# retoolkit

> Windows setup program, built with Inno Setup, that installs a ready-made x86/x64 reverse-engineering and malware-analysis toolkit as selectable components: debuggers, decompilers, hex editors, PE, ELF, .NET, Java, Go, Delphi and AutoIt analyzers, and process-inspection, unpacking, network, OLE/PDF and signature tools. Tools open from a desktop launcher or from a retoolkit entry in Explorer's right-click menu that passes the selected file; the README says some come preconfigured, such as x64dbg with plugins and command-line tools that run from any directory. The repository holds only the installer scripts, while the bundled programs are third-party tools under their own terms.

- Type: Tool
- Targets: Binary
- Category: Native analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-27
- Added to the catalog: 2026-11-09
- Original resource: <https://github.com/mentebinaria/retoolkit>
- Primary source: <https://github.com/mentebinaria/retoolkit/blob/8a5d1197c07ab0635c2948d42f53bda696680125/README.md>
- Catalog page: <https://awesomerea.org/resources/retoolkit/>
- Record JSON: <https://awesomerea.org/resources/retoolkit/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/retoolkit/index.md)

## Requirements & limits

- Release 2026.04 was published on 2026-05-16 as a roughly 2 GB 7z archive containing the setup program. The main branch also adds copyright and attribution notices and adjusts the Nmap and Wireshark scripts.
- For x86 and x64 Windows hosts; the JDK component, which is also installed with Ghidra, runs only in 64-bit install mode. The README says some included tools are not open source and come from uncertain sources, advises installing the toolkit only in a virtual machine at the user's own responsibility, and notes that Windows Defender may flag files during installation. Analysis inputs are the user's own samples.
- The .iss scripts copy tool files from a local source folder that is not in the repository, so the setup program cannot be rebuilt from the repository alone; CHECKSUMS.txt lists MD5 hashes for 35,444 bundled files.
- COPYING.txt applies Apache-2.0 to the installer scripts; every bundled program keeps its own license. Besides open-source tools such as Ghidra, x64dbg and ImHex, CHECKSUMS.txt lists executables for pestudio, HxD, API Monitor with its kernel drivers, Exeinfo PE and Resource Hacker, and the installers jdk-25_windows-x64_bin.exe and npcap-1.87.exe. The README states that only software authorized for redistribution by its license or by its authors is included.

## Primary sources

1. <https://github.com/mentebinaria/retoolkit/blob/8a5d1197c07ab0635c2948d42f53bda696680125/README.md>
2. <https://github.com/mentebinaria/retoolkit/blob/8a5d1197c07ab0635c2948d42f53bda696680125/src/installer/retoolkit.iss>
3. <https://github.com/mentebinaria/retoolkit/blob/8a5d1197c07ab0635c2948d42f53bda696680125/src/installer/utilities/jdk.iss>
4. <https://github.com/mentebinaria/retoolkit/blob/8a5d1197c07ab0635c2948d42f53bda696680125/src/installer/debuggers/x64dbg.iss>
5. <https://github.com/mentebinaria/retoolkit/blob/8a5d1197c07ab0635c2948d42f53bda696680125/CHANGELOG.md>
6. <https://github.com/mentebinaria/retoolkit/blob/8a5d1197c07ab0635c2948d42f53bda696680125/CHECKSUMS.txt>
7. <https://github.com/mentebinaria/retoolkit/blob/8a5d1197c07ab0635c2948d42f53bda696680125/COPYING.txt>

## More in Native binaries

- [D-810 ng](https://awesomerea.org/resources/d810-ng/index.md) · Tool
- [Anvill](https://awesomerea.org/resources/anvill/index.md) · Tool
- [XRefer](https://awesomerea.org/resources/xrefer/index.md) · Tool
- [dsdump (paradiseduo wrapper)](https://awesomerea.org/resources/paradiseduo-dsdump/index.md) · Tool
- [Dr. Memory](https://awesomerea.org/resources/dr-memory/index.md) · Tool
- [Intel XED](https://awesomerea.org/resources/intel-xed/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.