# Curated reverse engineering resources · Page 52

> Page 52 of 52, entries 5,101–5,191. 5,191 tools, projects, integrations, case studies, and references for websites, games, apps, native binaries, firmware, and communication protocols.

Source-reviewed means descriptions were checked against primary documentation. Each entry page lists the full requirements and sources; this page shows their counts and the review date.

- HTML: <https://awesomerea.org/resources/page/52/>
- JSON: <https://awesomerea.org/api/v1/resources.json>
- 简体中文: <https://awesomerea.org/zh/resources/page/52/index.md>

## References and learning (91)

- [OWASP Firmware Security Testing Methodology (FSTM)](https://awesomerea.org/resources/owasp-fstm/index.md): Learning resource · A free English methodology, maintained by Aaron Guzman and published on GitBook, for security testing and reverse engineering embedded-device firmware. It is organized as nine stages: information gathering, obtaining firmware, analyzing the image, extracting the filesystem, static analysis of its contents, emulation, dynamic testing, runtime analysis and binary exploitation, with example commands for tools such as binwalk, unblob, FACT, EMBA, Firmwalker, QEMU and Ghidra. An October 2025 revision added C/C++ static-analysis tools, SBOM generation and a mapping to the OWASP IoT Security Verification Standard (ISVS).
- [Emproof workshop: Firmware Reverse Engineering](https://awesomerea.org/resources/emproof-firmware-re-workshop/index.md): Learning resource · Slides and 14 self-contained exercises from Emproof's firmware reverse-engineering workshop at ScapyCon Automotive 2025, designed by Tim Blazytko for a technical audience with little security experience. The firmware and binary tasks move from reading ELF metadata with binutils and first steps in Ghidra or Binary Ninja, through unpacking two embedded-Linux CTF images with binwalk, to bare-metal analysis: identifying the microcontroller, toolchain and memory map of a model car's firmware ELF, and rebasing a raw STM32F103 flash dump with segments taken from the datasheet. Other tasks decrypt strings statically in a Mirai sample and trace a hardcoded AES key back to its data section.
- [iOS App Reverse Engineering](https://awesomerea.org/resources/ios-app-reverse-engineering-book/index.md): Learning resource · Freely published 2015 book by snakeninny and hangcom on reverse engineering iOS apps, distributed in its repository as a 442-page English PDF. Its four parts cover the iOS filesystem and file types; OS X and on-device tools such as class-dump, Theos, Reveal, IDA, Cycript and LLDB with debugserver; an Objective-C and ARM assembly methodology for locating the code behind a feature; and four worked practices that locate the relevant code in Notes, Mail, WeChat and Messages and then extend those apps with tweaks.
- [Frida Snippets](https://awesomerea.org/resources/frida-snippets/index.md): Learning resource · A single large README that collects hand-written Frida instrumentation examples, grouped into Native, Android and iOS sections, for observing how a running app behaves. The examples show patterns such as attaching interceptors, enumerating loaded modules and classes, describing class members, tracing method arguments and return values, printing backtraces, logging SQLite queries and I/O, and scanning or dumping process memory. A scripts directory adds helper code, including Python generators that emit hook stubs from a decompiler and a frida-server install script, plus editor snippets for Sublime and Vim.
- [iOSRE: iOS Reverse Engineering reference](https://awesomerea.org/resources/kpwn-iosre/index.md): Learning resource · A community-maintained reference on iOS reverse engineering started by kpwn, built from a wiki, a curated index of public technical papers and talks, and a few environment-setup scripts. The wiki pages introduce iOS internals such as the Mach-O executable format, the XNU kernel and IOKit, the boot chain and a history of platform mitigations, while the README states the project is an early, ongoing effort and several pages remain stubs. The repository hosts notes and external links rather than any Apple firmware, device images or app binaries.
- [linux-re-101](https://awesomerea.org/resources/linux-re-101/index.md): Learning resource · Michal Malik’s single-README reading list for Linux reverse engineering, with about 230 links and book titles that run from quick references on system calls, ELF and processor ABIs through 101 and 201 tiers on program start-up, linking and relocations. Later sections gather material on packers and obfuscation, anti-debugging, ELF infection, kernel modules and rootkits, exploitation, crackmes, radare2 walkthroughs, detection tools and books. It is a lightly annotated link list last changed in January 2022, useful as a background syllabus.
- [Frida Labs](https://awesomerea.org/resources/frida-labs/index.md): Learning resource · Eleven Android challenge apps with step-by-step write-ups for learning Frida instrumentation, progressing from setting up frida-server and hooking a Java method through calling static methods, changing fields, creating instances and hooking constructors to hooking, calling and patching native functions. The author presents them as beginner-to-intermediate exercises rather than hard CTF challenges: each app hides a flag, but the stated goal is learning Frida’s common APIs and being able to read scripts written by others.
- [osx & ios re 101](https://awesomerea.org/resources/osx-re-101/index.md): Learning resource · A single-README reading list for macOS (OS X) and iOS reverse engineering, kept by Michal Malik from 2015 to 2019 and labelled a work in progress. Its 98 entries in nine sections run from must-read blogs and Mach-O, ABI and system-call references through Mach-O basics, malware, anti-debugging and obfuscation write-ups, kernel, sandbox and jailbreak research, kernel-extension development and kernel debugging, and forensics and monitoring material, to crackmes and six books. Entries are bare links or titles, mostly with no annotation.
- [AndroidReverse101](https://awesomerea.org/resources/androidreverse101/index.md): Learning resource · A Chinese-language Android reverse-engineering course by Evil0ctal, planned as 100 daily lessons. It starts from number systems, ARM assembly, the Dalvik/ART runtime and APK loading, then covers APK and DEX structure, Smali editing and repackaging, Frida and Xposed hooking, JNI and native-library analysis, traffic analysis, obfuscation and app hardening, with commands and code for tools such as jadx, apktool, readelf, GDB/LLDB, Frida and Burp Suite. A Crackmes folder adds copies of OWASP's UnCrackable and r2pay practice apps, and a community Indonesian translation follows the published lessons.
- [Ghidra Snippets](https://awesomerea.org/resources/ghidra-snippets/index.md): Learning resource · A single-page collection of 30 commented Python examples for scripting Ghidra, grouped by task: projects, programs, functions and cross-references, basic blocks, instructions, stack variables, decompiler output, comments, P-code emulation and dumps, call graphs and program slices. It starts from the Flat Program, Flat Decompiler and Flat Debugger APIs, then shows where a task needs Ghidra's fuller API; most snippets include an example of their output.
- [Frida Boot: a beginner binary instrumentation workshop](https://awesomerea.org/resources/frida-boot-workshop/index.md): Learning resource · A beginner workshop by leonjza on binary instrumentation with Frida, served as offline pages from a Docker container that has gdb with GEF and frida-tools preinstalled. Three chapters move from a small Linux C program, LD_PRELOAD hooks and how library calls resolve through the PLT and GOT, to Frida’s Interceptor for reading arguments and changing return values, NativeFunction for calling a program’s own functions, Python injector tools, RPC exports, TypeScript agents, frida-server and frida-gadget. It deliberately leaves out Frida’s mobile-app uses, and every exercise targets sample programs shipped with the workshop.
- [Embedded Hacking (mytechnotalent)](https://awesomerea.org/resources/mytechnotalent-embedded-hacking/index.md): Learning resource · A free English course by mytechnotalent on developing, debugging and reverse engineering firmware for the Raspberry Pi Pico 2 (RP2350, Arm Cortex-M33). A fourteen-week syllabus with slides, Markdown notebooks and a 40-chapter PDF textbook follows a write, debug, then hack pattern from hello-world through variables, data types, constants, operators, conditionals, structures and functions, using GDB with OpenOCD and Ghidra, with Binary Ninja and IDA versions of the notebooks from week 4; an I2C LCD, GPS, LoRa radio, servo and IR remote supply the exercises. Graded CTFs, story-driven classified-brief challenges and a secure-boot custom bootloader ship as author-built binaries alongside their source.
- [Reverse-Engineering a Bluetooth-Enabled Radar Detector](https://awesomerea.org/resources/cobra-irad-bluetooth-protocol-walkthrough/index.md): Learning resource · Write-up of how the author decoded the Bluetooth RFCOMM protocol of a Cobra iRAD 900 radar detector so that a Raspberry Pi 3 could receive alerts without the iOS or Android app. Traffic was logged on a jailbroken iPhone with BTServer and filtered in Wireshark; the README then documents the detector's half-second status payload and the 9-byte reply whose ACK byte must echo the detector's sequence byte, and replays recorded responses to the initial settings sync instead of decoding it. A short beginner's case study on RFCOMM traffic analysis with a rough proof-of-concept script that has no ongoing client maintenance.
- [Link Pi ENCx encoders (unofficial documentation)](https://awesomerea.org/resources/linkpi-encx-unofficial-docs/index.md): Learning resource · A single-README notebook, kept since 2021 by an owner with no ties to the vendor, on the internals of LinkPi ENC-series video encoders and the TBS 2603SE, which share one firmware line; the author's first units use the F3520D board with a HiSilicon Hi3520DV400. It covers the Linux system and PHP web interface, undocumented features and internal pages, intercom and tally interfaces, default accounts and network services with hardening steps, HiSilicon media-pipeline diagnostics, board pinouts including the UART, firmware recovery, and translated release notes for firmware updates from 2020 to 2026.
- [Supplementary AST-Based Deobfuscation Materials](https://awesomerea.org/resources/reversejs-ast-deobfuscation-materials/index.md): Learning resource · Companion code for the ReverseJS blog's 2022 series on deobfuscating JavaScript by manipulating abstract syntax trees with Babel. Each folder pairs a small obfuscated sample with a deobfuscator script and its output, covering string concealing (escape sequences, concatenation, string arrays and string encryption), constant folding including JSFuck-style code, substitution of constant variables, bracket-to-dot property access, dead-code removal, proxy functions and sequence expressions. The README presents them as short learning examples rather than a production deobfuscator.
- [MCP Reversing Dataset (mrexodia)](https://awesomerea.org/resources/mcp-reversing-dataset/index.md): Learning resource · Three worked examples by mrexodia of a language model reverse-engineering crackme binaries in IDA Pro through his IDA Pro MCP server. Each folder holds the input binary, a README giving its origin, the prompt and the model, the agent's own report and the exported session transcript, so readers can follow every tool call, rename, retype and comment the agent made on the database. The tasks cover a small Linux password check, an obfuscated Linux flag checker and a Windows crackme that, according to the agent's report, routes its checks through vectored exception handling.
- [ICSim (Instrument Cluster Simulator)](https://awesomerea.org/resources/icsim/index.md): Learning resource · OpenGarages' Instrument Cluster Simulator for practising CAN bus reverse engineering on a Linux virtual CAN interface instead of a car. One SDL window draws a dashboard whose speedometer, turn signals and door-lock indicators react to the CAN frames it sniffs, while a separate controls program turns gamepad or keyboard input into those frames and replays a recorded sample of generic CAN traffic as background noise. In training mode the arbitration IDs and byte positions behind each signal are randomized from a seed shared by both programs, and the highest difficulty level adds further random data to the target messages, so learners have to find the relevant messages themselves.
- [RPISEC Malware Analysis course (CSCI 4976)](https://awesomerea.org/resources/rpisec-malware-analysis-course/index.md): Learning resource · Materials from the student-run Malware Analysis course that RPISEC taught at Rensselaer Polytechnic Institute in Fall 2015, built around the book Practical Malware Analysis. Twelve lectures run from basic static and dynamic analysis, x86 and IDA through Windows internals, malware behavior, data encoding, covert launching, anti-disassembly, anti-VM and anti-debugging, and packing and unpacking to the Windows kernel and rootkit techniques, with ten labs and four projects that include runtime process manipulation, unpacking automation and an APT sample analysis.
- [Corkami pics](https://awesomerea.org/resources/corkami-pics/index.md): Learning resource · Collection of posters and diagrams that dissect file formats byte by byte, published as PNG and PDF images. The binary posters cover executables (ELF, DOS COM and EXE, NE, LE, PE, Mach-O and fat Mach-O, Java class, Dalvik DEX, Python bytecode, SWF, GameCube/Wii DOL and Switch NRO) along with image, video, archive, document, sound and serialization formats, x86 and x64 opcode charts and Dalvik, JVM and .NET opcode tables. The more detailed 101 series explains PE, ELF, Mach-O, ZIP, Java class, PDF, COM and WAV files and includes Inkscape sources and proof-of-concept files.
- [Practical Malware Analysis](https://awesomerea.org/resources/practical-malware-analysis/index.md): Learning resource · No Starch Press book, published in February 2012, that teaches hands-on malware analysis from basic static and dynamic techniques in virtual machines through x86 disassembly with IDA Pro, debugging with OllyDbg and kernel debugging with WinDbg. Later chapters cover malicious Windows programs, covert launching, data encoding, network signatures, anti-disassembly, anti-debugging and anti-VM techniques, unpacking, shellcode, C++ and 64-bit malware, and hands-on labs with solutions have readers dissect malware samples.
- [Windows Malware Analysis training, volume 1 (malware_training_vol1)](https://awesomerea.org/resources/malware-training-vol1/index.md): Learning resource · Slides and exercises for a Windows malware analysis training that builds an understanding of common malware techniques through programming, reverse engineering and Windows internals, and shows how analysis tools are used for particular goals. Module 1 covers compilation, the PE format, processes, WoW64, shellcode and PE loaders; module 2 introduces malware missions and tactics, hooking, persistence and banking trojans; module 3 introduces evasion and self-defence and fingerprinting, with obfuscation, anti-hooking, deobfuscation and kernel-mode components planned.
- [RE-Workstation](https://awesomerea.org/resources/re-workstation/index.md): Learning resource · RE-Workstation is a Chinese reference library for reverse-engineering workflows and related security research. Its topic pages cover native binaries, APKs, firmware, JavaScript, patch diffing and malware analysis, with indexes, evidence templates and pattern references for locating relevant methods.
- [CrackMes](https://awesomerea.org/resources/crackmes-writeups/index.md): Learning resource · CrackMes is a set of walkthroughs for purpose-built crackme binaries from crackmes.one. The supplied Linux x86-64 examples identify ELF executables, inspect program disassembly, use breakpoints and runtime observations, and explain how candidate input is checked.
- [Hacking the Xbox — 日本語訳](https://awesomerea.org/resources/hacking-the-xbox-ja/index.md): Learning resource · Hacking the Xbox — 日本語訳 publishes a Japanese translation of a book on Xbox reverse engineering. The repository includes translated introductory material and chapters 1–6 with figures; later chapters and appendices remain pending.
- [Apple Data Formats and Knowledge](https://awesomerea.org/resources/hack-different-apple-knowledge/index.md): Learning resource · The Hack Different community's knowledge base on Apple hardware, firmware and operating-system internals, set up and largely maintained by Rick Mark, which pairs a long categorized link list with original pages and machine-readable YAML data. The README groups references from Mach-O, the dyld shared cache, img4 and boot policy to the Secure Enclave, basebands, USB and Lightning, wireless protocols and diagnostic formats, while the data folder holds 56 topic files plus per-device, certificate and firmware-key records on devices, chips, IPSW builds, Mach-O constants, NVRAM, boot arguments, lockdownd services and entitlements. Rake tasks regenerate parts of the data from Apple's update feeds, The iPhone Wiki and local Apple binaries, and the data is also published as apple-data packages for Ruby, Python and Node.js.
- [Snake & Apple: macOS internals and security article series](https://awesomerea.org/resources/snake-apple-macos-security-series/index.md): Learning resource · Code repository for Karol Mazurek’s Snake & Apple article series on macOS internals and security research. Chapters cover Mach-O, code signing, binary hardening checks, dylibs and dyld, AMFI, antivirus components, the App Sandbox and SIP, TCC and the XNU kernel, plus app bundles, and the README links each article and its follow-ups. CrimsonUroboros, the series’ LIEF-based Python analysis tool, grows with each chapter and groups its options by those topics, and smaller scripts parse trust caches, code signatures, sandbox profiles and TCC databases.
- [Compiler Explorer](https://awesomerea.org/resources/compiler-explorer/index.md): Learning resource · Compare source constructs with compiler-generated assembly to study optimizations and recognize code patterns during reverse engineering.
- [Little Big Adventure engine architecture](https://awesomerea.org/resources/lba-engine-architecture/index.md): Learning resource · This is documentation of how Adeline Software International built Little Big Adventure, Little Big Adventure 2, and Time Commando. It points at the community engine sources and is published as a Jekyll site.
- [IDA Pro guide](https://awesomerea.org/resources/ida-pro-guide/index.md): Learning resource · This is a practical guide to reading a binary in IDA Pro. It covers opening a Mach-O, PE, or ELF file and waiting for auto-analysis, the windows and keys used to move around, walking from an anchor function, reading pseudocode, and using cross-references. A later section covers patching and scripting.
- [Installation and client setup](https://awesomerea.org/resources/rea-installation/index.md): Documentation · Reviewed setup plans, client registration, provider prerequisites and scoped readiness checks.
- [CLI and Evidence](https://awesomerea.org/resources/rea-cli-evidence/index.md): Documentation · CLI workflows for saving Evidence and projecting smaller views from completed analysis.
- [MCP contracts and generated catalog](https://awesomerea.org/resources/rea-mcp-contracts/index.md): Documentation · Canonical tool contracts, provider discovery and Evidence semantics for integration authors.
- [Native binary investigation](https://awesomerea.org/resources/rea-native-workflow/index.md): Documentation · Locate a function, inspect instructions and pseudocode, and follow references with a selected native provider.
- [Cross-layer JavaScript application workflows](https://awesomerea.org/resources/rea-js-workflows/index.md): Documentation · Trace features and compare authenticated JavaScript application graphs while preserving static-analysis limits.
- [Static Android APK analysis](https://awesomerea.org/resources/rea-android-guide/index.md): Documentation · Inspect Android package identity, classes, methods and references through REA's JADX integration.
- [Managed-code analysis](https://awesomerea.org/resources/rea-managed-guide/index.md): Documentation · Read PE/CLI metadata and CIL, compare managed members and inspect declared native boundaries without loading the assembly.
- [Historical web network captures](https://awesomerea.org/resources/rea-web-captures/index.md): Documentation · Inspect saved web captures offline; recorded URLs are not fetched and no proxy is started.
- [Firmware analysis](https://awesomerea.org/resources/rea-firmware-guide/index.md): Documentation · Inspect firmware regions with Binwalk and explicitly extract with Unblob, retaining tool and artifact identity.
- [Recorded packet capture inspection](https://awesomerea.org/resources/rea-packet-captures/index.md): Documentation · Select TShark fields, display filters and decode-as rules over an existing network, USB or Bluetooth capture, and look up installed field names. It does not capture traffic, open an interface or control a device.
- [Packet capture summaries](https://awesomerea.org/resources/rea-pcap-summaries/index.md): Documentation · Summarize a saved pcap or pcapng file’s endpoints, DNS questions and addresses, TLS SNI, protocol stacks and HTTP URIs into paged Evidence views. It does not capture traffic or fetch recorded targets.
- [Recorded signal decoding](https://awesomerea.org/resources/rea-signal-recordings/index.md): Documentation · Run caller-chosen sigrok protocol decoders, such as UART or I2C, over an existing logic-signal recording and keep annotation text with sample ranges. It does not acquire samples or communicate with hardware.
- [Browser observation guide](https://awesomerea.org/resources/rea-browser-guide/index.md): Documentation · Follow a user-triggered export request in the supplied Notes browser example and connect it to the downloaded result.
- [JavaScript and Electron: follow a CSV export](https://awesomerea.org/resources/rea-electron-guide/index.md): Documentation · A source-owned Notes fixture teaches the renderer, preload, IPC and CSV path with linked analysis evidence.
- [Flutter build identification](https://awesomerea.org/resources/rea-flutter-guide/index.md): Documentation · Identifies a Flutter APK’s Dart snapshot hash, per-ABI library digests and engine build provenance, then inspects one ABI’s AOT snapshot sections, through REA’s pure-parsing CLI and MCP tools. The string-pool output is a bounded byte-pattern projection of package and SDK URIs.
- [Static HarmonyOS package inventory](https://awesomerea.org/resources/rea-harmony-guide/index.md): Documentation · Inventories HarmonyOS HAP, HSP and App Pack files through REA’s hardened ZIP reader and projects an execution-free application graph: component paths, IDs and hashes, Stage/FA packaging hints, runtime-family hints and path-based native-bridge hypotheses. Every claim rests on path presence; manifests, Ark bytecode, resources and signatures are not decoded or verified.
- [MIPS ELF analysis through Ghidra](https://awesomerea.org/resources/rea-ghidra-mips-guide/index.md): Documentation · Documents REA’s Ghidra lane for MIPS ELF executables, relocatable objects and MIPS16 shared images, including a pinned 32-bit language for recordless legacy firmware executables that Ghidra would otherwise import as 64-bit. Admission is bounded by declared header and ABI-record facts, and verification compares source-owned fixtures with independent readelf output rather than executing or rehosting firmware.
- [PSP static ELF analysis through Ghidra](https://awesomerea.org/resources/rea-ghidra-psp-guide/index.md): Documentation · Documents REA’s bounded Ghidra profile for static PSP ELF executables, which leaves Allegrex instructions, PSP loading and calling conventions to a caller-installed ghidra-allegrex extension while reusing REA’s CLI, MCP, Evidence and snapshot workflows. It admits one PSPSDK header and ABI declaration on Linux x64 and verifies selected static facts on a self-built fixture, not commercial games or PRX modules.
- [NativeAOT metadata recovery with Ghidra](https://awesomerea.org/resources/rea-ghidra-nativeaot-guide/index.md): Documentation · Recovers .NET 8 NativeAOT metadata from x64 PE executables during REA’s Ghidra analysis: MethodTable relationships, virtual slots and frozen strings from RTR 9.1 data, through a built-in read-only parser or an optional headless adapter that annotates the Ghidra database. Generated names, inferred prototypes and recovered native pseudocode stay separate from the unknown original C# names, fields and source.
- [Walksnail Ascent VRX UART Protocol](https://awesomerea.org/resources/walksnail-ascent-vrx-uart/index.md): Documentation · Walksnail Ascent VRX UART Protocol documents serial control messages for Walksnail video receivers and supplies a C reference transmitter with an STM32 example. It specifies framing, payload checksums, remote keys, channel selection and status queries, while recording contradictions and unknown reply layouts.
- [Assassin's Creed III online service docs](https://awesomerea.org/resources/ac3-online-service-docs/index.md): Documentation · Assassin's Creed III online service docs record method IDs and request and response fields for the PC game's online services. The files cover RMC services such as online saves and account management, alongside notes on P2P Duplicated Objects over PRUDP.
- [AC4 docs](https://awesomerea.org/resources/ac4-docs/index.md): Documentation · AC4 docs records online service interfaces for the PC version of Assassin's Creed IV Black Flag. Its RMC documents list method IDs and request and response types, while the repository also contains HTTP API specifications for service revival work.
- [eRepublik API Documentation](https://awesomerea.org/resources/erepublik-api-documentation/index.md): Documentation · eRepublik API Documentation maps endpoints observed in the browser-based strategy game's web client. Its reference pages cover authentication cookies and requests for travel, battles, economy, social features and other game functions, with HTTP methods and example parameters.
- [Garmin Strength Workout API](https://awesomerea.org/resources/garmin-strength-workout-api/index.md): Documentation · Garmin Strength Workout API documents payloads for creating strength workouts through Garmin Connect's undocumented API. Its reference describes repeat groups, exercise and rest steps, conditions, weights and exercise identifiers, with JSON examples plus a small builder and validator.
- [Substack API Reference (Unofficial)](https://awesomerea.org/resources/substack-api-reference/index.md): Documentation · Substack API Reference documents the web app's undocumented JSON API using curl probes and captured browser requests. It records read and write endpoints, authentication and request bodies, and supplies an OpenAPI 3.1 specification with curl and TypeScript examples. The author reports 129 verified endpoints from 14 capture rounds.
- [hyperscan-homebrew](https://awesomerea.org/resources/hyperscan-homebrew/index.md): Documentation · hyperscan-homebrew documents Mattel HyperScan hardware behavior for homebrew and emulation work. Its notes cover SPG290 PPU registers, RFID reader signaling, controller I²C behavior, SPU audio and S+Core 7 compiler failures, drawing on MAME experiments and hardware captures where available.
- [Локальный аудиостриминг на Яндекс.Станцию](https://awesomerea.org/resources/yandex-station-local-streaming/index.md): Documentation · Local audio streaming on Yandex Station is a technical guide to the device’s Glagol WebSocket control channel and its HTTP audio-stream behavior. It documents radio_play, token acquisition, message formats and MP3 CBR stream requirements, including an exact Content-Length.
- [whatsapp-docs](https://awesomerea.org/resources/whatsapp-docs/index.md): Documentation · whatsapp-docs records findings from static decompilation of the WhatsApp Android APK, covering app internals and communication formats. Its reports describe linked-device pairing, Noise transport, reporting stanzas, media upload and other client flows, with findings distinguished from inferences.
- [RtG-Format](https://awesomerea.org/resources/rtg-format/index.md): Documentation · RtG-Format documents the observed save and construction format of the Roblox game Road To Gramby's. Its references and experiments cover build structures, part identifiers, connections, properties, encoding and compression, with supporting CLI and browser preview tools.
- [PAN GlobalProtect protocol documentation](https://awesomerea.org/resources/pan-globalprotect-protocol-doc/index.md): Documentation · PAN GlobalProtect protocol documentation records authentication, configuration, tunnel data and logout exchanges between a VPN client and server. It uses anonymized logs based on the official Windows client v3.0.1-10, with some updates from v4.0.5-8, to describe requests, responses and tunnel behavior.
- [MiiTube](https://awesomerea.org/resources/miitube-format/index.md): Documentation · MiiTube documents the structure of Miitopia's SpotPass MiiTube.dat package with a Kaitai specification. The repository also includes a shell script for retrieving the files. The package contains Miis used for in-game character roles and needs decryption before inspection.
- [FSEQ File Format](https://awesomerea.org/resources/fseq-file-format/index.md): Documentation · FSEQ File Format documents the version 2 Falcon sequence files used by Falcon Player and xLights for timed lighting-channel states. Derived from those software implementations, it maps the little-endian header, compression blocks, sparse channel ranges, variable records and compressed channel data.
- [iWork '13 File Format](https://awesomerea.org/resources/iwork-file-format/index.md): Documentation · iWork '13 File Format documents the structure of documents produced by Apple's iWork '13 apps. It describes bundles, Index.zip and IWA component storage, and provides a sample file inspector with Protocol Buffers schemas.
- [GameSpy Documentations](https://awesomerea.org/resources/gamespydocs/index.md): Documentation · GameSpy Documentations collects technical research on the GameSpy protocol and games that use it. The repository includes a protocol research paper with TeX source, server and workflow diagrams, and SOAP structure notes for particular games.
- [max-cube-protocol](https://awesomerea.org/resources/max-cube-protocol/index.md): Documentation · max-cube-protocol documents the eQ3/ELV MAX! heating cube's TCP protocol, including connection setup, single-letter message types, CRLF framing and device-configuration payloads. The author combines observations from a cube running firmware 1.1.3 with findings from decompiling the original MAX software.
- [PoE dat schema](https://awesomerea.org/resources/poe-dat-schema/index.md): Documentation · PoE dat schema documents Path of Exile dat-file layouts as versioned GraphQL schemas. It defines scalar field types, row references, localized fields and file-path directives, with temporary types for unresolved columns. A build exports the schemas as JSON.
- [RS41 Decoding](https://awesomerea.org/resources/rs41-decoding/index.md): Documentation · RS41 Decoding documents the Vaisala RS41 radiosonde's radio frame format, from FSK audio and bit ordering to XOR whitening, Reed–Solomon data, frame types and CRC-protected blocks. Separate notes cover RS41 variants and extended XDATA payloads, including the OIF411 ozone interface.
- [XiPackets](https://awesomerea.org/resources/xipackets/index.md): Documentation · XiPackets documents reverse-engineered Final Fantasy XI network behavior across its lobby, world, cache and patch services. Its notes cover packet definitions, server roles, message exchanges, and the compression, encryption and hashing used by those services.
- [Nintendo Switch app REST API documentation](https://awesomerea.org/resources/nintendo-switch-app-rest-api/index.md): Documentation · Nintendo Switch app REST API documentation maps the iOS companion app's account and game-service requests, including its embedded Splatoon 2 web app. Based on mitmproxy observation, it provides endpoint blueprints and an ordered account-to-game authentication sequence.
- [unifi-inform-protocol](https://awesomerea.org/resources/unifi-inform-protocol/index.md): Documentation · unifi-inform-protocol documents the observed discovery and inform exchanges between Ubiquiti UniFi access points and their controller. It maps UDP discovery TLVs, the adoption sequence and binary HTTP /inform packet fields, including compression and AES encryption flags.
- [Reverse Engineered UniFi Protocol](https://awesomerea.org/resources/unifi-protocol-reverse-engineering/index.md): Documentation · Reverse Engineered UniFi Protocol documents communication between UniFi access points and their controller from observed traffic. It describes discovery TLVs and inform messages, including the TNBU header, JSON payloads, zlib compression and AES-CBC encryption.
- [TH-D74-Kenwood - PC RIG control commands](https://awesomerea.org/resources/th-d74-kenwood-control-docs/index.md): Documentation · TH-D74-Kenwood documents reverse-engineered PC control commands for the Kenwood TH-D74 radio. Its firmware 1.10 index links commands for frequency, memory, GPS, Bluetooth and transmit controls, with separate parameter tables.
- [Diablo II Save File Format](https://awesomerea.org/resources/d2s-format/index.md): Documentation · Diablo II Save File Format documents the binary layout of Diablo II .d2s character saves. It maps the 765-byte header, version identifiers, checksum calculation, status flags, waypoints and item bit fields, while marking unresolved sections and unknown bytes.
- [reMarkable Kaitai Specs](https://awesomerea.org/resources/remarkable-kaitai/index.md): Documentation · reMarkable Kaitai Specs defines Kaitai Struct parsers for versions 3 and 5 of the reMarkable tablet's binary .rm pen-stroke format. The repository includes a sample version 5 file and credits an earlier format investigation as its basis. The author reports superficial testing on one version 5 document and no testing of version 3.
- [Serflings Remake Project: Settlers 1 savegame format](https://awesomerea.org/resources/serflings-settlers-save-format/index.md): Documentation · Serflings publishes a byte-level reference for Settlers 1 savegames. It maps little-endian common data, player, map, settler, flag, building, and inventory sections, listing their offsets and field sizes. The repository also manages issues for the remake.
- [Game Boy Advance LCD Interface](https://awesomerea.org/resources/gba-lcd-interface/index.md): Documentation · Game Boy Advance LCD Interface documents the handheld's 40-pin and 32-pin display connectors and interprets their pixel clock, RGB data, latch and synchronization signals. Pin tables and captured waveforms describe signal edges, the approximate refresh rate and changes during vertical blanking.
- [WoWDBDefs](https://awesomerea.org/resources/wowdbdefs/index.md): Documentation · WoWDBDefs records column names, types, relationships and versioned layouts for World of Warcraft DBC and DB2 client databases. Its DBD format represents build ranges and layout hashes, while accompanying C# and Python code reads definitions and converts them for other tools.
- [MinYMizer](https://awesomerea.org/resources/minymizer/index.md): Documentation · MinYMizer documents a portable representation of maxYMiser MYS song and MYV voiceset files for lightweight PSG playback. It specifies the fixed-layout MXG format and examines LZ and Huffman compression of pattern data. Its format design focuses on YM2149F features that do not rely on timer-driven effects.
- [GTPD-Code-Reference](https://awesomerea.org/resources/gtpd-code-reference/index.md): Documentation · GTPD-Code-Reference documents Ghost Trick: Phantom Detective's Nintendo DS code through C++ type declarations and linker symbol maps. It includes game and framework headers, format structures such as CPAC, and ARM9 function addresses for compiling custom code.
- [rea-lab](https://awesomerea.org/resources/rea-lab/index.md): Research · A Windows REA/Ghidra lab with seeded challenges, published studies, upstream contributions and recorded limitations.
- [LLM4Decompile (EMNLP 2024)](https://awesomerea.org/resources/llm4decompile-paper/index.md): Research · Research on direct binary decompilation and refinement of Ghidra output with language models. Evaluates re-executability on HumanEval and ExeBench; useful for distinguishing readable output from functional recovery.
- [DecompileBench (Findings of ACL 2025)](https://awesomerea.org/resources/decompilebench-paper/index.md): Research · A benchmark combining functions from real programs, runtime-aware validation, and LLM-assisted assessment of decompiled-code usability. Helps separate functional correctness from perceived understandability when comparing decompilers.
- [ReSym (CCS 2024)](https://awesomerea.org/resources/resym-paper/index.md): Research · Combines language models and program analysis to recover variable and user-defined data-structure symbols from stripped binaries. The authors provide training, inference, evaluation, and posterior-reasoning artifacts.
- [CNNPRE (IEEE Access 2023)](https://awesomerea.org/resources/cnnpre/index.md): Research · Research code and data for CNNPRE, a message-type identification method for protocol reverse engineering by Javad Garshasbi and Mehdi Teimouri, published in IEEE Access in 2023. A single Colab notebook turns each message's padded bit string into a resized grayscale image, extracts features with an ImageNet-pretrained ResNet50 as transfer learning, adds message direction and length-group encodings, reduces the features with UMAP and clusters messages with agglomerative clustering and HDBSCAN, scoring each clustering against labelled message types. Preprocessed message datasets for twelve protocols, from ARP and DNS to SMTP and GSM, accompany the notebook.
- [esp-idf-injection-ng](https://awesomerea.org/resources/esp-idf-injection-ng/index.md): Research · esp-idf-injection-ng documents an investigation of ESP-IDF's compiled libnet80211.a frame-type check. The author traces why symbol overrides fail in v5 and later, then supplies an objcopy patch, demonstration firmware and captures for transmitting additional 802.11 management frames through esp_wifi_80211_tx.
- [T2 platform research](https://awesomerea.org/resources/t2-platform-research/index.md): Research · T2 platform research maps Apple T2 firmware, hardware and Linux-facing interfaces using static analysis, hardware observations and driver comparisons. Its chapters cover Secure Enclave services, boot and recovery, graphics, audio, sensors, storage and other subsystems. Machine-readable findings and board indexes connect claims to their evidence, with Python reference code for selected message formats.
- [Glaurung Models](https://awesomerea.org/resources/glaurung-models/index.md): Research · Glaurung Models contains tokenizer and model experiments for executable analysis. Its documented 64K BPE tokenizer encodes compiled PE and ELF bytes using Latin-1, with x86 and ARM64 training coverage; an accompanying analysis compares learned SSE and AVX instruction patterns across two tokenizers.
- [Binary BPE Tokenizer for Executable Analysis](https://awesomerea.org/resources/binary-bpe-tokenizer-research/index.md): Research · Binary BPE Tokenizer for Executable Analysis studies byte-pair encoding of ELF, PE, Mach-O and APK files for transformer-based binary analysis. The repository provides paper sources, 4K to 64K tokenizer vocabularies, Python evaluation scripts and a sample archive. The author reports 2.89 bytes per token for the 64K vocabulary.
- [Spelunking](https://awesomerea.org/resources/spelunking/index.md): Research · Spelunking studies Apple apps, private frameworks and system services with Swift and Objective-C probes. It inventories runtime classes, symbols, notifications and MediaRemote state, while publishing target-specific writeups and raw captures for Messages, Phone, MediaRemote and UserNotifications.
- [DecBench](https://awesomerea.org/resources/decbench/index.md): Research · DecBench is an experimental benchmark for comparing decompilers and language models on recovering exact source code. The README defines metrics and datasets for structure, types, and precise recompilability, and says scores can be updated as new decompilers appear.
- [Decompile-Bench-Eval](https://awesomerea.org/resources/decompile-bench-eval/index.md): Research · Decompile-Bench-Eval is a binary decompilation evaluation dataset pairing C and C++ function source with assembly and IDA Pro and Ghidra pseudocode. Its HumanEval, MBPP and GitHub 2025 splits also record optimization levels and function information.
- [Java Decompiler Dataset](https://awesomerea.org/resources/java-decompiler-dataset/index.md): Research · Java Decompiler Dataset provides paired Java source and decompiled Java assembly for training and evaluating decompilation models. Its samples are compilable single-class files selected from public GitHub repositories, with fields for source, assembly, tests and partial class scaffolds.