# Curated reverse engineering resources · Page 50

> Page 50 of 52, entries 4,901–5,000. 5,191 tools, projects, integrations, case studies, and references for websites, games, apps, native binaries, firmware, and communication protocols.

Source-reviewed means descriptions were checked against primary documentation. Each entry page lists the full requirements and sources; this page shows their counts and the review date.

- HTML: <https://awesomerea.org/resources/page/50/>
- JSON: <https://awesomerea.org/api/v1/resources.json>
- 简体中文: <https://awesomerea.org/zh/resources/page/50/index.md>

## Protocols (56)

- [poggadaj: rebuilding Gadu-Gadu backend services](https://awesomerea.org/resources/poggadaj-case/index.md): Case study · poggadaj rebuilds Gadu-Gadu backend services in Go for historical messaging clients. A TCP service handles login, presence, contacts, and messages across several client versions, while an HTTP service supplies client endpoints and a web frontend provides account access.
- [volvo_vida_db: reconstructing Volvo D2 ECU communication from VIDA](https://awesomerea.org/resources/volvo-vida-d2-protocol-case/index.md): Case study · volvo_vida_db reconstructs Volvo D2 ECU communication from VIDA 2014D database definitions and decompiled .NET services. Its scripts extract vehicle profiles and ECU parameters, form CAN request frames, reassemble multi-frame responses and decode parameter values for P1/P2-era vehicles.
- [UniSpy Server: rebuilding GameSpy services in Python](https://awesomerea.org/resources/unispy-server-case/index.md): Case study · UniSpy Server rebuilds GameSpy online services in Python using published GameSpy protocol research and an earlier server library as references. Its source organizes handlers for chat, game status, traffic relay, NAT negotiation, presence, query reporting, server browsing, and web services. The project documents Docker-based setup with PostgreSQL and Redis.
- [Validity90: reverse engineering a Validity/Synaptics fingerprint-reader protocol](https://awesomerea.org/resources/validity90-fingerprint-protocol-case/index.md): Case study · Reverse engineers the USB protocol of the Validity/Synaptics laptop fingerprint readers 138a:0090, 138a:0094, 138a:0097, 06cb:0081 and 06cb:009a, aiming at a written specification and a free libfprint driver. The repository holds a draft specification of the initialization sequence and of the modified TLS 1.2 handshake the readers use, a Wireshark Lua dissector that decrypts traffic after the key exchange, and a standalone C prototype that talks to a reader over libusb. The README calls the prototype extremely ugly code to be rewritten for the driver, and marks the integrated libfprint driver as not ready.
- [Ember Mug: reverse-engineered Bluetooth LE characteristics](https://awesomerea.org/resources/ember-mug-ble-protocol-case/index.md): Case study · Documents the Bluetooth Low Energy GATT interface of Ember smart mugs, worked out from an Ember Mug 2 and a decompiled copy of the Android Ember app. Per-characteristic pages give UUIDs, read, write and notify methods and byte layouts for the mug name, LED colour, current and target temperature, temperature unit, battery and charging status, liquid level and state, date and time zone, firmware and hardware versions, and push events. A separate page lists the analytics fields that the decompiled app sends to Ember’s collection server.
- [BM2 Battery Monitor: reconstructing an encrypted BLE voltage protocol](https://awesomerea.org/resources/bm2-battery-monitor-ble-case/index.md): Case study · Reimplements the Bluetooth Low Energy protocol of the BM2 (Battery Monitor 2) car battery monitor for independent voltage readings. A Python client built on Bleak decrypts the monitor's AES-encrypted notifications to read the current voltage and request the stored voltage history, an ESPHome template exposes the voltage from an ESP32, and example apps view and dump readings or forward them over MQTT. The author's write-up reports that the key and packet layout were recovered from the vendor app; results are author- and contributor-reported.
- [Smart ring protocol: documenting the Oura Ring BLE protocol and event format](https://awesomerea.org/resources/ringverse-oura-ring-protocol-case/index.md): Case study · Documents the Oura Ring Bluetooth Low Energy request and response framing, request tags and payloads, and binary event stream. The BLE notes are confirmed on Oura Ring 4. Many packets remain unknown. The author says the event reference and Node.js parser were generated from the Oura app event-parser library and await manual verification.
- [openrsync: an ISC implementation of rsync protocol 27](https://awesomerea.org/resources/openrsync-protocol-case/index.md): Case study · An ISC-licensed rsync that copies a directory and checks the result. regress/functional/test00_simple.test builds dir1/one.txt, an expected tree under dir2, runs openrsync -a from dir1 to dir3, and compare_trees diffs the listings and file contents.
- [Thermal Master P3: a browser client for the vendor USB protocol](https://awesomerea.org/resources/thermal-master-p3-protocol-case/index.md): Case study · A browser viewer for the Thermal Master P3, which speaks a vendor USB protocol over vendor USB control transfers. tests/test_webusb.mjs compares built commands with captured 18-byte transfers, including read_name, and parses a captured status buffer.
- [SNX-VPN: reconstructing Check Point browser login for SNX](https://awesomerea.org/resources/snxvpn-case/index.md): Case study · SNX-VPN reconstructs the browser login stage of Check Point SSL VPN as a Python command-line client while using the vendor's snx binary to establish the tunnel. Its notes describe password encryption, cookies, the undocumented -Z option and the binary connection exchange on local TCP port 7776.
- [OpenDS: reconstructing an FRC Driver Station client](https://awesomerea.org/resources/opends-frc-case/index.md): Case study · OpenDS reconstructs an FRC Driver Station client for Windows, Linux and macOS. Its Java code parses and builds year-specific robot-control packets and exposes enable, mode, joystick, status and NetworkTables functions for testing robots away from competition.
- [CO/Tech power plugs: reproducing captured radio commands](https://awesomerea.org/resources/cotech-remote-control-case/index.md): Case study · Recreates CO/Tech power-plug control with Arduino sketches that capture 24-bit commands from an original 433.92 MHz remote and transmit selected commands to paired plugs. The instructions describe the receiver connection, command capture and plug pairing.
- [ts3j: a Java implementation of the TeamSpeak 3 client protocol](https://awesomerea.org/resources/ts3j-protocol-case/index.md): Case study · ts3j implements the reverse-engineered TeamSpeak 3 full client protocol in Java, adapting an earlier C# client source. Its API connects to servers, tracks channels and clients, handles chat and sends or receives Opus audio packets.
- [WCH BLE Analyzer Pro: reconstructing its USB capture protocol for Linux](https://awesomerea.org/resources/wch-ble-analyzer-pro-linux-case/index.md): Case study · The WCH BLE Analyzer Pro project reconstructs the USB capture protocol of a three-channel BLE sniffer and implements a Linux libusb driver. It sends monitor commands to the device's CH582F controllers, decodes returned frames and writes BLE link-layer packets to pcap for Wireshark. Research notes describe USB captures and analysis of bundled decoder scripts.
- [eoip: a Linux implementation of MikroTik EoIP tunnelling](https://awesomerea.org/resources/eoip-protocol-case/index.md): Case study · eoip implements MikroTik-compatible Ethernet-over-IP tunnelling in Linux kernel modules with a user-space management utility. The author says development used sniffed datagrams; the README documents the GRE-like packet format, tunnel configuration and keepalive behaviour for IPv4 and IPv6 variants.
- [PrimeComm: reconstructing HP Prime file communication](https://awesomerea.org/resources/primecomm-hp-prime-case/index.md): Case study · PrimeComm implements file communication with the HP Prime calculator from the author's device reverse engineering. It provides a Windows GUI, PrimeCmd command-line access and PrimeLib for sending, receiving and converting calculator programs; the author says modern firmware changed the communication protocol.
- [MicronetToNMEA: reconstructing a marine instrument radio bridge](https://awesomerea.org/resources/micronet-to-nmea-case/index.md): Case study · MicronetToNMEA investigates Raymarine's Micronet wireless instrument protocol and implements a Teensy and CC1101 bridge to NMEA 0183. It receives Micronet traffic, converts wind, speed and other navigation data for a PC or tablet, and can send NMEA navigation data back to Micronet displays. The manual describes remaining uncertainties in the protocol.
- [openmili: implementing the Mi-Light 2.4 GHz control protocol](https://awesomerea.org/resources/openmili-case/index.md): Case study · openmili implements the Mi-Light 2.4 GHz LED control exchange with an nRF24 radio acting as a PL1167 backend. An Arduino sketch sends and receives framed packets over serial, while a Python daemon maps UDP commands to light-control messages with configurable sender IDs. The code specifies channels, sync words, CRC handling, and command mappings.
- [AcuRite 00592TX: decoding wireless temperature frames](https://awesomerea.org/resources/acurite-00592tx-protocol-case/index.md): Case study · The AcuRite 00592TX investigation captures and decodes 433 MHz temperature-probe transmissions with Arduino. Its notes describe synchronization pulses, 56-bit frames, probe IDs, channel bits, temperature parity and the final running-sum byte.
- [DIY Saab 9-3 Tachometer: decoding CAN signals for RPM and speed](https://awesomerea.org/resources/diy-saab-9-3-tachometer-case/index.md): Case study · DIY Saab 9-3 Tachometer investigates a 2007 Saab 9-3 CAN bus by logging traffic during controlled driving maneuvers and plotting bytes grouped by message ID. The author associates RPM with bytes 2–3 of 0x110 and vehicle speed with byte pairs in 0x280, then uses those signals for a Raspberry Pi display and gear estimate.
- [free-outernet: reconstructing Outernet broadcast services](https://awesomerea.org/resources/free-outernet-protocol-case/index.md): Case study · free-outernet reconstructs Outernet’s file and time broadcast services from reverse-engineered protocols. Its Python receiver accepts live UDP packets from gr-outernet or recorded KISS files, recovers transmitted files and prints time packets. The code also includes LDPC decoding to recover missing file blocks.
- [MikroTik WinBox Terminal Client: implementing the terminal protocol](https://awesomerea.org/resources/winbox-terminal-protocol-case/index.md): Case study · MikroTik WinBox Terminal Client implements RouterOS CLI access over the proprietary WinBox terminal protocol on TCP port 8291. Its Python code handles M2 TLV messages, EC-SRP5 or legacy MD5 authentication and AES-128-CBC terminal traffic. A companion specification records handshake fields, key derivation and message framing.
- [pippin: a Linux client for macOS high-performance Screen Sharing](https://awesomerea.org/resources/pippin-screen-sharing-case/index.md): Case study · pippin implements a native Linux client for macOS high-performance Screen Sharing using documented protocol reverse-engineering work from iShareScreen. Its Rust code handles the connection, media transport and HEVC display, with clipboard support and byte-level tests against reference wire vectors.
- [OpenSpy Core: reconstructing GameSpy online services](https://awesomerea.org/resources/openspy-core-case/index.md): Case study · OpenSpy Core reconstructs GameSpy online services as separate processes communicating through HTTP, AMQP, and Redis. Its QR service handles ASCII V1 and binary V2 formats, while server browsing supports legacy and enctypex variants. Other implemented services cover NAT negotiation, presence, account search, game statistics, chat, and selected EA FESL traffic.
- [OpenSnell: reconstructing the Snell v4/v5 proxy protocol](https://awesomerea.org/resources/opensnell-case/index.md): Case study · OpenSnell reconstructs the Snell v4/v5 proxy protocol in a Go client and server. It handles TCP CONNECT, UDP over TCP, HTTP and TLS obfuscation, with v5 QUIC proxy mode on the server. The author reports interoperability against Surge snell-server v5.0.1.
- [starlink-rs: Starlink dish gRPC definitions and client](https://awesomerea.org/resources/starlink-rs-case/index.md): Case study · starlink-rs reconstructs Protobuf definitions exposed through a Starlink user terminal's gRPC server reflection and implements a Rust client for the dish. Its examples exercise request and response handling and bidirectional streaming over the local HTTP/2 endpoint.
- [Acurite 00592TX Decoder: decoding wireless sensor messages](https://awesomerea.org/resources/acurite-00592tx-decoder-case/index.md): Case study · Acurite 00592TX Decoder implements a receiver for the 433.92 MHz messages sent by AcuRite 00592TX, 06002M and 06044 temperature sensors. The author documents pulse timing, sync structure and seven-byte fields for channel, sensor ID, status, humidity, temperature and checksum. ESP32 or ESP8266 code publishes readings through MQTT and can send alarms by email or SMS.
- [Mazda MX-5 CAN DBC: inferred HS-CAN and MS-CAN signals](https://awesomerea.org/resources/mazda-mx5-can-dbc-case/index.md): Case study · Mazda MX-5 CAN DBC records independently inferred HS-CAN and MS-CAN message definitions for 2015–2023 MX-5 vehicles. The author derives signal IDs, names, scales, offsets and behavior notes from vehicle observations, logs and known specifications. Some entries remain structural placeholders or under verification.
- [DavisRFM69: receiving the reverse-engineered Davis ISS radio protocol](https://awesomerea.org/resources/davisrfm69-case/index.md): Case study · DavisRFM69 receives weather packets from the Davis Instruments Integrated Sensor Suite over its reverse-engineered radio link. The Arduino library adapts RFM69 hardware to the ISS transmissions and includes a Vantage Pro2 console emulation example for Cumulus weather software.
- [CarHack: mapping 2010 Nissan Sentra CAN messages](https://awesomerea.org/resources/carhack-nissan-sentra-can-case/index.md): Case study · CarHack documents an investigation of CAN traffic from a 2010 Nissan Sentra. Its notes describe tapping the OBD-II port with a Kvaser interface, capturing traffic with SocketCAN and can-utils, and relating vehicle controls to observed message IDs and bits.
- [HU-058D WiFi clock: reconstructing its LED display interface](https://awesomerea.org/resources/hu-058-esphome-case/index.md): Case study · The HU-058D WiFi clock investigation reconstructs how its two AiP33628 drivers control a 33-LED RGB display. Logic-analyzer captures of stock behavior inform the COM and SEG map, while protocol notes describe 30-bit frames and latch timing. ESPHome and standalone ESP32 firmware drive the panel through the recovered interface.
- [A-OK: reconstructing a 433.92 MHz remote-control protocol](https://awesomerea.org/resources/a-ok-rf-protocol-case/index.md): Case study · A-OK implements the 433.92 MHz remote-control protocol used by AC114-01B controls for roller shades and projector screens. Arduino sketches capture 65-bit commands and transmit pairing, movement and stop commands; the README identifies tested motors and RF receivers.
- [Q-Hub Relay Control: reconstructing an OTAQ relay protocol](https://awesomerea.org/resources/qhub-relay-control-case/index.md): Case study · Q-Hub Relay Control implements a browser-operated client for the OTAQ Q-Hub relay board using a protocol recovered from the vendor's Windows utility. Its documentation specifies TCP command frames, a Fletcher-style checksum, UDP discovery and status replies, including observed inaccuracies in device status fields.
- [Markisol: reconstructing 433.92 MHz shade commands](https://awesomerea.org/resources/markisol-shade-protocol-case/index.md): Case study · The Markisol investigation captures 433.92 MHz commands from motorized-shade remotes and reuses their 41-bit messages from Arduino or Raspberry Pi control code. It documents remote IDs, capture steps and example pairing, up, down and stop commands for compatible shades.
- [Huawei R48xx: mapping the power supplies' CAN protocol](https://awesomerea.org/resources/huawei-r48xx-can-protocol-case/index.md): Case study · Huawei R48xx documents the CAN communication of Huawei 48 V power supplies, including 29-bit identifier fields, status commands, registers and software address negotiation between units. The author combines tests on R4830S1, R4850G2 and R4850G6 with other documentation. The repository also records connector pinouts and printable enclosure models.
- [OpenChirp: reconstructing the Chirp audio protocol](https://awesomerea.org/resources/openchirp-audio-protocol-case/index.md): Case study · OpenChirp reconstructs the Chirp data-over-audio protocol in an Android transmitter and receiver example. Its notes describe the frequency alphabet, payload and header frames, and Reed–Solomon error symbols, with an Octave walkthrough of the encoding.
- [Photo!: reconstructing Game Boy Camera sensor and transfer behavior](https://awesomerea.org/resources/photo-game-boy-camera-case/index.md): Case study · Photo! extends Game Boy Camera behavior in a replacement ROM using sensor rules assessed from MAC-GBD communication logs. It exposes manual sensor controls, changes printing speed, and defines a fast image transfer exchange using the standard printer INIT packet followed by a 0x10 packet carrying 3,584 image bytes. The source includes Game Boy and Game Boy Color builds.
- [Xbox Live Machine Account Creation Service: reconstructing authentication exchanges](https://awesomerea.org/resources/xbox-live-macs-case/index.md): Case study · Xbox Live Machine Account Creation Service investigates Xbox Live 1.0 authentication exchanges through a C# replacement service. The author reports parsing AS-REQ messages, decrypting encrypted timestamps and constructing AS-REP responses, while the service remains incomplete.
- [Quansheng UV-K5: programming protocol and memory-map investigation](https://awesomerea.org/resources/uvk5-reverse-engineering-case/index.md): Case study · The Quansheng UV-K5 investigation examines the radio's programming exchanges and memory contents to support open-source radio software. It includes captured read and write traffic, a deobfuscation script, a recovered memory-map spreadsheet, and an experimental CHIRP driver.
- [TSP143IIIU: reconstructing StarIO printer exchanges for a USB-to-Wi-Fi bridge](https://awesomerea.org/resources/tsp143-stario-protocol-case/index.md): Case study · TSP143IIIU Wi-Fi Print Bridge reconstructs StarIO exchanges so a Raspberry Pi can present a USB-only receipt printer to Shopify POS as a Star LAN printer. Its protocol research documents UDP discovery packets, USB and LAN ASB frame differences, ETB counters, and TCP/9101 status polling from hardware captures.
- [AirVideo for Ruby: reconstructing server communication](https://awesomerea.org/resources/airvideo-ruby-protocol-case/index.md): Case study · AirVideo for Ruby implements a client for the AirVideo server from a reverse engineered communication protocol. It browses folders and videos and obtains playable or live transcoded video URLs, with options for output dimensions.
- [OpenRad: a Radmin VPN client and wire-format reimplementation](https://awesomerea.org/resources/openrad-case/index.md): Case study · OpenRad reimplements Radmin VPN as a Rust desktop and command-line client with a virtual Ethernet interface. Its documented wire format and transport engine cover network membership, peer authentication, direct TCP and UDP connections, and relay fallback; Android, Python and Minecraft clients share the format.
- [FANUC RMI Mock: reconstructing a controller server](https://awesomerea.org/resources/fanuc-rmi-mock-case/index.md): Case study · FANUC RMI Mock reconstructs the server side of the Remote Motion Interface from fanuc_ucl's published client models. Its Python TCP server handles the connection handshake and motion-command stream, forwarding joint setpoints to a simulated Moveo arm or optional robot bridges.
- [openfsd: reconstructing the VATSIM FSD server protocol](https://awesomerea.org/resources/openfsd-case/index.md): Case study · openfsd implements a multiplayer flight-simulation server for the reverse-engineered VATSIM FSD protocol. Its Go server connects pilots and controllers, while a detailed protocol reference maps message identifiers and its web interface manages users, settings and connections.
- [Google Wifi API: discovered router HTTP endpoints](https://awesomerea.org/resources/google-wifi-api-case/index.md): Case study · Google Wifi API documents HTTP endpoints discovered on Google Wifi Router and OnHub. It records status, connected-device, configuration and setup routes, including required Host headers, POST payloads and a captured JSON response.
- [UniFi Protect API: decoding the updates WebSocket protocol](https://awesomerea.org/resources/unifi-protect-updates-protocol-case/index.md): Case study · UniFi Protect API is a TypeScript client that decodes the controller's undocumented updates WebSocket protocol. Its documentation records the four-frame packet layout, eight-byte headers and payload formats, while the library turns the stream into typed camera and doorbell events.
- [Chiaki: PlayStation Remote Play client informed by protocol analysis](https://awesomerea.org/resources/chiaki-remote-play-case/index.md): Case study · Chiaki implements a PlayStation 4 and 5 Remote Play client for desktop, mobile, and Nintendo Switch platforms. The project credits analysis of the registration and wakeup protocols and documents console discovery, account identification, PIN registration, and source builds.
- [esp8266-midea-dehumidifier: rebuilding dehumidifier serial control](https://awesomerea.org/resources/esp8266-midea-dehumidifier-case/index.md): Case study · esp8266-midea-dehumidifier replaces a Midea-made dehumidifier's Wi-Fi dongle with an ESP8266 adapter that speaks to the unit over TTL serial and exposes controls through MQTT. The author says its control logic draws on Android app reverse engineering and UART traffic analysis.
- [castv2: reconstructing the Chromecast CASTV2 protocol](https://awesomerea.org/resources/node-castv2-case/index.md): Case study · castv2 documents and implements the Chromecast CASTV2 protocol over TLS. Its Node.js client exchanges length-prefixed Protocol Buffers messages with a dongle, and its protocol notes describe namespaces, virtual connections, heartbeat messages and device authentication.
- [wycliffe: a clean-room Dante protocol implementation](https://awesomerea.org/resources/wycliffe-case/index.md): Case study · wycliffe is a clean-room implementation of the Dante protocol for uncompressed, multichannel, low-latency digital audio over Ethernet. Its notes record observed Dante packets, including channel labels and a session handshake.
- [ps4-waker: a client for the PS4 companion app protocol](https://awesomerea.org/resources/ps4-waker-case/index.md): Case study · ps4-waker implements the PlayStation App's local PS4 discovery and control exchanges in a command-line tool and JavaScript API. It responds to app broadcasts and simulates registration to obtain credentials, then authenticates over the app's TCP protocol to wake the console or send control commands.
- [NJUConnect: reconstructing the NJU EasyConnect VPN client](https://awesomerea.org/resources/njuconnect-vpn-protocol-case/index.md): Case study · NJUConnect implements a Go client for Nanjing University's EasyConnect VPN service using a custom TLS ClientHello and separate tunnel receive and transmit handshakes. Its code handles web login, token exchange, IP assignment and a SOCKS5 endpoint backed by gVisor networking.
- [LGTV: reconstructing LG webOS TV control exchanges](https://awesomerea.org/resources/lgtv-js-case/index.md): Case study · LGTV reconstructs control of a 2014 LG webOS TV in a Node.js client. The author documents SSDP discovery, WebSocket pairing on ports 3000 and 3001, and cleartext JSON requests observed with network tools, then uses them for input, volume and app controls.
- [Inferno: implementing Dante audio networking](https://awesomerea.org/resources/inferno-dante-protocol-case/index.md): Case study · Inferno implements Dante audio networking on Linux from reverse-engineered protocol behavior. Its Rust components send and receive audio with Dante devices, while an ALSA virtual soundcard and a raw-audio pipe adapter expose streams to local applications.
- [Lutron Protocols](https://awesomerea.org/resources/lutron-protocols/index.md): Project · Lutron Protocols researches CCA radio packets, CCX Thread and CoAP messages, the LEAP processor API and IPL Designer integration frames for Lutron lighting systems. Its documentation covers device behavior and firmware, while TypeScript tools capture and decode traffic and parse Designer project files.
- [NearDrop](https://awesomerea.org/resources/neardrop/index.md): Project · macOS menu bar app that partially implements Nearby Share and Quick Share to exchange files and links with Android devices. Its protocol document describes the protocol as understood from Chromium sources and a decompiled Google Services Framework APK.

## Agents and MCP (44)

- [Hex-Rays IDA MCP](https://awesomerea.org/resources/hex-rays-ida-mcp/index.md): Integration · Official Hex-Rays MCP server for agent access to IDA databases, with headless operation and optional GUI integration.
- [Game Decompilation Skill For Claude](https://awesomerea.org/resources/claude-game-decompilation-skill/index.md): Tool · Game Decompilation Skill For Claude is a set of Claude Code skills for building a byte-matching decompilation of a game. The skills describe the method, and each game repository supplies its own commands through an AGENTS.md file.
- [/re](https://awesomerea.org/resources/re-skill/index.md): Tool · /re is a Claude Code skill that bootstraps a reverse-engineering workspace from a ROM or binary and then disassembles, annotates, extracts assets, and ports the game to a web canvas. The README documents /re with a path, /re with no arguments, and re_loop.sh.
- [Console skill](https://awesomerea.org/resources/console-skill/index.md): Tool · The Console skill is a set of eleven skill folders and Python 3.8 tools for driving a PlayStation 2 port. The recompiler is PS2Recomp, which needs CMake 3.20 or newer and a C++20 compiler. The reverse skill maps the boot ELF and functions. Separate skills cover the IOP backend, graphics, controllers, mods, levels, sound, physics, saves, and packaging for Windows, macOS, Linux, Steam Deck, Android, and PS Vita. Ghidra with the EmotionEngine Reloaded extension is recommended. Claude Code can install the pack with /plugin marketplace add Jakeschincariol/console-skill.
- [Official reverse-engineer-anything skill](https://awesomerea.org/resources/rea-official-skill/index.md): Integration · Target routing, connection recovery and evidence practices for agents using REA.
- [dsh-mcp-rea](https://awesomerea.org/resources/dsh-mcp-rea/index.md): Integration · A community MCP bridge presents a smaller selected tool surface and forwards explicit commands to the REA CLI.
- [rea-jev](https://awesomerea.org/resources/rea-jev/index.md): Integration · A Claude Code plugin adds Jev-based routing and evidence checks around a pinned REA MCP integration.
- [rea-casebook](https://awesomerea.org/resources/rea-casebook/index.md): Integration · A Claude Code mod collects received REA Evidence, tracks unknowns and records findings that cite delivered evidence IDs.
- [Eleven](https://awesomerea.org/resources/eleven-agent-re-workbench/index.md): Integration · An agent-first desktop reverse-engineering app that opens Mach-O, ELF and PE binaries, Android packages and GPU kernels, and lets any Agent Client Protocol agent read code, rename functions, add notes and propose patches in a shared window. Native code is decompiled by Ghidra through a bundled REA build, with Rizin and jadx as alternative engines. It is a workbench around existing engines.
- [REA plugin for Hermes Agent](https://awesomerea.org/resources/hermes-rea-plugin/index.md): Integration · Nous Research’s Hermes Agent plugin package for REA. One catalog install registers REA’s MCP server, pinned to rea-agents 6.4.0 and launched through npx over stdio, with REA’s workflow skill adapted for Hermes and a separate crash-triage skill. About 170 REA tools stay behind Hermes’ on-demand tool search, and the adapted skill asks before tools that run programs, drive apps or change a connected Android device.
- [crashlens](https://awesomerea.org/resources/crashlens-rea-crash-triage/index.md): Integration · A crash-triage tool that turns Linux core dumps, runtime panics, exception traces and sanitizer reports into Markdown bug reports naming the crash type, the first frame in the user’s code and a stable signature. Its core-dump path calls the REA CLI to read the recorded crash and the binary layout, and can ask REA’s Ghidra provider for pseudocode of stripped functions; a Claude Code plugin bundles a skill and read-only MCP tools. It is an REA debugging integration with author-reported diagnostic accuracy.
- [REA Workspace Template](https://awesomerea.org/resources/rea-workspace-template/index.md): Integration · A clone-first Chinese workspace template for analyzing one target per workspace with REA from Claude Code or Codex. It ships project-level REA MCP settings, agent rules that require CONFIRMED/GUESS labels with evidence locations, seven task prompts and standard-library scripts that hash imported originals, stage writable copies and strip values from HAR captures. It organizes analysis rather than performing it, and its acceptance run used only synthetic samples.
- [REA Reconstruction Companion](https://awesomerea.org/resources/rea-reconstruction-companion/index.md): Integration · A third-party Agent Skill that works alongside REA’s own skill to turn reverse-engineering evidence into scoped requirements, design, staged implementation and validation, from one feature or format to a whole app. An optional installer can add a marked routing block to the user’s REA SKILL.md so that relevant reconstruction requests load both skills. Its bundled evaluation kit provides source-exposed, maintainer-authored examples with literal oracles for example-level checks.
- [App X-Ray](https://awesomerea.org/resources/app-xray-rea-evidence-reports/index.md): Integration · Builds evidence-linked HTML/JSON reports, summary cards and diffs from REA analysis of app packages, native build metadata and model files. Its component and configuration findings come from static inputs.
- [Decepticon: REA reversing service and subagent tools](https://awesomerea.org/resources/decepticon-rea-reverser/index.md): Integration · An optional reversing workload in BitterSecurity’s Decepticon wraps rea-agents and Ghidra inside a dedicated HTTP/MCP container and exposes three tools to its reverser subagent. It pins the inspected binary by SHA-256 and exports REA Evidence files to the shared workspace before returning results.
- [GhidraMCP](https://awesomerea.org/resources/ghidramcp/index.md): Integration · Ghidra extension and MCP bridge exposing decompilation, symbol navigation and renaming to agents, with GUI and headless modes.
- [Binary Ninja MCP (official)](https://awesomerea.org/resources/binary-ninja-official-mcp/index.md): Integration · Binary Ninja's own MCP interface exposes functions, symbols, disassembly, intermediate languages and decompiled text to agents.
- [Binary Ninja MCP (fosdickio)](https://awesomerea.org/resources/binary-ninja-community-mcp/index.md): Integration · Community Binary Ninja plugin and bridge for MCP clients, including workflows that switch among multiple open binaries.
- [IDA Pro MCP (mrexodia)](https://awesomerea.org/resources/ida-pro-mcp-community/index.md): Integration · Community IDA integration useful for existing setups and migration context; its maintainer now recommends the official Hex-Rays MCP server.
- [Radare2 MCP Server](https://awesomerea.org/resources/radare2-mcp/index.md): Integration · Native radare2 MCP server offering binary-analysis tools, reusable sessions and configurable read-only access.
- [r2ai](https://awesomerea.org/resources/r2ai/index.md): Integration · AI plugins inside radare2 for function explanations, naming suggestions and model-assisted decompilation using local or remote models.
- [DAILA](https://awesomerea.org/resources/daila/index.md): Integration · Decompiler-independent AI assistant for function summaries and naming across IDA, Ghidra, Binary Ninja and angr-management.
- [RevEng.AI Ghidra Plugin](https://awesomerea.org/resources/revengai-ghidra/index.md): Integration · Connects Ghidra to RevEng.AI for function similarity, recovered names, AI explanations and agent-assisted annotation.
- [LLDB MCP](https://awesomerea.org/resources/lldb-mcp/index.md): Integration · LLDB's official MCP interface gives agents debugger sessions and commands for breakpoints, memory inspection and stepping.
- [Claude Reverse Engineering Skill](https://awesomerea.org/resources/claude-reverse-engineering-skill/index.md): Integration · Community agent skill for triage, headless exports and evidence-based RE reports; explicitly documents workflows with REA and other MCP servers.
- [SpecterOps Reverse Engineering Skills](https://awesomerea.org/resources/specterops-re-skills/index.md): Integration · Focused Binary Ninja and Ghidra analysis skills that describe MCP tool use, analysis recipes and annotation practices.
- [pyghidra-mcp](https://awesomerea.org/resources/pyghidra-mcp/index.md): Integration · PyGhidra-based MCP server that analyzes every binary in a Ghidra project and exposes decompilation, cross-references, call graphs, symbol and string search, indexed semantic code search, and renaming, typing and comment edits. A separate HTTP CLI client and an optional mode driving a Ghidra GUI it launches are included.
- [LeanREA](https://awesomerea.org/resources/leanrea-skill/index.md): Integration · An independent agent skill that routes application and binary investigations through ordinary command-line tools. It supplies batched triage recipes, targeted source/disassembly reading and explicit seen/inferred/unknown evidence labels, accompanied by a small author-reported comparison against an REA MCP workflow.
- [Universal Modder](https://awesomerea.org/resources/universal-modder-agent-toolkit/index.md): Integration · Packages agent skills, three role briefs, a Python CLI and preconfigured fal MCP settings for modding PC games the user owns. Its reverse-engineering guidance sends managed, native and data-format work to external decompilers and debuggers, and requires a round-trip check before a reverse-engineered file format is used; one worked example ships an Age of Empires II sprite writer built this way. It is a modding toolkit with agent-written field notes and project-reported example results.
- [ReVa (Reverse Engineering Assistant)](https://awesomerea.org/resources/reva-ghidra-mcp/index.md): Integration · Ghidra extension that runs an MCP server inside Ghidra, giving agents decompilation with namespace and cross-reference context, symbol, string, data-type, structure and call-graph tools, program diffing, renaming and PyGhidra scripting. Its README attributes the project's distinction to tool design for LLM use: many small tools whose schemas tolerate other input, redirect correctable mistakes and return short fragments linked to related information. Assistant mode serves an open Ghidra project to several clients at once; headless mode starts Ghidra itself with session-scoped projects.
- [x64dbg-MCP Server](https://awesomerea.org/resources/x64dbg-mcp-server/index.md): Integration · Native x64dbg plugin, written in Zig for both x32dbg and x64dbg, that serves an MCP endpoint over streamable HTTP and SSE from inside the debugger. Agents can load or attach to a process, set software, hardware, memory and conditional breakpoints, step and trace, read registers, call stacks, threads, memory maps, imports, strings and cross-references, and run arbitrary x64dbg commands. A bundled SKILL.md guide tells agents to confirm the debugger state before every action.
- [mcp-windbg](https://awesomerea.org/resources/mcp-windbg/index.md): Integration · Independent, community-built MCP server that runs Microsoft's cdb.exe and kd.exe headless, so agents can open and triage user-mode and kernel crash dumps, attach to cdb remote debug servers and KD kernel targets, and run arbitrary debugger commands in separately addressed sessions. Its README directs users seeking AI inside WinDbg to Microsoft's official WinDbg MCP and describes this project as a wrapper for other MCP clients, remote HTTP use and batch dump triage that runs debugger commands.
- [Wireshark MCP](https://awesomerea.org/resources/wireshark-mcp/index.md): Integration · MCP server that wraps tshark, and optionally other Wireshark command-line tools, so agents can query saved captures through Wireshark's dissectors: packet lists and details, stream following, arbitrary field extraction, protocol hierarchies and conversations, decode-as rules for non-standard ports, protocol preferences, TLS and WPA decryption with user-supplied keys, and one tool that applies preset fields and filters for 25 protocols such as Modbus, S7comm, MQTT, Zigbee and BLE. Separate security-heuristic, live-capture and capture-editing tools sit beside the dissection tools.
- [BINNY](https://awesomerea.org/resources/binny-agent-harness/index.md): Integration · An open-source terminal agent harness from OpenBin that runs a user-chosen hosted or local model over binary-analysis data. It reads decompiled functions, strings, imports and data from an OpenBin or OpenAPK project or a local Ghidra container run, follows triage, investigation and drafting playbooks, and saves a draft malware-analysis or vulnerability-research report for human review.
- [decomp.wtf](https://awesomerea.org/resources/decomp-wtf-agent-decompilation/index.md): Integration · A discontinued local app and MCP server that hands AI coding agents one function of a user-owned console game at a time, compiles each C attempt with the game’s period compiler and accepts it only when the linked result matches the original bytes. It can start a project from a ROM or disc image, or work inside forks of public decompilation projects listed on decomp.dev, where objdiff judges the result. Its final commit, dated 15 October 2026, marks it discontinued in response to opposition in the decompilation community; the code stays under MIT without further fixes or releases.
- [Claude Intercept](https://awesomerea.org/resources/claude-intercept-traffic-capture/index.md): Integration · A local man-in-the-middle proxy and dashboard that captures HTTP/S traffic from the user’s own computer and devices, stores it in SQLite and hands it to Claude Code through an /intercept skill and CLI. Exports such as API documentation and traffic summaries support investigating request patterns and undocumented endpoints. It is an agent-facing capture tool for authorized testing.
- [Ghidra MCP Server (bethington)](https://awesomerea.org/resources/ghidra-mcp-bethington/index.md): Integration · A Ghidra GUI plugin, standalone headless server and Python MCP bridge exposing a 209-tool catalog: decompilation, cross-references, renaming, typing, structures, comments and batch edits, plus P-code emulation, live debugging through Ghidra’s TraceRmi framework, shared Ghidra Server repository and version-control operations, and hash-based transfer of function documentation between binary versions. The bridge loads three tool groups on connect and lets the model search for and load the rest, while naming and type conventions are enforced in the tool layer. Its NOTICE says it began as a derivative of LaurieWired’s GhidraMCP in August 2025 and has since been substantially rewritten and extended.
- [DecompilerServer](https://awesomerea.org/resources/decompilerserver-dotnet-mcp/index.md): Integration · Stdio MCP server built on the ICSharpCode.Decompiler engine that lets agents load managed .NET assemblies, including a Unity game's Assembly-CSharp.dll located from its game directory, then search symbols, string literals and attributes, read decompiled C# or IL, and trace callers, callees, usages and inheritance. Several assemblies stay loaded under aliases, so an agent can compare two versions structurally or diff individual method bodies, the README's example being RimWorld mod porting. Modding-oriented tools generate Harmony patch skeletons, detour stubs and transpiler anchor suggestions as text from the inspected members.
- [Gepetto](https://awesomerea.org/resources/gepetto/index.md): Integration · IDA Pro plugin that sends Hex-Rays pseudocode to a hosted or local language model the user selects, to explain a function, comment it or propose new variable and function names, which the user picks from before they are applied. A chat console inside IDA also lets the model call tools that read disassembly, decompilation, cross-references, strings and types, rename and comment the database and run Python. The README warns that these general-purpose models may well be wrong and asks users to treat every result critically.
- [GhidrAssistMCP](https://awesomerea.org/resources/ghidrassistmcp/index.md): Integration · Ghidra extension that runs an MCP server inside Ghidra over streamable HTTP and legacy SSE, with 100 explicitly named tools (93 enabled by default) for pseudocode, disassembly, P-code, control-flow and call graphs, cross-references, strings, imports and exports, plus renaming, retyping, comments and structure inference. Since version 3.0.0 the server starts with the project manager, so agents can create, open, save and close projects and open programs before a CodeBrowser exists, while one shared server tracks whichever CodeBrowser window has focus. Six program resource templates, seven analysis prompts and a bundled script for running the server under analyzeHeadless complete the package.
- [Android Reverse Engineering Skill](https://awesomerea.org/resources/android-reverse-engineering-skill/index.md): Integration · Claude Code plugin and agent skill that drives jadx and Fernflower/Vineflower to decompile Android APK, XAPK, JAR and AAR files and document their HTTP APIs. A fingerprint pass first identifies the app's framework, HTTP stack, obfuscation level and native libraries, then shell scripts extract endpoints and authentication patterns across Retrofit, OkHttp, Volley, Ktor and Apollo/GraphQL, trace call flows from UI down to the network layer, and rebuild original Kotlin class names from the metadata R8 leaves behind. It installs through the bundled Claude Code marketplace, and its scripts also run standalone with a /decompile slash command.
- [Reverify](https://awesomerea.org/resources/reverify-claim-verifier/index.md): Integration · Python CLI and stdio MCP server that checks a model’s structured claims about a binary, such as bytes or typed values at an offset, strings, imports and exports, instruction mnemonics, emulation results and tested or Z3-proved equivalence, and returns VERIFIED, REFUTED or INCONCLUSIVE with the evidence the tools observed. Grounded and refuted results are kept in a per-binary ledger on disk, so a reset or later session resumes from them instead of from a summary, and a reconstruct loop has a model propose claims until an informative set verifies. A separate rollover command replaces context compaction in Claude Code, Codex, Gemini CLI or OpenCode with file hand-offs and fresh sessions.
- [DecompAI](https://awesomerea.org/resources/decompai/index.md): Integration · Gradio chat application whose LangGraph ReAct agent analyses an uploaded x86 Linux ELF binary: it lists and disassembles functions, decompiles them with Ghidra, drives radare2 and gdb, and runs shell commands and Python scripts in a privileged Kali Linux runner container. Workspaces are keyed by the binary’s SHA-256, so uploading the same file again restores the session. It came out of a school research project, and its CTF results are the authors’ own report.
- [Kong](https://awesomerea.org/resources/kong-agentic-reverse-engineer/index.md): Integration · Command-line pipeline that runs Ghidra in-process through PyGhidra and asks Claude, OpenAI or OpenAI-compatible models to name the functions, types and parameters of a stripped binary, working bottom-up through the call graph so callers see already-named callees. It matches known library and cryptographic signatures first, sends functions whose decompilation looks obfuscated through a tool-using deobfuscation pass with z3-based simplification, applies results to the Ghidra program and exports annotated C and an analysis.json file. Its README calls it the first agentic reverse engineer; that label and its accuracy and cost figures are the author’s claims.