# Curated reverse engineering resources · Page 39

> Page 39 of 52, entries 3,801–3,900. 5,191 tools, projects, integrations, case studies, and references for websites, games, apps, native binaries, firmware, and communication protocols.

Source-reviewed means descriptions were checked against primary documentation. Each entry page lists the full requirements and sources; this page shows their counts and the review date.

- HTML: <https://awesomerea.org/resources/page/39/>
- JSON: <https://awesomerea.org/api/v1/resources.json>
- 简体中文: <https://awesomerea.org/zh/resources/page/39/index.md>

## Native binaries (100)

- [PbdViewer](https://awesomerea.org/resources/pbdviewer/index.md): Tool · PbdViewer is a PowerBuilder decompiler. The README points to a Kanxue thread, bbs.kanxue.com/thread-247372.htm.
- [Copy as YARA](https://awesomerea.org/resources/copy-as-yara/index.md): Tool · Copy as YARA is a Binary Ninja plugin that copies selected disassembly as text usable in a YARA rule. It can copy the bytes as shown, wildcard address tokens on x86 and ARM, or emit a complete rule.
- [pytest-idapro](https://awesomerea.org/resources/pytest-idapro/index.md): Tool · pytest-idapro is a pytest plugin for IDA and IDAPython. It can run a pytest session inside IDA, or mock IDAPython outside IDA. Since version 0.3.5 it also records and replays IDAPython calls.
- [360tools](https://awesomerea.org/resources/360tools/index.md): Tool · 360tools is a toolkit and playbook for statically recompiling Xbox 360 games to native x86-64 executables with the ReXGlue SDK. It is written for ReXGlue 0.8.0, which extracts XEX and STFS packages and generates C++. The older XenonRecomp pipeline is kept under legacy/.
- [retrokit](https://awesomerea.org/resources/retrokit/index.md): Tool · retrokit decompiles 32-bit games from about 1993 to 2010 with headless Ghidra. It loads DOS LE and LX executables, including Watcom calling conventions, and types Win32 PE imports such as DirectX COM methods and Miles, Smacker, Bink, FMOD, and BASS. The export is one large C file plus indexes of functions, calls, strings, and imports.
- [Source 2 Decompiler](https://awesomerea.org/resources/source-2-decompiler/index.md): Tool · Source 2 Decompiler, s2dc, decompiles Source 2 resource files. It currently reads .vtex_c, .vmat_c, and .vpcf_c. Dota 2 Reborn files that no longer carry structure metadata need the ntro metadata placed beside the executable.
- [parascope](https://awesomerea.org/resources/parascope/index.md): Tool · parascope scans source code and binaries with weggli rulesets. Building it needs IDA Pro 9.2 and the current SDK. It is installed from crates.io with cargo.
- [MBASED](https://awesomerea.org/resources/mbased/index.md): Tool · MBASED is a Binary Ninja plugin that simplifies mixed Boolean-arithmetic expressions. It parses an MLIL instruction into a tree and simplifies it with SymPy and Z3, then prints the result in the Binary Ninja log.
- [r2garlic](https://awesomerea.org/resources/r2garlic/index.md): Tool · r2garlic is a radare2 plugin for the Garlic DEX and Dalvik decompiler. pd:G decompiles the method at the current seek, pd:Gc the current class, and pd:Gs writes smali for the current class.
- [Pocket Disasm](https://awesomerea.org/resources/pocket-disasm/index.md): Tool · Pocket Disasm is an MCP router that gives each binary its own headless IDALib worker. Agents can create, select, inspect, save, and close analysis sessions. It uses a pinned revision of mrexodia/ida-pro-mcp.
- [Ghidra Hexagon SLEIGH](https://awesomerea.org/resources/ghidra-hexagon-sleigh/index.md): Tool · Ghidra Hexagon SLEIGH is a Ghidra processor module for Qualcomm Hexagon QDSP6. It disassembles v66, v67, v68, v73, v75, v79, v81, v83, and v85, including HVX v85, HMX v81, and an initial HLX v85. It also implements hardware loops and p-code for most operations.
- [sega2asm](https://awesomerea.org/resources/sega2asm/index.md): Tool · sega2asm splits a Sega Genesis or Mega Drive ROM by segment. It disassembles Motorola 68000 and Z80 code, writes 4bpp graphics as PNG, and converts raw PCM to WAV. Code output is aimed at clownassembler.
- [CryptoKnight](https://awesomerea.org/resources/cryptoknight/index.md): Tool · CryptoKnight classifies compiled cryptographic primitives. It uses Intel Pin for dynamic instrumentation and PyTorch for the model. The README points to the 2018 paper in Information, DOI 10.3390/info9090231.
- [cLuaDecompiler](https://awesomerea.org/resources/cluadecompiler/index.md): Tool · cLuaDecompiler is a Free Pascal and Lazarus disassembler and decompiler for Lua bytecode. It covers Lua 5.1 through 5.5, can load a custom opcode table, and can compare decompiled output with the original program when source is available.
- [HELPDECO](https://awesomerea.org/resources/helpdeco/index.md): Tool · HELPDECO dissects Windows Help files from Windows 3.0, 3.1, 3.11, and 95, and many MVB multimedia viewer titles, into the files needed to rebuild them with HC30, HC31, HCP, HCW, HCRTF, WMVC, MMVC, or MVC. The output includes the HPJ or MVP project, RTF, phrases, icons, pictures, and baggage files.
- [NWiiRecomp](https://awesomerea.org/resources/nwiirecomp/index.md): Tool · NWiiRecomp translates GameCube and Wii DOL and ELF executables into C++. nWiiAnalyzer finds function boundaries, nWiiRecomp emits the C++, and nWiiRuntime supplies the high-level runtime. The generated export directory builds on its own. The README says Mario Party 7 reaches its 3D intro and Need for Speed: Hot Pursuit 2 shows boot progress.
- [Nehebn2](https://awesomerea.org/resources/nehebn2/index.md): Tool · Nehebn2 is a Python 3 command-line interface for Binary Ninja. The reviewed README lists a linear disassembly view, cross-references, a function list, a hex view, and customizable key bindings.
- [Fishbones](https://awesomerea.org/resources/fishbones/index.md): Tool · Fishbones is a Python library for implementing decompiled code. It provides fixed-width integers, a vptr type for pointer reads and writes, and some built-in functions from IDA and Ghidra.
- [JVM Inspector](https://awesomerea.org/resources/jvm-inspector/index.md): Tool · JVM Inspector is an x64dbg plugin that reads a HotSpot JVM through VMStructs. It lists classes, decompiles bytecode, walks Java thread stacks, and can set a breakpoint on a Java method. It can load Mojang ProGuard mappings.
- [Binary Ninja PCode](https://awesomerea.org/resources/binaryninja-pcode/index.md): Tool · Binary Ninja PCode loads Ghidra SLEIGH architectures inside Binary Ninja and attempts to lift p-code into Low Level IL. The LOAD_SLA variable selects an architecture. The README says the lifted IL is verbose and that calling conventions are not set.
- [mapfile_parser](https://awesomerea.org/resources/mapfile-parser/index.md): Tool · mapfile_parser is a Python and Rust library that parses linker map files for decompilation projects. The README names GNU ld, clang lld, and Metrowerks ld. The Python package is mapfile_parser and the Rust crate is mapfile_parser.
- [idaidle](https://awesomerea.org/resources/idaidle/index.md): Tool · idaidle is an IDA Pro plugin that watches idle time. By default it warns after six hours and, after twelve hours, writes a database snapshot and closes IDA without saving. The warning delay is -OIdaIdleWarningSeconds:N. Builds produce idaidle.so, idaidle.dylib, or idaidle.dll.
- [lumina-binja](https://awesomerea.org/resources/lumina-binja/index.md): Tool · lumina-binja is a Binary Ninja plugin for IDA Lumina metadata. It applies function names, instruction and function comments, and function types on x86 and x86_64. The README estimates about 85 percent signature agreement with IDA, and marks ARM and AArch64 as not done. The official server expects an IDA license file and the Hex-Rays certificate.
- [gamedb](https://awesomerea.org/resources/gamedb/index.md): Tool · gamedb is a Rust command-line tool that indexes a directory of decompiled C, C++, Java, or C# into SQLite. The commands are index, search, read, and graph. Cargo.toml has no dependency section. On Windows it binds to winsqlite3.dll. Elsewhere it binds to libsqlite3.
- [BNPyc](https://awesomerea.org/resources/bnpyc/index.md): Tool · BNPyc is a Binary Ninja plugin that disassembles Python bytecode from version 3.0 through 3.10. It annotates branches and comparisons and inlines co_consts, co_names, and co_varnames. The README says IL lifting is not implemented.
- [bnpy](https://awesomerea.org/resources/bnpy/index.md): Tool · bnpy is a Binary Ninja architecture plugin that disassembles raw Python bytecode. A .pyc file is opened, the 8-byte magic and timestamp are skipped, and marshal.load yields the code object whose co_code is written out. That stream is loaded in Binary Ninja and selected as the Python architecture with P.
- [HEXPYRION](https://awesomerea.org/resources/hexpyrion/index.md): Tool · HEXPYRION recovers Python source from Nuitka-compiled PE, ELF, and Mach-O binaries. The NDX command is python nuitka_decompiler.py --ndx --dev-only <binary> -o OUT. --devirt emits each marshalled code object as a .pyc without executing the binary. --onefile-unpack unpacks a Nuitka onefile payload, including zstd, without running the bootstrap. pefile is required for PE parsing.
- [IDA YARA processor](https://awesomerea.org/resources/ida-yara-processor/index.md): Tool · This is an IDA loader and processor for YARA's compiled rule format. The processor goes in the IDA procs directory and the loader in the loaders directory. It requires IDA 7.0. The README says it was tested with YARA 3.7.0 and 3.8.1.
- [ida-headless](https://awesomerea.org/resources/ida-headless/index.md): Tool · ida-headless embeds RPyC in IDA so a background thread serves IDA's API over TCP port 18812. A client connects with rpyc.connect and uses c.root.idaapi and c.root.idc. Generator objects go through c.root.iterate. The threading workaround is for IDA Pro 7.2 and newer.
- [UQBT](https://awesomerea.org/resources/uqbt/index.md): Tool · UQBT is the University of Queensland binary translator. ./make X Y builds a translator named uqbtXY. The named architectures are sparc, pent, mc68k, win32, and hppa. ./make sparc sparc builds the gcc/jvm back end as uqbtss. ./make change switches the architecture pair before another build.
- [IDA embed arch disasm](https://awesomerea.org/resources/ida-embed-arch-disasm/index.md): Tool · This IDA plugin disassembles x86-64 instructions, including inlined WOW64 code, inside a 32-bit IDA database. The user selects a range, and the disassembled instructions are written as comments. It uses the capstone Python module. For IDA 7 and newer, capstone must match IDA's 64-bit Python.
- [PowerBuilder decompile](https://awesomerea.org/resources/powerbuilder-decompile/index.md): Tool · This Python module reads PowerBuilder PBD files. pbd_dump.py extracts a PBD into a folder. analyse_folder.py and analyse.py decompile win, fun, and udo files. pbd_analyse.py runs those steps on one PBD. The README says the work is incomplete and was tested against PowerBuilder 6. The recovered text is a descriptive listing, not a named programming language.
- [x64dbg_ext](https://awesomerea.org/resources/x64dbg-ext/index.md): Tool · x64dbg_ext adds three commands to x64dbg. telescope recursively follows pointers and prints symbols, modules, and strings. unicorn replaces the linear disassembly view with the instructions the emulator will execute and the propagated register values. context prints that unicorn trace and applies telescope to the stack. Initializing a Unicorn context uses about 1 GB of RAM. The plugin file is ext.dp64.
- [SemRay](https://awesomerea.org/resources/ida-semray/index.md): Tool · SemRay is an IDA Pro plugin that sends decompiler context to the Gemini API and applies reviewed names back to the IDB. It needs IDA Pro 7.6 or newer with Python 3 and PyQt5, plus the Hex-Rays decompiler for decompilation mode. The Python packages are google-genai and pydantic. A Google AI API key is required.
- [Paper Mario split](https://awesomerea.org/resources/paper-mario-split/index.md): Tool · This splits the US Paper Mario ROM for the Nintendo 64. The ROM is named baserom.z64. make builds n64split and writes the split ROM. Compiling n64split needs libcapstone and libyaml.
- [delink](https://awesomerea.org/resources/delink/index.md): Tool · delink splits binaries for decompilation projects. It handles AArch64 and 32-bit ARM shared objects, Mach-O STABS and SYMTAB, and Windows PE files with PDBs. An IDA 9.x script writes delink.ida.json with no file bytes, and delink ida-split turns that JSON plus the original binary into COFF objects, or ELF objects with --elf. x86 and x86-64 functions are disassembled with iced-x86.
- [AFL++](https://awesomerea.org/resources/aflplusplus/index.md): Tool · AFL++ is a coverage-guided fuzzer forked from American Fuzzy Lop. The README names release 5.03c and GitHub version 5.04a. docker pull aflplusplus/aflplusplus provides an x86_64 and arm64 image, and docs/INSTALL.md is the recommended source build. Binary-only, network, and GUI targets have separate guides under docs/.
- [AsmDude2](https://awesomerea.org/resources/asm-dude2/index.md): Tool · AsmDude2 is a Visual Studio 2022 extension and language server for assembly. It highlights x86 and x64, including SSE, AVX, AVX2, Xeon Phi, and AVX-512, plus common MASM directives and a selection of NASM directives. It also highlights the Visual Studio disassembly window. The installer is AsmDude.vsix 2.0.0.4. Running from source uses the Visual Studio 2022 SDK and F5.
- [RePKG](https://awesomerea.org/resources/repkg/index.md): Tool · RePKG is a C# unpacker for Wallpaper Engine PKG files and a converter for TEX images. repkg extract writes files to ./output by default, can limit extensions, and can copy project.json into a Wallpaper Engine project. repkg info dumps PKG and TEX entries, with sorting by name, extension, or size.
- [Malimite](https://awesomerea.org/resources/malimite/index.md): Tool · Malimite decompiles iOS and macOS IPA files and application bundles on Mac, Windows, and Linux. It uses Ghidra decompilation, reconstructs Swift classes, decodes Apple resources, and skips library code. A precompiled JAR is on the releases page. Installation steps are in the project wiki.
- [SPIRV-Cross](https://awesomerea.org/resources/spirv-cross/index.md): Tool · SPIRV-Cross parses SPIR-V and converts it to GLSL, Metal Shading Language, HLSL, and a JSON reflection format. A C++ backend is marked deprecated. It covers vertex, fragment, tessellation, geometry, and compute shaders, and exposes a reflection API for Vulkan pipeline layouts and OpDecorations. CMake is the tested build on Linux, macOS, Windows, and Android. make builds the CLI on Linux, macOS, and MinGW-w64. The compilers used are GCC 4.8+ or Clang 3.x+.
- [PowerUp](https://awesomerea.org/resources/powerup/index.md): Tool · PowerUp is a set of disassembly and decompilation utilities. PowerUp.Watcher.exe watches source, IR, and IL, then compiles, decompiles, and disassembles them to IL, IR, and x86 assembly. The reviewed command lines use -rs for Rust, -go for Go, and -cs for C#, each with an input file and an output file. The same process can run those compilers together. C# is the language with interactive execution, benchmarking, and class and struct layouts. The set also includes a .NET JIT disassembler and a .NET IL compiler.
- [BiTE](https://awesomerea.org/resources/bite/index.md): Tool · BiTE inspects executable content and debug information. The README feature list includes an assembly listing, a hex viewer, and disassembly beside source. It supports x86-64, AArch64, Armv7, RISC-V 64 and 32, and MIPS, and demangles MSVC, Itanium, and Rust names. cargo install --path . builds it. A debugging front end and assembly byte patching are still unchecked.
- [gooMBA](https://awesomerea.org/resources/goomba/index.md): Tool · gooMBA is a Hex-Rays Decompiler plugin that simplifies mixed Boolean-arithmetic expressions. It handles linear expressions and sign extension, checks simplifications with z3, and uses a fingerprint oracle for non-linear expressions. The action name is goomba:run. Options, including MBA_ORACLE_PATH and the z3 timeout, are in goomba.cfg. Release builds target IDA Pro and IDA Teams 8.2. From IDA 8.3 the plugin is included with those products.
- [NtRays](https://awesomerea.org/resources/ntrays/index.md): Tool · NtRays is a Hex-Rays microcode plugin that simplifies Windows kernel decompilation. It cleans scheduler hints, lifts missing instructions, TrapFrame accesses, KUSER_SHARED_DATA, dynamic page-table relocations with LA57, and SYSCALL instructions with selectable Nt signatures. It also replaces KTHREAD and KPROCESS with ETHREAD and EPROCESS. cmake takes IDA_SDK_DIR and HEXRAYS_SDK_DIR. The Windows build uses Visual Studio 2022. NtRays64.dll goes in the plugins folder. IDA 7.6 or newer is required.
- [Fickling](https://awesomerea.org/resources/fickling/index.md): Tool · Fickling decompiles and statically analyzes Python pickle serializations, including PyTorch files. python -m pip install fickling installs the library and the fickling command. Python 3.11 or newer is required. fickling --trace prints an execution trace, and Pickled.load builds an AST of a pickle. fickling[torch] adds the PyTorch modules. activate_safe_ml_environment hooks pickle and checks imports against an allowlist.
- [r2ghidra](https://awesomerea.org/resources/r2ghidra/index.md): Tool · r2ghidra integrates the Ghidra decompiler into radare2. The plugin is built from the C++ decompiler, so a Ghidra install is not required. r2pm -ci r2ghidra installs it. After af analyzes a function, pdg decompiles it. pdga shows disassembly beside the decompilation, pdgj dumps JSON, and pdgs lists Sleigh languages. It is known to build on Termux, macOS, iOS, GNU/Linux, Windows, and FreeBSD x86-64. ACR/make or Meson/Ninja can build it.
- [Oxidizer](https://awesomerea.org/resources/oxidizer/index.md): Tool · Oxidizer is a Rust decompiler on angr. It identifies compiler versions from 1.39.0 through 1.93.0, recovers standard-library functions, and emits Rust pseudocode with enums, match, the ? operator, and macros such as println! and panic!. The README says the work was merged into angr master in pull request 6283. docker build -t oxidizer . then docker run oxidizer python demo.py runs the demo. uv sync --frozen --no-default-groups is the local setup. The paper is Oxidizer: Toward Concise and High-fidelity Rust Decompilation, IEEE S&P 2026. Evaluation scripts are in sefcom/oxidizer-eval.
- [E-Decompiler](https://awesomerea.org/resources/e-decompiler/index.md): Tool · E-Decompiler is an IDA plugin for analyzing EPL programs. The current approach edits function declarations and the Hex-Rays ctree using EPL function signatures. The recommended build is Windows, Visual Studio 2022, and IDA SDK 9.4. cmake -S . -B build -DIDASDK takes the SDK root, and cmake --build build --config Release writes E-Decompiler.dll for the plugins directory. Ctrl+3 opens the plugin. An IDAPython port in e-mcp runs on IDA 9.x without the SDK.
- [Nyxstone](https://awesomerea.org/resources/nyxstone/index.md): Tool · Nyxstone assembles and disassembles code with the LLVM libraries already shipped by Linux distributions, Homebrew, and apt.llvm.org. The core is C++, with Rust and Python bindings. It covers the architectures in the linked LLVM, including x86, ARM, AArch64, MIPS, and RISC-V. The assembler accepts labels and reports relocations for external symbols. The crates.io and PyPI badges are version 0.1.9. Native builds are documented for Linux and macOS. Windows builds start from a Visual Studio 2022 x64 prompt.
- [Mikage Developer Edition](https://awesomerea.org/resources/mikage-dev/index.md): Tool · Mikage Developer Edition is a Nintendo 3DS emulator. The build is CMake, Conan 2, and Ninja. On Linux the Vulkan libraries come from the system. A first launch needs aes_keys.txt in the build folder and a virtual NAND bootstrapped from a game update. After that, the program runs a .cci or opens the system menu. An embedded GDB server listens on port 12345 when launched with --debug, and a debug console is on port 12347. Profiling uses Tracy.
- [STrace](https://awesomerea.org/resources/strace/index.md): Tool · STrace reimplements the Windows DTrace syscall and ETW probes. The C++ driver is the feature-complete path and loads DLL plugins whose exports run on syscall entry and return. A Rust driver hosts a WebAssembly interpreter as a separate experiment. Example plugins log syscalls and monitor file deletes. The build uses Visual Studio 2022, a matching Windows SDK, and the Windows Driver Kit. install/install_as_admin.ps1 registers the driver. The README says the driver loads only when driver signature enforcement is off for that boot.
- [BinAIVulHunter](https://awesomerea.org/resources/binaivulhunter/index.md): Tool · BinAIVulHunter is an IDA Pro plugin that sends Hex-Rays decompiled functions to OpenAI, Google Gemini, or a local Ollama model and reports possible vulnerabilities. Installation is a Python script copied into the IDA plugins directory. The reviewed context-menu command is Find possible vulnerability in function, and the hotkey listed for that scan is Ctrl+Alt+V. It targets IDA Pro 7.0 or newer and Python 3.6 or newer. A headless mode can scan functions from the command line.
- [pyasmtools](https://awesomerea.org/resources/pyasmtool/index.md): Tool · pyasmtools has a Python bytecode disassembler and a tracer that prints each executed source line with the variables loaded and stored. The README says some of it is specific to CPython. Install with pip3 install pyasmtools. The bytecode notes are in bytecode_disasm.md and the tracer notes are in tracer.md.
- [GameRoy](https://awesomerea.org/resources/gameroy/index.md): Tool · GameRoy is a Rust Game Boy emulator and debugger for the original DMG. It keeps the clock frequency, battery saves, save states, and rewind. The debugger shows disassembly, registers, and video RAM, and can break on read, write, jump, or execution. cargo run --release -p gameroy-native builds the Windows and Linux program. wasm-pack build --target web builds the browser version from the wasm directory. The Android port uses ./gradlew installDebug.
- [chernobog](https://awesomerea.org/resources/chernobog/index.md): Tool · chernobog is a Hex-Rays decompiler plugin for Hikari LLVM obfuscation. The reviewed notes for 6.5 use CoBRA to propose mixed Boolean-arithmetic candidates and Z3 to check the candidate and the emitted microcode or ctree. CHERNOBOG_MBA_BACKEND=legacy keeps the previous generator. A deep-deobfuscation action raises the per-function semantic budget from 1 second to 30 seconds. The plugin also covers opaque predicates, string decryption, and x86 flag and memory models.
- [ProjectorRays](https://awesomerea.org/resources/projectorrays/index.md): Tool · ProjectorRays decompiles Adobe Director and Shockwave movies back to Lingo and editable project files. A DCR or DXR becomes a DIR, and a CCT or CXT becomes a CST. The Windows release is projectorrays-0.2.0.exe. Drag a file or folder onto it, or run projectorrays-0.2.0.exe decompile with an input path. On Unix, make builds it after Boost 1.72.0 or later, mpg123, and zlib are installed. ./projectorrays decompile takes a file or a directory.
- [Mupen64Plus-Next](https://awesomerea.org/resources/mupen64plus-next/index.md): Tool · Mupen64Plus-Next is a Nintendo 64 emulation library for the libretro API and the successor of the older Mupen64Plus libretro core. The repository incorporates mupen64plus, GLideN64, cxd4, parallel-rsp, and the ParaLLEl variant of angrylion-rdp-plus.
- [disasm.pro](https://awesomerea.org/resources/disasm-pro/index.md): Tool · disasm.pro, formerly disasm.ninja, is a multi-architecture assembler and disassembler with line-to-line correlation. A live copy is at disasm.pro. The reviewed architectures are x86 and x86-64, ARMv8, MIPS, SPARC, and PowerPC. It uses a Keystone fork for assembly and Capstone for disassembly. The local server is python3 ninja.py after the Keystone submodule is built with make-share.sh and the Python 3 bindings are installed.
- [ROPMEMU](https://awesomerea.org/resources/ropmemu/index.md): Tool · ROPMEMU analyzes code-reuse attacks from a physical memory dump and reconstructs equivalent code for ordinary reverse-engineering tools. Memory forensics uses Volatility plugins. Emulation and multi-path execution use Unicorn. It then recovers a control-flow graph and applies compiler transformations. The project paper appeared at AsiaCCS 2016. Documentation is on the project wiki.
- [abi-decompiler](https://awesomerea.org/resources/abi-decompiler/index.md): Tool · abi-decompiler recovers names and argument counts for functions in Ethereum bytecode. The current C++ program brute-forces a 4-byte selector against a word list. clang++ -O3 -std=c++11 -pthread builds sig-bruteforcer from sha3.c and sig-bruteforcer.cpp. It takes the hex selector, a path to function names, a thread count, and a maximum argument count, and prints a matching signature such as a name plus its argument types. Word lists come from deployed contracts, a 100,000-word English list, and the ethersplay signature database. The older Python 2 script is marked deprecated.
- [fREedom](https://awesomerea.org/resources/freedom-binnavi/index.md): Tool · fREedom extracts disassembly from executables into the Postgres tables that BinNavi reads, without IDA Pro. It parses PE32, PE32+, and ELF binaries and disassembles x86 and x86-64 with Capstone. The repository includes BinNavi's Postgres setup script. python fREedom.py takes a database name, user, host, and binary path. It needs psycopg2. The README says it does not recover data types or library signatures.
- [EmuDbg](https://awesomerea.org/resources/emudbg/index.md): Tool · EmuDbg debugs a Windows executable by disassembling it with Zydis and emulating its instructions. It steps over Windows API calls instead of emulating those calls. cmake -B build configures a source build, and releases include emudbg.exe. The program takes the executable path, an optional -m module to wait for, and -b software, hardware, or noexec. -r sets a breakpoint at an RVA. -watch_section logs execution moving between named sections.
- [DolRecomp](https://awesomerea.org/resources/dolrecomp/index.md): Tool · DolRecomp statically recompiles GameCube and Wii PowerPC code, with an early Espresso path for Wii U RPX files. It generates C or LLVM. GameCube DOLs use --gamecube. Wii DOLs and REL modules take a six-character title ID. ./dolrecomp extract reads a GameCube ISO, and Wii ISO or WBFS extraction uses Wiimms ISO Tool when needed. cmake -S . -B build builds it. The LLVM backend needs LLVM 19 or 20. Windows builds are tested with MSVC and MinGW. Linux and macOS are supported. Graphics, audio, and input stay in the host program.
- [Py2ExeDecompiler](https://awesomerea.org/resources/py2exe-decompiler/index.md): Tool · Py2ExeDecompiler recovers source from executables built with py2exe. It extracts .pyc files from the executable resources and decompiles them with uncompyle6. The reviewed page covers Python 2.7 through 3.5. Python 3.6 only shows disassembly. The program is a .NET Framework 4.5.2 application. Drag an exe onto Py2ExeDecompiler.exe, or open it from the window.
- [dcc](https://awesomerea.org/resources/dcc-decompiler/index.md): Tool · dcc is Cristina Cifuentes and Mike Van Emmerik's decompiler for DOS executables, with later fixes for memory reallocation during decompilation. The distribution includes the 1994 and 1997 sources, Borland, Microsoft, and Turbo Pascal signature files, and small test executables such as fibo and strlen. Switches include a1 and a2 for assembler listings, i for the interactive disassembler, and o for an assembler output file. If it loads dccxxx.sig, it did not recognise the compiler library. The DCC environment variable points at the signature directory.
- [HRAST](https://awesomerea.org/resources/hrast/index.md): Tool · HRAST is an IDAPython proof of concept for matching and rewriting the Hex-Rays ctree. Load HRAST.py, put pattern tuples in read_patterns.py, and call reLOAD() so the decompiler window picks them up. unLOAD() turns the changes off. The included patterns rename globals and structure fields and replace an inlined strlen on a global. ast_helper.py builds ctree items. The reviewed page points the ctree verifier at IDA 7.1 or newer.
- [Ouroboros](https://awesomerea.org/resources/ouroboros-decompiler/index.md): Tool · Ouroboros is a Rust decompiler that recovers structure with symbolic execution and constraint tracking. It tracks path constraints, register and memory deltas, dominators, and SESE regions, then forms if/else, loops, and early exits. cargo build --release builds it, and cargo run --release opens the egui interface. File, Open accepts a PE32 or PE32+ binary. Press D on the first byte of an instruction to disassemble until a NOP or an invalid instruction, then press F on the function start to decompile it.
- [genmc](https://awesomerea.org/resources/genmc/index.md): Tool · genmc is an IDAPython script and plugin that displays Hex-Rays microcode. Running it as a script adds install_plugin(), which copies the script into IDA's plugins directory. From there the Plugins menu or Ctrl-Shift-M opens it. With the viewer focused, g shows the microcode graph and i shows the graph for the current micro-instruction. It needs IDA and a decompiler at version 7.3 or newer, and the main branch uses Python 3.
- [serum-preset-packager](https://awesomerea.org/resources/serum-preset-packager/index.md): Tool · serum-preset-packager reads and writes Serum 2 preset files using a format the author reverse engineered. Its Python CLI decompresses a preset into editable JSON, packs JSON back into a preset, or opens an edit cycle. The documented container has an XferJson metadata header and a Zstandard-compressed CBOR payload.
- [OpenJOC](https://awesomerea.org/resources/openjoc/index.md): Tool · OpenJOC decodes and inspects E-AC-3 JOC audio bitstreams in Rust. It extracts EMDF and OAMD data, reconstructs carrier-local object signals, renders speaker or binaural audio, and exports reconstructed ADM BWF within a documented profile.
- [Felix](https://awesomerea.org/resources/felix-lynx-debugger/index.md): Tool · Felix is an Atari Lynx emulator with facilities for analysing software running inside it. Its changelog documents disassembly, breakpoints, trace logging, symbol loading from mads .lab files, Lua debugging and memory dumps. The current build instructions target Windows and Visual Studio 2022.
- [aftereffects-aep-parser](https://awesomerea.org/resources/aftereffects-aep-parser/index.md): Tool · aftereffects-aep-parser is a Go library for inspecting Adobe After Effects AEP project files. The author identifies their big-endian RIFX container, provides a Kaitai structure for chunks and composition fields, and describes varying project contents to locate stored values.
- [OpenQBW](https://awesomerea.org/resources/openqbw/index.md): Tool · OpenQBW reverse engineers the QuickBooks Desktop .qbw company-file format and provides a Rust reader, CLI, Python bindings and a format specification. It parses SA17 pages and system catalogs, extracts transaction headers and line items, and exports selected data to SQLite, CSV or IIF while recording undecoded records and uncertain attribution.
- [WinTTD](https://awesomerea.org/resources/winttd/index.md): Tool · WinTTD exposes recovered WinDBG virtual CPU structures and callback layouts for instruction instrumentation. Its C++ taint code reads x86-64 instructions from virtual CPU memory, decodes them with Capstone and passes them to Triton while maintaining per-thread register state.
- [pyhwp](https://awesomerea.org/resources/pyhwp/index.md): Tool · pyhwp parses HWP Document Format v5 files and extracts their internal streams. Its Python source implements document structures and offers experimental conversion to OpenDocument and plain text, based on Hancom's published HWP Binary Specification 1.1.
- [apfs-fuse](https://awesomerea.org/resources/apfs-fuse/index.md): Tool · apfs-fuse examines Apple File System volume structures with apfs-dump and apfs-dump-quick, and mounts APFS volumes through a read-only FUSE driver. The tools expose management structures from drives or images; the driver also handles software-encrypted volumes, Fusion drives, snapshots and DMG files within its stated format limits.
- [Crate Digger](https://awesomerea.org/resources/crate-digger/index.md): Tool · Crate Digger parses rekordbox export databases and track-analysis files with Kaitai Struct definitions and generated Java classes. It also retrieves those files from the nonstandard NFSv2 servers in Pioneer players; its format documentation covers export.pdb, ANLZnnnn.DAT and ANLZnnnn.EXT.
- [MDB Tools](https://awesomerea.org/resources/mdb-tools/index.md): Tool · MDB Tools reads Microsoft Access MDB files and documents the Jet3 and Jet4 file format. Its libraries, command-line utilities and ODBC driver expose tables, schemas, queries and exported data; HACKING.md records page structures, offsets and other format findings.
- [ExtractAltiumSTEPModels](https://awesomerea.org/resources/extract-altium-step-models/index.md): Tool · ExtractAltiumSTEPModels is a Python proof of concept for recovering STEP component models embedded in Altium .PcbDoc PCB project files. It locates model data in the archive's MODELS folder and converts a binary representation into an ASCII STEP file; the repository includes a sample LED model input and output.
- [Rustation PlayStation debugger](https://awesomerea.org/resources/rustation-playstation-debugger/index.md): Tool · Rustation embeds a GDB remote debugger in a Rust PlayStation emulator core for inspecting running game code. A MIPS-targeted GDB session can read registers and memory, disassemble instructions, set code breakpoints and write watchpoints, and single-step execution.
- [Unshield](https://awesomerea.org/resources/unshield/index.md): Tool · Unshield lists and extracts files from InstallShield cabinet files through a C tool and library. Its implementation uses existing extractor source as a reference for the undocumented format and aims to support InstallShield versions 5 and later.
- [XBEpy](https://awesomerea.org/resources/xbepy/index.md): Tool · XBEpy is a Python library for inspecting Microsoft Xbox executable files. It exposes operations to view, extract, and validate data inside XBE files and was written to support unit testing for the XBENext emulator.
- [libagdb](https://awesomerea.org/resources/libagdb/index.md): Tool · libagdb analyzes the Windows SuperFetch database format and provides C library code and tools for accessing it. The repository includes a format document and an information utility; its author describes the library as experimental and unfinished.
- [StringsX64DbgNext](https://awesomerea.org/resources/stringsx64dbg-next/index.md): Tool · StringsX64DbgNext scans the main module of an x64dbg debuggee for printable ANSI and UTF-16LE strings. The C++ plugin supports length and null-termination settings, result filtering, CSV export and navigation to addresses in the debugger.
- [gho](https://awesomerea.org/resources/gho/index.md): Tool · gho reads, extracts, creates and modifies Norton Ghost GHO disk images through a Go library and CLI. Its format documentation maps file and partition records, span handling and compression blocks; the Fast LZ decompressor is described as reverse-engineered from Ghost 11.5.1.
- [tps-parse](https://awesomerea.org/resources/tps-parse/index.md): Tool · tps-parse reads Clarion TPS database files using a Java parser built from reverse-engineered file structures. Its library exposes tables, fields, and records, while a command-line converter exports TPS data to CSV and accepts encrypted files with a password.
- [OpenOrCadParser](https://awesomerea.org/resources/openorcadparser/index.md): Tool · OpenOrCadParser parses Cadence OrCAD Capture binary schematics and symbol libraries with a C++20 library and CLI. It handles DSN and DBK designs and OLB and OBK libraries, can print container trees or extract their streams, and uses OrCAD XML exports to check interpretations of binary fields.
- [xvdtool](https://awesomerea.org/resources/xvdtool/index.md): Tool · xvdtool is a C# command-line utility for inspecting Xbox One XVD and XVC packages. It reports headers, checks integrity, decrypts with supplied keys and extracts embedded data or filesystems; accompanying notes map XVD headers, hash trees and XVC descriptors. The repository also includes an XBFS extractor for Xbox One NAND.
- [MartyPC](https://awesomerea.org/resources/martypc/index.md): Tool · MartyPC emulates early IBM PCs and provides disassembly, CPU and memory inspection, breakpoints, and instruction or cycle-based logging for 8088 programs. Its author reports comparing emulated execution against a physical 8088 and investigating peripheral timings with measurement hardware.
- [ptformat](https://awesomerea.org/resources/ptformat/index.md): Tool · ptformat decrypts and parses Pro Tools session files to extract audio sources, regions and tracks, plus MIDI chunks, regions, tracks and notes. Its C++ tools include ptftool for parsing, ptunxor for decrypted-file inspection, and ptgenmissing for generating placeholder audio scripts.
- [LibreDWG](https://awesomerea.org/resources/libredwg/index.md): Tool · LibreDWG reads and writes AutoCAD DWG documents through a C library and command-line tools. It provides DWG inspection, text search, layer listing and conversion to DXF, JSON, GeoJSON, SVG and PostScript. The project maintains corrections to an ODA DWG specification and records version-specific reader and writer gaps.
- [libsai](https://awesomerea.org/resources/libsai/index.md): Tool · libsai documents and implements access to PaintTool SAI .sai artwork files. Its research describes 4,096-byte encrypted blocks, table entries, checksums and the virtual filesystem that stores layers and metadata; C++ sources and sample programs expose document and thumbnail handling.
- [Hiew](https://awesomerea.org/resources/hiew/index.md): Tool · Hiew edits files in text, hex and disassembler modes and supports x86-64 assembly and disassembly. It recognizes NE, LE, LX, PE/PE32+, little-endian ELF/ELF64 and Mach-O, and TE/TE64 executables, supports navigation through call and jump instructions, and searches by instruction pattern. Hiewix offers similar functions through WinAPI.
- [OpenSKP](https://awesomerea.org/resources/openskp/index.md): Tool · OpenSKP parses, writes, and converts SketchUp SKP files using independently implemented Python, TypeScript, .NET, Dart, and C++ libraries. Its format research covers the VFF container used from 2021 and the older MFC CArchive container, including geometry, materials, components, and layers. It exports models to formats including GLB, OBJ, STL, DXF, IFC4, and JSON.
- [rekordcrate](https://awesomerea.org/resources/rekordcrate/index.md): Tool · rekordcrate is a Rust parser and command-line inspector for Pioneer Rekordbox exports used by CDJ and XDJ players. It reads export.pdb databases, ANLZ .DAT, .EXT and .2EX analysis files, and device and mixer SETTING.DAT files, with debug or JSON output.
- [Dislocker](https://awesomerea.org/resources/dislocker/index.md): Tool · Dislocker inspects and decrypts BitLocker encrypted volumes on Linux and macOS. Its dislocker-bek and dislocker-metadata commands expose key-file and volume metadata, while dislocker-fuse presents a decrypted virtual NTFS partition and dislocker-file writes a decrypted flat file. The documentation covers Windows Vista through 10 volumes and BitLocker-To-Go media.
- [libflp](https://awesomerea.org/resources/libflp/index.md): Tool · libflp is a C++ library for parsing FL Studio .flp project files. It supports automated inspection of project contents, with source files for event parsing and a format note; the author identifies FLP event coverage as incomplete.
- [innodb_ruby](https://awesomerea.org/resources/innodb-ruby/index.md): Tool · innodb_ruby parses InnoDB file formats to expose database storage structures for investigation and teaching. Its Ruby library and tools let users inspect pages, record counts and B+ tree organization, including interactive examination through irb. The author describes its APIs and output as unstable.
- [Hidden Bee IDA loader](https://awesomerea.org/resources/hidden-bee-ida-loader/index.md): Tool · Hidden Bee IDA loader imports the malware family's stripped-down PE-like payload format into IDA for binary analysis. It creates segments, assigns import names and types, and processes relocation information so the database can be rebased. The author also documents examining IDA's pe.dll loader to work out its import and relocation handling.