App · Case study:
XY Remote: reconstructing XinYi amplifier BLE controlC2
XY Remote reconstructs BLE control for XinYi Sinilink amplifier boards in an iOS app and Swift library.
- App
- Protocol
Reviewed slopmaxxer/xy-remote@5ea829c
App · Case study:
XY Remote reconstructs BLE control for XinYi Sinilink amplifier boards in an iOS app and Swift library.
Reviewed slopmaxxer/xy-remote@5ea829c
App · Case study:
RideLink reconstructs TVS SmartXonnect scooter communication in an Android companion app.

Reviewed aiyu-ayaan/RideLink@856edba
Protocol · Case study:
lumalou reconstructs local Bluetooth LE control of the Fisher-Price Lumalou bedtime device after its companion app was discontinued.
Reviewed stramanu/lumalou@af0e3f3
App · Case study:
Scarlett MixControl replaces Focusrite's MixControl 1.10.6 on modern macOS for first-generation Scarlett interfaces.

App · Case study:
Mi Fitness Sync reconstructs workout retrieval from the Mi Fitness Android app and implements a Python CLI for activity export and Strava uploads.
Reviewed kevinkwee/Mi-Fitness-Sync@b51fd42
Protocol · Case study:
SSL Console Control implements Python control of SSL Matrix-family and Sigma mixing consoles over their native UDP protocols.
Reviewed koltyj/SSL@aacb2b0
App · Case study:
logitech-ipc-protocol reconstructs the Logi Options+ agent's local IPC messages for querying devices and changing their active host.
App · Case study:
samsung-notes-format reconstructs the handwriting geometry stored in Samsung Notes .sdocx files.
Reviewed bxff/samsung-notes-format@6f4b92a
App · Case study:
cam-server implements a backend for the Digicam Print Channel, producing responses in the format the client expects and rendering images from its templates.
Reviewed WiiLink24/cam-server@ab059bc
App · Case study:
bline investigates an earlier LINE voice-call stack and supplies tools for its custom ZLIB-compressed SIP data.
Reviewed thebabush/bline@0b70696
App · Case study:
WazeTripper connects Waze navigation to a Royal Enfield Tripper Pod by patching a Waze Android APK and sending commands over a reconstructed BLE interface.
Reviewed jnsdias/wazetripper@7c4235d
App · Case study:
device-reveng investigates a Choiceway GT6-EAU Android car head unit and rebuilds its launcher and operating-system layer.

Reviewed armeehn/device-reveng@b5c07f6
Protocol · Case study:
VTech Baby Pro Bridge reconstructs local streaming from an RM-series camera through TUTK/Kalay and VTech's X25519 and ChaCha20-Poly1305 layer.
App · Case study:
Reengineering Project for ibisPaint investigates the app's IPV artwork, IPCF configuration and IPBZ brush QR formats.
Reviewed HatLink/reeng-ibispaint@39b8224
App · Case study:
caniOn Rebirth reconstructs the Mitsubishi ZEV CAN protocol used by the caniOn v152 Android app for the i-MiEV, iOn and C-Zero.
Reviewed linuxkafe/caniOn-rebirth@abb8bb1
App · Case study:
AionLink Open investigates ICCOA CarLink connectivity for the GAC AION i60 through static analysis of Android APKs and an independently written Android client.
Reviewed codepdbh/aionlink-open@034635b
App · Case study:
claude-peer reconstructs the local Unix socket peer exchange used by Claude Code and Claude Desktop.
Reviewed nsozturk/claude-peer@0ab59df
App · Case study:
Nona investigates the Redmi Note 10 Pro Max camera's 108 MP remosaic behavior and implements a Camera2 app around the observed ISO and AecLux conditions.

Reviewed AbhiramJayasankar/redmi-note-10-pro-max-108mp-camera@d795d6b
App · Case study:
elevenlabs-reader-cli is a Python command-line client for creating ElevenLabs Reader documents and streaming their audio through the Reader WebSocket.
Protocol · Case study:
Yi M1 wireless protocol research reconstructs the camera’s BLE pairing, Wi-Fi handoff, HTTP remote-control commands and UDP live-view frame format.
Protocol · Case study:
TelloPython implements Python control of Tello drone functions available through its mobile app beyond the documented API.
Reviewed jaqxues/TelloPython@370497e
App · Case study:
Humax-CLI implements terminal control of the Humax IR4000HD receiver from findings the author attributes to reversing its Android app.
Reviewed D4Vinci/Humax-CLI@838c6cc
App · Case study:
Swish QR format documents QR-code payloads for Swish payments.
Reviewed lindskogen/swish-qr-format@aa8ea0c
App · Case study:
baseus-desktop reconstructs Baseus earbuds control in a Windows and Linux desktop client.

Reviewed elaxptr/baseus-desktop@ab2f1c4
App · Case study:
Samsung Cloud Notes reconstructs access to Samsung's private note-sync services in Mac, iOS, Android and command-line clients.
App · Case study:
Music Tag Desktop reconstructs the behavior of Android Music Tag 1.2.5.2 as a Windows music-tag editor.

Reviewed QingZhu233/music-tag-desktop@3435237
App · Case study:
vector-studio-re reconstructs the automation interface of Vector Studio 0.1.11 from its shipped Linux AppImage.
App · Case study:
AirTray reconstructs an Elgin Air app client as a Windows system-tray controller for compatible air conditioners.

App · Case study:
HikVision QR export decoder reconstructs the format of Hik-Connect device export QR codes and provides a Python decoder and renewal command.
Reviewed maxim-smirnov/hik-qr-export@65664fc
App · Case study:
ShatteredGlass reconstructs SwiftUI's Liquid Glass appearance on macOS using a layered Core Animation view.
Reviewed AlexStrNik/ShatteredGlass@0ce6e0d
App · Case study:
Grok3API implements a Python client for Grok’s mobile gRPC interface.
Reviewed boykopovar/Grok3API@a63a58b
App · Case study:
The Things Cloud Python client reconstructs part of the service's request behavior from traffic produced by the Mac app.
Reviewed disrupted/things-cloud-api@5698384
App · Case study:
NVFC implements undocumented NvAPI interfaces for NVIDIA GPU monitoring and configuration.
Reviewed graphitemaster/NVFC@b9ca5cc
App · Case study:
SingStar Mic documentation reconstructs the Android and iOS app's local discovery, catalogue and game-service exchanges.
Reviewed kevinvalk/re-singstar-mic@578384f
App · Case study:
Techstream for Linux reconstructs selected Toyota and Lexus diagnostic resource formats, command behavior and transport handling in a Python GTK4 workbench.
Reviewed gon7187/techstream@e2cec29
Protocol · Case study:
The Fluval Plant Pro 4.0 project reconstructs the light's CBOR-over-BLE control protocol from the FluvalConnect Android app.
App · Case study:
xtractedott reconstructs portions of Xfer Records' OTT VST multiband compressor in C.
Reviewed jwfeniello/xtractedott@f3d3447
App · Case study:
OpenApe reimplements the Call of Duty 4 mod tools' asset_manager.exe as a C++20 desktop editor.
Reviewed Rex109/OpenApe@628cc12
App · Case study:
EOO reconstructs the Nintendo DS Wii connection utility stored in Pokémon Diamond and Pearl.
Reviewed PikalaxALT/eoo@b4057d1
App · Case study:
PictoChat's standalone DSi system title is being reconstructed as matching C source for its ARM components.
Protocol · Case study:
Implements the proprietary protocol that AirPods use with Apple devices, which the author reports reverse-engineering, so that Android and Linux apps can switch noise-control modes, read ear detection and accurate battery levels, and use conversational awareness, head gestures and hearing-aid settings.

Reviewed librepods-org/librepods@89356c0
Protocol · Case study:
OpenHaystack uses a reconstructed Apple Find My protocol to build personal Bluetooth tracking tags and a Mac app that queries their location reports.

Reviewed seemoo-lab/openhaystack@ea05dad
App · Case study:
A cross-platform interpreter for GW-BASIC, BASICA, PCjr Cartridge BASIC, and Tandy 1000 GWBASIC.

Reviewed robhagemans/pcbasic@6a3a035
App · Case study:
Builds an open operating system intended to run applications and drivers written for the Windows NT family.
Reviewed reactos/reactos@fae4549
App · Case study:
A Linux RSS reader in Rust and GTK4 that the README calls a port of NetNewsWire.
Reviewed VirInvictus/Viaduct@a062290
App · Case study:
Repackages VNG's Zalo desktop app for Linux from the official macOS installer.
Reviewed thotam/zalo-linux@63b7293
App · Case study:
Free-BBN recreates the PlayStation Broadband Navigator dashboard as a PS2 homebrew application built with ps2sdk and gsKit.
Reviewed jegesmedve09/Free-BBN@26c9b49
App · Case study:
Serato Tags reconstructs the GEOB metadata structures that Serato DJ stores in audio files.
Reviewed Holzhaus/serato-tags@26cbdf2
App · Case study:
lsdj-decomp reconstructs Little Sound Dj 9.4.2 using tracked symbol maps, ROM analysis tools and C translations substituted into locally generated RGBDS assembly.
Reviewed tetrisgm/lsdj-decomp@49b55fa
App · Case study:
Moonlight Windows recreates NVIDIA Shield GameStream access on Windows and Windows Phone 8.1 after reverse engineering the Shield streaming software.
App · Case study:
sas7bdat reconstructs the binary layout of SAS7BDAT database files by examining sample databases for interoperability with R.
Reviewed BioStatMatt/sas7bdat@d6f8942
App · Case study:
The Outlook drag-and-drop investigation decodes the RenPrivateMessages OLE clipboard stream to recover identifiers of the original Outlook message.
App · Case study:
hbkit reconstructs the Synology Hyper Backup .hbk archive format and implements a Python file-recovery tool.

Reviewed YordiLorenzo/hbkit@db587c8
App · Case study:
Murmelbahn decodes GraviTrax course data obtained through the Ravensburger app API and presents course details and bills of materials in a web app.
Reviewed lfrancke/murmelbahn@8d7974a
App · Case study:
LSDisJ disassembles Little Sound DJ Game Boy ROM versions 9.2.L and 8.5.1 from user-provided copies.
Reviewed rbong/LSDisJ@7db8faa
App · Case study:
The h3maped project reconstructs C++ classes from the HoMM3 Horn of the Abyss map editor's executable.
Reviewed crackedmind/h3maped-decomp@b06b66f
App · Case study:
Wii Motion Plus Demo Video Player reconstructs a Wii video-player program found in several games.
Reviewed RootCubed/mpls_movie-decomp@c935a5d
App · Case study:
Cordial hosts the unmodified Roblox Android client on Linux through a ported bionic linker, ELF import resolution and substitutes for Android JNI and framework calls.

Reviewed luohoa97/cordial@378c83b
App · Case study:
The LSDj project reconstructs Little Sound Dj 9.4.0 with symbol maps, matching C functions and an RGBDS assembly tree generated from the user's ROM.
Reviewed gmoben/lsdj-decompiled@96bdca6
App · Case study:
VitalWear recreates Bandai Vital Bracelet BE gameplay as a Wear OS watch app with a phone companion.
Reviewed cfogrady/VitalWear@bb148e1
App · Case study:
Moonglow Toolset reimplements the Aurora module editor for Neverwinter Nights: Enhanced Edition in Rust, egui and wgpu.

Reviewed jadzziaa/moonglow-toolset@98e2bc6
App · Case study:
cpr2rpp documents the empirically recovered Cubase 12 CPR project format and converts selected project data into REAPER RPP files.
Reviewed daniel-lynch/cpr2rpp@7b75279
App · Case study:
wii-news-channel reconstructs the USA v7 Wii News Channel as C/C++ source intended to build a byte-identical main.dol.
App · Case study:
TraktorMappingFileFormat documents the controller-mapping data stored in Traktor Pro 2.x TSI files.
App · Case study:
AvatarEditorRecomp statically recompiles the Fall 2010 Kinect-preview Xbox 360 Avatar Editor into a PC application with ReXGlue.

App · Case study:
perception-pnrf documents the reverse-engineered PNRF measurement file format used by HBK Perception and provides Python and C# parsers.
Reviewed codeberg.org/Apollo3zehn/perception-pnrf/src/commi…
App · Case study:
metars_cgi reconstructs the data server used by NCAR's Java METAR viewer.
Reviewed codeberg.org/PurpleJillybeans/metars_cgi/src/commi…
App · Case study:
Xbox Demos Decompilation reconstructs the Xbox application that launches videos and demos from the North American BLiNX: The Time Sweeper disc.
Reviewed codeberg.org/KeybadeBlox/XDemos-Decomp/src/commit/…
App · Case study:
ag-psd reconstructs reading and writing of Photoshop PSD documents in JavaScript and TypeScript using format references and trial and error.

Reviewed Agamnentzar/ag-psd@a74425d
App · Case study:
locus-poi-db investigates the POI database format used with LocusMaps LoMaps.
Reviewed noschinl/locus-poi-db@6a5e517
App · Integration:
JADX plugin paired with a Python MCP server to inspect decompiled Android classes, resources, cross-references and debugger context.

Reviewed zinja-coder/jadx-ai-mcp@ce64f22
App · Integration:
Python MCP server that drives a local Apktool install so agents can decode APKs; list, read, search and edit smali and resource files; read AndroidManifest.xml and apktool.yml; and rebuild the project.

App · Integration:
Frida MCP server with persistent instrumentation sessions, runtime inspection and Android static-to-dynamic navigation.
Reviewed yfe404/frida-mcp@fb7d6c7
App · Integration:
Single-binary Frida MCP server for discovering devices, managing process sessions and loading instrumentation scripts.

Reviewed crissyfield/super-trouper@b3d31ad
Binary · Tool:
Open-source analysis suite for disassembly, decompilation, graphs and Java/Python automation across executable formats.

Binary · Tool:
Scriptable command-line framework for inspecting, disassembling, debugging and modifying binaries across many architectures.

Reviewed radareorg/radare2@6ac96f5
Binary · Tool:
Rizin-powered graphical reverse-engineering workspace with extensible views and Ghidra decompiler integration.

Reviewed rizinorg/cutter@734acd1
Binary · Tool:
Python emulation framework that adds OS, filesystem and API behavior around CPU emulation for instrumented binary analysis.
Reviewed qilingframework/qiling@206b90f
Binary · Tool:
Multi-architecture CPU emulator for executing selected instruction ranges with register, memory and hook control.
Reviewed unicorn-engine/unicorn@c24c9eb
Binary · Tool:
Python binary-analysis framework combining control-flow recovery, symbolic execution, data-flow analysis and decompilation.
Reviewed angr/angr@ae9f578
Binary · Tool:
Library for structured parsing and modification of executable formats including ELF, PE and Mach-O.

Reviewed lief-project/LIEF@b68429c
Binary · Tool:
Disassembly library with architecture-neutral APIs and instruction details for custom binary-analysis pipelines.
Reviewed capstone-engine/capstone@d7ef910
Binary · Tool:
Hex editor with a binary-pattern language, structured data inspection and visual tools for understanding file formats.

Reviewed WerWolv/ImHex@fddad83
Binary · Tool:
Windows binary debugger with disassembly, memory views and plugins for analyzing programs without source code.

Reviewed x64dbg/x64dbg@ac4db12
Binary · Tool:
Native and remote debugger for controlling execution and inspecting live or crashed program state.
Reviewed sourceware.org/gdb
Binary · Tool:
Records process execution and replays it under GDB, enabling repeatable inspection and reverse execution.
Reviewed rr-debugger/rr@7ff9786
Binary · Tool:
IDA-based binary diffing that matches functions and transfers names, comments and types between analyzed versions.

Reviewed joxeankoret/diaphora@a7e1594
Binary · Tool:
Compares disassembled binaries to find matching functions and changed code across versions.
Reviewed google/bindiff@882333b
Binary · Tool:
Format-aware file identification and static inspection using parsers, signatures and programmable heuristics.

Reviewed horsicq/Detect-It-Easy@bd693a6
App · Tool:
Use radare2 commands and Frida instrumentation together to inspect local or remote process memory, symbols, classes, and runtime calls on desktop and mobile targets.

Reviewed nowsecure/r2frida@4f1f8d7
Binary · Tool:
Turn documented binary layouts into reusable parsers for files and network packets.
Reviewed kaitai-io/kaitai_struct@5ca6630
Binary · Tool:
Recover Go build metadata, function names and address ranges, source file and line tables, embedded types and strings from Go binaries, including stripped and some malformed unpacked samples.
Reviewed mandiant/GoReSym@722897e
Binary · Tool:
Open-source decompilation pipeline that lifts x86-64, AArch64, i386, ARM and MIPS code with QEMU, runs LLVM-based analyses and emits C designed to be valid and recompilable.
Reviewed revng/revng@57d81a3
Binary · Tool:
Command-line reverse-engineering framework that began as a fork of radare2.
Reviewed rizinorg/rizin@db112e5
Binary · Tool:
Web service at dogbolt.org that runs one small uploaded executable through many decompilers and shows their C-like output side by side, described as Compiler Explorer in reverse.
Binary · Tool:
Python plug-in that loads into GDB, or runs as a REPL around LLDB, to make live program state easier to inspect.

Reviewed pwndbg/pwndbg@3044ccd
Binary · Tool:
Runtime code manipulation system for building dynamic tools that observe or transform any part of an unmodified program while it runs.
Reviewed DynamoRIO/dynamorio@6d2165a
Binary · Tool:
C++ disassembler and decompiler for compiled Python bytecode that aims to support bytecode from any Python version.
Reviewed zrax/pycdc@b428976
Binary · Tool:
Static analyzer from Fraunhofer FKIE that searches binary executables, mainly Linux and Unix ELF files, for code paths matching Common Weakness Enumeration bug classes such as buffer overflows, use-after-free and double free, NULL pointer dereferences, format strings and integer overflows.
Reviewed fkie-cad/cwe_checker@7288311
Binary · Tool:
Mandiant FLARE installer that sets up and maintains a Windows virtual machine for reverse engineering and malware analysis.

Reviewed mandiant/flare-vm@5dc321d