# Curated reverse engineering resources · Page 38

> Page 38 of 52, entries 3,701–3,800. 5,191 tools, projects, integrations, case studies, and references for websites, games, apps, native binaries, firmware, and communication protocols.

Source-reviewed means descriptions were checked against primary documentation. Each entry page lists the full requirements and sources; this page shows their counts and the review date.

- HTML: <https://awesomerea.org/resources/page/38/>
- JSON: <https://awesomerea.org/api/v1/resources.json>
- 简体中文: <https://awesomerea.org/zh/resources/page/38/index.md>

## Native binaries (100)

- [8086 Register Command Debugger](https://awesomerea.org/resources/8086-register-command-debugger/index.md): Tool · 8086 Register Command Debugger is an MS-DOS machine-code inspection tool written in 8086 assembly. It loads a program into a 64 KB segment, decodes 8086 instructions and lets users inspect or edit memory and registers while stepping through real CPU instructions using the Trap Flag.
- [advantage](https://awesomerea.org/resources/advantage/index.md): Tool · advantage is a Windows research tool for inspecting Lenovo Vantage and add-in RPC commands. It injects a stub into a Lenovo-signed process, supplies an RPC JSON payload from a local server, and returns the command response through a CLI or web interface; the repository also contains Frida contract and request dump scripts.
- [Valkyrie](https://awesomerea.org/resources/valkyrie-malware-analyzer/index.md): Tool · Valkyrie analyzes suspect binaries through static inspection and Docker-based execution. Its documented pipeline examines PE headers, entropy and packing, then captures system calls, file activity and PCAP traffic for reports and threat-intelligence output.
- [PE Disassembler](https://awesomerea.org/resources/pe-disassembler-ddeeduck/index.md): Tool · PE Disassembler is a WPF application that extracts the .text section of 32-bit Windows PE executables and displays decoded x86 instructions. It checks MZ and PE signatures, handles a limited set of movement, arithmetic and control-flow opcodes, and can save the listing as text.
- [SIC/XE Disassembler and Linking Loader](https://awesomerea.org/resources/sicxe-disassembler/index.md): Tool · SIC/XE Disassembler and Linking Loader converts SIC/XE object code into assembly listings and reconstructed symbols. Its first pass identifies instruction boundaries and addressing modes; its second emits assembly, while a separate loader resolves external symbols and applies relocation records.
- [Malware Deobfuscator](https://awesomerea.org/resources/malware-deobfuscator/index.md): Tool · Malware Deobfuscator analyzes obfuscated malware scripts and generates code, behavior and indicator reports. A deterministic pass extracts indicators with regexes and maps keyword signatures to MITRE ATT&CK; an OpenAI or Ollama model supplies deobfuscated code and execution-flow explanations. The CLI handles individual files or directories and can emit JSON.
- [flashkit](https://awesomerea.org/resources/flashkit/index.md): Tool · flashkit is a Python toolkit for examining Adobe Flash SWF files and AVM2 bytecode. It parses and rebuilds SWF and ABC structures, disassembles instructions, constructs call and reference indexes, and decompiles classes or methods to ActionScript 3 through a control-flow pipeline.
- [Kaiju](https://awesomerea.org/resources/kaiju-re-framework/index.md): Tool · Kaiju is a Rust reverse-engineering framework with a headless CLI for binary loading and analysis. Its current crates parse selected ELF, PE and Mach-O metadata, extract strings, decode a limited x86-64 instruction subset and inspect saved network evidence.
- [sqlce](https://awesomerea.org/resources/sqlce/index.md): Tool · sqlce reads SQL Server Compact .sdf database files using a cross-platform C++ parser informed by analysis of decompiled SQL CE components. Python and WebAssembly bindings expose table names, schemas and rows, including files encrypted with a supplied password.
- [inkterop](https://awesomerea.org/resources/inkterop/index.md): Tool · inkterop converts native handwriting files from note apps and e-ink devices through a documented intermediate representation. It reads stroke data including pressure and tilt where present, implements readers for formats such as GoodNotes and Notability, and publishes format investigation notes and conversion fidelity modes.
- [wMatcher](https://awesomerea.org/resources/wmatcher/index.md): Tool · wMatcher compares two Java archives to match classes renamed or obfuscated between releases. Its desktop workflow loads old and new JARs, accepts dependency JARs, lets the analyst correct uncertain matches and saves the comparison as a .wmatch project.
- [tasm-rs](https://awesomerea.org/resources/tasm-rs/index.md): Tool · tasm-rs implements TVM bytecode assembly and disassembly in Rust, with a tdisasm CLI, instruction tables, Fift parsing and trace and coverage reports. It uses checked-in conformance fixtures to compare output with the upstream TypeScript implementation; the author reports 959 matching fixtures.
- [Sogen Dart bindings](https://awesomerea.org/resources/sogen-dart-bindings/index.md): Tool · Sogen Dart bindings expose Windows and Linux binary emulation through a Dart FFI package and native bridge. The API covers execution, snapshots, memory and registers, process views, callbacks and low-level hooks; Windows API calls and Linux symbols can also be intercepted. Its example hooks a Sleep call in an emulated executable.
- [cupertino-files](https://awesomerea.org/resources/cupertino-files/index.md): Tool · cupertino-files is a TypeScript library for reading and writing modern Apple Pages, Numbers, and Keynote documents. It models their undocumented file structures from real documents, exposes editing APIs and CLI tools, and publishes format notes and a language-neutral conformance suite.
- [PackerScope](https://awesomerea.org/resources/packerscope/index.md): Tool · PackerScope scans Windows PE executables for packer signatures and structural indicators, including entropy, sections, imports and entry-point instructions. It can invoke supported unpackers and check PE integrity, entropy and import-table recovery before generating reports.
- [imprint](https://awesomerea.org/resources/imprint-pe-triage/index.md): Tool · imprint analyzes Windows PE files by parsing import, delay-import and export directories without executing the image. It maps imported Windows APIs to categories and MITRE ATT&CK techniques, then reports capability patterns with the imports that triggered each finding in text or JSON.
- [kdemulator](https://awesomerea.org/resources/kdemulator/index.md): Tool · kdemulator executes Windows x86-64 kernel-driver binaries outside a live kernel for IOCTL analysis. It maps PE sections into Unicorn, intercepts imported NT API calls and supplies minimal kernel-object and memory stubs. The CLI can invoke DriverEntry, send one IOCTL or run a mutation loop over an IOCTL input buffer.
- [angr-management](https://awesomerea.org/resources/angr-management/index.md): Tool · Cross-platform graphical binary analysis tool powered by the angr platform, with disassembly and decompilation views.
- [QIRA](https://awesomerea.org/resources/qira/index.md): Tool · QIRA is a tool for examining program execution traces. Its interface lets users navigate instruction changes, register values, memory reads and writes, and forks.
- [Dependencies](https://awesomerea.org/resources/dependencies-pe/index.md): Tool · Dependencies is a Windows PE dependency analysis tool with command-line and graphical interfaces. It shows imports, exports, and DLL load dependencies to help diagnose loading problems.
- [Hachoir](https://awesomerea.org/resources/hachoir/index.md): Tool · Hachoir is a Python library for viewing and editing binary streams as trees of fields, down to individual bits. Its command-line tools can search binary files for text, extract or remove metadata, and display file contents in text mode.
- [Pigaios](https://awesomerea.org/resources/pigaios/index.md): Tool · Pigaios is a tool that matches C source code against binaries in IDA. It extracts function features from source code, finds corresponding functions in an IDA database, and imports symbols, structures, and enumerations. It can work with partial source code that does not compile.
- [MachOExplorer](https://awesomerea.org/resources/machoexplorer/index.md): Tool · MachOExplorer is a desktop and command-line tool for inspecting Mach-O binaries, Universal binaries, static archives, and dyld shared caches. It displays file structures, symbols, disassembly, and Apple-specific metadata, and can export analysis as text or JSON.
- [FLEX](https://awesomerea.org/resources/flex-ios/index.md): Tool · FLEX is an in-app tool for exploring and debugging running iOS applications. It can inspect and change views and object state, browse app files and databases, and show network request history.
- [classdump-dyld](https://awesomerea.org/resources/classdump-dyld/index.md): Tool · classdump-dyld is a command-line tool that generates Objective-C headers from Mach-O app binaries, libraries, frameworks, bundles, and images in the dyld shared cache. It can dump a single class or process compatible files recursively.
- [Process Dump](https://awesomerea.org/resources/process-dump/index.md): Tool · Process Dump is a Windows command-line tool that saves code from running processes to disk for malware analysis. It can find hidden modules and loose executable code, reconstruct PE headers and imports, and use a clean-hash database to skip known modules.
- [mal_unpack](https://awesomerea.org/resources/mal-unpack/index.md): Tool · mal_unpack is a Windows dynamic unpacker based on PE-sieve. It runs a packed malware executable, waits for its payload to unpack, dumps the payload, and terminates the original process.
- [Bloaty](https://awesomerea.org/resources/bloaty/index.md): Tool · Bloaty is a binary size profiler that attributes file and memory usage to sources such as symbols, compilation units, and sections. It can compare sizes between binaries and supports ELF and Mach-O, with experimental PE/COFF and WebAssembly support.
- [bingrep](https://awesomerea.org/resources/bingrep/index.md): Tool · bingrep is a command-line tool for inspecting and colorizing binary files. It displays details from ELF, Mach, Unix and BSD archives, and PE files, with experimental views of hexadecimal data and file offset ranges.
- [libPeConv](https://awesomerea.org/resources/libpeconv/index.md): Tool · libPeConv is a Windows library for loading and manipulating PE files. It supports tasks such as section remapping, relocation, import loading, resource parsing, and rebuilding import address tables from memory dumps.
- [Viper](https://awesomerea.org/resources/viper-framework/index.md): Tool · Viper is a framework for binary analysis and for organizing malware samples, exploit samples, and research scripts. The Viper 1.x repository is archived and development has ended.
- [Cuckoo3](https://awesomerea.org/resources/cuckoo3/index.md): Tool · Cuckoo3 is a malware analysis tool that tests suspicious files and links in sandboxed platform emulators. It reports what the files or websites did during the test.
- [Cuckoo Sandbox](https://awesomerea.org/resources/cuckoo-sandbox/index.md): Tool · Cuckoo Sandbox is an automated malware analysis system that executes suspicious files in an isolated environment and reports their behavior.
- [fq](https://awesomerea.org/resources/fq/index.md): Tool · fq is a command-line tool and query language for inspecting and decoding binary formats. It provides a structural hex viewer, bit-level decoding, nested format parsing, and an interactive query interface.
- [innoextract](https://awesomerea.org/resources/innoextract/index.md): Tool · Unpacks Inno Setup installers on non-Windows systems without running them. It also handles modified variants, including GOG.com's Inno Setup-based game installers.
- [Metasm](https://awesomerea.org/resources/metasm/index.md): Tool · Metasm is a Ruby suite for assembling, disassembling, debugging, and modifying executable binaries. It supports formats including PE, ELF, Mach-O, and shellcode.
- [pymobiledevice3](https://awesomerea.org/resources/pymobiledevice3/index.md): Tool · Pure Python 3 library and command-line tool for communicating with iPhones, iPads and other iOS devices from Windows, Linux or macOS, implementing usbmux, lockdown and its services, DTX-based developer (DVT) services and the RemoteXPC tunnels that iOS 17+ uses for developer access. Commands cover device discovery and port forwarding, syslog and crash-report collection, AFC file access, app and profile management, PCAP capture of device traffic, Bluetooth HCI logging, WebInspector automation with a Chrome DevTools Protocol bridge for Safari and WebViews, and DVT tooling such as process monitoring and screenshots; firmware update, recovery/DFU and backups are also handled. Its protocol-internals documentation walks through the usbmux, lockdown, DTX and RemoteXPC layers, and helper scripts in misc/ sniff plist and RemoteXPC traffic.
- [dumpulator](https://awesomerea.org/resources/dumpulator/index.md): Tool · Python library that emulates user-mode code from minidumps of 64-bit and 32-bit Windows processes with Unicorn. Because the dump supplies the full process memory, only system calls are emulated, and analysts can call functions, run code between two addresses, trace instructions and read results such as decrypted strings. The README presents it for malware analysis, such as configuration extraction and unpacking, and for dynamic analysis generally; syscalls can be reimplemented or hooked in Python with typed structure declarations.
- [McSema](https://awesomerea.org/resources/mcsema/index.md): Tool · Archived Trail of Bits executable lifter that translates 32- and 64-bit Linux ELF and Windows PE binaries into LLVM bitcode for analysis or recompilation. Control-flow recovery runs in mcsema-disass, which relies on IDA Pro to write a protobuf CFG, and mcsema-lift then translates instructions through the Remill library; the README lists most x86 and x86-64 integer, x87, MMX, SSE and AVX instructions plus subsets of AArch64, SPARC32 and SPARC64. Lifted bitcode can go through LLVM passes, KLEE or libFuzzer, or be compiled back into a runnable program.
- [retoolkit](https://awesomerea.org/resources/retoolkit/index.md): Tool · Windows setup program, built with Inno Setup, that installs a ready-made x86/x64 reverse-engineering and malware-analysis toolkit as selectable components: debuggers, decompilers, hex editors, PE, ELF, .NET, Java, Go, Delphi and AutoIt analyzers, and process-inspection, unpacking, network, OLE/PDF and signature tools. Tools open from a desktop launcher or from a retoolkit entry in Explorer's right-click menu that passes the selected file; the README says some come preconfigured, such as x64dbg with plugins and command-line tools that run from any directory. The repository holds only the installer scripts, while the bundled programs are third-party tools under their own terms.
- [D-810 ng](https://awesomerea.org/resources/d810-ng/index.md): Tool · A refactored, updated fork of Boris Batteux's D-810 IDA Pro plugin that deobfuscates code at decompilation time by rewriting Hex-Rays microcode. Z3-verified instruction rules simplify mixed-boolean-arithmetic, opaque predicates and constant obfuscation across maturity levels, while control-flow unflatteners restore natural flow from O-LLVM, Tigress, Approov and Hodur (PlugX) dispatcher patterns. Rules are declared in a configurable DSL and project JSON, so new patterns can be added without editing the source, and optional Cython extensions speed up the hot paths with pure-Python fallbacks.
- [Anvill](https://awesomerea.org/resources/anvill/index.md): Tool · Trail of Bits machine-code lifter built on Remill that aims to produce high-quality LLVM bitcode, close to what Clang would emit for a semantically equivalent C function, for Rellic to decompile further into C. Its anvill-decompile-spec tool lifts the functions and global variables described in a Protobuf specification of a binary's low-level ABI information into LLVM IR or bitcode, and LLVM passes lower Remill intrinsics and recover stack frames, jump tables and switches. The README says the main branch reads specifications from an in-development, closed-source Ghidra plugin, while open-source Binary Ninja spec generation remains at the binja-final-version tag.
- [XRefer](https://awesomerea.org/resources/xrefer/index.md): Tool · A Python plugin for IDA Pro from Google's FLARE team that adds a custom navigation interface. XRefer traces execution paths from entry points, groups the binary into clusters of related functions, and surfaces downstream behaviors and artifacts, with path graphs for context. It can ingest external data such as API traces from the VMRay and CAPE sandboxes, capa results and user-defined indirect cross-references. An optional integration sends extracted artifacts to Google's Gemini model to generate natural-language descriptions of code relationships and cluster-based function labels.
- [dsdump (paradiseduo wrapper)](https://awesomerea.org/resources/paradiseduo-dsdump/index.md): Tool · Python wrapper around a prebuilt copy of Derek Selander's dsdump, an improved nm and Objective-C and Swift class-dump for Mach-O binaries, that writes each dumped protocol, class, category and Swift type to its own .h or .swift file instead of a single console stream. It runs the bundled executable once with --objc and once with --swift for the chosen arm64 or armv7 slice, and -d demangles Swift names through Xcode's swift-demangle at a speed cost. The README now points users to the author's resymbol instead.
- [Dr. Memory](https://awesomerea.org/resources/dr-memory/index.md): Tool · Instrument running application binaries to diagnose invalid memory access, uninitialized reads, use-after-free and leaks.
- [Intel XED](https://awesomerea.org/resources/intel-xed/index.md): Tool · Encode and decode x86 instructions through Intel’s library and example analysis utilities.
- [Keystone](https://awesomerea.org/resources/keystone/index.md): Tool · Assemble instruction text into machine code through a common API covering x86, Arm, MIPS and other architectures.
- [Microsoft Detours](https://awesomerea.org/resources/microsoft-detours/index.md): Tool · Monitor Windows API calls by embedding instrumentation into a program’s execution path.
- [PANDA](https://awesomerea.org/resources/panda/index.md): Tool · Record and replay whole-system execution for repeated inspection, plugin analysis and dynamic taint tracking.
- [pefile](https://awesomerea.org/resources/pefile/index.md): Tool · Inspect PE headers, sections, resources and malformed values through a Python API with limited in-place editing.
- [PolyTracker](https://awesomerea.org/resources/polytracker/index.md): Tool · Trace how parser functions consume input bytes by rebuilding programs with LLVM data-flow instrumentation and inspecting the resulting trace.
- [pyelftools](https://awesomerea.org/resources/pyelftools/index.md): Tool · Parse ELF executables and DWARF debugging information from Python for scripted binary inspection.
- [rustc-demangle](https://awesomerea.org/resources/rustc-demangle/index.md): Tool · Turn mangled Rust symbols into readable names for symbol inspection and binary-analysis tooling.
- [Scylla](https://awesomerea.org/resources/scylla/index.md): Tool · Inspect and rebuild x86/x64 PE import tables and repair process dumps during executable analysis.
- [TitanEngine Community Edition](https://awesomerea.org/resources/titanengine/index.md): Tool · Embed a Windows debugging engine with breakpoint, exception, process-dump and import-reconstruction support.
- [Volatility 3](https://awesomerea.org/resources/volatility3/index.md): Tool · Inspect operating-system memory samples to recover processes, modules and other runtime artifacts through forensic plugins.
- [FoxDec](https://awesomerea.org/resources/foxdec/index.md): Tool · FoxDec is a research decompiler for formally checked lifting of x86-64 binaries to recompilable NASM. The current version uses NASM as its intermediate representation, and an earlier version lifted C. The README limits inputs to sequential C binaries that follow the System V AMD64 ABI, and the quick start runs through Docker.
- [Dragodis](https://awesomerea.org/resources/dragodis/index.md): Tool · Dragodis is a Python framework for writing disassembler scripts that run on more than one disassembler. The README lists Ghidra, IDA Pro, and Vivisect as backends, and shows installation with pip install dragodis followed by a backend install documented in docs/install.md.
- [MBBSDASM](https://awesomerea.org/resources/mbbsdasm/index.md): Tool · MBBSDASM is a C# disassembler for 16-bit New Executable (NE) EXE and DLL files, written with .NET Core. It was built to study The Major BBS and Worldgroup modules, and the README says it also disassembles other NE files, with Solitaire and Calculator from Windows 3.1 used as checks. A text UI starts when the program is run with no arguments.
- [blc](https://awesomerea.org/resources/blc/index.md): Tool · blc, the Binary Lifting Contraption, is an IDA Pro plugin that integrates Ghidra's decompiler and shows a source view for platforms supported by both IDA and Ghidra. The README says it was written with IDA 7.x in mind and warns that the code is raw and likely buggy.
- [IDA BPF Processor](https://awesomerea.org/resources/ida-bpf-processor/index.md): Tool · IDA BPF Processor is a Python processor and loader for classic BPF bytecode in IDA. The README says it supports old BPF only, not eBPF, and that the loader accepts files whose magic is the four bytes bpf followed by NUL and whose reserved field is 0. It defines symbolic constants for seccomp return values and licenses the code under MIT.
- [Udis86](https://awesomerea.org/resources/udis86/index.md): Tool · Disassembler library for x86 and x86-64. The README says libudis86 decodes a stream of raw bytes and exposes the instructions in a structured form. It lists general-purpose and system instructions, plus MMX, x87, AMD 3DNow, SSE through SSE4.2, and AES among the ISA extensions.
- [Quick Assembler](https://awesomerea.org/resources/quickasm/index.md): Tool · Quick Assembler is a Windows application for editing x86 and x64 assembly, assembling it with NASM or Keystone in 16-bit, 32-bit, or 64-bit mode, and running it in the Unicorn emulator with breakpoints, registers, and memory views.
- [HLSL Decompiler](https://awesomerea.org/resources/hlsl-decompiler/index.md): Tool · HLSL Decompiler translates DXBC for shader model 5.x or lower, DXIL for shader model 6.x, and SPIR-V into HLSL. The README says the shaders it targets are those commonly used in Unreal Engine 5 projects.
- [Windbg Decompile Extension via LLM](https://awesomerea.org/resources/windbg-decompile-ext/index.md): Tool · Windows x64 WinDbg extension that resolves a function by name or address, reconstructs a control-flow view, and asks an LLM from the extension to produce pseudocode. The README limits the current scope to x64 and to live-memory analysis through DbgEng.
- [Pseudo C Dump](https://awesomerea.org/resources/pcdump-bn/index.md): Tool · Pseudo C Dump is a Binary Ninja plugin that writes the decompiler's Pseudo C for a binary into a chosen folder, so the output can be opened in an IDE or passed to a later static-analysis tool. It requires Binary Ninja build 3814 or newer and is written in Python 3. The README releases it under Apache-2.0.
- [Ruri.ShaderDecompiler](https://awesomerea.org/resources/ruri-shader-decompiler/index.md): Tool · Ruri.ShaderDecompiler is a shader decompiler library that turns compiled shader binaries into HLSL and rebuilds links between symbols and bytecode. The README describes a Unity path similar to AssetRipper and an Unreal path similar to FModel.
- [libghidra](https://awesomerea.org/resources/libghidra/index.md): Tool · libghidra is a typed API for Ghidra program databases, callable from C++, Python, or Rust. It offers a remote backend that uses a live Ghidra host and a local backend with a compiled-in Sleigh engine for an offline subset of queries.
- [ghidrasql](https://awesomerea.org/resources/ghidrasql/index.md): Tool · ghidrasql is a SQL interface for Ghidra program databases. The README says it can query functions, cross-references, types, and decompilation output, and that virtual-table rows last only for the statement that created them.
- [Pyre](https://awesomerea.org/resources/pyre/index.md): Tool · Pyre runs Ghidra's C++ decompiler in the browser. The README says you drag in an ELF, Mach-O, PE, or .wasm file, the SLEIGH spec is loaded for that architecture, and functions are decompiled on demand without uploading the binary.
- [gapstone](https://awesomerea.org/resources/gapstone/index.md): Tool · gapstone is a Go binding for the Capstone disassembly library. The README marks the repository retired and points to the fork at knightsc/gapstone, while the retained text names Capstone 4.0.1 as the upstream version it tracked.
- [scared](https://awesomerea.org/resources/scared/index.md): Tool · scared is a side-channel analysis framework maintained by eShard. The README publishes it on PyPI as scared and on the eshard Anaconda channel.
- [IDAPyHelper](https://awesomerea.org/resources/idapyhelper/index.md): Tool · IDAPyHelper is an IDAPython script that lists names available to IDAPython so they can be sorted, searched, and filtered. Double-clicking an entry shows its docstring when one exists, and Alt-E opens the module.
- [vscode-decompiler](https://awesomerea.org/resources/vscode-decompiler/index.md): Tool · vscode-decompiler is a Visual Studio Code extension that decompiles binaries through Ghidra or an experimental Windows-only IDA Pro path, plus Java jars and classes, Android APKs, Python .pyc and .pyo files, and Ethereum smart contracts.
- [Capstone.js](https://awesomerea.org/resources/capstone-js/index.md): Tool · Capstone.js is a JavaScript and WebAssembly port of the Capstone disassembler, built with Emscripten. The README shows it decoding machine-code bytes into instructions from a browser or another JavaScript environment.
- [Hexagon processor module](https://awesomerea.org/resources/idp-hexagon/index.md): Tool · idp_hexagon is an IDA Pro processor module for Qualcomm Hexagon, also called QDSP6. The README lists support for Hexagon versions from V4 through V79, including HVX, audio, HMX, and V66 neural-network extensions, plus ELF relocations.
- [ida-pro-loadmap](https://awesomerea.org/resources/ida-pro-loadmap/index.md): Tool · ida-pro-loadmap is an IDA Pro plugin that loads VC, Borland, Dede, GCC, and IDA .map symbol files into an IDA database. The README says those files can carry function names, globals, and sometimes locals.
- [Mach-O-Scope](https://awesomerea.org/resources/mach-o-scope/index.md): Tool · Mach-O-Scope 0.2 browses the disassembly of Mach-O bundles such as OS X applications and plugins. It uses otool and OTX to dump ppc, i386, and x86_64 assembly, stores the result in SQLite, and keeps notes on methods.
- [dayu](https://awesomerea.org/resources/dayu/index.md): Tool · dayu is a parser and a rudimentary decompiler for the Ark Bytecode .abc files used on OpenHarmony and HarmonyOS. The README describes it as a spare-time project with limited availability.
- [gdbida](https://awesomerea.org/resources/gdbida/index.md): Tool · gdbida pairs an IDA Pro plugin with a GDB Python client so an interactive GDB session can be followed in IDA. The README gives the plugin file ida_gdb_bridge.py and the client file gdb_ida_bridge_client.py.
- [reccmp](https://awesomerea.org/resources/reccmp/index.md): Tool · reccmp is a toolchain for decompilation projects that compares a recompilation with the original binary. The README says functions and data are matched from address comments in the source, and that the tools began with the LEGO Island decompilation.
- [decompiler](https://awesomerea.org/resources/multi-backend-decompiler/index.md): Tool · decompiler is a Python decompiler with IDA and Capstone backends. It follows van Emmerik's paper on static single assignment for decompilation. The README says it can decompile small functions with simple control flow, covers a limited set of x86 and x64 instructions, and currently restores call parameters for the System V x64 ABI.
- [unluac-rs](https://awesomerea.org/resources/unluac-rs/index.md): Tool · unluac-rs is a Rust decompiler for Lua bytecode. It covers Lua 5.1 through 5.5, LuaJIT 2.1, and Luau, detects the dialect from the chunk, and can run as a command-line tool, a Rust or JavaScript library, or a browser workspace.
- [aevt_decompile](https://awesomerea.org/resources/aevt-decompile/index.md): Tool · aevt_decompile annotates a disassembled run-only AppleScript. Its input is a text file produced by applescript-disassembler. The output adds AEVT code descriptions, decoded hard-coded strings, decimal conversions of hard-coded hex numbers, and names of targeted applications.
- [GBARecomp](https://awesomerea.org/resources/gbarecomp/index.md): Tool · GBARecomp is a beta static-recompilation framework for the Game Boy Advance. It translates ARM7TDMI ARM and Thumb code into C++, compiles that into a native application, and links it to a shared runtime for the PPU, audio, DMA, timers, interrupts, cartridge saves, GPIO, and input.
- [Zomboid Decompiler](https://awesomerea.org/resources/zomboid-decompiler/index.md): Tool · Zomboid Decompiler is a decompiler for Project Zomboid, powered by Vineflower. It writes the decompiled source to output/, adds doc comments, and remaps line numbers for remote debugging.
- [Ghidra Wasm Plugin](https://awesomerea.org/resources/ghidra-wasm-plugin/index.md): Tool · Ghidra Wasm Plugin loads WebAssembly modules into Ghidra for disassembly and decompilation. The README says it can handle simple modules and is no longer actively maintained, and it points to nneonneo/ghidra-wasm-plugin as a later version.
- [dx-shader-decompiler](https://awesomerea.org/resources/dx-shader-decompiler/index.md): Tool · dx-shader-decompiler decompiles DirectX 9 pixel and vertex shaders, shader model 3.0. It accepts the text or binary form produced by fxc.exe.
- [agsutils](https://awesomerea.org/resources/agsutils/index.md): Tool · agsutils unpacks, disassembles, modifies, and repacks Adventure Game Studio games. agstract extracts the files inside a game pack, and agsex writes a Makefile that repacks changed assembly.
- [ExtractMachO](https://awesomerea.org/resources/extractmacho/index.md): Tool · ExtractMachO is an IDA plugin that extracts Mach-O binaries found in a disassembly. It supports 32-bit and 64-bit images, fat binaries, and Intel, PowerPC, and ARM. Version 1.1 was tested with IDA 6.3 on Mac OS X.
- [waterbear](https://awesomerea.org/resources/waterbear/index.md): Tool · waterbear is an assembler and disassembler for Dreamcast VMU programs, available as a Rust library and command-line program. Version 0.18.0 can optimize jump and call encodings.
- [WPP Remover](https://awesomerea.org/resources/ida-wpp-remover/index.md): Tool · WPP Remover is an IDA Pro plugin that removes Windows software-trace calls from Hex-Rays pseudocode. It activates for Windows PE files and replaces calls to WPP_SF functions with NOPs in a microcode pass.
- [ds_disassembly_tools](https://awesomerea.org/resources/ds-disassembly-tools/index.md): Tool · ds_disassembly_tools is a set of scripts for the initial setup of a Nintendo DS disassembly. asmdiff.sh compares a rebuilt ARM9, ARM7, or overlay with a reference ROM. dump_fs.py extracts the Nitro file system.
- [PSRetrox](https://awesomerea.org/resources/psretrox/index.md): Tool · PSRetrox is a C++ application for reverse engineering PlayStation 2 games from extracted ISO files. It disassembles binaries with Capstone, recompiles assembly to C, and decodes audio, 3D models, and formats such as MB, MH, BD, BH, and PSS. Retrox Engine ports the resulting C files toward a PC build.
- [IDR Pascal](https://awesomerea.org/resources/idr-pascal/index.md): Tool · IDR Pascal is a Pascal translation of the Interactive Delphi Reconstructor. The original C++ project is crypto2011/IDR. IDP2TXT converts an IDR project file to text.
- [YaraVM](https://awesomerea.org/resources/yaravm/index.md): Tool · YaraVM is an IDA Pro loader and processor module for compiled YARA rules. It loads the rule bytecode and the regex bytecode so they can be disassembled in IDA.
- [DecompPipeline](https://awesomerea.org/resources/decomp-pipeline/index.md): Tool · DecompPipeline turns a game's machine code into C one function at a time and builds that C into a native port. A per-CPU translator writes the C. A judge runs the original function in an emulator and the C on the same inputs, then returns PASS or FAIL. Listed targets are Dreamcast SH-4, Saturn SH-2, GameCube PowerPC, and Xbox 360 PowerPC.
- [GameMaker 8.1 Decompiler](https://awesomerea.org/resources/gm81decompiler/index.md): Tool · GameMaker 8.1 Decompiler is the 2011 source of a decompiler for GameMaker 8.1 and 8.0 executables. It grew from the GameMaker 8.0 decompiler and uses the Gmk library for GMK serialization.
- [libdecomp](https://awesomerea.org/resources/libdecomp/index.md): Tool · libdecomp decompiles multi-architecture machine code into source. It supports x86, x86-64, and ARM64, with Zydis or Capstone as the disassembler backend, and can format output as C, Zig, or Python.
- [PSP Static Recompiler Toolkit](https://awesomerea.org/resources/psp-recompilation-toolkit/index.md): Tool · This toolkit translates a PSP relocatable executable into C, links it with a native runtime, and builds a Windows executable. The runtime includes a scheduler, HLE kernel, audio and video decoding, and an SDL3 plus Vulkan renderer written for this project.