Firmware · Learning resource:
A free English methodology, maintained by Aaron Guzman and published on GitBook, for security testing and reverse engineering embedded-device firmware.
Reviewed scriptingxss/owasp-fstm@ec666e8
Firmware · Learning resource:
Slides and 14 self-contained exercises from Emproof's firmware reverse-engineering workshop at ScapyCon Automotive 2025, designed by Tim Blazytko for a technical audience with little security experience.
Reviewed emproof-com/workshop_firmware_reverse_engineering@10dc72a
App · Learning resource:
Freely published 2015 book by snakeninny and hangcom on reverse engineering iOS apps, distributed in its repository as a 442-page English PDF.
App · Learning resource:
A single large README that collects hand-written Frida instrumentation examples, grouped into Native, Android and iOS sections, for observing how a running app behaves.
Reviewed iddoeldor/frida-snippets@773f89c
App · Learning resource:
A community-maintained reference on iOS reverse engineering started by kpwn, built from a wiki, a curated index of public technical papers and talks, and a few environment-setup scripts.
Reviewed kpwn/iOSRE@20aff77
Binary · Learning resource:
Michal Malik’s single-README reading list for Linux reverse engineering, with about 230 links and book titles that run from quick references on system calls, ELF and processor ABIs through 101 and 201 tiers on program start-up, linking and relocations.
Reviewed michalmalik/linux-re-101@f858da0
App · Learning resource:
Eleven Android challenge apps with step-by-step write-ups for learning Frida instrumentation, progressing from setting up frida-server and hooking a Java method through calling static methods, changing fields, creating instances and hooking constructors to hooking, calling and patching native functions.
Reviewed DERE-ad2001/Frida-Labs@b01f2f8
Binary · Learning resource:
A single-README reading list for macOS (OS X) and iOS reverse engineering, kept by Michal Malik from 2015 to 2019 and labelled a work in progress.
Reviewed michalmalik/osx-re-101@486f33a
App · Learning resource:
A Chinese-language Android reverse-engineering course by Evil0ctal, planned as 100 daily lessons.
Reviewed Evil0ctal/AndroidReverse101@9b72d20
Binary · Learning resource:
A single-page collection of 30 commented Python examples for scripting Ghidra, grouped by task: projects, programs, functions and cross-references, basic blocks, instructions, stack variables, decompiler output, comments, P-code emulation and dumps, call graphs and program slices.
Reviewed HackOvert/GhidraSnippets@9bcd718
Binary · Learning resource:
A beginner workshop by leonjza on binary instrumentation with Frida, served as offline pages from a Docker container that has gdb with GEF and frida-tools preinstalled.
Reviewed leonjza/frida-boot@73d1adf
Firmware · Learning resource:
A free English course by mytechnotalent on developing, debugging and reverse engineering firmware for the Raspberry Pi Pico 2 (RP2350, Arm Cortex-M33).
Protocol · Learning resource:
Write-up of how the author decoded the Bluetooth RFCOMM protocol of a Cobra iRAD 900 radar detector so that a Raspberry Pi 3 could receive alerts without the iOS or Android app.
Reviewed brandonasuncion/Reverse-Engineering-Bluetooth-Protocols@daf7c5c
Firmware · Learning resource:
A single-README notebook, kept since 2021 by an owner with no ties to the vendor, on the internals of LinkPi ENC-series video encoders and the TBS 2603SE, which share one firmware line; the author's first units use the F3520D board with a HiSilicon Hi3520DV400.
Reviewed matiaspl/LinkPi-ENCx@a30d201
Website · Learning resource:
Companion code for the ReverseJS blog's 2022 series on deobfuscating JavaScript by manipulating abstract syntax trees with Babel.
Reviewed SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials@3709295
Binary · Learning resource:
Three worked examples by mrexodia of a language model reverse-engineering crackme binaries in IDA Pro through his IDA Pro MCP server.
Protocol · Learning resource:
OpenGarages' Instrument Cluster Simulator for practising CAN bus reverse engineering on a Linux virtual CAN interface instead of a car.
Reviewed zombieCraig/ICSim@2b3333e
Binary · Learning resource:
Materials from the student-run Malware Analysis course that RPISEC taught at Rensselaer Polytechnic Institute in Fall 2015, built around the book Practical Malware Analysis.
Reviewed RPISEC/Malware@bbd48df
Binary · Learning resource:
Collection of posters and diagrams that dissect file formats byte by byte, published as PNG and PDF images.
Reviewed corkami/pics@669facb
Binary · Learning resource:
No Starch Press book, published in February 2012, that teaches hands-on malware analysis from basic static and dynamic techniques in virtual machines through x86 disassembly with IDA Pro, debugging with OllyDbg and kernel debugging with WinDbg.
Reviewed nostarch.com/malware
Binary · Learning resource:
Slides and exercises for a Windows malware analysis training that builds an understanding of common malware techniques through programming, reverse engineering and Windows internals, and shows how analysis tools are used for particular goals.
App · Learning resource:
RE-Workstation is a Chinese reference library for reverse-engineering workflows and related security research.
Reviewed SUNYT772/RE-Workstation@08af66c
Binary · Learning resource:
CrackMes is a set of walkthroughs for purpose-built crackme binaries from crackmes.one.
Reviewed ghostware0x00/CrackMes@dea5860
Firmware · Learning resource:
Hacking the Xbox — 日本語訳 publishes a Japanese translation of a book on Xbox reverse engineering.
Firmware · Learning resource:
The Hack Different community's knowledge base on Apple hardware, firmware and operating-system internals, set up and largely maintained by Rick Mark, which pairs a long categorized link list with original pages and machine-readable YAML data.
Binary · Learning resource:
Code repository for Karol Mazurek’s Snake & Apple article series on macOS internals and security research.
Reviewed Karmaz95/Snake_Apple@ef5aca0
Binary · Learning resource:
Compare source constructs with compiler-generated assembly to study optimizations and recognize code patterns during reverse engineering.
Game · Learning resource:
This is documentation of how Adeline Software International built Little Big Adventure, Little Big Adventure 2, and Time Commando.
Binary · Learning resource:
This is a practical guide to reading a binary in IDA Pro.
Reviewed shiedless/ida-pro-guide@925dc73
Website · Documentation:
Reviewed setup plans, client registration, provider prerequisites and scoped readiness checks.
Reviewed morluto/rea@808339f
Website · Documentation:
CLI workflows for saving Evidence and projecting smaller views from completed analysis.
Reviewed morluto/rea@808339f
Website · Documentation:
Canonical tool contracts, provider discovery and Evidence semantics for integration authors.
Reviewed morluto/rea@808339f
Binary · Documentation:
Locate a function, inspect instructions and pseudocode, and follow references with a selected native provider.
Reviewed morluto/rea@808339f
Website · Documentation:
Trace features and compare authenticated JavaScript application graphs while preserving static-analysis limits.
Reviewed morluto/rea@808339f
App · Documentation:
Inspect Android package identity, classes, methods and references through REA's JADX integration.
Reviewed morluto/rea@808339f
App · Documentation:
Read PE/CLI metadata and CIL, compare managed members and inspect declared native boundaries without loading the assembly.
Reviewed morluto/rea@808339f
Website · Documentation:
Inspect saved web captures offline; recorded URLs are not fetched and no proxy is started.
Reviewed morluto/rea@808339f
Firmware · Documentation:
Inspect firmware regions with Binwalk and explicitly extract with Unblob, retaining tool and artifact identity.
Reviewed morluto/rea@808339f
Protocol · Documentation:
Select TShark fields, display filters and decode-as rules over an existing network, USB or Bluetooth capture, and look up installed field names.
Reviewed morluto/rea@808339f
Protocol · Documentation:
Summarize a saved pcap or pcapng file’s endpoints, DNS questions and addresses, TLS SNI, protocol stacks and HTTP URIs into paged Evidence views.
Reviewed morluto/rea@808339f
Firmware · Documentation:
Run caller-chosen sigrok protocol decoders, such as UART or I2C, over an existing logic-signal recording and keep annotation text with sample ranges.
Reviewed morluto/rea@808339f
Website · Documentation:
Follow a user-triggered export request in the supplied Notes browser example and connect it to the downloaded result.
Reviewed morluto/rea@808339f
App · Documentation:
A source-owned Notes fixture teaches the renderer, preload, IPC and CSV path with linked analysis evidence.
Reviewed morluto/rea@808339f
App · Documentation:
Identifies a Flutter APK’s Dart snapshot hash, per-ABI library digests and engine build provenance, then inspects one ABI’s AOT snapshot sections, through REA’s pure-parsing CLI and MCP tools.
Reviewed morluto/rea@c12d9ed
App · Documentation:
Inventories HarmonyOS HAP, HSP and App Pack files through REA’s hardened ZIP reader and projects an execution-free application graph: component paths, IDs and hashes, Stage/FA packaging hints, runtime-family hints and path-based native-bridge hypotheses.
Reviewed morluto/rea@093ce69
Firmware · Documentation:
Documents REA’s Ghidra lane for MIPS ELF executables, relocatable objects and MIPS16 shared images, including a pinned 32-bit language for recordless legacy firmware executables that Ghidra would otherwise import as 64-bit.
Reviewed morluto/rea@c12d9ed
Binary · Documentation:
Documents REA’s bounded Ghidra profile for static PSP ELF executables, which leaves Allegrex instructions, PSP loading and calling conventions to a caller-installed ghidra-allegrex extension while reusing REA’s CLI, MCP, Evidence and snapshot workflows.
Reviewed morluto/rea@c12d9ed
Binary · Documentation:
Recovers .NET 8 NativeAOT metadata from x64 PE executables during REA’s Ghidra analysis: MethodTable relationships, virtual slots and frozen strings from RTR 9.1 data, through a built-in read-only parser or an optional headless adapter that annotates the Ghidra database.
Reviewed morluto/rea@093ce69
Protocol · Documentation:
Walksnail Ascent VRX UART Protocol documents serial control messages for Walksnail video receivers and supplies a C reference transmitter with an STM32 example.
Game · Documentation:
Assassin's Creed III online service docs record method IDs and request and response fields for the PC game's online services.
Reviewed Phoenix-Assassins/ac3-docs@10ab3f0
Game · Documentation:
AC4 docs records online service interfaces for the PC version of Assassin's Creed IV Black Flag.
Reviewed Phoenix-Assassins/ac4-docs@5db849b
Website · Documentation:
eRepublik API Documentation maps endpoints observed in the browser-based strategy game's web client.
Reviewed driversti/erepublik-api@e6f89df
Website · Documentation:
Garmin Strength Workout API documents payloads for creating strength workouts through Garmin Connect's undocumented API.
Reviewed n1t3k/garmin-strength-api@20aabbc
Website · Documentation:
Substack API Reference documents the web app's undocumented JSON API using curl probes and captured browser requests.
Protocol · Documentation:
hyperscan-homebrew documents Mattel HyperScan hardware behavior for homebrew and emulation work.
Reviewed vs-sr-dev/hyperscan-homebrew@54dd7aa
Protocol · Documentation:
Local audio streaming on Yandex Station is a technical guide to the device’s Glagol WebSocket control channel and its HTTP audio-stream behavior.
App · Documentation:
whatsapp-docs records findings from static decompilation of the WhatsApp Android APK, covering app internals and communication formats.
Reviewed 7ucg/whatsapp-docs@72e741c
Game · Documentation:
RtG-Format documents the observed save and construction format of the Roblox game Road To Gramby's.
Reviewed JuanCrakYT/RtG-Format@8199b79
Protocol · Documentation:
PAN GlobalProtect protocol documentation records authentication, configuration, tunnel data and logout exchanges between a VPN client and server.
Reviewed dlenski/openconnect@163f23b
Game · Documentation:
MiiTube documents the structure of Miitopia's SpotPass MiiTube.dat package with a Kaitai specification.
Reviewed RiiConnect24/MiiTube@499a3e2
App · Documentation:
FSEQ File Format documents the version 2 Falcon sequence files used by Falcon Player and xLights for timed lighting-channel states.
Reviewed Cryptkeeper/fseq-file-format@66f27ec
App · Documentation:
iWork '13 File Format documents the structure of documents produced by Apple's iWork '13 apps.
Reviewed obriensp/iWorkFileFormat@8575e44
Protocol · Documentation:
GameSpy Documentations collects technical research on the GameSpy protocol and games that use it.
Reviewed GameProgressive/GameSpyDocs@dc55573
Protocol · Documentation:
max-cube-protocol documents the eQ3/ELV MAX!
Reviewed Bouni/max-cube-protocol@f9d2734
Game · Documentation:
PoE dat schema documents Path of Exile dat-file layouts as versioned GraphQL schemas.
Reviewed poe-tool-dev/dat-schema@717d788
Protocol · Documentation:
RS41 Decoding documents the Vaisala RS41 radiosonde's radio frame format, from FSK audio and bit ordering to XOR whitening, Reed–Solomon data, frame types and CRC-protected blocks.
Reviewed bazjo/RS41_Decoding@702553b
Game · Documentation:
XiPackets documents reverse-engineered Final Fantasy XI network behavior across its lobby, world, cache and patch services.
Reviewed atom0s/XiPackets@ebe2216
App · Documentation:
Nintendo Switch app REST API documentation maps the iOS companion app's account and game-service requests, including its embedded Splatoon 2 web app.
Protocol · Documentation:
unifi-inform-protocol documents the observed discovery and inform exchanges between Ubiquiti UniFi access points and their controller.
Protocol · Documentation:
Reverse Engineered UniFi Protocol documents communication between UniFi access points and their controller from observed traffic.
Protocol · Documentation:
TH-D74-Kenwood documents reverse-engineered PC control commands for the Kenwood TH-D74 radio.
Reviewed LA3QMA/TH-D74-Kenwood@8876e34
Game · Documentation:
Diablo II Save File Format documents the binary layout of Diablo II .d2s character saves.
Reviewed krisives/d2s-format@ab63360
App · Documentation:
reMarkable Kaitai Specs defines Kaitai Struct parsers for versions 3 and 5 of the reMarkable tablet's binary .rm pen-stroke format.
Game · Documentation:
Serflings publishes a byte-level reference for Settlers 1 savegames.
Reviewed nicymike/serflings@f5c4e44
Protocol · Documentation:
Game Boy Advance LCD Interface documents the handheld's 40-pin and 32-pin display connectors and interprets their pixel clock, RGB data, latch and synchronization signals.
Reviewed squk/GBA-LCD@6546ccf
Game · Documentation:
WoWDBDefs records column names, types, relationships and versioned layouts for World of Warcraft DBC and DB2 client databases.
Reviewed wowdev/WoWDBDefs@9662a03
App · Documentation:
MinYMizer documents a portable representation of maxYMiser MYS song and MYV voiceset files for lightweight PSG playback.
Reviewed codeberg.org/jbqueru/minymize/src/commit/f55431ea4…
Game · Documentation:
GTPD-Code-Reference documents Ghost Trick: Phantom Detective's Nintendo DS code through C++ type declarations and linker symbol maps.
Reviewed Ed-1T/GTPD-Code-Reference@a40415a
Binary · Research:
A Windows REA/Ghidra lab with seeded challenges, published studies, upstream contributions and recorded limitations.
Reviewed pablodiazjorge/rea-lab@c96b76b
Binary · Research:
Research on direct binary decompilation and refinement of Ghidra output with language models.
Reviewed aclanthology.org/2024.emnlp-main.203
Binary · Research:
A benchmark combining functions from real programs, runtime-aware validation, and LLM-assisted assessment of decompiled-code usability.
Binary · Research:
Combines language models and program analysis to recover variable and user-defined data-structure symbols from stripped binaries.
Reviewed lt-asset/resym@437b4ac
Protocol · Research:
Research code and data for CNNPRE, a message-type identification method for protocol reverse engineering by Javad Garshasbi and Mehdi Teimouri, published in IEEE Access in 2023.
Reviewed JG91/CNNPRE@c7679ee
Binary · Research:
esp-idf-injection-ng documents an investigation of ESP-IDF's compiled libnet80211.a frame-type check.
Firmware · Research:
T2 platform research maps Apple T2 firmware, hardware and Linux-facing interfaces using static analysis, hardware observations and driver comparisons.
Binary · Research:
Glaurung Models contains tokenizer and model experiments for executable analysis.
Reviewed mjbommar/glaurung-models@1819020
Binary · Research:
Binary BPE Tokenizer for Executable Analysis studies byte-pair encoding of ELF, PE, Mach-O and APK files for transformer-based binary analysis.
App · Research:
Spelunking studies Apple apps, private frameworks and system services with Swift and Objective-C probes.
Reviewed gaelic-ghost/spelunking@8badd03
Binary · Research:
DecBench is an experimental benchmark for comparing decompilers and language models on recovering exact source code.
Reviewed Noelo-Lab/decbench@27c0cae
Binary · Research:
Decompile-Bench-Eval is a binary decompilation evaluation dataset pairing C and C++ function source with assembly and IDA Pro and Ghidra pseudocode.
Reviewed huggingface.co/datasets/LLM4Binary/decompile-eval/bl…
Binary · Research:
Java Decompiler Dataset provides paired Java source and decompiled Java assembly for training and evaluating decompilation models.
Reviewed huggingface.co/datasets/BradMcDanel/java-decompiler/…