# Curated reverse engineering resources · Page 40

> Page 40 of 52, entries 3,901–4,000. 5,191 tools, projects, integrations, case studies, and references for websites, games, apps, native binaries, firmware, and communication protocols.

Source-reviewed means descriptions were checked against primary documentation. Each entry page lists the full requirements and sources; this page shows their counts and the review date.

- HTML: <https://awesomerea.org/resources/page/40/>
- JSON: <https://awesomerea.org/api/v1/resources.json>
- 简体中文: <https://awesomerea.org/zh/resources/page/40/index.md>

## Native binaries (76)

- [OpenAllegroParser](https://awesomerea.org/resources/openallegroparser/index.md): Tool · OpenAllegroParser is a C++17 library and CLI for investigating Cadence Allegro binary design files. It parses and prints .pad padstack files and extracts embedded files; XML export is under development. The repository includes format notes and padstack test cases, while listing other Allegro formats as project targets.
- [LogicX Analyzer](https://awesomerea.org/resources/logicx-analyzer/index.md): Tool · LogicX Analyzer inspects Logic Pro .logicx project bundles and studies their undocumented ProjectData binary format. Python scripts map chunk markers, annotate hex dumps, extract plugin and Session Players data, and produce Markdown, JSON, and CSV reports across a folder of projects.
- [FunctionParser](https://awesomerea.org/resources/functionparser-xenonrecomp/index.md): Tool · FunctionParser identifies function ranges in IDA Pro HTML, reads switch-case error addresses from a XenonRecomp log and writes function entries for a XenonRecomp TOML configuration. Its companion configuration references a default.xex input.
- [hyperscan-emulator](https://awesomerea.org/resources/hyperscan-emulator/index.md): Tool · hyperscan-emulator loads a HyperScan firmware image into emulated memory and exposes CPU execution through an interactive debugger. The debugger supports stepping, breakpoints and memory views, while its disassembler prints decoded instructions and register operands.
- [AppleWin](https://awesomerea.org/resources/applewin-symbolic-debugger/index.md): Tool · AppleWin emulates Apple II computers on Windows and includes a symbolic debugger for inspecting running software. Its debugger documentation covers execution control, memory, registers, symbols and breakpoints across supported Apple II models.
- [PyFLP](https://awesomerea.org/resources/pyflp/index.md): Tool · PyFLP parses FL Studio project and preset files in Python. It exposes structures such as arrangements, channels and mixer data from the closed FLP format, with documentation on the format and on editing limits.
- [DownUnderCTF: masked-squares flag checker](https://awesomerea.org/resources/rea-ctf-case/index.md): Case study · An official educational challenge investigation connects binary checks to equations and records an original-program validation.
- [Show Your Work: a measured dissection of REA's evidence architecture](https://awesomerea.org/resources/noflag-rea-evidence-architecture-study/index.md): Case study · An unofficial field study that reads REA's source and then drives the running server through 1,012 recorded calls across 27 artifact classes, measuring its content-addressed Evidence records, revision-chained unknown ledger, typed refusals, cold starts and response limits. The author maps those mechanisms onto vulnerability-research agents as an argument for not overclaiming. It evaluates REA's tool surface.
- [Windows loader: static malware analysis with REA and Codex](https://awesomerea.org/resources/windows-loader-static-analysis-case/index.md): Case study · Fedele Mantuano reports using Codex with REA in an offline Docker lab to statically analyze a public Windows malware sample without executing it. The article separates behavior supported by the extracted JavaScript bundle from claims that would depend on remote components that were never obtained, and reclassifies a suspected infostealer as a loader. It is a defensive static analysis case built on an author-reviewed agent report; reconstruction and dynamic detonation were outside its scope.
- [OpenBSD netcat: static REA and Ghidra investigation](https://awesomerea.org/resources/netcat-openbsd-rea-static-case/index.md): Case study · A REA/Ghidra report studies the Ubuntu netcat-openbsd 1.234-1 ELF binary and publishes evidence envelopes, decompiled functions and a function inventory. Its output is a static investigation, rather than a rebuilt netcat application.
- [Woxi: a Wolfram Language interpreter in Rust](https://awesomerea.org/resources/woxi-case/index.md): Case study · The authors describe Woxi as a Rust interpreter for a subset of the Wolfram Language, focused on CLI scripting and Jupyter notebooks. The README does not claim full Mathematica compatibility.
- [uniswap-v2-reborn: reconstructing Uniswap v2 from deployed bytecode](https://awesomerea.org/resources/uniswap-v2-reborn-case/index.md): Case study · uniswap-v2-reborn reconstructs Uniswap v2 factory, pair and Router02 behavior from deployed EVM runtime bytecode using REA interface inspection, storage probing and written specifications. It provides a TypeScript model, Solidity 0.8 contracts and a differential harness that compares both with the original bytecode; the author reports 4,800 fuzzed operations without mismatches and exact replay of 426 historical swaps.
- [Eidolon in Rust: byte-exact Rust port of the Eidolon 64k intro](https://awesomerea.org/resources/eidolon-64k-rust-port-case/index.md): Case study · Ports Eidolon, Poo-Brain’s winning PC 64k intro from Revision 2017, from its packed 60,928-byte Windows executable to Rust, with chapters on how the original binary works and a separate size-optimized build. The author reports that coordinated OpenCode and Claude Code agents, using Ghidra through the REA MCP server among other tools, captured a controlled-clock reference of the original and matched all 27,000 frame hashes and the full PCM. Exactness rests on the project’s own GPU-specific captures, and the port embeds the original’s data.
- [m0rph: tracing an obfuscated ELF flag checker](https://awesomerea.org/resources/m0rph-ctf-analysis-case/index.md): Case study · The m0rph investigation examines an obfuscated x86-64 ELF CTF flag checker with readelf, strings, Cutter and Radare2. Its write-up traces indirect CALL RAX execution into allocated memory and describes recovering expected characters by breaking at the call and inspecting RDI during each loop iteration.
- [CPQ IO Scheduler: reconstructing Xiaomi's block scheduler](https://awesomerea.org/resources/cpq-iosched-case/index.md): Case study · CPQ IO Scheduler reconstructs Xiaomi's proprietary cpq.ko Linux block scheduler from a stripped ARM64 kernel module. Its out-of-tree C implementation combines priority classes, thread-group queues, deadline handling, and blk-mq elevator integration, with a whitepaper and author-reported benchmarks.
- [Malware Analysis: njRAT and Casdet behavior investigation](https://awesomerea.org/resources/malware-analysis-njrat-casdet-case/index.md): Case study · A malware investigation examines njRAT and a UPX-packed Casdet executable with PEStudio static triage and ANY.RUN sandbox telemetry, alongside a malicious PDF and benign comparison files. The author reports process, registry and network behavior, extracted indicators and MITRE ATT&CK mappings in a report and screenshots.
- [FSR 4 INT8: reconstructed GPU passes and comparison harness](https://awesomerea.org/resources/fsr4-int8-reconstruction-case/index.md): Case study · An FSR 4.1.1 INT8 investigation reconstructs the upscaler’s GPU passes in HLSL and compares their outputs with AMD’s compiled kernels through a D3D12 harness. The author reports byte-identical offline results for the documented passes and supplies an FFX-compatible provider build that obtains network weights from a user-supplied official DLL. Colour-mode paths and live frames have narrower comparison evidence.
- [bcwc_pcie: auditing the FaceTime HD camera driver against Apple's kext](https://awesomerea.org/resources/bcwc-pcie-camera-audit-case/index.md): Case study · bcwc_pcie audits the community FaceTime HD Linux driver against Apple's AppleCameraInterface.kext for Broadcom PCI 14e4:1570 cameras. Its scripts trace MMIO register accesses through the kext and compare offsets, masks and sequencing with the vendored driver; the author reports finding 19 registers the Linux implementation does not cover.
- [XexTool-RE: reconstructing the Xbox 360 XexTool utility](https://awesomerea.org/resources/xextool-re-case/index.md): Case study · XexTool-RE reimplements the closed XexTool utility from analysis of its binary and processes Xbox 360 .xex executables. Its C++ CLI and GUI inspect headers, extract basefiles and resources, convert compression or encryption, and document XEX layout and digest behavior. The author reports byte-identical output for most compared operations, with stated exceptions.
- [slopgs: reconstructing Microsoft GS Wavetable Synth](https://awesomerea.org/resources/slopgs-case/index.md): Case study · slopgs reconstructs the behavior of the Windows XP SP3 Microsoft GS Wavetable Synth driver in a portable C synthesizer. Its engine renders MIDI using gm.dls, with native and WebAssembly builds. MIDI probes and spectrogram comparisons against reference recordings guide refinements to synthesis behavior.
- [Surface Pro 11: reconstructing native Linux audio behavior](https://awesomerea.org/resources/sp11x1e-audio-case/index.md): Case study · SP11X1e-audio reconstructs Surface Pro 11 speaker and internal microphone behavior on Linux from Windows runtime observations and binary analysis. Its patches and AudioReach topology address SoundWire amplifiers, LPASS microphone clocks and capture routing; reproduction scripts rebuild the accepted topology and kernel artifacts.
- [uniq-reconstruction: rebuilding GNU uniq from behavioral probes](https://awesomerea.org/resources/uniq-reconstruction-case/index.md): Case study · uniq-reconstruction rebuilds GNU coreutils 9.7 uniq in C from black-box observations of a stripped ELF executable. The author records 51 probes covering flags, grouping, delimiters and error behavior, then implements argument parsing and stream processing. The author reports that the candidate passed all 43 comparison tests for output, exit code, stderr and file effects.
- [Watcom C 6.5: reconstructing damaged runtime libraries](https://awesomerea.org/resources/watcom-c-6-5-restoration-case/index.md): Case study · Watcom C 6.5 run-time library restoration rebuilds damaged CLIBS.LIB and CLIBC.LIB from surviving archive modules. It maps sector loss, converts modules from intact memory-model libraries, reconstructs selected C routines from machine code and records provenance for each result; the author reports matching every surviving byte used for comparison.
- [IOReport: investigating and decompiling Apple’s reporting library](https://awesomerea.org/resources/ioreport-decompile-case/index.md): Case study · IOReport decompile investigates Apple’s IOReport dylib, which provides calls for reading system reports and counters. The author describes disassembling powermetrics to understand its use of IOReport and provides an incomplete Objective-C reconstruction with a Makefile-built test program.
- [dargh: reconstructing Dynamic Animation Replacer for Skyrim](https://awesomerea.org/resources/dargh-case/index.md): Case study · dargh reconstructs the Dynamic Animation Replacer DLL for Skyrim Special Edition in C++ from analysis of versions 1.1.2 and 1.1.3. Its replacement uses hooks and trampolines for animation replacement and implements condition functions. The author reports apparent operation with Skyrim GOG 1.6.659 after limited testing.
- [ndec-re: reconstructing an MS-DOS encryption program](https://awesomerea.org/resources/ndec-re-case/index.md): Case study · ndec-re investigates an old MS-DOS COM encryption program through debugger-assisted assembly analysis and implements its encryption behavior in Go. The write-up traces the program's copied code, password-derived gamma and hashes, self-modifying instruction choice, initialization byte and mixing rounds. The repository also contains the original COM file and Go tests.
- [re-sysinternals-suite: rebuilding Sysinternals strings.exe](https://awesomerea.org/resources/re-sysinternals-strings-case/index.md): Case study · re-sysinternals-suite records an educational rebuild of the Sysinternals strings.exe executable. Its first episode contains C++ source, comments on the implementation, a Windows XP build patch and a link to a video walkthrough of the reverse-engineering process. The repository documents one rebuilt utility.
- [ExCrypt: reconstructing Xbox 360 XeCrypt functions](https://awesomerea.org/resources/excrypt-case/index.md): Case study · ExCrypt reconstructs Xbox 360 XeCrypt functions as a C and C++ replacement for use with existing console code and data. It aims to match externally visible state and return values for functions exported by the kernel or used during boot and in games or apps.
- [L1J-Encode-CLI: reconstructed Lineage 1 ServerData codec](https://awesomerea.org/resources/l1j-encode-cli-case/index.md): Case study · L1J-Encode-CLI reconstructs the Lineage 1 launcher's ServerData encoding as a Python encoder and decoder for IP addresses, ports, and feature flags. Its report describes disassembly, memory inspection, and differential analysis of Encode v3.63; the author reports byte-for-byte agreement in 106 comparisons with Encode.exe.
- [Wirenet Reverse Engineering: analysing a Linux trojan](https://awesomerea.org/resources/wirenet-analysis-case/index.md): Case study · Wirenet Reverse Engineering investigates the Wirenet Linux trojan through recovered source code and an Italian analysis report. The report covers the malware's workings, while an accompanying article focuses on its keylogger implementation.
- [SNES Station: reconstructing the PS2 emulator executable](https://awesomerea.org/resources/snes-station-decomp-case/index.md): Case study · SNES Station Decompilation reconstructs the PlayStation 2 SNES Station v0.23 WIP executable through source recovery, historical toolchain matching and image comparison. Its analysis covers the emulator core, PS2 runtime, renderer and SJCRUNCH container. The author reports a byte-identical rebuilt packed ELF against a user-supplied reference.
- [RFL: decompiling the Wii Mii library](https://awesomerea.org/resources/rfl-wii-mii-library-case/index.md): Case study · RFL reconstructs the Wii library responsible for handling Miis from an original game image. The build targets the 20080306 version from Challenge Me: Word Puzzles, and objdiff compares built objects; the author reports matching release builds and two unmatched debug functions.
- [cod4map: reconstructing the Call of Duty 4 BSP compiler](https://awesomerea.org/resources/cod4map-reconstruction-case/index.md): Case study · cod4map reconstructs the BSP compiler shipped with the 2007 Call of Duty 4 mod tools from its executable. Its C and C++ source builds a 32-bit Windows cod4map.exe; the project uses x87-oriented compiler flags because SSE2 floating-point generation changes BSP output bytes.
- [AGS Aging Cartridge: disassembling version 7.0](https://awesomerea.org/resources/ags-aging-cartridge-case/index.md): Case study · The project reconstructs AGS Aging Cartridge 7.0 from a user-supplied Game Boy Advance ROM as assembly and C source. Its build targets an aging.gba image with a published SHA-1 and uses devkitARM and pokeruby-tools.
- [GoonFi V2: byte-identical Rust recompilation of a Solana program](https://awesomerea.org/resources/goonfi-v2-rust-recompilation-case/index.md): Case study · OtterSec researchers describe an agent pipeline that reconstructed Rust source for the closed-source GoonFi V2 Solana program until a rebuild with the original toolchain reproduced the deployed ELF. Per-function instruction scoring, a deterministic merge judge and bans on assembly and other score-gaming constructs steered the agents; matching function order and panic-location paths closed the last differences. The article and a companion repository document the method and a verification script, while the internal tooling and agent transcripts remain unpublished.
- [HyperCard 1.2.2: a static recompilation of the classic Mac app](https://awesomerea.org/resources/hypercard-122-recomp-case/index.md): Case study · Statically recompiles HyperCard 1.2.2, a classic Mac application. The user supplies the file named HyperCard; tools/corpus.json records 2642 covered call sites out of 3166, and tools/conformance.py fails if that count drops.
- [openbst: a C reimplementation of BeSTspeech](https://awesomerea.org/resources/openbst-bestspeech-case/index.md): Case study · A from-scratch C reimplementation of the Berkeley Speech Technologies formant synthesizer sold as BeSTspeech and shipped in HumanWare Keynote GOLD. The original binaries are the comparison input and are not in the repository; make selftest checks tests/golden.txt, and make test compares the engine with those binaries.
- [OpenTV: a portable C rebuild of Centigram TruVoice](https://awesomerea.org/resources/opentv-truvoice-case/index.md): Case study · Rebuilds Centigram TruVoice, the 1997 text-to-speech engine, as portable C. tools/difftest.py compares PCM from the C build with the original DLL across the corpus checked in that script.
- [L&H TruVoice: a portable C rebuild of tv_enua.dll](https://awesomerea.org/resources/lh-truvoice-decomp-case/index.md): Case study · Rebuilds Lernout & Hauspie TruVoice 6.00 build 10, the SAPI 4 American English engine in tv_enua.dll, as C99. The port reads that DLL's tables at run time and checks PCM against the running engine.
- [Microsoft Anna: a bit-exact C rebuild of the TTS20 engine](https://awesomerea.org/resources/ms-anna-tts-case/index.md): Case study · Rebuilds Microsoft Anna, the Windows Vista and Windows 7 TTS20 voice, as C99 that reads the original voice data files. The README reports bit-exact PCM against the real engine on its test lines.
- [OneCore TTS: a C rebuild of David, Zira and Mark](https://awesomerea.org/resources/onecore-david-zira-mark-case/index.md): Case study · Rebuilds the Windows OneCore text-to-speech engine MSTTSEngine_OneCore.dll 10.3, the David, Zira, and Mark voices, as C99 that reads the original voice files. The README reports sample-for-sample PCM on its corpus, with two Zira lines excepted.
- [Microsoft Sam: a portable C rebuild of the SAPI 5 engine](https://awesomerea.org/resources/ms-sam-mike-mary-case/index.md): Case study · Rebuilds the Windows XP SAPI 5 engine spttseng.dll for Microsoft Sam, Mike, and Mary as C99 that reads the original voice files. The README reports audio of the same length with every sample within ±1 LSB of the 16-bit engine.
- [Eloquence 6.1: a C rebuild of ECI.DLL](https://awesomerea.org/resources/eloquence-61-eci-case/index.md): Case study · Rebuilds ETI Eloquence 6.1.0.2, the US English ECI.DLL plus ENU.SYN, as C with a drop-in ECI.DLL for x86 and x64. This is KamiKitsune420/eloquence-decomp, a different tree from Mudb0y/openevv.
- [Prose 2000 Reborn: a C decompilation of the speech board](https://awesomerea.org/resources/prose2000-reborn-case/index.md): Case study · Decompiles the Speech Plus and Telesensory Systems Prose 2000 text-to-speech firmware, an 8086 host plus an NEC uPD7720 DSP, into C. The README says the build does not need an emulator or ROM files.
- [GEOS 2.0: source that rebuilds the cbmfiles KERNAL binaries](https://awesomerea.org/resources/geos-20-kernal-case/index.md): Case study · Reorganized cc65 source for GEOS 2.0 on the Commodore 64 and 128. The README says a standard compile generates binaries identical to the GEOS 64 2.0 and GEOS 128 2.0 distribution binaries, and make regress compares the bsw and wheels builds with the reference tree.
- [geoWrite 2.1: source that rebuilds the original binaries](https://awesomerea.org/resources/geowrite-21-case/index.md): Case study · Reverse-engineered cc65 source for geoWrite 2.1, the GEOS word processor, in English and German. The README says a standard compile generates binaries identical to the English and German geoWrite 2.1 distribution binaries. The orig tree holds the collected original versions.
- [libmd12: a C model of the E-mu SP-1200 and SP-12 audio path](https://awesomerea.org/resources/libmd12-sp1200-case/index.md): Case study · A C99 library of the E-mu SP-1200 and SP-12 sampler audio path: pitch playback, filters, and the dynamic filter. The README says firmware behavior comes from running E-mu's operating-system code in a Z80 emulator, and make check runs the shipped suite.
- [reAL: a dsound.dll checked against Windows and ALchemy](https://awesomerea.org/resources/real-dsound-case/index.md): Case study · A drop-in dsound.dll that reimplements Creative ALchemy and DirectSound behavior, including DirectMusic pieces the README names. ./build.sh builds the DLL and runs the native unit tests. The README says comparisons with Microsoft's DLLs are line-by-line and event-by-event.
- [Konami's Game Master: a matching MSX utility-cartridge disassembly](https://awesomerea.org/resources/konamis-game-master-disassembly-case/index.md): Case study · Konami's Game Master reconstructs the Japanese RC-735 MSX utility cartridge as annotated assembly. The cartridge adds save and load functions, cheats and rankings to other Konami MSX1 games. The author reports that sjasmplus assembles the source into a bit-perfect copy of the original 16 KB ROM.
- [dolnetbp: reconstructing GameCube network SDK libraries](https://awesomerea.org/resources/dolnetbp-case/index.md): Case study · dolnetbp reconstructs the GameCube Dolphin Network Base Package eth, mdm and netcfg libraries in C. Its objdiff configuration pairs release and debug build outputs with original library objects for comparison.
- [Dolphin SDK 2004 Libraries: decompiling GameCube SDK archives](https://awesomerea.org/resources/dolphin-sdk-2004-libraries-case/index.md): Case study · Dolphin SDK 2004 Libraries reconstructs the built code libraries of the April 20, 2004 Dolphin SDK as C and assembly sources. Its build process extracts the user's .a archives with DTK and builds the supported libraries; the project reports several libraries still in progress.
- [dolsocketlibrary: reconstructing Dolphin networking libraries](https://awesomerea.org/resources/dolsocketlibrary-case/index.md): Case study · dolsocketlibrary reconstructs the Dolphin Network Base Package ip and dvdeth libraries in C. Its build configuration generates Ninja and objdiff inputs for comparing release and debug objects with the original GameCube library objects.
- [open_rvl: decompiling the Wii SDK used in Wii Sports](https://awesomerea.org/resources/open-rvl-sdk-case/index.md): Case study · open_rvl reconstructs the Wii SDK version found in Wii Sports as C source for reuse in game decompilations. It draws names from game debugging information and uses SHA-256 records generated from assembly or object files to check selected functions and data.
- [NW Eft: decompiling the Wii U NintendoWare Eft library](https://awesomerea.org/resources/nw4f-eft-decomp-case/index.md): Case study · NW Eft decompiles the NintendoWare for Cafe Eft library found in the Wii U game New Super Mario Bros. U. Its C++ source and headers cover emitters, rendering and related library components. Exact byte matching is outside the project's current priority.
- [libgpu2: reconstructing a PlayStation 2 Graphics Synthesizer model](https://awesomerea.org/resources/libgpu2-reconstruction-case/index.md): Case study · libgpu2 reconstructs Sony's 1998 PlayStation 2 Graphics Synthesizer software model from 23 ELF32/i386 objects as buildable C++. The project documents the recovered pipeline and compares VRAM output from replayed graphics streams with the original model and PS2 hardware. The author reports bit-identical output to the original model on its dump corpus.
- [re_nfpii: reimplementing the Wii U amiibo library](https://awesomerea.org/resources/re-nfpii-wii-u-library-case/index.md): Case study · re_nfpii reimplements the Wii U nn_nfp.rpl library for amiibo emulation and research. Its module replaces the library's exports and redirects tag reads and writes to SD-card dumps, while a companion plugin provides selection and configuration. The author describes the work as experimental and says it currently covers the major parts of the library.
- [MWCC: reconstructing the GameCube CodeWarrior compiler](https://awesomerea.org/resources/mwcc-decomp-case/index.md): Case study · MWCC reconstructs six Windows x86 versions of the GameCube CodeWarrior compiler mwcceppc.exe. It maintains C and C++ source for the driver, frontend, optimizer and backend, then compares rebuilt objects, functions or executable hashes with the original version according to each build configuration.
- [GA330-libretro: reconstructing the Gemei A330 runtime](https://awesomerea.org/resources/ga330-libretro-case/index.md): Case study · GA330-libretro reconstructs the Gemei A330 runtime as a libretro core using Unicorn to execute ARM application binaries. A minimal replacement OS loads programs and supplies file, input, and timing handlers; the author reports that 7days reaches gameplay.
- [linker_pc: reconstructing the Call of Duty 4 fastfile linker](https://awesomerea.org/resources/call-of-duty-4-linker-pc-case/index.md): Case study · linker_pc reconstructs the fastfile linker distributed with the Call of Duty 4 mod tools from its shipped 2008 executable. The recovered source builds a 32-bit Windows tool that reads zone CSV files and writes .ff fastfiles, using specified MSVC flags to preserve x87 floating-point behavior.
- [EGG Library: shared-source Wii library decompilation](https://awesomerea.org/resources/egg-wii-library-decomp-case/index.md): Case study · EGG Library is a work-in-progress decompilation of a Wii software library, aiming to share one source set across multiple games and applications. Users supply a supported game's disc image, build with Ninja and compare generated objects through objdiff.
- [NitroSDK: reconstructing Nintendo DS library source from game ROMs](https://awesomerea.org/resources/nitrosdk-decompilation-case/index.md): Case study · NitroSDK Decompilation reconstructs Nintendo DS SDK library source from code extracted from supported game ROMs. It organizes C source, headers and symbol maps around an objdiff workflow and uses stable identifiers to track functions shared across games.
- [Hagi: decompiling the Super Mario 3D All-Stars emulator](https://awesomerea.org/resources/hagi-emulator-decomp-case/index.md): Case study · Hagi decompiles the GameCube and Wii emulator executable included with Super Mario Sunshine in Super Mario 3D All-Stars version 1.0.0. Its build workflow starts from the user's original main NSO and uses CMake, Ninja, Python and a Rust toolchain.
- [Character Pipeline: April 2001 library decompilation](https://awesomerea.org/resources/character-pipeline-apr2001-decomp-case/index.md): Case study · Character Pipeline April 2001 Libraries reconstructs C source for the component's built code libraries. It covers actor, animation, control, geometry palette, lighting, shader and skinning libraries; make extract uses DTK to disassemble user-provided .a archives into source files.
- [8088 BIOS: disassembling Tandy and IBM PC firmware images](https://awesomerea.org/resources/bios-8088/index.md): Case study · This repository disassembles BIOS images from 8088 machines: the Tandy 1000, Tandy 1000A, Tandy 1000 HX, IBM PCjr, and IBM PC 5150. The README says the original images are in roms/ and the disassembly is in the subfolders, made with IDA Pro freeware.
- [lv0pen: matching source for the PlayStation 3 boot chain](https://awesomerea.org/resources/lv0pen/index.md): Case study · lv0pen rebuilds PlayStation 3 boot-chain programs and isolated SPU modules with the original compilers. The table lists lv0 4.93 at 100 percent, bootldr 1.0.0 at 458 of 458, metldr at 182 of 182, isoldr 4.93 at 273 of 273, and appldr 4.93 at 446 of 446. lv0ldr.2 3.6.5 is 472 of 474, and lv1ldr 4.93 is 293 of 300. Build steps are in BUILDING.md.
- [Forecast Channel: decompiling the Wii weather app](https://awesomerea.org/resources/forecast-channel/index.md): Case study · This decompiles the Wii Forecast Channel, version HAFE v7, USA/NTSC. The WAD is copied to orig/HAFE. python configure.py accepts --version for a version other than HAFE. ninja builds the project, and objdiff.json is written after the first successful build. Linux and macOS download wibo.
- [Xbox 360 kernel: decompiling version 17489.0](https://awesomerea.org/resources/xkrnl-decomp/index.md): Case study · This is a work-in-progress decompilation of the Xbox 360 kernel, file set 21256.18_D, kernel version 17489.0. xboxkrnld.exe has SHA-1 a303e3404e8dd0b9e9defd38aa6c37e04eb19101. xboxkrnld.pdb has SHA-1 625c54f4f273c66fd7a08e8b2ff7d1167983eeba. The image goes in orig/21256.18_D. python configure.py and ninja build it. objdiff.json appears after the first successful build.
- [PICOLOVE: reimplementing the PICO-8 API in LÖVE](https://awesomerea.org/resources/picolove/index.md): Case study · PICOLOVE implements the PICO-8 API in LÖVE so PICO-8 carts can run as LÖVE programs. The default runtime is LÖVE 11.5, and 0.10.2 and 0.9.2 are also listed. make builds it, make dev reloads in a loop, and make test runs the checks. Cartridge versions above 8 are not implemented, and the runtime uses floating-point numbers rather than PICO-8 fixed point.
- [DLSS 5 Neural Rendering: reconstructing a runtime model from DLL analysis](https://awesomerea.org/resources/dlss5-nr-reverse-engineering-case/index.md): Case study · DLSS 5 Neural Rendering reconstructs parts of NVIDIA's model from static analysis of nvngx_dlssnr.dll 310.8.0.0 shipped with NBA 2K27. It documents a 153-record weight container, a 71-block Swin/ViT structure and numerical references for selected operators. The author reports byte-for-byte agreement for one FFN operator across 24 comparisons.
- [linux-apfs-rw: reconstructing APFS support in a Linux kernel module](https://awesomerea.org/resources/linux-apfs-rw-case/index.md): Case study · linux-apfs-rw reconstructs support for Apple's APFS filesystem in a Linux kernel module using reverse-engineered format knowledge and an incomplete official specification. It mounts APFS volumes read-only by default and offers experimental writes, snapshot mounting and metadata checksum checking.
- [Decompile-Bench](https://awesomerea.org/resources/decompile-bench-dataset/index.md): Project · A dataset of binary-source function pairs published for the LLM4Decompile project. The dataset card says it holds two million pairs condensed from 100 million collected pairs, including C and C++ source, and that the binaries were compiled from permissively licensed GitHub projects.
- [Ghidra Function ID dataset repository](https://awesomerea.org/resources/ghidra-fidb-repo/index.md): Project · This repository holds Ghidra Function ID datasets generated with ghidra-fid-generator from a manual selection of libraries. The README lists packed .fidb files for CentOS 6 and 7 static libraries, Ubuntu and GCC builds, libsodium, Qt 5, SDL, and several OpenSSL builds.
- [BinaryAudit](https://awesomerea.org/resources/binaryaudit/index.md): Project · BinaryAudit is a benchmark of AI agents looking for backdoors in compiled binaries of open-source software. Agents receive stripped binaries and Ghidra or Radare2 inside Docker. The task set covers lighttpd, dnsmasq, Dropbear, Sozu, and Caddy, including clean binaries and timebomb tasks. The README says the backdoors were artificially injected.
- [Zakuro](https://awesomerea.org/resources/zakuro/index.md): Project · Zakuro is a high-level Nintendo 3DS emulator written in Rust. Instead of a JIT, it runs code recompiled ahead of time by 3dsrecomp. The README says tested games run at full speed that way, and below full speed on the interpreter alone. Releases exist for Windows, Linux, and macOS.
- [Luxon Server](https://awesomerea.org/resources/luxon-server/index.md): Project · Luxon Server is a clean-room implementation of the Photon Realtime server. It sits on the Luxon project, which reimplements the ENet protocol and Photon's binary serialization. The aim is a drop-in server for multiplayer games that use Photon without complex server-side plugins.
- [FreeVGUI](https://awesomerea.org/resources/freevgui/index.md): Project · FreeVGUI reimplements the Half-Life 1 VGUI library. It is written to match the original public API and, optionally, the private API. The current build path is as a subproject of Xash3D FWGS. The README says it shares no code with the original library.

## Firmware and hardware (24)

- [Binwalk](https://awesomerea.org/resources/binwalk/index.md): Tool · Identifies embedded formats and optionally extracts their contents, with entropy analysis for firmware triage.
- [unblob](https://awesomerea.org/resources/unblob/index.md): Tool · Recursively extracts archives and filesystems from binary blobs while reporting chunk boundaries and unknown regions.
- [Ghidra Firmware Utilities](https://awesomerea.org/resources/ghidra-firmware-utils/index.md): Tool · Ghidra loaders and helpers for PCI option ROMs, UEFI firmware volumes, Intel flash descriptors and coreboot images.
- [EMBA](https://awesomerea.org/resources/emba/index.md): Tool · Extract firmware, combine static checks with emulation-based analysis, inventory software components, and generate web reports and SBOMs for further investigation.
- [Firmware Analysis and Comparison Tool (FACT)](https://awesomerea.org/resources/fact-core/index.md): Tool · Unpack and analyze firmware through an extensible platform whose web interface and HTTP API make component contents and analysis results searchable and comparable across samples.
- [OFRAK](https://awesomerea.org/resources/ofrak/index.md): Tool · Recursively identify, unpack, analyze, modify, and repack firmware and binary formats using a resource-tree GUI and Python API, with optional disassembler backends.
- [FirmAE](https://awesomerea.org/resources/firmae/index.md): Tool · Emulate router and IP-camera firmware to inspect network services and runtime behavior, with automated emulation checks and separate analysis, run, and debugging modes.
- [PulseView](https://awesomerea.org/resources/pulseview/index.md): Tool · Examine captured logic and analog waveforms with sigrok's graphical frontend. Protocol decoders and decoder stacking expose bus messages and higher-level device operations, making hardware communication traces useful for firmware and interoperability investigations.
- [UEFITool](https://awesomerea.org/resources/uefitool/index.md): Tool · Parse UEFI firmware images into an inspectable tree and check their structure. Companion UEFIExtract and UEFIFind tools extract parsed contents and locate patterns, supporting analysis of firmware components and vendor formats.
- [Glasgow Interface Explorer](https://awesomerea.org/resources/glasgow-interface-explorer/index.md): Tool · Use FPGA-based open hardware and Python applets to read and write SPI flash, I2C EEPROM and parallel memory chips, determine JTAG pinouts, debug supported processors and analyze UART, SPI and QSPI transactions on physical devices.
- [Penguin](https://awesomerea.org/resources/penguin/index.md): Tool · Rehost embedded Linux firmware from an extracted root filesystem using a generated, editable configuration of emulation transformations, then refine it through a guest root shell, forwarded network services and recorded dynamic-analysis output.
- [ipsw](https://awesomerea.org/resources/ipsw/index.md): Tool · Command-line toolkit for Apple firmware research and reverse engineering. It downloads and unpacks IPSWs, OTAs and KDKs and compares builds; inspects Mach-O load commands, symbols, signatures and entitlements with ARM64 disassembly; finds symbols and cross-references in dyld shared caches, extracts dylibs and dumps Objective-C headers and Swift metadata; extracts KEXTs and compares kernelcaches; and parses IMG4, decrypts AEA archives and inspects iBoot and coprocessor firmware.
- [avatar²](https://awesomerea.org/resources/avatar2/index.md): Tool · Python framework from EURECOM's S3 group that orchestrates emulators, debuggers and physical devices for dynamic analysis of embedded firmware. An analysis script declares targets, such as a modified QEMU, PANDA, Unicorn, a gdbserver or an OpenOCD or J-Link debug probe, then a memory layout whose ranges can forward accesses from one target to another, and an execution plan. Execution and register or memory state can move between targets, so firmware can run in an emulator while its peripheral accesses go to the real device.
- [efiXplorer](https://awesomerea.org/resources/efixplorer/index.md): Tool · IDA Pro plugin and loader that automate static analysis of UEFI firmware. The plugin annotates Boot, Runtime, SMM and PEI service calls, lists the EFI protocols and known GUIDs a module installs or consumes, applies protocol interface types in the Hex-Rays decompiler, flags suspected SMM callout and GetVariable out-of-bounds write patterns for review and saves a JSON report. The efiXloader module opens a whole firmware image in one IDA database, with driver entry points, navigation between drivers and a DXE driver dependency graph.
- [vmlinux-to-elf](https://awesomerea.org/resources/vmlinux-to-elf/index.md): Tool · Rebuild an analyzable ELF with function and variable symbols from a Linux kernel image, whether a raw or compressed vmlinux, vmlinuz, zImage or bzImage blob, certain Android boot.img files or a stripped kernel ELF, by locating and decoding the embedded kallsyms symbol table. It detects the compression format, instruction set, endianness, word size, entry point and an approximate base address and writes an ELF for IDA Pro or Ghidra; a kallsyms-finder listing, a standalone decompressor and a GTK GUI are included.
- [Sony-PMCA-RE](https://awesomerea.org/resources/sony-pmca-re/index.md): Tool · USB tool built from reverse engineering Sony digital cameras. On supported models it reads camera information and installs Android apps through the PlayMemories Camera Apps mechanism, while its firmware-updater and service-mode shells can dump firmware, run Linux commands and change settings. The repository's notes describe the app-installation exchange between the Sony app store, the browser plugin and the camera.
- [cpu_rec](https://awesomerea.org/resources/cpu-rec/index.md): Tool · Statistically recognize the CPU instruction set in an arbitrary binary file, such as an unknown firmware image, by comparing Markov-chain byte statistics with a default corpus covering dozens of architectures, from 6502 and 8051 to ARM, MIPS, PowerPC, RISC-V, x86-64 and WebAssembly. It reports a match for the whole file, then the largest chunk that matches one architecture, and shows entropy so that encrypted or compressed regions can be discounted. It runs standalone, as a Python function or as a binwalk module.
- [ME Analyzer](https://awesomerea.org/resources/me-analyzer/index.md): Tool · Parse Intel Management Engine (CS)ME, TXE and SPS firmware, Graphics System Controller firmware and their independent PMC, PCHC, PHY and option-ROM images to report family, version, release, SKU, platform, size and health status. Research options print flash partition, BPDT/IFWI and CSE layout tables, validate RSA signatures and checksums, and unpack the supported CSE and GSC code and file systems. A bundled database identifies known images and reports those not yet listed in the community firmware repositories.
- [CHIPSEC](https://awesomerea.org/resources/chipsec/index.md): Tool · Platform security assessment framework, with Intel Corporation copyright notices, for analyzing PC hardware configuration, BIOS/UEFI system firmware and platform components from Windows, Linux or the UEFI shell. chipsec_main runs check modules that report whether expected protections are in place, such as BIOS and SPI flash write protection and locks, SMM and SMRR protection, memory-map locks and Secure Boot variables, as PASSED, FAILED, WARNING or informational results with JSON, XML and Markdown output. chipsec_util gives command-line and Python access to low-level interfaces and firmware data, including dumping the SPI flash to an image, decoding flash images into firmware volumes, files and NVRAM variables, and listing UEFI variables and tables.
- [binbloom](https://awesomerea.org/resources/binbloom/index.md): Tool · Quarkslab command-line tool that infers basic properties of a headerless raw firmware image from simple statistics on its content, which is why the README says it works with any architecture. It guesses endianness from how the high bytes of pointer-sized values cluster under each byte order, and ranks candidate loading (base) addresses by how many values would then point at indexed text strings and pointer arrays. Given a base address, it also searches automotive ECU firmware for a table of Unified Diagnostic Services (UDS) command IDs and prints the inferred structure layout for use in a disassembler.
- [m1n1](https://awesomerea.org/resources/m1n1/index.md): Tool · Asahi Linux's bootloader and hardware-research environment for Apple Silicon Macs. It bridges Apple's boot chain to Linux by loading appended device trees, initramfs and kernels; in proxy mode a USB link lets a Python client probe hardware live and run macOS or Linux under m1n1's hypervisor while tracing its hardware accesses.
- [SVD-Loader for Ghidra](https://awesomerea.org/resources/svd-loader-ghidra/index.md): Tool · Ghidra script from leveldown security that reads a CMSIS-SVD file, the XML format describing a microcontroller's memory-mapped peripherals and their registers, and applies it to firmware already loaded in Ghidra. It creates memory blocks for the peripheral address ranges, a structure type for each peripheral with its registers as fields, and a label at each peripheral base address, so register accesses can be read by peripheral and register name. It targets little-endian Arm Cortex-M devices and bundles a fork of the cmsis-svd parser ported to Ghidra's Jython.
- [UEFI Firmware Parser](https://awesomerea.org/resources/uefi-firmware-parser/index.md): Tool · Python library and uefi-firmware-parser command for identifying, parsing and extracting PC firmware images: UEFI firmware volumes, capsules, firmware file systems, files and sections, Intel PCH flash descriptors, Intel ME modules and Dell PFS update packages. An AutoParser picks the format, or a brute-force scan looks for volumes and other known objects inside an unidentified blob; results print as an object hierarchy or dump to files, with Tiano/EFI and LZMA sections decompressed by a bundled C extension. Helper scripts replace a section or file by GUID inside a volume, generate an FDF flash description from parsed volumes and output GUID labels for IDA scripts.
- [ESP32 Bit Pirate](https://awesomerea.org/resources/esp32-bit-pirate/index.md): Tool · Open-source firmware that turns ESP32-S3 boards into a Bus Pirate-inspired multi-protocol hardware tool, operated from a USB serial terminal, a Wi-Fi web CLI or the M5 Cardputer's own keyboard and screen. Its modes talk to, sniff and script I2C, SPI, UART, 1-Wire, CAN and other buses, read EEPROM and flash chips, and scan for JTAG and SWD pinouts. USB adapter modes let host tools such as flashrom, OpenOCD and sigrok/PulseView use the board as an SPI programmer, debug adapter or logic analyzer.