{
  "added_at": "2026-11-09",
  "additional_evidence_urls": [
    "https://github.com/mentebinaria/retoolkit/blob/8a5d1197c07ab0635c2948d42f53bda696680125/src/installer/retoolkit.iss",
    "https://github.com/mentebinaria/retoolkit/blob/8a5d1197c07ab0635c2948d42f53bda696680125/src/installer/utilities/jdk.iss",
    "https://github.com/mentebinaria/retoolkit/blob/8a5d1197c07ab0635c2948d42f53bda696680125/src/installer/debuggers/x64dbg.iss",
    "https://github.com/mentebinaria/retoolkit/blob/8a5d1197c07ab0635c2948d42f53bda696680125/CHANGELOG.md",
    "https://github.com/mentebinaria/retoolkit/blob/8a5d1197c07ab0635c2948d42f53bda696680125/CHECKSUMS.txt",
    "https://github.com/mentebinaria/retoolkit/blob/8a5d1197c07ab0635c2948d42f53bda696680125/COPYING.txt"
  ],
  "category": "native-analysis",
  "description_en": "Windows setup program, built with Inno Setup, that installs a ready-made x86/x64 reverse-engineering and malware-analysis toolkit as selectable components: debuggers, decompilers, hex editors, PE, ELF, .NET, Java, Go, Delphi and AutoIt analyzers, and process-inspection, unpacking, network, OLE/PDF and signature tools. Tools open from a desktop launcher or from a retoolkit entry in Explorer's right-click menu that passes the selected file; the README says some come preconfigured, such as x64dbg with plugins and command-line tools that run from any directory. The repository holds only the installer scripts, while the bundled programs are third-party tools under their own terms.",
  "description_zh": "基于 Inno Setup 构建的 Windows 安装程序，以可选组件的形式安装一套现成的 x86/x64 逆向工程与恶意软件分析工具集：调试器、反编译器、十六进制编辑器，PE、ELF、.NET、Java、Go、Delphi 和 AutoIt 分析工具，以及进程检查、脱壳、网络、OLE/PDF 和特征匹配工具。可从桌面启动器打开工具，也可通过资源管理器右键菜单中的 retoolkit 项把所选文件直接交给工具；README 称部分工具已预先配置，例如带插件的 x64dbg，以及可在任意目录运行的命令行工具。仓库只包含安装脚本，打包的程序都是第三方工具，各自适用其条款。",
  "entry_url": "https://awesomerea.org/resources/retoolkit/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/retoolkit/",
  "evidence_url": "https://github.com/mentebinaria/retoolkit/blob/8a5d1197c07ab0635c2948d42f53bda696680125/README.md",
  "group": "tools",
  "id": "retoolkit",
  "json_url": "https://awesomerea.org/resources/retoolkit/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/retoolkit/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/retoolkit/index.md",
  "name": "retoolkit",
  "name_zh": "retoolkit 逆向工程工具集安装程序",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Release 2026.04 was published on 2026-05-16 as a roughly 2 GB 7z archive containing the setup program. The main branch also adds copyright and attribution notices and adjusts the Nmap and Wireshark scripts.",
    "For x86 and x64 Windows hosts; the JDK component, which is also installed with Ghidra, runs only in 64-bit install mode. The README says some included tools are not open source and come from uncertain sources, advises installing the toolkit only in a virtual machine at the user's own responsibility, and notes that Windows Defender may flag files during installation. Analysis inputs are the user's own samples.",
    "The .iss scripts copy tool files from a local source folder that is not in the repository, so the setup program cannot be rebuilt from the repository alone; CHECKSUMS.txt lists MD5 hashes for 35,444 bundled files.",
    "COPYING.txt applies Apache-2.0 to the installer scripts; every bundled program keeps its own license. Besides open-source tools such as Ghidra, x64dbg and ImHex, CHECKSUMS.txt lists executables for pestudio, HxD, API Monitor with its kernel drivers, Exeinfo PE and Resource Hacker, and the installers jdk-25_windows-x64_bin.exe and npcap-1.87.exe. The README states that only software authorized for redistribution by its license or by its authors is included."
  ],
  "requirements_zh": [
    "2026.04 版于 2026-05-16 发布，为约 2 GB 的 7z 压缩包，内含安装程序。main 分支还补充了版权与署名说明，并调整 Nmap 和 Wireshark 脚本。",
    "适用于 x86 和 x64 Windows 主机；JDK 组件在安装 Ghidra 时也会一并安装，且只在 64 位安装模式下运行。README 称部分工具采用闭源形式、来源可疑，建议只在虚拟机中安装并自行承担风险，还提到 Windows Defender 可能在安装时报毒。分析对象是使用者自己的样本。",
    ".iss 脚本从一个不在仓库中的本地源目录复制工具文件，因此仅凭仓库无法重新构建安装程序；CHECKSUMS.txt 列出 35,444 个打包文件的 MD5 哈希。",
    "COPYING.txt 对安装脚本适用 Apache-2.0；每个打包程序保留各自的许可证。除 Ghidra、x64dbg、ImHex 等开源工具外，CHECKSUMS.txt 还列出 pestudio、HxD、API Monitor（含其内核驱动）、Exeinfo PE 和 Resource Hacker 的可执行文件，以及 jdk-25_windows-x64_bin.exe 和 npcap-1.87.exe 安装程序。README 声明只收录许可证或作者允许再分发的软件。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/mentebinaria/retoolkit",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}