# Curated reverse engineering resources · Page 51

> Page 51 of 52, entries 5,001–5,100. 5,191 tools, projects, integrations, case studies, and references for websites, games, apps, native binaries, firmware, and communication protocols.

Source-reviewed means descriptions were checked against primary documentation. Each entry page lists the full requirements and sources; this page shows their counts and the review date.

- HTML: <https://awesomerea.org/resources/page/51/>
- JSON: <https://awesomerea.org/api/v1/resources.json>
- 简体中文: <https://awesomerea.org/zh/resources/page/51/index.md>

## Agents and MCP (47)

- [Co-op Anything](https://awesomerea.org/resources/coop-anything/index.md): Integration · Agent playbook, skill set and stdio MCP server for adding online or split-screen co-op to single-player games the players already have installed. Agents either revive an existing co-op mod or reverse engineer the game and engine to build one, test it with in-game bots and send their notes back, while the MCP server searches a directory of 223 co-op projects and 32 open gaps, detects a game’s engine from its install folder and records the executable’s identity. Its README and reverse-engineering skill pair it with REA for native code, and two game write-ups report observations made through REA’s Ghidra lane.
- [DeepExtract (DeepExtractIDA)](https://awesomerea.org/resources/deepextract-ida/index.md): Integration · IDA Pro 9.x plugin and PowerShell batch extractor that turn Windows PE files into material AI coding agents can read: a per-binary SQLite database of PE metadata, signatures, disassembly, Hex-Rays pseudocode, cross-references, strings, stack frames, loops and dangerous API calls, plus optional grouped C++ and assembly files with per-function caller, callee and string headers and JSON indexes. It runs headless over directories, file lists or the modules of a running process, or interactively on the open IDA database, keeping the analyst’s renames and comments. The agent commands that work on this output come from the separate DeepExtractRuntime project.
- [Mizuchi](https://awesomerea.org/resources/mizuchi-matching-decompilation-pipeline/index.md): Integration · Plugin pipeline for matching decompilation that loops over functions in an existing decomp project: m2c drafts C, decomp-permuter mutates it, Claude rewrites it through a compile-and-diff tool, and objdiff accepts a result only when the compiled object matches the target assembly. A local Decomp Atlas web app indexes matched and unmatched functions with call graphs and code embeddings, helps pick the next function and builds prompts, while HTML reports summarise each run. An optional integrator places matched C into a git worktree, checks the build and can commit, push or open a PR.
- [ReAgent](https://awesomerea.org/resources/reagent-cpp-reconstruction-agent/index.md): Integration · An open-source Python agent, published on PyPI as auto-re-agent, that drafts C/C++ implementations of functions in a compiled program from Ghidra evidence and has a separately configurable checker model review each draft in a bounded fix loop. A candidate is accepted only after a structural comparison with the decompile, assembly, control-flow and P-code evidence, the project’s own build, test and optional differential commands, and 11 heuristic parity signals. The README treats these gates as conservative evidence, with equivalence still unverified. The tool writes candidates to an overlay, leaving the source tree unpatched.
- [lisa.py](https://awesomerea.org/resources/lisa-lldb-mcp/index.md): Integration · LLDB extension that adds an MCP bridge to a debugging session, adapted from ida-pro-mcp: the plugin's mcp start command serves 18 debugger functions over local JSON-RPC, and a FastMCP stdio server generated from those functions exposes them to MCP clients such as Claude Desktop. The tools create, launch or attach to targets, step, manage breakpoints, read backtraces, variables, disassembly and memory, evaluate expressions and run arbitrary LLDB commands. The same script keeps lisa.py's earlier exploit-development helpers, including checksec, a register and stack context view, Mach-O header and load-command display, Capstone disassembly and an exploitable crash-triage command.
- [WireMCP](https://awesomerea.org/resources/wiremcp/index.md): Integration · Node.js MCP server that runs Wireshark's tshark for LLM clients, aimed in its README at threat hunting, network diagnostics and anomaly detection. Three tools capture a few seconds of live traffic and return either a fixed set of IP, port, TCP-flag and HTTP fields, tshark's protocol-hierarchy statistics or TCP conversation statistics; analyze_pcap returns IPs, ports, HTTP URLs and protocol stacks from a saved capture. The remaining tools match captured IPs against the URLhaus blocklist and scan a capture for HTTP Basic, FTP, Telnet and Kerberos credentials, beside the dissection output.
- [ReverserAI](https://awesomerea.org/resources/reverser-ai/index.md): Integration · Binary Ninja plugin that suggests function names from HLIL decompiler output with a language model run locally through llama.cpp; the README says it operates entirely offline once the model is downloaded. It can rename the current function, every function still carrying a default sub_ name in call-graph post-order, or only those referencing strings and imported or library symbols. The author presents it as a research proof of concept whose only implemented task is function naming.
- [WPeGPT](https://awesomerea.org/resources/wpegpt/index.md): Integration · IDA plugin, formerly WPeChatGPT and inspired by Gepetto, that sends the Hex-Rays pseudocode of a function to an OpenAI-compatible model (OpenAI, DeepSeek or another compatible endpoint) and writes the model's analysis back into IDA as comments. Interactive actions explain a function's purpose and behavior, suggest variable names, re-express small routines such as XOR decoding in Python and flag potential vulnerabilities. Version 3.0 adds WPeServer, a TCP command server inside IDA through which an external controller or the separate wpegpt-analyzer skill runs headless light, full or vulnerability-focused passes, with string classification, network-indicator extraction, function suspiciousness scoring and JSON plus Markdown reports.
- [IDAssist](https://awesomerea.org/resources/idassist/index.md): Integration · IDA Pro plugin by Jason Tang, who also wrote GhidrAssist, that adds a dockable PySide6 panel for LLM-assisted analysis of the open database. Its tabs explain decompiled or disassembled functions with a security summary, keep persistent chats with context macros and an optional ReAct agent mode, propose function, variable and type renames for review before they are applied, and build a semantic knowledge graph of functions, calls, data flows and security traits, with retrieval over reference documents the analyst adds. Models can call built-in IDA tools or external MCP servers, and a SymGraph tab imports and publishes names, types and graph data through the hosted symgraph.ai service.
- [GhidraGPT](https://awesomerea.org/resources/ghidragpt/index.md): Integration · Ghidra extension that sends one function’s decompiled C to a hosted or local language model the user selects and streams the answer into a GhidraGPT console. Its three actions, offered in the Decompiler and Listing context menus, explain the function; rewrite it by writing recovered function, parameter and variable names, types, the prototype and inline comments back into the program; or audit it for likely security issues. Every action uses only the current function’s decompiler output, and the README calls audit findings leads to verify.
- [GhidrAssist](https://awesomerea.org/resources/ghidrassist/index.md): Integration · Ghidra extension by Jason Tang, who also wrote GhidrAssistMCP, that adds a tabbed GhidrAssist window to CodeBrowser for LLM-assisted analysis of the open program. Its tabs explain decompiled or disassembled functions with a security summary, keep persistent chats with context macros, MCP tool calling and an optional ReAct agent mode, propose function and variable renames, retypes and structures for review before they are applied, and build a semantic knowledge graph of functions, calls and security features with community detection, alongside Lucene retrieval over reference documents the analyst adds. A SymGraph tab imports and publishes names, types, graph data and documents through the hosted symgraph.ai service.
- [Rikugan](https://awesomerea.org/resources/rikugan/index.md): Integration · IDA Pro and Binary Ninja plugin that runs its own agent loop inside the disassembler: a model the user chooses streams its answers and calls more than 60 in-process tools for navigation, decompilation, disassembly, cross-references, strings, types, annotations, scripting and host IL or microcode edits. An orchestrator can map a binary and spawn parallel subagents, findings persist in a RIKUGAN.md file beside the database, and experimental commands apply plain-language patches or, on Binary Ninja, remove control-flow flattening and other obfuscation. README says it was vibecoded with Claude Code.
- [bn](https://awesomerea.org/resources/bn-binary-ninja-agent-cli/index.md): Integration · Agent-oriented command-line interface for the Binary Ninja database already open in the GUI, reached through a companion plugin that listens on a local Unix-domain socket. Agents read decompilation, IL, disassembly, cross-references, callsites, types and data, export multi-function bundles and run unrestricted Python inside Binary Ninja; renames and prototype, structure and type edits can be previewed, are verified after they apply and roll back on failure. Large text output spills to hashed artifact files, and a packaged Codex skill describes the workflow.
- [IDA Pro MCP Server (fdrechsler)](https://awesomerea.org/resources/mcp-server-idapro-fdrechsler/index.md): Integration · An IDA Pro plugin and a TypeScript MCP server by Florian Drechsler: the plugin starts an HTTP server inside IDA on 127.0.0.1:9045, and the stdio MCP server forwards agent requests to it. Its twelve tools run IDAPython scripts passed inline or by file path, list functions, exports and strings, search names, immediate values and byte sequences, return cross-references to and from an address, and disassemble address ranges. It is a separate codebase from the mrexodia and Hex-Rays IDA MCP servers listed here.
- [Ghidra Headless MCP](https://awesomerea.org/resources/ghidra-headless-mcp/index.md): Integration · Headless MCP server that drives Ghidra through PyGhidra and is meant to share a container with the agent. Its 212 tools in 34 groups cover program and project lifecycle, disassembly, decompilation and P-code, patching and memory edits, symbols, references, types and structure layouts, search and graph extraction, with raw Python, Java-API and script access for anything else. Programs open read-only by default, edits run in transactions with undo and redo, a fake backend lets development and CI run without Ghidra, and a ghidra_cli client exposes the same tools to shells and agents without MCP.
- [Binary Ninja Headless MCP](https://awesomerea.org/resources/binary-ninja-headless-mcp/index.md): Integration · A third-party, headless-only MCP server by Ruben Marks (mrphrazer) that gives agents a large Binary Ninja tool surface the project counts as 181 tools across 36 feature groups, including disassembly, intermediate languages, cross-references, types, search, patching with undo/redo transactions, and arbitrary scripting through binja.eval and binja.call. It speaks MCP over stdio or TCP, ships a schema-derived command-line client (binja_cli), and is meant to run in the same container as the agent runtime. A fake-backend mode runs the CLI, tests and a feature fuzzer without a Binary Ninja license, while real analysis needs a headless-capable license.
- [IDA-Skill](https://awesomerea.org/resources/ida-skill-malware-analysis/index.md): Integration · Agent skill that has an AI agent triage malware samples statically in IDA Pro through headless idat. An initialization script builds the IDA database and exports a summary, imports, exports, entry-point decompilation and filtered strings, and an executor runs IDAPython snippets or files against that database. SKILL.md sets a static-only rule, a top-down method and a rule to hand large string dumps to a sub-agent, and bundled scripts add cryptographic-constant detection, an export-size check and REAI, which sends decompiled functions to a configured OpenAI-compatible model to describe them and rename them with an AI_ prefix.
- [BinAssist](https://awesomerea.org/resources/binassist/index.md): Integration · Binary Ninja plugin by Jason Tang, who also wrote GhidrAssist and IDAssist, that adds a BinAssist sidebar for LLM-assisted analysis of the open binary. Its tabs explain functions at the LLIL, MLIL and HLIL levels and individual instructions, keep chats with context macros, MCP tool calling and an optional ReAct agent mode, propose function and variable renames, retypes and structures with confidence scores for review before they are applied, and build a semantic graph of functions and calls with community detection and source-to-sink taint paths, alongside retrieval over reference documents the analyst adds. A SymGraph tab imports and publishes names, graph data and documents through the hosted symgraph.ai service.
- [Reversecore MCP](https://awesomerea.org/resources/reversecore-mcp/index.md): Integration · MCP server that puts radare2 with r2ghidra, LIEF, Capstone, YARA, CAPA, Detect It Easy, binwalk, angr, Volatility3, Scapy, Sleuth Kit and other engines behind 177 typed tools for AI clients such as Claude and Cursor. The tools cover disassembly and decompilation, binary parsing, string, IOC and capability extraction, ESIL emulation and symbolic execution, YARA scanning, memory, PCAP and disk forensics, source-code pattern scanning and session reports with MITRE ATT&CK mapping, alongside 22 guided analysis prompts and per-binary MCP resources. File access is confined to a configured sample workspace, and the server runs over stdio or HTTP/SSE, typically from the project's Docker image.
- [AutoProber](https://awesomerea.org/resources/autoprober/index.md): Integration · Flying-probe control stack meant to let a coding agent or an operator take a circuit board on a GRBL 3018-style CNC from locating it on the plate, through XYZ-tagged USB-microscope frames and an annotated map of pads, pins and chips, to probing targets the operator has approved. Python wrappers, a Flask dashboard and AGENTS.md safety rules run every move under an oscilloscope-monitored optical endstop that triggers feed hold and a STOP state with no automatic recovery. The published code covers device control, camera-to-motion calibration and map and probe-candidate review; the README presents locating, stitching and annotating the board as agent tasks.
- [ToCode](https://awesomerea.org/resources/tocode/index.md): Integration · Python CLI that exports a binary, IDA database, Android APK, .NET assembly or whole application folder into a source-like project tree for coding agents: recovered C (Java for APKs, C# and IL for .NET) with matching assembly and function summaries, recovered headers and types, section dumps, JSON indexes of functions, strings, imports, exports, reachability and call-graph clusters, and generated AGENTS.md and CLAUDE.md files. It drives IDA, Binary Ninja, radare2 with r2ghidra or angr, and for folders links each import to the defining file's function using the platform's loader rules. Its tocode mcp server keeps the decompiler open so an agent can record names, types and comments and re-render only the affected files.
- [Reverse API Engineer](https://awesomerea.org/resources/reverse-api-engineer/index.md): Integration · Python CLI that turns the HTTP traffic a website actually produces into a typed API client. A browser session, driven by the user through Playwright or by an AI agent through Playwright or Chrome DevTools MCP servers or Vercel's agent-browser CLI, is recorded to a HAR file; a coding agent run through the Claude Agent SDK, OpenCode, Cursor or GitHub Copilot then reads the capture and writes a client, README and usage example in one of ten languages. A separate collector mode gathers structured JSON/CSV data with web search and fetch.
- [OpenBaud](https://awesomerea.org/resources/openbaud-serial-device-mcp/index.md): Integration · Rust MCP server and Codex plugin that gives coding agents audited access to local serial devices, from identifying ports by USB metadata and sending framed requests to recording every received and transmitted byte in lossless .obcap captures. Device behaviour confirmed during exploration is kept as YAML device profiles, typed commands and workflows that validate checksums and decode scalars, bit fields and record arrays, and the same commands can be replayed against a capture without hardware. Its worked demo decodes OBP/1, a small binary protocol the author wrote for an ESP32-S3 test board; existing vendor protocols are outside the demo.
- [JADX MCP Server (Qtty)](https://awesomerea.org/resources/qtty-jadx-mcp-server/index.md): Integration · MCP server for Android APK analysis in which a Python FastMCP process talks to the agent over stdio and drives a long-lived local JVM daemon that embeds JADX 1.5.6 as a library, so no JADX GUI is involved and a loaded APK stays warm between sessions. Its 23 tools return classes, decompiled sources with size-capped outlines, methods, fields, smali, cross-references and callees read from a dex-derived index, type hierarchies and overrides, exported and deep-link components, the manifest and resource files, plus a whole-APK sweep for framework sink call sites grouped by impact category.
- [usb-rea](https://awesomerea.org/resources/usb-rea/index.md): Integration · Python CLI and stdio MCP server for inferring the USB protocol of a device whose only control software is a vendor app. While the user clicks through the app, it captures traffic with usbmon or USBPcap, takes a label for each action, diffs the packets per action and infers message layouts: constant bytes, rolling counters, scaled 8- to 32-bit values, lookup tables, packed bit fields and sum, XOR or CRC checksums. It also decodes device replies, handshakes with session tokens and image streams sent to device screens, links each inferred field to Wireshark frame numbers in a report, and generates a pyusb driver and a Wireshark Lua dissector.
- [IDA NO MCP](https://awesomerea.org/resources/ida-no-mcp/index.md): Integration · IDA Pro exporter that turns an analyzed binary into plain files for AI coding tools such as Cursor or Claude Code instead of serving it over MCP. It writes each decompiled function as a .c file, or as .asm when decompilation fails, under a header listing its name, address, callers and callees, along with the string, import and export tables, 1 MB hexdump chunks of every segment and logs of fallbacks, failures and skipped library functions. It ships as an IDA plugin (Export for AI, Ctrl-Shift-E) for small and medium files and as a Rust command-line binary for large or batch exports, which can skip IDA's auto-analysis.
- [ida-mcp-rs](https://awesomerea.org/resources/ida-mcp-rs/index.md): Integration · Headless MCP server written in Rust that drives IDA Pro through idalib, so agents such as Claude Code, Codex CLI, Gemini CLI or Cursor can open and analyze binaries without the IDA GUI. Apple targets are single tool calls, including universal Mach-O slice selection, dSYM/DWARF loading and dyld_shared_cache module loading; a 28-tool lean profile sits beside the full tool set, run_script executes IDAPython and returns JSON, and editing tools such as rename, comments, patches and type application each take exactly one address or exact symbol name. save_idb writes checkpoints, and crashed or wedged IDA workers are replaced automatically.
- [ida-multi-mcp](https://awesomerea.org/resources/ida-multi-mcp/index.md): Integration · MCP server that lets an agent analyze several IDA Pro databases at once through one endpoint. Each database with its plugin registers itself when opened and headless idalib sessions can be added, and a router exposes up to 76 tools for triage, decompilation and disassembly, cross-references and call graphs, search, types, renaming, comments and patching, plus analysis-wait gating so agents can wait for IDA's auto-analysis to settle; its IDA tool implementations come from the ida-pro-mcp project. Function-similarity search compares functions within or across binaries using name-independent instruction MinHash, API, string and constant anchors and control-flow shape, with optional local neural recall, and nothing is uploaded.
- [x64dbg MCP (x64dbgMCP)](https://awesomerea.org/resources/x64dbgmcp/index.md): Integration · MCP server that connects LLM clients to the x64dbg and x32dbg debuggers through a native plugin and a Python MCP script. It exposes more than 40 tools built on the x64dbg SDK and was tested with Claude and Cursor; agents can query registers, search byte patterns in a module and drive debugging sessions. The README advises giving the model the executable's full path so it can restart a crashed or hung target through the command-execution tool, and starting from GetModuleBase so that queries use valid addresses.
- [IDASQL](https://awesomerea.org/resources/idasql/index.md): Integration · SQL interface to IDA Pro databases that exposes a binary's analysis as more than 30 live virtual tables for agents and scripts. The tables cover functions, segments, names, imports, cross-references, basic blocks, instructions, strings, types, decompilation and annotations, and part of the database can be edited through them. It runs as a standalone CLI that can open raw binaries through idalib, as a plugin in IDA's command-line dropdown, as an HTTP REST or MCP server, or through a skills plugin for Claude Code, GitHub Copilot CLI and Codex, and it can work across several databases at once.
- [Exoproc](https://awesomerea.org/resources/exoproc/index.md): Integration · Exoproc exposes Windows x64 process inspection and instrumentation to agents through a CLI and MCP server. It enumerates processes, reads and scans memory, installs function detours, redirects thread contexts and compiles C snippets for execution in a target process.
- [OpenOCD SPI Dump Plugin](https://awesomerea.org/resources/claude-openocd-spi-dump/index.md): Integration · OpenOCD SPI Dump Plugin guides an agent through extracting SPI flash or EEPROM contents using a target MCU's SWD/JTAG debug connection. It supplies MCU register maps, a RAM-resident C reader, linker and OpenOCD Tcl templates, and a workflow for JEDEC identification and dump checking.
- [dos-mcp](https://awesomerea.org/resources/dos-mcp/index.md): Integration · dos-mcp connects AI agents to DOS programs running in js-dos for interactive reverse engineering. Its MCP tools send keyboard and mouse input, capture frames, exchange files with the guest and read or search emulated memory; the documentation shows a save-format comparison workflow using Ultima Underworld.
- [x64dbg MCP](https://awesomerea.org/resources/hxt9-x64dbg-mcp/index.md): Integration · x64dbg MCP gives agents debugger control over Windows binaries through a native x64dbg plugin and a C# stdio MCP server. The plugin serves local HTTP requests to x64dbg's bridge API, while MCP tools expose disassembly, memory and register access, modules, execution control, and breakpoints.
- [adb-mcp](https://awesomerea.org/resources/adb-mcp/index.md): Integration · adb-mcp gives agents structured Android Debug Bridge tools for investigating app behavior on a device. It can launch packages, inspect the UI hierarchy, capture logcat records and screenshots, retrieve files, and set up port forwarding. Its documentation shows a command sequence for investigating an in-app action through UI interaction and logs.
- [website-to-cli](https://awesomerea.org/resources/website-to-cli/index.md): Integration · website-to-cli is an agent skill for deriving terminal clients from captured website traffic. Its scripts record a HAR and filter requests to identify endpoint methods, paths, parameters, payload shapes and authentication headers. The skill then uses a Bun CLI template to build a client. The repository includes clients for crates.io and Hacker News search.
- [reverse-workbench-skill](https://awesomerea.org/resources/reverse-workbench-skill/index.md): Integration · reverse-workbench-skill is a multi-agent-harness skill bundle that routes investigations to workflows for APKs, native binaries, firmware, frontend JavaScript, and network traffic. Its documented paths include Ghidra headless exports, binary diffing, and evidence recording, alongside broader security-analysis skills and helper scripts.
- [MindNode MCP Server](https://awesomerea.org/resources/mindnode-mcp/index.md): Integration · MindNode MCP Server connects agents to MindNode Next mind maps on macOS. Its reader decodes the app's SQLite library, protobuf snapshots, Apple LZ4 compression and CRDT operations into Markdown outlines; other MCP tools return previews or create maps through MindNode's Markdown importer.
- [OGhidra](https://awesomerea.org/resources/oghidra/index.md): Integration · OGhidra is an AI integration for analyzing binaries with Ghidra through natural language. It supports function analysis, automated renaming, malware pattern detection, and either an MCP or PyGhidra backend.
- [aiDAPal](https://awesomerea.org/resources/aidapal/index.md): Integration · aiDAPal is an IDA Pro plugin that uses a locally hosted language model trained for Hex-Rays pseudocode to assist with code analysis. It presents generated changes for acceptance before updating the pseudocode.
- [x64dbg MCP Server Plugin](https://awesomerea.org/resources/x64dbg-mcp-setsuna/index.md): Integration · An MCP server plugin for x64dbg and x32dbg that lets external applications and AI agents control debugging through HTTP. It provides tools for execution, memory, registers, breakpoints, and disassembly, along with debugger context resources and workflow prompts.
- [JEB-MCP](https://awesomerea.org/resources/jebmcp/index.md): Integration · JEB-MCP is an MCP server and JEB Pro script that lets MCP clients inspect and rename elements of Android apps in JEB. Its documented commands include reading decompiled code, examining classes and methods, and renaming them.
- [re-shell](https://awesomerea.org/resources/re-shell/index.md): Integration · re-shell is a Nix flake development environment that provides Claude Code with reverse engineering tools and workflows. Its skills select guidance for Windows binaries, Android packages, and web captures based on the files being analyzed.
- [ghidra-rpc](https://awesomerea.org/resources/ghidra-rpc/index.md): Integration · ghidra-rpc is a CLI integration that lets AI coding assistants use a persistent Ghidra session for binary analysis. It returns structured JSON for tasks such as decompilation, symbol annotation, type recovery, patching, and binary version comparison.
- [r0idamcp](https://awesomerea.org/resources/r0idamcp/index.md): Integration · r0idamcp is a single-file MCP server that connects IDA Pro to an MCP-capable assistant for automated reverse engineering. Its tools expose functions, strings, decompilation, cross-references, comments, and renaming through an SSE connection.
- [SOMCP](https://awesomerea.org/resources/somcp/index.md): Integration · SOMCP is an Android MCP server for analyzing and modifying native SO libraries. It exposes ELF analysis, disassembly, patching, and optional dynamic analysis tools to MCP clients.
- [REA — Reverse Engineer Anything](https://awesomerea.org/resources/rea-upstream/index.md): Project · The upstream CLI and MCP server for evidence-based investigations of shipped software and runtime behavior.

## Related collections (33)

- [Awesome Reverse Engineering](https://awesomerea.org/resources/morluto-awesome-re/index.md): Collection · A task-oriented reverse-engineering resource list by REA's maintainer, useful for broader tools and foundations.
- [Awesome REA Cases](https://awesomerea.org/resources/awesome-rea-cases/index.md): Collection · A bilingual collection of REA and other AI-assisted reverse engineering cases, with source links and explicit distinctions between reported and reproduced outcomes.
- [awesome-rea (yibie): verification-focused projects and practice reports](https://awesomerea.org/resources/yibie-awesome-rea/index.md): Collection · Organizes AI-assisted game decompilation, native ports, static recompilation and tooling around stated acceptance checks, alongside a separate track of practitioner write-ups and discussions. Useful for finding primary reports and comparing how projects define correctness.
- [Reversed with AI](https://awesomerea.org/resources/reversed-with-ai-directory/index.md): Collection · A moderated website directory of AI-assisted reverse-engineering projects across games, firmware, file formats, APIs and protocols, apps and legacy software. Each entry links to its primary source and records the author-reported model, tools, time, cost and outcome, with four checks for public source, reproduction steps, real-hardware testing and third-party confirmation.
- [Awesome Malware Analysis](https://awesomerea.org/resources/awesome-malware-analysis/index.md): Collection · A long-running single-README list of malware analysis tools and resources, grouped into 17 top-level sections covering open-source threat intelligence, detection and classification, online scanners and sandboxes, document and shellcode analysis, deobfuscation, debugging and reverse engineering, network, memory forensics, Windows artifacts, plus books and other references. Each entry is a name linked to an external tool or resource with a short description. The repository also keeps a Simplified Chinese translation of the list.
- [Awesome Connected Things Security](https://awesomerea.org/resources/awesome-connected-things-sec/index.md): Collection · A single-README list of security-research references for IoT, embedded, industrial and automotive systems, organized into sections on hardware attacks, wireless protocols (BLE, Zigbee/Z-Wave, LoRa, Matter/Thread, cellular, NFC/RFID, Wi-Fi, USB), firmware security including extraction, static and dynamic analysis and secure boot, network and web protocols, cloud backends, mobile apps, and industrial and automotive topics. Each entry links out to an external tool, talk, paper, write-up or course with a short note. The README reports 900+ resources.
- [Awesome CAN Bus](https://awesomerea.org/resources/awesome-canbus/index.md): Collection · A single-README list of CAN bus tools, hardware and resources for automotive and embedded work, grouped into sections for reverse-engineering tools, test equipment and simulators, higher-layer protocols (OBD-II, UDS, ISO-TP, J1939, J2534), general and Linux utilities, CAN database formats (DBC, KCD) with converters, and hardware for ARM, Arduino, ESP32, single-board computers and FPGA cores. Each entry links out to an external project or resource with a short description.
- [Awesome CAN ID](https://awesomerea.org/resources/awesome-automotive-can-id/index.md): Collection · A single-README list that gathers links to CAN message identifier and payload decodings in one place, grouped by vehicle make and model under about 30 car brands and brand groups plus BMW, Ducati and KTM motorcycles. Its links lead to DBC files, decoding spreadsheets, wiki pages, sniffing notes and small libraries maintained elsewhere, after a Common section of general databases such as comma.ai’s opendbc and the OpenGarages CAN ID references.
- [Awesome REA: Reverse Engineer Anything with AI (AIshihzong)](https://awesomerea.org/resources/aishihzong-awesome-reverse-engineer-anything/index.md): Collection · An unofficial, bilingual awesome list of what AI agents have reverse-engineered and rebuilt, tagged by whether each case's own sources show that REA was used. It gathers REA's official resources and showcases; community cases in games, apps, hardware and protocols, and security evaluations; the wider wave of AI reverse engineering and clean-room rebuilds without confirmed REA; plugins, guides and research, related MCP tools, other lists and press; and a section on legal questions and controversy.
- [AI Rebuilds](https://awesomerea.org/resources/ai-rebuilds-directory/index.md): Collection · A website and GitHub list of 81 projects that rebuild existing software or games without the original source: AI-built clean-room apps such as the ArtCraft suite, software rewritten with coding agents, AI-assisted game decompilations, game engine reimplementations, human-led decompilations and ports, clean-room classics such as Wine and ReactOS, and tools for rebuilders. Each entry says what it rebuilds and carries a method label and an AI-involvement label, and the site can be searched, filtered and sorted by stars or recent activity. A separate guide describes a clean-room rebuild workflow with REA.
- [awesome-game-decompilations](https://awesomerea.org/resources/awesome-game-decompilations/index.md): Collection · A single-README list of about 480 game decompilation, recompilation and disassembly projects, grouped by console from the NES and Game Boy to the Xbox 360, PC and mobile, with a large uncategorised section. Each entry is a game title linked to its project, mostly on GitHub, and entries with AI involvement are marked with a warning emoji under the maintainer’s disclosure policy.
- [Awesome Decomp Games](https://awesomerea.org/resources/submitgame-awesome-decomp-games/index.md): Collection · A generated, rated index of public game reconstruction projects: decompilations, disassemblies, static recompilations, source ports, engine remakes and browser ports. A daily job merges several upstream lists and registries with GitHub and decomp.dev metadata, drops dead links and rebuilds the README and website from data files. Useful for discovery; its scores are automated heuristics.
- [awesome-unofficial-pc-ports](https://awesomerea.org/resources/awesome-unofficial-pc-ports/index.md): Collection · A single-README guide to unofficial PC ports of console games built from decompilations or recompilations and chosen for easy installation by players. Its 76 game entries, grouped under Nintendo, PlayStation, Xbox, SEGA, Indie and J2ME, each recommend a port with short setup notes and often link the underlying decompilation and alternative ports; a Utilities section adds two recompilation launchers.
- [awesome-decompilation](https://awesomerea.org/resources/nforest-awesome-decompilation/index.md): Collection · A short, link-only reading list on decompiling machine code, last updated in 2023. Its 45 links cover foundational theses, compiler and program-analysis books, decompiler products and projects, pipeline topics from intermediate representations to type, control-flow and identifier recovery, early neural-decompilation papers and binary-to-source matching.
- [Remade](https://awesomerea.org/resources/remade-reimplementation-directory/index.md): Collection · The source repository of remade.wiki, a community-curated directory of open-source reimplementations of closed-source software, mostly creative, productivity and engineering applications. Each listing is a YAML record naming the original software, languages, platforms, license and self-reported status, compatibility and limitations, and the directory also tracks requests for software nobody has reimplemented yet.
- [Reverse Engineering resources (wtsxDev)](https://awesomerea.org/resources/wtsxdev-reverse-engineering-list/index.md): Collection · A single-README awesome list, started in January 2017 and maintained under the KaliTut name, of 139 reverse-engineering links in 16 sections: books, courses, practice targets, hex editors, binary-format tools, disassemblers, binary analysis, bytecode analysis, import reconstruction, dynamic analysis, debugging, Mac decryption, document analysis, scripting, Android and YARA. Entries are mostly a tool or resource name with its link, a few with a one-line usage note, and lean towards Windows and macOS tooling and malware analysis.
- [Awesome Android Reverse Engineering](https://awesomerea.org/resources/awesome-android-reverse-engineering/index.md): Collection · An awesome list of Android reverse-engineering training, tools and resources started in 2023 by James Stevenson, with 92 one-line entries, 16 of them starred as great and up to date. It covers courses, videos and books; static analysis and deobfuscation, networking and Frida-based instrumentation, decompilers and malware analysis tools; documentation and case studies; CTFs and crackmes; obfuscation and anti-reversing; and a short firmware and kernel section.
- [Awesome Frida](https://awesomerea.org/resources/awesome-frida/index.md): Collection · An awesome list of libraries, scripts, tools, talks and articles built on or about Frida, the dynamic instrumentation toolkit, started by David Weinstein in May 2016. Its 82 entries fall into libraries (about half of them NowSecure Node.js modules), script collections and projects, talks and papers, tools powered by Frida such as r2frida, objection, friTap and Fridump, videos, blog posts and community links, most with a one-line summary.
- [Awesome Ghidra](https://awesomerea.org/resources/awesome-ghidra/index.md): Collection · An awesome list of Ghidra scripts, plugins, extensions, learning materials and related services, kept by the Allsafe GitHub organization since December 2019. Its 49 entries comprise 36 scripts and extensions, from malware-analysis and crypto-constant finders to Go, JNI, EVM and EFI helpers, Python and Jupyter bridges, P-code emulation and patch-diff correlators; 10 books, talks and courses; and three related projects such as r2ghidra-dec and Ghidraaas, each with a one-line summary.
- [PRE-list](https://awesomerea.org/resources/pre-list/index.md): Collection · A table-based reading list of 71 research papers on automatic protocol reverse engineering for network protocols, from the Protocol Informatics project (2004) to NetPlier (2021). Built from three surveys and extended since, it compares each method by approach, by input (network traces or execution traces) and output (message formats, state machines or other artifacts), and by the text, binary or hybrid protocols it was evaluated on, with full references and a short table of the few papers that released code.
- [awesome-reverse-engineering (alphaSeclab)](https://awesomerea.org/resources/alphaseclab-awesome-reverse-engineering/index.md): Collection · Large reverse-engineering link list, auto-exported in 2019 in English and Chinese, with abridged and full README versions. The full English README lists about 3,600 open-source tools and 2,300 posts and videos, grouped under Windows, Linux, Apple platforms and Android, and under tool sections for IDA, Ghidra, x64dbg, OllyDbg, WinDbg, radare2, Cuckoo, Binary Ninja and dynamic binary instrumentation. Tool rows carry a star count, language and upstream description captured at export time.
- [awesome-mobile-security](https://awesomerea.org/resources/awesome-mobile-security/index.md): Collection · A single-README list of Android and iOS application security resources, about 245 links in all, divided by platform into blogs, papers and how-tos, books, courses, tools, deliberately vulnerable lab apps, talks and miscellany. Android tools are further split into static analysis, dynamic analysis and online APK analyzers, and reverse-engineering entries such as smali/baksmali, radare2, Cutter, Bytecode Viewer, Frida and Objection sit alongside pentesting guides and vulnerability write-ups.
- [Awesome Executable Packing](https://awesomerea.org/resources/awesome-executable-packing/index.md): Collection · A single-README list of resources on executable packing, meaning the bundling, compression, encryption, mutation, protection or virtualization of PE, ELF and other executables, including Android apps, and on detecting and unpacking packed files. About 770 entries are grouped into documentation, dated scientific papers, sample datasets, packers sorted by era from before 2000 to after 2010, and tools for packer identification, unpacking and binary analysis.
- [Awesome AI Reverse Engineering](https://awesomerea.org/resources/awesome-ai-reverse/index.md): Collection · A single-README, Chinese-language list of AI-assisted reverse-engineering projects, grouped into JavaScript reversing, binary and native analysis, Android and iOS security, and browser automation and traffic analysis. Its entries are mostly MCP servers, agent skills for Claude, Cursor and Codex, and IDE plugins that connect large language models to tools such as IDA Pro, Ghidra, Binary Ninja, JADX and Frida. Each row is a project name, a link and a one-line Chinese blurb.
- [Interactive IDA Plugin List](https://awesomerea.org/resources/interactive-ida-plugin-list/index.md): Collection · A sortable, filterable list of 618 plugins, loaders, processor modules and scripts for Hex-Rays' IDA Pro, published as a GitHub Pages table with a static copy generated into the README. Each entry links to its project, almost always on GitHub, with a short description and, where recorded, its language (C++ or Python), category tags such as decompiler, deobfuscation, loader, debug or integration, and the date the project was last updated. The list grew out of onethawt's idaplugins-list of about 200 plugins.
- [Awesome RE-MCP](https://awesomerea.org/resources/awesome-re-mcp/index.md): Collection · A single-README list, written in July 2025, of 28 MCP servers for reverse-engineering tools, grouped into disassemblers and decompilers (IDA Pro, Ghidra, Binary Ninja and others), debuggers, static and dynamic analysis, network analysis, Android and security testing, with a one-line note per entry. It also names tools the author found without an MCP server, links four talks and guides, and points to starting material for writing new servers.
- [RE list (extremecoders-re)](https://awesomerea.org/resources/extremecoders-re-list/index.md): Collection · A single-README list of 71 open-source reverse-engineering tools with a focus on binary analysis, kept as one alphabetical list from Amoco to X86isa. Each entry gives the tool's name, a link and a one- to three-sentence description; the entries span binary analysis frameworks, lifters to LLVM and other intermediate representations, symbolic execution and emulation engines, dynamic instrumentation, whole-system and virtual-machine introspection platforms, decompilers, debugger front ends and deobfuscation tools.
- [awesome-te](https://awesomerea.org/resources/awesome-te/index.md): Collection · A public-domain directory, started in June 2026, of hacking projects for Teenage Engineering devices: custom firmware, reverse-engineering notes and protocol documentation, tools, hardware mods, teardown and recovery guides and community hubs for the OP-1, OP-Z, OP-XY, TP-7, SP-1 Stem Player, EP series, Pocket Operators and other gear. One-line entries are grouped by device and task, each with a maintainer-assigned active, dormant or archived marker, and the scope rule admits only released, TE-specific projects.
- [Awesome UEFI Security](https://awesomerea.org/resources/awesome-uefi-security/index.md): Collection · A single-README awesome list of UEFI and BIOS security material, which its maintainer describes as a personal and not comprehensive collection. It links UEFI, PI and ACPI specifications, EDK II development resources, firmware analysis tools such as UEFITool, efiXplorer, CHIPSEC and UEFI plugins for Ghidra and Binary Ninja, SMM-themed CTF challenges, analyses of bootkits found in the wild, vulnerability write-ups, conference talks, blog posts, papers and training courses.
- [Firmware-Analysis-Papers](https://awesomerea.org/resources/firmware-analysis-papers-list/index.md): Collection · A single-README reading list of 28 academic security papers on firmware and embedded-system analysis, grouped by year from 2013 to 2021. It covers rehosting and emulation, firmware fuzzing, symbolic execution, Bluetooth and baseband analysis and bug detection in Linux-based and bare-metal firmware. Each entry is a title linked to a PDF or publisher page, with its venue such as USENIX Security, NDSS, IEEE S&P or CCS.
- [OpenDeviceDB](https://awesomerea.org/resources/opendevicedb/index.md): Collection · OpenDeviceDB indexes devices with existing firmware or protocol reverse-engineering work and links back to source projects. Its website lists installation routes and remaining vendor dependencies, while importers aggregate existing databases and an MCP server lets agents query device records.
- [Malware Analysis & CTI Reports](https://awesomerea.org/resources/malware-analysis-cti-reports/index.md): Collection · Malware Analysis & CTI Reports collects ten PDF investigations of malware, security tools and binaries with disputed detections. The author describes static inspection with Detect It Easy, strings and imports, followed by manual disassembly or decompilation in Ghidra or radare2.
- [SCUMM Decompilation Archive](https://awesomerea.org/resources/scumm-decompile-archive/index.md): Collection · Eric Oakford's archive collects decompiled scripts for Lucasfilm and Humongous Entertainment SCUMM games. Current files come from NUTcracker, which the README says supports script versions v5 through v8, including the Humongous games. The README says the author does not know whether the scripts can be recompiled.

## References and learning (20)

- [rea-playbook](https://awesomerea.org/resources/rea-playbook/index.md): Learning resource · An Electron practice target, Evidence extractor and MCP probe; offline fixture mode is distinguished from real REA analysis.
- [REA & AI RE Tools Guide (unofficial)](https://awesomerea.org/resources/reaguide-unofficial-rea-guide/index.md): Learning resource · An unofficial, independently run guide to installing REA and connecting it to coding agents, in 32 pages: install paths for npx, npm and Bun including Windows, MCP setup for Claude Code and Desktop, Codex, Cursor, Windsurf and Gemini CLI, a config generator for 24 clients, Ghidra, IDA and JADX provider setup, and troubleshooting pages that match exact error text to upstream REA issues. Several pages record the author's own runs, such as Android APK analysis through headless JADX on rea-agents 6.5.0 and a Claude Code setup re-test on 6.8.0. The site also compares REA with Ghidra, IDA and other reverse-engineering MCP servers and documents look-alike REA copies.
- [OpenSecurityTraining2](https://awesomerea.org/resources/ost2/index.md): Learning resource · Free self-paced security courses with learning paths for reverse engineering, firmware and systems foundations.
- [pwn.college: Reverse Engineering](https://awesomerea.org/resources/pwn-college-re/index.md): Learning resource · Hands-on reverse-engineering module covering functions, data access, static tools and dynamic tools with hosted exercises.
- [Reverse Engineering for Beginners](https://awesomerea.org/resources/re-for-beginners/index.md): Learning resource · Dennis Yurichev's free book on understanding compiled programs and assembly, available in multiple languages.
- [The Official Radare2 Book](https://awesomerea.org/resources/radare2-book/index.md): Learning resource · Official practical reference for radare2 analysis, disassembly, scripting, debugging and related plugins.
- [Finding Jingle Town: Debugging an N64 Game without Symbols](https://awesomerea.org/resources/finding-jingle-town-n64-debugging/index.md): Learning resource · A walkthrough from the Snowboard Kids 2 decompilation project on attaching gdb-multiarch to the Ares emulator while the matching build still cannot carry debug information. It breaks on a function by its ELF symbol name and reads one structure byte by hand to test whether that byte selects the level overlay. A short method note on checking decompilation hypotheses at runtime.
- [JPCERT/CC: APK analysis and API probing on attack servers](https://awesomerea.org/resources/jpcert-apk-api-attack-infrastructure-report/index.md): Learning resource · JPCERT/CC’s 15 October 2026 blog post on the infrastructure behind a series of unauthorized-access incidents in Japan. It reports that the attackers used AI for known-vulnerability scanning and API attacks, and that attack servers held APKs, jadx- and Blutter-related files, APK-extraction directories and an SSRF test script used to probe app APIs. It is a defender’s account of observed attacker tooling with mitigation advice.
- [Reverse Engineering (mytechnotalent)](https://awesomerea.org/resources/mytechnotalent-reverse-engineering/index.md): Learning resource · A free, English lesson index by mytechnotalent that grows almost daily: 490 numbered lessons, most of which have learners write small programs and then debug and patch ("hack") them, across x86, x64, 32/64-bit ARM, RISC-V and AVR. Early courses start from number systems, registers, memory and the stack; later ones cover microcontroller firmware on Raspberry Pi Pico/Pico 2, STM32F401, ESP32-C3, ATmega328P and micro:bit boards, plus Windows, Go, Rust and WebAssembly programs. The README is a table of links; the lesson text lives in a GitBook and in the author's other repositories and PDF books.
- [Z0FCourse Reverse Engineering](https://awesomerea.org/resources/z0f-reverse-engineering-course/index.md): Learning resource · A free English course by Z0F on reverse engineering 64-bit Windows programs, which its README pitches as taking learners from beginner to intermediate. Markdown lessons move from number systems, x64 registers, memory layout and calling conventions to x64dbg and Ghidra, then reverse small samples and an author-written DLL, recovering a Player class and calling the DLL's exports from a program of one's own. The unfinished later chapters introduce Windows internals and reverse ntdll's generic-table functions.
- [OWASP Mobile Application Security Testing Guide (MASTG)](https://awesomerea.org/resources/owasp-mastg/index.md): Learning resource · OWASP’s open manual for Android and iOS app security testing and reverse engineering, published at mas.owasp.org. Chapters on platform internals, test setup and app tampering and reverse engineering sit beside modular, individually referenced tests, techniques, tool pages, knowledge articles, best practices and runnable demos, all mapped to MASVS controls and MASWE weaknesses. OWASP’s UnCrackable crackme apps serve as practice targets and examples.
- [The Decompilation Wiki](https://awesomerea.org/resources/decompilation-wiki/index.md): Learning resource · Community wiki explaining how decompilers work, from disassembly, lifting and control-flow recovery to type recovery, control-flow structuring, quality evaluation and neural decompilation, citing the research behind each technique. It also keeps directories of decompilers, plugins, blogs and talks, pages on applied research such as symbol recovery, code similarity and vulnerability discovery, and a table of about 240 game reconstruction projects by original platform.
- [Frontkick vs Rikugan: a CREBench agent comparison](https://awesomerea.org/resources/frontkick-rikugan-crebench-comparison/index.md): Learning resource · Matthieu Breuil’s Synacktiv article explains tool-calling and code-executing agent designs and describes Frontkick, a CodeAct agent that runs generated Python inside Binary Ninja. It compares Frontkick with the open-source Rikugan plugin on two CREBench cryptographic binary tasks, then attributes most of Frontkick’s advantage to a prompt that listed installed Python libraries rather than to its architecture. It is a small evaluation write-up with per-run results.
- [FLARE Learning Hub](https://awesomerea.org/resources/flare-learning-hub/index.md): Learning resource · Free English reverse-engineering and malware-analysis modules from Mandiant's FLARE team, published as Google Docs, with lab binaries, IDA databases and scripts kept in this repository. The Malware Analysis Crash Course builds from x86 basics to reading Windows API use through assembly-patching exercises and labs with worked solutions; the other modules introduce WinDbg Time Travel Debugging for malware triage and provide a reference to how Go 1.24 programs look in Windows executables.
- [Nintendo Switch Reverse Engineering](https://awesomerea.org/resources/nintendo-switch-joycon-re-notes/index.md): Learning resource · Notes begun by dekuNukem in 2017 and extended by contributors on how the Joy-Con, Pro Controller and parts of the Switch console and dock work, worked out from teardowns, logic-analyzer captures and packet logs. Markdown files cover the Joy-Con board test points and rail-connector pinout, the wired serial handshake with its CRC-8 checksum, Bluetooth HID input and output reports with 32 documented subcommands, the USB HID commands of the Pro Controller and charging grip, the SPI flash memory map with stick and 6-axis calibration, IMU conversion formulas and rumble encoding tables. The repository also keeps STM32 test firmware that plays the console or a Joy-Con on the rail, a Wireshark dissector for the Bluetooth traffic, and the captures behind the notes.
- [Android App Reverse Engineering 101](https://awesomerea.org/resources/android-app-re-101/index.md): Learning resource · Maddie Stone's free English workshop introducing static reverse engineering of Android apps, published as GitHub Pages. Its chapters cover app components and entry points, Dalvik bytecode and smali, decompiling DEX with jadx, finding and reading JNI native libraries in Ghidra, and string deobfuscation. Seven exercises with written solutions apply this to triaging malware samples and spotting command-execution flaws in pre-installed apps.
- [Reverse Engineering iOS Applications](https://awesomerea.org/resources/re-ios-apps-course/index.md): Learning resource · Ivan Rodriguez's free English course (version 1.1) on reverse engineering iOS applications, aimed at beginners in iOS app security. Five Markdown modules cover setting up a jailbroken test device, decrypting App Store apps for analysis, static analysis of an IPA's files, frameworks, Objective-C classes and ARM binary in Hopper or Ghidra, runtime analysis with Cycript and Frida, and binary patching in Hopper. Exercises use CoinZa, a deliberately insecure Objective-C app the author built from vulnerability classes he reports finding in production App Store apps.
- [tiny-dec](https://awesomerea.org/resources/tiny-dec/index.md): Learning resource · Zhuo Zhang's small educational decompiler for 32-bit RISC-V (RV32I) ELF files, written in Python to teach how decompilation works rather than to compete with production decompilers. Its 19 deliberately separate stages run from ELF loading, decoding and p-code lifting through SSA, stack, type, variable and range recovery to control-flow structuring and C output, and the CLI can stop at any stage to print that stage's intermediate result. The README also offers a Claude Code plugin whose AI tutor walks learners through the stages with quizzes and exercises.
- [Reverse Engineering Reading List](https://awesomerea.org/resources/onethawt-re-reading-list/index.md): Learning resource · A short reading list, compiled by One Thawt mostly in 2015–2016, of about 58 links to reverse-engineering tools, books, papers, talks and blog posts, kept in a README and a separate malware-analysis page. Sections run from disassemblers and debuggers, beginner talks and classic books through data-structure recovery papers, instruction-set references, iOS, Android and Windows material, unpacking, deobfuscation and protocol inference from network traces.
- [Decomp Academy](https://awesomerea.org/resources/decomp-academy/index.md): Learning resource · A free, English, in-browser course in matching decompilation maintained by Jack Price-Burns: learners read a function's target assembly, write C, and the original console compiler grades the result byte for byte. Lessons build from reading registers and arithmetic through control flow, structs, floating point, the ABI, globals, optimizer behaviour and 64-bit integers, then finish with functions adapted from open-source decompilation projects. The curriculum now spans GameCube PowerPC, Game Boy Advance Thumb and Nintendo 64 MIPS courses, and the frontend source is on GitHub.