# Curated reverse engineering resources · Page 36

> Page 36 of 52, entries 3,501–3,600. 5,191 tools, projects, integrations, case studies, and references for websites, games, apps, native binaries, firmware, and communication protocols.

Source-reviewed means descriptions were checked against primary documentation. Each entry page lists the full requirements and sources; this page shows their counts and the review date.

- HTML: <https://awesomerea.org/resources/page/36/>
- JSON: <https://awesomerea.org/api/v1/resources.json>
- 简体中文: <https://awesomerea.org/zh/resources/page/36/index.md>

## Native binaries (100)

- [B2R2](https://awesomerea.org/resources/b2r2/index.md): Tool · Binary analysis framework written in F# for .NET by KAIST's SoftSec Lab. It parses ELF, PE, Mach-O and WebAssembly files, parses, disassembles and lifts instructions into its own IR, recovers control-flow graphs and assembles code; the README's feature table covers x86/x86-64, ARMv7/AArch64, MIPS, PowerPC, RISC-V, SPARC, S390 and other ISAs as well as CIL, EVM, eBPF, WebAssembly and Python bytecode. Its b2r2 launcher starts a readelf-like format scanner, a linear-sweep disassembler, a recursive-descent explorer with a web GUI, an IR and assembly REPL and an assembler.
- [rz-ghidra](https://awesomerea.org/resources/rz-ghidra/index.md): Tool · Rizin plugin that embeds Ghidra's C++ decompiler and Sleigh disassembler, so no Java Ghidra installation is needed. Its pdg commands decompile the current function, optionally side by side with offsets or as XML or JSON, can return the output to Rizin as comments, and list the loaded Sleigh languages; config variables control formatting and can override the auto-detected Sleigh language. The decompiler draws on Rizin's loaded binary, types and comments, and an optional plugin brings it into the Cutter GUI.
- [dewolf](https://awesomerea.org/resources/dewolf/index.md): Tool · Research decompiler from Fraunhofer FKIE, developed with Singapore's DSO National Laboratories between 2019 and 2021, that runs as a Binary Ninja plugin and starts from Binary Ninja's Medium Level IL. A pipeline of preprocessing, SSA, data-flow and control-flow stages restructures code following the DREAM/DREAM++ approach and emits C-like output. Results appear in a Binary Ninja dock widget, or decompile.py prints or writes them for a whole binary or one named function in batch use.
- [decomp2dbg](https://awesomerea.org/resources/decomp2dbg/index.md): Tool · Decompiler-to-debugger bridge that serves function names, global variables, stack and register variable names and decompiled code from IDA Pro, Binary Ninja, Ghidra or angr-management to GDB over an XML-RPC connection. Synced functions and globals become ordinary GDB symbols for breakpoints and memory examination, local variables appear as convenience variables, and each breakpoint stop prints the decompiled line for the current address. It works with vanilla GDB, GEF and pwndbg, and can map a shared library's symbols once its load range is supplied.
- [E9Patch](https://awesomerea.org/resources/e9patch/index.md): Tool · Static binary rewriter for x86-64 Linux ELF executables and shared objects that inserts instrumentation without control-flow recovery and writes a drop-in replacement binary, following the PLDI 2020 paper Binary Rewriting without Control Flow Recovery. The e9tool front end selects instructions with a matching language over disassembly attributes and patches them with built-in trampolines, calls into C or C++ functions compiled with e9compile.sh, or hand-written plugin trampolines; the e9patch back end accepts JSON-RPC commands so other tools can drive it. Optional modes add heuristic control-flow recovery for faster rewritten binaries or SIGILL-based fallbacks for full patch coverage.
- [Rellic](https://awesomerea.org/resources/rellic/index.md): Tool · Trail of Bits implementation of the pattern-independent structuring algorithm from the No More Gotos paper, turning LLVM bitcode into goto-free C as a small, hackable decompiler back end that interoperates with LLVM and Remill. rellic-decomp translates a bitcode module to C in batch, rellic-xref serves a web interface for choosing refinement passes and linking C AST nodes to the bitcode that produced them, and rellic-headergen emits C layouts of data structures from a module's DWARF metadata. Machine code must first be lifted to bitcode by another tool; a bundled IDA script uses Anvill for that step.
- [ghidra-delinker-extension](https://awesomerea.org/resources/ghidra-delinker-extension/index.md): Tool · Ghidra extension that delinks a selected part of a program back into a relocatable object file. Its relocation table synthesizer analyzer reconstructs, from the Ghidra database, the relocations a linker normally discards, and its exporters write COFF (x86, x86-64), ELF (x86, x86-64, MIPS) or OMF (x86) objects with symbols and relocation tables that a toolchain can link again. The README lists binary patching through the linker, software ports, format conversion, library extraction and decompilation projects that reimplement a program one object file at a time among its uses.
- [BinExport](https://awesomerea.org/resources/binexport/index.md): Tool · The exporter component of BinDiff: plugins for IDA Pro and Binary Ninja and an extension for Ghidra that write an analyzed disassembly to the Protocol Buffer format BinDiff requires. The BinExport2 schema covers instructions with their operands and expressions, basic blocks, flow graphs, the call graph, sections, strings, comments and data references; the exporter can also write a statistics text file or a text dump for debugging. Exports can be scripted through IDC or IDAPython in IDA and through a BinExport.java script that also runs in Ghidra's headless analyzer.
- [Karta](https://awesomerea.org/resources/karta/index.md): Tool · Source-code-assisted IDA Python plugin from Check Point Research that finds and matches open-source libraries compiled into large binaries and firmware. Its identifier script reports which supported libraries, such as OpenSSL, zlib, libpng and net-snmp, are present and fingerprints their versions; the matcher then uses a JSON configuration built from that library version to locate its compiled files by their original function order, match their functions and the external libc functions they call, and export selected matches as IDA names. The bundled Thumbs Up scripts improve IDA's function analysis beforehand, including ARM/Thumb separation in firmware.
- [VTIL-Core](https://awesomerea.org/resources/vtil-core/index.md): Tool · C++20 core of the VTIL (Virtual-machine Translation Intermediate Language) project, an intermediate language and optimizing compiler that the README describes as built for binary de-obfuscation and de-virtualization. Unlike LLVM IR, VTIL keeps the native stack, physical registers and non-SSA form, so code from register or stack machines can be lifted into it, native instructions can stay inline, and code can be emitted back at any virtual address. The library provides the IL with routines, basic blocks and serialization, a symbolic expression engine and simplifier, optimizer passes such as dead-code elimination, propagation and stack pinning, and Capstone/Keystone-based AMD64 and ARM64 disassembly and assembly helpers.
- [Frida Workbench for VSCode](https://awesomerea.org/resources/vscode-frida/index.md): Tool · Unofficial Visual Studio Code extension for Frida work. A sidebar lists apps and processes on local, Apple Simulator, USB and remote devices to attach, spawn or kill, and runtime panels browse an attached process's native modules and exports and its Java and Objective-C classes, methods and protocols; selected items generate Interceptor, Objective-C or Java hook scaffolds, optionally with GitHub Copilot-inferred native signatures, and Objective-C headers or Java class stubs can be dumped. A language server completes class, selector and module names from a live target, and the extension also scaffolds Frida agent and C-module projects, script-debugging configurations, syslog streaming and Android frida-server setup.
- [ghidriff](https://awesomerea.org/resources/ghidriff/index.md): Tool · Command-line binary diffing engine that drives Ghidra headlessly through pyghidra: it imports and analyzes an old and a new binary, then reports added, deleted and modified functions, with patch diffing as its main use. The default VersionTrackingDiff engine combines several Ghidra Version Tracking correlators with BSim matching, alongside simpler symbol-name and structural-graph engines and a GhidraDiffEngine base class for custom differs. Results are written as JSON and Markdown with Mermaid charts and meta diffs of strings, called and calling functions and binary metadata, plus optional side-by-side HTML.
- [Ddisasm](https://awesomerea.org/resources/ddisasm/index.md): Tool · GrammaTech's Datalog disassembler, which turns ELF and PE binaries for x86-32, x86-64, ARM32, ARM64 and MIPS32 into the GTIRB intermediate representation. It decodes a superset of possible instructions, then applies Soufflé Datalog rules and weighted heuristics to infer code locations, symbolization and function boundaries; gtirb-pprinter turns the result into reassemblable assembly or a rebuilt binary, and the GTIRB APIs or gtirb-rewriting can modify it in between. User hint files add Datalog facts or change heuristic weights where inference goes wrong.
- [PINCE](https://awesomerea.org/resources/pince/index.md): Tool · Linux front end for the GNU Debugger (GDB), focused on games but usable for other reverse engineering; the name stands for “PINCE is not Cheat Engine”. It scans process memory and pointers through libmemscan into a typed address table, and its memory view adds disassembly, an on-the-fly assembler, code dissection for referenced calls, jumps and strings, function, region and instruction searches, and structure overlays, including structures generated from Mono/IL2CPP class dissection of native Linux or Wine/Proton processes. Debugging covers chained breakpoints and watchpoints, tracking of the instructions that access an address, tracing and stack traces, alongside a GDB console and the reusable libpince Python library.
- [uncompyle6](https://awesomerea.org/resources/uncompyle6/index.md): Tool · Cross-version decompiler that translates Python bytecode back into equivalent Python source, accepting bytecode from Python 1.0 through 3.8 as well as some PyPy bytecode and Dropbox's Python 2.5. It disassembles code objects with the companion xdis library and parses the instruction stream into a grammar-based tree from which source is printed; it can also deparse just the fragment around a given bytecode offset, which the author's trepan debuggers use for exact location reporting. It succeeds the older decompyle, uncompyle and uncompyle2 forks.
- [ret-sync](https://awesomerea.org/resources/ret-sync/index.md): Tool · Reverse-Engineering Tools SYNChronization: plugins that keep IDA, Ghidra or Binary Ninja graph and decompiler views following a live WinDbg, GDB, LLDB, OllyDbg 1.10/2 or x64dbg session, rebasing addresses on the fly so ASLR does not break the mapping. Debugger commands push comments, labels, rebased addresses and command output into the disassembler database and resolve symbols from it, while disassembler hotkeys set breakpoints and step the debugger; several databases can be synced at once and the two sides may run on different hosts. A standalone Python library offers the same position syncing to custom tracing tools.
- [PyInstaller Extractor (pyinstxtractor)](https://awesomerea.org/resources/pyinstxtractor/index.md): Tool · Single-file Python script that extracts the contents of executables built with PyInstaller, including Linux ELF builds without other tools. It locates the PyInstaller archive in the executable, reports the PyInstaller and Python versions and likely entry-point scripts, and writes out the bundled CArchive files and the modules in the PYZ archive. It fixes the headers of the extracted .pyc files so that Python bytecode decompilers such as uncompyle6 and Decompyle++ (pycdc) recognize them.
- [Binary Analysis Platform (BAP)](https://awesomerea.org/resources/bap/index.md): Tool · OCaml binary analysis platform from Carnegie Mellon University. Its bap command loads a program, disassembles it, lifts instructions into an architecture-neutral intermediate representation, builds the control-flow graph and runs analysis passes, while objdump, raw-loader and mc modes handle linear disassembly, raw code blobs and single encodings. The README lists x86, x86-64, ARM, MIPS and PowerPC support, an interpreter, a microexecution interpreter, a symbolic executor and the Primus Lisp language for analyses, function stubs and SMT-solver queries; analyses are written as OCaml plugins or by embedding BAP as a library, with C bindings and minimal Python support in separate repositories.
- [Reko](https://awesomerea.org/resources/reko/index.md): Tool · General-purpose decompiler that loads executables or raw images, scans their machine code into a machine-independent register transfer language, groups it into procedures and decompiles them into high-level C code. The reviewed source has 64 architecture directories, from 6502, Z80 and PDP-11 to ARM, MIPS, PowerPC, RISC-V and x86, and loaders for formats including ELF, PE/MZ, Mach-O, COFF, Amiga Hunk, VMS, WebAssembly, Xbox XBE and Xbox 360 XEX. It runs as a Windows Forms GUI, a command-line client or a .NET library, and project files and scripts let users add names, types and comments.
- [Dyninst](https://awesomerea.org/resources/dyninst/index.md): Tool · Binary instrumentation, analysis and modification libraries from the Paradyn project. DyninstAPI inserts and changes instrumentation in a running program, or rewrites an executable or library on disk and writes the patched copy back, through one machine-independent interface that also supports static and dynamic analysis. Separately documented components handle symbol tables, line numbers and types (SymtabAPI), instruction decoding and disassembly (InstructionAPI), parsing into blocks, functions and loops (ParseAPI), dataflow analyses such as slicing (DataFlowAPI), process control, stack walking and patching.
- [goblin](https://awesomerea.org/resources/goblin/index.md): Tool · Rust crate for zero-copy, endian-aware parsing of ELF32/64, 32/64-bit Mach-O and multi-architecture fat containers, PE32/PE32+, COFF objects, Terse Executable (TE) images and Unix/BSD archives; Object::parse picks the format from its magic bytes. Parsed structures cover ELF headers, sections, symbols, dynamic entries, relocations and notes, Mach-O load commands, imports and exports, and PE imports, exports, relocations, TLS, resources, exception and unwind data, Authenticode certificates and the .NET CLR header. Feature flags can reduce it to std-free #[repr(C)] struct definitions for kernels and other no_std code.
- [FLOSS (FLARE Obfuscated String Solver)](https://awesomerea.org/resources/flare-floss/index.md): Tool · Mandiant FLARE string extractor for malware analysis that is used like strings.exe but also recovers obfuscated strings. Besides static ASCII and UTF-16LE strings it extracts stack strings, tight strings and strings decoded by functions: it heuristically identifies decoding routines, recovers their arguments through control-flow analysis, emulates them and diffs memory before and after emulation. It also extracts Go and Rust strings and accepts PE, ELF and raw 32- or 64-bit shellcode; JSON results can be turned into import scripts for IDA Pro, Ghidra, Binary Ninja, radare2 and x64dbg.
- [Zydis](https://awesomerea.org/resources/zydis/index.md): Tool · Lightweight C11 x86/x86-64 disassembler and code-generation library. Its decoder reports each instruction's operands, accessed CPU and FPU flags, ISA set and extension and branch type; the formatter prints Intel, MASM or AT&T syntax, and the encoder assembles instructions from encoder requests, which can also be derived from decoded instructions. ZydisDisasm and ZydisInfo command-line tools are included, and the official Rust and Python 3 bindings live in separate repositories.
- [QBDI](https://awesomerea.org/resources/qbdi/index.md): Tool · Quarkslab's modular dynamic binary instrumentation (DBI) framework, which JIT-recompiles a program's basic blocks inside its own process so that an instrumentation tool can register callbacks before or after instructions, on memory reads and writes, and on VM events. The engine is a library that can start an instrumented execution anywhere in a process, scripted from C, C++, Python (PyQBDI) or Frida JavaScript. It has no preferred injection method: it bundles the LD_PRELOAD-based QBDIPreload for Linux and macOS dynamic executables and is integrated with Frida.
- [binsider](https://awesomerea.org/resources/binsider/index.md): Tool · Terminal user interface for inspecting ELF binaries. It shows file information and linked shared libraries in the manner of stat and ldd, browses ELF headers, notes, sections, segments, symbols, dynamic symbols and relocations much like readelf, extracts strings with an adjustable minimum length, and offers a searchable hexdump view. Optional dynamic analysis runs the binary and traces its system calls like strace, with a summary of time and call counts per system call; the interface can also be embedded as a Rust library in Ratatui applications.
- [iced](https://awesomerea.org/resources/iced/index.md): Tool · x86 instruction library for 16-, 32- and 64-bit code that decodes, formats, assembles and encodes instructions, with masm, nasm, GNU AT&T and Intel XED output syntaxes. Its instruction-info API reports the registers, memory operands and RFLAGS bits an instruction reads or writes, its CPUID feature flags and control-flow type, and the encoder can re-encode decoded instructions at any address. Rust, C# (.NET) and Java implementations live in one repository, with Python, JavaScript (WebAssembly) and Lua bindings built on the Rust crate.
- [hrtng](https://awesomerea.org/resources/hrtng/index.md): Tool · IDA plugin published by Kaspersky that extends the Hex-Rays decompiler with tools its author collected for reverse-engineering work, including malware analysis. It decrypts strings, data and constants with built-in ciphers or in bulk through IDA's Appcall debugger feature, resolves API-name hashes, unflattens control flow and forces decompilation of obfuscated code, and recognizes library code through microcode signatures, inlined-function detection and PAT files built from an IDA database. Pseudocode helpers cover automatic renaming, retyping and enum substitution, structure creation, virtual and indirect call navigation, and patching.
- [BinCAT](https://awesomerea.org/resources/bincat/index.md): Tool · Static binary code analysis toolkit designed for reverse engineers. Starting from a chosen address and initial state, it computes register and memory values, taint and reconstructed types, with forward and backward analysis and heap use-after-free and double-free detection; bits it cannot determine are shown as unknown. It is driven from an IDA plugin, where analysts can override values or taint, skip functions or replace instructions with NOPs before re-running, or from Python and an .ini configuration for automation.
- [GEF (GDB Enhanced Features)](https://awesomerea.org/resources/gef/index.md): Tool · Single-file Python extension, gef.py, that adds dynamic-analysis commands to GDB. Each stop shows a context view of registers, stack, code, threads and call trace, and commands cover memory maps, pointer dereferencing, searching process memory for patterns, ELF and security-property information, process status and glibc heap inspection. An architecture abstraction layer covers x86-32/64, ARMv5–v7, AArch64, SPARC, MIPS and PowerPC, and gef-remote enriches remote sessions through gdbserver or the GDB stubs of qemu-user and qemu-system.
- [Triton](https://awesomerea.org/resources/triton/index.md): Tool · C++ library with Python bindings for dynamic binary analysis of x86, x86-64, ARM32, AArch64 and RISC-V 32/64 code. Callers process instructions one at a time, optionally with concrete register and memory values; Triton builds symbolic expressions from each instruction's semantics, tracks taint and solves path constraints through Z3 or Bitwuzla. It also synthesizes and simplifies expressions and lifts them to LLVM IR or Z3 and back, for building analysis tools, automating reverse engineering, software verification or emulating code.
- [PyLingual](https://awesomerea.org/resources/pylingual/index.md): Tool · Research decompiler for CPython bytecode from Python 3.6 onward that pairs per-version transformer models with control-flow reconstruction. A segmentation model splits bytecode into statements, a statement model translates each into source, and templates rebuild loops, conditionals, exception handlers, with blocks and match statements. The result is recompiled with the target Python version and its control flow compared with the original bytecode, and failing segments are retried with alternative segmentations; the design is described in the IEEE S&P 2025 paper “PyLingual: Toward Perfect Decompilation of Evolving High-Level Languages”.
- [Miasm](https://awesomerea.org/resources/miasm/index.md): Tool · Python reverse-engineering framework for analyzing, modifying and generating binary programs. It reads, modifies and generates 32- and 64-bit PE and ELF files, assembles and disassembles x86, ARM, AArch64, MIPS, PowerPC, SH4, MSP430 and MeP code, and lifts it into its own intermediate language for symbolic execution, SSA and data-flow analysis, dependency graphs and expression simplification aimed at deobfuscation. Its JIT emulator runs shellcode or parts of binaries through LLVM, GCC, Clang or pure-Python backends, with Python callbacks that stand in for library functions, sandboxes with selected Windows API and Linux emulation, and dynamic symbolic execution through Z3.
- [HyperDbg](https://awesomerea.org/resources/hyperdbg/index.md): Tool · Hypervisor-assisted Windows debugger that virtualizes the running system with Intel VT-x and Extended Page Tables to debug kernel and user mode, either locally as a tracing and introspection tool or from a host attached over a serial connection to a guest virtual machine. Its events include EPT-based hidden breakpoints and hooks, memory read, write and execute monitoring without the limits of hardware debug registers, monitoring of system calls, CPUID, MSRs, I/O ports, MMIO, exceptions and interrupts, and Intel PT and LBR branch tracing. A kernel-side script engine, PDB symbol support and an SDK automate analysis.
- [Kuna](https://awesomerea.org/resources/kuna/index.md): Tool · Agent-first decompiler written in Rust that began as a port of Ghidra’s C++ decompiler and SLEIGH compiler, and has since diverged with option-gated features, some ported from angr. A single self-contained kuna binary decompiles one function or exports a whole binary to C, header and assembly files, and the same engine runs in the browser through WebAssembly or as the decompiler backend inside Ghidra. The project calls itself an experiment in having LLM agents refine the decompiler; most code is agent-written and steered by regression and benchmark results.
- [Binary Ninja API](https://awesomerea.org/resources/binary-ninja-api/index.md): Tool · Vector 35’s public C++, Python and Rust APIs for Binary Ninja, with their documentation, examples and the open-source plugins built on them. Binary Ninja itself is a closed-source commercial application, and this repository does not contain its analysis core. The open plugins cover the x86/x86_64, ARM64, ARMv7, PowerPC, MIPS, RISC-V and MSP430 architectures, ELF, PE/COFF, Mach-O and Apple shared-cache and kernel-cache loaders, DWARF, PDB and IDB import, and Objective-C, RTTI and SVD analysis, while the examples walk the low- and medium-level intermediate languages and extend the analysis pipeline through workflows.
- [capa](https://awesomerea.org/resources/capa/index.md): Tool · Mandiant FLARE tool that reports what an executable can do by matching a YAML rule set against features extracted from PE, ELF and .NET files or 32/64-bit shellcode, such as API calls, imports, strings and constants. Matches are grouped into capability namespaces with ATT&CK and MBC tags, and verbose output shows the function or basic-block addresses and features behind each match, pointing analysts to code worth studying. It also reads CAPE, DRAKVUF and VMRay sandbox reports for dynamic features and can use vivisect, IDA Pro, Ghidra or Binary Ninja for analysis, with explorer plugins for IDA and Ghidra and a browser viewer for its JSON results.
- [RetDec](https://awesomerea.org/resources/retdec/index.md): Tool · Avast's retargetable machine-code decompiler built on LLVM. It takes ELF, PE, Mach-O, COFF, AR, Intel HEX or raw code for 32-bit x86, ARM, MIPS, PIC32 and PowerPC or 64-bit x86-64 and ARM64, recovers functions, types and C++ class hierarchies, and emits C or a Python-like language with call and control-flow graphs.
- [REDasm](https://awesomerea.org/resources/redasm/index.md): Tool · Cross-platform interactive disassembler whose version 4 is a plain-C rewrite: a C17 engine library, the Qt6 GUI kept in this repository, and loader, processor and analyzer plugins loaded as shared libraries. The listing supports renaming, comments and typed data, with a synchronized control-flow graph, cross-references, string detection, a hex view, patching and saved projects. Besides PE and ELF, loaders cover retro and console formats such as DOS MZ, Win16 NE, OS/2 LE/LX, PlayStation 1, original Xbox and ZX Spectrum, with x86/x86-64, MIPS32, ARM/Thumb, ARM64, Z80 and 6502 processors.
- [Lighthouse](https://awesomerea.org/resources/lighthouse/index.md): Tool · Code-coverage explorer plugin for IDA Pro and Binary Ninja that loads execution traces of native programs and paints the executed code across the disassembler's views, without needing symbols or source. Its coverage overview lists per-function coverage, and a composing shell combines loaded coverage sets with logical operators to diff runs, filter functions and jump to addresses, while coverage cross-references show which of many batch-loaded sets executed a block. It reads DynamoRIO drcov logs, module+offset, absolute-address and Tenet traces, writes basic HTML coverage reports, and ships a prototype Intel Pin tool and a Frida script that produce drcov-compatible logs.
- [BinAbsInspector](https://awesomerea.org/resources/binabsinspector/index.md): Tool · Static vulnerability scanner from Tencent Keen Lab that runs as a Ghidra extension or headless script and applies abstract interpretation to Ghidra's P-code rather than to assembly, covering x86, x64, ARMv7 and AArch64 binaries. Its flow- and context-sensitive interprocedural analysis, with configurable value-set size and call-string depth, optional Z3 constraint solving and models of external functions, feeds checkers for 13 CWE classes, including command injection, buffer overflows and out-of-bounds access, format strings, integer overflow, double free, use-after-free and NULL dereference. Warnings list the instruction address and its call context, in the Ghidra console or as JSON.
- [VulHunt Community Edition](https://awesomerea.org/resources/vulhunt/index.md): Tool · Open-source Community Edition of Binarly REsearch's VulHunt engine for hunting vulnerabilities in POSIX binaries and UEFI firmware on x86 and ARM. Lua rules run on the Rust BIAS framework, which lifts code to Ghidra's P-code and bundles Ghidra's C++ decompiler, and combine taint and dataflow tracking, Weggli-based queries over decompiled code, byte patterns, FLIRT signatures and type libraries; findings are written as JSON with annotated decompiled code. The CLI scans single binaries, Binarly BA2 archives or Binary Ninja databases, and can also run as an MCP server that lets AI assistants open a project, query it with Lua, rename functions and keep notes.
- [BinSync](https://awesomerea.org/resources/binsync/index.md): Tool · Decompiler plugin for collaborative reverse engineering that records each analyst's work in a shared Git repository, one branch per user, so teammates can pull, push or auto-push changes across IDA Pro, Binary Ninja, Ghidra and angr-management. Synced artifacts are function headers (names, arguments and types), stack and global variables, structs, enums and comments, including user-defined types. It is built by mahaloz, the angr team and the SEFCOM research lab and is used by the Shellphish hacking team; scripting goes through the separate DecLib library.
- [class-dump](https://awesomerea.org/resources/class-dump/index.md): Tool · Command-line utility that reads the Objective-C runtime metadata in Mach-O executables, frameworks and bundles and prints it as ordinary Objective-C declarations for the classes, categories and protocols it finds, the same information otool -ov shows in a more compact form. It can write one header file per class, recurse into the frameworks a binary uses, choose one architecture from a universal binary, filter or sort the output, and annotate it with instance-variable offsets and implementation addresses.
- [Lucid](https://awesomerea.org/resources/lucid-microcode-explorer/index.md): Tool · IDA Pro plugin by Markus Gaasedelen for studying how the Hex-Rays decompiler transforms its microcode intermediate language. Opened from a Pseudocode window with View microcode, its explorer stays synchronized with the pseudocode and lets the user scroll a selected microinstruction through each microcode maturity level, tracing sub-operands back to their origins and changing the cursor color when the traced code has been optimized away. Nested sub-instructions can be shown as tree graphs; the plugin is a developer-oriented prototype and code resource.
- [r2dec](https://awesomerea.org/resources/r2dec/index.md): Tool · Decompiler plugin for radare2 that turns the disassembly of an analyzed function into pseudo-C through the pdd command. Its decompiler is written in JavaScript, with one module per architecture, compiled to QuickJS bytecode and embedded in a native radare2 core plugin; output can sit beside the assembly or offsets, show only scope blocks, casts or cross-references, render as HTML, or be written back into radare2 as comments. The README lists x86/x64, 16/32/64-bit ARM, MIPS, PowerPC (including VLE), SPARC, AVR, V850 and Dalvik, plus experimental 6502, 8051, BPF, m68k, SuperH, WebAssembly and RISC-V support.
- [Runtime Mobile Security (RMS)](https://awesomerea.org/resources/rms-runtime-mobile-security/index.md): Tool · Frida-based web interface for observing Android and iOS apps at run time on a test device. It lists the classes and methods loaded in memory, traces method arguments and return values, generates hook templates for a selected class, finds class instances on the heap, and on Android monitors categorized framework APIs and a few libc file functions; a beta file browser covers the app's private folders.
- [Pharos](https://awesomerea.org/resources/pharos/index.md): Tool · Carnegie Mellon SEI's framework of automated static analysis tools for binary programs, built on LLNL's ROSE compiler infrastructure for disassembly, control-flow analysis and instruction semantics. Its best-known tool, OOAnalyzer, recovers C++ classes, methods and other object-oriented constructs from 32-bit x86 executables built with Microsoft Visual C++ by applying Prolog rules to facts about how object pointers move between functions, as described in a CCS 2018 paper, and exports JSON for an included IDA plugin or the separate Kaiju Ghidra plugin. Other tools find API call sequences (ApiAnalyzer), report static API-call parameters (CallAnalyzer), produce function hashes and YARA signatures for similarity analysis (FN2Hash, FN2Yara) and work out the conditions for reaching one address from another (PathAnalyzer).
- [heimdall-rs](https://awesomerea.org/resources/heimdall-rs/index.md): Tool · Rust toolkit by Jonathan Becker for analyzing EVM smart-contract bytecode, particularly of contracts without verified source. Its CLI disassembles bytecode, builds control-flow graphs, decompiles it through per-function symbolic execution and heuristic post-processing passes into an ABI plus beta Solidity or Yul source, decodes raw calldata, dumps the storage slots a contract accesses over a block range, and inspects transactions by decoding their calldata, traces and logs. Targets can be raw bytecode, files, contract addresses or ENS names; function selectors are resolved against the OpenChain signature database unless that step is skipped.
- [PE-bear](https://awesomerea.org/resources/pe-bear/index.md): Tool · Qt GUI to view and edit Windows Portable Executable files, meant as a fast first look for malware analysts and robust against malformed PE32 and PE64 files. It shows headers and section layout, follows raw, RVA and VA addresses, disassembles from any offset with Capstone, matches packer signatures, compares two files and unmaps dumped images.
- [PE-sieve](https://awesomerea.org/resources/pe-sieve/index.md): Tool · Windows process scanner by hasherezade that finds and dumps implants in one running process: replaced or injected PE modules, shellcode, inline and IAT hooks and other in-memory patches, with the README naming Process Hollowing, Process Doppelgänging and reflective DLL injection among the techniques it detects. Options add shellcode detection by patterns or statistics, scans of thread call stacks, non-executable pages and encrypted or obfuscated content, a choice of dump mode with import-table recovery for dumped PEs, minidumps and JSON reports. It builds as an EXE, as a DLL with a small API that Python, Go and Rust bindings use, or as a static library, and is the engine behind HollowsHunter and MalUnpack.
- [oletools](https://awesomerea.org/resources/oletools/index.md): Tool · Python package by Philippe Lagadec for analyzing Microsoft OLE2 (Compound File Binary) files such as Office 97–2003 documents, MSI files and Outlook messages, as well as RTF and OpenXML documents, mainly for malware analysis, forensics and debugging. Its command-line tools detect and extract VBA and Excel 4 (XLM) macros, embedded OLE and Flash objects and DDE links (olevba, MacroRaptor, oleobj, rtfobj, pyxswf, msodde), flag characteristics common in malicious files with oleid and ftguess, and show directory entries, metadata, timestamps and sector maps with oledir, olemeta, oletimes and olemap. It is built on the same author's olefile parser.
- [MonkeyDev](https://awesomerea.org/resources/monkeydev/index.md): Tool · Based on iOSOpenDev, MonkeyDev adds a MonkeyApp project template to Xcode for instrumenting iOS apps the developer is authorized to analyze. From Xcode it injects a developer-written dylib into a supplied decrypted app, builds Objective-C or Logos (CaptainHook) hooks, and re-signs, installs and debugs the result with source-level breakpoints; optional build settings restore Objective-C symbols, export the target's Objective-C headers and enable Reveal view inspection. The current version also builds jailbreak Logos/CaptainHook tweaks and command-line tools for rootless, rootful or roothide environments.
- [Hollows Hunter](https://awesomerea.org/resources/hollows-hunter/index.md): Tool · Windows command-line memory scanner by hasherezade that runs the PE-sieve engine across many processes, or the whole system, instead of a single PID. It recognizes and dumps replaced or implanted PE modules, shellcode, hooks and other in-memory patches for further analysis, selecting processes by PID list, name list or creation time relative to the scan. Scans can repeat in a loop or, in the 64-bit build, run as an ETW listener whose INI profile chooses the triggering events.
- [restore-symbol](https://awesomerea.org/resources/restore-symbol/index.md): Tool · macOS command-line tool that writes a stripped iOS app's Mach-O executable back out with a rebuilt symbol table, so a debugger such as lldb can break on and display Objective-C method names. It recovers method names and addresses from the binary's Objective-C metadata through class-dump, and can merge extra name and address pairs from a JSON file, such as the block symbols found by the bundled IDA script.
- [FakeNet-NG](https://awesomerea.org/resources/fakenet-ng/index.md): Tool · Mandiant FLARE's dynamic network analysis tool for malware analysts, a successor to the original Fakenet. Its Diverter redirects traffic from local processes on Windows, or from other hosts in Linux MultiHost mode, to configurable listeners that simulate DNS, HTTP and HTTPS, SMTP, FTP, TFTP, IRC, POP and raw TCP or UDP services, with process and host filters, custom responses and an option to launch a command such as a debugger on a connection. Sessions can be saved as PCAP and end with an interactive HTML report of network-based indicators grouped by process and protocol.
- [Joern](https://awesomerea.org/resources/joern/index.md): Tool · Static code analysis platform that parses source code, JVM bytecode and executables into code property graphs held in a graph database and queried with a Scala-based language from an interactive shell or server mode. Frontends cover C/C++, Java, JavaScript, Python, Kotlin, PHP, Go, Ruby, Swift, C#, Rust and ABAP source, JVM bytecode and APK/DEX files through Soot, and binaries loaded through an embedded Ghidra, which the documentation lists as x86/x64 support. It adds a static taint-tracking engine, the joern-scan query database of vulnerability patterns, and export of AST, CFG, PDG or whole-graph views to DOT, GraphML, GraphSON or Neo4j CSV.
- [Speakeasy](https://awesomerea.org/resources/speakeasy/index.md): Tool · Mandiant's Windows malware emulation framework, which runs PE executables, DLLs, kernel drivers and raw x86/amd64 shellcode on the Unicorn CPU emulator inside a modeled Windows runtime instead of a full VM. Hand-written handlers and a signature database built from win32metadata and phnt emulate Windows API calls, process and thread behavior, the filesystem, registry and network, and each run is recorded as a structured JSON report of API events with named arguments, dropped files and optional memory snapshots. It runs from the speakeasy CLI or as a Python library, and a built-in GDB stub lets an analyst step through an emulated sample.
- [LazyIDA](https://awesomerea.org/resources/lazyida/index.md): Tool · Single-file IDA plugin of convenience actions first written for CTF work. In the disassembly and hex views it dumps a selection as a string, hex string, C/C++ array or Python list of bytes, words, dwords or qwords and copies the result to the clipboard, shows a selection XORed with one byte, fills it with NOPs, and copies or jumps to addresses and file offsets by hotkey. With Hex-Rays it toggles a function’s return type to void, copies item names and jumps to the member function behind an obj->func call on double-click, while a heuristic scan lists printf-family calls whose format argument falls outside read-only constants.
- [Tiny Tracer](https://awesomerea.org/resources/tiny-tracer/index.md): Tool · Intel Pin tool by hasherezade that traces a 32- or 64-bit program while it runs on Windows or Linux, logging API calls (with arguments and return values for watched functions), chosen local and statically linked functions, inline system calls, RDTSC, CPUID and INT instructions, and transitions between sections of the traced module, which helps find the original entry point of a packed module. It can follow code the module unpacks into new memory, disassemble selected ranges and, on Windows, flag the anti-debug and anti-VM checks a sample performs. Each run writes a .tag file of RVA;event lines that PE-bear reads natively and that the wiki shows loading into IDA Pro, Binary Ninja, x64dbg, Ghidra and Cutter to annotate code.
- [Ponce](https://awesomerea.org/resources/ponce/index.md): Tool · IDA Pro plugin, described by its repository as the winner of the 2016 IDA plugin contest, that brings the Triton framework's taint analysis and symbolic execution into IDA's debugger for x86 and x64 programs. After the analyst taints or symbolizes registers, memory or inputs such as argv or a buffer read with fread, Ponce single-steps the debugged program, analyzes each instruction with Triton and renames the functions that the input influences. Its symbolic engine can solve a branch condition, or negate it and inject a satisfying input into memory, while execution snapshots restore earlier state to try that input; builds with Hex-Rays support also show the results in decompiler pseudocode.
- [DRAKVUF Sandbox](https://awesomerea.org/resources/drakvuf-sandbox/index.md): Tool · CERT Polska’s automated black-box malware analysis system built on the DRAKVUF engine, which observes a Windows guest from the Xen hypervisor through virtual machine introspection rather than an agent installed in the guest. Samples submitted through the web interface or the CLI run in a restored snapshot, and the report covers the process tree, WinAPI, file and network activity, a PCAP, intercepted TLS keys, memory dumps, screenshots and capa-based TTP indicators. A drakrun installer builds the Windows guest, its snapshot and the VMI profile.
- [HexRaysPyTools](https://awesomerea.org/resources/hexrayspytools/index.md): Tool · IDAPython plugin for IDA Pro's Hex-Rays decompiler that helps rebuild structures and classes from pseudocode. Its structure builder collects the fields a variable accesses within one function or, with deep scan, across the functions it is passed to, marks virtual tables, resolves conflicting fields and finalizes a C declaration applied to every scanned variable; a Classes view edits classes and their virtual functions, and a graph shows how local types relate. Pseudocode helpers recast and rename across assignments and calls, propagate names, rewrite out-of-bounds pointers as CONTAINING_RECORD for a containing structure, edit function signatures, rename functions from assert strings and untangle if statements.
- [CAPE Sandbox (CAPEv2)](https://awesomerea.org/resources/capev2/index.md): Tool · Malware sandbox derived from Cuckoo v1 that runs samples in isolated Windows guests and records API-hook behavior, created and modified files, network traffic as PCAP, screenshots and memory dumps. Its capemon monitor adds automated unpacking, capturing injected, extracted or decompressed payloads and dumping process images, plus a debugger that YARA signatures or submission options can program with breakpoints and short instruction traces. Results are classified with YARA, Suricata and behavioral signatures, and malware configurations are extracted by parsers maintained in the separate CAPE-parsers package.
- [LuaDec](https://awesomerea.org/resources/luadec/index.md): Tool · Lua bytecode decompiler that turns compiled chunks back into Lua source, with a disassembly mode, selection of single nested functions by number and a guesser for local variable declarations that can be overridden by hand. Its -fc option recompiles each decompiled function and compares it instruction by instruction with the original. It targets Lua 5.1, marks Lua 5.2 and 5.3 support as experimental, and continues Hisham Muhammad’s LuaDec for Lua 5.0 and Zsolt Sztupak’s LuaDec51.
- [xpcspy](https://awesomerea.org/resources/xpcspy/index.md): Tool · Frida-powered command-line tool that observes XPC messages exchanged between processes on iOS and macOS in both directions, for understanding how Apple-platform apps and services talk over XPC. It can spawn or attach to a target over a USB or remote Frida connection, filter the trace by direction (incoming or outgoing) and by service name with wildcards, and optionally parse the binary-plist payloads carried in XPC dictionaries, with bplist00 and bplist16 described as officially supported and bplist15 and bplist17 as experimental. A Python CLI drives a TypeScript Frida agent that is compiled to JavaScript.
- [de4py](https://awesomerea.org/resources/de4py/index.md): Tool · Python deobfuscation and analysis toolkit with a PySide6 GUI and a CLI mode, aimed at analysts examining obfuscated or packed Python programs. It bundles deobfuscators for named Python obfuscators such as Jawbreaker, BlankOBF, PlusOBF, Wodx, Hyperion and pyobfuscate, and an AI-assisted "Onyx" engine that pairs a local Ollama LLM (default qwen2.5-coder:1.5b) with AST cleaning and pattern matching. A file analyzer detects packers such as PyInstaller, computes hashes, looks up suspicious strings and extracts metadata, while a behavior monitor and a Python-code execution shell support dynamic inspection of a target process. It has a plugin API and can be used as a library.
- [Dwarf](https://awesomerea.org/resources/dwarf-debugger/index.md): Tool · PyQt5 debugger built on Frida that attaches to or spawns processes on Android and iOS devices, the local machine or a remote Frida server. A session offers breakpoints, watchpoints, register context, backtraces and threads, a Capstone disassembly view for x86, x64, ARM and ARM64, a hex editor and panels for modules, memory ranges and memory search, while Java explorer, inspector and trace panels and an Objective-C inspector cover mobile app runtimes. User Frida scripts and Python plugins extend a session, and companion commands trace Java methods or native addresses (dwarf-trace), log syscalls from one module on arm64 (dwarf-strace) and scaffold scripting projects with Dwarf API typings (dwarf-creator).
- [bddisasm](https://awesomerea.org/resources/bddisasm/index.md): Tool · Bitdefender’s dependency-free C decoder for x86/x64 instructions, reporting explicit and implicit operands with their access modes, CPUID feature flags, flag accesses and valid modes, and printing Intel/MASM-style text. A minimal API with a 64-byte instruction structure trades detail for speed, and the companion bdshemu library emulates basic x86/x64 code in a raw buffer to flag shellcode-like behaviour such as NOP sleds, reading the instruction pointer, self-modification, TEB/PEB access and system calls. The disasmtool command-line example decodes or emulates files and hex strings.
- [decompyle3](https://awesomerea.org/resources/decompyle3/index.md): Tool · Reworking of uncompyle6 by the same author that translates Python 3.7 and 3.8 bytecode, including some PyPy 3.7 and 3.8 bytecode, back into equivalent Python source; older bytecode stays with uncompyle6. It disassembles code objects with the companion xdis library, then tokenizes and parses the instruction stream with a refactored grammar into a tree from which source is printed, and it can decompile between given start and stop offsets or, through decompyle3-code, only a file's lambdas, generators and comprehensions. The README says the grammar rewrite does not by itself fix uncompyle6's control-flow problem, which the author is addressing with dominator-based analysis in a separate, non-public project.
- [DRAKVUF](https://awesomerea.org/resources/drakvuf/index.md): Tool · Tamas K Lengyel's virtualization-based, agentless black-box binary analysis system: running on the Xen hypervisor through LibVMI, it traces execution in Windows and Linux guests, from kernel functions to user-mode code, without installing software inside the analyzed virtual machine. Plugins log system calls, API calls and file, registry, process, socket and memory activity, extract files from memory before they are deleted and dump process memory, while an injector starts programs in the guest without an in-guest helper. CERT Polska's separate DRAKVUF Sandbox builds an automated sandbox with a GUI on top of it.
- [ViperMonkey](https://awesomerea.org/resources/vipermonkey/index.md): Tool · VBA parser and emulation engine, created by Philippe Lagadec and developed since 2017 mainly by Kirk Sayre and other contributors, for analyzing and deobfuscating malicious macros in Microsoft Office files such as Word, Excel, PowerPoint and Publisher documents, as well as VBScript files and HTA files carrying VBScript. The vmonkey command reads the macros through oletools' olevba, emulates them from their auto-run entry points or from functions the analyst names, and reports the recorded actions, such as process creation, along with optional intermediate IOCs and the files the code would write; vbashell is an interactive VBA shell. A Python API evaluates VBA snippets, walks and emulates individual code blocks, replaces functions and deobfuscates code.
- [BREAD](https://awesomerea.org/resources/bread-bios-debugger/index.md): Tool · Injectable real-mode x86 debugger for legacy BIOS code, boot code and DOS programs on real hardware or in a virtual machine. A small 16-bit assembly stub placed in the target code installs interrupt handlers, single-steps the processor and talks over a serial line to a Linux bridge, which translates its simple packets into the GDB remote protocol so GDB can read and write memory and registers, step, continue and set one hardware breakpoint and one watchpoint at a time. A companion script turns an address–label list into a minimal ELF symbol file for GDB.
- [Mergen](https://awesomerea.org/resources/mergen/index.md): Tool · Function-level lifter that symbolically lifts one x86-64 function from a Windows PE binary into LLVM IR, then iterates LLVM and custom passes to a fixpoint so obfuscated or virtualized code reduces to simpler control flow and semantics for analysis. Its scope document lists 119 instruction handlers, two-way branches and tested jump-table shapes; README examples lift small test functions the authors protected with VMProtect and Themida, and the IR can be compiled for viewing in a decompiler.
- [readpe (formerly pev)](https://awesomerea.org/resources/readpe/index.md): Tool · Command-line toolkit, formerly named pev, for analyzing 32- and 64-bit Windows PE files. readpe prints the DOS, COFF and optional headers, sections, data directories, imports and exports, while companion tools disassemble code (pedis), hash the file, headers or sections with ssdeep and imphash among others (pehash), list and extract resources (peres), match packer signatures (pepack), flag traits such as TLS callbacks, high entropy or an unusual entry point (pescan), report ASLR, DEP/NX, SEH and stack-cookie flags and dump certificates (pesec), find strings and convert between file offsets and RVAs. Output plugins write text, CSV, XML, HTML or JSON, and the bundled libpe C library provides the parser.
- [malware-jail](https://awesomerea.org/resources/malware-jail/index.md): Tool · Node.js sandbox for semi-automatic analysis of JavaScript malware: it runs a sample in Node's vm module against emulated Windows Script Host and ActiveX objects such as WScript.Shell, MSXML2.XMLHTTP, ADODB.Stream, Scripting.FileSystemObject and WMI, plus a partial browser context with selectable browser profiles. It logs the objects created and methods called, keeps every eval() argument to help deobfuscation, records requested URLs and WMI queries, and saves the files a dropper tries to write so payloads can be examined. When the run ends, the whole sandbox context is dumped to JSON for review.
- [gxpc](https://awesomerea.org/resources/gxpc/index.md): Tool · macOS command-line XPC sniffer, inspired by xpcspy, that injects a Frida agent into an attached or newly spawned process and logs the XPC messages it sends and receives, labelled with the libxpc function, connection name, peer PID and process name. The agent recursively converts xpc_object_t dictionaries, arrays and scalar values into readable output and decodes binary-plist payloads, while a Go host built on frida-go selects a local, USB or remote Frida device, filters connections by name or PID and can save the trace to a file. It observes how Apple-platform apps and services communicate over XPC and does not alter or inject messages.
- [Manticore](https://awesomerea.org/resources/manticore/index.md): Tool · Trail of Bits' now-archived symbolic execution tool for Linux ELF binaries on x86, x86-64, AArch64 and ARMv7, Ethereum smart contracts as EVM bytecode, and WebAssembly modules. It runs a program on symbolic inputs to explore the states it can reach, generates concrete inputs that lead to a chosen state and detects crashes and other failures, solving constraints with an external Yices, Z3 or CVC4 solver. The manticore CLI writes generated test cases to an mcore_ workspace, while the Python API adds instruction hooks, event callbacks and custom initial states; manticore-verifier checks contract properties written in the contract's own language.
- [Ghidra Ninja ghidra_scripts](https://awesomerea.org/resources/ghidra-ninja-scripts/index.md): Tool · Thomas Roth's (Ghidra Ninja) collection of Ghidra Python scripts, which appear under a Ghidra Ninja category in the Script Manager. binwalk.py and yara.py run binwalk or bundled YARA crypto-constant rules over the loaded program and bookmark the findings, YaraSearch.py does the same with a rule file the user chooses, swift_demangler.py demangles Swift function names, golang_renamer.py restores function names in stripped Go binaries from the .gopclntab table, and export_gameboy_rom.py writes a working ROM back out of a Game Boy program imported with GhidraBoy.
- [FindCrypt - Ghidra Edition](https://awesomerea.org/resources/findcrypt-ghidra/index.md): Tool · Ghidra script that ports Ilfak Guilfanov's FindCrypt plugin for IDA, searching a program's memory or the current selection for constants of cryptographic and compression algorithms. Its serialized signature database keeps the original plugin's 79 algorithm constant sets and, by the README's count, holds 122 detectable constants for hash functions, block and stream ciphers, Curve25519 code, Keccak and zlib; when a whole constant is absent, the script also looks for its individual elements and reports partial matches above a detection threshold. Hits become Ghidra bookmarks and a results table from which matching data can be defined.
- [Binary Refinery](https://awesomerea.org/resources/binary-refinery/index.md): Tool · Large collection of composable Python command-line units for transforming binary data: encodings, compression, encryption, archive and executable-format extraction, carving and pattern search. Each unit reads stdin and writes stdout, so units chain into shell pipelines, while framing, multibin arguments and meta variables let one pipeline process many chunks, and the binref command searches unit help. The author describes it as a command-line take on CyberChef focused on malware triage; the README also points to a separate binref/agent repository of instructions for language-model agents that use refinery.
- [AngryGhidra](https://awesomerea.org/resources/angryghidra/index.md): Tool · Ghidra extension that runs angr symbolic execution from a CodeBrowser panel. The analyst marks a destination address, an optional start address and addresses to avoid with hotkeys, and can make program arguments, memory ranges or registers symbolic, write concrete values into memory and registers, hook instructions or apply bytes patched in Ghidra to the angr project. A bundled Python script runs angr's explorer on the program's original file, the listing highlights the instructions along the path it finds, and the panel shows the argument, memory and stdin values that reach the destination.
- [fpicker](https://awesomerea.org/resources/fpicker/index.md): Tool · Frida-based fuzzing suite for closed-source programs, listed here for its in-process instrumentation and coverage layer. A JavaScript harness injected with Frida starts Stalker at an analyst-chosen function and records the basic blocks executed in the target module on each call, feeding either AFL++'s coverage bitmap or fpicker's own standalone mode. Its passive mode works as a tracer: it attaches to a running process without sending inputs and stores each input that reaches the function together with new coverage, on the local host or on USB and network devices running frida-server.
- [RetroWrite](https://awesomerea.org/resources/retrowrite/index.md): Tool · HexHive's static binary rewriter for x64 and aarch64 Linux ELF binaries, which turns a binary into symbolized, reassemblable assembly so instrumentation can be inserted without source code and without heuristics. Bundled passes add a binary-only AddressSanitizer and AFL coverage instrumentation, plus a coarse-grained control-flow-integrity pass on aarch64, and the symbolized assembly can also be edited by hand or by other tools before reassembly. The KRetrowrite variant of the x64 rewriter instruments Linux kernel modules with BASan or kcov for kernel fuzzing.
- [Interruptor](https://awesomerea.org/resources/interruptor/index.md): Tool · Frida library, taken from the Dexcalibur project, that uses Frida’s Stalker to trace a process’s system calls and print strace-like lines with the calling thread, module and offset, decoded flag values and file paths resolved from descriptors. A trace can be limited to chosen modules and syscalls by name or pattern, started when a given library loads, extended with Interceptor-style per-syscall callbacks, and used to write drcov basic-block coverage files. The README documents Linux and Android on AArch64 and x64; the source also contains AArch32 Linux and macOS arm64 and x64 entry points.
- [dyld_cache_extract](https://awesomerea.org/resources/dyld-cache-extract/index.md): Tool · macOS application and command-line tool that reads a dyld_shared_cache file from macOS or iOS, shows its header, mappings and image list, and copies one library or every library out to a directory. The CLI offers --info, --extract and --extract-all; the GUI presents the same header details and lets users select images to extract. The README marks the project obsolete and points to the author's dyld-cache-dump.
- [FLARE IDA Pro utilities](https://awesomerea.org/resources/flare-ida/index.md): Tool · Archived collection of IDAPython plugins and scripts from Mandiant's FLARE team for malware and native-code analysis in IDA Pro. It searches code for precomputed API-name hashes used by shellcode, recovers strings built on the stack (statically, or by emulation with flare-emu in ironstrings), applies function types to structure fields and indirect calls, annotates imports with MSDN function, argument and constant information, and uses idb2pat to generate pattern files from an IDB's functions for building FLIRT signatures. Other scripts track static arguments to functions such as string decoders, link Objective-C selector references to their implementations in Mach-O files, and graft stub implementations of common Windows API imports so that decoding or unpacking code can run under IDA's Bochs emulation.
- [Binlex](https://awesomerea.org/resources/binlex/index.md): Tool · Binary trait-lexer framework that extracts instructions, basic blocks and functions from executables and emits searchable JSON traits for similarity, hunting and signature work. It models code with a genomics-inspired hierarchy and computes features such as MinHash, TLSH, SHA256, entropy and wildcard byte patterns, so samples can be compared, clustered and turned into signatures at scale. It ships a CLI suite, a Rust API, Python bindings and an IDA plugin, can generate YARA rules from its patterns, and runs processors locally or over IPC and HTTP.
- [Driver Buddy Reloaded](https://awesomerea.org/resources/driver-buddy-reloaded/index.md): Tool · IDA Pro Python plugin for triaging Windows kernel drivers, building on NCC Group's original DriverBuddy. Its auto-analysis identifies the driver model (WDM, KMDF, UMDF, WDF, Mini-Filter, Stream Minidriver, AVStream or PortCls), locates the device-control dispatch routines, labels IRP, IO_STACK_LOCATION and WDF structures and calls, and discovers and decodes IOCTL codes through Hex-Rays ctree, switch-table and immediate-operand scans. It also reports device names, symbolic links and device ACLs, pool tags, flagged APIs and opcodes, name-based call chains and heuristic vulnerability leads with per-IOCTL risk scores, in an IDA findings window, a JSON file and an HTML report.
- [FA (Firmware Analysis)](https://awesomerea.org/resources/fa-firmware-analysis/index.md): Tool · Python framework, mainly used as an IDA plugin, that turns the manual steps of locating symbols, such as finding a string, following its cross-reference and taking the function start, into reusable signatures. Hjson SIG files, grouped into per-platform projects, chain commands that search bytes, strings, immediates or Keystone-assembled opcodes, filter by operands and cross-references, and then set names, types, constants, enums and struct members; Python scripts can drive the same interpreter. In IDA it adds an FA menu and toolbar to find all of a project's symbols, draft a temporary signature from the current function and export symbols plus a C header, and a separate loader runs signatures over a raw ELF file without IDA.
- [pyinstxtractor-ng (PyInstaller Extractor Next Generation)](https://awesomerea.org/resources/pyinstxtractor-ng/index.md): Tool · Fork of PyInstaller Extractor (pyinstxtractor) by the same author that extracts the bundled CArchive files and PYZ modules from Linux ELF and Windows PE executables built with PyInstaller, writing .pyc files with repaired headers for a separate bytecode decompiler. Unlike the original script, it unmarshals the PYZ archive with the xdis library, so it does not have to run under the Python version that built the executable, and it automatically decrypts PYZ entries that PyInstaller's optional AES encryption protected, using the key module bundled in the same executable. A one-directory mode extracts the PYZ next to the other files so the result can be run directly, and --info prints archive metadata such as versions, entry points and encryption without writing files.
- [CoBRA (Coefficient-Based Reconstruction of Arithmetic)](https://awesomerea.org/resources/cobra-mba-simplifier/index.md): Tool · Trail of Bits' C++23 simplifier for Mixed Boolean-Arithmetic (MBA) expressions, an obfuscation technique that rewrites simple computations as interleaved arithmetic, bitwise and shift operations. Given an expression and a bit width from 1 to 64, cobra-cli returns a simpler equivalent: a worklist scheduler combines signature-vector and change-of-basis techniques, semilinear handling of constant masks, polynomial recovery, decomposition of mixed products and subexpression lifting, and each result is checked on random inputs or, optionally, with a Z3 equivalence proof. The same engine is available as a library and as an optional LLVM pass plugin that simplifies MBA expressions it detects in LLVM IR.
- [ollvm-unflattener](https://awesomerea.org/resources/ollvm-unflattener/index.md): Tool · Python command-line deobfuscator for the control-flow flattening applied by Obfuscator-LLVM (OLLVM). Given a flattened function's address, it uses Miasm's symbolic execution to track the dispatcher's state variable, records which blocks each state value selects and which state follows it, and writes a copy of the binary in which the function is reassembled with Keystone in its recovered order; an optional mode also follows the function's calls. The README covers 32- and 64-bit x86 Windows and Linux binaries and contrasts this approach with MODeflattener's static one.
- [GolangAnalyzerExtension](https://awesomerea.org/resources/ghidra-golanganalyzerextension/index.md): Tool · Ghidra extension whose Golang Analyzer reads the runtime header and module data in Go binaries built with go1.6 through go1.27 to identify the Go version, rename functions, correct their arguments, comment source files and line numbers, add Go types to the Data Type Manager and label Go strings. A plugin window lists the recovered functions, types, source files and strings with links to Go source, and WebAssembly builds are handled when a separate Wasm loader such as ghidra-wasm-plugin is installed. A bundled script also renames functions that decode gobfuscate-style obfuscated strings and comments the decoded text.
- [IDA iOS Helper](https://awesomerea.org/resources/ida-ios-helper/index.md): Tool · IDA Pro plugin that cleans up Hex-Rays pseudocode and adds navigation helpers for iOS user-mode binaries and the kernelcache, enabling its components according to the loaded file. For Objective-C and Swift code it hides reference-counting calls, selectors and static class arguments, collapses os_log sequences, turns property helpers into plain assignments or field reads, lists cross-references to a method's selector, and adds Swift type declarations and readable stack strings. For kernelcaches it types the results of safeMetaCast and typed operator new, names and types kalloc_type_view globals, fixes this arguments and lists the possible implementations of a virtual call, while shared helpers remove __break calls, rewrite ranged conditions, collapse block initializers and mark outlined functions.
- [MAMBO](https://awesomerea.org/resources/mambo/index.md): Tool · Dynamic binary modification framework from the University of Manchester that runs unmodified Linux user-space programs on 32-bit Arm (A32/T32), AArch64 and RV64GC RISC-V, translating their code into a code cache as it executes. An event-driven C plugin API registers callbacks on code-scanning and execution events and emits instrumentation; sample plugins count instruction mixes, branches and blocks, trace memory accesses and system calls, find hotspots, simulate caches, check memory errors and detect data races.
- [Class Informer](https://awesomerea.org/resources/class-informer/index.md): Tool · IDA Pro plugin that scans Microsoft Visual C++ binaries for virtual function tables (vftables) through their C++ run-time type information (RTTI), names, labels and comments the vftables it finds, defines the RTTI data structures and identifies single, multiple and virtual inheritance in each class hierarchy. It also processes static initializer and terminator tables, and opens a list window of the vftables with their method counts and class hierarchies, where each line jumps to its vftable. Its author notes that IDA 9's built-in RTTI plugin now finds nearly all of this data, so the current version only sets types that IDA missed and serves mainly as a gathering and browsing view.
- [Kam1n0](https://awesomerea.org/resources/kam1n0/index.md): Tool · Server platform from McGill University's Data Mining and Security Lab that indexes collections of disassembled binaries into shared repositories and searches them for cloned assembly functions. Its applications cover subgraph clone search within one instruction-set family (Asm-Clone), cross-architecture semantic search over VEX IR using symbolic and concrete execution (Sym1n0), Asm2Vec representation learning aimed at compiler optimization and obfuscation, and executable classification built on Asm2Vec. An IDA Pro plug-in sends functions to the server and shows flow-graph, text-diff and clone-group views; the README's accuracy and query-time figures come from the authors' own papers.
- [iblessing](https://awesomerea.org/resources/iblessing/index.md): Tool · Toolkit for analyzing iOS apps and arm64 Mach-O binaries, built on Capstone, Unicorn and Keystone. Its scanners extract app-bundle metadata such as URL schemes and transport-security settings, locate Objective-C class references and NSPredicate uses, detect symbol wrappers, and partially emulate arm64 code with Unicorn to recover objc_msgSend cross-references, including those passed through blocks. Generators turn the reports into IDA Pro scripts that add cross-references and rename wrappers, or into a local query server, and a shared core library with a plug-in interface supports custom tools.
- [SiMBA](https://awesomerea.org/resources/simba-mba-simplifier/index.md): Tool · Research tool from Denuvo that simplifies linear mixed Boolean-arithmetic (MBA) expressions, which combine bitwise and integer operations and are used in code obfuscation. Like MBA-Blast and MBA-Solver it works algebraically, using the fact that a linear MBA is fully determined by its values on inputs of zeros and ones: it evaluates the expression on every such combination and rewrites it as a linear combination of basic bitwise expressions, without first translating it to 1-bit space. Python scripts simplify single expressions or whole datasets, can check that an input is linear and can prove the result equivalent with Z3.
- [GTIRB](https://awesomerea.org/resources/gtirb/index.md): Tool · GrammaTech's intermediate representation for passing disassembly, analysis and rewriting results between binary tools, modeled on the role LLVM-IR plays for compilers. An IR holds modules for executables or libraries with their sections, byte intervals, code and data blocks, symbols and symbolic operands, plus an inter-procedural CFG and AuxData tables for analysis results, all referenced by UUID; instruction semantics are deliberately left out, so machine code stays as raw bytes for Capstone/Keystone or any other IL. It serializes as protobuf, with C++, Python and Common Lisp APIs and a partial Java API; the separately listed ddisasm produces it.