# Curated reverse engineering resources · Page 43

> Page 43 of 52, entries 4,201–4,300. 5,191 tools, projects, integrations, case studies, and references for websites, games, apps, native binaries, firmware, and communication protocols.

Source-reviewed means descriptions were checked against primary documentation. Each entry page lists the full requirements and sources; this page shows their counts and the review date.

- HTML: <https://awesomerea.org/resources/page/43/>
- JSON: <https://awesomerea.org/api/v1/resources.json>
- 简体中文: <https://awesomerea.org/zh/resources/page/43/index.md>

## Firmware and hardware (36)

- [Nuked MD: reconstructing the Sega Mega Drive chipset](https://awesomerea.org/resources/nuked-md-case/index.md): Case study · Nuked MD reconstructs Sega Mega Drive chipset behavior in C using decapped chip photographs. Its current combination targets an NMOS 68000, NMOS Z80 and FC1004, with separate implementations for video, audio, arbitration, I/O and cartridge handling.
- [NC2000/1020Emu: Wenquxing device emulation](https://awesomerea.org/resources/nc2000-1020emu-case/index.md): Case study · NC2000/1020Emu reconstructs the hardware environment needed to run firmware dumped from Wenquxing NC2000, NC2600 and NC1020 portable computers. Its C++ code models a 6502 SoC, memory mapping, NOR and NAND flash, LCD, sound, keyboard and serial or infrared communication.
- [m-bootloader: reconstructing JieLi synthesizer boot and flash interfaces](https://awesomerea.org/resources/m-bootloader-case/index.md): Case study · m-bootloader reconstructs the boot and flash interfaces of the M-VAVE FM-1 and SMK-37 Pro/Elite synthesizers built around the JieLi AC791N chip. Its specification covers boot stages, SPI flash formats, retained-RAM handovers and the USB flash-loader command protocol. The C and pi32v2 assembly implementation provides a replacement bootloader, recovery menu and RAM flash loader for M-Flasher.
- [CEN64: register-transfer-level Nintendo 64 emulation](https://awesomerea.org/resources/cen64-nintendo-64-emulation-case/index.md): Case study · CEN64 emulates Nintendo 64 hardware and aims to model it down to register-transfer level. It runs big-endian .z64 ROMs with PIF data, supports 64DD disk images and provides a GDB connection for debugging emulated programs.
- [Orbital: reconstructing PlayStation 4 hardware for virtualization](https://awesomerea.org/resources/orbital-ps4-reconstruction-case/index.md): Case study · Orbital reconstructs PlayStation 4 hardware in a virtualization-based emulator intended to boot decrypted console kernels. Its C++ source models components including Aeolia controllers and Liverpool graphics hardware, while hardware and kernel notes record device IDs, registers and kernel interfaces.
- [TamaLIB: emulating first-generation Tamagotchi firmware](https://awesomerea.org/resources/tamalib-tamagotchi-case/index.md): Case study · TamaLIB emulates first-generation Tamagotchi devices built around Epson E0C6S46 and E0C6S48 microcontrollers, allowing their program ROMs to run on other hardware. A host implements its hardware abstraction layer for buttons, timing, audio and the 32×16 display.
- [Quansheng UV-K5 Hardware Reverse Engineering Project: V1.4 radio PCB reconstruction](https://awesomerea.org/resources/quansheng-uv-k5-hardware-case/index.md): Case study · The Quansheng UV-K5 Hardware Reverse Engineering Project reconstructs the radio's V1.4 PCB as KiCad schematic and board files. The author describes measuring removed components, photographing and sanding the board to expose inner layers, and aligning those images while tracing connections.
- [orsala_hack: reconstructing IKEA ORSALA lamp controls](https://awesomerea.org/resources/orsala-hack-case/index.md): Case study · orsala_hack reconstructs the control behavior of the IKEA ORSALA lamp in replacement STM8 firmware. It documents the original rotary-encoder actions, MCU and LED-driver connections, and changes brightness, color-temperature and power controls while saving settings to EEPROM.
- [stf-sharc: reconstructing Sega Model 2 SHARC microcode](https://awesomerea.org/resources/stf-sharc-case/index.md): Case study · stf-sharc reconstructs and annotates the two ADSP-21062 microcode images used by Sega Model 2 hardware. The assembly documents COP math commands, GEO display-list commands and FIFO exchanges; the author reports that both images reassemble byte for byte to the ROM.
- [F3DEX2: matching disassemblies of Nintendo 64 RSP microcode](https://awesomerea.org/resources/f3dex2-disasm/index.md): Case study · F3DEX2 is a set of matching disassemblies of the Nintendo 64 F3DEX2 and F3DZEX2 RSP microcode family. Matched examples include F3DEX2 2.04 through 2.08H and F3DZEX2 2.06H, 2.08I, and 2.08J, in fifo, xbus, and No Nearclipping variants.
- [B3603: reconstructing control-board behavior for replacement firmware](https://awesomerea.org/resources/b3603-case/index.md): Case study · B3603 investigates the buck converter's control board to support replacement STM8 firmware. The project maps MCU pins, display drivers and voltage and current control signals, includes board schematics, and provides firmware that the author reports is operational and serially controllable.
- [SmartClock-OSS: rebuilding SD Pro Smart Weather Clock firmware](https://awesomerea.org/resources/smartclock-oss-case/index.md): Case study · SmartClock-OSS rebuilds firmware for the SD Pro Smart Weather Clock after analysis of its stock image and flash layout. The ESP8266 firmware provides seven clock faces, Open-Meteo weather, a local settings page, and recovery through power cycling; the repository records hardware observations and installation results.
- [Radtel RT-890: reimplementing radio firmware v1.34](https://awesomerea.org/resources/radtel-rt-890-firmware-case/index.md): Case study · The Radtel RT-890 project reimplements version 1.34 of the radio's firmware as C source to study device behavior. Its tree contains application logic, radio and peripheral drivers, board support and startup code, while the author notes that some variables and functions remain unidentified.
- [Macrosilicon Custom Firmware: rebuilding USB video chip EEPROM firmware](https://awesomerea.org/resources/macrosilicon-custom-firmware-case/index.md): Case study · Macrosilicon Custom Firmware studies the 8051 mask ROM and EEPROM loading behavior of MS2107, MS2109 and MS9123 USB video chips, then builds replacement EEPROM images. Its chip notes map hooks, headers and memory addresses; host tools dump device memory and access new HID mailbox commands for status, GPIO and I2C.
- [Obliteration: reconstructing the PlayStation 4 kernel](https://awesomerea.org/resources/obliteration-case/index.md): Case study · Obliteration reconstructs the PlayStation 4 kernel in Rust for a custom virtualization stack intended to run dumped PS4 system software on Windows, Linux, and macOS. The author reports a working 64-bit kernel and VMM with GDT, TSS, IDT, syscall, and virtual-memory setup; development is focused on launching mini-syscore.elf.
- [libElysianVMU: reconstructing the Dreamcast Visual Memory Unit](https://awesomerea.org/resources/libelysianvmu-case/index.md): Case study · libElysianVMU reconstructs the Sega Dreamcast Visual Memory Unit as a C17 emulator core. It models the VMU CPU, memory, display, buzzer, and flash filesystem, supports official BIOS images, and handles VMU formats including VMI, VMS, DCI, and DCM. The repository also contains instruction-set, memory-map, and file-format documentation.
- [Digimon V-Pet: a literate disassembly of the 1997 firmware](https://awesomerea.org/resources/digimon-vpet-1997-disassembly-case/index.md): Case study · Digimon V-Pet investigates the 1997 Digital Monster firmware, focusing on Ver. 1 and comparing Ver. 2. Static analysis and emulator experiments map its Epson E0C6200 program, RAM, LCD, care and battle behavior, and device link protocol. The repository includes an article, Ghidra maps and tools that generate annotated listings from a user's firmware dump.
- [BCM5719 Firmware Reimplementation: rebuilding network-card firmware](https://awesomerea.org/resources/bcm5719-firmware-reimplementation-case/index.md): Case study · BCM5719 Firmware Reimplementation rebuilds firmware for the Broadcom BCM5719 network controller from the Ortega specification. Its source includes MIPS boot stages, an APE NC-SI handler, NVRAM and MII libraries, plus flash and register tools. The author reports testing on Talos II and Blackbird and says the firmware handles network traffic over NC-SI.
- [X-40 laser rangefinder: circuit and firmware reconstruction](https://awesomerea.org/resources/x40-laser-rangefinder-case/index.md): Case study · The X-40 laser rangefinder study reconstructs the tape measure's circuit and replaces its firmware for DIY distance measurement. The author captured I2C packets with a logic analyzer, decoded modulation-frequency values and wrote firmware that processes signals with a Goertzel algorithm; PC utilities display captured data and results.
- [CatCard: replacement firmware built around Coldcard bootloader contracts](https://awesomerea.org/resources/catcard-coldcard-firmware-case/index.md): Case study · CatCard implements Rust replacement firmware for Coldcard mk3, mk4, mk5 and Q1 hardware. It documents the protected bootloader's image layout, signature and callgate ABI, then builds board-specific wallet, storage and USB components against those fixed interfaces. The author reports that device builds run, while signing and several transports remain without end-to-end device exercise.
- [LaiNES: cycle-level NES hardware emulation](https://awesomerea.org/resources/laines-nes-emulation-case/index.md): Case study · LaiNES reconstructs NES console behavior in a cycle-level emulator. Its implementation models the 6502 CPU, PPU, audio hardware and common cartridge mappers, while technical notes describe timing the PPU at three steps per CPU cycle.
- [EP4CE6 Bitstream Reverse Engineering: mapping Cyclone IV configuration bits](https://awesomerea.org/resources/cyclone-cram-mapper-case/index.md): Case study · EP4CE6 Bitstream Reverse Engineering maps the proprietary .rbf configuration format of the Cyclone IV EP4CE6F17C8 FPGA. Its Python pipeline compiles controlled Verilog variants with Quartus, diffs bitstreams and records CRAM, LUT and routing mappings. The repository includes format findings and code for reading and writing bitstream features.
- [Powar: emulating the Pokéwalker](https://awesomerea.org/resources/powar-pokewalker-case/index.md): Case study · Powar emulates the Pokéwalker using a user-supplied ROM and EEPROM image. Its C source implements the CPU instructions used so far, EEPROM, LCD, buttons and some Timer W functions, with SDL2 builds for desktop and an Emscripten web interface. The author describes it as a prototype with major peripherals and DS connectivity unfinished.
- [GameCube IPL: investigating and reconstructing the console BootROM](https://awesomerea.org/resources/gamecube-ipl-case/index.md): Case study · GameCube IPL investigates the USA retail GameCube BootROM and develops replacement IPL code. The repository includes Bootstrap 1 disassembly, IPL call and function notes, boot-font research and source for parts of the boot process; the author reports several early milestones complete while menus and final ROM assembly remain open.
- [GoPro Metadata Format Parser: mapping GPMD telemetry](https://awesomerea.org/resources/gopro-gpmd-format-case/index.md): Case study · GoPro Metadata Format Parser maps the GPMD telemetry stream embedded in GoPro Hero 5 MP4 recordings and provides Go readers and conversion commands. The notes describe big-endian values, four-byte alignment and labels for GPS, gyroscope, accelerometer and temperature samples.
- [uLaunch: reconstructing the Nintendo Switch HOME Menu](https://awesomerea.org/resources/ulaunch-switch-home-menu-case/index.md): Case study · uLaunch reconstructs selected Nintendo Switch HOME Menu behavior in a customizable replacement. It launches and suspends applications, handles applets and controllers, and implements a subset of system settings; additional settings are being reversed and implemented.
- [uOFW: PSP kernel and firmware reconstruction](https://awesomerea.org/resources/uofw-case/index.md): Case study · uOFW reconstructs PSP kernel and hardware behavior to produce technical documentation and open source firmware. Its source tree contains kernel module implementations and headers for PSP subsystems including memory, interrupts, device control and media handling. The project describes its implementation as incomplete.
- [canon_cr3: mapping Canon CR3 camera files](https://awesomerea.org/resources/canon-cr3-format-case/index.md): Case study · canon_cr3 maps Canon camera image files, especially the CR3 container and its CRX image structures. Its format notes describe tracks, custom tags, metadata and compression, while a Python parser inspects CR3 and CR2 files and extracts selected image parts. Separate notes describe Canon HEIF images.
- [qemu-esp32-wireless: ESP32 wireless hardware emulation](https://awesomerea.org/resources/qemu-esp32-wireless-case/index.md): Case study · qemu-esp32-wireless reconstructs ESP32 Wi-Fi and Bluetooth LE hardware behavior in QEMU to run stock ESP-IDF firmware and its wireless blobs. QEMU patches model radio events, 802.11 traffic and BLE connections; the repository also provides example firmware, capture tools and test scenarios. The author reports comparing wireless timing with ESP32 hardware over JTAG.
- [rpi-open-firmware: a Raspberry Pi VPU boot firmware replacement](https://awesomerea.org/resources/rpi-open-firmware-case/index.md): Case study · rpi-open-firmware implements a replacement for the Raspberry Pi's stock VPU bootcode.bin and documents the device's boot stages. Its VC4 code initializes the clock, UART, SDRAM and ARM core; an ARM chainloader then reads the FAT boot partition and loads a Linux kernel.
- [ESP DC1: investigating and replacing Phicomm DC1 firmware](https://awesomerea.org/resources/esp-dc1-power-strip-case/index.md): Case study · ESP DC1 provides replacement firmware for the Phicomm DC1 power strip after its original app service became unavailable. The project credits original-firmware extraction, PCB photographs and U7 logic analysis; its firmware provides web setup, MQTT control, electrical measurements and overload protection.
- [fdsboot: Famicom Disk System boot ROM disassembly](https://awesomerea.org/resources/fdsboot-case/index.md): Case study · fdsboot is a 6502 disassembly of the Famicom Disk System boot ROM, split into disk I/O, PPU, joypad, timer, sound, interrupt and random-number routines with include files for the console and FDS registers. The ca65/ld65 build reassembles fdsboot.bin and compares its CRC with the original and with a second revision, 3DS and Wii VC builds, and GW and TWIN variants selected by assembler flags. It serves as a reference when disassembling Famicom Disk System titles.
- [gyx-decomp: Casio ES PLUS GYX firmware decompilation](https://awesomerea.org/resources/gyx-decomp-case/index.md): Case study · gyx-decomp is a decompilation of the Casio ES PLUS GYX scientific calculator firmware, which runs on ROHM nX-U8/100 microcontrollers. Code Casio wrote in C is recovered as ANSI C that the CCU8 compiler turns into matching assembly, Casio assembly is disassembled and reworked for RASU8, and MCU startup code is recreated from files for other U8 parts. A build script compiles, links with RLU8, converts to Intel HEX and binary, and a features file switches modes and functions to build custom ROMs. Notes cover the memory model, compiler options, segment naming and link order.
- [vmiv: View-Master Interactive Video emulator and format notes](https://awesomerea.org/resources/vmiv-case/index.md): Case study · vmiv emulates the View-Master Interactive Video system by decoding a captured tape video with FFmpeg, extracting the UART-style data bytes and auxiliary audio carried in the scanlines, and feeding them to an 8051 core that runs the VMI8802 ROM alongside a TMS9128 video chip model rendered with SDL2. Its notes document the mainboard chips, VDP register setup and VRAM map, the RLE sprite and tile records, and the packet layout with sequence numbers and CRC-CCITT checks. A companion dstool disassembles and reassembles the stack-based script bytecode delivered on the tape.
- [qemu-rtd2841](https://awesomerea.org/resources/qemu-rtd2841/index.md): Project · qemu-rtd2841 adds a Realtek RTD2841/RTK284x TV machine model to QEMU for bare-metal diagnostics and local firmware experiments. Its board profile models AArch32 Cortex-A53 cores, GICv2, timers, SDHCI, Ethernet, UART, and a framebuffer, with diagnostic assembly and a staged test runner.
- [premium5](https://awesomerea.org/resources/premium5-radio-emulator/index.md): Project · premium5 emulates the Volkswagen Premium 5 car radio at the register and signal level so its original firmware can run without patches. It models the NEC microcontroller, LCD controller, EEPROM and selected vehicle interfaces, with live disassembly, memory inspection and execution controls for firmware research.

## Protocols (64)

- [Even G2 protocol: reverse-engineering Even Realities G2 smart-glasses BLE traffic](https://awesomerea.org/resources/even-g2-ble-protocol-case/index.md): Case study · Documents the Bluetooth Low Energy protocol between the Even app and Even Realities G2 smart glasses, worked out from captured traffic: GATT characteristic UUIDs, an 8-byte transport header with sequence, multi-packet and two-byte service-ID fields, a CRC-16/CCITT over the payload, and protobuf payloads with draft .proto definitions. A Python example built on bleak sends the seven-packet session handshake and drives the teleprompter service to show custom text. The README’s status table marks connection, handshake, teleprompter and calendar widget as working, notifications as partial, and Even AI and navigation as still under research.
- [Wireshark](https://awesomerea.org/resources/wireshark/index.md): Tool · Inspect captured application and device traffic as decoded protocol fields, with filtering and shared GUI/TShark dissection. Custom dissectors let an analyst encode newly understood packet formats and compare protocol implementations.
- [Netzob](https://awesomerea.org/resources/netzob/index.md): Tool · Model communication protocols and infer message layouts from traces, with configured active learning for protocol state machines. Python APIs expose message fields, symbols and automata for parsing, traffic generation and fuzzing.
- [Scapy](https://awesomerea.org/resources/scapy/index.md): Tool · Script packet dissection, construction, request/reply matching and capture-file analysis in Python. Custom packet fields and layer bindings let analysts encode understood wire formats and investigate protocol behavior.
- [Universal Radio Hacker (URH)](https://awesomerea.org/resources/universal-radio-hacker/index.md): Tool · Demodulate and decode signals captured with software-defined radios, with automatic modulation-parameter detection and customizable decodings. Analysts assign protocol fields and message types by hand or review rule-based automatic field inference; a fuzzer targets stateless protocols and a simulator supports stateful exchanges.
- [SavvyCAN](https://awesomerea.org/resources/savvycan/index.md): Tool · Capture or load CAN bus traffic and investigate frames with sniffer, graphing, file-comparison and ISO-TP/UDS decoding views; loaded or analyst-edited DBC files map raw bytes to named signals. Separate custom-sender, fuzzing and UDS-scan windows transmit frames on a live bus.
- [AALpy](https://awesomerea.org/resources/aalpy/index.md): Tool · General-purpose Python automata-learning library that infers deterministic, non-deterministic, stochastic and pushdown models of black-box systems from active queries or passive traces. Its README links a separate Bluetooth Low Energy study whose repository reports learned connection and legacy-pairing state machines; message formats are not inferred.
- [rtl_433](https://awesomerea.org/resources/rtl-433/index.md): Tool · Receives and decodes transmissions from ISM-band devices such as weather sensors, remote controls, doorbells and alarm sensors, using RTL-SDR or SoapySDR receivers or recorded I/Q files, and emits decoded fields as JSON, CSV, MQTT and other outputs. For signals no built-in decoder recognizes, a pulse analyzer reports OOK/FSK timings and hints for a flexible -X decoder that slices frames into bits; its analysis guide leaves mapping those bits to values to the analyst, working from known readings.
- [Blackbox Protobuf](https://awesomerea.org/resources/blackbox-protobuf/index.md): Tool · NCC Group's tools for decoding and re-encoding Protocol Buffers messages without the matching .proto definition. The decoder returns the message data with an editable type definition built from best-effort guesses based on wire types; analysts can name fields, correct types and re-encode edited messages, which protoc --decode_raw cannot do. It ships as a Python library with a bbpb CLI, a Jython Burp Suite extension and a mitmproxy addon, and its README traces it to modifying messages during mobile penetration tests.
- [furiousMAC Continuity](https://awesomerea.org/resources/furiousmac-continuity/index.md): Tool · Reverse-engineering notes and a Wireshark dissector for Apple's proprietary Continuity Bluetooth LE advertisements, continuing the authors' PETS 2019 privacy study. Per-message pages document field layouts and observed values for 14 message types, including AirDrop, Handoff, Proximity Pairing, Nearby Info and Find My, and the dissector replaces Wireshark's packet-bthci_cmd.c so captured advertisements decode into named btcommon.apple fields.
- [opendbc](https://awesomerea.org/resources/opendbc/index.md): Tool · comma.ai's repository of DBC files describing the CAN messages and signals of many car makes, with a Python library that parses and builds CAN messages from those definitions; its porting guide has contributors reverse engineer new messages from recorded drives in the cabana tool. Per-brand car ports built on it parse vehicle state, identify models from ECU firmware versions and generate openpilot's steering, gas and brake messages, while safety code for comma's panda interface restricts which messages can be sent.
- [FISSURE](https://awesomerea.org/resources/fissure/index.md): Tool · GNU Radio-based RF framework that carries a signal from survey and detection through IQ capture, inspection, conditioning, feature extraction and classification into a protocol discovery workflow. Its demodulation workspace estimates symbol rates for OOK/ASK and binary FSK recordings, and the bitstream and framing stage applies Manchester or differential decoding, sync-pattern and CRC evidence and repeated-message detection to propose message boundaries. A Qt dashboard coordinates local or remote SDR sensor nodes, a library keeps protocol and packet definitions, dissectors and archived recordings, and plugins add inspection modules such as radar pulse analysis.
- [friTap](https://awesomerea.org/resources/fritap/index.md): Tool · Frida-based tool that hooks TLS libraries such as OpenSSL, BoringSSL, NSS and GnuTLS inside a running process and writes NSS key logs and decrypted payloads as PCAP, so analysts can inspect an application's encrypted traffic in Wireshark. For stripped or statically linked libraries it accepts byte patterns or offsets and can scan for renamed libraries, or it can recover TLS secrets by scanning heap memory instead of hooking. A terminal UI, a Python API and a Wireshark extcap integration wrap the same capture.
- [pbtk](https://awesomerea.org/resources/pbtk/index.md): Tool · Recover Protobuf message definitions from compiled programs as readable .proto files. Extractors cover the Java runtimes in JAR, DEX and APK files (including ProGuard-obfuscated code), binaries that embed Protobuf reflection metadata, and web apps using the Protobuf-URL format. A GUI then binds a recovered message type to an HTTP endpoint, decodes hex-encoded captured samples into an editable field tree and resends edited messages, so analysts can relate each field to the response.
- [SteamKit](https://awesomerea.org/resources/steamkit/index.md): Tool · .NET library that implements the client side of Valve’s Steam network protocol: connection-manager sessions, authentication, friends, unified service and Game Coordinator messages, Web API calls and CDN depot downloads. Message classes are generated from Steam protobufs tracked in a submodule and from the project’s own SteamLanguage definitions. Its Resources tree adds protocol-research tools: NetHook2, a Windows DLL that hooks a running Steam client to dump the network messages it exchanges, NetHookAnalyzer2 for viewing those dumps, and ProtobufDumper for recovering protobuf definitions from executables.
- [protobuf-inspector](https://awesomerea.org/resources/protobuf-inspector/index.md): Tool · Parses Protocol Buffers blobs (proto2 or proto3) without their .proto definition and prints a colored view of the fields in wire order, trying each length-delimited chunk as a nested message, then a packed array, a string and finally a hexdump. Analysts record what they work out in a protobuf_config.py file, with field types and names, message and enum types and custom native types, until the parser no longer has to guess. Field names, zig-zag encoding, signedness and integer-versus-float choices cannot be read from the wire, and the README says guesses can be wrong, especially for small chunks.
- [libimobiledevice](https://awesomerea.org/resources/libimobiledevice/index.md): Tool · C library and command-line tools that speak iOS devices' native service protocols without Apple's proprietary libraries or a jailbreak. Over usbmuxd or Wi-Fi sync it implements lockdownd pairing and services such as AFC file access, backup, app installation, crash reports, syslog, debugserver and WebKit inspection, plus Cython bindings.
- [Sniffle](https://awesomerea.org/resources/sniffle/index.md): Tool · NCC Group's sniffer for Bluetooth 5 and 4.x Low Energy, made of firmware for TI CC1352/CC26x2 radio boards and Python host tools. It captures advertising and connection traffic on the 1M, 2M and coded PHYs, follows connections through channel-map, connection-parameter and PHY changes, captures BT5 extended advertising, and filters by MAC address, IRK, RSSI or advertisement content; for a filtered target it hops all three primary advertising channels, which the README says makes connection detection nearly three times more reliable than single-channel sniffers. Captures are saved as Ubertooth-compatible PCAP, a Wireshark extcap plugin starts captures from the Wireshark GUI, and command-line decoders print advertising data, including Apple and Microsoft manufacturer-specific fields.
- [Packetry](https://awesomerea.org/resources/packetry/index.md): Tool · Great Scott Gadgets' USB 2.0 protocol analysis application for live capture with the Cynthion analyzer or for exploring previously captured traffic, working from physical-layer packet data at High, Full and Low Speed. Its GTK 4 interface offers a hierarchical view that expands high-level events into their transactions and packets, plus chronological transaction and packet views, while a device pane summarizes each observed device from its decoded descriptors, including HID report descriptors. Captures are opened and saved as pcap files with the LINKTYPE_USB_2_0 link type, and v0.5.0 added pcapng with custom blocks for non-packet events.
- [Caring Caribou](https://awesomerea.org/resources/caringcaribou/index.md): Tool · Python automotive security exploration tool, begun in the HEAVENS research project, that the README describes as a zero-knowledge tool to drop onto a CAN network and collect information about the services present. Passive modules dump CAN traffic to the terminal or a candump-format file and list every arbitration ID seen on the bus, while the UDS (ISO 14229-1), DoIP (ISO 13400-2) and XCP modules discover ECUs that answer diagnostic requests, enumerate their supported services and subservices, read data identifiers and query XCP capabilities. Its utilities provide reusable ISO-TP (ISO 15765-2) and UDS implementations, and new modules plug into a drop-in module architecture.
- [protodump](https://awesomerea.org/resources/protodump/index.md): Tool · Go command-line utility that recovers Protocol Buffers schemas from a compiled binary or any other file: it scans the raw bytes for serialized FileDescriptorProto records embedded by generated code, locating them through their .proto file names, and writes each one back out as a .proto source file under its original descriptor path. The regenerated files use proto2, proto3 or editions syntax and include the package, imports, common file options, messages with reserved ranges, nested enums, oneofs, maps and default values, and services with their RPC methods, giving analysts message and API definitions to work with when decoding Protobuf traffic.
- [CAN Commander](https://awesomerea.org/resources/can-commander/index.md): Tool · A Flipper Zero app and earlier Arduino sketches for reverse engineering CAN bus traffic, chiefly in vehicles. The current app is a UART front end for a CAN Commander ESP32 board: it streams all or filtered frames, lists unique IDs, measures message rates, tracks per-bit and per-byte changes, and runs a two-phase Auto Reverse Engineer that first calibrates out background traffic and then shows which IDs change during an action. It also decodes live signals from DBC-based profiles and reads OBD-II PIDs, the VIN and trouble codes.
- [Automated CAN Payload Reverse Engineering](https://awesomerea.org/resources/can-reverse-engineering/index.md): Tool · Research Python and R scripts that automate reverse engineering of Controller Area Network (CAN) payloads recorded from passenger vehicles, implementing the pipeline from Brent Stone's AFIT dissertation. The Python pipeline pre-processes a CAN log into per-arbitration-ID data frames, pulls out public SAE J1979 diagnostic data, runs a lexical analysis that guesses individual signal time-series boundaries, then a semantic analysis that builds a correlation matrix and hierarchically clusters related signals, with plots and a dendrogram as output. A separate R script set applies the rEDM empirical dynamic modeling package to engine-RPM, brake-pressure and vehicle-speed time series to study causal relationships.
- [Deluder](https://awesomerea.org/resources/deluder/index.md): Tool · Frida-based interceptor for the traffic of proxy-unaware applications. JavaScript hook scripts on the send and receive functions of WinSock, Linux libc sockets, OpenSSL, GnuTLS and SChannel pass plaintext buffers to Python interceptor modules, which log them or forward them to a proxy for inspection. It spawns or attaches to a process, optionally through a remote frida-server, and was designed mainly as the backend for the author's PETEP proxy; a proxifier interceptor works with other proxy tools, and new scripts and interceptors can be added.
- [PiCCANTE](https://awesomerea.org/resources/piccante/index.md): Tool · Raspberry Pi Pico firmware and hardware designs for a low-cost CAN bus interface aimed at exploring and reverse engineering vehicle networks. It runs two CAN 2.0B channels on RP2040 boards or three on RP2350 boards through the PIO-based can2040 library and exposes them over USB as a GVRET device for SavvyCAN and as per-channel SLCAN devices for Linux SocketCAN via can-utils. A configuration shell, a partial ELM327 emulator for OBD-II PID requests with ISO-TP multi-frame replies, and Wi-Fi, Bluetooth and a web interface on Pico W boards complete the firmware, alongside perfboard and KiCad PCB designs with 3D-printable cases for an OBD-II dongle.
- [VanBus](https://awesomerea.org/resources/vanbus/index.md): Tool · Arduino library for ESP8266/ESP8285 and ESP32 boards that receives and transmits packets on the VAN (Vehicle Area Network) comfort bus that PSA fitted to Peugeot and Citroën models until about 2009. It decodes the signal from a GPIO pin, wired through a CAN transceiver or a receive-only resistor divider, in software into packets with identifier, command flags, data and a 15-bit CRC that it can check or try to repair by flipping single bits, and reports queue and error statistics. Example sketches dump raw packets, send a packet, and parse comfort-bus traffic into readable fields on the serial port or a live web page.
- [Apple Continuity Reverse Engineering Toolkit](https://awesomerea.org/resources/apple-continuity-tools/index.md): Tool · Three macOS helpers from SEEMOO Lab that the Open Wireless Link project used to study Apple wireless services such as AirDrop, Wi-Fi Password Sharing, Handoff and Offline Finding from the host side. process_recon summarizes which processes, log categories and subsystems emit log entries matching chosen keywords; keychain_access uses Frida to hook SecItemCopyMatching in a process and exports the keychain items it accesses to JSON; and lldb breakpoint commands print the Handoff and Universal Clipboard messages that the rapportd daemon sends and receives.
- [Cabana (standalone openpilot-cabana)](https://awesomerea.org/resources/openpilot-cabana/index.md): Tool · Qt desktop CAN and CAN FD analyzer for decoding signals and reverse engineering unknown messages, split out of openpilot's cabana by Dean Lee, a frequent contributor to it, and now maintained on its own. It shows live per-bit change heatmaps, colors bytes by trend such as counters, toggles or noisy data, searches for signals by value or for bits that change together across messages and buses, mutes known bits, plots signals and edits DBC files with undo, while replaying openpilot drives with synchronized camera video. Sources are openpilot routes, Vector ASC, candump and PEAK TRC logs, SocketCAN, comma.ai Panda devices and live streams from a comma device, with a bundled set of opendbc DBC files.
- [eCapture](https://awesomerea.org/resources/ecapture/index.md): Tool · eBPF-based Linux and Android tool that attaches uprobes to TLS libraries such as OpenSSL, BoringSSL, GnuTLS and NSS, and to Go's TLS stack, recording the plaintext a process sends and receives without a proxy or an installed CA certificate, so analysts can inspect an application's encrypted traffic on a host they control. Output modes write plaintext text, NSS key logs, or pcapng files with embedded TLS secrets for Wireshark and tshark, and a text mode can rebuild complete HTTP/1.1 and HTTP/2 messages from the captured stream. Separate modules audit bash and zsh commands and MySQL and PostgreSQL queries.
- [USBPcap](https://awesomerea.org/resources/usbpcap/index.md): Tool · Tomasz Moń's open-source USB packet capture for Windows. A filter driver installed in the Windows USB device stack records the USB Request Blocks (URBs) exchanged with devices on each root hub, and USBPcapCMD writes them to pcap files in the LINKTYPE_USBPCAP format, which Wireshark dissects. Since 1.2.0.0 the project has recommended running USBPcapCMD as a Wireshark extcap: each root hub then appears as a capture interface, with options to capture selected, all or newly connected devices and to add the descriptors of devices that are already attached.
- [cantools](https://awesomerea.org/resources/cantools/index.md): Tool · Python 3 library and command-line tool for CAN bus databases that parses DBC, KCD, SYM, ARXML 3/4 and CDD files and encodes and decodes CAN messages, including simple and extended signal multiplexing and diagnostic DIDs. Its CLI decodes candump output against a database, plots decoded signals from candump logs with matplotlib, dumps each message's bit layout, converts between database formats, generates C pack and unpack code, and monitors a live bus in a text interface through python-can.
- [inspectrum](https://awesomerea.org/resources/inspectrum/index.md): Tool · Desktop analyzer for recorded radio signals, primarily captures from software-defined radio receivers, which the README says handles files of 100 GB and more. A zoomable spectrogram with a tunable filter feeds sample, amplitude, frequency, phase and threshold plots, and cursors measure period and symbol rate and extract symbol values to stdout or the clipboard. Selected time spans, filtered samples and demodulated traces can be exported, and SigMF annotations can be displayed over the spectrogram.
- [PULSAR](https://awesomerea.org/resources/pulsar/index.md): Tool · Research prototype by Hugo Gascon and colleagues that learns a model of an unknown network protocol from recorded traffic. Messages extracted from PCAP traces are embedded as token or n-gram vectors, clustered by matrix factorization through the PRISMA R module, and turned into a Markov-chain state model with message templates and rules linking fields to earlier messages, written out as model files and a Graphviz state graph. The same models drive the tool's session simulator and stateful fuzzer, described in the authors' SecureComm 2015 paper; this entry covers only the protocol-learning part.
- [CanLab](https://awesomerea.org/resources/canlab/index.md): Tool · PyQt6 desktop workstation and command-line tool for reverse-engineering CAN bus captures offline. It reads SavvyCAN/GVRET CSV, candump, pcap, Vector BLF/ASC, MDF4 and openpilot logs, then suggests counters, checksums and their algorithms, byte roles, flags, multiplexers, entropy-based field boundaries and cross-ID correlations, decodes J1939 and NMEA 2000 PGNs and reassembles multi-frame messages. A cantools-backed DBC builder checks signal definitions against the captured frames and exports DBC, openpilot DBC, CANdb++, ARXML and Wireshark Lua dissectors, and an optional MCP server offers 29 receive-only analysis tools to assistants.
- [Facedancer](https://awesomerea.org/resources/facedancer/index.md): Tool · Python library for implementing USB devices in software, with a hardware peripheral such as Cynthion or GreatFET acting as a remote-controlled USB controller attached to the target host. Its USBProxy mode sits between a real device and a host, forwarding transfers while filters log, decode or modify them for USB protocol analysis; the README notes this suits devices whose software you do not control, such as embedded systems or game consoles. Version 3 is a ground-up rewrite of the emulation core that ships keyboard, mass-storage and FTDI serial device models plus HID and logging proxy filters, and no longer runs legacy 2.9.x scripts.
- [Mirage](https://awesomerea.org/resources/mirage-wireless-framework/index.md): Tool · Python framework from IoT-security research at LAAS-CNRS for analysing wireless communications, with lightweight protocol stacks for Bluetooth Low Energy, Bluetooth, Enhanced ShockBurst, Mosart, Zigbee, Wi-Fi and infrared that a command-line interpreter drives through chainable modules. For protocol analysis it offers per-protocol scan, information and sniffing modules, BLE ATT/GATT discovery that saves the discovered attribute table, HCI monitoring of an Android phone through its btsnoop log over ADB, PCAP reading and writing, and an experimental HackRF software-radio receive path with FSK demodulators and BLE and Zigbee decoders. Its author has deprecated it in favour of the WHAD tool suite.
- [Protobuf Decoder](https://awesomerea.org/resources/pawitp-protobuf-decoder/index.md): Tool · Pawit Pornkitprasan's React web application for decoding Protocol Buffers data without the original .proto files, offered as a hosted page or run locally, with all decoding done in the browser. Pasted hex or base64 input, or an uploaded file, is split into a table of byte ranges, field numbers, wire types and contents: varints are shown as unsigned, two's-complement and zigzag integers, fixed32 and fixed64 values as integers and floating-point numbers, and length-delimited fields as nested messages when they parse cleanly, otherwise as UTF-8 strings or bytes. It skips a leading gRPC message header and can optionally split a stream of varint length-delimited messages.
- [gr-lora](https://awesomerea.org/resources/gr-lora/index.md): Tool · GNU Radio out-of-tree module by Pieter Robyns and co-authors for receiving and decoding LoRa physical-layer frames with a software-defined radio, implementing the modulation features described in patents and blog posts. Its receiver channelizes the input, detects and synchronizes to LoRa chirps with clock-drift correction, and decodes symbols through Gray mapping, deinterleaving, dewhitening and Hamming decoding into header and payload bytes, which a message socket sink can forward over UDP port 40868. The bundled flowgraphs decode recorded traces or live captures, and the README lists HackRF One, USRP B201, RTL-SDR and LimeSDR as tested receivers.
- [termshark](https://awesomerea.org/resources/termshark/index.md): Tool · Graham Clark's terminal user interface for tshark, inspired by Wireshark and aimed at inspecting captures on a remote machine, for example over SSH, without copying them back to a desktop. It reads pcap files, fifos or standard input, or captures live from one or more interfaces, and shows a packet list filtered with Wireshark display filters next to the dissected packet structure and a hex view. Analysis views reassemble TCP and UDP streams with search and client- or server-only display, list Ethernet, IPv4, IPv6, UDP and TCP conversations that can be turned into display filters, and search packet contents; Wireshark-style profiles can reuse a linked Wireshark profile's packet colors.
- [SigDigger](https://awesomerea.org/resources/sigdigger/index.md): Tool · Qt graphical digital signal analyzer by Gonzalo José Carracedo Carballal, built on his Suscan and Sigutils libraries; its user manual names reverse engineering of radio signals with unknown parameters as the main use. It receives from SoapySDR-supported SDRs or plays back recorded I/Q and WAV files, shows spectrum and waterfall views, and lets analysts measure captured stretches in a time window with carrier recovery, transforms and symbol sampling. Inspector tabs run user-tunable PSK, FSK and ASK demodulators with parameter estimation and can forward demodulated samples; it also decodes analog video and previews AM, FM and SSB audio.
- [grpc-tools](https://awesomerea.org/resources/grpc-tools/index.md): Tool · Bradley Kemp's suite of gRPC debugging tools, described as Fiddler or Charles for gRPC. grpc-dump runs as a local HTTP(S) proxy that logs every gRPC and gRPC-Web call an application makes as a JSON stream with service and method names, metadata, any error status and each message both raw and parsed; without the .proto files it decodes messages heuristically. grpc-replay re-sends the recorded requests and checks the server's responses, grpc-fixture answers clients from a saved dump, and the grpc-proxy Go library underlies them.
- [Holley EFI Parser](https://awesomerea.org/resources/holley-efi-parser/index.md): Tool · Holley EFI Parser decodes Holley DL and DLZ data logs and live ECU CAN messages. Its Python tools decompress DLZ with byte swapping and RLE, parse versioned DL records into pandas DataFrames, and decode CAN messages using supplied DBC files. The documentation records the proprietary 29-bit CAN identifier layout.
- [CAN Bus Parser](https://awesomerea.org/resources/vanmoof-can-bus-parser/index.md): Tool · CAN Bus Parser decodes VanMoof SA5 and later bicycle CAN captures from CSV or candump input. It reassembles multi-frame CBOR messages, maps device IDs and heartbeat frames, and provides live or saved-capture diagnostics for components such as the electronic lock and shifter.
- [Hermes](https://awesomerea.org/resources/hermes-flipperzero/index.md): Tool · Hermes is a Flipper Zero app for identifying unknown UART settings and inspecting a device's serial console. It timestamps line edges to estimate bit time, checks candidate rates and parity against received UART bytes, then offers a terminal with text, hex and capture features. The source states that detection leaves the transmit pin undriven until the user sends data.
- [RoflLens](https://awesomerea.org/resources/rofllens/index.md): Tool · RoflLens is a Python library and CLI for analysing League of Legends ROFL v2 replay containers and network transport. It exports blocks and payloads, and offers patch-specific decoders for events such as movement, spells and deaths when the client version, protocol digest and executable hash match.
- [LogicAnalyzer](https://awesomerea.org/resources/logicanalyzer/index.md): Tool · LogicAnalyzer is a hardware and software tool for capturing digital signals and decoding communication protocols. It supports triggered capture, multiple channels, and Sigrok protocol decoders.
- [BtleJuice](https://awesomerea.org/resources/btlejuice/index.md): Tool · BtleJuice is a framework for intercepting Bluetooth Low Energy GATT operations between devices. Its web interface displays intercepted operations and supports replay, data modification, and export.
- [Impacket](https://awesomerea.org/resources/impacket/index.md): Tool · Impacket is a Python library for constructing and parsing network packets and working with protocol implementations. It covers protocols including SMB and MSRPC and includes example tools.
- [BtleJack](https://awesomerea.org/resources/btlejack/index.md): Tool · Capture Bluetooth Low Energy connections with compatible nRF51822-based boards and export packets for Wireshark analysis.
- [can-utils](https://awesomerea.org/resources/can-utils/index.md): Tool · Record, filter, compare and replay SocketCAN traffic with tools for raw CAN, ISO-TP and J1939 analysis.
- [libsigrokdecode](https://awesomerea.org/resources/libsigrokdecode/index.md): Tool · Run sigrok’s Python protocol decoders through a C library to interpret captured digital signals.
- [Ubertooth](https://awesomerea.org/resources/ubertooth/index.md): Tool · Capture Bluetooth radio traffic using the Ubertooth hardware platform and its host analysis tools.
- [Umap2](https://awesomerea.org/resources/umap2/index.md): Tool · Explore a USB host’s supported device classes and vendor-specific behavior through programmable device emulation.
- [DSDcc](https://awesomerea.org/resources/dsdcc/index.md): Tool · DSDcc decodes digital radio traffic in DMR, D-Star, dPMR and Yaesu System Fusion formats through a C++ library and command-line program. It accepts 48 kS/s sample streams and exposes decoded audio, MBE frames and protocol status for analysis or integration.
- [winbox](https://awesomerea.org/resources/winbox-protocol-python/index.md): Tool · winbox implements the Winbox protocol's M2 packet and message structures in Python. It frames short and chunked packets, parses typed message fields, and provides session routines for challenge-response and cleartext login exchanges.
- [wow_messages](https://awesomerea.org/resources/wow-messages/index.md): Tool · wow_messages maintains World of Warcraft authentication and world-server message definitions in the wowm language. Its parser generates Rust message libraries, a machine-readable representation and Wireshark dissector messages, with examples for game clients from versions 1.12, 2.4.3 and 3.3.5.
- [Vifterpreter](https://awesomerea.org/resources/vifterpreter/index.md): Tool · Vifterpreter is a Rust crate for inspecting PlayStation 2 DMA packet structures and VIF commands. Its example reads binary input with binrw and traverses DMA tags to access the VIF codes carried by each tag.
- [meteor_decoder](https://awesomerea.org/resources/meteor-decoder/index.md): Tool · meteor_decoder processes captured Meteor-M LRPT weather-satellite signals into BMP images or decoded dumps. It accepts 8-bit soft samples and 1-bit hard samples, with options for deinterleaving, differential coding and channel selection by APID.
- [RF-Bridge-OB38S003](https://awesomerea.org/resources/rf-bridge-ob38s003/index.md): Tool · RF-Bridge-OB38S003 provides replacement firmware for 433 MHz radio-to-Wi-Fi bridges that decodes radio packets and sniffs unknown codes. It offers passthrough, RCSwitch and Portisch modes for Sonoff Bridge R2 boards and supported 8051 microcontrollers, forwarding results over UART to the ESP8265.
- [RFLink ESP](https://awesomerea.org/resources/rflink-esp/index.md): Tool · RFLink ESP is ESP32 and ESP8266 firmware that receives and decodes 433 MHz OOK device messages. Its debug mode reports unrecognized pulse timings, and its plugin guide uses those captures to investigate a device's radio protocol and add a decoder.
- [bedrock-protocol](https://awesomerea.org/resources/bedrock-protocol/index.md): Tool · bedrock-protocol parses and serializes Minecraft Bedrock Edition packets as JavaScript objects and provides client, server and proxy connections. Its authentication and encryption handling, protocol documentation and packet-dump tooling support inspection of Bedrock network exchanges.
- [Twonkie](https://awesomerea.org/resources/twonkie-usb-pd-sniffer/index.md): Tool · Twonkie is a USB-PD sniffer, injector and sink built around a four-layer board derived from the open-source Twinkie design. It supplies board fabrication files, assembly guidance and STM32 firmware sources for inspecting USB Power Delivery traffic.
- [BresserWeatherSensorReceiver](https://awesomerea.org/resources/bresser-weather-sensor-receiver/index.md): Tool · BresserWeatherSensorReceiver is an Arduino library for receiving and decoding 868 MHz transmissions from Bresser weather sensors. It tries 7-in-1, 6-in-1, 5-in-1, lightning and leakage payload decoders and documents how 6-in-1 sensors alternate partial weather messages.
- [rtlamr](https://awesomerea.org/resources/rtlamr/index.md): Tool · rtlamr receives and decodes Itron ERT-compatible smart-meter transmissions in the 900 MHz ISM band through rtl-sdr and rtl_tcp. Its protocol handlers parse SCM, SCM+, IDM, NetIDM and Neptune R900 message variants to expose consumption and interval readings.