Binary · Tool:
PbdViewerC1
PbdViewer is a PowerBuilder decompiler. The README points to a Kanxue thread, bbs.kanxue.com/thread-247372.htm.
- Binary
Reviewed Hucxy/PbdViewer@b46fd3e
Curated reverse engineering resources
5,191Evidence class
- C0full software reconstruction
- C1partial scope or analysis entry
- C2code & docs, no demo or download
- C3notes only
- ?Source unavailable or unreadable at review time
Native binaries
502Binary · Tool:
Copy as YARAC2
Copy as YARA is a Binary Ninja plugin that copies selected disassembly as text usable in a YARA rule.
- Binary
Reviewed ald3ns/copy-as-yara@539b28a
Binary · Tool:
pytest-idaproC2
pytest-idapro is a pytest plugin for IDA and IDAPython.
- Binary
Reviewed nirizr/pytest-idapro@12f9aab
Game · Tool:
360toolsC2
360tools is a toolkit and playbook for statically recompiling Xbox 360 games to native x86-64 executables with the ReXGlue SDK.
- Game
Reviewed sp00nznet/360tools@1b53928
Game · Tool:
retrokitC1
retrokit decompiles 32-bit games from about 1993 to 2010 with headless Ghidra.
- Game
Reviewed nautilusbits/retrokit@7625c6b
Game · Tool:
Source 2 DecompilerC2
Source 2 Decompiler, s2dc, decompiles Source 2 resource files.
- Game
Reviewed Dingf/Source-2-Decompiler@0526b7a
Binary · Tool:
parascopeC1
parascope scans source code and binaries with weggli rulesets.
- Binary
Reviewed xorpse/parascope@42e23e3
Binary · Tool:
MBASEDC2
MBASED is a Binary Ninja plugin that simplifies mixed Boolean-arithmetic expressions.
- Binary
Reviewed bliutech/mbased@fb8315f
Binary · Tool:
r2garlicC2
r2garlic is a radare2 plugin for the Garlic DEX and Dalvik decompiler.
- Binary
Reviewed radareorg/r2garlic@125c5fd
Binary · Tool:
Pocket DisasmC2
Pocket Disasm is an MCP router that gives each binary its own headless IDALib worker.
- Binary
Reviewed whoisqwerz/pocket_disasm@fdcdde8
Firmware · Tool:
Ghidra Hexagon SLEIGHC2
Ghidra Hexagon SLEIGH is a Ghidra processor module for Qualcomm Hexagon QDSP6.
- Firmware
Reviewed CUB3D/ghidra-hexagon-sleigh@7ec35fc
Game · Tool:
sega2asmC2
sega2asm splits a Sega Genesis or Mega Drive ROM by segment.
- Game
Reviewed hansbonini/sega2asm@78f37b0
Binary · Tool:
CryptoKnightC2
CryptoKnight classifies compiled cryptographic primitives.
- Binary
Binary · Tool:
cLuaDecompilerC2
cLuaDecompiler is a Free Pascal and Lazarus disassembler and decompiler for Lua bytecode.
- Binary
Reviewed Coldzer0/LuaDecompiler@e75c48a
Binary · Tool:
HELPDECOC2
HELPDECO dissects Windows Help files from Windows 3.0, 3.1, 3.11, and 95, and many MVB multimedia viewer titles, into the files needed to rebuild them with HC30, HC31, HCP, HCW, HCRTF, WMVC, MMVC, or MVC.
- Binary
Reviewed pmachapman/helpdeco@7852737
Binary · Tool:
NWiiRecompC2
NWiiRecomp translates GameCube and Wii DOL and ELF executables into C++.
- Binary
Binary · Tool:
Nehebn2C2
Nehebn2 is a Python 3 command-line interface for Binary Ninja.
- Binary
Reviewed ElykDeer/nehebn2@a92096d
Binary · Tool:
FishbonesC2
Fishbones is a Python library for implementing decompiled code.
- Binary
Reviewed sledgeh4w/fishbones@ba22044
Binary · Tool:
JVM InspectorC2
JVM Inspector is an x64dbg plugin that reads a HotSpot JVM through VMStructs.
- Binary
Reviewed kitsune-de/jvm-inspector@00340b3
Binary · Tool:
Binary Ninja PCodeC2
Binary Ninja PCode loads Ghidra SLEIGH architectures inside Binary Ninja and attempts to lift p-code into Low Level IL.
- Binary
Reviewed pd0wm/binaryninja-pcode@4755b13
Binary · Tool:
mapfile_parserC2
mapfile_parser is a Python and Rust library that parses linker map files for decompilation projects.
- Binary
Binary · Tool:
idaidleC2
idaidle is an IDA Pro plugin that watches idle time.
- Binary
Reviewed google/idaidle@d3206f1
Binary · Tool:
lumina-binjaC2
lumina-binja is a Binary Ninja plugin for IDA Lumina metadata.
- Binary
Reviewed ubcctf/lumina-binja@e46a6e7
Binary · Tool:
gamedbC2
gamedb is a Rust command-line tool that indexes a directory of decompiled C, C++, Java, or C# into SQLite.
- Binary
Reviewed smileybaal/gamedb@7054201
Binary · Tool:
BNPycC2
BNPyc is a Binary Ninja plugin that disassembles Python bytecode from version 3.0 through 3.10.
- Binary
Reviewed Njord0/BNPyc@2bad86e
Binary · Tool:
bnpyC2
bnpy is a Binary Ninja architecture plugin that disassembles raw Python bytecode.
- Binary
Reviewed extremecoders-re/bnpy@58ba9fe
Binary · Tool:
HEXPYRIONC2
HEXPYRION recovers Python source from Nuitka-compiled PE, ELF, and Mach-O binaries.
- Binary
Reviewed DimaReverse/hexpyrion@4daa534
Binary · Tool:
IDA YARA processorC2
This is an IDA loader and processor for YARA's compiled rule format.
- Binary
Reviewed bnbdr/ida-yara-processor@d784e5b
Binary · Tool:
ida-headlessC2
ida-headless embeds RPyC in IDA so a background thread serves IDA's API over TCP port 18812.
- Binary
Reviewed hugsy/ida-headless@2f2d6ec
Binary · Tool:
UQBTC2
UQBT is the University of Queensland binary translator.
- Binary
Reviewed osfree-project/uqbt@1b33e29
Binary · Tool:
IDA embed arch disasmC2
This IDA plugin disassembles x86-64 instructions, including inlined WOW64 code, inside a 32-bit IDA database.
- Binary
Reviewed a1ext/ida-embed-arch-disasm@aa86249
Binary · Tool:
PowerBuilder decompileC2
This Python module reads PowerBuilder PBD files.
- Binary
Reviewed sijms/PowerBuilder-decompile@5a7b9b0
Binary · Tool:
x64dbg_extC1
x64dbg_ext adds three commands to x64dbg.
- Binary
Reviewed expend20/x64dbg_ext@0e86748
Binary · Tool:
SemRayC2
SemRay is an IDA Pro plugin that sends decompiler context to the Gemini API and applies reviewed names back to the IDB.
- Binary
Reviewed 19h/ida-semray@3b4c01c
Game · Tool:
Paper Mario splitC3
This splits the US Paper Mario ROM for the Nintendo 64.
- Game
Binary · Tool:
delinkC2
delink splits binaries for decompilation projects.
- Binary
Reviewed HaydnTrigg/delink@fc10946
Binary · Tool:
AFL++C2
AFL++ is a coverage-guided fuzzer forked from American Fuzzy Lop.
- Binary
Reviewed AFLplusplus/AFLplusplus@d007072
Binary · Tool:
AsmDude2C1
AsmDude2 is a Visual Studio 2022 extension and language server for assembly.
- Binary
Reviewed HJLebbink/asm-dude@93b5669
Binary · Tool:
RePKGC2
RePKG is a C# unpacker for Wallpaper Engine PKG files and a converter for TEX images.
- Binary
Reviewed notscuffed/repkg@8005eb2
Binary · Tool:
MalimiteC1
Malimite decompiles iOS and macOS IPA files and application bundles on Mac, Windows, and Linux.
- Binary
Reviewed LaurieWired/Malimite@f25b0a6
Binary · Tool:
SPIRV-CrossC2
SPIRV-Cross parses SPIR-V and converts it to GLSL, Metal Shading Language, HLSL, and a JSON reflection format.
- Binary
Reviewed KhronosGroup/SPIRV-Cross@57e4efc
Binary · Tool:
PowerUpC2
PowerUp is a set of disassembly and decompilation utilities.
- Binary
Reviewed badamczewski/PowerUp@cd197e3
Binary · Tool:
BiTEC1
BiTE inspects executable content and debug information.
- Binary
Reviewed WINSDK/bite@54c10e1
Binary · Tool:
gooMBAC1
gooMBA is a Hex-Rays Decompiler plugin that simplifies mixed Boolean-arithmetic expressions.
- Binary
Reviewed HexRaysSA/goomba@8302f5b
Binary · Tool:
NtRaysC1
NtRays is a Hex-Rays microcode plugin that simplifies Windows kernel decompilation.
- Binary
Reviewed can1357/NtRays@254eea6
Binary · Tool:
FicklingC1
Fickling decompiles and statically analyzes Python pickle serializations, including PyTorch files.
- Binary
Reviewed trailofbits/fickling@c098aeb
Binary · Tool:
r2ghidraC1
r2ghidra integrates the Ghidra decompiler into radare2.
- Binary
Reviewed radareorg/r2ghidra@edc6310
Binary · Tool:
OxidizerC2
Oxidizer is a Rust decompiler on angr. It identifies compiler versions from 1.39.0 through 1.93.0, recovers standard-library functions, and emits Rust pseudocode with enums, match, the ?
- Binary
Reviewed sefcom/oxidizer@fc18d0a
Binary · Tool:
E-DecompilerC2
E-Decompiler is an IDA plugin for analyzing EPL programs.
- Binary
Reviewed fjqisba/E-Decompiler@0d50f09
Binary · Tool:
NyxstoneC1
Nyxstone assembles and disassembles code with the LLVM libraries already shipped by Linux distributions, Homebrew, and apt.llvm.org.
Demo available · no screenshot - Binary
Reviewed emproof-com/nyxstone@14e894f
Binary · Tool:
Mikage Developer EditionC2
Mikage Developer Edition is a Nintendo 3DS emulator.
- Binary
Reviewed mikage-emu/mikage-dev@3e1952b
Binary · Tool:
STraceC1
STrace reimplements the Windows DTrace syscall and ETW probes.
- Binary
Reviewed mandiant/STrace@39d2cc4
Binary · Tool:
BinAIVulHunterC2
BinAIVulHunter is an IDA Pro plugin that sends Hex-Rays decompiled functions to OpenAI, Google Gemini, or a local Ollama model and reports possible vulnerabilities.
- Binary
Reviewed ke0z/BinAIVulHunter@1b0b990
Binary · Tool:
pyasmtoolsC2
pyasmtools has a Python bytecode disassembler and a tracer that prints each executed source line with the variables loaded and stored.
- Binary
Reviewed MoserMichael/pyasmtool@f418cff
Game · Tool:
GameRoyC1
GameRoy is a Rust Game Boy emulator and debugger for the original DMG.
- Game
Reviewed Rodrigodd/gameroy@a5acdc9
Binary · Tool:
chernobogC1
chernobog is a Hex-Rays decompiler plugin for Hikari LLVM obfuscation.
- Binary
Reviewed 19h/chernobog@579c1c0
Binary · Tool:
ProjectorRaysC2
ProjectorRays decompiles Adobe Director and Shockwave movies back to Lingo and editable project files.
- Binary
Reviewed ProjectorRays/ProjectorRays@6f9bceb
Game · Tool:
Mupen64Plus-NextC2
Mupen64Plus-Next is a Nintendo 64 emulation library for the libretro API and the successor of the older Mupen64Plus libretro core.
- Game
Binary · Tool:
disasm.proC2
disasm.pro, formerly disasm.ninja, is a multi-architecture assembler and disassembler with line-to-line correlation.
- Binary
Reviewed ret2jazzy/disasm.pro@f32009a
Binary · Tool:
ROPMEMUC2
ROPMEMU analyzes code-reuse attacks from a physical memory dump and reconstructs equivalent code for ordinary reverse-engineering tools.
- Binary
Reviewed Cisco-Talos/ROPMEMU@d734228
Binary · Tool:
abi-decompilerC2
abi-decompiler recovers names and argument counts for functions in Ethereum bytecode.
- Binary
Reviewed Decurity/abi-decompiler@ee042e7
Binary · Tool:
EmuDbgC1
EmuDbg debugs a Windows executable by disassembling it with Zydis and emulating its instructions.
- Binary
Reviewed mojtabafalleh/emudbg@4e095c3
Game · Tool:
DolRecompC2
DolRecomp statically recompiles GameCube and Wii PowerPC code, with an early Espresso path for Wii U RPX files.
- Game
Reviewed ExpansionPak/DolRecomp@02e27ac
Binary · Tool:
Py2ExeDecompilerC1
Py2ExeDecompiler recovers source from executables built with py2exe.
- Binary
Reviewed endgameinc/Py2ExeDecompiler@e871e04
Binary · Tool:
dccC2
dcc is Cristina Cifuentes and Mike Van Emmerik's decompiler for DOS executables, with later fixes for memory reallocation during decompilation.
- Binary
Reviewed nemerle/dcc@e0585cc
Binary · Tool:
HRASTC2
HRAST is an IDAPython proof of concept for matching and rewriting the Hex-Rays ctree.
- Binary
Reviewed sibears/HRAST@5c64853
Binary · Tool:
OuroborosC2
Ouroboros is a Rust decompiler that recovers structure with symbolic execution and constraint tracking.
- Binary
Reviewed Hexorg/Ouroboros@729c5b6
Binary · Tool:
genmcC2
genmc is an IDAPython script and plugin that displays Hex-Rays microcode.
- Binary
Reviewed patois/genmc@f6f85d2
App · Tool:
serum-preset-packagerC2
serum-preset-packager reads and writes Serum 2 preset files using a format the author reverse engineered.
- App
Binary · Tool:
OpenJOCC1
OpenJOC decodes and inspects E-AC-3 JOC audio bitstreams in Rust.
- Binary
Reviewed chyinan/OpenJOC@e3e330a
Binary · Tool:
FelixC2
Felix is an Atari Lynx emulator with facilities for analysing software running inside it.
- Binary
Reviewed laoo/Felix@f5a9cda
App · Tool:
aftereffects-aep-parserC2
aftereffects-aep-parser is a Go library for inspecting Adobe After Effects AEP project files.
- App
App · Tool:
OpenQBWC2
OpenQBW reverse engineers the QuickBooks Desktop .qbw company-file format and provides a Rust reader, CLI, Python bindings and a format specification.
- App
Reviewed Sigilweaver/OpenQBW@68f91eb
Binary · Tool:
WinTTDC3
WinTTD exposes recovered WinDBG virtual CPU structures and callback layouts for instruction instrumentation.
- Binary
Reviewed Colton1skees/WinTTD@43e871e
App · Tool:
pyhwpC2
pyhwp parses HWP Document Format v5 files and extracts their internal streams.
- App
Reviewed mete0r/pyhwp@83239f0
Binary · Tool:
apfs-fuseC2
apfs-fuse examines Apple File System volume structures with apfs-dump and apfs-dump-quick, and mounts APFS volumes through a read-only FUSE driver.
- Binary
Reviewed sgan81/apfs-fuse@66b86bd
App · Tool:
Crate DiggerC1
Crate Digger parses rekordbox export databases and track-analysis files with Kaitai Struct definitions and generated Java classes.
- App
Reviewed Deep-Symmetry/crate-digger@7c9d535
App · Tool:
MDB ToolsC2
MDB Tools reads Microsoft Access MDB files and documents the Jet3 and Jet4 file format.
- App
Reviewed mdbtools/mdbtools@96d6880
App · Tool:
ExtractAltiumSTEPModelsC2
ExtractAltiumSTEPModels is a Python proof of concept for recovering STEP component models embedded in Altium .PcbDoc PCB project files.
- App
Game · Tool:
Rustation PlayStation debuggerC2
Rustation embeds a GDB remote debugger in a Rust PlayStation emulator core for inspecting running game code.
- Game
- Binary
Reviewed simias/rustation@5e650b9
App · Tool:
UnshieldC2
Unshield lists and extracts files from InstallShield cabinet files through a C tool and library.
- App
Reviewed twogood/unshield@c602af6
Binary · Tool:
XBEpyC2
XBEpy is a Python library for inspecting Microsoft Xbox executable files.
- Binary
Reviewed LoveMHz/XBEpy@87568a3
App · Tool:
libagdbC2
libagdb analyzes the Windows SuperFetch database format and provides C library code and tools for accessing it.
- App
Reviewed libyal/libagdb@2859755
Binary · Tool:
StringsX64DbgNextC2
StringsX64DbgNext scans the main module of an x64dbg debuggee for printable ANSI and UTF-16LE strings.
- Binary
Reviewed Orohal/stringsx64dbg-next@5b3b28d
App · Tool:
ghoC2
gho reads, extracts, creates and modifies Norton Ghost GHO disk images through a Go library and CLI.
- App
Reviewed nyarime/gho@40af0e8
App · Tool:
tps-parseC2
tps-parse reads Clarion TPS database files using a Java parser built from reverse-engineered file structures.
- App
Reviewed ctrl-alt-dev/tps-parse@9ebe03d
App · Tool:
OpenOrCadParserC2
OpenOrCadParser parses Cadence OrCAD Capture binary schematics and symbol libraries with a C++20 library and CLI.
- App
Reviewed Werni2A/OpenOrCadParser@be0a83a
Game · Tool:
xvdtoolC2
xvdtool is a C# command-line utility for inspecting Xbox One XVD and XVC packages.
- Game
Reviewed emoose/xvdtool@6fc2886
Binary · Tool:
MartyPCC1
MartyPC emulates early IBM PCs and provides disassembly, CPU and memory inspection, breakpoints, and instruction or cycle-based logging for 8088 programs.
- Binary
Reviewed dbalsom/martypc@05c0d08
App · Tool:
ptformatC2
ptformat decrypts and parses Pro Tools session files to extract audio sources, regions and tracks, plus MIDI chunks, regions, tracks and notes.
- App
Reviewed zamaudio/ptformat@af15ee9
App · Tool:
LibreDWGC2
LibreDWG reads and writes AutoCAD DWG documents through a C library and command-line tools.
- App
Reviewed LibreDWG/libredwg@c184dd0
App · Tool:
libsaiC2
libsai documents and implements access to PaintTool SAI .sai artwork files.
- App
Reviewed Wunkolo/libsai@f07ee88
Binary · Tool:
HiewC2
Hiew edits files in text, hex and disassembler modes and supports x86-64 assembly and disassembly.
- Binary
Reviewed hiew.ru
App · Tool:
OpenSKPC1
OpenSKP parses, writes, and converts SketchUp SKP files using independently implemented Python, TypeScript, .NET, Dart, and C++ libraries.
- App
Reviewed iamahsanmehmood/openskp@52980b7
App · Tool:
rekordcrateC2
rekordcrate is a Rust parser and command-line inspector for Pioneer Rekordbox exports used by CDJ and XDJ players.
- App
Reviewed Holzhaus/rekordcrate@68cd702
Binary · Tool:
DislockerC2
Dislocker inspects and decrypts BitLocker encrypted volumes on Linux and macOS.
- Binary
Reviewed Aorimn/dislocker@21ef6e5
App · Tool:
libflpC2
libflp is a C++ library for parsing FL Studio .flp project files.
- App
Reviewed codecat/libflp@349d06b
Binary · Tool:
innodb_rubyC2
innodb_ruby parses InnoDB file formats to expose database storage structures for investigation and teaching.
- Binary
Reviewed jeremycole/innodb_ruby@7ad09f9