# Curated reverse engineering resources · Page 37

> Page 37 of 52, entries 3,601–3,700. 5,191 tools, projects, integrations, case studies, and references for websites, games, apps, native binaries, firmware, and communication protocols.

Source-reviewed means descriptions were checked against primary documentation. Each entry page lists the full requirements and sources; this page shows their counts and the review date.

- HTML: <https://awesomerea.org/resources/page/37/>
- JSON: <https://awesomerea.org/api/v1/resources.json>
- 简体中文: <https://awesomerea.org/zh/resources/page/37/index.md>

## Native binaries (100)

- [Quokka](https://awesomerea.org/resources/quokka-binary-exporter/index.md): Tool · Quarkslab’s binary exporter, inspired by BinExport, saves a disassembler’s analysis to a protobuf .quokka file so functions, basic blocks, data, cross-references, segments and optionally decompiled code can be used later without the disassembler. Its Python bindings load an export together with the original binary, decode instructions at runtime with Capstone, or optionally lift them to P-code with pypcode, and expose programs, functions and control-flow graphs through one API. The main branch adds Ghidra and Binary Ninja exporters beside the IDA Pro plugin, a parallel quokka-cli batch exporter and name and type edits that can be written back to an IDA database.
- [knife](https://awesomerea.org/resources/knife/index.md): Tool · Static reverse-engineering toolkit in Rust, installed as the knife command, that parses PE, ELF, Mach-O and WebAssembly files without running them. It triages hashes, sections, mitigations, imports, strings, indicators and crypto constants; recovers functions, call graphs and CFGs through recursive-descent disassembly for x86/x64 and AArch64; and lifts functions to experimental pseudocode. Analysts' names, notes, types and staged patches persist in a per-binary database shared by the CLI, a terminal UI and an MCP server, and further passes rank risky API call sites by argument provenance and summarize Windows driver dispatch and IOCTL surfaces.
- [BARF](https://awesomerea.org/resources/barf/index.md): Tool · Python binary analysis framework that loads ELF and PE programs, disassembles 32- and 64-bit x86 and 32-bit ARM code with Capstone and translates it into the REIL intermediate language, so its analyses do not depend on the source architecture. Modules recover control-flow and call graphs, emulate REIL and turn code fragments into Z3 or CVC4 formulas for checking constraints on registers and memory; release 0.6.0 added basic symbolic execution. Bundled command-line tools recover CFGs and call graphs, replay x86 execution traces and search, classify and verify ROP gadgets.
- [rabbitizer](https://awesomerea.org/resources/rabbitizer/index.md): Tool · MIPS instruction decoder written in C that never allocates on the heap, with Python, C++ and Rust bindings in the same repository and the stated aim of producing matching assembly. It decodes one instruction word at a time, focusing on MIPS I to III with partial MIPS IV support, and also handles the N64 RSP, the PlayStation's R3000 GTE, the PSP's R4000 Allegrex and the PS2's R5900; it offers validation checks, instruction-grouping queries, configurable pseudo-instructions and register names, and small helpers for building pointer and symbol detection. Matching-decompilation tooling builds on it: splat and spimdisasm both list it as a Python dependency.
- [ghidrecomp](https://awesomerea.org/resources/ghidrecomp/index.md): Tool · Python command-line decompiler that drives Ghidra through pyghidra to decompile every function of a binary into separate C files, or into one C file and header with Ghidra's C++ exporter, keeping the Ghidra project so later runs can reuse the analysis. Options filter functions by regex, apply PDB symbols from a local file or from Microsoft, Chromium, Mozilla, Intel, NVIDIA and AMD symbol servers, apply extra GDT data-type archives, write Mermaid call-graph Markdown, generate BSim function signatures, and scan the decompiled code with Semgrep rules into SARIF reports.
- [Vivisect](https://awesomerea.org/resources/vivisect/index.md): Tool · Pure-Python reverse-engineering framework that combines the vivisect static analyzer, the vtrace debugging library and the vdb debugger. Vivisect loads PE, ELF, Mach-O, Intel HEX, S-record and raw blob files into workspaces, disassembles and emulates code through envi architecture modules for x86, AMD64, ARM, Thumb, AArch64, MSP430, H8 and Z80, and adds symbolic execution, a Qt GUI and a remote workspace server. vtrace drives processes on Windows, Linux, FreeBSD, macOS and Solaris and has GDB-stub and VMware backends.
- [r2pipe](https://awesomerea.org/resources/r2pipe/index.md): Tool · radare2's official scripting interface, with implementations for more than two dozen languages in one repository. Every binding sends radare2 command strings and returns their text output, the design behind r_core_cmd_str(), and the README recommends asking for JSON output and decoding it into native objects instead of using the C API. Bindings connect through the R2PIPE_IN/R2PIPE_OUT pipes of a script run from inside r2, a spawned r2 -q0 process, TCP, HTTP or radare2's RAP protocol, many offer asynchronous calls, and r2pipe scripts can also implement radare2 plugins such as disassemblers, IO backends or ESIL syscall handlers.
- [GREASE](https://awesomerea.org/resources/grease/index.md): Tool · Galois's command-line tool, Ghidra plug-in and Haskell library for checking properties of binaries with under-constrained symbolic execution. It lifts AArch32, PowerPC or x86_64 ELF executables and shared objects, or LLVM bitcode, into a control-flow graph, simulates each function from fully symbolic registers and grows the inferred memory layout after out-of-bounds accesses, then reports likely undefined behavior such as division by zero or invalid memory access together with concretized arguments. Built-in overrides, or user overrides written in Crucible's S-expression language, model external library functions, and the plug-in presents results in Ghidra.
- [PLASMA](https://awesomerea.org/resources/plasma-disassembler/index.md): Tool · Interactive terminal disassembler, formerly named Reverse, for x86 and x86-64 with partial ARM and MIPS/MIPS64 support, reading ELF, PE and raw binaries. Its visual mode shows functions as indented, colored pseudo-code and lets the analyst reshape the flow by inverting conditional jumps, while a Python API runs scripts for strings, cross-reference call graphs, crypto-constant detection and Keystone assembly. Development stopped in 2019, and the repository has no releases.
- [mobdevim](https://awesomerea.org/resources/mobdevim/index.md): Tool · Derek Selander's macOS command-line utility for inspecting and controlling iOS devices connected over USB or Wi-Fi through Apple's private MobileDevice framework. It lists devices and installed apps with their Info.plist keys and entitlements, streams the device console, fetches crash logs, shows provisioning profiles and developer certificates, copies an app's data container off the device and back where the sandbox allows, and installs, uninstalls and launches apps with arguments and environment variables. With a Developer Disk Image mounted it also lists and kills processes and simulates location, and output can be printed as plist for scripts.
- [XPEViewer](https://awesomerea.org/resources/xpeviewer/index.md): Tool · Qt-based PE file viewer and editor for Windows, Linux and macOS by horsicq, the author of the catalog's Detect It Easy. Its PE view parses the DOS, NT and optional headers, sections, normal, delay-load and bound imports, exports, resources including manifests, version data and string tables, relocations, TLS callbacks, exception, debug and load-configuration data, certificates, the Rich header and .NET metadata tables. Hex, disassembly, strings, entropy, hash, memory-map and extractor views sit beside Detect It Easy, Nauz File Detector and YARA scans and an optional VirusTotal lookup.
- [Fermion](https://awesomerea.org/resources/fermion/index.md): Tool · Ruben Boonen's Electron desktop application that wraps frida-node and the Monaco editor into one window for writing, injecting and refining Frida scripts. The editor brings linting, IntelliSense and Frida API type definitions, a device menu reaches local, USB and remote Frida servers to attach to or spawn processes, scripts reload in the target with a keyboard shortcut and their output appears beside the code. A prototype CALL tracer follows every call a thread makes from a chosen pointer or module symbol until it returns and renders the result as a Graphviz SVG graph, and Frida's JavaScript API documentation is built in.
- [Ghidrathon](https://awesomerea.org/resources/ghidrathon/index.md): Tool · Mandiant FLARE's Ghidra extension that embeds the user's local CPython 3 interpreter in Ghidra through Jep, as an alternative to Ghidra's Jython-based Python 2.7 scripting. It adds an interactive Python 3 interpreter window, Python 3 scripts in the Script Manager and Python 3 post-scripts in headless analyzeHeadless runs, with GhidraScript state such as currentProgram() and FlatProgramAPI methods available as Python builtins. Because the configured interpreter or virtual environment is used as is, scripts can import installed packages; the README names capa, Unicorn and angr as motivating examples and shows Unicorn emulating ARM code inside Ghidra.
- [diStorm3](https://awesomerea.org/resources/distorm/index.md): Tool · Lightweight x86/AMD64 disassembler library in C that the README describes as a decomposer: besides formatted text, distorm_decompose returns a binary structure per instruction with its opcode, operands, prefixes, flow-control class and optionally affected CPU flags. It decodes 16-, 32- and 64-bit code, can stop at calls, returns, branches, interrupts or privileged instructions, and its generated instruction tables cover integer, x87, MMX, 3DNow!, SSE through SSE4.2 and SSE4a, AVX, FMA, AES, CLMUL, VMX and SVM sets. The repository includes the distorm3 Python module, plus example Java and .NET wrappers and sample programs for Linux, Win32 and a Windows kernel driver.
- [ProbeDroid](https://awesomerea.org/resources/probedroid/index.md): Tool · Dynamic Java-method instrumentation kit for Android 5.0 that lets analysts write their own tracing and profiling tools for apps whose source code they do not have. A launcher uses ptrace to inject the native engine library and a user-built instrumentation APK into a newly started target app, and the tool subclasses the Instrument API to hook framework or app-defined Java methods and inspect or change their arguments and return values. The README's demos use sample tools that log strings built through StringBuilder and StringBuffer and the activities and services an app starts.
- [Fridump](https://awesomerea.org/resources/fridump/index.md): Tool · Small Python command-line tool that attaches to a running process through Frida and writes its accessible memory ranges to files, run from a Windows, Linux or macOS host against iOS, Android or Windows applications. By default it saves ranges that are readable and writable, -r also takes read-only ones, ranges above a size limit (20 MiB unless set with --max-size) are split into chunks, and -s runs a basic strings pass that collects printable text from every dump into strings.txt. Its README presents it for penetration testers and developers.
- [Redress](https://awesomerea.org/resources/redress/index.md): Tool · Command-line tool, built on the GoRE library, that recovers metadata from stripped binaries produced by the Go compiler. It reports the compiler version, build ID, GOROOT, main-package path and Go module information; lists project, standard-library and vendored packages; prints interfaces, structs and their methods as Go type declarations; and projects the source tree as packages, files and functions with estimated line ranges. Run inside radare2 through r2pipe, it adds function and type flags and analyzes main.init and main.main.
- [ghidra-nanomips](https://awesomerea.org/resources/ghidra-nanomips/index.md): Tool · Ghidra processor module that adds nanoMIPS disassembly and decompilation through a SLEIGH specification of the little-endian 32-bit nanoMIPS instruction set, including its multithreading instructions. NCC Group's announcement says it was written while reverse engineering MediaTek 5G baseband firmware, implements the instructions met in that firmware and leaves some complex P-Code emulation unimplemented, yet decompiles most of the baseband code the team analyzed.
- [SMDA](https://awesomerea.org/resources/smda/index.md): Tool · Python recursive disassembler library built on Capstone that recovers control-flow graphs from PE, ELF and Mach-O files, .NET assemblies, raw DEX files and memory dumps with a known base address, through x86/x64, AArch64, 32-bit ARM/Thumb, CIL and Dalvik backends. Its JSON reports list functions, basic blocks, instructions and the edges between them, enriched with symbols from imports, exports, PDB, Go, Rust and Delphi metadata, referenced strings, Windows API references inferred with the ApiScout method and position-independent code hashes. Function discovery deliberately favours completeness over precision; the README names SMDA as capa's disassembler backend and MCRIT's code-analysis layer, and IDA Pro or Binary Ninja analyses can be exported into the same report format.
- [frida-trace (NowSecure library)](https://awesomerea.org/resources/nowsecure-frida-trace/index.md): Tool · JavaScript library for Frida agents that traces native functions from a declarative description: each function is listed with its return type and input and output arguments, including pointers, UTF-8 and UTF-16 strings and byte arrays whose length is bound to another argument or the return value, with conditions such as reading an output pointer only when the call succeeds. It resolves the functions from a module's exports or a vtable, attaches Frida's Interceptor and hands one event per call to callbacks. Helper scripts in the same repository generate trace boilerplate from C headers through libclang.
- [BTD (Bin To DNN)](https://awesomerea.org/resources/btd-dnn-decompiler/index.md): Tool · Research artifact for the USENIX Security 2023 paper “Decompiling x86 Deep Neural Network Executables”. BTD decompiles x86 executables emitted by the DNN compilers TVM, Glow and NNFusion into model specifications: operator types, network topology, dimensions and parameters such as weights and biases. It splits IDA disassembly into functions, infers each operator's type with a trained classifier over assembly tokens, records Intel Pin traces filtered by taint analysis, recovers dimensions and parameters with a trace-based symbolic execution engine, then rebuilds the model in PyTorch and compares its output with the original executable.
- [Boomerang Decompiler](https://awesomerea.org/resources/boomerang-decompiler/index.md): Tool · Fork of the SourceForge Boomerang project, a general machine-code decompiler that translates executables into C. The README lists x86 (IA-32 only), PowerPC and ST20 code in ELF, PE, DOS MZ, DOS/4GW LE and Mach-O files; instruction semantics are defined in SSL specification files, and library signature files plus printf- and scanf-style format strings help recover types. It provides a boomerang-cli command-line tool and a Qt boomerang-gui application, with unit, regression and recompilation test suites.
- [ktool](https://awesomerea.org/resources/ktool/index.md): Tool · Pure-Python toolkit for static Mach-O and Objective-C analysis, used as the ktool command line, a terminal browser (ktool open) or a library, with no compiled dependencies. Its commands print load commands, linked libraries, symbol tables, imports and exports, Objective-C classes and protocols, Swift types, function starts and code-signing entitlements, and dump reconstructed Objective-C headers or .tbd stubs. It can also list and extract kexts from kernel caches, split and combine fat binaries, change install names and insert load commands.
- [Brida](https://awesomerea.org/resources/brida/index.md): Tool · Burp Suite extension by Federico Dotta and Piergiovanni Cipolloni that bridges Burp and Frida, so an analyst can run an app's own functions on the HTTP messages it exchanges with its backend instead of reimplementing its encryption, encoding or signing. A graphical plugin engine connects Frida-exported functions to Burp: they can process requests and responses in every Burp tool, or run from custom message-editor tabs, context-menu entries and buttons, and a Generate Stubs tool emits Java or Python code for external Burp extensions. An analysis tab shows the app's Java and Objective-C classes, methods, imports and exports as a tree, from which hooks that log arguments and return values, or replace return values, can be added; an editor holds the analyst's own Frida exports.
- [Qu1cksc0pe](https://awesomerea.org/resources/qu1cksc0pe/index.md): Tool · All-in-one malware triage tool that statically analyses Windows PE, Linux ELF (including Go binaries), macOS Mach-O and Android APK, JAR and DEX files as well as Office and PDF documents, scripts, shortcuts, archives, e-mails and PCAPs, reporting imports and API categories, sections, strings and IOCs, packers, embedded executables, Android permission risk, YARA matches and, for Windows and Linux, MITRE ATT&CK mappings. VBA/VBScript, JavaScript and PowerShell are run through bounded in-memory emulators instead of being executed, and --watch modes monitor live Windows, Linux and Android processes. A CLI, a Flask web UI and an MCP server expose the analyses, with optional LLM summaries of the JSON reports.
- [AppMon](https://awesomerea.org/resources/appmon/index.md): Tool · Frida-based framework by Nishant Das Patnaik, shown at Black Hat Arsenal 2016, for watching the system API calls that native macOS, iOS and Android apps make. Its Sniffer attaches to or spawns an app, loads hook scripts from a bundled library covering areas such as crypto, keychain, files, SQLite, HTTP, IPC and WebView, and records each intercepted call in a per-app SQLite database that a local Flask web interface displays. Further components trace Java classes, methods and argument types in Android apps and repackage IPAs or APKs with Frida Gadget so they can be inspected on non-jailbroken or non-rooted devices.
- [Yagi](https://awesomerea.org/resources/yagi-ghidra-decompiler-for-ida/index.md): Tool · Airbus CERT plugin that embeds Ghidra's native decompiler in IDA Pro and IDA Free: pressing F3 on a function shows Ghidra's C output inside IDA, and edits made there, covering global symbols such as function prototypes and the names and types of stack and register variables, are saved to the IDA database. The README lists x86, x86-64, ARM, AArch64, PowerPC, MIPS, SPARC, AVR8, 6502, Z80 and eBPF as supported, while other Ghidra processors such as Dalvik, JVM, RISC-V and 68000 are not yet enabled.
- [frida-scripts (0xdea)](https://awesomerea.org/resources/raptor-frida-scripts/index.md): Tool · Marco Ivaldi's (raptor) collection of Frida JavaScript instrumentation scripts for reverse engineering mobile apps and Linux programs. The main Android and iOS tracers hook Java or Objective-C classes and methods selected by name, wildcard or regular expression, plus native functions matched by Frida ApiResolver patterns such as exports:*!open*, and log each call's arguments and return value; they can also print backtraces. Companion scripts enumerate loaded classes and methods, and a Linux pair traces and enumerates functions in an ELF binary and its shared libraries.
- [System Informer](https://awesomerea.org/resources/system-informer/index.md): Tool · Windows process viewer and system inspector, formerly Process Hacker, for examining running programs and the system around them. It gives a highlighted overview of system activity, searches the handles and loaded DLLs of processes to find which one is using a file, shows active network connections and real-time disk access, displays stack traces with kernel-mode, WOW64 and .NET support, and creates, edits and controls services. Version 4.0 adds a Process Monitor that logs process, thread, image, registry, file, handle and silo events from its kernel driver, and plugins add .NET assembly and performance tabs, a window explorer and Hybrid Analysis lookups.
- [CyberChef](https://awesomerea.org/resources/cyberchef/index.md): Tool · GCHQ's browser-based workbench for decoding, decrypting, decompressing, parsing and carving data by chaining operations into a recipe, with all processing done client-side. The pinned operation catalogue lists 506 operations, among them XOR brute force, AES, DES and Blowfish decryption, x86 and ARM disassembly, ELF info, file-type detection, file extraction, entropy and strings, YARA rules, Protobuf decoding and Ethernet, IPv4, TCP and UDP header parsing. The Magic operation tries to detect nested encodings automatically, and breakpoints step through a recipe one operation at a time to show the data at each stage.
- [YARA](https://awesomerea.org/resources/yara/index.md): Tool · VirusTotal's pattern-matching tool for identifying and classifying files such as malware samples with rules that combine text, hex and regular-expression strings with a Boolean condition. It scans a file, a folder or a running process from the command line, through the libyara C API or from Python with yara-python. Modules expose parsed structure to rules: pe and elf expose most fields of PE and ELF headers, dotnet adds .NET metadata, math adds calculations such as entropy, and the optional magic and cuckoo modules add libmagic file types and Cuckoo sandbox behavior reports.
- [Cheat Engine](https://awesomerea.org/resources/cheat-engine/index.md): Tool · Memory scanner, debugger, disassembler and assembler for inspecting and changing running games and other applications; its README calls it a development environment focused on modding games and applications for personal use. The project site lists a memory scanner for finding the variables a game uses, a debugger, disassembler, assembler, speedhack, trainer maker, Direct3D manipulation and system inspection tools, and the README's build notes add Mono, .NET and Java runtime inspection, a VEH debugger interface, Lua and C code in scripts and an optional kernel-mode driver.
- [Noriben](https://awesomerea.org/resources/noriben/index.md): Tool · Python script that drives Sysinternals Process Monitor to record what a program does while it runs, filters out routine system activity and writes a text report of the processes it created and its file, registry and network activity. It works as a lightweight malware sandbox and can also log events while the analyst runs a sample by hand, with command-line options, user interaction or under a debugger; created files can be scanned with YARA rules and their hashes looked up on VirusTotal. Version 2.1.0 adds DLL-load monitoring, an ASCII process tree and JSON output, and NoribenSandbox.py automates runs inside a guest VM.
- [QEMU](https://awesomerea.org/resources/qemu/index.md): Tool · Machine and user-space emulator that runs code built for one CPU architecture on another through its TCG dynamic translator. System emulation boots a complete emulated machine, such as an ARMv7 board on an x86_64 PC, and user-mode emulation runs Linux or BSD binaries built for another ABI by translating their system calls. For analysis, its gdbstub lets GDB stop the guest, examine registers and memory and set breakpoints and watchpoints, TCG plugins passively instrument execution down to single instructions and memory accesses (bundled examples count instructions, trace system calls and log execution), and system emulation supports deterministic record/replay debugging.
- [Hex Fiend](https://awesomerea.org/resources/hex-fiend/index.md): Tool · Open-source macOS hex editor that inspects and edits binary files of any size without loading them into memory. It supports insertions and deletions, fast search and a data inspector that reads integers and floating-point values as signed or unsigned and big- or little-endian. File > Compare shows the differences between two files while accounting for inserted or deleted bytes, and Tcl binary templates display a file's structure next to its bytes; bundled templates cover COFF, ELF, Mach-O and MS-DOS EXE headers, 6502 disassembly and Commodore 64 PRG files, plus archives, file systems, partition tables and media formats. Its hex and data views are also available as an embeddable framework.
- [ScyllaHide](https://awesomerea.org/resources/scyllahide/index.md): Tool · User-mode (ring 3) anti-anti-debug library for 32- and 64-bit Windows programs that hooks system functions so the program being debugged cannot detect the debugger. Its documentation covers options for PEB debug flags such as BeingDebugged, NtGlobalFlag and heap flags, threads hidden with ThreadHideFromDebugger, debugger windows and processes found through window and process-list queries, invalid-handle NtClose checks, input blocking, timing checks, hardware-breakpoint detection and exception-based checks; extra options inject DLLs, prevent thread creation and dump processes started RunPE-style. Plugins integrate it with x64dbg, OllyDbg v1 and v2, IDA and TitanEngine, and the standalone InjectorCLI injects its hook library into a process under any debugger.
- [YARA-X](https://awesomerea.org/resources/yara-x/index.md): Tool · VirusTotal's Rust rewrite of YARA for identifying and classifying files with pattern-matching rules. It is meant to replace YARA, with more detailed error reports, faster regular-expression and hex-pattern matching and a more capable command line. Rules keep YARA's syntax of text, hex and regular-expression patterns joined by a Boolean condition, and modules parse PE, ELF, Mach-O, .NET, Android DEX, Chrome CRX and Windows LNK files; the CLI can also print a module's parsed output as JSON or YAML without any rule, which makes it usable as a file-dissection tool. Rust, C, Go and Python APIs, a rule formatter and a language server with a Visual Studio Code extension are included.
- [ReClass.NET](https://awesomerea.org/resources/reclass-net/index.md): Tool · Memory structure editor for reconstructing the classes and data structures of a running x86 or x64 process, a .NET port of ReClass with many additions. Users lay out memory as typed nodes, such as integers, floats, vectors and matrices, text, pointers, arrays, unions, virtual tables and function pointers, with automatic node dissection, highlighting of changed memory, types from PDB debug symbols and RTTI class names, then generate C++ or C# code from the result. It also offers a memory viewer and scanner, a module and section dumper, a debugger that finds what writes to or accesses an address, and plugins that can supply other memory-access methods or game-specific class information, such as for Frostbite games.
- [Keypatch](https://awesomerea.org/resources/keypatch/index.md): Tool · IDA Pro plugin built on the Keystone assembler engine that patches a binary from typed assembly, fills an address range with instructions or raw bytes and searches the loaded binary for assembly instructions. It assembles Arm, Arm64, Hexagon, MIPS, PowerPC, SPARC, SystemZ and 16-, 32- and 64-bit x86 code, shows the encoding while you type, can pad with NOPs up to the next instruction boundary, keeps the original instruction in an IDA comment and can undo the last patch.
- [edb-debugger](https://awesomerea.org/resources/edb-debugger/index.md): Tool · Qt-based graphical debugger for AArch32, x86 and x86-64 programs, inspired by OllyDbg, with Linux as its only officially supported platform. Its interface docks disassembly, register, stack and data views, adds a memory-regions window, process attaching, symbols, an expression syntax and an analysis bar similar to IDA Pro's, and its default plugins include Analyzer, Assembler, BinarySearcher, BreakpointManager, FunctionFinder, HardwareBreakpoints, HeapAnalyzer, OpcodeSearcher, ROPTool and SymbolViewer.
- [BinNavi](https://awesomerea.org/resources/binnavi/index.md): Tool · Google's open-sourced binary analysis IDE for inspecting, navigating, editing and annotating the control-flow graphs and call graphs of disassembled code. It also collects and combines execution traces and keeps track of analysis results among a group of analysts. Disassemblies come from IDA Pro through a bundled export plugin that writes the PostgreSQL database BinNavi uses for disassemblies, comments and traces; the README notes that no exporter exists yet for other disassemblers.
- [flare-emu](https://awesomerea.org/resources/flare-emu/index.md): Tool · Mandiant FLARE Python library that pairs IDA Pro, Rizin or Radare2 with the Unicorn emulator so analysts can script emulation of the binary they are analyzing, for 32- and 64-bit x86, ARM and ARM64. Its interfaces emulate an instruction range or function with chosen register and stack values, force execution down the branches needed to reach target addresses or every cross-reference to a function, walk all paths through a function, run a standalone byte blob, or emulate from an address until nothing is left, with hooks on instructions and calls. A common use in its README is decrypting malware strings by emulating the decryption routine at each call site and commenting the results.
- [IDA Pro](https://awesomerea.org/resources/ida-pro/index.md): Tool · Hex-Rays' commercial interactive disassembler, decompiler and debugger, which turns compiled code for more than 70 processor families into annotated, cross-referenced assembly and decompiled pseudocode. Its 15 decompilers cover 32- and 64-bit x86, ARM, MIPS, PowerPC and RISC-V as well as ARC, V850, TriCore, Hexagon and Android DEX; the Dalvik decompiler, new in IDA 9.5 alongside TriCore and Hexagon, renders DEX bytecode as Java pseudocode. Documented loaders include PE, ELF and Mach-O with Apple dyld shared caches and kernelcaches, DEX, UEFI firmware images, WebAssembly modules and console formats such as Xbox XBE, N64, SNES ROM and PlayStation PSX executables, and the processor list names console CPUs from the NES and Game Boy to the PlayStation 3 Cell, Xbox 360 Xenon and PSP Allegrex. The debugger runs locally or through remote debug servers for Windows, Linux, macOS and Android, and analysis can be scripted with IDAPython, IDC and the C++ SDK, run without a GUI through the idalib library, or driven from MCP clients through IDA MCP.
- [Binary Ninja](https://awesomerea.org/resources/binary-ninja/index.md): Tool · Vector 35's commercial interactive disassembler, decompiler and debugger, whose decompiler is built on the BNIL family of intermediate languages and shows either C or BNIL for every officially supported architecture. Depending on the edition it decompiles x86/x86-64, ARMv7/Thumb2, AArch64, PowerPC, MIPS, RISC-V, MSP430, 6502, nanoMIPS, TriCore, C-SKY, M·CORE, Hexagon, NDS32 and TMS320C6x, and it loads raw binaries and PE/COFF, ELF, Mach-O, TE, Intel HEX, Motorola S-Record, TI-TXT, MD1ROM and VxWorks files. C++, Python and Rust APIs automate analysis inside or outside the UI; the open-source debugger runs locally or remotely on Windows, Linux and macOS and also connects to GDB, LLDB and iOS debugserver targets; patches can be made by editing assembly, in the hex editor or with the bundled SCC compiler; and 6.0 added an MCP server. Ultimate adds Firmware Ninja for embedded firmware, which finds code and data regions by entropy and detects memory-mapped I/O accesses, while the EFI Resolver workflow types protocol usage in UEFI PEI, DXE and SMM modules.
- [Hopper Disassembler](https://awesomerea.org/resources/hopper-disassembler/index.md): Tool · Cryptic Apps' commercial disassembler, decompiler and debugger for macOS and Linux, which reads Mach-O (macOS and iOS), PE and ELF executables built for 32- and 64-bit Intel, ARMv6, ARMv7, ARM64 and PowerPC processors. Each procedure can be viewed as assembly, as an interactive control-flow graph that exports to PDF or as C-like pseudocode, with Swift name demangling and extraction of Objective-C selectors and messages, and binaries can be patched through the hex editor, the built-in assembler or Python. Debugging of Mac applications uses LLDB or GDB, Python scripts reach most features, an SDK adds file-format parsers and CPU backends, and Hopper 6 brought a new decompiler and an MCP server for LLM clients.
- [WinDbg](https://awesomerea.org/resources/windbg/index.md): Tool · Microsoft's WinDbg debugger and the Debugging Tools for Windows, documented on Microsoft Learn, for debugging live user-mode and kernel-mode code, analyzing crash dumps and examining CPU registers and memory. The current app keeps the engine, commands and extensions of WinDbg (Classic) and adds Time Travel Debugging, which records a user-mode process and replays it in both directions, JavaScript and NatVis scripting and Linux ELF dump analysis; since 1.2610.1001.0 it also offers WinDbg MCP for supported AI clients.
- [010 Editor](https://awesomerea.org/resources/010-editor/index.md): Tool · SweetScape Software's commercial hex and text editor whose Binary Templates, C/C++-like struct definitions with control flow and functions, parse binary files into hierarchical, editable structures. Templates can run when a file opens and are shared through an online repository, scripts with C/C++-like syntax automate edits and batch runs, and the tools include a Capstone-based disassembler for x86, ARM, MIPS, PowerPC and other code, byte-by-byte comparison, checksums and hashes, and editing of drives and, on Windows, process memory.
- [pestudio](https://awesomerea.org/resources/pestudio/index.md): Tool · Winitor's Windows tool for initial malware assessment, which statically inspects Windows executable files and reports key indicators such as hard-coded URLs and IP addresses, flagged imports, resources and overlay data. The free basic edition also detects file signatures, debug information and TLS callbacks, computes entropy and imphash, shows the rich header and .NET metadata and looks up VirusTotal scores by hash; pestudio-pro adds MITRE ATT&CK mapping, XML reports and the pestudiox.exe command-line version.
- [OllyDbg](https://awesomerea.org/resources/ollydbg/index.md): Tool · 32-bit assembler-level analyzing debugger for Windows that emphasizes binary code analysis for programs without source; its site says development is frozen, and the newest version it lists is 2.01 of 27 September 2013. Its analysis recognizes procedures, loops, API calls, switches, tables, constants and strings and decodes calls to more than 1,900 standard API and 400 C functions; it attaches to running programs, debugs DLLs directly, sets conditional, logging, memory and hardware breakpoints and writes patches back to the executable.
- [Tenet](https://awesomerea.org/resources/tenet/index.md): Tool · IDA Pro plugin for exploring execution traces of a binary: it loads an externally recorded trace and lets the analyst step forwards and backwards through time while the disassembly shows the execution flow in both directions. Execution, memory and region breakpoints mark every execution of an instruction or every read and write of an address or range along a trace timeline, register seeking jumps to the instruction that set a register's value, and a timestamp shell seeks to a position or percentage of the trace.
- [findcrypt-yara](https://awesomerea.org/resources/findcrypt-yara/index.md): Tool · IDA Pro plugin that scans the loaded database with YARA rules for cryptographic constants and similar signatures, lists the matches in a results window and names each matching address after its rule. Its bundled findcrypt3.rules has 126 rules covering constants and tables of hash, cipher and checksum algorithms such as MD5, SHA-1, SHA-256, SHA-512, RIPEMD-160, Whirlpool, DES, Blowfish, RC6, TEA and CRC32, big-number and prime constants, crypto API names and functions of libraries such as OpenSSL, Crypto++, MIRACL and FGint; users can add their own .rules files.
- [deREferencing](https://awesomerea.org/resources/dereferencing/index.md): Tool · IDA Pro plugin that adds register and stack views to the debugger in which pointers are dereferenced and colored, similar to the context displays of GDB plugins such as PEDA, GEF and pwndbg. It supports x86, x86-64, ARM, ARM64, MIPS32 and MIPS64; both views open from Debugger > Debugger Windows or with Alt-Shift-D and Alt-Shift-E, and a saved desktop layout reopens them in later debugging sessions.
- [HexRays Toolbox](https://awesomerea.org/resources/hexrays-toolbox/index.md): Tool · IDAPython scripts that find code patterns in Hex-Rays decompiler output, independent of the binary's processor architecture, by running user-written lambda queries over the decompiled ctree. Queries run from the hxtb-shell GUI inside IDA, from IDAPython through functions such as find_expr() and find_item(), from interactive command-line helpers or in batch mode over a set of files. The README's use cases include finding vulnerabilities and their variants, locating code patterns from previously reversed executables in newly decompiled code, malware variant analysis and finding patterns across binaries built for different architectures.
- [Virtuailor](https://awesomerea.org/resources/virtuailor/index.md): Tool · IDAPython tool that reconstructs C++ virtual tables in IDA Pro for 32- and 64-bit Intel and AArch64 code by observing indirect calls while the program runs under IDA's debugger. Its static part finds indirect calls and hooks the assignment of their targets with conditional breakpoints; when those breakpoints hit, the dynamic part creates vtable structures, renames vtables and virtual functions, adds structure offsets to the call instructions and cross-references from each indirect call to the virtual functions it reached, and for AArch64 firmware tries to fix undefined vtables and their functions.
- [xAnalyzer](https://awesomerea.org/resources/xanalyzer/index.md): Tool · x64dbg plugin that annotates the static code of the debugged x86 or x64 executable with function-call, argument and loop analysis. It adds argument and type information from over 13,000 API definitions for almost 200 DLLs, handles undefined and register-based calls generically and detects loops automatically. Analysis runs on a selection, a function or a whole module from menus or the xanal commands, can run automatically at the entry point like OllyDbg's initial analysis, and users can extend its .api and header definition files.
- [Voltron](https://awesomerea.org/resources/voltron/index.md): Tool · Extensible Python debugger UI toolkit that attaches utility views to LLDB, GDB, VDB and WinDbg/CDB sessions. Each view retrieves data from the debugger host and can run in its own terminal, so users can assemble a custom debugger interface; built-in views cover registers, disassembly, stack, memory, breakpoints and backtrace, and any debugger command can be split off into a view highlighted with a chosen Pygments lexer. The views provide utility panels alongside the debugger's command line.
- [Remill](https://awesomerea.org/resources/remill/index.md): Tool · Static binary translation library that lifts AArch64, SPARC32, SPARC64, x86 and amd64 machine code, including AVX and AVX512, into LLVM bitcode, with AArch32 support underway. It focuses on lifting individual instructions accurately and is meant as a library for other tools such as McSema; its documentation walks through how an instruction is lifted, how instruction semantics are implemented and the overall design.
- [iaito](https://awesomerea.org/resources/iaito/index.md): Tool · Official Qt-based graphical interface for the radare2 reverse-engineering framework, aiming for parity with radare2's commands, features and keybindings so that existing r2 plugins and scripts keep working. Its README lists forensics, binary diffing and binary patching alongside disassembly; iaito was the original name before the project was forked as Cutter.
- [HexRaysCodeXplorer](https://awesomerea.org/resources/hexrays-codexplorer/index.md): Tool · Hex-Rays decompiler plugin for navigating and reconstructing C++ code in IDA's pseudocode window. It reconstructs C++ object types from a selected pointer variable into IDA's local types, identifies virtual function tables and generates structures for them, lets the analyst click through virtual calls once objects are typed, visualizes a function's ctree as a graph, jumps from a pseudocode line to its disassembly and dumps ctrees and types to files. Its Object Explorer lists vtables with cross-references and RTTI parsing, and a batch mode processes many files without user interaction.
- [GDB dashboard](https://awesomerea.org/resources/gdb-dashboard/index.md): Tool · Standalone .gdbinit file written with GDB's Python API that shows a modular status interface each time the debugged program stops, reducing the commands needed to inspect its state. No GDB command is redefined; its features sit under a single dashboard command.
- [REHex](https://awesomerea.org/resources/rehex/index.md): Tool · Cross-platform hex editor for reverse engineering that handles files over 1 TB. It adds inline disassembly, integer and floating-point decoding, byte-range annotations, side-by-side comparison, virtual address mapping and bitmap visualisation, with Binary Templates that annotate data automatically and Lua scripting.
- [Dobby](https://awesomerea.org/resources/dobby/index.md): Tool · Lightweight, modular hook framework for Windows, macOS, iOS, Android and Linux on x86, x86-64, ARM and ARM64.
- [XLMMacroDeobfuscator](https://awesomerea.org/resources/xlmmacrodeobfuscator/index.md): Tool · Command-line tool and Python library that extracts and decodes obfuscated Excel 4.0 (XLM) macros from xls, xlsm and xlsb files. An internal XLM emulator interprets the macros without fully performing the code, and results can be exported as JSON.
- [PE Tree](https://awesomerea.org/resources/pe-tree/index.md): Tool · Python module that shows Portable Executable files in a tree view using pefile and PyQt5, as a standalone application and as a plugin for IDA Pro, Ghidra, Volatility, Rekall and minidump. It reads PE images from files, ZIP archives, Windows memory dumps and analysis databases.
- [RpcView](https://awesomerea.org/resources/rpcview/index.md): Tool · Open-source Windows tool that explores and decompiles the RPC functionality present on a Microsoft system. New rpcrt4.dll runtime versions are added by extending its version table or by reversing the runtime's internal structures.
- [amoco](https://awesomerea.org/resources/amoco/index.md): Tool · Python package for symbolic analysis of binaries. It combines an instruction-decoding framework for adding architectures, a symbolic algebra module that describes instruction semantics, an abstract memory and execution model, and disassembly techniques from linear sweep and recursive traversal to solver-based path-predicate exploration.
- [Chisel](https://awesomerea.org/resources/chisel-lldb/index.md): Tool · Collection of LLDB commands for debugging iOS apps. Commands print view and view-controller hierarchies, find views by class-name regex, show or hide views without resuming the process, mask or border views, set symbolic breakpoints on a class's method and watchpoints on instance variables, and can be extended with custom commands.
- [gdbgui](https://awesomerea.org/resources/gdbgui/index.md): Tool · Browser-based frontend to the GNU debugger, gdb.
- [Porosity](https://awesomerea.org/resources/porosity/index.md): Tool · Decompiler that turns Ethereum Virtual Machine bytecode into readable Solidity-syntax contracts, supported on Linux and macOS.
- [Xori](https://awesomerea.org/resources/xori/index.md): Tool · Automation-ready disassembly and static analysis library for shellcode and PE binaries that outputs disassembly, functions and imports as JSON. It offers a light emulation mode that enumerates all paths and a slower full emulation mode, simulated TEB and PEB structures, and FLIRT-style signatures.
- [binglide](https://awesomerea.org/resources/binglide/index.md): Tool · Visual reverse-engineering tool that gives a quick overview of the data types present in a file. It reads no particular format, so it also works when headers are missing or corrupted or the format is unknown.
- [ERESI](https://awesomerea.org/resources/eresi/index.md): Tool · Reverse Engineering Software Interface built around ELFsh, an interactive and scriptable shell for reading and modifying ELF objects, and e2dbg, an embedded ELF debugger. ELFsh analyses sections, edits headers and symbol and relocation tables, disassembles through libasm, draws control-flow graphs and injects code into ELF files.
- [pixd](https://awesomerea.org/resources/pixd/index.md): Tool · Terminal tool that visualises binary data like a hexdump, but draws each octet as a coloured square from a palette.
- [Universal Extractor 2](https://awesomerea.org/resources/universal-extractor-2/index.md): Tool · Unofficial, extended continuation of Universal Extractor that unpacks files from standard archives, application installers, disk images and game archives. Version 2 adds batch mode, a scan-only mode that detects a file's type, password lists and silent mode.
- [ElleKit](https://awesomerea.org/resources/ellekit/index.md): Tool · Function hooking toolkit for arm64 XNU devices: a C function hooker that patches memory pages directly, an Objective-C function hooker, an arm64 assembler, JIT inline assembly for Swift and a reimplementation of the Substrate and libhooker APIs. The README lists the Dopamine, palera1n and meowbrek2 jailbreaks as users.
- [ProcDump for Linux and macOS](https://awesomerea.org/resources/procdump-linux/index.md): Tool · Linux and macOS reimagining of the Sysinternals ProcDump tool that writes process dumps in response to performance, runtime, signal and resource-tracking triggers, including native dumps through a Rust ELF writer and managed dumps through .NET diagnostics IPC.
- [fishhook](https://awesomerea.org/resources/fishhook/index.md): Tool · Small library that dynamically rebinds symbols in Mach-O binaries running on iOS, on device and in the simulator, by updating the lazy and non-lazy symbol pointers that dyld uses.
- [pcode2code](https://awesomerea.org/resources/pcode2code/index.md): Tool · VBA p-code decompiler based on pcodedmp, written for Office documents whose macro source has been stomped to leave only bytecode. It takes a document or a previously saved pcodedmp dump and also works as a Python module.
- [rust-deobf](https://awesomerea.org/resources/rust-deobf/index.md): Tool · rust-deobf analyzes compiled, mainly Rust, ELF, PE and Mach-O binaries to recover hidden strings and related artifacts. It combines static call-site analysis with Unicorn function emulation, identifies Rust metadata and library functions, and offers unpacking and Ghidra annotations. CLI and MCP interfaces expose the core analysis; deeper control-flow and virtualization modules have separate licensing.
- [CFG Visualizer](https://awesomerea.org/resources/cfg-visualizer/index.md): Tool · CFG Visualizer extracts function control-flow graphs from ELF, PE and Mach-O binaries with radare2 and presents them in an interactive 3D browser view. Its FastAPI backend returns graph JSON, while the frontend shows branch edges and node disassembly.
- [Cpp2CS](https://awesomerea.org/resources/cpp2cs/index.md): Tool · Cpp2CS recovers managed methods from Android ARM64 Unity IL2CPP ELF binaries and matching metadata, emitting CIL assemblies, C# source and per-method diagnostics. Its pipeline models machine IR, IL2CPP runtime idioms, memory SSA and type recovery while marking unresolved portions.
- [ghidra-c6000](https://awesomerea.org/resources/ghidra-c6000/index.md): Tool · ghidra-c6000 adds Texas Instruments C64x, C67x and C674x DSP support to Ghidra 12.x. Its SLEIGH languages decode full-width and compact instructions, supply p-code for decompilation, and add C6000 calling conventions and packet-aware analyzers for ELF or raw images.
- [cocos2d-dumper](https://awesomerea.org/resources/cocos2d-dumper/index.md): Tool · cocos2d-dumper extracts defined function symbols from ELF shared libraries and demangles C++ names with GNU binutils. It produces a map of ELF symbol values and names for inspecting unstripped cocos2d-x binaries and other native libraries.
- [Binary Ninja Security Analysis Plugin](https://awesomerea.org/resources/binary-ninja-security-analysis-plugin/index.md): Tool · Binary Ninja Security Analysis Plugin batches binary analysis from a Rust plugin and exports Parquet reports. It records architecture, hashes, functions, strings, segments, cyclomatic complexity, entropy and references to selected process-execution functions.
- [Human-Readable Decompilation](https://awesomerea.org/resources/human-readable-decompilation/index.md): Tool · Human-Readable Decompilation restructures C produced by Ghidra's binary decompiler using an ANTLR parser and AST transformations. It recovers switches from conditional chains, introduces guard clauses, flattens nested branches and simplifies selected expressions. A GUI can launch Ghidra headlessly before transformation, while a CLI handles existing C output.
- [BinStruct Inspector](https://awesomerea.org/resources/binstruct-inspector/index.md): Tool · BinStruct Inspector is a GUI for examining binary file layouts through user-defined field trees. It parses files as structures are edited, shows parsed values beside synchronized hex and JSON views, and tracks byte-level insertions, deletions, and replacements; plugins add custom data types.
- [SimpleParserPE](https://awesomerea.org/resources/simpleparserpe/index.md): Tool · SimpleParserPE is a C++ command-line inspector for PE32 Windows executables. It reads DOS and NT headers, section metadata, data directories, and imported DLL functions, translating RVAs through the section table without Windows headers or external libraries.
- [tenet_tracer](https://awesomerea.org/resources/tenet-tracer/index.md): Tool · tenet_tracer uses Intel Pin to record instruction-level execution traces for Tenet. It captures program counters, register changes and memory accesses, stores them in SQLite tables, and provides a script to export the trace text.
- [BinScan](https://awesomerea.org/resources/binscan/index.md): Tool · BinScan scans files in bulk and emits per-file JSON containing format identification, structural metadata, hashes and entropy. Its C++ library includes parsers for PE, ELF and Mach-O executables alongside archives, packages, documents and images, with a staged read, analyze and write pipeline.
- [Patch-0xC0000022](https://awesomerea.org/resources/patch-0xc0000022/index.md): Tool · Patch-0xC0000022 instruments the running Windows SysMain service by changing its NtCreateFile response to STATUS_ACCESS_DENIED. The C++ program finds the service process, resolves the remote function address and applies a six-byte patch to study the effect on prefetch behavior.
- [iMonitor](https://awesomerea.org/resources/imonitor-system-activity-monitor/index.md): Tool · iMonitor is a Windows endpoint activity monitor for examining running software. It records process, file, registry and network events, adds DLL-load analysis, and supports custom columns and matching rules through plugins and scripts.
- [m68kdasm](https://awesomerea.org/resources/m68kdasm/index.md): Tool · m68kdasm disassembles Motorola 68000-family machine code in Go and returns assembly with structured instruction metadata. It supports selectable CPU variants, optional FPU and PMMU decoding, symbol and label formatting, streaming input and helpers for 68000 ELF binaries.
- [IR Lifting Benchmark](https://awesomerea.org/resources/ir-lifting-benchmark/index.md): Tool · IR Lifting Benchmark compares binary lifting workflows across Ghidra P-code, angr VEX, BAP BIL and optional LLVM IR paths. Shell and Python scripts run analyses on binary samples, collect performance and control-flow metrics, check lifted semantics and generate reports and visualizations.
- [Bin-Hunter](https://awesomerea.org/resources/bin-hunter/index.md): Tool · Bin-Hunter is a Python command-line tool for initial static inspection of binary files. It identifies formats from magic bytes, calculates whole-file and peak-region Shannon entropy, extracts readable strings, and finds URLs, IP addresses, email addresses, and suspicious keywords in those strings.
- [BinaryInsight](https://awesomerea.org/resources/binaryinsight/index.md): Tool · BinaryInsight inspects ELF, PE, and Mach-O executables and libraries in an interactive terminal view or a text-report CLI. Its Rust core uses goblin to parse binary structure and exposes sections, symbols, printable strings, and security mitigation indicators such as PIE, NX, RELRO, ASLR, and DEP.
- [rust-sig-gen](https://awesomerea.org/resources/rust-sig-gen/index.md): Tool · rust-sig-gen generates IDA FLAIR library signatures from compiled Rust crates for executable analysis. Its Python script obtains the top 100 crates, builds them for Linux and x86-64 Windows, and processes the outputs with sigmake, pelf and pcf.
- [1C 7.7 Configuration Parser (MD Parser)](https://awesomerea.org/resources/1cmdparser/index.md): Tool · 1C 7.7 Configuration Parser inspects 1C:Enterprise 7.7 1cv7.md configuration containers. Its Win32 interface displays OLE streams, decompresses ZLib data, removes the documented XOR layer and parses Main MetaData Stream into an object hierarchy.
- [x64dbg-tenet](https://awesomerea.org/resources/x64dbg-tenet/index.md): Tool · x64dbg-tenet is a native x64dbg plugin that records execution steps in Tenet trace format. Commands start and stop logging or trace a specified number of steps, with an option to stop when execution leaves the current module.
- [NullSec BinGaze](https://awesomerea.org/resources/nullsec-bingaze/index.md): Tool · NullSec BinGaze analyses ELF executables by parsing headers, listing sections and calculating entropy. It also reports NX stack, PIE, RELRO, stack-canary and RWX-segment properties through command-line modes for full analysis, section listing or security assessment.
- [pdbinspector](https://awesomerea.org/resources/pdbinspector/index.md): Tool · pdbinspector analyzes Microsoft PDB files to list structures, classes, enums, functions, public symbols and exports. It demangles MSVC C++ names, decodes MSVC string literals and emits text, JSON or tab-separated reports through a CLI; a WebAssembly version runs online.