics, diagnostics, factory self-tests, hidden debug information and firmware flashing for supported models.","description_zh":"在跨平台桌面与 Android 管理器中，通过三星 Galaxy Buds 专有的 RFCOMM 串口协议重新实现耳机控制。作者称通过分析耳机发出的二进制数据流并反汇编三星官方 Android 应用来恢复报文格式，并公开了 2019 款 Buds 和 Buds+ 的部分数据包笔记。除官方应用的设置外，它还提供电池统计、诊断、出厂自检、隐藏调试信息，以及适用型号的固件刷写。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-19"},{"id":"owasp-mastg","name":"OWASP Mobile Application Security Testing Guide (MASTG)","name_zh":"OWASP 移动应用安全测试指南（MASTG）","url":"https://mas.owasp.org/MASTG/","evidence_url":"https://github.com/OWASP/mastg/blob/02ffd85fb74383ec2a30b42866d38f89d72c0ead/README.md","description_en":"OWASP’s open manual for Android and iOS app security testing and reverse engineering, published at mas.owasp.org. Chapters on platform internals, test setup and app tampering and reverse engineering sit beside modular, individually referenced tests, techniques, tool pages, knowledge articles, best practices and runnable demos, all mapped to MASVS controls and MASWE weaknesses. OWASP’s UnCrackable crackme apps serve as practice targets and examples.","description_zh":"OWASP 维护的开放手册，讲解 Android 和 iOS 应用的安全测试与逆向工程，发布于 mas.owasp.org。除平台原理、测试环境搭建以及应用篡改与逆向工程等章节外，还收录可单独引用的测试、技术、工具页面、知识条目、最佳实践和可运行的演示，均与 MASVS 控制项和 MASWE 弱点对应。OWASP 自己的 UnCrackable 破解练习应用用作练习目标和示例。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["app"],"verified_at":"2026-10-19"},{"id":"wino-mail-case","name":"Wino Mail: recreating Windows Mail and Calendar","name_zh":"Wino Mail：重建 Windows 邮件与日历体验","url":"https://github.com/bkaankose/Wino-Mail","evidence_url":"https://github.com/bkaankose/Wino-Mail/blob/72b8d56881789ab11e42c9ab41b6567db1b85cde/README.md","description_en":"Native Windows client that aims to preserve the familiar Windows Mail and Calendar experience while rebuilding its functionality. The upstream README documents a WinUI 3 interface, mail and calendar providers, contacts, tasks and offline workflows.","description_zh":"原生 Windows 客户端，以重建 Windows 邮件与日历的功能、保留熟悉的使用体验为目标。上游 README 说明了 WinUI 3 界面、邮件与日历服务、联系人、待办及离线工作流。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-10-18"},{"id":"primedecomp-metroid-prime-decomp-case","name":"Metroid Prime: the PrimeDecomp matching GameCube decompilation","name_zh":"《密特罗德 Prime》：PrimeDecomp 的 GameCube 版一致性反编译","url":"https://github.com/PrimeDecomp/prime","evidence_url":"https://github.com/PrimeDecomp/prime/blob/2fd31790998c0486744a6289cac7e2fecc22d143/README.md","description_en":"Reconstructs C++ source for Metroid Prime’s GameCube executable and its NES-emulator module so that CodeWarrior builds match the originals, across the USA, Korean, PAL and Japanese releases, with early configurations for demo discs and three Wii releases. Matched units are compiled from source and linked with objects split from the user’s disc, then checked against per-version SHA-1 hashes; the repository contains no game assets or assembly. The separately curated Metaforce and Metroid Prime Port build their native ports on this code.","description_zh":"为《密特罗德 Prime》GameCube 版的可执行文件及其 NES 模拟器模块重建 C++ 源码，使 CodeWarrior 编译结果与原文件一致，涵盖美版、韩版、PAL 版与日版，另有针对体验版光盘和三个 Wii 版本的早期配置。已匹配的单元由源码编译，再与从使用者光盘中拆分出的对象链接，并按各版本的 SHA-1 哈希校验；仓库不含游戏素材或汇编。另行收录的 Metaforce 与 Metroid Prime Port 都在这份代码之上构建原生移植。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"batla-3d-server-emulator-case","name":"Batla 3D server emulator (2015 client)","name_zh":"Batla 3D 服务端模拟器（2015 年客户端）","url":"https://github.com/Serega25511s/Batla-3D-server-emu","evidence_url":"https://github.com/Serega25511s/Batla-3D-server-emu/blob/c70f254ee86b3fa7363b5afb98541bcaa9e6c751/README.md","description_en":"C# server emulator for the 2015 Steam client of Batla 3D, covering HTTP account, shop and room services and Lidgren UDP gameplay. It includes a client-assembly patcher and protocol notes that distinguish recovered client evidence from emulator rules.","description_zh":"面向 Batla 3D 2015 年 Steam 客户端的 C# 服务端模拟器，涵盖账户、商店、房间 HTTP 服务与 Lidgren UDP 对战。项目包含客户端程序集补丁工具，协议文档区分了从客户端恢复的证据与模拟器自行选择的规则。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game","protocol"],"verified_at":"2026-10-19"},{"id":"decompilation-wiki","name":"The Decompilation Wiki","name_zh":"Decompilation Wiki 反编译维基","url":"https://decompilation.wiki/","evidence_url":"https://github.com/mahaloz/decompilation-wiki/blob/0133d7124ea65d0eb717ff9a01c01b28923d2ca2/README.md","description_en":"Community wiki explaining how decompilers work, from disassembly, lifting and control-flow recovery to type recovery, control-flow structuring, quality evaluation and neural decompilation, citing the research behind each technique. It also keeps directories of decompilers, plugins, blogs and talks, pages on applied research such as symbol recovery, code similarity and vulnerability discovery, and a table of about 240 game reconstruction projects by original platform.","description_zh":"社区维护的维基，讲解反编译器如何工作，从反汇编、提升和控制流恢复，到类型恢复、控制流结构化、质量评估和神经反编译，并为各项技术注明研究出处。它还整理了反编译器、插件、博客和演讲目录，设有符号恢复、代码相似性和漏洞发现等应用研究页面，以及按原平台列出的约 240 个游戏重建项目表。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"rsdkv4-sonic-1-2-decomp-case","name":"RSDKv4 Decompilation: Retro Engine v4 and the Sonic 1 & 2 (2013) menus","name_zh":"RSDKv4 Decompilation：Retro Engine v4 与《索尼克》1、2（2013）菜单的反编译","url":"https://github.com/RSDKModding/RSDKv4-Decompilation","evidence_url":"https://github.com/RSDKModding/RSDKv4-Decompilation/blob/a7f5195e21fdad7b75e4587e249013feeea9e6f3/README.md","description_en":"Decompiles Retro Engine (RSDK) v4, the engine behind Sonic the Hedgehog and Sonic the Hedgehog 2 (2013), together with the games’ natively coded menus, and builds it for Windows, Linux and Android. The engine runs the game scripts contained in the official releases’ data files, which users must supply. The project adds a script compiler, a mod loader and an experimental online mode for Sonic 2’s 2P VS; it is the predecessor of the same group’s RSDKv5 decompilation.","description_zh":"反编译 Retro Engine（RSDK）v4——《索尼克》与《索尼克 2》（2013）所用的引擎——以及两款游戏中以原生代码实现的菜单，可构建 Windows、Linux 与 Android 版本。引擎运行官方发行版数据文件中的游戏脚本，这些文件需由使用者自备。项目增加了脚本编译器、模组加载器，以及《索尼克 2》双人对战的实验性联网模式；它是同一团队 RSDKv5 反编译项目的前身。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"miasm","name":"Miasm","name_zh":"Miasm 逆向工程框架","url":"https://github.com/cea-sec/miasm","evidence_url":"https://github.com/cea-sec/miasm/blob/3671fc24d6e625c2d75f3311724eb6b0c97664f8/README.md","description_en":"Python reverse-engineering framework for analyzing, modifying and generating binary programs. It reads, modifies and generates 32- and 64-bit PE and ELF files, assembles and disassembles x86, ARM, AArch64, MIPS, PowerPC, SH4, MSP430 and MeP code, and lifts it into its own intermediate language for symbolic execution, SSA and data-flow analysis, dependency graphs and expression simplification aimed at deobfuscation. Its JIT emulator runs shellcode or parts of binaries through LLVM, GCC, Clang or pure-Python backends, with Python callbacks that stand in for library functions, sandboxes with selected Windows API and Linux emulation, and dynamic symbolic execution through Z3.","description_zh":"用于分析、修改和生成二进制程序的 Python 逆向工程框架。它可读取、修改和生成 32 位与 64 位 PE 和 ELF 文件，汇编和反汇编 x86、ARM、AArch64、MIPS、PowerPC、SH4、MSP430 与 MeP 代码，并将其提升到自有的中间语言，用于符号执行、SSA 与数据流分析、依赖图以及面向反混淆的表达式化简。其 JIT 模拟器可借助 LLVM、GCC、Clang 或纯 Python 后端运行 shellcode 或二进制中的部分代码，用 Python 回调代替库函数，提供模拟部分 Windows API 和 Linux 行为的沙箱，并可通过 Z3 进行动态符号执行。","kind":"tool","category":"binary-libraries","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"fernflower","name":"Fernflower","name_zh":"Fernflower Java 反编译器","url":"https://github.com/JetBrains/fernflower","evidence_url":"https://github.com/JetBrains/fernflower/blob/924b60f87d93743ab63b59454eec708e8309ef2a/README.md","description_en":"JetBrains' analytical decompiler that turns Java class files back into Java source; IntelliJ IDEA bundles it to show code when debugging or browsing class files. The standalone console decompiler takes class files, JARs, ZIPs or directories, can load library files with -e only as analysis context, and writes Java sources to an output directory. Options cover generic signatures, lambdas, inner classes, record and switch patterns, per-method time limits and renaming of ambiguous or obfuscated identifiers, optionally through a user-supplied renamer class.","description_zh":"JetBrains 的分析型反编译器，可将 Java class 文件还原为 Java 源码；IntelliJ IDEA 内置了它，用于在调试或浏览 class 文件时显示代码。独立的控制台反编译器接受 class 文件、JAR、ZIP 或目录，可通过 -e 加载仅作为分析上下文的库文件，并将 Java 源码写入输出目录。选项涵盖泛型签名、lambda、内部类、记录模式与 switch 模式、单个方法的处理时限，以及对含糊或混淆标识符的重命名，也可由使用者提供的重命名类来实现。","kind":"tool","category":"jvm","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"hyperdbg","name":"HyperDbg","name_zh":"HyperDbg 虚拟化辅助调试器","url":"https://github.com/HyperDbg/HyperDbg","evidence_url":"https://github.com/HyperDbg/HyperDbg/blob/ff3ba351a1059ce558967aa45a2c70ed25620aa4/README.md","description_en":"Hypervisor-assisted Windows debugger that virtualizes the running system with Intel VT-x and Extended Page Tables to debug kernel and user mode, either locally as a tracing and introspection tool or from a host attached over a serial connection to a guest virtual machine. Its events include EPT-based hidden breakpoints and hooks, memory read, write and execute monitoring without the limits of hardware debug registers, monitoring of system calls, CPUID, MSRs, I/O ports, MMIO, exceptions and interrupts, and Intel PT and LBR branch tracing. A kernel-side script engine, PDB symbol support and an SDK automate analysis.","description_zh":"借助虚拟化技术的 Windows 调试器：利用 Intel VT-x 和扩展页表（EPT）将正在运行的系统虚拟化，从而调试内核态和用户态代码；既可在本机作为跟踪与内省工具运行，也可从宿主机通过串行连接附加到客户虚拟机进行调试。其事件包括基于 EPT 的隐藏断点与钩子、不受硬件调试寄存器限制的内存读写和执行监控，对系统调用、CPUID、MSR、I/O 端口、MMIO、异常和中断的监控，以及 Intel PT 与 LBR 分支跟踪。内核侧脚本引擎、PDB 符号支持和 SDK 可用于自动化分析。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"jpexs-decompiler","name":"JPEXS Free Flash Decompiler (FFDec)","name_zh":"JPEXS Flash 反编译器（FFDec）","url":"https://github.com/jindrapetrik/jpexs-decompiler","evidence_url":"https://github.com/jindrapetrik/jpexs-decompiler/blob/de7efbf4754865f46c1c5bd36c9db9cc4ef2fa0b/README.md","description_en":"Java desktop decompiler and editor for Adobe Flash SWF files. It decompiles ActionScript 1/2 and AS3 side by side with the P-code they came from, edits scripts as source (experimental) or through the assembler view, and exports or replaces images, shapes, sounds, video, fonts and texts, with SWF-to-FLA conversion, SWF-to-XML round trips and SVG or HTML5 Canvas output. It also opens SWC and ABC files, Scaleform GFx and 64-bit Iggy files, has an ActionScript debugger and deobfuscation passes for obfuscated AS3, and offers its parser and decompiler as the ffdec_lib Java library and a command line.","description_zh":"面向 Adobe Flash SWF 文件的 Java 桌面反编译与编辑工具。它可反编译 ActionScript 1/2 和 AS3，并与对应的 P-code 对照显示；既能以源码形式（实验性）编辑脚本，也能通过汇编视图编辑，还可导出或替换图像、形状、声音、视频、字体和文本，支持 SWF 转 FLA、SWF 与 XML 互转，以及输出 SVG 或 HTML5 Canvas。它还能打开 SWC、ABC 文件以及 Scaleform GFx 和 64 位 Iggy 文件，内置 ActionScript 调试器和针对混淆 AS3 的反混淆处理，并以 ffdec_lib Java 库和命令行形式提供其解析与反编译功能。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["game","website"],"verified_at":"2026-10-19"},{"id":"mizuchi-matching-decompilation-pipeline","name":"Mizuchi","name_zh":"Mizuchi 匹配反编译流水线","url":"https://github.com/macabeus/mizuchi","evidence_url":"https://github.com/macabeus/mizuchi/blob/25eaef4214574cc20f376878dbc1b8099e97164e/README.md","description_en":"Plugin pipeline for matching decompilation that loops over functions in an existing decomp project: m2c drafts C, decomp-permuter mutates it, Claude rewrites it through a compile-and-diff tool, and objdiff accepts a result only when the compiled object matches the target assembly. A local Decomp Atlas web app indexes matched and unmatched functions with call graphs and code embeddings, helps pick the next function and builds prompts, while HTML reports summarise each run. An optional integrator places matched C into a git worktree, checks the build and can commit, push or open a PR.","description_zh":"面向匹配反编译的插件式流水线，在现有反编译项目中逐个处理函数：m2c 生成 C 初稿，decomp-permuter 对其做变异，Claude 借助编译并比对的工具改写代码，只有编译出的目标文件与目标汇编一致时才由 objdiff 判定通过。本地 Decomp Atlas 网页应用为已匹配和未匹配函数建立索引，附调用图和代码向量，帮助挑选下一个函数并生成提示词；HTML 报告汇总每次运行结果。可选的集成插件会把匹配成功的 C 代码放入 git 工作树，检查构建，并可提交、推送或发起 PR。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"kuna","name":"Kuna","name_zh":"Kuna 智能体优先反编译器","url":"https://github.com/Noelo-Lab/kuna","evidence_url":"https://github.com/Noelo-Lab/kuna/blob/d1f98e52e054bc7684fd5bb13fca5088f3e09a2d/README.md","description_en":"Agent-first decompiler written in Rust that began as a port of Ghidra’s C++ decompiler and SLEIGH compiler, and has since diverged with option-gated features, some ported from angr. A single self-contained kuna binary decompiles one function or exports a whole binary to C, header and assembly files, and the same engine runs in the browser through WebAssembly or as the decompiler backend inside Ghidra. The project calls itself an experiment in having LLM agents refine the decompiler; most code is agent-written and steered by regression and benchmark results.","description_zh":"以智能体为核心、用 Rust 编写的反编译器，最初移植自 Ghidra 的 C++ 反编译器和 SLEIGH 编译器，此后加入了可按选项开关的功能（部分移植自 angr），已与上游分化。单个自包含的 kuna 程序可反编译单个函数，也可将整个二进制导出为 C、头文件和汇编文件；同一引擎还能通过 WebAssembly 在浏览器中运行，或在 Ghidra 中充当反编译后端。项目自称是让 LLM 智能体持续改进反编译器的实验，大部分代码由智能体编写，并以回归测试和基准结果为导向。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"bytecode-viewer","name":"Bytecode Viewer","name_zh":"Bytecode Viewer Java/Android 逆向工程套件","url":"https://github.com/Konloch/bytecode-viewer","evidence_url":"https://github.com/Konloch/bytecode-viewer/blob/31430e0033fa220db566b5ef461256727ff6793b/README.md","description_en":"Desktop suite for inspecting compiled Java and Android programs: drop in a class, JAR, WAR, APK, DEX, XAPK or APKM file to browse its classes and resources, with up to three decompiler or disassembler views side by side. The README lists six bundled Java decompilers (Krakatau, CFR, Procyon, FernFlower, JADX and JD-GUI), Krakatau and Smali/baksmali disassemblers and assemblers plus javap, Dex2Jar and Enjarify for APK/DEX conversion, a built-in Java compiler for editing, and static search. Java and JavaScript plugins receive every loaded class as an ASM ClassNode for jobs such as string deobfuscation or malicious-code searches.","description_zh":"用于检查已编译 Java 与 Android 程序的桌面套件：拖入 class、JAR、WAR、APK、DEX、XAPK 或 APKM 文件即可浏览其中的类和资源，并可并排显示最多三个反编译器或反汇编器视图。README 列出六个内置 Java 反编译器（Krakatau、CFR、Procyon、FernFlower、JADX 和 JD-GUI）、Krakatau 与 Smali/baksmali 反汇编器和汇编器以及 javap，还有用于 APK/DEX 转换的 Dex2Jar 和 Enjarify、用于编辑的内置 Java 编译器和静态搜索。Java 和 JavaScript 插件会收到全部已加载类的 ASM ClassNode，可用于字符串去混淆或恶意代码搜索等任务。","kind":"tool","category":"jvm","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"binary-ninja-api","name":"Binary Ninja API","name_zh":"Binary Ninja 公开 API","url":"https://github.com/Vector35/binaryninja-api","evidence_url":"https://github.com/Vector35/binaryninja-api/blob/14d46ea2a46330b0b6abbea8dcb620f84494fc8b/README.md","description_en":"Vector 35’s public C++, Python and Rust APIs for Binary Ninja, with their documentation, examples and the open-source plugins built on them. Binary Ninja itself is a closed-source commercial application, and this repository does not contain its analysis core. The open plugins cover the x86/x86_64, ARM64, ARMv7, PowerPC, MIPS, RISC-V and MSP430 architectures, ELF, PE/COFF, Mach-O and Apple shared-cache and kernel-cache loaders, DWARF, PDB and IDB import, and Objective-C, RTTI and SVD analysis, while the examples walk the low- and medium-level intermediate languages and extend the analysis pipeline through workflows.","description_zh":"Vector 35 为 Binary Ninja 公开的 C++、Python 和 Rust API，附带文档、示例以及基于这些 API 的开源插件。Binary Ninja 本身是闭源商业软件，本仓库不包含其分析核心。开源插件涵盖 x86/x86_64、ARM64、ARMv7、PowerPC、MIPS、RISC-V 和 MSP430 架构，ELF、PE/COFF、Mach-O 以及 Apple 共享缓存和内核缓存加载器，DWARF、PDB 与 IDB 导入，以及 Objective-C、RTTI 和 SVD 分析；示例则演示如何遍历低级与中级中间语言，并通过工作流扩展分析流程。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-19"},{"id":"openrw-gta3-engine-case","name":"OpenRW: an open re-implementation of the Grand Theft Auto III engine","name_zh":"OpenRW：《侠盗猎车手 III》引擎的开源重新实现","url":"https://github.com/rwengine/openrw","evidence_url":"https://github.com/rwengine/openrw/blob/5c5f266b71aa55aeec8cb4d823f19e7c4348f3bd/README.md","description_en":"Re-implements Rockstar Games’ Grand Theft Auto III (2001) as a cross-platform C++ engine that runs on the data of a legitimate PC copy. It has its own loaders for the game’s RenderWare models, textures and archives, a script machine for the original mission scripts, and an optional Qt data viewer. Playability is partial: the project’s mission tracker marks six early Portland story missions as completable.","description_zh":"以跨平台 C++ 引擎重新实现 Rockstar Games 的《侠盗猎车手 III》（2001），在正版 PC 游戏的数据上运行。项目自行实现了游戏 RenderWare 模型、纹理和归档的加载器，提供执行原版任务脚本的脚本机，并附带可选的 Qt 数据查看器。可玩程度有限：项目的任务追踪清单只将波特兰的六个早期剧情任务标为可完成。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"rexglue-sdk","name":"ReXGlue SDK","name_zh":"ReXGlue Xbox 360 静态重编译 SDK","url":"https://github.com/rexglue/rexglue-sdk","evidence_url":"https://github.com/rexglue/rexglue-sdk/blob/c94f5ebdcb3c9d1a460ca48e04f9758448f8d518/README.md","description_en":"Experimental SDK for statically recompiling Xbox 360 executables into portable C++23 that runs natively on Windows, Linux and macOS. Its rexglue CLI scaffolds a per-game CMake project and, from a TOML config, analyzes a XEX binary (import resolution, PDATA, block discovery, gap filling, jump resolution and call-target validation) before translating each PowerPC instruction into C++; a runtime derived from Xenia's emulator core, with D3D12 or Vulkan graphics, hosts the generated code. Generated functions are weak aliases that native C++ overrides or mid-function hooks can replace, so a port can be refined one function at a time.","description_zh":"实验性 SDK，可将 Xbox 360 可执行文件静态重编译为可移植的 C++23 代码，在 Windows、Linux 和 macOS 上原生运行。其 rexglue 命令行工具为单个游戏搭建 CMake 项目，并根据 TOML 配置分析 XEX 二进制（导入解析、PDATA、基本块发现、空隙填充、跳转解析和调用目标校验），再将每条 PowerPC 指令翻译为 C++；生成的代码由派生自 Xenia 模拟器核心的运行时承载，图形后端为 D3D12 或 Vulkan。生成的函数均为弱别名，可用原生 C++ 覆盖或在函数内插入钩子来替换，从而逐个函数完善移植。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"reagent-cpp-reconstruction-agent","name":"ReAgent","name_zh":"ReAgent C/C++ 函数重建智能体","url":"https://github.com/Dryxio/reagent","evidence_url":"https://github.com/Dryxio/reagent/blob/d12cea338c61898b06a86fe8adb25275fa9d5615/README.md","description_en":"An open-source Python agent, published on PyPI as auto-re-agent, that drafts C/C++ implementations of functions in a compiled program from Ghidra evidence and has a separately configurable checker model review each draft in a bounded fix loop. A candidate is accepted only after a structural comparison with the decompile, assembly, control-flow and P-code evidence, the project’s own build, test and optional differential commands, and 11 heuristic parity signals. The README calls these gates conservative evidence, not proof of equivalence, and the tool writes candidates to an overlay rather than patching the source tree.","description_zh":"开源 Python 智能体，以 auto-re-agent 之名发布于 PyPI。它依据 Ghidra 提供的证据为已编译程序中的函数起草 C/C++ 实现，再由可单独配置的检查模型在有轮数上限的修复循环中审阅每份草稿。候选代码须先与反编译、汇编、控制流和 P-code 证据做结构比对，再通过项目自己的构建、测试及可选的差分命令和 11 项启发式一致性信号，才会被接受。README 称这些关卡只是保守的证据，并非等价性证明；工具把候选代码写入覆盖层，而不直接修改源码树。","kind":"integration","category":"agent-workflows","group":"agents","relationship":"independent-agent-integration","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"capa","name":"capa","name_zh":"capa 可执行文件功能识别工具","url":"https://github.com/mandiant/capa","evidence_url":"https://github.com/mandiant/capa/blob/7a235c46965ea0965c65be3b9ee1e21dca686f3d/README.md","description_en":"Mandiant FLARE tool that reports what an executable can do by matching a YAML rule set against features extracted from PE, ELF and .NET files or 32/64-bit shellcode, such as API calls, imports, strings and constants. Matches are grouped into capability namespaces with ATT&CK and MBC tags, and verbose output shows the function or basic-block addresses and features behind each match, pointing analysts to code worth studying. It also reads CAPE, DRAKVUF and VMRay sandbox reports for dynamic features and can use vivisect, IDA Pro, Ghidra or Binary Ninja for analysis, with explorer plugins for IDA and Ghidra and a browser viewer for its JSON results.","description_zh":"Mandiant FLARE 团队的工具，将 YAML 规则集与从 PE、ELF、.NET 文件或 32/64 位 shellcode 中提取的 API 调用、导入、字符串和常量等特征进行匹配，报告可执行文件具备哪些功能。匹配结果按功能命名空间归类并标注 ATT&CK 和 MBC，详细输出会列出每项匹配所依据的函数或基本块地址及特征，为分析人员指出值得深入研究的代码。它还能读取 CAPE、DRAKVUF 和 VMRay 沙箱报告以利用动态特征，可选用 vivisect、IDA Pro、Ghidra 或 Binary Ninja 进行分析，并提供 IDA 和 Ghidra 的 explorer 插件以及查看 JSON 结果的浏览器界面。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"ruffle-flash-player-case","name":"Ruffle: a Rust reimplementation of Adobe Flash Player","name_zh":"Ruffle：用 Rust 重新实现的 Adobe Flash Player","url":"https://github.com/ruffle-rs/ruffle","evidence_url":"https://github.com/ruffle-rs/ruffle/blob/ea24ef78aa6c898e8170c1a603a496dd1131bd6c/README.md","description_en":"Reimplements Adobe Flash Player in Rust so that SWF content, from ActionScript 1/2 (AVM1) to ActionScript 3 (AVM2), runs in a native desktop player or in browsers through WebAssembly, as a self-hosted script or a browser extension. Its contributor guide says behavior comes from observing Flash Player's output or from license-compatible sources such as Adobe's open avmplus code, and forbids decompiling Flash Player, Flash Professional or Animate. Regression tests run contributor-made SWFs and compare their trace output, and optionally rendered images, with captures from the official debug Flash Player.","description_zh":"用 Rust 重新实现 Adobe Flash Player，使从 ActionScript 1/2（AVM1）到 ActionScript 3（AVM2）的 SWF 内容能在原生桌面播放器中运行，或通过 WebAssembly 以自托管脚本或浏览器扩展的形式在浏览器中运行。其贡献指南称，行为依据对 Flash Player 输出的观察或 Adobe 开源的 avmplus 等许可兼容来源确定，并禁止反编译 Flash Player、Flash Professional 或 Animate。回归测试运行贡献者自制的 SWF，将其 trace 输出（以及可选的渲染图像）与官方调试版 Flash Player 的记录进行比较。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game","website"],"verified_at":"2026-10-19"},{"id":"ps3recomp","name":"ps3recomp","name_zh":"ps3recomp PS3 静态重编译工具包","url":"https://github.com/sp00nznet/ps3recomp","evidence_url":"https://github.com/sp00nznet/ps3recomp/blob/39a36296511c445707adabcd312f0b740cfbd694/README.md","description_en":"Toolkit and runtime for statically recompiling PlayStation 3 games into native executables. Python tools parse PS3 ELF and PRX files, find functions and firmware imports, and lift PPU and SPU code to C/C++; a project template links that code with a C/C++ runtime providing LV2 system calls, high-level emulation of the system libraries and RSX graphics translation to Direct3D 12, Metal or Vulkan.","description_zh":"用于将 PlayStation 3 游戏静态重编译为原生可执行文件的工具包与运行时。Python 工具解析 PS3 ELF 和 PRX 文件，识别函数与固件导入，并将 PPU 和 SPU 代码提升为 C/C++；项目模板再将这些代码与 C/C++ 运行时链接，由运行时提供 LV2 系统调用、系统库的高层仿真，以及转换到 Direct3D 12、Metal 或 Vulkan 的 RSX 图形层。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"nebulafd","name":"Nebula (NebulaFD)","name_zh":"Nebula（NebulaFD）Clickteam Fusion 反编译器","url":"https://github.com/AITYunivers/NebulaFD","evidence_url":"https://github.com/AITYunivers/NebulaFD/blob/a24d4d1da78c35412413faac750e07ff7d603a8a/Nebula.CLI/Program.cs","description_en":"Work-in-progress decompiler for games made with Clickteam Fusion 2.5, with fixes for older Multimedia Fusion 1.5 files. Its .NET console app reads Windows executables, Android APKs, iOS IPAs, CCN data files and existing MFA projects, then runs plug-in tools: an MFA Parser that writes the game back out as an editable Fusion project, and an Asset Dumper for images, sounds, music, fonts, icons, shaders and packed files.","description_zh":"面向 Clickteam Fusion 2.5 游戏的反编译器，仍在开发中，也针对更早的 Multimedia Fusion 1.5 文件做了修复。其 .NET 控制台程序可读取 Windows 可执行文件、Android APK、iOS IPA、CCN 数据文件以及现有的 MFA 项目，再运行插件式工具：MFA Parser 将游戏重新写成可编辑的 Fusion 项目，Asset Dumper 则导出图像、音效、音乐、字体、图标、着色器和打包文件。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-19"},{"id":"scooterlink-honda-roadsync-case","name":"ScooterLink: reconstructing Honda RoadSync’s handlebar-button protocol","name_zh":"ScooterLink：重建 Honda RoadSync 车把按键协议","url":"https://github.com/gdorgian/ScooterLink","evidence_url":"https://github.com/gdorgian/ScooterLink/blob/a089f6210e863d56b590ed4625b92f886ff6a097/docs/PROTOCOL.md","description_en":"Replaces Honda RoadSync’s Apple Music-only media control with an iOS app that pairs with a Honda PCX 2025 TFT dash over Bluetooth Low Energy and turns handlebar presses into system-wide commands for any player. The author documents the dash’s BLE services, key exchange, button registration and event bytes, reportedly worked out from the official Android app and logged traffic. Results are author-reported on one PCX125, and the protocol notes separate confirmed from unverified parts.","description_zh":"以一个 iOS 应用替代 Honda RoadSync 仅支持 Apple Music 的媒体控制：通过低功耗蓝牙与 Honda PCX 2025 的 TFT 仪表配对，把车把按键转换为对任意播放器生效的系统级命令。作者记录了仪表的 BLE 服务、密钥交换、按键注册与事件字节，据称依据官方 Android 应用及通信日志推断得出。结果为作者在一台 PCX125 上的报告，协议说明区分了已确认与未验证的部分。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-19"},{"id":"frontkick-rikugan-crebench-comparison","name":"Frontkick vs Rikugan: a CREBench agent comparison","name_zh":"Frontkick 与 Rikugan：基于 CREBench 的智能体对比","url":"https://www.synacktiv.com/en/publications/ufc-666-frontkick-vs-rikugan","evidence_url":"https://www.synacktiv.com/en/publications/ufc-666-frontkick-vs-rikugan","description_en":"Matthieu Breuil’s Synacktiv article explains tool-calling and code-executing agent designs and describes Frontkick, a CodeAct agent that runs generated Python inside Binary Ninja. It compares Frontkick with the open-source Rikugan plugin on two CREBench cryptographic binary tasks, then attributes most of Frontkick’s advantage to a prompt that listed installed Python libraries rather than to its architecture. It is a small evaluation write-up with per-run results, not a released tool or a general benchmark finding.","description_zh":"Matthieu Breuil 在 Synacktiv 发表的文章讲解了调用预定义工具与执行生成代码两类智能体设计，并介绍在 Binary Ninja 内运行生成的 Python 代码的 CodeAct 智能体 Frontkick。文章在 CREBench 的两个密码二进制任务上将 Frontkick 与开源插件 Rikugan 对比，随后指出 Frontkick 的优势主要来自提示词中列出已安装 Python 库的做法，而非其架构本身。这是一篇附逐次运行结果的小规模评估文章，不是已发布的工具，也不是普遍性的基准结论。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-19"},{"id":"opendmcufirm-wii-u-dmcu-firmware-case","name":"OpenDMCUFirm: a reimplemented Wii U DMCU display firmware","name_zh":"OpenDMCUFirm：重新实现的 Wii U DMCU 显示固件","url":"https://github.com/GaryOderNichts/OpenDMCUFirm","evidence_url":"https://github.com/GaryOderNichts/OpenDMCUFirm/blob/9e6747f71cb91f2c182869b4df1091f6d5d8218d/README.md","description_en":"Reimplements in C the firmware of the Wii U’s DMCU, the M68HC11-compatible display microcontroller in its AMD graphics controller, which in Wii mode reads the Video Interface state and configures display output, deinterlacing, scaling and overscan. The README says the work is based on reverse engineering of the original firmware but is not a byte-for-byte matching decompilation, and calls it a work in progress. The built image replaces the stock firmware in Wii mode when loaded through the evWii plugin.","description_zh":"用 C 语言重新实现 Wii U 的 DMCU 固件。DMCU 是其 AMD 图形控制器中兼容 M68HC11 的显示微控制器，在 Wii 模式下读取视频接口（VI）状态，并配置显示输出、去隔行、缩放与过扫描。README 称这项工作基于对原固件的逆向工程，但并非逐字节一致的反编译，并说明项目仍在开发中。构建出的镜像经 evWii 插件载入后，在 Wii 模式下替代原厂固件。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware"],"verified_at":"2026-10-19"},{"id":"cod4-rewrite-reconstruction-case","name":"CoD4 Rewrite: Rust/Bevy reconstruction","name_zh":"CoD4 Rewrite：Rust/Bevy 游戏重建","url":"https://github.com/Nilbong/COD4-Rewrite","evidence_url":"https://github.com/Nilbong/COD4-Rewrite/blob/bd03eb07f2b2ec84dd33946bfc2b8163fc49c480/README.md","description_en":"A Rust/Bevy reconstruction of Call of Duty 4 multiplayer systems, using assets from a local game installation. Source covers menus, local bots, movement and combat, and connects custom relay-based netplay to the game.","description_zh":"以 Rust/Bevy 重建《使命召唤4》的多人游戏系统，使用本地游戏安装中的素材。源码包含菜单、本地机器人、移动和战斗，并将自定义中继联机实现接入游戏。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"libd2-engine-core-reconstruction-case","name":"libd2: Diablo II 1.14d engine-core libraries","name_zh":"libd2：《暗黑破坏神II》1.14d 引擎组件库","url":"https://github.com/jaenster/libd2","evidence_url":"https://github.com/jaenster/libd2/blob/bc21bb924b9238def4907bd2b3f79e8041a5fc0a/README.md","description_en":"Zig libraries reconstructing Diablo II 1.14d seeded maps, item generation, saves, simulation rules and network formats. Selected components expose native and WebAssembly interfaces; verification notes distinguish retail map comparisons from weaker subsystem evidence.","description_zh":"以 Zig 库重建《暗黑破坏神II》1.14d 的种子地图、物品生成、存档、模拟规则和网络格式。部分组件提供原生与 WebAssembly 接口；验证说明区分了原游戏地图对照与其他子系统较弱的证据。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["binary","game","protocol"],"verified_at":"2026-10-19"},{"id":"underworld-exhumed-case","name":"Underworld Exhumed: reconstructing Ultima Underworld I and II","name_zh":"Underworld Exhumed：重建 Ultima Underworld I 与 II","url":"https://github.com/abedegno/underworld-exhumed","evidence_url":"https://github.com/abedegno/underworld-exhumed/blob/e5deadd6945b492636aadccc14f52caa908b4186/README.md","description_en":"Pairs reconstructed DOS sources with native ports of Ultima Underworld I and II. The upstream documents Exhume-based byte-matching builds, routine-level comparisons and recorded-session replay against DOS.","description_zh":"将 Ultima Underworld I 与 II 的 DOS 源码重建与原生移植结合。上游记录了基于 Exhume 的字节匹配构建、例程级比较及对照 DOS 的录制会话回放。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["binary","game"],"verified_at":"2026-10-20"},{"id":"linewars-ii-sdl-case","name":"LineWars II: a portable SDL3 reconstruction","name_zh":"LineWars II：可移植的 SDL3 重建版","url":"https://github.com/fredangstadt-lang/LineWarsII-SDL","evidence_url":"https://github.com/fredangstadt-lang/LineWarsII-SDL/blob/343bb50942a61e9d7fa1c1314cd1f03f8e7b12ac/README.md","description_en":"Provides an SDL3 backend for a portable-C reconstruction of the 1994 DOS game. Its build configuration links the reconstructed engine to video, input and audio adapters; the upstream documents differential gates against original machine code.","description_zh":"为 1994 年 DOS 游戏的可移植 C 重建提供 SDL3 后端。构建配置将重建引擎接到视频、输入与音频适配层，上游记录了对照原始机器码的差分测试关卡。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["binary","game"],"verified_at":"2026-10-20"},{"id":"bfm-decomp-case","name":"BFM-decomp: Brave Fencer Musashi matching decompilation","name_zh":"BFM-decomp：Brave Fencer Musashi 匹配反编译","url":"https://github.com/Druthulu/BFM-decomp","evidence_url":"https://github.com/Druthulu/BFM-decomp/blob/b6a28f96bac70af70573826f767a96cf212fd5e3/README.md","description_en":"Documents an agent-assisted reconstruction of the USA PlayStation game with a pinned compiler and whole-binary SHA-1 gates. The verification recipe covers the main executable, resident engine and disc-loaded code modules, with explicit library and assembly exceptions.","description_zh":"记录美版 PlayStation 游戏的智能体辅助重建，使用固定编译器及完整二进制 SHA-1 检查。验证规约覆盖主程序、常驻引擎及光盘加载代码模块，并明确列出库与汇编例外。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["binary","game"],"verified_at":"2026-10-20"},{"id":"logic-lens","name":"Logic-Lens","name_zh":"Logic-Lens：实验性 JavaScript 源码理解工具","url":"https://github.com/Abdoulrazack1/Logic-Lens","evidence_url":"https://github.com/Abdoulrazack1/Logic-Lens/blob/bb15aab345de64ef044a074d5e564fb087999032/README.md","description_en":"Experimental JavaScript source-analysis toolkit that classifies AST-token sequences into configured formula families after local training, and produces heuristic structure, call-graph and intent reports. It supports code-comprehension experiments; its predictions do not establish arbitrary program invariants or semantic equivalence.","description_zh":"实验性 JavaScript 源码分析工具：本地训练后将 AST token 序列归入预设公式类别，并生成启发式结构、调用图和意图报告。它可用于代码理解实验，但预测结果不证明任意程序的不变量或语义等价。","kind":"tool","category":"javascript-electron","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-20"},{"id":"android-security-toolkit","name":"Android Security Toolkit","name_zh":"Android Security Toolkit：APK 静态初步分析","url":"https://github.com/abhirampatel/android-security-toolkit","evidence_url":"https://github.com/abhirampatel/android-security-toolkit/blob/d9153acad34a062298b15244a0c38f0497680dbf/README.md","description_en":"Local Python APK triage tool that drives apktool and strings, checks manifest settings and source/native-library strings, and produces TXT/JSON findings for manual review. Its rules flag possible issues without proving exploitability or reconstructing application behavior.","description_zh":"本地 Python APK 初步分析工具，调用 apktool 与 strings 检查清单配置、源码及原生库字符串，输出 TXT／JSON 结果供人工核验。规则仅提示潜在问题，不证明可利用性，也不重建应用行为。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-20"},{"id":"littlebird-static-rebuild-case","name":"Littlebird.ai static home-page rebuild","name_zh":"Littlebird.ai 静态首页重建","url":"https://github.com/AkashNaickar/crdb-sample-frontend","evidence_url":"https://github.com/AkashNaickar/crdb-sample-frontend/blob/673dc8c8d93b4f8a13257604749b638adf146298/README.md","description_en":"Rebuilds the Littlebird.ai home page in plain HTML/CSS/JavaScript from captured markup and assets, with source-wired mobile navigation, FAQ toggles, scroll reveals and OS-dependent call-to-action presentation. It illustrates a bounded website reconstruction, with uncaptured routes and product functionality left outside the scope.","description_zh":"依据捕获的标记与资源，用原生 HTML/CSS/JavaScript 重建 Littlebird.ai 首页；源码实现移动导航、FAQ 展开、滚动显现及随操作系统变化的按钮展示。它是范围明确的网页重建案例，不涵盖未捕获路由或产品本身的功能。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["website"],"verified_at":"2026-10-20"},{"id":"akiselev-ilspy-cli","name":"ilspy-cli: targeted .NET decompilation for agents","name_zh":"ilspy-cli：面向 Agent 的定向 .NET 反编译","url":"https://github.com/akiselev/ilspy-cli","evidence_url":"https://github.com/akiselev/ilspy-cli/blob/089895f16a9031bb8391db13c2160def9a2e8b60/README.md","description_en":"Rust CLI that hosts an ILSpy C# bridge in-process for assembly, type and named-method decompilation, source search and structured JSON output. A separate PE-header detector identifies managed assemblies without loading the .NET runtime.","description_zh":"通过进程内托管的 ILSpy C# 桥接层，提供程序集、类型和指定方法的反编译、源码搜索及结构化 JSON 输出的 Rust CLI；独立的 PE 头检测器无需加载 .NET 运行时即可识别托管程序集。","kind":"tool","category":"dotnet","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-20"},{"id":"swe1r-assets-unity","name":"swe1r-assets-unity: Racer model-block editor sample","name_zh":"swe1r-assets-unity：Racer 模型块编辑器样例","url":"https://github.com/akopetsch/swe1r-assets-unity","evidence_url":"https://github.com/akopetsch/swe1r-assets-unity/blob/2fcae9138583da959882171095920ab9b802168b/README.md","description_en":"Work-in-progress Unity editor sample for importing and modifying Star Wars Episode I: Racer model blocks, then serializing them back through swe1r-assets. Its editor includes an unmodified import/export byte-comparison command; it is an asset-format workflow rather than a reimplementation of the game.","description_zh":"尚在开发中的 Unity 编辑器样例，可导入和修改《星球大战：极速飞车》的模型块，再通过 swe1r-assets 序列化回原格式。编辑器提供未修改导入／导出结果的字节比较命令；其范围是资产格式工作流，而非完整游戏重实现。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["game"],"verified_at":"2026-10-20"},{"id":"react-decode","name":"React-Decode","name_zh":"React-Decode","url":"https://github.com/alexandra-seredkina/React-Decode","evidence_url":"https://github.com/alexandra-seredkina/React-Decode/blob/80e8bda2912b7e3f9e01bc3a0034a61ea488b14a/README.md","description_en":"Static-analysis CLI for compiled React JavaScript that produces readable bundle output and inferred API-request, route and application-constant reports. It can extract embedded source-map contents when available.","description_zh":"面向已构建 React JavaScript 的静态分析 CLI，可输出更易读的代码，以及推断的 API 请求、路由和应用常量报告；存在 source map 内嵌源码时可将其提取。","kind":"tool","category":"javascript-electron","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-20"},{"id":"wasmlens","name":"WasmLens: exploratory WebAssembly inspection","name_zh":"WasmLens：探索性 WebAssembly 检查","url":"https://github.com/alexandrmotologa/wasmlens","evidence_url":"https://github.com/alexandrmotologa/wasmlens/blob/2351cccea90f812053b30d1ad14816d3c664a4f7/README.md","description_en":"Python CLI with static paths for inspecting WebAssembly sections and function signatures, producing WAT-style instruction listings, and reconstructing limited C-like pseudocode. These are exploratory analysis aids for supported modules, not recovered original source or a complete WebAssembly runtime.","description_zh":"提供 WebAssembly 区段与函数签名检查、WAT 风格指令列表和有限 C 风格伪代码重建的 Python CLI。所收录的是面向受支持模块的探索性静态分析路径，不代表恢复原始源码或实现完整 WebAssembly 运行时。","kind":"tool","category":"webassembly","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-20"},{"id":"submitgame-awesome-decomp-games","name":"Awesome Decomp Games","name_zh":"Awesome Decomp Games：附评分、每日刷新的游戏重建项目目录","url":"https://github.com/SubmitGame/awesome-decomp-games","evidence_url":"https://github.com/SubmitGame/awesome-decomp-games/blob/02727e90fe10c7b55fad3fdd4bd671c55e1fe587/README.md","description_en":"A generated, rated index of public game reconstruction projects: decompilations, disassemblies, static recompilations, source ports, engine remakes and browser ports. A daily job merges several upstream lists and registries with GitHub and decomp.dev metadata, drops dead links and rebuilds the README and website from data files. Useful for discovery; its scores are automated heuristics, not reviews.","description_zh":"自动生成并附评分的公开游戏重建项目索引，涵盖反编译、反汇编、静态重编译、源码移植、引擎重制及浏览器移植。每日任务合并多个上游目录与登记站点，结合 GitHub 和 decomp.dev 元数据，剔除失效链接，再由数据文件重建 README 和网站。适合用来发现项目；其评分是自动启发式结果，并非人工审阅。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["game"],"verified_at":"2026-10-18"},{"id":"snowboardkids-matching-decomp-case","name":"Snowboard Kids: an agent-assisted N64 matching decompilation","name_zh":"Snowboard Kids：智能体辅助的 N64 匹配反编译","url":"https://github.com/cdlewis/snowboardkids-decomp","evidence_url":"https://github.com/cdlewis/snowboardkids-decomp/blob/0a398d907aae32ae45e6ba0ca688049e5c60dab8/README.md","description_en":"A matching decompilation of the original Nintendo 64 Snowboard Kids that rebuilds SHA1-identical North American and Japanese ROMs from a user-supplied ROM. The author’s 84-day post-mortem describes coding agents run through his Nigel harness alongside m2c, the permuter and a shared file of compiler learnings, and declines to credit LLMs alone for the speed-up. It is a separate project from the Snowboard Kids 2 decompilation.","description_zh":"原版 Nintendo 64 游戏 Snowboard Kids 的匹配反编译，利用使用者自备的 ROM 重新构建 SHA1 一致的北美版与日版 ROM。作者在 84 天复盘文章中介绍了通过自建的 Nigel 工具调度编程智能体，并结合 m2c、permuter 与共享编译器经验文件的流程，同时表示不应把提速完全归功于大模型。它与 Snowboard Kids 2 反编译是不同的项目。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"reflecticon-224-lexicon-emulation-case","name":"reflecticon-224: running Lexicon 224 reverb firmware on emulated hardware","name_zh":"reflecticon-224：在模拟硬件上运行 Lexicon 224 混响器固件","url":"https://github.com/joelanders/reflecticon-224","evidence_url":"https://github.com/joelanders/reflecticon-224/blob/37fde47f6cf94d4f4f96f3c233382e2c43a70354/Makefile","description_en":"Emulates the Lexicon 224, 224X and 224XL digital reverbs so that their own firmware runs in a browser page or a JUCE plugin. The repository layers KiCad schematics, gate-level and board-level Verilog models, an 8080-hosted C++ emulator and analog input/output models, and checks faster layers against slower ones using user-supplied ROMs. It is a work-in-progress hardware-and-firmware emulation whose documentation is still pending, not recovered algorithm source.","description_zh":"模拟 Lexicon 224、224X 与 224XL 数字混响器，使其原厂固件能在浏览器页面或 JUCE 插件中运行。仓库分层包含 KiCad 原理图、门级与板级 Verilog 模型、以 8080 为主机的 C++ 模拟器及模拟输入／输出模型，并用使用者自备的 ROM 以较慢层级校验较快层级。这是仍在开发、文档尚未完成的硬件与固件模拟，并非恢复出的算法源码。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware"],"verified_at":"2026-10-18"},{"id":"sa3-marun-ai-decomp-case","name":"Sonic Advance 3: an AI-assisted match of one enemy module","name_zh":"Sonic Advance 3：AI 辅助匹配单个敌人模块","url":"https://gambiconf.substack.com/p/development-journey-on-game-decompilation","evidence_url":"https://gambiconf.substack.com/p/development-journey-on-game-decompilation","description_en":"Macabeus’s dated study describes prompting Claude Sonnet 3.5 and DeepSeek R1 with assembly, similar decompiled functions and structs to write matching C for Marun, one enemy module of the community Sonic Advance 3 GBA decompilation. The resulting pull request replaced that module’s assembly and was merged; the author calls the setting unusually AI-friendly, and the project now bars LLM-origin contributions.","description_zh":"Macabeus 在注明日期的研究文章中，介绍了如何把汇编、相似的已反编译函数和结构体放进提示词，让 Claude Sonnet 3.5 与 DeepSeek R1 为社区 Sonic Advance 3 GBA 反编译项目中的敌人模块 Marun 编写匹配的 C 代码。由此产生的拉取请求替换了该模块的汇编并已合并；作者认为这一场景对 AI 格外友好，而该项目现已不接受源自大模型的贡献。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-18"},{"id":"ix500-scan-scansnap-wifi-case","name":"iX500 Scan: a macOS client for the reverse-engineered ScanSnap Wi-Fi protocol","name_zh":"iX500 Scan：基于逆向 ScanSnap Wi-Fi 协议的 macOS 客户端","url":"https://github.com/jonaswagnr/ix500-scan","evidence_url":"https://github.com/jonaswagnr/ix500-scan/blob/24a5f7c89fc6d0c35a4d83d0879348ced153844a/README.md","description_en":"Replaces ScanSnap Home for a Fujitsu/PFU ScanSnap iX500 on macOS with a SwiftUI app and Python service that scan over Wi-Fi through the community-reverse-engineered VENS protocol, or over USB through SANE, and produce searchable PDFs. It vendors bramheerink’s GPL-2.0 driver, extends it for macOS, and documents further handshake and hardware-status fields, including the scan-button bit. Results are author-reported; the repository publishes no tests or captures.","description_zh":"在 macOS 上以 SwiftUI 应用和 Python 后台服务替代 ScanSnap Home，为富士通／PFU ScanSnap iX500 提供扫描：Wi-Fi 经由社区逆向的 VENS 协议，USB 经由 SANE，输出可搜索的 PDF。项目内置 bramheerink 的 GPL-2.0 驱动并为 macOS 做了扩展，还记录了更多握手字段和硬件状态字段，包括扫描键状态位。结果均为作者报告，仓库未公开测试或抓包记录。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-19"},{"id":"roborock-local-server-cloud-case","name":"Roborock Local Server: a self-hosted stand-in for Roborock’s vacuum cloud","name_zh":"Roborock Local Server：自托管替代 Roborock 扫地机云端","url":"https://github.com/Python-roborock/local_roborock_server","evidence_url":"https://github.com/Python-roborock/local_roborock_server/blob/c3b32845c63a4bc9d1fc9dfb205b86a33ea06bf3/docs/technical_writeup.md","description_en":"Runs a local HTTPS and MQTT stack in place of Roborock’s cloud, so supported vacuums keep live maps and controls on an isolated network without rooting or hardware changes. The maintainer’s technical write-up recounts earlier app and traffic analysis and a later investigation in which Claude Code and Codex worked against an emulated firmware environment. Compatibility is reported per model by the project and its users.","description_zh":"运行一套本地 HTTPS 与 MQTT 服务来替代 Roborock 云端，使受支持的扫地机在隔离网络中无需 root 或改装硬件即可保留实时地图与控制。维护者的技术说明回顾了早期的应用与流量分析，以及后来借助 Claude Code 和 Codex、在模拟固件环境中开展的调查。兼容性由项目及其用户按型号报告。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"wristbeam-garmin-watch-protocol-case","name":"WristBeam: reconstructing Garmin’s watch protocol for a Mac companion","name_zh":"WristBeam：为 Mac 配套应用重建佳明手表协议","url":"https://github.com/kongdayan/wristbeam","evidence_url":"https://github.com/kongdayan/wristbeam/blob/712f577ac55b476ff91e0b44565934ac0d4cad4d/README.md","description_en":"Implements a Garmin watch companion as a native macOS menu-bar app that pairs over Bluetooth, receives live health notifications and original FIT files, and can upload them to Garmin Connect. Source comments attribute its GFDI framing, handshake, file-transfer and status fields to analysis of a supplied Garmin Android package, cross-checked against community implementations such as Gadgetbridge. Device verification covers one watch model, and the opt-in MCP and HTTP interfaces expose only locally cached data.","description_zh":"以原生 macOS 菜单栏应用实现佳明手表的配套客户端：通过蓝牙配对，接收实时健康通知和原始 FIT 文件，并可上传至 Garmin Connect。源码注释称，GFDI 分帧、握手、文件传输和状态字段依据对一个自备佳明 Android 安装包的分析实现，并与 Gadgetbridge 等社区实现相互核对。设备验证仅涵盖一款手表；可选启用的 MCP 与 HTTP 接口只提供本地缓存的数据。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-19"},{"id":"abc-decompiler","name":"abc-decompiler","name_zh":"abc-decompiler 鸿蒙方舟字节码反编译器","url":"https://github.com/ohos-decompiler/abc-decompiler","evidence_url":"https://github.com/ohos-decompiler/abc-decompiler/blob/427c4cd9f80496236a4a3548d29a6b8aaf74b8e0/README.md","description_en":"Decompiler for HarmonyOS Ark bytecode (.abc), the format HarmonyOS app packages carry in modules.abc, built by adapting the jadx decompiler and reading files through a patched copy of the abcde library. Because much of Ark bytecode is semantically close to DEX, it reuses jadx's GUI, IR and passes: an .abc file dropped into the jadx-based window is shown as decompiled code. The README reports that all 227 usable instructions of the 282 Ark opcodes are implemented, most special instructions as pseudo-functions.","description_zh":"面向鸿蒙方舟字节码（.abc）的反编译工具；HarmonyOS 应用包中的 modules.abc 即为此格式。它通过改造 jadx 反编译器实现，并借助打过补丁的 abcde 库读取文件。由于方舟字节码有很大一部分与 DEX 字节码语义相近，它沿用了 jadx 的图形界面、中间表示和处理流程：把 .abc 文件拖入基于 jadx 的窗口即可查看反编译代码。README 称 282 条方舟字节码中可用的 227 条指令均已实现，其中大部分特殊指令以伪函数形式实现。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"pypush-apns-protocol-case","name":"pypush: a Python client for Apple’s push protocol","name_zh":"pypush：Apple 推送协议的 Python 客户端","url":"https://github.com/JJTech0130/pypush","evidence_url":"https://github.com/JJTech0130/pypush/blob/71aa2e4442061596f75e6b02dfad613330127b5b/README.md","description_en":"Reimplements the client side of Apple’s private Apple Push Notification service (APNs) protocol in platform-independent Python: it activates as an Apple device, connects to the APNs courier, mints app-scoped tokens and receives push notifications. The project began as the author’s proof of concept for iMessage reverse engineering, but the current rewrite has removed IDS and iMessage support for now. It uses Apple’s services outside Apple’s official clients.","description_zh":"以与平台无关的 Python 重新实现 Apple 私有推送通知服务（APNs）协议的客户端：它以 Apple 设备身份完成激活，连接 APNs courier 服务器，生成限定于应用的令牌并接收推送通知。项目最初是作者 iMessage 逆向研究的概念验证，但当前重写版暂时移除了 IDS 和 iMessage 支持。它在 Apple 官方客户端之外使用 Apple 的服务。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"luajit-decompiler-v2","name":"LuaJIT Decompiler v2","name_zh":"LuaJIT Decompiler v2 字节码反编译器","url":"https://github.com/marsinator358/luajit-decompiler-v2","evidence_url":"https://github.com/marsinator358/luajit-decompiler-v2/blob/6a8a0cec48fdf175dddaca5d3fbfe3aa59b5550a/README.md","description_en":"Decompiles LuaJIT bytecode files back into Lua source, written as a replacement for the older Python LuaJIT decompiler. The README reports full support for gotos and for stripped bytecode, including reconstructed locals and upvalues, and its boolean-expression recovery follows a published decompilation algorithm. It processes single files or whole folders and writes .lua output.","description_zh":"将 LuaJIT 字节码文件反编译回 Lua 源码，作为旧版 Python LuaJIT 反编译器的替代品编写。README 称它完整支持 goto 和去除调试信息的字节码，包括还原局部变量和上值；其布尔表达式恢复基于一篇已发表的反编译算法论文。它可处理单个文件或整个文件夹，输出 .lua 文件。","kind":"tool","category":"game-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"flare-learning-hub","name":"FLARE Learning Hub","name_zh":"FLARE 学习中心","url":"https://github.com/mandiant/flare-learning-hub","evidence_url":"https://github.com/mandiant/flare-learning-hub/blob/ebd4e3a7dd71c0082db2748aba13e300447cd2e0/README.md","description_en":"Free English reverse-engineering and malware-analysis modules from Mandiant's FLARE team, published as Google Docs, with lab binaries, IDA databases and scripts kept in this repository. The Malware Analysis Crash Course builds from x86 basics to reading Windows API use through assembly-patching exercises and labs with worked solutions; the other modules introduce WinDbg Time Travel Debugging for malware triage and provide a reference to how Go 1.24 programs look in Windows executables.","description_zh":"Mandiant FLARE 团队发布的免费英文逆向工程与恶意软件分析课程模块，正文以 Google Docs 形式发布，实验用二进制文件、IDA 数据库和脚本存放在本仓库中。其中的恶意软件分析速成课从 x86 基础讲到解读 Windows API 调用，穿插汇编修改练习和附详细解答的实验；其余模块介绍如何用 WinDbg 时间旅行调试（Time Travel Debugging）分诊恶意软件，并提供一份说明 Go 1.24 程序在 Windows 可执行文件中呈现方式的参考手册。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-19"},{"id":"pokewalker-matching-decomp-case","name":"pw: a matching decompilation of the Pokéwalker firmware","name_zh":"pw：Pokéwalker 固件的一致性反编译重建","url":"https://github.com/lumirth/pw","evidence_url":"https://github.com/lumirth/pw/blob/6dc7bc09950078fa3fe0dffa4dae34e9549a99da/README.md","description_en":"Reconstructs as C the firmware of the Pokéwalker, the pedometer accessory for Pokémon HeartGold and SoulSilver, for its Renesas H8/38606 microcontroller. With artwork from the user’s retail firmware image and a supported Renesas compiler suite, the README reports a byte-identical rebuild of the 48 KiB image; without that image, original placeholder art gives a non-matching reference build. The author describes disassembling and decompiling the retail binary, the HeartGold/SoulSilver ROMs and the candidate compilers, alongside published hardware research.","description_zh":"以 C 语言重建 Pokéwalker 的固件。Pokéwalker 是《宝可梦 心金／魂银》配套的计步器配件，采用 Renesas H8/38606 微控制器。README 报告，使用从使用者自备的零售固件镜像中取得的美术素材及受支持的 Renesas 编译器套件，可重新构建出逐字节相同的 48 KiB 镜像；没有该镜像时，项目原创的占位美术只能生成不一致的参考构建。作者称其结合已公开的硬件研究，对零售二进制文件、心金／魂银 ROM 及候选编译器进行了反汇编和反编译。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware","game"],"verified_at":"2026-10-19"},{"id":"slicer","name":"slicer","name_zh":"slicer 浏览器端 Java 逆向工具","url":"https://github.com/katana-project/slicer","evidence_url":"https://github.com/katana-project/slicer/blob/1881aae26eed58d12885a21305554aae2cb4ccc5/README.md","description_en":"Browser-based Java reverse-engineering tool that loads class files and JAR/ZIP archives and disassembles or decompiles them with Vineflower (the default), CFR, Procyon or JASM, compiled to run in the browser, next to its own bytecode disassembler. It draws inheritance and interface graphs and per-method control-flow graphs, searches constant-pool entries, instructions and member declarations or usages, applies Tiny, SRG/TSRG/CSRG or ProGuard mappings, and offers generic transformers that strip or normalize bytecode attributes so decompilers cope better with obfuscation. A JavaScript scripting API can add disassemblers and manipulate the workspace; the README itself recommends Recaf for serious reverse engineering.","description_zh":"基于浏览器的 Java 逆向工程工具：可加载 class 文件和 JAR/ZIP 归档，使用编译为可在浏览器中运行的 Vineflower（默认）、CFR、Procyon 或 JASM 进行反汇编或反编译，另有自带的字节码反汇编器。它能绘制继承与接口实现关系图以及单个方法的控制流图，搜索常量池条目、指令以及成员声明或使用位置，可应用 Tiny、SRG/TSRG/CSRG 或 ProGuard 映射，还提供剥离或规范化字节码属性的通用转换器，帮助反编译器更好地应对混淆。JavaScript 脚本 API 可添加反汇编器并操作工作区；README 自己也建议，若要进行严肃的逆向工程，应使用 Recaf。","kind":"tool","category":"jvm","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"steamkit","name":"SteamKit","name_zh":"SteamKit Steam 网络协议库","url":"https://github.com/SteamRE/SteamKit","evidence_url":"https://github.com/SteamRE/SteamKit/blob/49387aec55c24104946af7a7b160148358e538b4/readme.md","description_en":".NET library that implements the client side of Valve’s Steam network protocol: connection-manager sessions, authentication, friends, unified service and Game Coordinator messages, Web API calls and CDN depot downloads. Message classes are generated from Steam protobufs tracked in a submodule and from the project’s own SteamLanguage definitions. Its Resources tree adds protocol-research tools: NetHook2, a Windows DLL that hooks a running Steam client to dump the network messages it exchanges, NetHookAnalyzer2 for viewing those dumps, and ProtobufDumper for recovering protobuf definitions from executables.","description_zh":"实现 Valve Steam 网络协议客户端的 .NET 库，涵盖连接管理服务器会话、身份验证、好友、统一服务消息与 Game Coordinator 消息、Web API 调用以及 CDN depot 下载。消息类由子模块跟踪的 Steam protobuf 和项目自有的 SteamLanguage 定义生成。其 Resources 目录还提供协议研究工具：NetHook2 是挂钩正在运行的 Steam 客户端、转储其收发网络消息的 Windows DLL，NetHookAnalyzer2 用于查看这些转储，ProtobufDumper 则从可执行文件中恢复 protobuf 定义。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["game","protocol"],"verified_at":"2026-10-19"},{"id":"nintendo-switch-joycon-re-notes","name":"Nintendo Switch Reverse Engineering","name_zh":"Nintendo Switch 逆向工程笔记","url":"https://github.com/dekuNukem/Nintendo_Switch_Reverse_Engineering","evidence_url":"https://github.com/dekuNukem/Nintendo_Switch_Reverse_Engineering/blob/b354f21ae81f7b0d1d060b2b61e66ad0d9bc1756/README.md","description_en":"Notes begun by dekuNukem in 2017 and extended by contributors on how the Joy-Con, Pro Controller and parts of the Switch console and dock work, worked out from teardowns, logic-analyzer captures and packet logs. Markdown files cover the Joy-Con board test points and rail-connector pinout, the wired serial handshake with its CRC-8 checksum, Bluetooth HID input and output reports with 32 documented subcommands, the USB HID commands of the Pro Controller and charging grip, the SPI flash memory map with stick and 6-axis calibration, IMU conversion formulas and rumble encoding tables. The repository also keeps STM32 test firmware that plays the console or a Joy-Con on the rail, a Wireshark dissector for the Bluetooth traffic, and the captures behind the notes.","description_zh":"由 dekuNukem 于 2017 年发起、众多贡献者陆续补充的笔记，记录 Joy-Con、Pro 手柄以及 Switch 主机与底座部分硬件的工作方式，依据来自拆机、逻辑分析仪抓取和数据包记录。各 Markdown 文件涵盖 Joy-Con 电路板测试点与滑轨接口引脚定义、带 CRC-8 校验的有线串口握手、蓝牙 HID 输入与输出报告及其中记录的 32 个子命令、Pro 手柄与充电握把的 USB HID 命令、含摇杆与六轴校准数据的 SPI 闪存布局、IMU 换算公式以及振动编码表。仓库还保存了在滑轨接口上扮演主机或 Joy-Con 的 STM32 测试固件、用于解析蓝牙流量的 Wireshark 解析器，以及笔记所依据的抓取数据。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["firmware","protocol"],"verified_at":"2026-10-19"},{"id":"android-app-re-101","name":"Android App Reverse Engineering 101","name_zh":"Android 应用逆向工程 101","url":"https://www.ragingrock.com/AndroidAppRE/","evidence_url":"https://github.com/maddiestone/AndroidAppRE/blob/17f9eeb5cb190d31cd90e9b9c7967978ea7a9d10/index.md","description_en":"Maddie Stone's free English workshop introducing static reverse engineering of Android apps, published as GitHub Pages. Its chapters cover app components and entry points, Dalvik bytecode and smali, decompiling DEX with jadx, finding and reading JNI native libraries in Ghidra, and string deobfuscation. Seven exercises with written solutions apply this to triaging malware samples and spotting command-execution flaws in pre-installed apps.","description_zh":"Maddie Stone 编写的免费英文工作坊，以 GitHub Pages 发布，入门讲解 Android 应用的静态逆向工程。各章涵盖应用组件与入口点、Dalvik 字节码与 smali、用 jadx 反编译 DEX、在 Ghidra 中定位并阅读 JNI 原生库，以及字符串去混淆。七个附书面解答的练习将这些方法用于分诊恶意软件样本，以及找出预装应用中的命令执行缺陷。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["app","binary"],"verified_at":"2026-10-19"},{"id":"wii-menu-ipl-decomp-case","name":"wii-ipl: a decompilation of the Wii Menu (System Menu 4.3)","name_zh":"wii-ipl：Wii Menu（System Menu 4.3）的反编译重建","url":"https://github.com/koopthekoopa/wii-ipl","evidence_url":"https://github.com/koopthekoopa/wii-ipl/blob/f4c09f4001c5a0b9af734ad1e3f80a54c5e5723c/README.md","description_en":"A work-in-progress decompilation of the Wii Menu, the console’s System Menu (IPL), targeting version 4.3 in its USA, European, Japanese and Korean builds. It recovers the menu’s own code together with the Revolution SDK, NintendoWare (NW4R), EGG and middleware libraries linked into it, matched unit by unit against the original executable with decomp-toolkit and objdiff. The repository holds no assets or assembly; a build needs the user’s own Wii Menu WAD and yields only main.dol.","description_zh":"Wii Menu（即主机的 System Menu，IPL）的反编译重建，仍在进行中，针对 4.3 版的美、欧、日、韩四个版本。项目重建菜单自身的代码，以及链接进其中的 Revolution SDK、NintendoWare（NW4R）、EGG 和中间件库，并借助 decomp-toolkit 与 objdiff 逐个编译单元与原可执行文件比对。仓库不含任何素材或汇编；构建需要使用者自己的 Wii Menu WAD，且只生成 main.dol。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware","game"],"verified_at":"2026-10-19"},{"id":"usque-warp-masque-client-case","name":"usque: an open reimplementation of Cloudflare WARP’s MASQUE mode","name_zh":"usque：Cloudflare WARP MASQUE 模式的开源再实现","url":"https://github.com/Diniboy1123/usque","evidence_url":"https://github.com/Diniboy1123/usque/blob/6aa03fc97d12848dce34eedbd187fb1077b5d1ea/README.md","description_en":"Reimplements the MASQUE mode of Cloudflare’s WARP client in Go, tunnelling IP traffic over QUIC/HTTP/3 with Connect-IP (RFC 9484) and exposing it as a native TUN device, SOCKS5 or HTTP proxies, TCP-only L4 proxies or port forwarding. RESEARCH.md describes how the author worked out device enrollment, TLS client authentication and Cloudflare’s non-standard cf-connect-ip variant by analyzing the official Android client with Frida, mitmproxy, JADX, IDA Free and Wireshark. It registers with and connects to Cloudflare’s service outside the official client.","description_zh":"用 Go 重新实现 Cloudflare WARP 客户端的 MASQUE 模式：通过基于 QUIC/HTTP/3 的 Connect-IP（RFC 9484）隧道传输 IP 流量，并以原生 TUN 设备、SOCKS5 或 HTTP 代理、仅 TCP 的 L4 代理或端口转发等形式提供。RESEARCH.md 记录了作者如何借助 Frida、mitmproxy、JADX、IDA Free 和 Wireshark 分析官方 Android 客户端，弄清设备注册、TLS 客户端认证以及 Cloudflare 非标准的 cf-connect-ip 变体。它在官方客户端之外向 Cloudflare 服务注册并建立连接。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app","protocol"],"verified_at":"2026-10-19"},{"id":"awesome-unofficial-pc-ports","name":"awesome-unofficial-pc-ports","name_zh":"awesome-unofficial-pc-ports 非官方 PC 移植清单","url":"https://github.com/Sebastrion/awesome-unofficial-pc-ports","evidence_url":"https://github.com/Sebastrion/awesome-unofficial-pc-ports/blob/faef1ab57fa50446ca156bcbf085466dce9a9229/README.md","description_en":"A single-README guide to unofficial PC ports of console games built from decompilations or recompilations and chosen for easy installation by players. Its 76 game entries, grouped under Nintendo, PlayStation, Xbox, SEGA, Indie and J2ME, each recommend a port with short setup notes and often link the underlying decompilation and alternative ports; a Utilities section adds two recompilation launchers.","description_zh":"以单个 README 维护的非官方 PC 移植指南，收录基于反编译或重编译、且便于玩家安装的主机游戏移植。76 个游戏条目按 Nintendo、PlayStation、Xbox、SEGA、独立游戏和 J2ME 分组，每项推荐一个移植版并附简短安装说明，常同时链接所依据的反编译项目和其他移植版；“实用工具”部分另列两个重编译启动器。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["game"],"verified_at":"2026-10-19"},{"id":"re-ios-apps-course","name":"Reverse Engineering iOS Applications","name_zh":"iOS 应用逆向工程课程","url":"https://github.com/ivRodriguezCA/RE-iOS-Apps","evidence_url":"https://github.com/ivRodriguezCA/RE-iOS-Apps/blob/183873adea6b07f951e1b49565000e2c83448429/README.md","description_en":"Ivan Rodriguez's free English course (version 1.1) on reverse engineering iOS applications, aimed at beginners in iOS app security. Five Markdown modules cover setting up a jailbroken test device, decrypting App Store apps for analysis, static analysis of an IPA's files, frameworks, Objective-C classes and ARM binary in Hopper or Ghidra, runtime analysis with Cycript and Frida, and binary patching in Hopper. Exercises use CoinZa, a deliberately insecure Objective-C app the author built from vulnerability classes he reports finding in production App Store apps.","description_zh":"Ivan Rodriguez 编写的免费英文课程（1.1 版），讲解 iOS 应用逆向工程，面向 iOS 应用安全初学者。五个 Markdown 模块依次介绍越狱测试设备的环境配置、为分析而解密 App Store 应用、对 IPA 中的文件、框架、Objective-C 类和 ARM 二进制进行静态分析（使用 Hopper 或 Ghidra）、用 Cycript 和 Frida 做运行时分析，以及在 Hopper 中修补二进制。练习使用 CoinZa：作者根据其所述在 App Store 正式应用中发现的漏洞类型，专门编写的一个故意不安全的 Objective-C 应用。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["app","binary"],"verified_at":"2026-10-19"},{"id":"webamp-winamp-reimplementation-case","name":"Webamp: a browser reimplementation of Winamp 2","name_zh":"Webamp：在浏览器中重新实现 Winamp 2","url":"https://github.com/captbaritone/webamp","evidence_url":"https://github.com/captbaritone/webamp/blob/f01369fc2d7aaa9366a3ba9ab0ad1db4b6417a40/README.md","description_en":"Reimplements Winamp 2's main, equalizer and playlist windows in HTML5 and JavaScript, with Web Audio playback, volume, balance and equalizer, and renders original classic .wsz skins, which its documentation says match Winamp 2.9 pixel for pixel; Milkdrop presets run through the Butterchurn WebGL port. It ships as the webamp npm module for embedding in web pages, and the same monorepo runs webamp.org and the skins.webamp.org skin museum. Its webamp-modern prototype targets Winamp 3/5 modern skins with an interpreter for MAKI skin scripts, whose undocumented bytecode format the author reverse engineered and documents in the repository.","description_zh":"用 HTML5 和 JavaScript 重新实现 Winamp 2 的主窗口、均衡器和播放列表窗口，借助 Web Audio 实现播放、音量、声道平衡和均衡器，并渲染原有的经典 .wsz 皮肤，其文档称渲染效果与 Winamp 2.9 逐像素一致；Milkdrop 预设通过 Butterchurn 的 WebGL 移植版运行。它以 webamp npm 模块的形式发布，可嵌入网页，同一 monorepo 还运行着 webamp.org 和 skins.webamp.org 皮肤博物馆。其中的 webamp-modern 原型面向 Winamp 3/5 的现代皮肤，内含 MAKI 皮肤脚本解释器；MAKI 字节码格式原本没有公开文档，作者对其进行了逆向分析，并在仓库中写成文档。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["app"],"verified_at":"2026-10-19"},{"id":"nforest-awesome-decompilation","name":"awesome-decompilation","name_zh":"awesome-decompilation 反编译阅读清单","url":"https://github.com/nforest/awesome-decompilation","evidence_url":"https://github.com/nforest/awesome-decompilation/blob/8731870b99d1816ed6979ab5745ae42b4bf73018/README.md","description_en":"A short, link-only reading list on decompiling machine code, last updated in 2023. Its 45 links cover foundational theses, compiler and program-analysis books, decompiler products and projects, pipeline topics from intermediate representations to type, control-flow and identifier recovery, early neural-decompilation papers and binary-to-source matching.","description_zh":"篇幅不长、只列链接的机器码反编译阅读清单，最近一次更新在 2023 年。45 个链接涵盖奠基性学位论文、编译器与程序分析书籍、反编译器产品和项目，从中间表示到类型、控制流和标识符恢复的反编译流程主题，早期神经网络反编译论文，以及二进制与源码匹配。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-19"},{"id":"tiny-dec","name":"tiny-dec","name_zh":"tiny-dec 教学用反编译器","url":"https://github.com/ZhangZhuoSJTU/tiny-dec","evidence_url":"https://github.com/ZhangZhuoSJTU/tiny-dec/blob/4f5f1e00a147ba1c1471d2e01f9dd4beb5a693d6/README.md","description_en":"Zhuo Zhang's small educational decompiler for 32-bit RISC-V (RV32I) ELF files, written in Python to teach how decompilation works rather than to compete with production decompilers. Its 19 deliberately separate stages run from ELF loading, decoding and p-code lifting through SSA, stack, type, variable and range recovery to control-flow structuring and C output, and the CLI can stop at any stage to print that stage's intermediate result. The README also offers a Claude Code plugin whose AI tutor walks learners through the stages with quizzes and exercises.","description_zh":"Zhuo Zhang 用 Python 编写的小型教学用反编译器，面向 32 位 RISC-V（RV32I）ELF 文件，目的是讲清反编译的工作原理，而非与生产级反编译器竞争。它把流程刻意拆成 19 个独立阶段：从 ELF 加载、指令解码和 p-code 提升，经过 SSA、栈、类型、变量和取值范围恢复，再到控制流结构化和 C 代码输出；命令行可在任一阶段停下，打印该阶段的中间结果。README 还提供一个 Claude Code 插件，其中的 AI 导师会结合小测和练习，带学习者逐个阶段学习。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-19"},{"id":"sead-nintendo-library-decomp-case","name":"sead: a decompilation of Nintendo’s first-party C++ standard library","name_zh":"sead：Nintendo 第一方 C++ 标准库的反编译重建","url":"https://github.com/open-ead/sead","evidence_url":"https://github.com/open-ead/sead/blob/f4178a21e21235830357dc27c26a2c29956972ed/README.md","description_en":"Decompiles sead, the C++ standard library that Nintendo statically links into its first-party games, covering containers, heaps, strings, math, file devices, threads, the game framework and graphics. Compile-time presets target the recent versions used by Breath of the Wild, Super Mario Odyssey, Splatoon 3, Tears of the Kingdom and Super Mario Bros. Wonder, and game decompilations such as Breath of the Wild pull it in as a submodule. Names come from debugging symbols and assertions in retail titles, and the README warns that many inlined and templated names are guesses.","description_zh":"反编译 sead，即 Nintendo 静态链接进其第一方游戏的 C++ 标准库，涵盖容器、堆、字符串、数学、文件设备、线程、游戏框架和图形等模块。编译期预设针对《旷野之息》《超级马力欧 奥德赛》《斯普拉遁 3》《王国之泪》和《超级马力欧兄弟 惊奇》所用的较新版本，《旷野之息》等游戏反编译项目以子模块方式引入它。命名来自零售游戏中的调试符号和断言，README 也提醒许多内联与模板函数的名称只是猜测。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"teddycloud-toniebox-server-case","name":"TeddyCloud: a self-hosted replacement for the Toniebox cloud","name_zh":"TeddyCloud：可自托管的 Toniebox 云端替代服务器","url":"https://github.com/toniebox-reverse-engineering/teddycloud","evidence_url":"https://github.com/toniebox-reverse-engineering/teddycloud/blob/78c3b38e36f665d3a5fffe907f73a02725176377/README.md","description_en":"Reimplements the Boxine cloud services a Toniebox talks to as a self-hosted C server, so the box can fetch audio, settings and over-the-air content locally while the owner controls what reaches the manufacturer. It serves and caches tonie audio, converts other audio into the box’s TAF format, can pass requests through to the original cloud, and adds a web interface, MQTT and Home Assistant integration. Protobuf definitions in the repository describe the box’s freshness-check, RTNL log and TAF header messages.","description_zh":"以可自托管的 C 服务器重新实现 Toniebox 所连接的 Boxine 云服务，使盒子能在本地获取音频、设置和无线下发内容，同时由用户控制哪些数据发往厂商。它可提供并缓存 tonie 音频，把其他音频转换为盒子使用的 TAF 格式，可将请求透传到原云端，并提供网页界面、MQTT 及 Home Assistant 集成。仓库中的 protobuf 定义描述了盒子的 freshness-check、RTNL 日志和 TAF 头部报文。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware","protocol"],"verified_at":"2026-10-19"},{"id":"onethawt-re-reading-list","name":"Reverse Engineering Reading List","name_zh":"逆向工程阅读清单（onethawt）","url":"https://github.com/onethawt/reverseengineering-reading-list","evidence_url":"https://github.com/onethawt/reverseengineering-reading-list/blob/a1ee767b5cf8504c398763b2b6304c20507ef1e3/README.md","description_en":"A short reading list, compiled by One Thawt mostly in 2015–2016, of about 58 links to reverse-engineering tools, books, papers, talks and blog posts, kept in a README and a separate malware-analysis page. Sections run from disassemblers and debuggers, beginner talks and classic books through data-structure recovery papers, instruction-set references, iOS, Android and Windows material, unpacking, deobfuscation and protocol inference from network traces.","description_zh":"由 One Thawt 编写的简短阅读清单，主要成形于 2015–2016 年，在一个 README 和单独的恶意软件分析页面中收录约 58 个链接，涵盖逆向工程工具、书籍、论文、演讲和博客文章。各部分从反汇编器与调试器、入门讲座和经典书籍，到数据结构恢复论文、指令集参考资料、iOS、Android 与 Windows 相关资料、脱壳、反混淆，以及基于网络流量的协议推断。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-19"},{"id":"animal-forest-n64-decomp-case","name":"Animal Forest: an in-progress matching N64 decompilation","name_zh":"《动物之森》：进行中的 N64 一致性反编译","url":"https://github.com/zeldaret/af","evidence_url":"https://github.com/zeldaret/af/blob/4ddba04604ee7b4c4cfc0b64f8ee4d094bb385be/README.md","description_en":"Rebuilds the Japanese Nintendo 64 release of Animal Forest (Dōbutsu no Mori) from C code reverse-engineered from the ROM, combined with assets and assembly extracted from a user-supplied ROM. Default builds compare the uncompressed and recompressed ROMs with stored MD5 checksums. The README rules out use as a port base or for commercial purposes, and decomp.dev reported 18.52% of code matched at the reviewed commit.","description_zh":"将从 ROM 逆向得到的 C 代码与从使用者自备 ROM 中提取的素材和汇编结合，重建日版 Nintendo 64《动物之森》（どうぶつの森）。默认构建会用仓库保存的 MD5 校验未压缩与重新压缩的 ROM。README 明确该项目不作为移植基础，也不用于商业目的；decomp.dev 报告所审提交有 18.52% 的代码已匹配。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"remade-reimplementation-directory","name":"Remade","name_zh":"Remade 软件重新实现目录","url":"https://github.com/replicraft/remade","evidence_url":"https://github.com/replicraft/remade/blob/ea8119f01c2fab14ef9e0c23a7d348b0a86660ff/README.md","description_en":"The source repository of remade.wiki, a community-curated directory of open-source reimplementations of closed-source software, mostly creative, productivity and engineering applications. Each listing is a YAML record naming the original software, languages, platforms, license and self-reported status, compatibility and limitations, and the directory also tracks requests for software nobody has reimplemented yet.","description_zh":"remade.wiki 的源码仓库。remade.wiki 是由社区整理的目录，收录闭源软件的开源重新实现，以创意、办公和工程类应用为主。每个条目是一份 YAML 记录，注明被重现的原软件、编程语言、平台、许可证，以及自报的开发状态、兼容程度和局限；目录还收集尚无人重新实现的软件请求。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["app"],"verified_at":"2026-10-19"},{"id":"pixmob-ir-protocol-case","name":"PixMob IR reverse engineering: controlling event wristbands at home","name_zh":"PixMob 红外逆向工程：在家控制活动手环","url":"https://github.com/danielweidman/pixmob-ir-reverse-engineering","evidence_url":"https://github.com/danielweidman/pixmob-ir-reverse-engineering/blob/b372420e1e1ff818a8d25ba50f0c71e97e62f138/README.md","description_en":"Recovers enough of the infrared protocol used by PixMob event wristbands to light them at home, starting from Flipper Zero recordings made at concerts and games and replaying them to bracelets. Pulse-timing analysis found 38 kHz signals with bit intervals of roughly 700 µs, and targeted brute forcing from an ESP32 discovered hundreds of colour, fade, random and motion-mode commands, now sent through Arduino, Python and web tools. The README calls the result far from exhaustive and points to a later repository that decoded most of the full IR protocol through MCU dumping.","description_zh":"从在演唱会和球赛现场用 Flipper Zero 录下的信号出发，把录音重放给手环，恢复出足以在家中点亮 PixMob 活动手环的部分红外协议。脉冲时序分析发现信号载波为 38 kHz、比特间隔约 700 微秒；项目再用 ESP32 做有针对性的暴力枚举，找到数百条颜色、渐变、随机和体感模式命令，现可通过 Arduino、Python 和网页工具发送。README 称这些结果远未穷尽，并指向一个后来通过 MCU 转储基本解出完整红外协议的仓库。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"wtsxdev-reverse-engineering-list","name":"Reverse Engineering resources (wtsxDev)","name_zh":"Reverse Engineering resources 逆向工程资源清单（wtsxDev）","url":"https://github.com/wtsxDev/reverse-engineering","evidence_url":"https://github.com/wtsxDev/reverse-engineering/blob/b25498551c6d7110685896078afeb27097aa1e24/README.md","description_en":"A single-README awesome list, started in January 2017 and maintained under the KaliTut name, of 139 reverse-engineering links in 16 sections: books, courses, practice targets, hex editors, binary-format tools, disassemblers, binary analysis, bytecode analysis, import reconstruction, dynamic analysis, debugging, Mac decryption, document analysis, scripting, Android and YARA. Entries are mostly a tool or resource name with its link, a few with a one-line usage note, and lean towards Windows and macOS tooling and malware analysis.","description_zh":"以单个 README 维护的 awesome 清单，2017 年 1 月创建，以 KaliTut 名义维护，共收录 139 个逆向工程链接，分为 16 个部分：书籍、课程、练习目标、十六进制编辑器、二进制格式工具、反汇编器、二进制分析、字节码分析、导入表重建、动态分析、调试、Mac 解密、文档分析、脚本、Android 和 YARA。条目大多只有工具或资源名称及链接，少数附一行用法说明，内容偏重 Windows 与 macOS 工具以及恶意软件分析。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["app","binary"],"verified_at":"2026-10-19"},{"id":"decomp-academy","name":"Decomp Academy","name_zh":"Decomp Academy 一致性反编译课程","url":"https://decomp-academy.dev/","evidence_url":"https://github.com/JackPriceBurns/decomp-academy-fe/blob/a21f9d00dcdcb00936c3f0369f396b555e893d93/README.md","description_en":"A free, English, in-browser course in matching decompilation maintained by Jack Price-Burns: learners read a function's target assembly, write C, and the original console compiler grades the result byte for byte. Lessons build from reading registers and arithmetic through control flow, structs, floating point, the ABI, globals, optimizer behaviour and 64-bit integers, then finish with functions adapted from open-source decompilation projects. The curriculum now spans GameCube PowerPC, Game Boy Advance Thumb and Nintendo 64 MIPS courses, and the frontend source is on GitHub.","description_zh":"由 Jack Price-Burns 维护的免费英文在线课程，在浏览器中教授一致性反编译：学习者阅读函数的目标汇编，编写 C 代码，再由原版主机编译器逐字节评判结果。课程从读寄存器和算术运算讲起，依次覆盖控制流、结构体、浮点、ABI、全局变量、优化器行为和 64 位整数，最后以改编自开源反编译项目的函数收尾。课程目前包括 GameCube PowerPC、Game Boy Advance Thumb 和 Nintendo 64 MIPS 三门，前端源码公开在 GitHub 上。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"phantom-hourglass-ds-decomp-case","name":"Phantom Hourglass: an early-stage matching Nintendo DS decompilation","name_zh":"《幻影沙漏》：早期阶段的 Nintendo DS 一致性反编译","url":"https://github.com/zeldaret/ph","evidence_url":"https://github.com/zeldaret/ph/blob/f0799bd6038be6858499ec68f0d03cdbbfa53d0b/README.md","description_en":"Recreates C++ source for The Legend of Zelda: Phantom Hourglass by hand-decompiling its European and US Nintendo DS releases, using the dsd toolkit to delink code from a user-supplied ROM and rebuild the ROM. objdiff tracks matches function by function, and the default build compares the output ROM with a stored SHA-1. The work is at an early stage: decomp.dev reported 2.82% of code matched at the reviewed commit.","description_zh":"通过手工反编译，为《塞尔达传说 幻影沙漏》的欧版与美版 Nintendo DS 重建 C++ 源码：借助 dsd 工具集从使用者自备的 ROM 中拆分代码，再重新构建 ROM。objdiff 逐个函数跟踪匹配情况，默认构建会将输出 ROM 与仓库保存的 SHA-1 比对。项目仍处于早期阶段：decomp.dev 报告所审提交有 2.82% 的代码已匹配。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"kinoko-mkwii-physics-reimplementation-case","name":"Kinoko: reimplementing Mario Kart Wii’s physics engine for exact ghost replay","name_zh":"Kinoko：为精确回放幽灵记录而重新实现 Mario Kart Wii 物理引擎","url":"https://github.com/vabold/Kinoko","evidence_url":"https://github.com/vabold/Kinoko/blob/550c97a299c4de4a9f7cb90bc79cf8c7c768557c/README.md","description_en":"Re-implements Mario Kart Wii’s physics engine in C++ as a command-line simulator, continuing stblr/Hanachan’s goal of perfectly accurate time-trial ghost replay. Each test case replays a recorded ghost through the engine and compares kart position, rotation, velocities, speed and checkpoint state frame by frame with a trace captured from the original game. It is a behavioural reimplementation of the physics only, not a matching decompilation, and has no graphical frontend.","description_zh":"以 C++ 将 Mario Kart Wii 的物理引擎重新实现为命令行模拟器，延续 stblr/Hanachan 的目标：完全准确地回放计时赛幽灵记录。每个测试用例让引擎重放一条幽灵记录，并逐帧将赛车的位置、旋转、速度向量、速率和检查点状态与从原版游戏采集的轨迹比较。它只在行为层面重新实现物理部分，并非一致性反编译，也没有图形前端。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"owasp-fstm","name":"OWASP Firmware Security Testing Methodology (FSTM)","name_zh":"OWASP 固件安全测试方法论（FSTM）","url":"https://scriptingxss.gitbook.io/firmware-security-testing-methodology/","evidence_url":"https://github.com/scriptingxss/owasp-fstm/blob/ec666e8f8b9f7618a248a1c354469893abf0edb2/README.md","description_en":"A free English methodology, maintained by Aaron Guzman and published on GitBook, for security testing and reverse engineering embedded-device firmware. It is organized as nine stages: information gathering, obtaining firmware, analyzing the image, extracting the filesystem, static analysis of its contents, emulation, dynamic testing, runtime analysis and binary exploitation, with example commands for tools such as binwalk, unblob, FACT, EMBA, Firmwalker, QEMU and Ghidra. An October 2025 revision added C/C++ static-analysis tools, SBOM generation and a mapping to the OWASP IoT Security Verification Standard (ISVS).","description_zh":"由 Aaron Guzman 维护、发布在 GitBook 上的免费英文方法论，用于嵌入式设备固件的安全测试与逆向工程。全文分为九个阶段：信息收集、获取固件、分析固件镜像、提取文件系统、静态分析文件系统内容、仿真、动态测试、运行时分析和二进制漏洞利用，并给出 binwalk、unblob、FACT、EMBA、Firmwalker、QEMU 和 Ghidra 等工具的示例命令。2025 年 10 月的修订加入了 C/C++ 静态分析工具、SBOM 生成，以及与 OWASP IoT 安全验证标准（ISVS）的对应关系。","kind":"learning-resource","category":"learning","group":"learn","relationship":"learning","targets":["firmware"],"verified_at":"2026-10-19"},{"id":"awesome-android-reverse-engineering","name":"Awesome Android Reverse Engineering","name_zh":"Awesome Android Reverse Engineering Android 逆向工程资源清单","url":"https://github.com/user1342/Awesome-Android-Reverse-Engineering","evidence_url":"https://github.com/user1342/Awesome-Android-Reverse-Engineering/blob/0ade43d6b46ff19675ca4d8b8f1cc098e1af73b8/README.md","description_en":"An awesome list of Android reverse-engineering training, tools and resources started in 2023 by James Stevenson, with 92 one-line entries, 16 of them starred as great and up to date. It covers courses, videos and books; static analysis and deobfuscation, networking and Frida-based instrumentation, decompilers and malware analysis tools; documentation and case studies; CTFs and crackmes; obfuscation and anti-reversing; and a short firmware and kernel section.","description_zh":"James Stevenson 于 2023 年创建的 awesome 清单，收录 Android 逆向工程的培训、工具和资源，共 92 个单行条目，其中 16 个以星标注为优质且较新的资源。内容涵盖课程、视频和书籍，静态分析与反混淆、网络分析与基于 Frida 的插桩、反编译器和恶意软件分析工具，文档与案例研究，CTF 与 crackme，混淆与反逆向，以及一个简短的固件与内核部分。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["app"],"verified_at":"2026-10-19"},{"id":"mario-kart-double-dash-decomp-case","name":"Mario Kart: Double Dash!!: a matching GameCube decompilation of the debug build","name_zh":"《马力欧卡丁车：双重冲刺!!》：调试版 GameCube 一致性反编译","url":"https://github.com/doldecomp/mkdd","evidence_url":"https://github.com/doldecomp/mkdd/blob/1d2918ca577817ba431baddb78dda24831e0e0bb/README.md","description_en":"A work-in-progress 1:1 decompilation of Mario Kart: Double Dash!! that rebuilds the GameCube main.dol of the US debug build (MarioClub_us) from C and C++ with the original Metrowerks compilers, checking it against a stored SHA-1. The build splits the binary from a user-supplied disc image, and objdiff compares objects during development. decomp.dev reported 47.09% of code matched at the reviewed commit; a European retail target is configured but marked as not working yet.","description_zh":"《马力欧卡丁车：双重冲刺!!》的进行中 1:1 反编译：用原版 Metrowerks 编译器从 C 与 C++ 源码重建美版调试构建（MarioClub_us）的 GameCube main.dol，并与仓库保存的 SHA-1 比对。构建从使用者自备的光盘镜像中拆分二进制，开发时用 objdiff 比对目标文件。decomp.dev 报告所审提交有 47.09% 的代码已匹配；欧版零售目标虽已配置，但标注为尚不可用。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"sfiii-3rd-strike-ps2-decomp-case","name":"3S Decomp: a byte-compared PS2 decompilation of Street Fighter III: 3rd Strike","name_zh":"3S Decomp：逐字比对的《街头霸王 III：3rd Strike》PS2 反编译重建","url":"https://github.com/crowded-street/3s-decomp","evidence_url":"https://github.com/crowded-street/3s-decomp/blob/be9b9bc69dc19822a8eca9ce3e72ba560d5a3835/README.md","description_en":"Decompiles the PlayStation 2 executable of Street Fighter III: 3rd Strike from Street Fighter Anniversary Collection into C that period Metrowerks and EE GCC compilers rebuild, then compares the rebuilt executable word by word with the user’s original. README reports the game code fully decompiled and the CRI middleware partly so. The separate 3SX native port describes itself as this project’s continuation.","description_zh":"将 Street Fighter Anniversary Collection 中《街头霸王 III：3rd Strike》的 PlayStation 2 可执行文件反编译为 C 源码，用当年的 Metrowerks 与 EE GCC 编译器重新构建，再将重建出的可执行文件与使用者自备的原文件逐字比较。README 报告游戏代码已全部反编译，CRI 中间件部分完成。另有独立的 3SX 原生移植，自称是本项目的延续。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"halo-ce-xbox-reimplementation-case","name":"Halo: Combat Evolved: an incremental re-implementation patched into the original Xbox executable","name_zh":"Halo: Combat Evolved：逐步重新实现并修补进原版 Xbox 可执行文件","url":"https://github.com/halo-re/halo","evidence_url":"https://github.com/halo-re/halo/blob/21bc641df6b8bdd730c23885ff643545423dcc82/README.md","description_en":"A research project re-implementing the original Xbox Halo: Combat Evolved in C, one function at a time. Rewritten functions are compiled into a separate image and patched into the user’s original executable with redirects from the original implementations, so the hybrid game can be run and debugged in xemu or on an Xbox as work progresses. The project reports an early stage, and its sources document no byte-for-byte comparison with the original code.","description_zh":"一个以 C 语言逐个函数重新实现初代 Xbox 版 Halo: Combat Evolved 的研究项目。重写的函数编译为独立映像，再修补进使用者自备的原版可执行文件，并从原有实现重定向过去，使这一混合版本能在开发过程中于 xemu 或 Xbox 上运行和调试。项目自述仍处于早期阶段，其来源也未记录与原代码的逐字节比较。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"paper-mario-ttyd-decomp-case","name":"Paper Mario: The Thousand-Year Door: an early matching GameCube decompilation","name_zh":"《纸片马力欧 RPG》：早期阶段的 GameCube 一致性反编译","url":"https://github.com/doldecomp/ttyd","evidence_url":"https://github.com/doldecomp/ttyd/blob/62131fc31866f85a12e4817a8dc37f0c25eb5f8c/README.md","description_en":"A work-in-progress matching decompilation of Paper Mario: The Thousand-Year Door that targets the Japanese Rev 0 GameCube release (G8MJ01), rebuilding MarioSt.dol and 31 REL modules with the original Metrowerks compilers and checking each against a stored SHA-1. The build splits these binaries from a user-supplied disc image, and objdiff compares objects during development. decomp.dev reported 12.10% of code matched at the reviewed commit.","description_zh":"《纸片马力欧 RPG》（Paper Mario: The Thousand-Year Door）的进行中一致性反编译，目标为日版 Rev 0 GameCube 版本（G8MJ01）：用原版 Metrowerks 编译器重建 MarioSt.dol 和 31 个 REL 模块，并逐一与仓库保存的 SHA-1 比对。构建从使用者自备的光盘镜像中拆分这些二进制，开发时用 objdiff 比对目标文件。decomp.dev 报告所审提交有 12.10% 的代码已匹配。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"awesome-frida","name":"Awesome Frida","name_zh":"Awesome Frida Frida 资源清单","url":"https://github.com/dweinstein/awesome-frida","evidence_url":"https://github.com/dweinstein/awesome-frida/blob/e20da3b2ae3a30cd65ab0e4a0f0345bb909ecb10/README.md","description_en":"An awesome list of libraries, scripts, tools, talks and articles built on or about Frida, the dynamic instrumentation toolkit, started by David Weinstein in May 2016. Its 82 entries fall into libraries (about half of them NowSecure Node.js modules), script collections and projects, talks and papers, tools powered by Frida such as r2frida, objection, friTap and Fridump, videos, blog posts and community links, most with a one-line summary.","description_zh":"David Weinstein 于 2016 年 5 月创建的 awesome 清单，收录基于或围绕动态插桩工具包 Frida 的程序库、脚本、工具、演讲和文章。全部 82 个条目分为程序库（约一半是 NowSecure 的 Node.js 模块）、脚本合集与项目、演讲与论文、基于 Frida 的工具（如 r2frida、objection、friTap 和 Fridump）、视频、博客文章以及社区链接，大多附有一行简介。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["app","binary"],"verified_at":"2026-10-19"},{"id":"3sx-third-strike-native-port-case","name":"3SX: a native Street Fighter III: 3rd Strike port continuing the PS2 decompilation","name_zh":"3SX：延续 PS2 反编译的《街头霸王 III：3rd Strike》原生移植","url":"https://github.com/crowded-street/3sx","evidence_url":"https://github.com/crowded-street/3sx/blob/bdc2cd351aad35d7e251a5a6d63a3368bd31cbaa/README.md","description_en":"Builds Street Fighter III: 3rd Strike as native C for Windows, macOS and Linux, continuing the 3s-decomp PS2 decompilation, with SDL3 for video, input and audio and GekkoNet for rollback netplay. README stresses that it is neither a recompilation nor emulation. The port needs the player’s own PS2 game files and works toward arcade-accurate balance, which an optional Statcheck build tests against CPS3 RAM states recorded from Fightcade replays.","description_zh":"延续 3s-decomp 的 PS2 反编译成果，将《街头霸王 III：3rd Strike》构建为可在 Windows、macOS 和 Linux 上运行的原生 C 程序，以 SDL3 处理画面、输入和声音，以 GekkoNet 实现回滚联机。README 强调它既不是重编译，也不是模拟。移植版需要玩家自备 PS2 游戏文件，并以接近街机版的平衡性为目标；可选的 Statcheck 构建会用 Fightcade 对战录像中记录的 CPS3 内存状态来检验这一点。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"re4-gamecube-debug-decomp-case","name":"re4: a byte-identical decompilation of the Resident Evil 4 GameCube debug build","name_zh":"re4：Resident Evil 4 GameCube 调试版的字节一致反编译","url":"https://github.com/adonis-singh/re4","evidence_url":"https://github.com/adonis-singh/re4/blob/9b76ff003081d6ece8b838453fb8310743a972c7/README.md","description_en":"Reconstructs C and C++ source for the two-disc Resident Evil 4 GameCube debug prototype (G4BE08) and rebuilds main.dol and all 114 REL overlays with the compilers the README names, checking every output against a SHA-1 list. Function names are Capcom’s own from the debug build’s Bio4.sym files, and most struct and field names are aligned from the PS2 debug build’s debug information. The project’s research log says AI agents did the matching work; byte identity is project-reported.","description_zh":"为 Resident Evil 4 的双光盘 GameCube 调试原型版（G4BE08）重建 C 与 C++ 源码，并用 README 所列编译器重新构建 main.dol 及全部 114 个 REL 覆盖模块，逐一与 SHA-1 清单比对。函数名沿用调试版 Bio4.sym 符号文件中 Capcom 自己的命名，多数结构体与字段名则依据 PS2 调试版的调试信息对齐得出。项目的研究日志称一致性工作由 AI 智能体完成；字节一致为项目报告的结果。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"smash-bros-brawl-decomp-case","name":"Super Smash Bros. Brawl: an early matching Wii decompilation","name_zh":"《任天堂明星大乱斗X》：早期阶段的 Wii 一致性反编译","url":"https://github.com/doldecomp/brawl","evidence_url":"https://github.com/doldecomp/brawl/blob/b96b501ff127b29e8946ee9a352a7bdc2ef5f38a/README.md","description_en":"A work-in-progress matching decompilation of Super Smash Bros. Brawl that targets the USA Rev 2 Wii release (RSBE01_02), splitting main.dol and 126 REL modules from a user-supplied disc image and checking the rebuilt binaries against stored SHA-1 values. objdiff compares objects during development, and six other regional revisions are listed but commented out of the supported set. decomp.dev reported 1.27% of code matched at the reviewed commit.","description_zh":"《任天堂明星大乱斗X》（Super Smash Bros. Brawl）的进行中一致性反编译，目标为美版 Rev 2 Wii 版本（RSBE01_02）：从使用者自备的光盘镜像中拆分 main.dol 和 126 个 REL 模块，并按仓库保存的 SHA-1 校验重建出的二进制。开发时用 objdiff 比对目标文件；另外六个地区修订版虽已列出，但在支持列表中被注释掉。decomp.dev 报告所审提交有 1.27% 的代码已匹配。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"re-plants-vs-zombies-decomp-case","name":"re-plants-vs-zombies: decompiling and modernizing Plants vs. Zombies GOTY","name_zh":"re-plants-vs-zombies：反编译并现代化改造 Plants vs. Zombies 年度版","url":"https://github.com/Patoke/re-plants-vs-zombies","evidence_url":"https://github.com/Patoke/re-plants-vs-zombies/blob/c4692036c5e11d227c8fb7c593b734dac96da028/README.md","description_en":"Reconstructs C++ source for Plants vs. Zombies on PopCap’s open-source SexyAppFramework, starting from an earlier community decompilation of version 0.9.9 and adding functionality reversed from the Game of the Year edition, with functions annotated by GOTY addresses. The project also modernizes the engine with current C++ and is replacing the DirectDraw and Direct3D 7 renderers with GLFW. It builds a fan executable that runs from an original game folder, aiming at a modernized, extensible game rather than an identical binary.","description_zh":"以 PopCap 开源的 SexyAppFramework 为基础重建 Plants vs. Zombies 的 C++ 源码：起点是社区早先对 0.9.9 版的反编译，再补入从年度版（GOTY）逆向得到的功能，并以 GOTY 版地址标注函数。项目同时以现代 C++ 改造引擎，并正将 DirectDraw 与 Direct3D 7 渲染器替换为 GLFW。它构建出在原版游戏目录中运行的同人可执行文件，目标是现代化、可扩展的游戏，而不是完全一致的二进制。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"awesome-ghidra","name":"Awesome Ghidra","name_zh":"Awesome Ghidra Ghidra 资源清单","url":"https://github.com/AllsafeCyberSecurity/awesome-ghidra","evidence_url":"https://github.com/AllsafeCyberSecurity/awesome-ghidra/blob/9265b2f730a10f6261945ac22cb295c8f6038f87/README.md","description_en":"An awesome list of Ghidra scripts, plugins, extensions, learning materials and related services, kept by the Allsafe GitHub organization since December 2019. Its 49 entries comprise 36 scripts and extensions, from malware-analysis and crypto-constant finders to Go, JNI, EVM and EFI helpers, Python and Jupyter bridges, P-code emulation and patch-diff correlators; 10 books, talks and courses; and three related projects such as r2ghidra-dec and Ghidraaas, each with a one-line summary.","description_zh":"由 GitHub 组织 Allsafe 自 2019 年 12 月起维护的 awesome 清单，收录 Ghidra 脚本、插件、扩展、学习资料和相关服务。全部 49 个条目包括 36 个脚本与扩展，从恶意软件分析和加密常量查找工具，到 Go、JNI、EVM 和 EFI 辅助工具、Python 与 Jupyter 桥接、P-code 模拟以及补丁对比关联器；10 份书籍、演讲和课程资料；以及 r2ghidra-dec、Ghidraaas 等 3 个相关项目，每项附一行简介。","kind":"collection","category":"related-lists","group":"learn","relationship":"learning","targets":["binary"],"verified_at":"2026-10-19"},{"id":"sonic-advance-1-2-decomp-port-case","name":"Sonic Advance 1 & 2: a matching GBA decompilation with widescreen ports","name_zh":"《索尼克 Advance》1 与 2：一致性 GBA 反编译及宽屏移植","url":"https://github.com/SAT-R/sa2","evidence_url":"https://github.com/SAT-R/sa2/blob/393357f7c9d46b5c10b6c41a57b80fe3b58f3c8d/README.md","description_en":"Reconstructs Sonic Advance and Sonic Advance 2 for the Game Boy Advance as C that rebuilds six hash-listed ROMs with SAT-R’s agbcc fork, and compiles the same code into widescreen SDL ports for Linux, macOS and Windows plus PSP and PS2 builds. README reports Sonic Advance 2 built entirely from C with about 60 functions still non-matching. Extracted graphics, music and data are committed, so the builds read no original ROM.","description_zh":"将 Game Boy Advance 版《索尼克 Advance》和《索尼克 Advance 2》重建为 C 源码，借助 SAT-R 的 agbcc 分支重新构建六个列有哈希值的 ROM，同一套代码还可编译为面向 Linux、macOS 和 Windows 的宽屏 SDL 移植版，以及 PSP 和 PS2 版本。README 报告《索尼克 Advance 2》已全部由 C 构建，仍有约 60 个函数不一致。提取出的图像、音乐和数据都提交在仓库中，因此构建时不读取原 ROM。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"paleblood-bloodborne-functional-decomp-case","name":"Paleblood: a functional decompilation of Bloodborne with its own runtime","name_zh":"Paleblood：带自有运行时的 Bloodborne 功能等价反编译","url":"https://github.com/Yharnam-Hunters/Paleblood","evidence_url":"https://github.com/Yharnam-Hunters/Paleblood/blob/1d418eba692745d8fc0a7d77a04d1bca56badab8/README.md","description_en":"Rewrites code from Bloodborne’s PS4 executable (CUSA03173 with update 1.09) as readable C++, one function at a time, aiming at a native PC source port on a clean-room runtime of its own. It is a functional rather than matching decompilation: each replacement is hooked in, compared with the original machine code on recorded and generated inputs, and independently reviewed. Work is at an early stage: README reports 21 of 157,757 functions verified, and the game does not yet run on Paleblood’s own runtime.","description_zh":"将 Bloodborne PS4 可执行文件（CUSA03173，含 1.09 更新）的代码逐个函数改写为可读的 C++，目标是在项目以净室方式自行编写的运行时上实现原生 PC 源码移植。它追求功能等价而非字节一致：每个替换函数都以钩子接入，在录制与生成的输入上与原始机器码对照比较，再经独立审核。项目仍处早期：README 报告 157,757 个函数中已验证 21 个，游戏尚不能在 Paleblood 自己的运行时上运行。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"pikmin-2-matching-decomp-case","name":"Pikmin 2: a fully matched GameCube decompilation across five releases","name_zh":"《皮克敏2》：覆盖五个版本、已完全匹配的 GameCube 反编译","url":"https://github.com/projectPiki/pikmin2","evidence_url":"https://github.com/projectPiki/pikmin2/blob/ffbd853726427f2e90cd201aaca90dc82b34f990/README.MD","description_en":"A fan decompilation of Pikmin 2 that rebuilds main.dol for five GameCube releases (USA retail, two USA demos, PAL and Japan) with the original Metrowerks compilers, checking each against a stored SHA-1. The build reads main.dol from the user’s own copy of each release. decomp.dev reported all code matched and fully linked for every version at the reviewed commit, and a non-matching mode builds the US DOL entirely from C++ for modding.","description_zh":"由爱好者进行的《皮克敏2》反编译项目：用原版 Metrowerks 编译器为五个 GameCube 版本（美版零售版、两个美版体验版、PAL 版和日版）重建 main.dol，并逐一与仓库保存的 SHA-1 比对。构建读取使用者自有各版本中的 main.dol。decomp.dev 报告所审提交中各版本的代码均已全部匹配并完全链接；另有非一致性模式，可完全由 C++ 源码构建美版 DOL 以供模组制作。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"gran-turismo-4-matching-decomp-case","name":"Gran Turismo 4: an agent-assisted PS2 engine matching decompilation","name_zh":"Gran Turismo 4：借助智能体的 PS2 引擎匹配反编译","url":"https://github.com/gustavocanepa/gt4-decomp","evidence_url":"https://github.com/gustavocanepa/gt4-decomp/blob/e35ec1ddb6a5931252489ff7d8ed27520fdabe4e/README.md","description_en":"Decompiles Gran Turismo 4’s PS2 engine executable (CORE.GT4, NTSC-U v1.01) into one C or C++ source per function for Sony’s ee-gcc 2.96, matching public libraries such as newlib and Expat from their own source. The README credits AI agents (Anthropic’s Claude) driving the project’s tools with most of the matching, each function accepted only on a compiler-and-judge comparison, and reports 95.4% of functions and 83.6% of code bytes matched for an October 2026 commit. A local full build links sources at their original addresses, fills the rest from disassembly and compares SHA-1 with the user’s executable.","description_zh":"将 Gran Turismo 4（《GT 赛车 4》）的 PS2 引擎可执行文件（CORE.GT4，NTSC-U v1.01）按每个函数一个 C 或 C++ 源文件反编译，面向 Sony 的 ee-gcc 2.96，并用 newlib、Expat 等公开库自身的源码匹配其函数。README 称大部分匹配工作由驱动项目工具的 AI 智能体（Anthropic 的 Claude）完成，每个函数须通过编译器与判定器的比对才算完成，并报告 2026 年 10 月某次提交时 95.4% 的函数和 83.6% 的代码字节已匹配。本地完整构建将源码链接到原始地址，其余部分用反汇编补齐，再与使用者的可执行文件比较 SHA-1。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"mario-kart-wii-decomp-case","name":"Mario Kart Wii: an in-progress matching decompilation of the PAL release","name_zh":"《马力欧卡丁车 Wii》：进行中的 PAL 版一致性反编译","url":"https://github.com/snailspeed3/mkw","evidence_url":"https://github.com/snailspeed3/mkw/blob/78572c95c41dbf6cbb7dd251a567e538560ce1d8/README.md","description_en":"A work-in-progress matching decompilation of Mario Kart Wii that targets the PAL release (RMCP01), rebuilding main.dol and the StaticR.rel module from C and C++ with Metrowerks compilers and checking both against stored SHA-1 values. The build splits these binaries from a user-supplied disc image, and objdiff compares objects during development. The README’s progress badges point to a decomp.dev page that did not resolve at review, and the default branch was last updated in September 2025.","description_zh":"《马力欧卡丁车 Wii》的进行中一致性反编译，目标为 PAL 版（RMCP01）：用 Metrowerks 编译器从 C 与 C++ 源码重建 main.dol 和 StaticR.rel 模块，并与仓库保存的 SHA-1 比对。构建从使用者自备的光盘镜像中拆分这些二进制，开发时用 objdiff 比对目标文件。README 的进度徽章指向的 decomp.dev 页面在审阅时无法访问，默认分支最后更新于 2025 年 9 月。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"pinyon-shift-forza-horizon-recomp-case","name":"Pinyon Shift: a ShiftGlue static recompilation of Forza Horizon for PC","name_zh":"Pinyon Shift：以 ShiftGlue 将 Forza Horizon 静态重编译到 PC","url":"https://github.com/arcanite24/pinyon-shift","evidence_url":"https://github.com/arcanite24/pinyon-shift/blob/9331e453e9850d0fcc1c1606dee95db834a9d317/README.md","description_en":"Builds a native port of the Xbox 360 release of Forza Horizon by translating its PowerPC executable ahead of time into C++ with ShiftGlue, the author’s fork of ReXGlue, and compiling it on the player’s machine from their own disc. A renderer written for this game runs its GPU commands on Vulkan, and some translated library code, such as FMOD Ex DSP units, is replaced by independently written native code checked against the translated original. README presents it as a playable preview with rendering bugs and slowdowns.","description_zh":"使用作者对 ReXGlue 的分支 ShiftGlue，将 Xbox 360 版 Forza Horizon 的 PowerPC 可执行文件提前转换为 C++，并依玩家自有光盘在其电脑上编译，构建原生移植版。专为该游戏编写的渲染器在 Vulkan 上执行其 GPU 命令；部分转换后的库代码（如 FMOD Ex 的 DSP 单元）由独立编写、并与转换后原版对照检查的原生代码替代。README 称其为可游玩的预览版，仍有渲染错误和卡顿。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"th07-decomp-case","name":"Touhou 7: reconstructing Perfect Cherry Blossom 1.00b source","name_zh":"Touhou 7：重建东方妖妖梦 1.00b 版源码","url":"https://github.com/some100/th07","evidence_url":"https://github.com/some100/th07/blob/4878bf0e42a9280ef44735eb0517d4fda7cb6e04/README.md","description_en":"Reconstructs C++ source for the Windows executable of Touhou 7: Perfect Cherry Blossom 1.00b and its custom.exe configuration tool, built with the original Visual Studio .NET 2002 and DirectX 8 toolchain and compared function by function with the user’s originals through reccmp. The committed progress badges report th07.exe fully implemented at 99.78% accuracy and custom.exe fully matched. The README says the game should be fully playable, but a matching build trips the game’s integrity check, and the cross-platform ports live on separate branches.","description_zh":"为 Touhou 7：东方妖妖梦 1.00b 版的 Windows 可执行文件及其 custom.exe 设置工具重建 C++ 源码，使用原版 Visual Studio .NET 2002 与 DirectX 8 工具链构建，并通过 reccmp 与使用者自备的原程序逐函数比较。仓库内的进度徽章报告 th07.exe 已全部实现、准确率 99.78%，custom.exe 已完全匹配。README 称游戏应可完整游玩，但匹配构建会触发游戏自身的完整性检查；跨平台移植位于其他分支。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"dkc1-recomp-case","name":"DKC1Recomp: static recompilation of Donkey Kong Country","name_zh":"DKC1Recomp：《大金刚国度》的静态重编译","url":"https://github.com/elliotttate/DKC1Recomp","evidence_url":"https://github.com/elliotttate/DKC1Recomp/blob/3eb9a10c49cb210df2bd63addafe2a78cf9f4e22/README.md","description_en":"Statically recompiles the North American v1.0 SNES release of Donkey Kong Country into native Windows, macOS and iOS applications with a pinned fork of snesrecomp, which translates 65816 code to C and links it against a modelled SNES hardware runtime. Function boundaries, entry flag states and jump-table targets are ingested from a byte-identical community disassembly instead of discovered heuristically, and the game code is generated locally from the user’s verified ROM. Optional widescreen, CRT filters, MSU-1 music and a Dixie Kong Country variant are host-side additions to what the README calls a playable bring-up.","description_zh":"借助固定版本的 snesrecomp 分支，将 SNES 版《大金刚国度》北美 v1.0 静态重编译为 Windows、macOS 与 iOS 原生程序；该框架把 65816 代码转译为 C，并链接到模拟 SNES 硬件的运行时。函数边界、入口标志状态与跳转表目标均取自一份逐字节一致的社区反汇编，而非靠启发式发现；游戏代码在本地由使用者经校验的 ROM 生成。可选的宽屏、CRT 滤镜、MSU-1 音乐和 Dixie Kong Country 变体都是宿主端附加功能，README 称这一移植处于可游玩的初步运行阶段。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"san-andreas-unity-engine-case","name":"San Andreas Unity: a GTA San Andreas engine reimplementation in Unity","name_zh":"San Andreas Unity：在 Unity 中重新实现的《侠盗猎车手：圣安地列斯》引擎","url":"https://github.com/in0finite/SanAndreasUnity","evidence_url":"https://github.com/in0finite/SanAndreasUnity/blob/f685c437f48721afc0787f27d22c85d96e8684c7/README.md","description_en":"Reimplements the Grand Theft Auto: San Andreas engine in Unity (C#), loading the archives, RenderWare models and textures, collision, animations, audio, text and item definitions from the user’s own PC installation. README says it will not be a complete reimplementation; it focuses on gameplay features, multiplayer and a framework for extending and modding the game through C# plugins. Development has stalled: the newest commit on any branch dates from 2022-09-30.","description_zh":"在 Unity（C#）中重新实现《侠盗猎车手：圣安地列斯》的引擎，从使用者自有的 PC 版安装中读取归档、RenderWare 模型与纹理、碰撞、动画、音频、文本和物品定义。README 表示这不会是完整的重新实现，重点在于游戏玩法、多人模式，以及可通过 C# 插件扩展和改装游戏的框架。项目开发已停滞：所有分支中最新的提交日期为 2022-09-30。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"minecraft-lce-switch-decomp-case","name":"MinecraftLCE: an early-stage Minecraft: Nintendo Switch Edition decompilation","name_zh":"MinecraftLCE：处于早期阶段的 Minecraft: Nintendo Switch Edition 反编译","url":"https://github.com/GRAnimated/MinecraftLCE","evidence_url":"https://github.com/GRAnimated/MinecraftLCE/blob/959e1503b7b26d6821cfa98b3b05ef9089675195/README.md","description_en":"Decompiles Minecraft: Nintendo Switch Edition v1.0.17, a Legacy Console Edition release, into C++ that is compared function by function with the original executable using a patched Clang 4.0.1 and the open-ead Switch decompilation tools. The README explains the choice of the Switch build for its matchable Clang toolchain and type information, with names ported from the symbol-bearing Wii U Edition. At the reviewed commit the function list marks about 11% of functions decompiled, most of them matching; the result cannot run the game.","description_zh":"将 Legacy Console Edition 系列中的 Minecraft: Nintendo Switch Edition v1.0.17 反编译为 C++，借助打过补丁的 Clang 4.0.1 和 open-ead 的 Switch 反编译工具，与原可执行文件逐函数比较。README 解释了选用 Switch 版的原因：其 Clang 工具链可以匹配且带有类型信息，函数名则从带符号的 Wii U Edition 移植而来。所审提交时函数列表标记约 11% 的函数已反编译，其中大多已匹配；产物无法运行游戏。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"ff7-ps1-matching-decomp-case","name":"Final Fantasy VII: a matching PlayStation decompilation","name_zh":"Final Fantasy VII：PlayStation 版一致性反编译","url":"https://github.com/Xeeynamo/ff7-decomp","evidence_url":"https://github.com/Xeeynamo/ff7-decomp/blob/37f35a536ba80f0575e79e243a273b28702d494d/README.md","description_en":"Reconstructs C source for the US PlayStation release of Final Fantasy VII, aiming for code that compiles back to the original main executable and its game overlays. The build splits the user’s disc files with splat, compiles with period cc1-psx compilers and checks every rebuilt file against its SHA-1. A native build against the PsyZ PlayStation-library replacement is compiled in CI but is not documented as a playable port.","description_zh":"为 Final Fantasy VII 美版 PlayStation 发行版重建 C 源码，目标是让代码重新编译出原版主可执行文件及各游戏覆盖段（overlay）。构建流程用 splat 拆分使用者自备的光盘文件，以当年的 cc1-psx 编译器编译，并用 SHA-1 校验每个重建文件。基于 PsyZ（PlayStation 库替代实现）的原生构建会在 CI 中编译，但未作为可游玩的移植版加以说明。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"megaman-x-snes-recomp-case","name":"Mega Man X Recompiled: a snesrecomp static recompilation","name_zh":"Mega Man X Recompiled：基于 snesrecomp 的静态重编译","url":"https://github.com/mstan/MegaManXSNESRecomp","evidence_url":"https://github.com/mstan/MegaManXSNESRecomp/blob/adc1fea7baf90614a4272a90336cfcea563c504c/README.md","description_en":"Statically translates the 65816 CPU code of the SNES Mega Man X (USA Rev 1) to C with the snesrecomp framework; the PPU, audio, DMA and other hardware run in the framework’s runtime, and a LakeSnes-derived interpreter executes whatever the static pass cannot prove. The C is generated locally from the user’s ROM, with function names imported from community DiztinGUIsh annotations. Playable Zero, co-op and rollback netplay, X2/X3 boss weapons and adaptive widescreen are layered on top, using assets extracted locally from the user’s own sequel ROMs.","description_zh":"借助 snesrecomp 框架，将 SNES 版《洛克人 X》（美版 Rev 1）的 65816 CPU 代码静态转译为 C；PPU、音频、DMA 等硬件由框架运行时处理，静态分析无法证明的部分则交给源自 LakeSnes 的解释器执行。C 代码在本地由使用者的 ROM 生成，函数名取自社区的 DiztinGUIsh 注解。项目在此基础上加入可操作的 Zero、合作与回滚联机、X2／X3 的头目武器以及自适应宽屏，所用素材在本地从使用者自有的续作 ROM 中提取。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"opensc4-simcity-4-reimplementation-case","name":"OpenSC4: an early open-source reimplementation of SimCity 4","name_zh":"OpenSC4：SimCity 4 的早期开源重新实现","url":"https://github.com/OpenSC4-org/OpenSC4","evidence_url":"https://github.com/OpenSC4-org/OpenSC4/blob/fdc90c33e6e012b8c825f20ee10c51f55796df39/README.md","description_en":"Reimplements SimCity 4 as a Godot project in GDScript that reads DBPF archives, region folders and city saves from the user’s own SimCity 4 installation. The code draws a region view with city thumbnails and interface elements built from the game’s UI definitions, opens a saved city’s terrain and water in 3D, and includes a DAT explorer for previewing archive subfiles. It is an early, inactive engine case without simulation gameplay, not a playable replacement.","description_zh":"以 Godot 项目和 GDScript 重新实现 SimCity 4，从使用者自有的 SimCity 4 安装目录读取 DBPF 归档、区域文件夹和城市存档。代码可绘制带城市缩略图的区域视图，并依据游戏的 UI 定义生成界面元素，可在 3D 中打开已存城市的地形与水面，还附带用于预览归档子文件的 DAT 浏览器。这是一个早期且已停滞的引擎案例，尚无模拟玩法，并非可替代原版的实现。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"synchrony","name":"synchrony","name_zh":"synchrony JavaScript 反混淆工具","url":"https://github.com/relative/synchrony","evidence_url":"https://github.com/relative/synchrony/blob/710e9f6c21ceea0cddf178eb863ef678f5d9d6ee/README.md","description_en":"JavaScript cleaner and deobfuscator aimed mainly at output from javascript-obfuscator (obfuscator.io). It parses a script with acorn and runs a fixed pipeline of AST transformers that fold expressions, clean member accesses, remove dead branches, split sequence expressions, undo switch-based control-flow flattening and decode string arrays, re-implementing their base64 and RC4 decoders in TypeScript rather than executing the input. It ships on npm as deobfuscator with a synchrony CLI and a library API, and optional renaming replaces identifiers with generated word names rather than recovering the originals.","description_zh":"主要面向 javascript-obfuscator（obfuscator.io）输出的 JavaScript 清理与反混淆工具。它用 acorn 解析脚本，再运行一组固定的 AST 转换器：折叠表达式、整理成员访问、删除死分支、拆分逗号表达式、还原基于 switch 的控制流平坦化，并解码字符串数组；其中 base64 和 RC4 解码器以 TypeScript 重新实现，而不是执行输入代码。它以 deobfuscator 之名发布在 npm 上，提供 synchrony 命令行工具和库 API；可选的重命名会把标识符换成生成的单词名，并不能恢复原名。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-19"},{"id":"relive-oddworld-abe-engine-case","name":"R.E.L.I.V.E.: an Oddworld Abe’s Oddysee and Abe’s Exoddus engine reimplementation","name_zh":"R.E.L.I.V.E.：Oddworld: Abe’s Oddysee 与 Abe’s Exoddus 引擎的重新实现","url":"https://github.com/AliveTeam/alive_reversing","evidence_url":"https://github.com/AliveTeam/alive_reversing/blob/3be8967b71b29e6e61009d291bd64dce39abf7ac/README.md","description_en":"Reimplements the engine of Oddworld: Abe’s Oddysee and Abe’s Exoddus as an open-source replacement executable that runs from the user’s own game folder. The team decompiled the original executables and replaced their functions incrementally, using injected DLLs that hook reimplemented code into the patched retail executable, then rewrote the result into a standalone cross-platform engine. The project site says both games are playable in their entirety, with bug fixes and windowed, high-resolution and controller play.","description_zh":"以开源的替代可执行文件重新实现 Oddworld: Abe’s Oddysee 与 Abe’s Exoddus 的引擎，在使用者自己的游戏目录中运行。团队先反编译原版可执行文件并逐步替换其中的函数，借助注入的 DLL 将重新实现的代码挂接到打过补丁的零售版程序中，之后再把成果改写为独立的跨平台引擎。项目网站称两款游戏均可完整通关，并修复了缺陷，支持窗口模式、高分辨率和手柄游玩。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"retdec","name":"RetDec","name_zh":"RetDec 可重定向机器码反编译器","url":"https://github.com/avast/retdec","evidence_url":"https://github.com/avast/retdec/blob/9450585772e6f1c18e5f0b2ad5518a18d6bce71e/README.md","description_en":"Avast's retargetable machine-code decompiler built on LLVM. It takes ELF, PE, Mach-O, COFF, AR, Intel HEX or raw code for 32-bit x86, ARM, MIPS, PIC32 and PowerPC or 64-bit x86-64 and ARM64, recovers functions, types and C++ class hierarchies, and emits C or a Python-like language with call and control-flow graphs.","description_zh":"Avast 推出的基于 LLVM 的可重定向机器码反编译器。可处理 ELF、PE、Mach-O、COFF、AR、Intel HEX 或原始机器码，覆盖 32 位 x86、ARM、MIPS、PIC32、PowerPC 以及 64 位 x86-64 和 ARM64，能恢复函数、类型和 C++ 类层次结构，输出 C 或类 Python 语言代码，并生成调用图和控制流图。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"aoe-free-software-remake-case","name":"Age of Empires Free Software Remake: a re-implementation on the original data","name_zh":"Age of Empires Free Software Remake：基于原版数据的重新实现","url":"https://github.com/FolkertVanVerseveld/aoe","evidence_url":"https://github.com/FolkertVanVerseveld/aoe/blob/3234eac7098124e7fac11272697cacb3aed5e608/README.md","description_en":"Re-implements Microsoft’s Age of Empires and its Rise of Rome expansion as a cross-platform C++17 engine on SDL2 and OpenGL that loads the original game’s DRS archives and language.dll resources. README says it mimics the Windows API and the Genie engine for compatibility and reconstructs some code from the disassembly; the repository adds format notes and Python tools for inspecting the original data files. Only very basic gameplay through a multiplayer session exists so far, so it is an early engine case rather than a playable replacement.","description_zh":"以基于 SDL2 和 OpenGL 的跨平台 C++17 引擎重新实现 Microsoft 的《帝国时代》及其资料片《罗马复兴》，载入原版游戏的 DRS 归档和 language.dll 资源。README 称项目为兼容起见模仿 Windows API 和 Genie 引擎，部分代码依据反汇编重建；仓库另附格式笔记和用于检查原版数据文件的 Python 工具。目前只能通过多人会话进行非常基础的游戏，因此这是一个早期引擎案例，而非可替代原版游玩的实现。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"god-of-war-ps2-recomp-case","name":"God of War PS2 static recompilation: a native Windows port via PS2Recomp","name_zh":"《战神》PS2 静态重编译：基于 PS2Recomp 的 Windows 原生移植","url":"https://github.com/KIexster/god-of-war-recomp","evidence_url":"https://github.com/KIexster/god-of-war-recomp/blob/92ece581c673842c282a9c23819545de5ab92d3c/README.md","description_en":"Statically recompiles the MIPS R5900 code of the NTSC-U PlayStation 2 God of War executable (SCUS-97399) to C++ with PS2Recomp and builds it as a native Windows program. Since October 2026 the port builds on Waffle565’s runtime, which replaces the PS2 hardware with native code: VU1 microprograms and, optionally, the game’s IRX modules are compiled ahead of time, and an OpenGL renderer stands in for the GS. The repository holds only the game-specific function map, recompiler configuration, overrides and runtime patches; the README reports gameplay on the opening ship level, with sustained 60 fps and a full playthrough still pending.","description_zh":"使用 PS2Recomp 将 PlayStation 2 版《战神》美版（SCUS-97399）可执行文件中的 MIPS R5900 代码静态重编译为 C++，并构建为 Windows 原生程序。自 2026 年 10 月起，移植以 Waffle565 的运行时为基础，用原生代码取代 PS2 硬件：VU1 微程序以及可选的游戏 IRX 模块会预先编译，OpenGL 渲染器则代替 GS。仓库只包含本作专用的函数映射、重编译器配置、覆盖实现与运行时补丁；README 报告已能在开场的船上关卡中游玩，而稳定 60 fps 与完整通关仍待完成。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"redasm","name":"REDasm","name_zh":"REDasm 反汇编器","url":"https://github.com/redasm-dev/redasm","evidence_url":"https://github.com/redasm-dev/redasm/blob/509b76548a741aac569161df666b6c13f927d6f5/README.md","description_en":"Cross-platform interactive disassembler whose version 4 is a plain-C rewrite: a C17 engine library, the Qt6 GUI kept in this repository, and loader, processor and analyzer plugins loaded as shared libraries. The listing supports renaming, comments and typed data, with a synchronized control-flow graph, cross-references, string detection, a hex view, patching and saved projects. Besides PE and ELF, loaders cover retro and console formats such as DOS MZ, Win16 NE, OS/2 LE/LX, PlayStation 1, original Xbox and ZX Spectrum, with x86/x86-64, MIPS32, ARM/Thumb, ARM64, Z80 and 6502 processors.","description_zh":"跨平台交互式反汇编器，第 4 版以纯 C 重写：由 C17 引擎库、保留在本仓库中的 Qt6 图形界面，以及以共享库形式加载的加载器、处理器和分析器插件组成。反汇编列表支持重命名、注释和类型化数据，并提供同步的控制流图、交叉引用、字符串检测、十六进制视图、补丁和项目保存。除 PE 和 ELF 外，加载器还支持 DOS MZ、Win16 NE、OS/2 LE/LX、PlayStation 1、初代 Xbox 和 ZX Spectrum 等复古及主机格式，处理器涵盖 x86/x86-64、MIPS32、ARM/Thumb、ARM64、Z80 和 6502。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","game"],"verified_at":"2026-10-19"},{"id":"protobuf-inspector","name":"protobuf-inspector","name_zh":"protobuf-inspector 未知定义 Protobuf 解析工具","url":"https://github.com/mildsunrise/protobuf-inspector","evidence_url":"https://github.com/mildsunrise/protobuf-inspector/blob/3211be9c2fb1d24e788ff492571cd0ba895c519a/README.md","description_en":"Parses Protocol Buffers blobs (proto2 or proto3) without their .proto definition and prints a colored view of the fields in wire order, trying each length-delimited chunk as a nested message, then a packed array, a string and finally a hexdump. Analysts record what they work out in a protobuf_config.py file, with field types and names, message and enum types and custom native types, until the parser no longer has to guess. Field names, zig-zag encoding, signedness and integer-versus-float choices cannot be read from the wire, and the README says guesses can be wrong, especially for small chunks.","description_zh":"无需对应的 .proto 定义即可解析 Protocol Buffers 数据块（proto2 或 proto3），按线路编码顺序以彩色输出字段；对每个长度限定的数据块，依次尝试解析为嵌套消息、打包数组、字符串，最后退回十六进制转储。分析者把推断出的内容写入 protobuf_config.py，包括字段类型与名称、消息和枚举类型以及自定义原生类型，直到解析器不再需要猜测。字段名、zig-zag 编码、有无符号以及整数还是浮点数，都无法从线路数据中读出；README 也说明猜测可能出错，小数据块尤甚。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"lighthouse","name":"Lighthouse","name_zh":"Lighthouse 代码覆盖率浏览插件","url":"https://github.com/gaasedelen/lighthouse","evidence_url":"https://github.com/gaasedelen/lighthouse/blob/562595be9bd99e8a5dfef6017d608467f5706630/README.md","description_en":"Code-coverage explorer plugin for IDA Pro and Binary Ninja that loads execution traces of native programs and paints the executed code across the disassembler's views, without needing symbols or source. Its coverage overview lists per-function coverage, and a composing shell combines loaded coverage sets with logical operators to diff runs, filter functions and jump to addresses, while coverage cross-references show which of many batch-loaded sets executed a block. It reads DynamoRIO drcov logs, module+offset, absolute-address and Tenet traces, writes basic HTML coverage reports, and ships a prototype Intel Pin tool and a Frida script that produce drcov-compatible logs.","description_zh":"面向 IDA Pro 和 Binary Ninja 的代码覆盖率浏览插件，载入原生程序的执行轨迹，并在反汇编器的各个视图中为已执行代码着色，无需符号或源码。覆盖率总览按函数列出覆盖情况；组合命令行可用逻辑运算符组合已载入的覆盖率集合，用于比较多次运行的差异、筛选函数或跳转到指定地址；覆盖率交叉引用则显示批量载入的众多集合中哪些执行过某个基本块。它可读取 DynamoRIO drcov 日志、模块+偏移、绝对地址和 Tenet 轨迹，能生成简单的 HTML 覆盖率报告，并附带可输出 drcov 兼容日志的原型 Intel Pin 工具和 Frida 脚本。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"racewave46-wave-race-64-recomp-case","name":"RaceWave46: an AI-assisted Wave Race 64 recompilation for Windows","name_zh":"RaceWave46：AI 辅助的《Wave Race 64》Windows 重编译","url":"https://github.com/DomazinUS/RaceWave46","evidence_url":"https://github.com/DomazinUS/RaceWave46/blob/5c34f3711426978107707a8f06af9c2af4ee5401/README.md","description_en":"Recompiles the USA Rev 1 Nintendo 64 release of Wave Race 64 into a native Windows application with N64Recomp and RSPRecomp, on modified copies of the N64ModernRuntime, RecompFrontend and RT64 stacks. Game and microcode C is generated locally from the user’s ROM, after an included widescreen patch is applied to a temporary copy, and checked against recorded checksums. The port adds higher resolutions, frame interpolation, ultrawide views, rasterized and ray-traced reflections and shadows, split-screen or separate-window two-player play and RetroAchievements; the maintainer calls it an AI-assisted recompilation.","description_zh":"使用 N64Recomp 与 RSPRecomp，在经修改的 N64ModernRuntime、RecompFrontend 和 RT64 之上，将 Nintendo 64 版《Wave Race 64》美版 Rev 1 重编译为 Windows 原生程序。游戏与微码的 C 代码在本地由使用者的 ROM 生成：先将随附的宽屏补丁应用到临时副本，再按记录的校验和核对生成结果。移植加入了更高分辨率、帧插值、超宽视野、光栅化与光线追踪的反射和阴影、分屏或分窗口的双人游戏以及 RetroAchievements；维护者称其为 AI 辅助的重编译。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"opendrop-airdrop-reimplementation-case","name":"OpenDrop: an open reimplementation of Apple AirDrop","name_zh":"OpenDrop：Apple AirDrop 的开源重新实现","url":"https://github.com/seemoo-lab/opendrop","evidence_url":"https://github.com/seemoo-lab/opendrop/blob/11fe7ba7861093b302bc0637e8cb10adf2d29337/README.md","description_en":"Python command-line reimplementation of Apple's AirDrop protocol from SEEMOO Lab's reverse-engineering research. It finds receivers via _airdrop._tcp DNS-SD, sends binary-plist /Discover and /Ask requests over HTTPS and uploads gzip-compressed CPIO archives to exchange files with iOS and macOS. It is not affiliated with Apple.","description_zh":"基于 SEEMOO 实验室逆向研究、用 Python 编写的 Apple AirDrop 协议命令行重新实现。它通过 _airdrop._tcp DNS-SD 发现接收方，经 HTTPS 发送二进制 plist 格式的 /Discover 和 /Ask 请求，并上传 gzip 压缩的 CPIO 归档，与 iOS 和 macOS 设备互传文件。它与 Apple 无关联。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"chipsec","name":"CHIPSEC","name_zh":"CHIPSEC 平台安全评估框架","url":"https://github.com/chipsec/chipsec","evidence_url":"https://github.com/chipsec/chipsec/blob/c11756375417cc859e25a98e0788849ebd6eb8cc/README.md","description_en":"Platform security assessment framework, with Intel Corporation copyright notices, for analyzing PC hardware configuration, BIOS/UEFI system firmware and platform components from Windows, Linux or the UEFI shell. chipsec_main runs check modules that report whether expected protections are in place, such as BIOS and SPI flash write protection and locks, SMM and SMRR protection, memory-map locks and Secure Boot variables, as PASSED, FAILED, WARNING or informational results with JSON, XML and Markdown output. chipsec_util gives command-line and Python access to low-level interfaces and firmware data, including dumping the SPI flash to an image, decoding flash images into firmware volumes, files and NVRAM variables, and listing UEFI variables and tables.","description_zh":"平台安全评估框架（源码带有 Intel Corporation 版权声明），可在 Windows、Linux 或 UEFI Shell 中分析 PC 硬件配置、BIOS/UEFI 系统固件及平台组件。chipsec_main 运行检查模块，报告预期的保护措施是否到位，例如 BIOS 与 SPI 闪存的写保护和锁定、SMM 与 SMRR 保护、内存映射锁定及安全启动变量，结果分为 PASSED、FAILED、WARNING 和信息类，并可输出 JSON、XML 和 Markdown。chipsec_util 通过命令行和 Python 访问底层接口和固件数据，包括将 SPI 闪存转储为镜像、把闪存镜像解析为固件卷、文件和 NVRAM 变量，以及列出 UEFI 变量和表。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-19"},{"id":"apk-studio","name":"APK Studio","name_zh":"APK Studio Android 逆向 IDE","url":"https://github.com/vaibhavpandeyvpz/apkstudio","evidence_url":"https://github.com/vaibhavpandeyvpz/apkstudio/blob/c6e2724786f6e25323d20db1c1ceb2160fbc1ee9/README.md","description_en":"Qt6 desktop front end that drives Apktool, JADX, uber-apk-signer and ADB from an IDE-style workspace for Android packages. It decodes an APK into smali and resources, optionally adds JADX Java output, then rebuilds, signs (with optional keystore generation and zipalign) and installs the result on a selected device; manufacturer framework files and extra Apktool arguments can be supplied. Decoded projects open in a file tree with syntax-highlighted smali, Java, XML and YAML editing, an image viewer, a hex editor and search across files.","description_zh":"基于 Qt6 的桌面前端，在 IDE 式工作区中调用 Apktool、JADX、uber-apk-signer 和 ADB 处理 Android 安装包。它将 APK 解码为 smali 和资源文件，可选附加 JADX 生成的 Java 代码，随后重新打包、签名（可生成密钥库并执行 zipalign）并安装到所选设备；还可指定厂商框架文件和额外的 Apktool 参数。解码后的项目以文件树形式打开，提供 smali、Java、XML 和 YAML 的语法高亮编辑、图片查看器、十六进制编辑器和跨文件搜索。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"valetudo-robot-cloud-replacement-case","name":"Valetudo: local replacement for robot-vacuum vendor clouds","name_zh":"Valetudo：扫地机器人厂商云的本地替代","url":"https://github.com/Hypfer/Valetudo","evidence_url":"https://github.com/Hypfer/Valetudo/blob/78267517d3036258322b6760ba8a9979d197e249/README.md","description_en":"Replaces the vendor cloud of supported robot vacuums with a local service that runs on the rooted robot beside the vendor firmware and emulates the cloud endpoints that firmware expects, including a miio dummycloud and a counterpart for Midea's MSmart protocol. Its FAQ says each new vendor backend meant reverse engineering data formats, authentication and communication without vendor documentation; Valetudo converts the proprietary map formats into one ValetudoMap format and keeps Kaitai Struct descriptions of Dreame, Roborock and Viomi map files and a Midea protobuf schema as references. It adds a web interface, a REST API with Swagger UI and MQTT/Home Assistant integration, while feature parity with the vendor apps is an explicit non-goal.","description_zh":"用运行在已 root 机器人上、与厂商固件并存的本地服务取代受支持扫地机器人的厂商云，并模拟固件所期待的云端接口，包括 miio 模拟云（dummycloud）以及对应 Midea MSmart 协议的实现。其 FAQ 说明，每支持一个新厂商，都需要在没有厂商文档的情况下逆向分析数据格式、认证和通信；Valetudo 将各家专有地图格式转换为统一的 ValetudoMap 格式，并保留 Dreame、Roborock、Viomi 地图文件的 Kaitai Struct 描述和一份 Midea protobuf 模式作为参考。它提供网页界面、带 Swagger UI 的 REST API 以及 MQTT／Home Assistant 集成，但明确不以与厂商应用功能对等为目标。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["firmware","protocol"],"verified_at":"2026-10-19"},{"id":"sourcemapper","name":"sourcemapper","name_zh":"sourcemapper 源映射源码还原工具","url":"https://github.com/denandz/sourcemapper","evidence_url":"https://github.com/denandz/sourcemapper/blob/f739bd5dd266b0d0e2cfa17c0a132f79bd9a5ba9/README.md","description_en":"Go command-line tool that recreates a web front end's original JavaScript source tree from a source map generated by webpack or a similar bundler, writing each embedded source file under the path the map records. It takes a .map file by URL or local path, walks a directory of .map files, or fetches a JavaScript file and follows its sourceMappingURL comment or SourceMap response header, including inline data: maps.","description_zh":"Go 编写的命令行工具，可根据 webpack 等打包工具生成的源映射（source map）重建网站前端原有的 JavaScript 源码目录树，并把映射中内嵌的每个源文件写到其记录的路径下。它可通过 URL 或本地路径读取 .map 文件，递归处理整个目录中的 .map 文件，也可抓取 JavaScript 文件并跟随其中的 sourceMappingURL 注释或 SourceMap 响应头，内联的 data: 映射同样支持。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-19"},{"id":"jazz2-resurrection-engine-case","name":"Jazz² Resurrection: a native C++ reimplementation of Jazz Jackrabbit 2","name_zh":"Jazz² Resurrection：《爵士兔 2》的原生 C++ 重新实现","url":"https://github.com/deathkiller/jazz2-native","evidence_url":"https://github.com/deathkiller/jazz2-native/blob/c18381c246271d76c70af723a8ab5615028e3c6c/README.md","description_en":"Reimplements Jazz Jackrabbit 2 (1998) as a native C++ game on an extensively modified nCine engine, converting the user’s original game files into its own cache on first start. It runs on desktop, mobile, web and many homebrew console targets, with multiplayer, an enhanced Reforged mode and partial JJ2+ and MLLE support. A two-sided trajectory probe checks its non-Reforged movement against the original game, and the project reports 376 of 406 scenarios within 25 px/s.","description_zh":"以原生 C++ 在深度修改的 nCine 引擎上重新实现《爵士兔 2》（Jazz Jackrabbit 2，1998），首次启动时把使用者的原版游戏文件转换为自己的缓存。它可在桌面、移动设备、网页和众多自制软件主机平台上运行，支持多人游戏、增强的 Reforged 模式，并部分支持 JJ2+ 与 MLLE。项目用一个双向轨迹探针把非 Reforged 模式的移动与原版游戏对照，报告 406 个场景中有 376 个误差在 25 px/s 以内。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"binabsinspector","name":"BinAbsInspector","name_zh":"BinAbsInspector 二进制漏洞静态扫描工具","url":"https://github.com/KeenSecurityLab/BinAbsInspector","evidence_url":"https://github.com/KeenSecurityLab/BinAbsInspector/blob/658b41389b2fc16c2fcd4bfc5610f6c26d31ca6f/README.md","description_en":"Static vulnerability scanner from Tencent Keen Lab that runs as a Ghidra extension or headless script and applies abstract interpretation to Ghidra's P-code rather than to assembly, covering x86, x64, ARMv7 and AArch64 binaries. Its flow- and context-sensitive interprocedural analysis, with configurable value-set size and call-string depth, optional Z3 constraint solving and models of external functions, feeds checkers for 13 CWE classes, including command injection, buffer overflows and out-of-bounds access, format strings, integer overflow, double free, use-after-free and NULL dereference. Warnings list the instruction address and its call context, in the Ghidra console or as JSON.","description_zh":"腾讯科恩实验室开发的二进制静态漏洞扫描工具，以 Ghidra 扩展或无界面脚本方式运行，在 Ghidra 的 P-code 而非汇编上进行抽象解释，支持 x86、x64、ARMv7 和 AArch64 二进制。它执行流敏感、上下文敏感的过程间分析，可配置值集合大小和调用串深度，可选用 Z3 约束求解，并对外部函数建模，在此基础上运行 13 类 CWE 检查，涵盖命令注入、缓冲区溢出与越界访问、格式化字符串、整数溢出、重复释放、释放后使用和空指针解引用等。告警会列出指令地址及其调用上下文，显示在 Ghidra 控制台中或以 JSON 输出。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"libimobiledevice","name":"libimobiledevice","name_zh":"libimobiledevice iOS 设备协议库","url":"https://github.com/libimobiledevice/libimobiledevice","evidence_url":"https://github.com/libimobiledevice/libimobiledevice/blob/fa0f79190142bc309307967c058f89c1b36eb6b8/README.md","description_en":"C library and command-line tools that speak iOS devices' native service protocols without Apple's proprietary libraries or a jailbreak. Over usbmuxd or Wi-Fi sync it implements lockdownd pairing and services such as AFC file access, backup, app installation, crash reports, syslog, debugserver and WebKit inspection, plus Cython bindings.","description_zh":"用 C 编写的库及命令行工具，无需 Apple 的专有库或越狱即可使用 iOS 设备的原生服务协议通信。它经 usbmuxd 或 Wi-Fi 同步连接，实现 lockdownd 配对，以及 AFC 文件访问、备份、应用安装、崩溃报告、系统日志、debugserver 和 WebKit 检查等服务，并提供 Cython 绑定。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["app","protocol"],"verified_at":"2026-10-19"},{"id":"ngrev","name":"ngrev","name_zh":"ngrev Angular 应用结构分析工具","url":"https://github.com/mgechev/ngrev","evidence_url":"https://github.com/mgechev/ngrev/blob/edd1ee316a7f2a0d9ddbf94ae91bb0b624997edb/README.md","description_en":"Electron desktop application that statically analyzes an Angular project's TypeScript sources and draws interactive graphs of its NgModules, components, directives, pipes and providers and how they depend on each other, without running the application. A project is loaded through its tsconfig file; views move from the module tree to individual modules, templates and providers, with fuzzy symbol search and PNG export of the current graph.","description_zh":"一款 Electron 桌面应用，对 Angular 项目的 TypeScript 源码做静态分析，以交互式图形展示其中的 NgModule、组件、指令、管道和服务提供者及其依赖关系，无需运行该应用。通过项目的 tsconfig 文件载入后，可从模块树逐层查看单个模块、模板和提供者，支持符号模糊搜索，并可将当前图形导出为 PNG。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-19"},{"id":"apkid","name":"APKiD","name_zh":"APKiD Android 加壳与混淆识别工具","url":"https://github.com/rednaga/APKiD","evidence_url":"https://github.com/rednaga/APKiD/blob/5cb6b2572a2fe1580d7dd2fd807ada5fb6377a12/README.md","description_en":"PEiD-style identifier for Android packages from RedNaga. It scans APK and DEX files, nested ZIP entries and the native ELF libraries, PE DLLs and resources inside them with YARA rules, using the yara-python-dex DEX module, and reports the compilers, packers, protectors, obfuscators and anti-VM or anti-disassembly tricks it recognizes, per file or as JSON. Optional tracker rules attributed to the Exodus API flag embedded tracking SDKs; APKiD only identifies, and does not unpack or deobfuscate anything.","description_zh":"RedNaga 推出的 Android 安装包识别工具，类似 PEiD。它借助 yara-python-dex 的 DEX 模块，用 YARA 规则扫描 APK、DEX 文件、嵌套的 ZIP 条目及其中的原生 ELF 库、PE 格式 DLL 和资源，报告识别出的编译器、加壳工具、保护工具、混淆工具以及反虚拟机或反反汇编手法，可按文件输出或输出 JSON。可选的追踪器规则注明来自 Exodus API，用于标出内嵌的追踪 SDK；APKiD 只做识别，不会脱壳或反混淆。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"jsluice","name":"jsluice","name_zh":"jsluice JavaScript 静态提取工具","url":"https://github.com/BishopFox/jsluice","evidence_url":"https://github.com/BishopFox/jsluice/blob/0ddfab153e060a9eeaded4d8669233f7c071e7e4/README.mkd","description_en":"Bishop Fox's Go library and command-line tool that parses JavaScript with tree-sitter to recover the endpoints a script calls, judging values by how the code uses them rather than by regular expressions alone. URL extraction follows location assignments, window.open, fetch, XMLHttpRequest and jQuery request calls, keeps the HTTP method, headers and query or body parameters, and stands in a placeholder for values only known at run time. Other modes flag credential-shaped values, print syntax trees, run tree-sitter queries and reformat minified code.","description_zh":"Bishop Fox 推出的 Go 库与命令行工具，借助 tree-sitter 解析 JavaScript，还原脚本所调用的接口地址；它依据代码如何使用某个值来判断，而不仅仅依靠正则表达式。URL 提取会跟踪 location 赋值、window.open、fetch、XMLHttpRequest 和 jQuery 请求调用，保留 HTTP 方法、请求头以及查询或请求体参数，并以占位符代替只有运行时才能确定的值。其他模式可标记形似凭据的值、打印语法树、运行 tree-sitter 查询以及格式化压缩代码。","kind":"tool","category":"web-analysis","group":"tools","relationship":"foundation","targets":["website"],"verified_at":"2026-10-19"},{"id":"lba2remake-little-big-adventure-case","name":"LBA2 Remake: a Little Big Adventure 1 and 2 reimplementation in TypeScript and Three.js","name_zh":"LBA2 Remake：以 TypeScript 和 Three.js 重新实现 Little Big Adventure 1 与 2","url":"https://github.com/LBALab/lba2remake","evidence_url":"https://github.com/LBALab/lba2remake/blob/db54f5de071354939a8b02e71e47c53343ab6ee5/README.md","description_en":"Reimplements the engine of Little Big Adventure 2, and now also Little Big Adventure 1, in TypeScript, Three.js and React so that it runs in a browser on resources imported from the user’s copy of the game. README calls it a full re-engineering rather than a disassembly-based approach: every island and building can be explored and most graphics and part of the gameplay work, but the game cannot yet be completed. It adds an editor with an actor-script debugger, VR support and fan-made 3D replacement models for the isometric scenes.","description_zh":"用 TypeScript、Three.js 和 React 重新实现 Little Big Adventure 2 的引擎，现在也涵盖 Little Big Adventure 1，在浏览器中运行，资源从使用者自有的游戏中导入。README 称这是完全重新设计实现，而非基于反汇编的方法：所有岛屿和建筑都可以探索，大部分图形和部分玩法已经可用，但游戏目前还无法通关。项目另外提供带角色脚本调试器的编辑器、VR 支持，以及由爱好者为等距场景制作的 3D 替换模型。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"vulhunt","name":"VulHunt Community Edition","name_zh":"VulHunt 社区版漏洞挖掘框架","url":"https://github.com/vulhunt-re/vulhunt","evidence_url":"https://github.com/vulhunt-re/vulhunt/blob/b2fa617923f47d84a57899137107380391700b64/README.md","description_en":"Open-source Community Edition of Binarly REsearch's VulHunt engine for hunting vulnerabilities in POSIX binaries and UEFI firmware on x86 and ARM. Lua rules run on the Rust BIAS framework, which lifts code to Ghidra's P-code and bundles Ghidra's C++ decompiler, and combine taint and dataflow tracking, Weggli-based queries over decompiled code, byte patterns, FLIRT signatures and type libraries; findings are written as JSON with annotated decompiled code. The CLI scans single binaries, Binarly BA2 archives or Binary Ninja databases, and can also run as an MCP server that lets AI assistants open a project, query it with Lua, rename functions and keep notes.","description_zh":"Binarly REsearch 团队 VulHunt 引擎的开源社区版，用于在 x86 和 ARM 架构的 POSIX 二进制和 UEFI 固件中挖掘漏洞。Lua 规则运行在 Rust 编写的 BIAS 框架之上（该框架将代码提升为 Ghidra P-code，并内置 Ghidra 的 C++ 反编译器），可结合污点与数据流追踪、基于 Weggli 的反编译代码查询、字节模式、FLIRT 签名和类型库进行检测；结果以 JSON 输出，并附带标注后的反编译代码。命令行可扫描单个二进制、Binarly BA2 归档或 Binary Ninja 数据库，也可作为 MCP 服务器运行，让 AI 助手打开项目、用 Lua 查询、重命名函数并记录注释。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary","firmware"],"verified_at":"2026-10-19"},{"id":"sniffle","name":"Sniffle","name_zh":"Sniffle 蓝牙低功耗嗅探器","url":"https://github.com/nccgroup/Sniffle","evidence_url":"https://github.com/nccgroup/Sniffle/blob/3a53f5ab21df7599ad0c46475d322603c1a54bb7/README.md","description_en":"NCC Group's sniffer for Bluetooth 5 and 4.x Low Energy, made of firmware for TI CC1352/CC26x2 radio boards and Python host tools. It captures advertising and connection traffic on the 1M, 2M and coded PHYs, follows connections through channel-map, connection-parameter and PHY changes, captures BT5 extended advertising, and filters by MAC address, IRK, RSSI or advertisement content; for a filtered target it hops all three primary advertising channels, which the README says makes connection detection nearly three times more reliable than single-channel sniffers. Captures are saved as Ubertooth-compatible PCAP, a Wireshark extcap plugin starts captures from the Wireshark GUI, and command-line decoders print advertising data, including Apple and Microsoft manufacturer-specific fields.","description_zh":"NCC Group 推出的蓝牙 5 与 4.x 低功耗（BLE）嗅探器，由运行在 TI CC1352/CC26x2 射频板上的固件和 Python 主机工具组成。它可在 1M、2M 和编码 PHY 上捕获广播与连接流量，跟随连接经历的信道映射、连接参数和 PHY 变更，捕获 BT5 扩展广播，并按 MAC 地址、IRK、RSSI 或广播内容过滤；对已过滤的目标会在全部三个主广播信道间跳频，README 称这使连接检测的可靠性比只监听单一信道的嗅探器高出近三倍。捕获结果保存为与 Ubertooth 兼容的 PCAP；Wireshark extcap 插件可直接从 Wireshark 界面启动捕获，命令行解码器可打印广播数据，包括 Apple 和 Microsoft 的厂商自定义字段。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"dex2jar","name":"dex2jar","name_zh":"dex2jar Android DEX 转换工具集","url":"https://github.com/pxb1988/dex2jar","evidence_url":"https://github.com/pxb1988/dex2jar/blob/b5bda4fb4935ae8b3869b422454ae3b3896c7bc1/README.md","description_en":"Java toolkit that converts Android DEX bytecode, including DEX inside APKs, into JVM .class files packed as a jar for Java decompilers and bytecode tools. It also reads and writes DEX through an ASM-like API, disassembles and assembles smali with its own implementation, converts jars back to DEX and ships helpers such as d2j-decrypt-string.","description_zh":"用 Java 编写的工具集，可将 Android DEX 字节码（包括 APK 内的 DEX 文件）转换为打包成 jar 的 JVM .class 文件，供 Java 反编译器和字节码工具使用。它还通过类似 ASM 的 API 读写 DEX，以自有实现进行 smali 反汇编与汇编，可将 jar 转回 DEX，并附带 d2j-decrypt-string 等辅助工具。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"binsync","name":"BinSync","name_zh":"BinSync 协同逆向插件","url":"https://github.com/binsync/binsync","evidence_url":"https://github.com/binsync/binsync/blob/07a2ce87638b25728564cbc5198e1bd945d4d70c/README.md","description_en":"Decompiler plugin for collaborative reverse engineering that records each analyst's work in a shared Git repository, one branch per user, so teammates can pull, push or auto-push changes across IDA Pro, Binary Ninja, Ghidra and angr-management. Synced artifacts are function headers (names, arguments and types), stack and global variables, structs, enums and comments, including user-defined types. It is built by mahaloz, the angr team and the SEFCOM research lab and is used by the Shellphish hacking team; scripting goes through the separate DecLib library.","description_zh":"用于协同逆向工程的反编译器插件，把每位分析者的工作记录在共享 Git 仓库中（每位用户一个分支），队友可在 IDA Pro、Binary Ninja、Ghidra 和 angr-management 之间拉取、推送或自动推送更改。可同步的内容包括函数头（名称、参数和类型）、栈变量和全局变量、结构体、枚举和注释，并支持用户自定义类型。它由 mahaloz、angr 团队和 SEFCOM 研究实验室开发，并被 Shellphish 黑客团队使用；脚本操作需借助独立的 DecLib 库。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"class-dump","name":"class-dump","name_zh":"class-dump Objective-C 头文件生成工具","url":"https://github.com/nygard/class-dump","evidence_url":"https://github.com/nygard/class-dump/blob/2c82b4ff12b2ea5d1ac23e49281d496997370841/README.md","description_en":"Command-line utility that reads the Objective-C runtime metadata in Mach-O executables, frameworks and bundles and prints it as ordinary Objective-C declarations for the classes, categories and protocols it finds, the same information otool -ov shows in a more compact form. It can write one header file per class, recurse into the frameworks a binary uses, choose one architecture from a universal binary, filter or sort the output, and annotate it with instance-variable offsets and implementation addresses.","description_zh":"一款命令行工具，读取 Mach-O 可执行文件、框架和 bundle 中的 Objective-C 运行时元数据，并将其中的类、类别和协议输出为常规的 Objective-C 声明；信息与 otool -ov 所显示的相同，但形式更紧凑。它可以为每个类生成一个头文件，递归展开二进制所用的框架，从通用二进制中选择单一架构，对输出进行筛选或排序，并标注实例变量偏移和方法实现地址。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["app","binary"],"verified_at":"2026-10-19"},{"id":"openawe-alan-wake-engine-case","name":"OpenAWE: an open reimplementation of Remedy’s Alan Wake engine","name_zh":"OpenAWE：Remedy 的 Alan Wake 引擎的开源重新实现","url":"https://github.com/OpenAWE-Project/OpenAWE","evidence_url":"https://github.com/OpenAWE-Project/OpenAWE/blob/cce15d3bc289df31522d778fb8e99180e6752b58/README.md","description_en":"Reimplements Remedy Entertainment’s Alan Wake engine, later known as Northlight, in C++ and OpenGL, aiming to run Alan Wake and Alan Wake’s American Nightmare portably from the user’s game data, with Quantum Break and possibly Control as later goals. README documents only a free camera for moving through loaded game data, and the American Nightmare script table implements 16 of its 278 native functions. The repository also includes command-line tools for the games’ archive, texture, Havok and sound formats.","description_zh":"以 C++ 和 OpenGL 重新实现 Remedy Entertainment 的 Alan Wake 引擎（后来称为 Northlight），目标是借助使用者自己的游戏数据，以可移植方式运行《心灵杀手》和《心灵杀手：美国梦魇》，并把《量子破碎》乃至《控制》列为后续目标。README 只介绍了一个用于在已加载游戏数据中移动的自由视角相机，《美国梦魇》的脚本函数表在 278 个原生函数中实现了 16 个。仓库还附带处理这些游戏的归档、纹理、Havok 和音频格式的命令行工具。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"cps2recomp-arcade-static-recomp-case","name":"CPS-2 Recomp: static recompilation of Capcom CPS-2 and CPS-1 arcade games","name_zh":"CPS-2 Recomp：Capcom CPS-2 与 CPS-1 街机游戏的静态重编译","url":"https://github.com/tmcleroy/cps2recomp","evidence_url":"https://github.com/tmcleroy/cps2recomp/blob/74e26fb10e166fbfacfb1e6520fbc05e400642b1/README.md","description_en":"Translates the 68000 game programs and Z80 sound programs of Capcom arcade boards ahead of time into C++ and runs them on a machine model written for the project, with an interpreter for code that has not been translated. One launcher covers Street Fighter Alpha and Alpha 2, Super Puzzle Fighter II Turbo, Vampire Savior and its variants, Vampire Hunter 2, Alien vs. Predator and the CPS-1 Cadillacs and Dinosaurs, adding training modes, widescreen and three-player options. Translated code is generated from the user’s own ROM sets, and a check build compares it block by block with the interpreter.","description_zh":"将 Capcom 街机基板上的 68000 游戏程序与 Z80 声音程序预先转译为 C++，并在为本项目编写的机器模型上运行，尚未转译的代码则交给解释器执行。一个启动器涵盖《街头霸王 Alpha》及《Alpha 2》、《超级益智战士 II Turbo》、《恶魔战士：救世主》及其变体、《恶魔猎人 2》、《异形大战铁血战士》以及 CPS-1 平台的《恐龙新世纪》，并加入训练模式、宽屏和三人游戏选项。转译代码由使用者自有的 ROM 套装生成，专门的检查构建会逐个代码块将其与解释器对比。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"binbloom","name":"binbloom","name_zh":"binbloom 原始固件端序与基址分析工具","url":"https://github.com/quarkslab/binbloom","evidence_url":"https://github.com/quarkslab/binbloom/blob/95cfaacf2dfcbeba51c7d09132f188331449ec24/README.md","description_en":"Quarkslab command-line tool that infers basic properties of a headerless raw firmware image from simple statistics on its content, which is why the README says it works with any architecture. It guesses endianness from how the high bytes of pointer-sized values cluster under each byte order, and ranks candidate loading (base) addresses by how many values would then point at indexed text strings and pointer arrays. Given a base address, it also searches automotive ECU firmware for a table of Unified Diagnostic Services (UDS) command IDs and prints the inferred structure layout for use in a disassembler.","description_zh":"Quarkslab 开发的命令行工具，通过对内容做简单统计来推断无文件头原始固件镜像的基本属性，因此 README 称其适用于所有架构。它根据指针宽度数值的高位字节在两种字节序下的聚集程度推测端序，并按候选加载地址（基址）下有多少数值会指向已索引的文本字符串和指针数组，对候选地址排序。给定基址后，它还能在汽车 ECU 固件中查找统一诊断服务（UDS）命令 ID 表，并输出推断出的结构体布局，供反汇编器使用。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-19"},{"id":"packetry","name":"Packetry","name_zh":"Packetry USB 2.0 协议分析工具","url":"https://github.com/greatscottgadgets/packetry","evidence_url":"https://github.com/greatscottgadgets/packetry/blob/5a7f98b77aa00519ecf7e811c9f26c6534966d05/README.md","description_en":"Great Scott Gadgets' USB 2.0 protocol analysis application for live capture with the Cynthion analyzer or for exploring previously captured traffic, working from physical-layer packet data at High, Full and Low Speed. Its GTK 4 interface offers a hierarchical view that expands high-level events into their transactions and packets, plus chronological transaction and packet views, while a device pane summarizes each observed device from its decoded descriptors, including HID report descriptors. Captures are opened and saved as pcap files with the LINKTYPE_USB_2_0 link type, and v0.5.0 added pcapng with custom blocks for non-packet events.","description_zh":"Great Scott Gadgets 推出的 USB 2.0 协议分析应用，可配合 Cynthion 分析仪实时捕获，也可浏览已捕获的流量，处理高速、全速和低速 USB 的物理层数据包。其 GTK 4 界面提供分层视图，可将高层事件逐级展开为事务和数据包，另有按时间顺序排列的事务视图和数据包视图；设备面板则根据解码后的描述符（包括 HID 报告描述符）汇总每个观察到的设备。捕获以 LINKTYPE_USB_2_0 链路类型的 pcap 文件打开和保存，v0.5.0 还加入了带有非数据包事件自定义块的 pcapng 格式。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"lucid-microcode-explorer","name":"Lucid","name_zh":"Lucid Hex-Rays 微码浏览器","url":"https://github.com/gaasedelen/lucid","evidence_url":"https://github.com/gaasedelen/lucid/blob/9f2480dc8e6bbb9421b5711533b0a98d2e9fb5af/README.md","description_en":"IDA Pro plugin by Markus Gaasedelen for studying how the Hex-Rays decompiler transforms its microcode intermediate language. Opened from a Pseudocode window with View microcode, its explorer stays synchronized with the pseudocode and lets the user scroll a selected microinstruction through each microcode maturity level, tracing sub-operands back to their origins and changing the cursor color when the traced code has been optimized away. Nested sub-instructions can be shown as tree graphs; the author labels it a developer-oriented prototype and code resource, not a general-purpose reverse-engineering tool.","description_zh":"Markus Gaasedelen 开发的 IDA Pro 插件，用于研究 Hex-Rays 反编译器如何逐步变换其微码（microcode）中间语言。在伪代码窗口中选择 View microcode 即可打开浏览器，它与伪代码保持同步，用户可让选中的微指令依次滚动经过各个微码成熟度层级，把子操作数追溯到来源；若追踪的代码已被优化掉，光标会变色提示。嵌套的子指令可显示为树状图；作者将其定位为面向开发者的原型和代码参考，而不是通用逆向工程工具。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"bluefluff-furby-connect-ble-case","name":"bluefluff: reverse engineering Furby Connect's Bluetooth LE protocol","name_zh":"bluefluff：逆向分析 Furby Connect 的蓝牙低功耗协议","url":"https://github.com/Jeija/bluefluff","evidence_url":"https://github.com/Jeija/bluefluff/blob/9e865c47326167c2d4e6f47d96321e8e5cfc0e32/README.md","description_en":"Documents the Bluetooth Low Energy interface of Hasbro's Furby Connect toy, worked out, according to its notes, from the companion app's native library, sniffed BLE traffic and trial and error. It maps the GATT services and the command and response bytes of the toy's Nordic radio and GeneralPlus controller, covering action sequences, antenna colour, mood values, sensor reports and a hidden debug screen. fluffd, a Node.js daemon built on the noble BLE library, exposes these commands through an HTTP API and a browser control page.","description_zh":"记录 Hasbro 玩具 Furby Connect 的蓝牙低功耗（BLE）接口；据其说明，这些内容来自对配套应用原生库的分析、BLE 流量嗅探和反复试验。文档梳理了 GATT 服务，以及玩具中 Nordic 无线芯片和 GeneralPlus 控制器的命令与响应字节，涵盖动作序列、天线颜色、情绪数值、传感器报告和一个隐藏的调试界面。fluffd 是基于 noble BLE 库的 Node.js 守护进程，通过 HTTP API 和浏览器控制页面提供这些命令。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"apk-sh","name":"apk.sh","name_zh":"apk.sh Android 应用分析脚本","url":"https://github.com/ax/apk.sh","evidence_url":"https://github.com/ax/apk.sh/blob/2a1ed25e861dacfb4fec1aef7b099813abff24ed/README.md","description_en":"Bash script that automates repetitive Android app analysis chores around apktool: pulling an installed package from a device or emulator, decoding resources and disassembling dex code, and rebuilding the decoded directory into an APK. Split APKs from app bundles are combined into a single APK when pulled, and the script can also prepare a copy for Frida instrumentation.","description_zh":"一个 Bash 脚本，围绕 apktool 自动完成 Android 应用分析中的重复性工作：从设备或模拟器拉取已安装的应用包、解码资源并反汇编 dex 代码，以及将解码后的目录重新构建为 APK。拉取 app bundle 的拆分 APK 时会将其合并为单个 APK，脚本还可以准备一份用于 Frida 插桩的副本。","kind":"tool","category":"android","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"r2dec","name":"r2dec","name_zh":"r2dec radare2 反编译插件","url":"https://github.com/wargio/r2dec-js","evidence_url":"https://github.com/wargio/r2dec-js/blob/32ada0dc8bffd1e3ec55d6134531eaae244502ed/README.md","description_en":"Decompiler plugin for radare2 that turns the disassembly of an analyzed function into pseudo-C through the pdd command. Its decompiler is written in JavaScript, with one module per architecture, compiled to QuickJS bytecode and embedded in a native radare2 core plugin; output can sit beside the assembly or offsets, show only scope blocks, casts or cross-references, render as HTML, or be written back into radare2 as comments. The README lists x86/x64, 16/32/64-bit ARM, MIPS, PowerPC (including VLE), SPARC, AVR, V850 and Dalvik, plus experimental 6502, 8051, BPF, m68k, SuperH, WebAssembly and RISC-V support.","description_zh":"radare2 的反编译插件，通过 pdd 命令把已分析函数的反汇编转换为伪 C 代码。反编译器用 JavaScript 编写，每种架构对应一个模块，编译为 QuickJS 字节码后嵌入原生的 radare2 核心插件；输出可与汇编或偏移并排显示，可只显示作用域块，可显示类型转换或交叉引用，也可输出 HTML 或作为注释写回 radare2。README 列出的架构包括 x86/x64、16/32/64 位 ARM、MIPS、PowerPC（含 VLE）、SPARC、AVR、V850 和 Dalvik，另有实验性的 6502、8051、BPF、m68k、SuperH、WebAssembly 和 RISC-V 支持。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"m1n1","name":"m1n1","name_zh":"m1n1 Apple Silicon 引导与硬件研究工具","url":"https://github.com/AsahiLinux/m1n1","evidence_url":"https://github.com/AsahiLinux/m1n1/blob/7cde7d1a784d851ebfee5579fa363c38b14150c0/README.md","description_en":"Asahi Linux's bootloader and hardware-research environment for Apple Silicon Macs. It bridges Apple's boot chain to Linux by loading appended device trees, initramfs and kernels; in proxy mode a USB link lets a Python client probe hardware live and run macOS or Linux under m1n1's hypervisor while tracing its hardware accesses.","description_zh":"Asahi Linux 面向 Apple Silicon Mac 的引导程序与硬件研究环境。它将 Apple 的启动链衔接到 Linux，加载附加在其后的设备树、initramfs 和内核；在代理模式下，Python 客户端可通过 USB 连接实时探查硬件，并在 m1n1 的虚拟机监控器中运行 macOS 或 Linux，同时追踪其硬件访问。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-19"},{"id":"svd-loader-ghidra","name":"SVD-Loader for Ghidra","name_zh":"SVD-Loader：Ghidra CMSIS-SVD 外设映射脚本","url":"https://github.com/leveldown-security/SVD-Loader-Ghidra","evidence_url":"https://github.com/leveldown-security/SVD-Loader-Ghidra/blob/4b21fa54a1f516e25e959939f6e1251263c74725/README.md","description_en":"Ghidra script from leveldown security that reads a CMSIS-SVD file, the XML format describing a microcontroller's memory-mapped peripherals and their registers, and applies it to firmware already loaded in Ghidra. It creates memory blocks for the peripheral address ranges, a structure type for each peripheral with its registers as fields, and a label at each peripheral base address, so register accesses can be read by peripheral and register name. It targets little-endian Arm Cortex-M devices and bundles a fork of the cmsis-svd parser ported to Ghidra's Jython.","description_zh":"leveldown security 发布的 Ghidra 脚本，读取 CMSIS-SVD 文件（描述微控制器内存映射外设及其寄存器的 XML 格式），并将其应用到已载入 Ghidra 的固件上。它为外设地址范围创建内存块，为每个外设生成以寄存器为字段的结构体类型，并在各外设基址处添加标签，从而可按外设和寄存器名称阅读寄存器访问。它面向小端 Arm Cortex-M 设备，并附带一份移植到 Ghidra Jython 环境的 cmsis-svd 解析器分支。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-19"},{"id":"impacto-mages-engine-case","name":"impacto: a reimplementation of the MAGES. visual-novel engine","name_zh":"impacto：MAGES. 视觉小说引擎的重新实现","url":"https://github.com/CommitteeOfZero/impacto","evidence_url":"https://github.com/CommitteeOfZero/impacto/blob/b30493852424d32c7806307486fd33edfa0bc54a/README.md","description_en":"Reimplements the MAGES. visual-novel engine, used by the Science Adventure and Memories Off series, in C++ with OpenGL, running supported titles from the user’s original data files through per-game Lua profiles in one binary. README says all endings can be reached in at least one game, Memories Off 6 T-Wave, but no game is fully complete. The project’s tracking issue lists partial support for titles including Chaos;Head Love Chu Chu, Chaos;Child Love Chu Chu, Steins;Gate and Robotics;Notes Elite.","description_zh":"以 C++ 和 OpenGL 重新实现《科学冒险》系列和《告别回忆》系列所用的 MAGES. 视觉小说引擎，通过按游戏划分的 Lua 配置，在同一个程序中运行使用者原版数据文件里的受支持作品。README 称至少有一款游戏（Memories Off 6 T-Wave）可以达成全部结局，但还没有任何游戏完全实现。项目的跟踪议题列出了对 Chaos;Head Love Chu Chu、Chaos;Child Love Chu Chu、Steins;Gate、Robotics;Notes Elite 等作品的部分支持。","kind":"case-study","category":"reconstruction-cases","group":"cases","relationship":"independent-reconstruction","targets":["game"],"verified_at":"2026-10-19"},{"id":"caringcaribou","name":"Caring Caribou","name_zh":"Caring Caribou 汽车 CAN 总线安全探索工具","url":"https://github.com/CaringCaribou/caringcaribou","evidence_url":"https://github.com/CaringCaribou/caringcaribou/blob/092eff3c2c95bb7952a2a92ac12b6c1c29035b70/README.md","description_en":"Python automotive security exploration tool, begun in the HEAVENS research project, that the README describes as a zero-knowledge tool to drop onto a CAN network and collect information about the services present. Passive modules dump CAN traffic to the terminal or a candump-format file and list every arbitration ID seen on the bus, while the UDS (ISO 14229-1), DoIP (ISO 13400-2) and XCP modules discover ECUs that answer diagnostic requests, enumerate their supported services and subservices, read data identifiers and query XCP capabilities. Its utilities provide reusable ISO-TP (ISO 15765-2) and UDS implementations, and new modules plug into a drop-in module architecture.","description_zh":"Python 编写的汽车安全探索工具，起源于 HEAVENS 研究项目；README 称它是一种无需预先了解目标的工具，可接入任意 CAN 网络并收集其中存在哪些服务的信息。被动模块可将 CAN 流量输出到终端或 candump 格式文件，并列出总线上出现的所有仲裁 ID；UDS（ISO 14229-1）、DoIP（ISO 13400-2）和 XCP 模块则可发现响应诊断请求的 ECU，枚举其支持的服务和子服务，读取数据标识符并查询 XCP 能力。其工具库提供可复用的 ISO-TP（ISO 15765-2）和 UDS 实现，新模块可通过即插即用的模块架构加入。","kind":"tool","category":"protocol-analysis","group":"tools","relationship":"foundation","targets":["protocol"],"verified_at":"2026-10-19"},{"id":"rms-runtime-mobile-security","name":"Runtime Mobile Security (RMS)","name_zh":"Runtime Mobile Security（RMS）移动应用运行时分析界面","url":"https://github.com/m0bilesecurity/RMS-Runtime-Mobile-Security","evidence_url":"https://github.com/m0bilesecurity/RMS-Runtime-Mobile-Security/blob/d07212e7edec20b14e3108860bebb4f0e8fffe40/README.md","description_en":"Frida-based web interface for observing Android and iOS apps at run time on a test device. It lists the classes and methods loaded in memory, traces method arguments and return values, generates hook templates for a selected class, finds class instances on the heap, and on Android monitors categorized framework APIs and a few libc file functions; a beta file browser covers the app's private folders.","description_zh":"基于 Frida 的 Web 界面，用于在测试设备上观察运行中的 Android 与 iOS 应用。它可列出内存中已加载的类和方法，跟踪方法参数与返回值，为选定的类生成 Hook 模板，在堆上查找类实例；在 Android 上还能按类别监控框架 API 以及少数 libc 文件函数。另有处于测试阶段的文件浏览器，可查看应用的私有目录。","kind":"tool","category":"dynamic-analysis","group":"tools","relationship":"foundation","targets":["app"],"verified_at":"2026-10-19"},{"id":"pharos","name":"Pharos","name_zh":"Pharos 二进制静态分析框架","url":"https://github.com/cmu-sei/pharos","evidence_url":"https://github.com/cmu-sei/pharos/blob/782492fe3b854c02f3b6257e9be3b6de87be1960/README.md","description_en":"Carnegie Mellon SEI's framework of automated static analysis tools for binary programs, built on LLNL's ROSE compiler infrastructure for disassembly, control-flow analysis and instruction semantics. Its best-known tool, OOAnalyzer, recovers C++ classes, methods and other object-oriented constructs from 32-bit x86 executables built with Microsoft Visual C++ by applying Prolog rules to facts about how object pointers move between functions, as described in a CCS 2018 paper, and exports JSON for an included IDA plugin or the separate Kaiju Ghidra plugin. Other tools find API call sequences (ApiAnalyzer), report static API-call parameters (CallAnalyzer), produce function hashes and YARA signatures for similarity analysis (FN2Hash, FN2Yara) and work out the conditions for reaching one address from another (PathAnalyzer).","description_zh":"卡内基梅隆大学软件工程研究所（SEI）推出的二进制程序自动化静态分析工具框架，基于劳伦斯利弗莫尔国家实验室的 ROSE 编译器基础设施完成反汇编、控制流分析和指令语义建模。其中最知名的 OOAnalyzer 跟踪对象指针在函数之间的传递，再用 Prolog 规则从这些事实中恢复 C++ 类、方法等面向对象结构，适用于 Microsoft Visual C++ 编译的 32 位 x86 可执行文件，方法见 CCS 2018 论文；结果以 JSON 导出，可供仓库自带的 IDA 插件或独立的 Kaiju Ghidra 插件使用。其他工具可查找 API 调用序列（ApiAnalyzer）、报告 API 调用的静态参数（CallAnalyzer）、生成用于相似性分析的函数哈希和 YARA 签名（FN2Hash、FN2Yara），以及求出从一个地址到达另一地址所需的条件（PathAnalyzer）。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"heimdall-rs","name":"heimdall-rs","name_zh":"heimdall-rs EVM 字节码分析工具包","url":"https://github.com/Jon-Becker/heimdall-rs","evidence_url":"https://github.com/Jon-Becker/heimdall-rs/blob/9de15de029ac1128c7c7566672d472f104a9747a/README.md","description_en":"Rust toolkit by Jonathan Becker for analyzing EVM smart-contract bytecode, particularly of contracts without verified source. Its CLI disassembles bytecode, builds control-flow graphs, decompiles it through per-function symbolic execution and heuristic post-processing passes into an ABI plus beta Solidity or Yul source, decodes raw calldata, dumps the storage slots a contract accesses over a block range, and inspects transactions by decoding their calldata, traces and logs. Targets can be raw bytecode, files, contract addresses or ENS names; function selectors are resolved against the OpenChain signature database unless that step is skipped.","description_zh":"Jonathan Becker 用 Rust 编写的 EVM 智能合约字节码分析工具包，尤其适用于未公开验证源码的合约。其命令行可反汇编字节码、生成控制流图，借助逐函数的符号执行和启发式后处理把字节码反编译为 ABI 以及测试阶段的 Solidity 或 Yul 源码，还能解码原始 calldata、导出合约在某一区块范围内访问的存储槽，并通过解码 calldata、调用跟踪和日志来检查交易。分析目标可以是原始字节码、文件、合约地址或 ENS 名称；函数选择器默认通过 OpenChain 签名数据库解析，也可跳过这一步。","kind":"tool","category":"native-analysis","group":"tools","relationship":"foundation","targets":["binary"],"verified_at":"2026-10-19"},{"id":"uefi-firmware-parser","name":"UEFI Firmware Parser","name_zh":"UEFI Firmware Parser 固件结构解析工具","url":"https://github.com/theopolis/uefi-firmware-parser","evidence_url":"https://github.com/theopolis/uefi-firmware-parser/blob/c4b8c64e7a1ca647b68db99db80ef0410d9afe79/README.rst","description_en":"Python library and uefi-firmware-parser command for identifying, parsing and extracting PC firmware images: UEFI firmware volumes, capsules, firmware file systems, files and sections, Intel PCH flash descriptors, Intel ME modules and Dell PFS update packages. An AutoParser picks the format, or a brute-force scan looks for volumes and other known objects inside an unidentified blob; results print as an object hierarchy or dump to files, with Tiano/EFI and LZMA sections decompressed by a bundled C extension. Helper scripts replace a section or file by GUID inside a volume, generate an FDF flash description from parsed volumes and output GUID labels for IDA scripts.","description_zh":"Python 库及 uefi-firmware-parser 命令行工具，用于识别、解析和提取 PC 固件镜像：UEFI 固件卷、胶囊（capsule）、固件文件系统、文件与节（section），以及 Intel PCH Flash Descriptor、Intel ME 模块和 Dell PFS 更新包。AutoParser 可自动判断格式，暴力扫描模式则在未识别的数据块中查找固件卷及其他已知对象；结果可打印为对象层级或导出为文件，Tiano/EFI 与 LZMA 压缩的节由内置 C 扩展解压。附带的脚本可按 GUID 替换固件卷中的节或文件，根据解析出的固件卷生成 FDF 闪存描述文件，并输出供 IDA 脚本使用的 GUID 标签。","kind":"tool","category":"firmware","group":"tools","relationship":"foundation","targets":["firmware"],"verified_at":"2026-10-19"}]}