Awesome REA
中文Star on GitHubStar2.4k stars
Star on GitHubStar2.4k stars

Curated reverse engineering resources

5,191

Filters

Kind
Category
Show all 24

Showing 3,701–3,800 of 5,191

Download the dataSuggest a resource

Evidence class
  • C0full software reconstruction
  • C1partial scope or analysis entry
  • C2code & docs, no demo or download
  • C3notes only
  • ?Source unavailable or unreadable at review time
How classes are assigned

  • Native binaries

    502

  • Binary · Tool:

    PE DisassemblerC2

    PE Disassembler is a WPF application that extracts the .text section of 32-bit Windows PE executables and displays decoded x86 instructions.

    • Binary

    Reviewed ddeeduck/Pe-disassembler@089a567

  • Binary · Tool:

    KaijuC2

    Kaiju is a Rust reverse-engineering framework with a headless CLI for binary loading and analysis.

    • Binary

    Reviewed nightwarelabz/kaiju@86572f2

  • App · Tool:

    sqlceC2

    sqlce reads SQL Server Compact .sdf database files using a cross-platform C++ parser informed by analysis of decompiled SQL CE components.

    • App

    Reviewed boykopovar/sqlce@78a3888

  • App · Tool:

    inkteropC2

    inkterop converts native handwriting files from note apps and e-ink devices through a documented intermediate representation.

    • App

    Reviewed cable729/inkterop@f16eb8d

  • Binary · Tool:

    wMatcherC2

    wMatcher compares two Java archives to match classes renamed or obfuscated between releases.

    • Binary

    Reviewed earthsworth/wMatcher@225940a

  • Binary · Tool:

    tasm-rsC2

    tasm-rs implements TVM bytecode assembly and disassembly in Rust, with a tdisasm CLI, instruction tables, Fift parsing and trace and coverage reports.

    • Binary

    Reviewed nktkt/tasm-rs@b9ed7d9

  • Binary · Tool:

    PackerScopeC2

    PackerScope scans Windows PE executables for packer signatures and structural indicators, including entropy, sections, imports and entry-point instructions.

    • Binary

    Reviewed salmanmallah/packerscope@db2ea6d

  • Binary · Tool:

    imprintC2

    imprint analyzes Windows PE files by parsing import, delay-import and export directories without executing the image.

    • Binary

    Reviewed hamodywe/imprint@b63df33

  • Binary · Tool:

    kdemulatorC2

    kdemulator executes Windows x86-64 kernel-driver binaries outside a live kernel for IOCTL analysis.

    • Binary

    Reviewed 000nico/kdemulator@44c0521

  • Binary · Tool:

    QIRAC2

    QIRA is a tool for examining program execution traces.

    • Binary

    Reviewed geohot/qira@5f34406

  • Binary · Tool:

    HachoirC2

    Hachoir is a Python library for viewing and editing binary streams as trees of fields, down to individual bits.

    • Binary

    Reviewed vstinner/hachoir@685b298

  • Binary · Tool:

    MachOExplorerC1

    MachOExplorer is a desktop and command-line tool for inspecting Mach-O binaries, Universal binaries, static archives, and dyld shared caches.

    Demo screenshot from the project's public documentation
    • Binary

    Reviewed everettjf/machoexplorer@cd612d7

  • App · Tool:

    FLEXC2

    FLEX is an in-app tool for exploring and debugging running iOS applications.

    • App

    Reviewed FLEXTool/FLEX@dac6130

  • App · Tool:

    classdump-dyldC2

    classdump-dyld is a command-line tool that generates Objective-C headers from Mach-O app binaries, libraries, frameworks, bundles, and images in the dyld shared cache.

    • App
    • Binary

    Reviewed limneos/classdump-dyld@31b6f9d

  • Binary · Tool:

    Process DumpC2

    Process Dump is a Windows command-line tool that saves code from running processes to disk for malware analysis.

    • Binary

    Reviewed glmcdona/Process-Dump@e4373c6

  • Binary · Tool:

    BloatyC2

    Bloaty is a binary size profiler that attributes file and memory usage to sources such as symbols, compilation units, and sections.

    • Binary

    Reviewed google/bloaty@ccb49b0

  • Binary · Tool:

    bingrepC1

    bingrep is a command-line tool for inspecting and colorizing binary files.

    Demo screenshot from the project's public documentation
    • Binary

    Reviewed m4b/bingrep@99d1054

  • Binary · Tool:

    ViperC2

    Viper is a framework for binary analysis and for organizing malware samples, exploit samples, and research scripts.

    • Binary

    Reviewed viper-framework/viper@fdd7855

  • Binary · Tool:

    Cuckoo3C2

    Cuckoo3 is a malware analysis tool that tests suspicious files and links in sandboxed platform emulators.

    • Binary
    • Website

    Reviewed cert-ee/cuckoo3@86be764

  • Binary · Tool:

    Cuckoo SandboxC2

    Cuckoo Sandbox is an automated malware analysis system that executes suspicious files in an isolated environment and reports their behavior.

    • Binary

    Reviewed cuckoosandbox/cuckoo@50452a3

  • Binary · Tool:

    fqC1

    fq is a command-line tool and query language for inspecting and decoding binary formats.

    Demo video thumbnail from the project's public documentation
    • Binary
    • Protocol

    Reviewed wader/fq@3f518c8

  • Binary · Tool:

    MetasmC2

    Metasm is a Ruby suite for assembling, disassembling, debugging, and modifying executable binaries.

    • Binary

    Reviewed jjyg/metasm@a70271c

  • App · Tool:

    pymobiledevice3C1

    Pure Python 3 library and command-line tool for communicating with iPhones, iPads and other iOS devices from Windows, Linux or macOS, implementing usbmux, lockdown and its services, DTX-based developer (DVT) services and the RemoteXPC tunnels that iOS 17+ uses for developer access.

    Demo screenshot from the project's public documentation
    • App
    • Protocol

    Reviewed doronz88/pymobiledevice3@9ea9491

  • Binary · Tool:

    dumpulatorC1

    Python library that emulates user-mode code from minidumps of 64-bit and 32-bit Windows processes with Unicorn.

    Demo video thumbnail from the project's public documentation
    • Binary

    Reviewed mrexodia/dumpulator@18a64d7

  • Binary · Tool:

    McSemaC2

    Archived Trail of Bits executable lifter that translates 32- and 64-bit Linux ELF and Windows PE binaries into LLVM bitcode for analysis or recompilation.

    • Binary

    Reviewed lifting-bits/mcsema@2636805

  • Binary · Tool:

    retoolkitC1

    Windows setup program, built with Inno Setup, that installs a ready-made x86/x64 reverse-engineering and malware-analysis toolkit as selectable components: debuggers, decompilers, hex editors, PE, ELF, .NET, Java, Go, Delphi and AutoIt analyzers, and process-inspection, unpacking, network, OLE/PDF and signature tools.

    Demo screenshot from the project's public documentation
    • Binary

    Reviewed mentebinaria/retoolkit@8a5d119

  • Binary · Tool:

    D-810 ngC2

    A refactored, updated fork of Boris Batteux's D-810 IDA Pro plugin that deobfuscates code at decompilation time by rewriting Hex-Rays microcode.

    • Binary

    Reviewed w00tzenheimer/d810-ng@2e59ab4

  • Binary · Tool:

    AnvillC2

    Trail of Bits machine-code lifter built on Remill that aims to produce high-quality LLVM bitcode, close to what Clang would emit for a semantically equivalent C function, for Rellic to decompile further into C.

    • Binary

    Reviewed lifting-bits/anvill@9948d26

  • Binary · Tool:

    XReferC2

    A Python plugin for IDA Pro from Google's FLARE team that adds a custom navigation interface.

    • Binary

    Reviewed mandiant/xrefer@1aeda16

  • App · Tool:

    dsdump (paradiseduo wrapper)C2

    Python wrapper around a prebuilt copy of Derek Selander's dsdump, an improved nm and Objective-C and Swift class-dump for Mach-O binaries, that writes each dumped protocol, class, category and Swift type to its own .h or .swift file instead of a single console stream.

    • App

    Reviewed paradiseduo/dsdump@16b15c6

  • Binary · Tool:

    Dr. MemoryC1

    Instrument running application binaries to diagnose invalid memory access, uninitialized reads, use-after-free and leaks.

    Demo screenshot from the project's public documentation
    • Binary
    • App

    Reviewed DynamoRIO/drmemory@3d2b5f9

  • Binary · Tool:

    Intel XEDC2

    Encode and decode x86 instructions through Intel’s library and example analysis utilities.

    • Binary

    Reviewed intelxed/xed@0bcb623

  • Binary · Tool:

    KeystoneC2

    Assemble instruction text into machine code through a common API covering x86, Arm, MIPS and other architectures.

    • Binary

    Reviewed keystone-engine/keystone@0d9567f

  • Binary · Tool:

    PANDAC2

    Record and replay whole-system execution for repeated inspection, plugin analysis and dynamic taint tracking.

    • Binary

    Reviewed panda-re/panda@3650211

  • Binary · Tool:

    pefileC2

    Inspect PE headers, sections, resources and malformed values through a Python API with limited in-place editing.

    • Binary

    Reviewed erocarrera/pefile@274e0b8

  • Binary · Tool:

    PolyTrackerC2

    Trace how parser functions consume input bytes by rebuilding programs with LLVM data-flow instrumentation and inspecting the resulting trace.

    • Binary

    Reviewed trailofbits/polytracker@ae7b5f1

  • Binary · Tool:

    pyelftoolsC2

    Parse ELF executables and DWARF debugging information from Python for scripted binary inspection.

    • Binary

    Reviewed eliben/pyelftools@beedcc4

  • Binary · Tool:

    ScyllaC2

    Inspect and rebuild x86/x64 PE import tables and repair process dumps during executable analysis.

    • Binary

    Reviewed NtQuery/Scylla@e87fd57

  • Binary · Tool:

    FoxDecC2

    FoxDec is a research decompiler for formally checked lifting of x86-64 binaries to recompilable NASM.

    • Binary

    Reviewed ssrg-vt/FoxDec@d9206ef

  • Binary · Tool:

    MBBSDASMC1

    MBBSDASM is a C# disassembler for 16-bit New Executable (NE) EXE and DLL files, written with .NET Core.

    Demo screenshot from the project's public documentation
    • Binary

    Reviewed mbbsemu/MBBSDASM@52dc12a

  • Binary · Tool:

    blcC2

    blc, the Binary Lifting Contraption, is an IDA Pro plugin that integrates Ghidra's decompiler and shows a source view for platforms supported by both IDA and Ghidra.

    • Binary

    Reviewed cseagle/blc@ac38069

  • Binary · Tool:

    Quick AssemblerC1

    Quick Assembler is a Windows application for editing x86 and x64 assembly, assembling it with NASM or Keystone in 16-bit, 32-bit, or 64-bit mode, and running it in the Unicorn emulator with breakpoints, registers, and memory views.

    Demo screenshot from the project's public documentation
    • Binary

    Reviewed zodiacon/QuickAsm@27955fc

  • Binary · Tool:

    Pseudo C DumpC2

    Pseudo C Dump is a Binary Ninja plugin that writes the decompiler's Pseudo C for a binary into a chosen folder, so the output can be opened in an IDE or passed to a later static-analysis tool.

    • Binary

    Reviewed AsherDLL/PCDump-bn@67aec1f

  • Binary · Tool:

    libghidraC2

    libghidra is a typed API for Ghidra program databases, callable from C++, Python, or Rust.

    • Binary

    Reviewed 0xeb/libghidra@d4c399b

  • Binary · Tool:

    scaredC2

    scared is a side-channel analysis framework maintained by eShard.

    • Binary

    Reviewed eshard/scared@a1bb2f8

  • Binary · Tool:

    IDAPyHelperC2

    IDAPyHelper is an IDAPython script that lists names available to IDAPython so they can be sorted, searched, and filtered.

    • Binary

    Reviewed patois/IDAPyHelper@2a13c48

  • Binary · Tool:

    vscode-decompilerC2

    vscode-decompiler is a Visual Studio Code extension that decompiles binaries through Ghidra or an experimental Windows-only IDA Pro path, plus Java jars and classes, Android APKs, Python .pyc and .pyo files, and Ethereum smart contracts.

    • Binary
    • App

    Reviewed tintinweb/vscode-decompiler@fb499bd

  • Binary · Tool:

    dayuC2

    dayu is a parser and a rudimentary decompiler for the Ark Bytecode .abc files used on OpenHarmony and HarmonyOS.

    • Binary

    Reviewed hx1997/dayu@da59296

  • Binary · Tool:

    gdbidaC2

    gdbida pairs an IDA Pro plugin with a GDB Python client so an interactive GDB session can be followed in IDA.

    • Binary

    Reviewed Comsecuris/gdbida@c317816

  • Binary · Tool:

    reccmpC2

    reccmp is a toolchain for decompilation projects that compares a recompilation with the original binary.

    • Binary

    Reviewed isledecomp/reccmp@b0bf3d3

  • Game · Tool:

    agsutilsC2

    agsutils unpacks, disassembles, modifies, and repacks Adventure Game Studio games.

    • Game

    Reviewed rofl0r/agsutils@48dc22e

  • Firmware · Tool:

    waterbearC2

    waterbear is an assembler and disassembler for Dreamcast VMU programs, available as a Rust library and command-line program.

    • Firmware

    Reviewed wtetzner/waterbear@9d7a253

  • Binary · Tool:

    IDR PascalC3

    IDR Pascal is a Pascal translation of the Interactive Delphi Reconstructor.

    • Binary

    Reviewed tmcdos/IDR@805f601

  • Binary · Tool:

    YaraVMC2

    YaraVM is an IDA Pro loader and processor module for compiled YARA rules.

    • Binary

    Reviewed milankovo/YaraVM@3b4e357

↑↓ move↵ open⌘↵ new tab