Runtime and debugging.

An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.

Main repo for hosting release binaries

Exploit Development and Reverse Engineering with GDB & LLDB Made Easy

Record and Replay Framework

GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux

Patch iOS apps without jailbreaking using CaptainHook Tweak, Logos Tweak, and command-line tools.

A True Instrumentable Binary Emulation Framework

State-of-the-art native debugging tools

Malware Configuration And Payload Extraction

Dynamic Instrumentation Tool Platform

Reverse engineering tool for Linux

Runtime Mobile Security (RMS) 📱🔥 - is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime

x64dbg-MCP Server is a native MCP (Model Context Protocol) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Connect any MCP-compatible AI assistant and control x64dbg programmatically: set breakpoints, step through code, read memory, dump registers, and more. Built with Zig — zero dependencies, single-binary output, cros

ret-sync is a set of plugins that helps to synchronize a debugging session (WinDbg/GDB/LLDB/OllyDbg2/x64dbg) with IDA/Ghidra/Binary Ninja disassemblers.

A Dynamic Binary Instrumentation framework based on LLVM.

A Pin Tool for tracing API calls etc

A collection of my Frida instrumentation scripts to reverse engineer mobile apps and more.

IDA 2016 plugin contest winner! Symbolic Execution just one-click away!

Radare2 and Frida better together.

A collection of excellent reverse engineering articles I have read, well worth a look.

DRAKVUF Sandbox - automated hypervisor-level malware analysis system

Most usable tools for iOS penetration testing

Full featured multi arch/os debugger built on top of PyQt5 and frida

Open-source AI reverse-engineering agent platform and MCP server for Ghidra, Frida, x64dbg and Rizin — automated PE/APK/binary analysis, CTF and malware research, with 100+ MCP tools and a 194-article runnable knowledge base.

A tool that helps you easy trace classes, functions, and modify the return values of methods on iOS platform

A powerful static binary rewriting tool

Cross-platform decryption of QQ chat databases

Cross-platform instrumentation and introspection library written in C

Historical Windows temporal memory-state research artifact for studying time-bound memory observations, validation limits, and defensive visibility.

DyninstAPI: Tools for binary instrumentation, analysis, and modification.

Notes on interesting things I encounter while learning Android reverse engineering.

Frida core library

IDA Pro plugin that implements more user-friendly register and stack views

An online assembly editor, emulator and debugger for the x86-64 architecture

Unofficial frida extension for VSCode

Labeless is a multipurpose IDA Pro plugin system for labels/comments synchronization with a debugger backend, with complex memory dumping and interactive Python scripting capabilities.

Wechaty Puppet WeChat Windows Protocol

Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js

tool to extract passwords from TeamViewer memory using Frida

Bidirectional XPC message interception and more. Powered by Frida

Run a more undetectable frida server on boot using magisk 🔐✅

Work in progress...

A persistence solution for Frida

A comprehensive binary emulation and instrumentation platform.

Patch iOS Apps, The Easy Way, Without Jailbreak.

A low-overhead dynamic binary instrumentation and modification tool for ARM (both AArch32 and AArch64 support) and RISC-V (RV64GC).

Cycript fork powered by Frida.

Human-friendly cross-platform system call tracing and hooking library based on Frida's Stalker

Use Frida to retrieve functions dynamically registered through JNI RegisterNatives.

Java Dynamic Reverse Engineering and Debugging Tool

gdbghidra - a visual bridge between a GDB session and GHIDRA

Frida Boot 👢- A binary instrumentation workshop, with Frida, for beginners!

A Python library to debug binary executables, your own way.

fpicker is a Frida-based fuzzing suite supporting various modes (including AFL++ in-process fuzzing)

frick - aka the first debugger built on top of frida

Data Visualization Plugin for IDA Pro

Use angr in the IDA Pro debugger generating a state from the current debug session

Script to Automate installtion of Apps ,frida server and moving Burpsuite certificate to root folder

frida runtime (no python required, only a single file),One-click support for ios dump

Trace APIs declaratively through Frida.

Package your Frida script into an executable.

WinDbg-like kernel debugger for Windows, from Linux and macOS

This repo aims at providing practical examples on how to use r2frida

An AI-agent skill system for mobile reverse engineering: Frida hooks, one-click unpacking, anti-detection bypasses, in-memory DEX dumps, and symbol/structure recovery through Ghidra MCP.

Tool to decrypt iOS apps using r2frida

iOS library (SDK) providing app security and threat monitoring. Shield your app with free RASP. Detect reverse engineering, jailbreak, Frida, emulators, bots, signature and integrity issues, VPN usage, and monitor device identification and more.

GUI for Frida -Scripts

Automates creating and capturing Free Fire guest accounts via Frida, formats and manages them, obtains JWTs, and sends encrypted like requests to a target UID with concurrency controls and one-like-per-guest-per-target guarantees.

disassembler, decompiler and debugger in one, with a built-in mcp server: point an ai at a binary and it can debug it, not just read it. ida-style listing, pseudocode (f5), x64dbg-style debugger (windows and linux), binary diff, lua plugins. reads pe, elf and mach-o. runs on windows, linux and macos.

Sniff XPC communication using Frida and Go

An interactive disassembler for the CPU 6502, focused on Commodore 8-bit computers. Features a TUI with modern features like x-ref, undo/redo, flow arrows, keyboard-driven, MCP server for auto analysis, VICE debugger and more!

iOS is Apple's proprietary operating system that runs on the iPhone, iPod Touch and iPad. A lot of components are specific to iOS. Here are key features of the iOS hardware and software security architecture and guide how to test your applications.

AirSpy - Frida-based tool for exploring and tracking the evolution of Apple's AirDrop protocol implementation on i/macOS, from the server's perspective. Released during BH USA 2019 Training https://www.nowsecure.com/event/advanced-frida-and-radare-a-hackers-delight/

Personal study and research notes on Objective-C, C++, iOS reverse engineering, assembly and Python.

SDA is a rich cross-platform tool for reverse engineering that focused firstly on analysis of computer games. I'm trying to create a mix of the Ghidra, Cheat Engine and x64dbg. My tool will combine static and dynamic analysis of programs. Now SDA is being developed.

Resources About Dynamic Binary Instrumentation and Dynamic Binary Analysis

Jailbreak detection was changed through the years. This is a history overview and analysis of modern applications like Snapchat and Pokemon GO.

Random things

A versatile C++ function mocking framework.

A simple scraper for Ultimate-Guitar.com's mobile API, written in Go.

A set of plugins for Ghidra and x64Dbg synchronization. A faster, more flexible ret-sync.

First open-source DMA-based HWID spoofer written in Rust. Spoof hardware IDs via direct memory access.

Command line utility that interacts with plugged in iOS devices. Uses Apple's MobileDevice framework

Robust Frida-based tool to dump decrypted iOS apps as .ipa from a jailbroken device supports App Store, sideloaded and system.

Fuzz iOS URL schemes

SherlockElf is a powerful tool designed for both static and dynamic analysis of Android ELF binaries and dynamic iOS Macho-O binaries (experimental).

Traces syscalls on iOS via Frida, including Mach syscalls.

Malware dynamic instrumentation tool based on frida framework

Use frida-gum's stalker for tracing

Inject JS and C# into Windows apps, call COM and WinRT APIs

Extension for GDB

Using Frida Stalker to Bypass OLLVM and Restore (Function Call Analysis, Parameter Analysis, Stack Trace Printing, Instruction & Registers Trace).

frida runtime resolves smali

Frida script to bypass the iOS application Jailbreak Detection

This module allows you to easily inject javascript using frida and frida-load.

ARM64 trace evidence analysis & cipher algorithm recovery — Claude Desktop plugin with skills + local MCP server driving the native ak_search engine over GB-scale trace files

Debug and DebugX (short: Debug/X) are extended versions of MS DEBUG

All the mono c exports, ready to be used in frida!

Python script to hook ZIP files passwords in Windows 10

6502 CPU emulator, assembler, disassembler, debugger and host written in go

Wii U RAM TCP Debugger Client/Cheat Code Manager

Full-stack mobile game-security research (Honor of Kings / sgame): kernel-mode cross-process memory reading (KernelPatch KPM), Tencent ACE anti-cheat & IL2CPP/native engine reverse engineering, and a real-time ESP overlay. Educational / research only; no proprietary binaries.

Tool to automate the process of embedding dynamic libraries into iOS applications from GNU/Linux

Automated SSL pinning bypass for any Flutter & Shorebird version — PyGhidra static analysis auto-discovers BoringSSL and generates ready-to-run Frida & Renef scripts

Hooks libboringssl.dylib to extract TLS keys and enables the traffic from iOS apps to be decrypted.

XDV is disassembler or debugger that works based on the extension plugin.

Decrypt VMware vTPM-encrypted .vmem/.vmsn/.vmss/.nvram from the VM password, and flatten the .vmem to a Volatility-ready image.

MCP server for Frida.

reverse engineering of the windows nt kernel debugger protocol & reimplementation.

Unofficial patches for IDA 7.5 Demo on Linux x86_64. Suffering from success: Hex-Rays SA DMCA’d repository.

Use angr inside the radare2 debugger. Create an angr state from the current debugger state.

Redirect spawned iOS application stdout and stderr to pty

Open-source memory forensics platform for DFIR, threat hunting, malware analysis, and incident response.

Neo Geo Pocket / Color emulator with a full debugger and fan-translation & ROM hacking tools (.tbl tables, relative search, pointer finder, ROM diff). Save states, rewind, Windows/Linux/macOS builds.

The Native Reverse Engineering IDE. Zero-overhead binary analysis, full CPU emulation (PE/ELF), and headless automation. Powered by Capstone, Unicorn, LLVM & Remill via N-API.

iOS SSL Bypass & Real-Time Traffic Monitor – A Frida-based script for bypassing SSL pinning and monitoring network traffic on iOS apps in real-time. Designed for security researchers and ethical testing. 📡🔓

MCP server for Frida 17 dynamic instrumentation

A reverse-engineering toolkit for iOS and Android applications (Frida, mitmproxy, Ghidra, Theos)

Reverse-engineering skills for AI coding agents, with IDA/MCP integration, APK and JavaScript workflows, bounded agent swarms, and routing evaluation.

Decrypt and dump iOS app binaries to an IPA file via USB and SSH/SFTP

Frida wrapper for iOS/macOS penetration testers and reverse engineers. (WIP)

Custom-built for dsh (DeepSeek Harness): a persistent Ghidra headless daemon and reverse-engineering agent skills (triage/unpack/decompile/pwn/pcap/APK), with circuit breakers against agent failure loops and skills that evolve through retrospectives.

Dart AOT snapshot analyzer: exports blutter-compatible symbols and structs for IDA / radare2 / Frida, and decompiles functions into dart-analyze-clean Dart. Desktop and real-device mobile (compressed pointers), Dart 2.7-3.14. No Dart SDK, never runs the target.

Dynamic branch-divergence finder for native code -- traces two Frida executions and finds the exact instruction where they diverge.

Browse, scan, modify, custom by frida

A reverse engineering laboratory for iOS applications.

Personal reverse engineering toolbox with custom tools, scripts, and malware analysis notes.

Loonaro - Automated Malware Analysis

Driver-backed Windows kernel interface for VAD-tree inspection/manipulation, PTE relinking, and cross-process memory operations, with runtime symbol resolution from ntoskrnl's PDB.

Reverse engineering the Black Energy Driver

Modern C++17 wrapper for MemProcFS/VMMDLL with structured DMA memory APIs, process introspection, scanning, input support, and hardware-free tests.

Expert reverse engineer specializing in binary analysis, malware research, and low-level system internals. Experienced in dissecting complex software, uncovering vulnerabilities, and understanding code beyond source-level abstraction

Generate layered Frida TLS testing agents from Flutter engine binaries.

Defensive C++20 library for runtime memory integrity, hook detection, and anti-tamper monitoring on Windows/Linux

🛡️ Mobile-first Interactive Disassembler & Decompiler Framework — IDA Pro / Ghidra-class RE on Android. APK · ELF · PE · DEX · ARM64 · x86-64 · IR decompiler · call graph · ptrace debugger · SakoScript plugins. Created by Maxamed Xasan Muse 🇸🇴

A deterministic memory-mapping and database forensic suite engineered to audit client-side data leakage and bypass ephemeral privacy controls via SQLite Write-Ahead Logs (.db-wal).

Offset Zero: A free, open-source field guide to digital forensics, reverse engineering, and detection engineering. Start at the first byte. YEAHH, ITS MORE OF A MINDSET!

Reproducible Apple security research environments for macOS, iOS and iPadOS.

MCP server for reverse engineering — 77 semantic operations: static triage, unpacking, decompilation (Ghidra/IDA), dynamic instrumentation (frida/TTD), emulation (Unicorn), symbolic execution (angr), evidence handling. Works with any MCP-compatible agent host.

An Electron-based AI workbench for CTF reverse-engineering challenges on Windows. It combines an AI tool loop with local validation, connects to IDA, JEB, and Burp through MCP, and automatically tackles APK, PE, ELF, PYC, DEX, JAR, Mach-O, Lua, and Web-JS challenges. Includes 11 methodology skills, a 54-page structured knowledge base, and self-improvement from experience.

Deterministic binary analysis, runtime instrumentation & protocol reverse-engineering skill for AI coding agents.

Give your reverse-engineering agent a memory, a map, and receipts.

Reverse engineer APKs and analyze native binaries directly on your Android device without a PC or ADB.

Inspect, analyze, and debug JavaScript bundles from webpack, rspack, rollup, esbuild, and Vite.

Give a coding agent evidence, not screenshots: local workbench to reverse Android, iOS, desktop and web protocol clients with JADX, radare2, ADB, Frida and live HTTP probes.

A set of Frida scripts to help inspect Firebase calls in Flutter apps on iOS

Interactive x86 & x86-64 assembly simulator and reverse-engineering lab — step-through 32/64-bit engines, stack playground, register quiz, 28 tutorials, and 7 tools. Pure browser, no build, no dependencies.

An AI-assisted, multi-platform reverse engineering workbench integrating Ghidra, Frida, and MCP. Features zero-dependency triage for APK/ELF/PE, entropy-based packer detection, and strict default-deny authorization for secure, reproducible analysis.

Open-source Android security auditing and ethical hacking toolkit for authorized ADB inspection, APK analysis, reverse engineering, network test Ethical Hacker Toolkit for Android security auditing, reverse engineering, dynamic analysis, network inspection, and APK analysis using ADB, JADX, Apktool, Ghidra, Frida, MobSF and TShark.

Automated firmware analysis framework combining recursive extraction, Ghidra-based static analysis, and dynamic binary instrumentation to detect cryptographic primitives and hardcoded secrets in stripped binaries

One-click Windows modkit with stable sandbox/bin paths for the current Ghidra, Unity, Unreal and reverse-engineering tools an agent should call.

A Windows PE runtime for Linux: native guest execution, in-process debugging, offline de-virtualization. No Wine, no emulator.