Tool

retoolkit

Windows setup program, built with Inno Setup, that installs a ready-made x86/x64 reverse-engineering and malware-analysis toolkit as selectable components: debuggers, decompilers, hex editors, PE, ELF, .NET, Java, Go, Delphi and AutoIt analyzers, and process-inspection, unpacking, network, OLE/PDF and signature tools. Tools open from a desktop launcher or from a retoolkit entry in Explorer's right-click menu that passes the selected file; the README says some come preconfigured, such as x64dbg with plugins and command-line tools that run from any directory. The repository holds only the installer scripts, while the bundled programs are third-party tools under their own terms.

Targets: Binary
Category: Native analysis tools
Relationship: Foundation tool
Sources reviewed: 2026-10-27

Stars: 5.3k
Last commit: 2026-09-10
Language: Inno Setup
License (GitHub): Apache-2.0

GitHub data as of 2026-11-09

Copy as Markdown View JSON Cite

Requirements & limits

Release 2026.04 was published on 2026-05-16 as a roughly 2 GB 7z archive containing the setup program. The main branch also adds copyright and attribution notices and adjusts the Nmap and Wireshark scripts.
For x86 and x64 Windows hosts; the JDK component, which is also installed with Ghidra, runs only in 64-bit install mode. The README says some included tools are not open source and come from uncertain sources, advises installing the toolkit only in a virtual machine at the user's own responsibility, and notes that Windows Defender may flag files during installation. Analysis inputs are the user's own samples.
The .iss scripts copy tool files from a local source folder that is not in the repository, so the setup program cannot be rebuilt from the repository alone; CHECKSUMS.txt lists MD5 hashes for 35,444 bundled files.
COPYING.txt applies Apache-2.0 to the installer scripts; every bundled program keeps its own license. Besides open-source tools such as Ghidra, x64dbg and ImHex, CHECKSUMS.txt lists executables for pestudio, HxD, API Monitor with its kernel drivers, Exeinfo PE and Resource Hacker, and the installers jdk-25_windows-x64_bin.exe and npcap-1.87.exe. The README states that only software authorized for redistribution by its license or by its authors is included.

Cite

BibTeX

@misc{retoolkit,
  title = {{retoolkit}},
  howpublished = {\url{https://github.com/mentebinaria/retoolkit}},
  url = {https://github.com/mentebinaria/retoolkit},
  urldate = {2026-10-27},
  note = {Awesome REA entry: \url{https://awesomerea.org/resources/retoolkit/}}
}

Plain text

retoolkit. https://github.com/mentebinaria/retoolkit (accessed 2026-10-27). Awesome REA entry: https://awesomerea.org/resources/retoolkit/

Useful? Star Awesome REA on GitHub2.4k

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

README.md GitHub · mentebinaria/retoolkit · Revision 8a5d119
src/installer/retoolkit.iss GitHub · mentebinaria/retoolkit · Revision 8a5d119
src/installer/utilities/jdk.iss GitHub · mentebinaria/retoolkit · Revision 8a5d119
src/installer/debuggers/x64dbg.iss GitHub · mentebinaria/retoolkit · Revision 8a5d119
CHANGELOG.md GitHub · mentebinaria/retoolkit · Revision 8a5d119
CHECKSUMS.txt GitHub · mentebinaria/retoolkit · Revision 8a5d119
COPYING.txt GitHub · mentebinaria/retoolkit · Revision 8a5d119