Binary · Tool:
Quarkslab’s binary exporter, inspired by BinExport, saves a disassembler’s analysis to a protobuf .quokka file so functions, basic blocks, data, cross-references, segments and optionally decompiled code can be used later without the disassembler.
Reviewed quarkslab/quokka@5afe14b
Binary · Tool:
Static reverse-engineering toolkit in Rust, installed as the knife command, that parses PE, ELF, Mach-O and WebAssembly files without running them.
Reviewed bl4ckr0ss3/knife@f260b87
Binary · Tool:
Python binary analysis framework that loads ELF and PE programs, disassembles 32- and 64-bit x86 and 32-bit ARM code with Capstone and translates it into the REIL intermediate language, so its analyses do not depend on the source architecture.
Reviewed programa-stic/barf-project@9547ef8
Game · Tool:
MIPS instruction decoder written in C that never allocates on the heap, with Python, C++ and Rust bindings in the same repository and the stated aim of producing matching assembly.
Reviewed Decompollaborate/rabbitizer@724a49a
Binary · Tool:
Python command-line decompiler that drives Ghidra through pyghidra to decompile every function of a binary into separate C files, or into one C file and header with Ghidra's C++ exporter, keeping the Ghidra project so later runs can reuse the analysis.
Reviewed clearbluejar/ghidrecomp@7a82556
Binary · Tool:
Pure-Python reverse-engineering framework that combines the vivisect static analyzer, the vtrace debugging library and the vdb debugger.
Reviewed vivisect/vivisect@66c93f0
Binary · Tool:
radare2's official scripting interface, with implementations for more than two dozen languages in one repository.
Reviewed radareorg/radare2-r2pipe@c355810
Binary · Tool:
Galois's command-line tool, Ghidra plug-in and Haskell library for checking properties of binaries with under-constrained symbolic execution.
Reviewed GaloisInc/grease@b94e1e0
Binary · Tool:
Interactive terminal disassembler, formerly named Reverse, for x86 and x86-64 with partial ARM and MIPS/MIPS64 support, reading ELF, PE and raw binaries.
Reviewed plasma-disassembler/plasma@ec7df9b
App · Tool:
Derek Selander's macOS command-line utility for inspecting and controlling iOS devices connected over USB or Wi-Fi through Apple's private MobileDevice framework.
Reviewed DerekSelander/mobdevim@68cddb3
Binary · Tool:
Qt-based PE file viewer and editor for Windows, Linux and macOS by horsicq, the author of the catalog's Detect It Easy.
Reviewed horsicq/XPEViewer@828a0fb
App · Tool:
Ruben Boonen's Electron desktop application that wraps frida-node and the Monaco editor into one window for writing, injecting and refining Frida scripts.
Reviewed FuzzySecurity/Fermion@79b2643
Binary · Tool:
Mandiant FLARE's Ghidra extension that embeds the user's local CPython 3 interpreter in Ghidra through Jep, as an alternative to Ghidra's Jython-based Python 2.7 scripting.
Reviewed mandiant/Ghidrathon@56866ad
Binary · Tool:
Lightweight x86/AMD64 disassembler library in C that the README describes as a decomposer: besides formatted text, distorm_decompose returns a binary structure per instruction with its opcode, operands, prefixes, flow-control class and optionally affected CPU flags.
Reviewed gdabah/distorm@7a02caa
App · Tool:
Dynamic Java-method instrumentation kit for Android 5.0 that lets analysts write their own tracing and profiling tools for apps whose source code they do not have.
Reviewed ZSShen/ProbeDroid@a6dc602
App · Tool:
Small Python command-line tool that attaches to a running process through Frida and writes its accessible memory ranges to files, run from a Windows, Linux or macOS host against iOS, Android or Windows applications.
Reviewed Nightbringer21/fridump@3e64ee0
Binary · Tool:
Command-line tool, built on the GoRE library, that recovers metadata from stripped binaries produced by the Go compiler.
Reviewed goretk/redress@fe38d96
Firmware · Tool:
Ghidra processor module that adds nanoMIPS disassembly and decompilation through a SLEIGH specification of the little-endian 32-bit nanoMIPS instruction set, including its multithreading instructions.
Reviewed nccgroup/ghidra-nanomips@62ebe71
Binary · Tool:
Python recursive disassembler library built on Capstone that recovers control-flow graphs from PE, ELF and Mach-O files, .NET assemblies, raw DEX files and memory dumps with a known base address, through x86/x64, AArch64, 32-bit ARM/Thumb, CIL and Dalvik backends.
Reviewed danielplohmann/smda@04652e6
Binary · Tool:
JavaScript library for Frida agents that traces native functions from a declarative description: each function is listed with its return type and input and output arguments, including pointers, UTF-8 and UTF-16 strings and byte arrays whose length is bound to another argument or the return value, with conditions such as reading an output pointer only when the call succeeds.
Reviewed nowsecure/frida-trace@9b92c17
Binary · Tool:
Research artifact for the USENIX Security 2023 paper “Decompiling x86 Deep Neural Network Executables”.
Reviewed monkbai/DNN-decompiler@33227a0
Binary · Tool:
Fork of the SourceForge Boomerang project, a general machine-code decompiler that translates executables into C.
App · Tool:
Pure-Python toolkit for static Mach-O and Objective-C analysis, used as the ktool command line, a terminal browser (ktool open) or a library, with no compiled dependencies.
Reviewed 0cyn/ktool@faed829
App · Tool:
Burp Suite extension by Federico Dotta and Piergiovanni Cipolloni that bridges Burp and Frida, so an analyst can run an app's own functions on the HTTP messages it exchanges with its backend instead of reimplementing its encryption, encoding or signing.
Reviewed federicodotta/Brida@f335034
Binary · Tool:
All-in-one malware triage tool that statically analyses Windows PE, Linux ELF (including Go binaries), macOS Mach-O and Android APK, JAR and DEX files as well as Office and PDF documents, scripts, shortcuts, archives, e-mails and PCAPs, reporting imports and API categories, sections, strings and IOCs, packers, embedded executables, Android permission risk, YARA matches and, for Windows and Linux, MITRE ATT&CK mappings.
Reviewed CYB3RMX/Qu1cksc0pe@180d44f
App · Tool:
Frida-based framework by Nishant Das Patnaik, shown at Black Hat Arsenal 2016, for watching the system API calls that native macOS, iOS and Android apps make.
Reviewed dpnishant/appmon@f753c4d
Binary · Tool:
Airbus CERT plugin that embeds Ghidra's native decompiler in IDA Pro and IDA Free: pressing F3 on a function shows Ghidra's C output inside IDA, and edits made there, covering global symbols such as function prototypes and the names and types of stack and register variables, are saved to the IDA database.
Reviewed airbus-cert/Yagi@6fc4787
App · Tool:
Marco Ivaldi's (raptor) collection of Frida JavaScript instrumentation scripts for reverse engineering mobile apps and Linux programs.
Reviewed 0xdea/frida-scripts@987ba48
Binary · Tool:
Windows process viewer and system inspector, formerly Process Hacker, for examining running programs and the system around them.
Reviewed winsiderss/systeminformer@999fe5e
Binary · Tool:
GCHQ's browser-based workbench for decoding, decrypting, decompressing, parsing and carving data by chaining operations into a recipe, with all processing done client-side.
Reviewed gchq/CyberChef@d4d96c6
Binary · Tool:
VirusTotal's pattern-matching tool for identifying and classifying files such as malware samples with rules that combine text, hex and regular-expression strings with a Boolean condition.
Reviewed VirusTotal/yara@6d47342
Game · Tool:
Memory scanner, debugger, disassembler and assembler for inspecting and changing running games and other applications; its README calls it a development environment focused on modding games and applications for personal use.
Reviewed cheat-engine/cheat-engine@ec45d5f
Binary · Tool:
Python script that drives Sysinternals Process Monitor to record what a program does while it runs, filters out routine system activity and writes a text report of the processes it created and its file, registry and network activity.
Reviewed Rurik/Noriben@4c84a98
Binary · Tool:
Machine and user-space emulator that runs code built for one CPU architecture on another through its TCG dynamic translator.
Reviewed qemu-project/qemu@f71afb4
Binary · Tool:
Open-source macOS hex editor that inspects and edits binary files of any size without loading them into memory.
Reviewed HexFiend/HexFiend@32cb2ef
Binary · Tool:
User-mode (ring 3) anti-anti-debug library for 32- and 64-bit Windows programs that hooks system functions so the program being debugged cannot detect the debugger.
Reviewed x64dbg/ScyllaHide@baa5c8e
Binary · Tool:
VirusTotal's Rust rewrite of YARA for identifying and classifying files with pattern-matching rules.
Reviewed VirusTotal/yara-x@1bda5fc
Binary · Tool:
Memory structure editor for reconstructing the classes and data structures of a running x86 or x64 process, a .NET port of ReClass with many additions.
Reviewed ReClassNET/ReClass.NET@a02fcb9
Binary · Tool:
IDA Pro plugin built on the Keystone assembler engine that patches a binary from typed assembly, fills an address range with instructions or raw bytes and searches the loaded binary for assembly instructions.
Reviewed keystone-engine/keypatch@e7ecb93
Binary · Tool:
Qt-based graphical debugger for AArch32, x86 and x86-64 programs, inspired by OllyDbg, with Linux as its only officially supported platform.
Reviewed eteran/edb-debugger@b8640eb
Binary · Tool:
Mandiant FLARE Python library that pairs IDA Pro, Rizin or Radare2 with the Unicorn emulator so analysts can script emulation of the binary they are analyzing, for 32- and 64-bit x86, ARM and ARM64.
Reviewed mandiant/flare-emu@6688c32
Binary · Tool:
Hex-Rays' commercial interactive disassembler, decompiler and debugger, which turns compiled code for more than 70 processor families into annotated, cross-referenced assembly and decompiled pseudocode.
Reviewed hex-rays.com/ida-pro
Binary · Tool:
Vector 35's commercial interactive disassembler, decompiler and debugger, whose decompiler is built on the BNIL family of intermediate languages and shows either C or BNIL for every officially supported architecture.
Reviewed binary.ninja
Binary · Tool:
Cryptic Apps' commercial disassembler, decompiler and debugger for macOS and Linux, which reads Mach-O (macOS and iOS), PE and ELF executables built for 32- and 64-bit Intel, ARMv6, ARMv7, ARM64 and PowerPC processors.
Reviewed hopperapp.com
Binary · Tool:
Microsoft's WinDbg debugger and the Debugging Tools for Windows, documented on Microsoft Learn, for debugging live user-mode and kernel-mode code, analyzing crash dumps and examining CPU registers and memory.
Reviewed learn.microsoft.com/en-us/windows-hardware/drivers/debugg…
Binary · Tool:
SweetScape Software's commercial hex and text editor whose Binary Templates, C/C++-like struct definitions with control flow and functions, parse binary files into hierarchical, editable structures.
Reviewed sweetscape.com/010editor
Binary · Tool:
Winitor's Windows tool for initial malware assessment, which statically inspects Windows executable files and reports key indicators such as hard-coded URLs and IP addresses, flagged imports, resources and overlay data.
Reviewed winitor.com
Binary · Tool:
32-bit assembler-level analyzing debugger for Windows that emphasizes binary code analysis for programs without source; its site says development is frozen, and the newest version it lists is 2.01 of 27 September 2013.
Reviewed ollydbg.de/viewer.htm
Binary · Tool:
IDA Pro plugin for exploring execution traces of a binary: it loads an externally recorded trace and lets the analyst step forwards and backwards through time while the disassembly shows the execution flow in both directions.
Reviewed gaasedelen/tenet@62c0bec
Binary · Tool:
IDA Pro plugin that scans the loaded database with YARA rules for cryptographic constants and similar signatures, lists the matches in a results window and names each matching address after its rule.
Reviewed polymorf/findcrypt-yara@044644b
Binary · Tool:
IDA Pro plugin that adds register and stack views to the debugger in which pointers are dereferenced and colored, similar to the context displays of GDB plugins such as PEDA, GEF and pwndbg.
Reviewed danigargu/deREferencing@797a615
Binary · Tool:
IDAPython scripts that find code patterns in Hex-Rays decompiler output, independent of the binary's processor architecture, by running user-written lambda queries over the decompiled ctree.
Reviewed patois/HexraysToolbox@d04869a
Binary · Tool:
IDAPython tool that reconstructs C++ virtual tables in IDA Pro for 32- and 64-bit Intel and AArch64 code by observing indirect calls while the program runs under IDA's debugger.
Reviewed 0xgalz/Virtuailor@f5e20a0
Binary · Tool:
x64dbg plugin that annotates the static code of the debugged x86 or x64 executable with function-call, argument and loop analysis.
Reviewed ThunderCls/xAnalyzer@09b7742
Binary · Tool:
Extensible Python debugger UI toolkit that attaches utility views to LLDB, GDB, VDB and WinDbg/CDB sessions.
Reviewed snare/voltron@be9e54b
Binary · Tool:
Static binary translation library that lifts AArch64, SPARC32, SPARC64, x86 and amd64 machine code, including AVX and AVX512, into LLVM bitcode, with AArch32 support underway.
Reviewed lifting-bits/remill@56918a8
Binary · Tool:
Official Qt-based graphical interface for the radare2 reverse-engineering framework, aiming for parity with radare2's commands, features and keybindings so that existing r2 plugins and scripts keep working.
Reviewed radareorg/iaito@a043f93
Binary · Tool:
Hex-Rays decompiler plugin for navigating and reconstructing C++ code in IDA's pseudocode window.
Reviewed REhints/HexRaysCodeXplorer@dc48267
Binary · Tool:
Standalone .gdbinit file written with GDB's Python API that shows a modular status interface each time the debugged program stops, reducing the commands needed to inspect its state.
Reviewed cyrus-and/gdb-dashboard@7b9b126
Binary · Tool:
Cross-platform hex editor for reverse engineering that handles files over 1 TB.
Reviewed solemnwarning/rehex@1e4fcd4
Binary · Tool:
Lightweight, modular hook framework for Windows, macOS, iOS, Android and Linux on x86, x86-64, ARM and ARM64.
Reviewed jmpews/Dobby@5dfc854
Binary · Tool:
Command-line tool and Python library that extracts and decodes obfuscated Excel 4.0 (XLM) macros from xls, xlsm and xlsb files.
Binary · Tool:
Python module that shows Portable Executable files in a tree view using pefile and PyQt5, as a standalone application and as a plugin for IDA Pro, Ghidra, Volatility, Rekall and minidump.
Reviewed blackberry/pe_tree@2be607f
Binary · Tool:
Open-source Windows tool that explores and decompiles the RPC functionality present on a Microsoft system.
Reviewed silverf0x/RpcView@14d5e1a
Binary · Tool:
Python package for symbolic analysis of binaries.
Reviewed bdcht/amoco@3e36c52
App · Tool:
Collection of LLDB commands for debugging iOS apps.
Reviewed meta/chisel@b28507a
Binary · Tool:
Browser-based frontend to the GNU debugger, gdb.
Reviewed cs01/gdbgui@773b916
Binary · Tool:
Decompiler that turns Ethereum Virtual Machine bytecode into readable Solidity-syntax contracts, supported on Linux and macOS.
Reviewed msuiche/porosity@b407155
Binary · Tool:
Automation-ready disassembly and static analysis library for shellcode and PE binaries that outputs disassembly, functions and imports as JSON.
Reviewed endgameinc/xori@d58a742
Binary · Tool:
Visual reverse-engineering tool that gives a quick overview of the data types present in a file.
Reviewed wapiflapi/binglide@60168d8
Binary · Tool:
Reverse Engineering Software Interface built around ELFsh, an interactive and scriptable shell for reading and modifying ELF objects, and e2dbg, an embedded ELF debugger.
Reviewed thorkill/eresi@4769c17
Binary · Tool:
Terminal tool that visualises binary data like a hexdump, but draws each octet as a coloured square from a palette.
Reviewed FireyFly/pixd@f49add4
Binary · Tool:
Unofficial, extended continuation of Universal Extractor that unpacks files from standard archives, application installers, disk images and game archives.
Reviewed Bioruebe/UniExtract2@9719ac9
Binary · Tool:
Function hooking toolkit for arm64 XNU devices: a C function hooker that patches memory pages directly, an Objective-C function hooker, an arm64 assembler, JIT inline assembly for Swift and a reimplementation of the Substrate and libhooker APIs.
Reviewed tealbathingsuit/ellekit@1017a0d
Binary · Tool:
Linux and macOS reimagining of the Sysinternals ProcDump tool that writes process dumps in response to performance, runtime, signal and resource-tracking triggers, including native dumps through a Rust ELF writer and managed dumps through .NET diagnostics IPC.
Reviewed microsoft/ProcDump-Linux@2f83148
App · Tool:
Small library that dynamically rebinds symbols in Mach-O binaries running on iOS, on device and in the simulator, by updating the lazy and non-lazy symbol pointers that dyld uses.
Reviewed meta/fishhook@aadc161
Binary · Tool:
VBA p-code decompiler based on pcodedmp, written for Office documents whose macro source has been stomped to leave only bytecode.
Reviewed Big5-sec/pcode2code@65ae983
Binary · Tool:
rust-deobf analyzes compiled, mainly Rust, ELF, PE and Mach-O binaries to recover hidden strings and related artifacts.
Reviewed VAHPEM/rust-deobf@04a9c4a
Binary · Tool:
CFG Visualizer extracts function control-flow graphs from ELF, PE and Mach-O binaries with radare2 and presents them in an interactive 3D browser view.
Reviewed zhameersheraz/cfg-visualizer@76a84f0
Binary · Tool:
Cpp2CS recovers managed methods from Android ARM64 Unity IL2CPP ELF binaries and matching metadata, emitting CIL assemblies, C# source and per-method diagnostics.
Reviewed MetaMikuAI/Cpp2CS@c1acd6b
Binary · Tool:
ghidra-c6000 adds Texas Instruments C64x, C67x and C674x DSP support to Ghidra 12.x.
Reviewed geepot/ghidra-c6000@6cf197e
Binary · Tool:
cocos2d-dumper extracts defined function symbols from ELF shared libraries and demangles C++ names with GNU binutils.
Reviewed d1xus/cocos2d-dumper@c53f57c
Binary · Tool:
Binary Ninja Security Analysis Plugin batches binary analysis from a Rust plugin and exports Parquet reports.
Binary · Tool:
Human-Readable Decompilation restructures C produced by Ghidra's binary decompiler using an ANTLR parser and AST transformations.
Binary · Tool:
BinStruct Inspector is a GUI for examining binary file layouts through user-defined field trees.
Binary · Tool:
SimpleParserPE is a C++ command-line inspector for PE32 Windows executables.
Reviewed wmitq/SimpleParserPE@0e3f99c
Binary · Tool:
tenet_tracer uses Intel Pin to record instruction-level execution traces for Tenet.
Reviewed mahmoudimus/tenet_tracer@26fa9b4
Binary · Tool:
BinScan scans files in bulk and emits per-file JSON containing format identification, structural metadata, hashes and entropy.
Reviewed Mraxzist/BinScan@7bd7e78
App · Tool:
Patch-0xC0000022 instruments the running Windows SysMain service by changing its NtCreateFile response to STATUS_ACCESS_DENIED.
App · Tool:
iMonitor is a Windows endpoint activity monitor for examining running software.
Binary · Tool:
m68kdasm disassembles Motorola 68000-family machine code in Go and returns assembly with structured instruction metadata.
Reviewed jenska/m68kdasm@a4de220
Binary · Tool:
IR Lifting Benchmark compares binary lifting workflows across Ghidra P-code, angr VEX, BAP BIL and optional LLVM IR paths.
Reviewed Prajwal-kp-18/ir-analysis@20cc18c
Binary · Tool:
Bin-Hunter is a Python command-line tool for initial static inspection of binary files.
Reviewed Emirzonee/Bin-Hunter@28d2636
Binary · Tool:
BinaryInsight inspects ELF, PE, and Mach-O executables and libraries in an interactive terminal view or a text-report CLI.
Reviewed ismailtsdln/BinaryInsight@bd51371
Binary · Tool:
rust-sig-gen generates IDA FLAIR library signatures from compiled Rust crates for executable analysis.
Reviewed st0de/rust-sig-gen@8890d96
App · Tool:
1C 7.7 Configuration Parser inspects 1C:Enterprise 7.7 1cv7.md configuration containers.
Reviewed bigsprut/1CMDParser@bcf43b4
Binary · Tool:
x64dbg-tenet is a native x64dbg plugin that records execution steps in Tenet trace format.
Reviewed gr0grig/x64dbg-tenet@4ed0c58
Binary · Tool:
NullSec BinGaze analyses ELF executables by parsing headers, listing sections and calculating entropy.
Reviewed bad-antics/nullsec-bingaze@91848d3
Binary · Tool:
pdbinspector analyzes Microsoft PDB files to list structures, classes, enums, functions, public symbols and exports.
Reviewed nikaiw/pdbinspector@c02a188