{
  "category": "dynamic-analysis",
  "count": 152,
  "kind": "repository-category",
  "labels": [
    "Runtime and debugging",
    "运行时与调试"
  ],
  "note": "Automatically discovered repository index, unreviewed. Stars, licenses and last-push times are collection-time snapshots.",
  "note_zh": "自动发现的仓库索引，未审核。星标、许可证与最近推送时间均为采集时快照。",
  "page_url": "https://awesomerea.org/browse/dynamic-analysis/",
  "page_url_zh": "https://awesomerea.org/zh/browse/dynamic-analysis/",
  "repositories": [
    {
      "category": "dynamic-analysis",
      "description_en": "An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.",
      "description_language": "bilingual",
      "description_zh": "面向 Windows 的开源用户态调试器，针对逆向工程和恶意软件分析进行了优化。",
      "full_name": "x64dbg/x64dbg",
      "id": "scan-33791743",
      "license": "NOASSERTION",
      "observed_at": "2026-10-16T01:35:23.874647Z",
      "pushed_at": "2026-10-09T10:40:58Z",
      "readme_sha256": "66607f0df8c2e5f30bcfa00de99e4b1df059215e89ac43ac28bc0cc6fb166f47",
      "readme_url": "https://github.com/x64dbg/x64dbg/blob/development/README.md",
      "stars": 49888,
      "targets": [
        "binary"
      ],
      "topics": [
        "binary-analysis",
        "ctf",
        "cybersecurity",
        "debugger",
        "debugging",
        "disassembler",
        "dynamic-analysis",
        "exploit-development",
        "hacking",
        "malware-analysis",
        "offensive-security",
        "oscp",
        "program-analysis",
        "reverse-engineering",
        "security",
        "security-tools",
        "windows",
        "x64",
        "x86",
        "x86-64"
      ],
      "url": "https://github.com/x64dbg/x64dbg",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Main repo for hosting release binaries",
      "description_language": "bilingual",
      "description_zh": "用于托管发布版二进制文件的主仓库。",
      "full_name": "frida/frida",
      "id": "scan-9405122",
      "license": "NOASSERTION",
      "observed_at": "2026-10-16T01:35:59.347260Z",
      "pushed_at": "2026-10-15T17:34:44Z",
      "readme_sha256": "8478d48f61310d01be76702014de292852260f32cda695a64f8f86ab110b655b",
      "readme_url": "https://github.com/frida/frida/blob/main/README.md",
      "stars": 22317,
      "targets": [
        "app",
        "binary",
        "game"
      ],
      "topics": [
        "frida",
        "instrumentation",
        "vala"
      ],
      "url": "https://github.com/frida/frida",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Exploit Development and Reverse Engineering with GDB & LLDB Made Easy",
      "description_language": "bilingual",
      "description_zh": "让使用 GDB 和 LLDB 进行漏洞利用开发与逆向工程变得简单。",
      "full_name": "pwndbg/pwndbg",
      "id": "scan-31181767",
      "license": "MIT",
      "observed_at": "2026-10-16T01:35:24.722654Z",
      "pushed_at": "2026-10-12T17:50:08Z",
      "readme_sha256": "8a4facab92788380c58d4e1bc388cf80b27d5381b4920eeca7b622ab1e442704",
      "readme_url": "https://github.com/pwndbg/pwndbg/blob/dev/README.md",
      "stars": 11064,
      "targets": [
        "binary"
      ],
      "topics": [
        "binary-ninja",
        "capture-the-flag",
        "ctf",
        "debugging",
        "disassembler",
        "exploit-development",
        "gdb",
        "gef",
        "hacking-tool",
        "ida-pro",
        "linux",
        "lldb",
        "low-level",
        "malware-analysis",
        "pwnable",
        "pwndbg",
        "python",
        "reverse-engineering"
      ],
      "url": "https://github.com/pwndbg/pwndbg",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Record and Replay Framework",
      "description_language": "bilingual",
      "description_zh": "录制与回放框架。",
      "full_name": "rr-debugger/rr",
      "id": "scan-2269868",
      "license": "NOASSERTION",
      "observed_at": "2026-10-16T07:14:45.650412Z",
      "pushed_at": "2026-10-16T01:24:48Z",
      "readme_sha256": "14b1924211e22bfe03f91057bae978189a5b471c0bc1e30fc632f087c8d6e7a0",
      "readme_url": "https://github.com/rr-debugger/rr/blob/master/README.md",
      "stars": 10707,
      "targets": [
        "binary"
      ],
      "topics": [
        "debugger",
        "gdb",
        "linux",
        "reverse-execution"
      ],
      "url": "https://github.com/rr-debugger/rr",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux",
      "description_language": "bilingual",
      "description_zh": "GEF（GDB Enhanced Features）：为 Linux 上的漏洞利用开发人员和逆向工程师提供现代化 GDB 体验及高级调试功能。",
      "full_name": "hugsy/gef",
      "id": "scan-32955140",
      "license": "MIT",
      "observed_at": "2026-10-16T01:35:33.594802Z",
      "pushed_at": "2026-08-20T21:35:23Z",
      "readme_sha256": "e93c05c5f7f2b0f36cfddc047b1407d6f3d00734d095a88de714154d3df7e677",
      "readme_url": "https://github.com/hugsy/gef/blob/main/README.md",
      "stars": 8399,
      "targets": [
        "binary"
      ],
      "topics": [
        "binary-ninja",
        "ctf",
        "debugging",
        "discord",
        "exploit",
        "exploit-development",
        "gdb",
        "gef",
        "ida-pro",
        "linux",
        "malware-analysis",
        "mips",
        "powerpc",
        "pwn",
        "pwntools",
        "python",
        "python-api",
        "reverse-engineering",
        "sparc"
      ],
      "url": "https://github.com/hugsy/gef",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Patch iOS apps without jailbreaking using CaptainHook Tweak, Logos Tweak, and command-line tools.",
      "description_language": "bilingual",
      "description_zh": "无需越狱，利用 CaptainHook Tweak、Logos Tweak 和命令行工具为 iOS 应用打补丁。",
      "full_name": "AloneMonkey/MonkeyDev",
      "id": "scan-95544373",
      "license": "GPL-3.0",
      "observed_at": "2026-10-16T01:35:33.834171Z",
      "pushed_at": "2022-07-09T08:24:07Z",
      "readme_sha256": "b996fe3c17a58999323cd60c850b8c97a3276571bca91de843286c59f5e7586e",
      "readme_url": "https://github.com/AloneMonkey/MonkeyDev/blob/master/README.md",
      "stars": 6800,
      "targets": [
        "app"
      ],
      "topics": [
        "cocoapods",
        "ios",
        "iosopendev",
        "ipa",
        "objective-c",
        "reverse-engineering",
        "theos",
        "xcode"
      ],
      "url": "https://github.com/AloneMonkey/MonkeyDev",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "A True Instrumentable Binary Emulation Framework",
      "description_language": "bilingual",
      "description_zh": "真正支持插桩的二进制模拟框架。",
      "full_name": "qilingframework/qiling",
      "id": "scan-203799854",
      "license": "GPL-2.0",
      "observed_at": "2026-10-16T01:35:34.084968Z",
      "pushed_at": "2026-09-24T15:37:33Z",
      "readme_sha256": "36199b1efc76f6958e8936dc6633e17737ec7fc5fbc1a50d43226b2c2ea62c0d",
      "readme_url": "https://github.com/qilingframework/qiling/blob/master/README.md",
      "stars": 6139,
      "targets": [
        "binary",
        "firmware"
      ],
      "topics": [
        "analysis",
        "binary",
        "cross-architecture",
        "emulator",
        "framework",
        "malware",
        "qiling",
        "reverse-engineering",
        "uefi",
        "unicorn-emulator",
        "unicorn-engine"
      ],
      "url": "https://github.com/qilingframework/qiling",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "State-of-the-art native debugging tools",
      "description_language": "bilingual",
      "description_zh": "先进的原生调试工具。",
      "full_name": "HyperDbg/HyperDbg",
      "id": "scan-231214350",
      "license": "GPL-3.0",
      "observed_at": "2026-10-16T01:35:35.914495Z",
      "pushed_at": "2026-10-07T13:44:41Z",
      "readme_sha256": "333cabb431890b283f5a00abf266734a1e3cfe48c13f20755d2730fbe2be26c2",
      "readme_url": "https://github.com/HyperDbg/HyperDbg/blob/master/README.md",
      "stars": 4133,
      "targets": [
        "binary",
        "game"
      ],
      "topics": [
        "anti-debug",
        "anti-debugging",
        "anti-virtualization",
        "binary-analysis",
        "debug",
        "debugger",
        "debugging",
        "debugging-tool",
        "ept",
        "game-security",
        "hook",
        "hyperdbg",
        "hypervisor",
        "kernel-debugger",
        "malware-analysis",
        "reverse-engineering",
        "security",
        "security-tools",
        "virtual-machine-introspection",
        "virtualization"
      ],
      "url": "https://github.com/HyperDbg/HyperDbg",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Malware Configuration And Payload Extraction",
      "description_language": "bilingual",
      "description_zh": "恶意软件配置与载荷提取。",
      "full_name": "kevoreilly/CAPEv2",
      "id": "scan-215366713",
      "license": "NOASSERTION",
      "observed_at": "2026-10-16T01:35:37.303486Z",
      "pushed_at": "2026-10-14T22:35:39Z",
      "readme_sha256": "17381efe4bed1c4e218f2966bee58c05a9d8df1cc80036087fb4e381af5e9255",
      "readme_url": "https://github.com/kevoreilly/CAPEv2/blob/master/README.md",
      "stars": 3570,
      "targets": [
        "binary"
      ],
      "topics": [
        "cape",
        "configs",
        "debugging-tools",
        "malware",
        "malware-analysis",
        "malware-research",
        "reverse-engineering",
        "sandbox",
        "unpacking"
      ],
      "url": "https://github.com/kevoreilly/CAPEv2",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Dynamic Instrumentation Tool Platform",
      "description_language": "bilingual",
      "description_zh": "动态插桩工具平台。",
      "full_name": "DynamoRIO/dynamorio",
      "id": "scan-27242935",
      "license": "NOASSERTION",
      "observed_at": "2026-10-16T01:35:38.302001Z",
      "pushed_at": "2026-10-16T00:41:50Z",
      "readme_sha256": "69e0b2f61792ce182534161c895c1752be55bfcc3d2d009eb6a03d36ab6aff2a",
      "readme_url": "https://github.com/DynamoRIO/dynamorio/blob/master/README.md",
      "stars": 3181,
      "targets": [
        "binary"
      ],
      "topics": [
        "analysis-framework",
        "binary-analysis",
        "cache-simulator",
        "dynamorio",
        "instrumentation",
        "linux",
        "profiling",
        "simulator",
        "toolkit",
        "windows"
      ],
      "url": "https://github.com/DynamoRIO/dynamorio",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Reverse engineering tool for Linux",
      "description_language": "bilingual",
      "description_zh": "Linux 逆向工程工具。",
      "full_name": "korcankaraokcu/PINCE",
      "id": "scan-52111486",
      "license": "NOASSERTION",
      "observed_at": "2026-10-16T01:35:27.095805Z",
      "pushed_at": "2026-09-18T16:19:30Z",
      "readme_sha256": "dafdfd5bb5616f93de2e8b674ce587e0a314220311ab233ca764483072465ad4",
      "readme_url": "https://github.com/korcankaraokcu/PINCE/blob/master/README.md",
      "stars": 3124,
      "targets": [
        "binary",
        "game"
      ],
      "topics": [
        "assembler",
        "cheat-engine",
        "debugging-tool",
        "disassembler",
        "dissect-code",
        "game-hacking",
        "gdb",
        "gdb-python-scripts",
        "hex-editor",
        "injection",
        "memory-hacking",
        "opcode-searcher",
        "patcher",
        "python3",
        "reverse-engineering",
        "tracer"
      ],
      "url": "https://github.com/korcankaraokcu/PINCE",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Runtime Mobile Security (RMS) 📱🔥  - is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime",
      "description_language": "bilingual",
      "description_zh": "Runtime Mobile Security（RMS）📱🔥：功能强大的 Web 界面，帮助你在运行时操控 Android 和 iOS 应用。",
      "full_name": "m0bilesecurity/RMS-Runtime-Mobile-Security",
      "id": "scan-250552704",
      "license": "GPL-3.0",
      "observed_at": "2026-10-16T01:35:38.059488Z",
      "pushed_at": "2026-10-12T11:17:35Z",
      "readme_sha256": "b32db848993f003367db6232251fe7847950f569adef6b918d888d95cdbf0148",
      "readme_url": "https://github.com/m0bilesecurity/RMS-Runtime-Mobile-Security/blob/master/README.md",
      "stars": 3111,
      "targets": [
        "app",
        "binary",
        "website"
      ],
      "topics": [
        "android-security",
        "frida",
        "ios-security",
        "mobile-security",
        "reverse-engineering"
      ],
      "url": "https://github.com/m0bilesecurity/RMS-Runtime-Mobile-Security",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "x64dbg-MCP Server is a native MCP (Model Context Protocol) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Connect any MCP-compatible AI assistant and control x64dbg programmatically: set breakpoints, step through code, read memory, dump registers, and more.  Built with Zig — zero dependencies, single-binary output, cros",
      "description_language": "bilingual",
      "description_zh": "x64dbg-MCP Server 是 x64dbg 的原生 MCP（模型上下文协议）插件，通过 HTTP 提供调试器的全部功能。连接任意兼容 MCP 的 AI 助手，即可通过程序控制 x64dbg：设置断点、单步执行代码、读取内存、转储寄存器等。使用 Zig 构建，零依赖，输出单个二进制文件，cros…",
      "full_name": "duty1g/x64dbg-mcp-server",
      "id": "scan-1342886503",
      "license": "MIT",
      "observed_at": "2026-10-16T01:35:38.460482Z",
      "pushed_at": "2026-10-12T08:49:17Z",
      "readme_sha256": "a54d89c839f86c8def835ca7c5c83c4d1571547caa5562a484a3d1e2e46b03b9",
      "readme_url": "https://github.com/duty1g/x64dbg-mcp-server/blob/main/README.md",
      "stars": 2514,
      "targets": [
        "binary"
      ],
      "topics": [
        "ai-agents",
        "ai-debugging",
        "binary-analysis",
        "claude",
        "claude-code",
        "malware-analysis",
        "malware-research",
        "malware-scanner",
        "mcp",
        "mcp-server",
        "mcp-servers",
        "x64dbg",
        "x64dbg-mcp",
        "x64dbg-plugin",
        "x64dbg-tools",
        "xdbg",
        "zig",
        "zig-lang",
        "ziglang"
      ],
      "url": "https://github.com/duty1g/x64dbg-mcp-server",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "ret-sync is a set of plugins that helps to synchronize a debugging session (WinDbg/GDB/LLDB/OllyDbg2/x64dbg) with IDA/Ghidra/Binary Ninja disassemblers.",
      "description_language": "bilingual",
      "description_zh": "ret-sync 是一组插件，可将调试会话（WinDbg/GDB/LLDB/OllyDbg2/x64dbg）与 IDA/Ghidra/Binary Ninja 反汇编器同步。",
      "full_name": "bootleg/ret-sync",
      "id": "scan-49377590",
      "license": "GPL-3.0",
      "observed_at": "2026-10-16T01:35:45.260004Z",
      "pushed_at": "2026-02-15T09:12:10Z",
      "readme_sha256": "4629d5673ccf49a9f31d9689e07465adc61fe045d13977a1faed3adc048c08e7",
      "readme_url": "https://github.com/bootleg/ret-sync/blob/master/README.md",
      "stars": 2401,
      "targets": [
        "binary"
      ],
      "topics": [
        "binaryninja",
        "debugger",
        "disassembler",
        "ghidra",
        "ida-plugin",
        "ida-pro",
        "reverse-engineering",
        "software-analysis"
      ],
      "url": "https://github.com/bootleg/ret-sync",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "A Dynamic Binary Instrumentation framework based on LLVM.",
      "description_language": "bilingual",
      "description_zh": "基于 LLVM 的动态二进制插桩框架。",
      "full_name": "QBDI/QBDI",
      "id": "scan-108147444",
      "license": "NOASSERTION",
      "observed_at": "2026-10-16T01:36:00.137506Z",
      "pushed_at": "2026-09-02T15:13:48Z",
      "readme_sha256": "ebf2cc5583fa2a5bd7920be211b5482a633a07c3ac591effaec40b31454803d0",
      "readme_url": "https://github.com/QBDI/QBDI/blob/dev-next/README.rst",
      "stars": 1828,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "dbi",
        "frida",
        "instrumentation",
        "llvm",
        "reverse-engineering"
      ],
      "url": "https://github.com/QBDI/QBDI",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "A Pin Tool for tracing API calls etc",
      "description_language": "bilingual",
      "description_zh": "用于跟踪 API 调用等行为的 Pin 工具。",
      "full_name": "hasherezade/tiny_tracer",
      "id": "scan-141471197",
      "license": "GPL-2.0",
      "observed_at": "2026-10-18T14:37:13.233012Z",
      "pushed_at": "2026-06-02T17:16:52Z",
      "readme_sha256": "8012708f0ced2454088598f766c1e2505cdef5c25ffae821156d012dd6ff3a64",
      "readme_url": "https://github.com/hasherezade/tiny_tracer/blob/99618fc0569a4a06b7955e507e1707792ad1bef5/README.md",
      "stars": 1711,
      "targets": [
        "binary"
      ],
      "topics": [
        "api-trace",
        "dbi",
        "intel-pintools",
        "malware-analysis",
        "reverse-engineering"
      ],
      "url": "https://github.com/hasherezade/tiny_tracer",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "A collection of my Frida instrumentation scripts to reverse engineer mobile apps and more.",
      "description_language": "bilingual",
      "description_zh": "我编写的 Frida 插桩脚本合集，用于移动应用逆向工程等任务。",
      "full_name": "0xdea/frida-scripts",
      "id": "scan-101912162",
      "license": "MIT",
      "observed_at": "2026-10-16T01:36:00.314402Z",
      "pushed_at": "2026-08-02T21:39:51Z",
      "readme_sha256": "beb33c1eaacb9a281fc645302888862ea45e10fc325dadc06853ace1bec9eb70",
      "readme_url": "https://github.com/0xdea/frida-scripts/blob/master/README.md",
      "stars": 1672,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "android",
        "frida",
        "ios",
        "linux",
        "mobile",
        "reverse-engineering"
      ],
      "url": "https://github.com/0xdea/frida-scripts",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "IDA 2016 plugin contest winner! Symbolic Execution just one-click away!",
      "description_language": "bilingual",
      "description_zh": "IDA 2016 插件竞赛获奖作品！一键即可使用符号执行！",
      "full_name": "illera88/Ponce",
      "id": "scan-62432794",
      "license": "NOASSERTION",
      "observed_at": "2026-10-16T01:35:52.410517Z",
      "pushed_at": "2025-06-11T17:54:58Z",
      "readme_sha256": "d26ad7054294198041bbedee18790f8f3a75679d6254868dff74b1c73e1a4f9b",
      "readme_url": "https://github.com/illera88/Ponce/blob/master/README.md",
      "stars": 1635,
      "targets": [
        "binary"
      ],
      "topics": [
        "ida",
        "ida-plugin",
        "idapro",
        "symbolic-execution"
      ],
      "url": "https://github.com/illera88/Ponce",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Radare2 and Frida better together.",
      "description_language": "bilingual",
      "description_zh": "让 Radare2 与 Frida 更好地协同工作。",
      "full_name": "nowsecure/r2frida",
      "id": "scan-35610263",
      "license": "MIT",
      "observed_at": "2026-10-16T01:36:00.733797Z",
      "pushed_at": "2026-10-13T16:41:44Z",
      "readme_sha256": "95cfbb90949f2a222d789f8153955de1e97a5a0081c99a8b0a12f196dc3925cd",
      "readme_url": "https://github.com/nowsecure/r2frida/blob/master/README.md",
      "stars": 1450,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "android-security",
        "dynamic-analysis",
        "frida",
        "ios-security",
        "radare2",
        "static-analysis"
      ],
      "url": "https://github.com/nowsecure/r2frida",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "A collection of excellent reverse engineering articles I have read, well worth a look.",
      "description_language": "bilingual",
      "description_zh": "浏览过的精彩逆向文章汇总，值得一看。",
      "full_name": "darbra/sperm",
      "id": "scan-465195923",
      "license": "GPL-3.0",
      "observed_at": "2026-10-16T01:36:00.835361Z",
      "pushed_at": "2026-04-13T03:28:35Z",
      "readme_sha256": "6c840ec1151e19cbd8ff4dafe4529be3257b3941054b6ab1b197ff1210470941",
      "readme_url": "https://github.com/darbra/sperm/blob/main/README.md",
      "stars": 1422,
      "targets": [
        "binary"
      ],
      "topics": [
        "crawl",
        "crawler",
        "frida",
        "spider",
        "unidbg"
      ],
      "url": "https://github.com/darbra/sperm",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "DRAKVUF Sandbox - automated hypervisor-level malware analysis system",
      "description_language": "bilingual",
      "description_zh": "DRAKVUF Sandbox：在虚拟机监控器层进行自动化恶意软件分析的系统。",
      "full_name": "CERT-Polska/drakvuf-sandbox",
      "id": "scan-248540269",
      "license": "NOASSERTION",
      "observed_at": "2026-10-18T14:37:13.234457Z",
      "pushed_at": "2026-10-16T12:41:16Z",
      "readme_sha256": "247e76b52bfdcce9e70fc26696b87868b48fd3fa8d1f436d61666ca57ae9fe9a",
      "readme_url": "https://github.com/CERT-Polska/drakvuf-sandbox/blob/7c328ab48bfe07b99c896c8695b7e51edf431ceb/README.md",
      "stars": 1355,
      "targets": [
        "binary"
      ],
      "topics": [
        "malware",
        "malware-analysis",
        "malware-research",
        "reverse-engineering",
        "sandbox"
      ],
      "url": "https://github.com/CERT-Polska/drakvuf-sandbox",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Most usable tools for iOS penetration testing",
      "description_language": "bilingual",
      "description_zh": "实用的 iOS 渗透测试工具。",
      "full_name": "ansjdnakjdnajkd/iOS",
      "id": "scan-112600629",
      "license": "Apache-2.0",
      "observed_at": "2026-10-16T01:35:45.456328Z",
      "pushed_at": "2023-11-06T14:01:12Z",
      "readme_sha256": "65e5ae257a1f787ec474104c14852c4d7e90a8eb6a4b355d048de4e6aedc0724",
      "readme_url": "https://github.com/ansjdnakjdnajkd/iOS/blob/master/README.md",
      "stars": 1327,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "apple",
        "cheatsheet",
        "frida",
        "ghidra",
        "information-security",
        "information-security-research",
        "infosec",
        "ios",
        "jailbreak",
        "keychain",
        "macos",
        "objection",
        "objective-c",
        "pentest",
        "research",
        "security",
        "security-tools",
        "slides",
        "swift",
        "tools"
      ],
      "url": "https://github.com/ansjdnakjdnajkd/iOS",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Full featured multi arch/os debugger built on top of PyQt5 and frida",
      "description_language": "bilingual",
      "description_zh": "基于 PyQt5 和 Frida 构建、功能全面的多架构/多操作系统调试器。",
      "full_name": "iGio90/Dwarf",
      "id": "scan-162325852",
      "license": "GPL-3.0",
      "observed_at": "2026-10-16T01:36:01.013558Z",
      "pushed_at": "2024-05-16T07:32:52Z",
      "readme_sha256": "b9e4f60adf79154980cfcdd758c808001d7a5e515deb5d0680e993bc09dac338",
      "readme_url": "https://github.com/iGio90/Dwarf/blob/master/README.md",
      "stars": 1321,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "android",
        "capstone-engine",
        "cracking",
        "frida",
        "ios",
        "keystone-engine",
        "linux",
        "pyqt5",
        "reverse-engineering",
        "unicorn-emulator",
        "windows"
      ],
      "url": "https://github.com/iGio90/Dwarf",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Open-source AI reverse-engineering agent platform and MCP server for Ghidra, Frida, x64dbg and Rizin — automated PE/APK/binary analysis, CTF and malware research, with 100+ MCP tools and a 194-article runnable knowledge base.",
      "description_language": "bilingual",
      "description_zh": "面向 Ghidra、Frida、x64dbg 和 Rizin 的开源 AI 逆向工程智能体平台与 MCP 服务器，支持自动化 PE/APK/二进制分析、CTF 与恶意软件研究，提供 100 多个 MCP 工具和包含 194 篇可运行内容的知识库。",
      "full_name": "LING71671/open-reverselab",
      "id": "scan-1272358389",
      "license": "GPL-3.0",
      "observed_at": "2026-10-16T01:35:29.999537Z",
      "pushed_at": "2026-10-15T10:21:59Z",
      "readme_sha256": "5b2306bd00ca5c174a22fbeb3a663e3e9747bda4a7fa3dc1028289ec3ac70cfa",
      "readme_url": "https://github.com/LING71671/open-reverselab/blob/main/README.md",
      "stars": 1265,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "ai-agent",
        "ai-reverse-engineering",
        "android-reverse-engineering",
        "binary-analysis",
        "binary-reverse-engineering",
        "claude-code",
        "codex",
        "ctf",
        "frida",
        "ghidra",
        "ghidra-mcp",
        "malware-analysis",
        "mcp",
        "mcp-server",
        "model-context-protocol",
        "pe-analysis",
        "reverse-engineering",
        "reverse-engineering-agent",
        "rizin",
        "x64dbg"
      ],
      "url": "https://github.com/LING71671/open-reverselab",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "A tool that helps you easy trace classes, functions, and modify the return values of methods on iOS platform",
      "description_language": "bilingual",
      "description_zh": "帮助你轻松跟踪 iOS 平台上的类和函数，并修改方法返回值的工具。",
      "full_name": "yazgx97/frida-ios-hook",
      "id": "scan-218020351",
      "license": "MIT",
      "observed_at": "2026-10-16T01:36:01.116894Z",
      "pushed_at": "2026-05-05T11:03:25Z",
      "readme_sha256": "1e0d9162bac4617a7fd6ec1e54296e08af05cf36ff583f120ad8f69f6142bca2",
      "readme_url": "https://github.com/yazgx97/frida-ios-hook/blob/master/README.md",
      "stars": 1191,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "frida",
        "frida-ios-hook",
        "hooking",
        "ios",
        "pentest",
        "pentesting-tools",
        "reverse-engineering",
        "script-loader",
        "trace"
      ],
      "url": "https://github.com/yazgx97/frida-ios-hook",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "A powerful static binary rewriting tool",
      "description_language": "bilingual",
      "description_zh": "功能强大的静态二进制重写工具。",
      "full_name": "GJDuck/e9patch",
      "id": "scan-250687801",
      "license": "GPL-3.0",
      "observed_at": "2026-10-16T01:35:39.451133Z",
      "pushed_at": "2026-06-28T02:52:44Z",
      "readme_sha256": "ae0d5cab9a28deea8254f45f538cda8ff17b2a6750e7a6318925f2c7f697526c",
      "readme_url": "https://github.com/GJDuck/e9patch/blob/master/README.md",
      "stars": 1156,
      "targets": [
        "binary"
      ],
      "topics": [
        "binary",
        "binary-analysis",
        "binary-instrumentation",
        "binary-patching",
        "binary-rewriting",
        "e9patch",
        "elf",
        "reverse-engineering"
      ],
      "url": "https://github.com/GJDuck/e9patch",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Cross-platform decryption of QQ chat databases",
      "description_language": "bilingual",
      "description_zh": "全平台 QQ 聊天数据库解密。",
      "full_name": "QQBackup/qq-win-db-key",
      "id": "scan-635639063",
      "license": "NOASSERTION",
      "observed_at": "2026-10-16T01:36:01.119480Z",
      "pushed_at": "2026-10-13T16:41:26Z",
      "readme_sha256": "4e9aedf6716c303fa98b0e614f94f947a432a066ecee91d45d2e5d66a072b83c",
      "readme_url": "https://github.com/QQBackup/qq-win-db-key/blob/master/README.md",
      "stars": 1103,
      "targets": [
        "binary"
      ],
      "topics": [
        "backup",
        "frida",
        "ida",
        "qq",
        "reverse-engineering"
      ],
      "url": "https://github.com/QQBackup/qq-win-db-key",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Cross-platform instrumentation and introspection library written in C",
      "description_language": "bilingual",
      "description_zh": "以 C 编写的跨平台插桩与内省库。",
      "full_name": "frida/frida-gum",
      "id": "scan-9340574",
      "license": "NOASSERTION",
      "observed_at": "2026-10-16T01:36:01.309254Z",
      "pushed_at": "2026-10-15T17:27:12Z",
      "readme_sha256": "0c351d63dd0f3e417dd16b01b0de2ba5e90dd10f3cf6544c6cfd4c0e025e2b81",
      "readme_url": "https://github.com/frida/frida-gum/blob/main/README.md",
      "stars": 1032,
      "targets": [
        "binary"
      ],
      "topics": [
        "frida",
        "instrumentation"
      ],
      "url": "https://github.com/frida/frida-gum",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Historical Windows temporal memory-state research artifact for studying time-bound memory observations, validation limits, and defensive visibility.",
      "description_language": "bilingual",
      "description_zh": "历史性的 Windows 时序内存状态研究产物，用于研究有时间边界的内存观测、验证局限和防御可见性。",
      "full_name": "JLospinoso/gargoyle",
      "id": "scan-83858471",
      "license": "AGPL-3.0",
      "observed_at": "2026-10-18T14:36:34.819328Z",
      "pushed_at": "2026-05-15T01:58:49Z",
      "readme_sha256": "7c3a6d3915964584ecc786a6d498d6f4ada72b39fa6e0a6fd82134451a628899",
      "readme_url": "https://github.com/JLospinoso/gargoyle/blob/a773c2ff20758b7fa480a3708e154a3999c40e13/README.md",
      "stars": 916,
      "targets": [
        "binary"
      ],
      "topics": [
        "apc",
        "arm64ec",
        "assembly",
        "code-injection",
        "dfir",
        "malware-research",
        "memory-analysis",
        "memory-forensics",
        "native-code",
        "pic",
        "research-artifact",
        "reverse-engineering",
        "rop-gadgets",
        "security",
        "security-research",
        "temporal-memory-state",
        "windows",
        "windows-internals",
        "x64",
        "x86"
      ],
      "url": "https://github.com/JLospinoso/gargoyle",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "DyninstAPI: Tools for binary instrumentation, analysis, and modification.",
      "description_language": "bilingual",
      "description_zh": "DyninstAPI：二进制插桩、分析与修改工具。",
      "full_name": "dyninst/dyninst",
      "id": "scan-57918231",
      "license": "LGPL-2.1",
      "observed_at": "2026-10-16T01:35:39.799317Z",
      "pushed_at": "2026-10-15T23:55:57Z",
      "readme_sha256": "24d1a3b677ebc5885788d4094c5ca809a5ffd62310d4afb947c79345b0fe5295",
      "readme_url": "https://github.com/dyninst/dyninst/blob/master/README.md",
      "stars": 838,
      "targets": [
        "binary"
      ],
      "topics": [
        "binary-analysis",
        "dyninst",
        "stackwalker",
        "symtab"
      ],
      "url": "https://github.com/dyninst/dyninst",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Notes on interesting things I encounter while learning Android reverse engineering.",
      "description_language": "bilingual",
      "description_zh": "记录我在学习 Android 逆向过程中遇到的一些有趣内容。",
      "full_name": "Simp1er/MobileSec",
      "id": "scan-246603588",
      "license": null,
      "observed_at": "2026-10-16T01:36:01.668743Z",
      "pushed_at": "2023-09-11T15:37:25Z",
      "readme_sha256": "c580626210f1e0105633b53dfb93074fec211493ecb912955318bf751bc71799",
      "readme_url": "https://github.com/Simp1er/MobileSec/blob/master/README.md",
      "stars": 809,
      "targets": [
        "binary"
      ],
      "topics": [
        "androidsec",
        "frida",
        "hook",
        "unicorn"
      ],
      "url": "https://github.com/Simp1er/MobileSec",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Frida core library",
      "description_language": "bilingual",
      "description_zh": "Frida 核心库。",
      "full_name": "frida/frida-core",
      "id": "scan-9340492",
      "license": "NOASSERTION",
      "observed_at": "2026-10-16T01:36:01.635380Z",
      "pushed_at": "2026-10-15T17:27:10Z",
      "readme_sha256": "b171ff8dbcebd3d2aaa7b367bba40ecbd2b9add396de24adb482a812c2540584",
      "readme_url": "https://github.com/frida/frida-core/blob/main/README.md",
      "stars": 782,
      "targets": [
        "binary"
      ],
      "topics": [
        "frida",
        "instrumentation",
        "vala"
      ],
      "url": "https://github.com/frida/frida-core",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "IDA Pro plugin that implements more user-friendly register and stack views",
      "description_language": "bilingual",
      "description_zh": "提供更友好寄存器和栈视图的 IDA Pro 插件。",
      "full_name": "danigargu/deREferencing",
      "id": "scan-208227198",
      "license": "GPL-3.0",
      "observed_at": "2026-10-16T01:35:53.094389Z",
      "pushed_at": "2026-09-03T13:35:56Z",
      "readme_sha256": "cc44ab71b6f22304681d56559b6ac3ee3667ee4599bbac47b3a8282d515438b1",
      "readme_url": "https://github.com/danigargu/deREferencing/blob/master/README.md",
      "stars": 775,
      "targets": [
        "binary"
      ],
      "topics": [
        "ida-plugin",
        "ida-pro",
        "idapython",
        "idapython-plugin",
        "python"
      ],
      "url": "https://github.com/danigargu/deREferencing",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "An online assembly editor, emulator and debugger for the x86-64 architecture",
      "description_language": "bilingual",
      "description_zh": "面向 x86-64 架构的在线汇编编辑器、模拟器和调试器。",
      "full_name": "robalb/x86-64-playground",
      "id": "scan-849596405",
      "license": "ISC",
      "observed_at": "2026-10-18T14:38:14.455426Z",
      "pushed_at": "2026-01-18T19:17:26Z",
      "readme_sha256": "aef89927fc159e31e69ffb641290a6fbb468dc21ea50b4049a13f9e49e66a205",
      "readme_url": "https://github.com/robalb/x86-64-playground/blob/d617f6a19879157c1debbe0454b6c4cff2ebe094/README.md",
      "stars": 758,
      "targets": [
        "binary"
      ],
      "topics": [
        "assembler",
        "assembly",
        "binary-exploitation",
        "binutils",
        "emscripten",
        "emulator",
        "fasm",
        "gdb",
        "nasm",
        "playground",
        "reverse-engineering",
        "wasm",
        "x86-64"
      ],
      "url": "https://github.com/robalb/x86-64-playground",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Unofficial frida extension for VSCode",
      "description_language": "bilingual",
      "description_zh": "非官方的 VSCode Frida 扩展",
      "full_name": "ChiChou/vscode-frida",
      "id": "scan-233831241",
      "license": "MIT",
      "observed_at": "2026-10-16T10:47:35.487418Z",
      "pushed_at": "2026-09-29T08:10:09Z",
      "readme_sha256": "a983acdebd6fe72cb0296c0b6b1aff097b07582071c82383cf8359496b79f4b3",
      "readme_url": "https://github.com/ChiChou/vscode-frida/blob/main/README.md",
      "stars": 592,
      "targets": [
        "app"
      ],
      "topics": [
        "android",
        "ios",
        "mobile-security",
        "reverse-engineering",
        "vscode"
      ],
      "url": "https://github.com/ChiChou/vscode-frida",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Labeless is a multipurpose IDA Pro plugin system for labels/comments synchronization with a debugger backend, with complex memory dumping and interactive Python scripting capabilities.",
      "description_language": "bilingual",
      "description_zh": "Labeless 是多用途 IDA Pro 插件系统，可与调试器后端同步标签和注释，并具备复杂内存转储和交互式 Python 脚本能力。",
      "full_name": "a1ext/labeless",
      "id": "scan-43691261",
      "license": "NOASSERTION",
      "observed_at": "2026-10-16T01:37:12.601937Z",
      "pushed_at": "2026-02-23T15:57:52Z",
      "readme_sha256": "6c69724efd83acb471f24bccc7203ac97067c1e11e68840a3fa32c09f4026574",
      "readme_url": "https://github.com/a1ext/labeless/blob/devel/README.MD",
      "stars": 587,
      "targets": [
        "binary"
      ],
      "topics": [
        "broken-pe-headers",
        "decryption-automation",
        "heap-spray",
        "ida",
        "labeless",
        "memorydumping",
        "ollydbg",
        "python-script",
        "reversing",
        "x64",
        "x64dbg",
        "x64dbg-plugin",
        "x86",
        "x86-64"
      ],
      "url": "https://github.com/a1ext/labeless",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Wechaty Puppet WeChat Windows Protocol",
      "description_language": "bilingual",
      "description_zh": "Wechaty Puppet 微信 Windows 协议。",
      "full_name": "wechaty/puppet-xp",
      "id": "scan-385589889",
      "license": "Apache-2.0",
      "observed_at": "2026-10-16T01:36:02.096349Z",
      "pushed_at": "2025-07-29T05:06:04Z",
      "readme_sha256": "3970f9deff4103d469e9add4a4900d69028b1996ac96595b7ca0e9d57ee6b117",
      "readme_url": "https://github.com/wechaty/puppet-xp/blob/main/README.md",
      "stars": 551,
      "targets": [
        "binary"
      ],
      "topics": [
        "frida",
        "puppet",
        "sidecar",
        "wechat",
        "wechaty",
        "windows"
      ],
      "url": "https://github.com/wechaty/puppet-xp",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js",
      "description_language": "bilingual",
      "description_zh": "用于半自动 JavaScript 恶意软件分析、去混淆和载荷提取的沙箱，为 Node.js 编写。",
      "full_name": "HynekPetrak/malware-jail",
      "id": "scan-49388942",
      "license": "MIT",
      "observed_at": "2026-10-16T01:36:47.587367Z",
      "pushed_at": "2023-06-16T16:17:47Z",
      "readme_sha256": "3023b91ec93330e76fcb740328021842790c299c59397de27ae18b2e258bfd53",
      "readme_url": "https://github.com/HynekPetrak/malware-jail/blob/master/README.md",
      "stars": 480,
      "targets": [
        "binary",
        "website"
      ],
      "topics": [
        "analysis",
        "angler",
        "deobfuscation",
        "javascript",
        "malware-analysis",
        "malware-analyzer",
        "malware-jail",
        "malware-research",
        "malware-samples",
        "payload",
        "payload-extraction",
        "wscript"
      ],
      "url": "https://github.com/HynekPetrak/malware-jail",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "tool to extract passwords from TeamViewer memory using Frida",
      "description_language": "bilingual",
      "description_zh": "使用 Frida 从 TeamViewer 内存中提取密码的工具。",
      "full_name": "vah13/extractTVpasswords",
      "id": "scan-99037553",
      "license": null,
      "observed_at": "2026-10-16T01:36:02.516433Z",
      "pushed_at": "2018-07-17T07:05:20Z",
      "readme_sha256": "9e99ed88004637b6a27ca8363b593073a0805d73a96324f42a0df094c97cc9d6",
      "readme_url": "https://github.com/vah13/extractTVpasswords/blob/master/README.md",
      "stars": 465,
      "targets": [
        "binary"
      ],
      "topics": [
        "cplusplus",
        "frida",
        "hacking",
        "python",
        "teamviewer"
      ],
      "url": "https://github.com/vah13/extractTVpasswords",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Bidirectional XPC message interception and more. Powered by Frida",
      "description_language": "bilingual",
      "description_zh": "双向 XPC 消息拦截及更多功能，由 Frida 驱动。",
      "full_name": "ab-rizk/xpcspy",
      "id": "scan-310089268",
      "license": "Apache-2.0",
      "observed_at": "2026-10-16T01:36:02.705910Z",
      "pushed_at": "2026-05-11T18:34:02Z",
      "readme_sha256": "6f169e9c1f74965528ef88891ad27b9995c96378da4335f9de2b3db97d732576",
      "readme_url": "https://github.com/ab-rizk/xpcspy/blob/main/README.md",
      "stars": 452,
      "targets": [
        "app",
        "binary",
        "protocol"
      ],
      "topics": [
        "frida",
        "ios",
        "macos",
        "xnu",
        "xpc"
      ],
      "url": "https://github.com/ab-rizk/xpcspy",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Run a more undetectable frida server on boot using magisk 🔐✅",
      "description_language": "bilingual",
      "description_zh": "通过 Magisk 在开机时运行更难被检测到的 Frida 服务器 🔐✅。",
      "full_name": "Exo1i/MagiskHluda",
      "id": "scan-748890174",
      "license": null,
      "observed_at": "2026-10-16T01:36:02.880504Z",
      "pushed_at": "2026-02-04T09:53:35Z",
      "readme_sha256": "00beb549c6928b586856dbfe2d17e97299aec57c31279578bb5829fb41fc2846",
      "readme_url": "https://github.com/Exo1i/MagiskHluda/blob/main/README.md",
      "stars": 433,
      "targets": [
        "binary"
      ],
      "topics": [
        "frida",
        "hluda",
        "magisk",
        "magisk-hluda",
        "magiskhluda",
        "reverse-engineering",
        "security"
      ],
      "url": "https://github.com/Exo1i/MagiskHluda",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Work in progress...",
      "description_language": "bilingual",
      "description_zh": "开发中……",
      "full_name": "ivan-sincek/ios-penetration-testing-cheat-sheet",
      "id": "scan-437304045",
      "license": "MIT",
      "observed_at": "2026-10-16T01:36:02.930388Z",
      "pushed_at": "2026-02-24T13:56:24Z",
      "readme_sha256": "6549afdb9739ae8bb8acfcbf4318773231e31ae5195c9ff4433045bf6eac348b",
      "readme_url": "https://github.com/ivan-sincek/ios-penetration-testing-cheat-sheet/blob/main/README.md",
      "stars": 425,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "bug-bounty",
        "ethical-hacking",
        "frida",
        "ios",
        "ios-penetration-testing",
        "mobile-penetration-testing",
        "mobsf",
        "objection",
        "offensive-security",
        "penetration-testing",
        "red-team-engagement",
        "security",
        "unc0ver"
      ],
      "url": "https://github.com/ivan-sincek/ios-penetration-testing-cheat-sheet",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "A persistence solution for Frida",
      "description_language": "bilingual",
      "description_zh": "Frida 持久化解决方案。",
      "full_name": "hanbinglengyue/FridaManager",
      "id": "scan-353351616",
      "license": null,
      "observed_at": "2026-10-16T01:36:03.139842Z",
      "pushed_at": "2022-03-27T09:36:37Z",
      "readme_sha256": "9e71fbfb4bbf2a18edc1fc0e3e523bf2554587b50b9da9420e8bbc74445cb5b1",
      "readme_url": "https://github.com/hanbinglengyue/FridaManager/blob/main/README.md",
      "stars": 420,
      "targets": [
        "binary"
      ],
      "topics": [
        "frida",
        "persistence"
      ],
      "url": "https://github.com/hanbinglengyue/FridaManager",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "A comprehensive binary emulation and instrumentation platform.",
      "description_language": "bilingual",
      "description_zh": "全面的二进制模拟与插桩平台。",
      "full_name": "zeropointdynamics/zelos",
      "id": "scan-244431161",
      "license": "AGPL-3.0",
      "observed_at": "2026-10-16T01:35:42.040909Z",
      "pushed_at": "2023-01-31T00:27:41Z",
      "readme_sha256": "00ad295b2bfe6466ec1a43ce477c48ba6a550143b20311dbca791ab27ad99c6a",
      "readme_url": "https://github.com/zeropointdynamics/zelos/blob/master/README.md",
      "stars": 420,
      "targets": [
        "binary"
      ],
      "topics": [
        "binary",
        "binary-analysis",
        "emulation",
        "emulator",
        "linux",
        "malware",
        "malware-analysis",
        "vulnerability-analysis"
      ],
      "url": "https://github.com/zeropointdynamics/zelos",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Patch iOS Apps, The Easy Way, Without Jailbreak.",
      "description_language": "bilingual",
      "description_zh": "无需越狱，轻松为 iOS 应用打补丁。",
      "full_name": "paradiseduo/IPAPatch",
      "id": "scan-166788429",
      "license": "MIT",
      "observed_at": "2026-10-16T01:36:03.346107Z",
      "pushed_at": "2025-03-18T07:16:04Z",
      "readme_sha256": "794f65859134189ad97c14df3a19b027622818ceb4a0c380fa6192f8102977c0",
      "readme_url": "https://github.com/paradiseduo/IPAPatch/blob/master/README.md",
      "stars": 412,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "dynamic-libraries",
        "frida",
        "frida-ios-hook",
        "ios",
        "ipa",
        "ipa-files",
        "ipapatch",
        "lldb",
        "patching",
        "xcode"
      ],
      "url": "https://github.com/paradiseduo/IPAPatch",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "A low-overhead dynamic binary instrumentation and modification tool for ARM (both AArch32 and AArch64 support) and RISC-V (RV64GC).",
      "description_language": "bilingual",
      "description_zh": "面向 ARM（支持 AArch32 和 AArch64）及 RISC-V（RV64GC）的低开销动态二进制插桩与修改工具。",
      "full_name": "beehive-lab/mambo",
      "id": "scan-51374589",
      "license": "Apache-2.0",
      "observed_at": "2026-10-16T01:35:42.325693Z",
      "pushed_at": "2025-01-21T14:55:46Z",
      "readme_sha256": "ff65d5effc48a213151299b5547f68f69053d99f007bcbb3ea5ce64eeb772344",
      "readme_url": "https://github.com/beehive-lab/mambo/blob/master/README.md",
      "stars": 400,
      "targets": [
        "binary"
      ],
      "topics": [
        "binary-analysis",
        "dbi",
        "dbm",
        "dbt",
        "instrumentation"
      ],
      "url": "https://github.com/beehive-lab/mambo",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Cycript fork powered by Frida.",
      "description_language": "bilingual",
      "description_zh": "由 Frida 驱动的 Cycript 分支。",
      "full_name": "nowsecure/frida-cycript",
      "id": "scan-67085858",
      "license": "AGPL-3.0",
      "observed_at": "2026-10-16T01:36:03.297267Z",
      "pushed_at": "2023-03-04T04:31:57Z",
      "readme_sha256": "0246a6bd63af323dbaea2e3d3a5d2c826d7b28f9da0ed213da7f7a21746b1e7d",
      "readme_url": "https://github.com/nowsecure/frida-cycript/blob/master/README.md",
      "stars": 396,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "cylang",
        "dsl",
        "frida",
        "ios",
        "nodejs",
        "substrate"
      ],
      "url": "https://github.com/nowsecure/frida-cycript",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Human-friendly cross-platform system call tracing and hooking library based on Frida's Stalker",
      "description_language": "bilingual",
      "description_zh": "基于 Frida Stalker、易于使用的跨平台系统调用跟踪与 hook 库。",
      "full_name": "FrenchYeti/interruptor",
      "id": "scan-443181261",
      "license": "NOASSERTION",
      "observed_at": "2026-10-16T01:36:03.726017Z",
      "pushed_at": "2026-09-23T13:48:02Z",
      "readme_sha256": "51747d40394082dbdcca3153b71373b3a69f3bfc0e8abc5bf504b0bb0e89ae25",
      "readme_url": "https://github.com/FrenchYeti/interruptor/blob/main/README.md",
      "stars": 360,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "arm64",
        "frida",
        "hooking",
        "instrumentation",
        "strace",
        "syscall-tracing",
        "syscalls",
        "system-call-tracing",
        "tracing"
      ],
      "url": "https://github.com/FrenchYeti/interruptor",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Use Frida to retrieve functions dynamically registered through JNI RegisterNatives.",
      "description_language": "bilingual",
      "description_zh": "使用 Frida 获取通过 JNI RegisterNatives 动态注册的函数。",
      "full_name": "deathmemory/fridaRegstNtv",
      "id": "scan-249618506",
      "license": null,
      "observed_at": "2026-10-16T01:36:03.938348Z",
      "pushed_at": "2023-03-06T02:29:27Z",
      "readme_sha256": "84ab88721c85016f4c5bae61fb99603119e836a984d10910f2cf1c59158a07c9",
      "readme_url": "https://github.com/deathmemory/fridaRegstNtv/blob/master/README.md",
      "stars": 353,
      "targets": [
        "binary"
      ],
      "topics": [
        "frida",
        "registernatives"
      ],
      "url": "https://github.com/deathmemory/fridaRegstNtv",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Java Dynamic Reverse Engineering and Debugging Tool",
      "description_language": "bilingual",
      "description_zh": "Java 动态逆向工程与调试工具。",
      "full_name": "roger1337/JDBG",
      "id": "scan-921949141",
      "license": "Apache-2.0",
      "observed_at": "2026-10-16T01:36:15.365467Z",
      "pushed_at": "2025-02-23T01:51:03Z",
      "readme_sha256": "cd558dec2acc6b54fccb154eaa8080d081162a1193741b60ebbfd1ca54cded59",
      "readme_url": "https://github.com/roger1337/JDBG/blob/main/README.MD",
      "stars": 331,
      "targets": [
        "binary"
      ],
      "topics": [
        "agent",
        "asm",
        "bytecode",
        "cybersecurity",
        "debugger",
        "disassembler",
        "dynamic-analysis",
        "java",
        "jni",
        "jvmti",
        "offensive-security",
        "oscp",
        "reverse-engineering",
        "security",
        "security-tools"
      ],
      "url": "https://github.com/roger1337/JDBG",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "gdbghidra - a visual bridge between a GDB session and GHIDRA",
      "description_language": "bilingual",
      "description_zh": "gdbghidra：连接 GDB 会话与 Ghidra 的可视化桥梁。",
      "full_name": "Comsecuris/gdbghidra",
      "id": "scan-186974778",
      "license": "MIT",
      "observed_at": "2026-10-16T01:35:47.866074Z",
      "pushed_at": "2019-10-18T09:07:38Z",
      "readme_sha256": "135553866acf321ed04e2a7879ba8e0604b1bd08dab046d974ed879ceb1aa52b",
      "readme_url": "https://github.com/Comsecuris/gdbghidra/blob/master/README.md",
      "stars": 324,
      "targets": [
        "binary"
      ],
      "topics": [
        "bridge",
        "debugger",
        "engineering",
        "gdb",
        "ghidra",
        "plugin",
        "reverse"
      ],
      "url": "https://github.com/Comsecuris/gdbghidra",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Frida Boot 👢- A binary instrumentation workshop, with Frida, for beginners!",
      "description_language": "bilingual",
      "description_zh": "Frida Boot 👢：面向初学者的 Frida 二进制插桩工作坊！",
      "full_name": "leonjza/frida-boot",
      "id": "scan-257429471",
      "license": null,
      "observed_at": "2026-10-16T01:36:04.244194Z",
      "pushed_at": "2023-09-27T12:29:56Z",
      "readme_sha256": "b14c838e27bb81c6a7444952af255f2a2683d50ee69a61a425cd66d478fe6259",
      "readme_url": "https://github.com/leonjza/frida-boot/blob/master/README.md",
      "stars": 320,
      "targets": [
        "binary"
      ],
      "topics": [
        "beginner",
        "frida",
        "instrumentation",
        "training",
        "workshop"
      ],
      "url": "https://github.com/leonjza/frida-boot",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "A Python library to debug binary executables, your own way.",
      "description_language": "bilingual",
      "description_zh": "让你以自己的方式调试二进制可执行文件的 Python 库。",
      "full_name": "libdebug/libdebug",
      "id": "scan-472866724",
      "license": "NOASSERTION",
      "observed_at": "2026-10-16T01:37:12.931045Z",
      "pushed_at": "2026-09-09T18:02:59Z",
      "readme_sha256": "20efac1fca6bd5405bbdb2a45a7f703c9c4f1b7327ff99502c8b765c209542df",
      "readme_url": "https://github.com/libdebug/libdebug/blob/main/README.md",
      "stars": 315,
      "targets": [
        "binary"
      ],
      "topics": [
        "ctf",
        "ctf-tools",
        "debugger",
        "debugging",
        "debugging-tool",
        "dynamic-analysis",
        "dynamic-analysis-tools",
        "linux",
        "malware-analysis",
        "ptrace",
        "python",
        "reverse-engineering",
        "reversing",
        "scriptable"
      ],
      "url": "https://github.com/libdebug/libdebug",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "fpicker is a Frida-based fuzzing suite supporting various modes (including AFL++ in-process fuzzing)",
      "description_language": "bilingual",
      "description_zh": "fpicker 是基于 Frida 的模糊测试套件，支持多种模式，包括 AFL++ 进程内模糊测试。",
      "full_name": "ttdennis/fpicker",
      "id": "scan-338259227",
      "license": "MIT",
      "observed_at": "2026-10-16T01:36:04.451603Z",
      "pushed_at": "2025-07-24T14:03:28Z",
      "readme_sha256": "5505d0659a9a1bd4f8add4c2f8065f3312b83b1dd0a248d6a06adf4b07732d3b",
      "readme_url": "https://github.com/ttdennis/fpicker/blob/main/README.md",
      "stars": 298,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "frida",
        "fuzzer",
        "in-process"
      ],
      "url": "https://github.com/ttdennis/fpicker",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "frick - aka the first debugger built on top of frida",
      "description_language": "bilingual",
      "description_zh": "frick：首个基于 Frida 构建的调试器",
      "full_name": "iGio90/frick",
      "id": "scan-137655266",
      "license": "MIT",
      "observed_at": "2026-10-16T01:36:04.446158Z",
      "pushed_at": "2018-12-18T11:17:10Z",
      "readme_sha256": "0ad1a819d8682b792c1f95ae786b9d6c148cd5fd4d5b90701f2f0e08f49a8338",
      "readme_url": "https://github.com/iGio90/frick/blob/master/README.md",
      "stars": 296,
      "targets": [
        "binary"
      ],
      "topics": [
        "cli",
        "debugger",
        "frida",
        "reverse-engineering"
      ],
      "url": "https://github.com/iGio90/frick",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Data Visualization Plugin for IDA Pro",
      "description_language": "bilingual",
      "description_zh": "IDA Pro 数据可视化插件",
      "full_name": "patois/IDACyber",
      "id": "scan-78717853",
      "license": "MIT",
      "observed_at": "2026-10-16T01:36:18.918136Z",
      "pushed_at": "2022-12-06T22:10:47Z",
      "readme_sha256": "2b2179d2338e433ec7c466394c6a568cdf4edec6b9a0ce922788fa5e88f516b5",
      "readme_url": "https://github.com/patois/IDACyber/blob/master/README.md",
      "stars": 296,
      "targets": [
        "binary",
        "firmware"
      ],
      "topics": [
        "color-filter",
        "cyber",
        "data-visualization",
        "exploitation",
        "firmware-analysis",
        "ida",
        "ida-pro",
        "idapython-plugin",
        "memory-forensics",
        "memory-hacking",
        "pixel-art",
        "reverse-engineering"
      ],
      "url": "https://github.com/patois/IDACyber",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Use angr in the IDA Pro debugger generating a state from the current debug session",
      "description_language": "bilingual",
      "description_zh": "在 IDA Pro 调试器中使用 angr，根据当前调试会话生成状态",
      "full_name": "andreafioraldi/IDAngr",
      "id": "scan-120510442",
      "license": "BSD-2-Clause",
      "observed_at": "2026-10-16T01:35:54.630552Z",
      "pushed_at": "2020-07-22T15:30:00Z",
      "readme_sha256": "d9f500a8c5e7e88d10473f894db889f960e04cff4019ea6d9d0a34a76ba1a0bb",
      "readme_url": "https://github.com/andreafioraldi/IDAngr/blob/master/README.md",
      "stars": 286,
      "targets": [
        "binary"
      ],
      "topics": [
        "angr",
        "concrete",
        "debugger",
        "execution",
        "gui",
        "ida",
        "ida-plugin",
        "ida-pro",
        "idapython",
        "plugin",
        "symbolic",
        "symbolic-execution"
      ],
      "url": "https://github.com/andreafioraldi/IDAngr",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Script to Automate installtion of Apps ,frida server and moving Burpsuite certificate to root folder",
      "description_language": "bilingual",
      "description_zh": "自动安装应用和 frida-server，并将 Burp Suite 证书移至根文件夹的脚本",
      "full_name": "raoshaab/Pen-Andro",
      "id": "scan-529786151",
      "license": "GPL-3.0",
      "observed_at": "2026-10-16T01:36:04.549140Z",
      "pushed_at": "2024-01-28T11:40:18Z",
      "readme_sha256": "07db92298c96624e0b410f70fbc95c92e15ed7d33ebbc52f0b7560b992bebbda",
      "readme_url": "https://github.com/raoshaab/Pen-Andro/blob/main/README.md",
      "stars": 273,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "adb",
        "automation",
        "bash",
        "bash-script",
        "burpsuite",
        "frida",
        "jadax",
        "mirror",
        "proxy",
        "proxydroid",
        "proxytoggle",
        "screen",
        "toggle"
      ],
      "url": "https://github.com/raoshaab/Pen-Andro",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "frida runtime (no python required, only a single file),One-click support for ios dump",
      "description_language": "bilingual",
      "description_zh": "Frida 运行时，无需 Python，仅需单个文件，一键支持 iOS 转储",
      "full_name": "aadog/fd-back",
      "id": "scan-385001048",
      "license": null,
      "observed_at": "2026-10-16T01:36:04.980515Z",
      "pushed_at": "2024-03-13T22:22:41Z",
      "readme_sha256": "fce73da69c09e085fe0479d40a1cb2a5bb5523348dfd3175ff55b9a3084700b3",
      "readme_url": "https://github.com/aadog/fd-back/blob/master/README.MD",
      "stars": 250,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "bagbak",
        "clutch",
        "dump",
        "dumpdecrypted",
        "frida",
        "frida-dump",
        "frida-go",
        "frida-ios",
        "frida-ios-dump",
        "frida-ios-hook",
        "frida-ipa",
        "frida-ipa-dump",
        "frida-python",
        "frida-runtime",
        "go",
        "go-frida",
        "ios",
        "ipa",
        "objection",
        "runtime"
      ],
      "url": "https://github.com/aadog/fd-back",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Trace APIs declaratively through Frida.",
      "description_language": "bilingual",
      "description_zh": "通过 Frida 以声明式方式跟踪 API。",
      "full_name": "nowsecure/frida-trace",
      "id": "scan-53356872",
      "license": "MIT",
      "observed_at": "2026-10-16T01:36:05.115016Z",
      "pushed_at": "2025-06-16T11:51:14Z",
      "readme_sha256": "aec924fb06cddf073bc17dcd02e3a13536a3d40c703c3520e7a86c8d54ea9c6c",
      "readme_url": "https://github.com/nowsecure/frida-trace/blob/main/README.md",
      "stars": 237,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "frida",
        "nowsecure",
        "trace"
      ],
      "url": "https://github.com/nowsecure/frida-trace",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Package your Frida script into an executable.",
      "description_language": "bilingual",
      "description_zh": "将 Frida 脚本打包为可执行文件。",
      "full_name": "std-microblock/fripack",
      "id": "scan-1093460134",
      "license": null,
      "observed_at": "2026-10-16T01:36:05.388360Z",
      "pushed_at": "2026-03-18T09:36:21Z",
      "readme_sha256": "6745674674c7c0eb427cea2252169d2b1f96047197c1c88cd3df301eb3cf08de",
      "readme_url": "https://github.com/std-microblock/fripack/blob/master/README.md",
      "stars": 233,
      "targets": [
        "binary"
      ],
      "topics": [
        "bundle",
        "frida",
        "hook",
        "javascript",
        "reverse-engineering"
      ],
      "url": "https://github.com/std-microblock/fripack",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "WinDbg-like kernel debugger for Windows, from Linux and macOS",
      "description_language": "bilingual",
      "description_zh": "可从 Linux 和 macOS 使用、类似 WinDbg 的 Windows 内核调试器",
      "full_name": "dmaivel/ntoseye",
      "id": "scan-856699121",
      "license": "MIT",
      "observed_at": "2026-10-16T01:35:44.232237Z",
      "pushed_at": "2026-10-15T21:47:46Z",
      "readme_sha256": "4010017b2faeb01ce1b2323776bab757215f63dd00dd118818a4c92c4183ceca",
      "readme_url": "https://github.com/dmaivel/ntoseye/blob/master/README.md",
      "stars": 218,
      "targets": [
        "binary"
      ],
      "topics": [
        "binary-analysis",
        "debugger",
        "kdnet",
        "kernel-debugger",
        "kvm",
        "malware-analysis",
        "mcp",
        "qemu",
        "reverse-engineering",
        "secure-kernel",
        "virtual-machine-introspection",
        "windbg",
        "windows",
        "windows-driver-development",
        "windows-driver-kit",
        "windows-kernel"
      ],
      "url": "https://github.com/dmaivel/ntoseye",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "This repo aims at providing practical examples on how to use r2frida",
      "description_language": "bilingual",
      "description_zh": "本仓库提供 r2frida 使用方法的实践示例",
      "full_name": "enovella/r2frida-wiki",
      "id": "scan-153009971",
      "license": null,
      "observed_at": "2026-10-16T01:36:05.816979Z",
      "pushed_at": "2020-12-11T12:21:08Z",
      "readme_sha256": "c630edaa4bed7c41fe4dc8b4e18403081e1fdb1bf5fcdcf6a34403fdb94ae86e",
      "readme_url": "https://github.com/enovella/r2frida-wiki/blob/master/README.md",
      "stars": 203,
      "targets": [
        "binary"
      ],
      "topics": [
        "dynamic-analysis",
        "frida",
        "r2frida",
        "radare2",
        "static-analysis"
      ],
      "url": "https://github.com/enovella/r2frida-wiki",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "An AI-agent skill system for mobile reverse engineering: Frida hooks, one-click unpacking, anti-detection bypasses, in-memory DEX dumps, and symbol/structure recovery through Ghidra MCP.",
      "description_language": "bilingual",
      "description_zh": "AI 智能体驱动的移动端逆向技能集：Frida Hook、一键脱壳、反检测绕过、内存 DEX 转储，以及通过 Ghidra MCP 恢复符号和结构。",
      "full_name": "index-login/MobileRE-Skill",
      "id": "scan-1255951226",
      "license": "MIT",
      "observed_at": "2026-10-16T01:35:49.925230Z",
      "pushed_at": "2026-10-10T09:37:03Z",
      "readme_sha256": "6d7ae893970a5fdee0729a75ff5c58c862b7b17e14e34e6f449a90bc778c5078",
      "readme_url": "https://github.com/index-login/MobileRE-Skill/blob/main/README.md",
      "stars": 185,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "agent-skills",
        "ai-agent",
        "android-security",
        "anti-debug",
        "dex",
        "dynamic-instrumentation",
        "frida",
        "frida-scripts",
        "frida-skills",
        "ghidra",
        "ios-security",
        "jadx",
        "llm",
        "mcp",
        "mcp-server",
        "mobile-security",
        "reverse-engineering",
        "unicorn-engine",
        "unpacking"
      ],
      "url": "https://github.com/index-login/MobileRE-Skill",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Tool to decrypt iOS apps using r2frida",
      "description_language": "bilingual",
      "description_zh": "使用 r2frida 解密 iOS 应用的工具",
      "full_name": "as0ler/r2flutch",
      "id": "scan-401239639",
      "license": "GPL-3.0",
      "observed_at": "2026-10-16T01:36:05.954501Z",
      "pushed_at": "2026-09-06T19:02:05Z",
      "readme_sha256": "8cc0ca50f65c51a857eec3ba68f17fe2d3fbe877b2f38513276f047bd996b087",
      "readme_url": "https://github.com/as0ler/r2flutch/blob/main/README.md",
      "stars": 184,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "decryption",
        "frida",
        "ios",
        "ipa",
        "r2frida",
        "radare2",
        "reverse-engineering"
      ],
      "url": "https://github.com/as0ler/r2flutch",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "iOS library (SDK) providing app security and threat monitoring. Shield your app with free RASP. Detect reverse engineering, jailbreak, Frida, emulators, bots, signature and integrity issues, VPN usage, and monitor device identification and more.",
      "description_language": "bilingual",
      "description_zh": "提供应用安全与威胁监控的 iOS 库（SDK），通过免费的 RASP 保护应用。可检测逆向工程、越狱、Frida、模拟器、机器人、签名与完整性问题、VPN 使用，并监控设备标识等信息。",
      "full_name": "talsec/Free-RASP-iOS",
      "id": "scan-377372740",
      "license": "MIT",
      "observed_at": "2026-10-16T01:36:06.146649Z",
      "pushed_at": "2026-10-05T07:48:46Z",
      "readme_sha256": "151b0ef34cdf6717b9b7efcb17eed90645eac20e3eea6bbb8d8c8d1b5bee84b7",
      "readme_url": "https://github.com/talsec/Free-RASP-iOS/blob/master/README.md",
      "stars": 184,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "freerasp",
        "frida",
        "frida-detection",
        "ios",
        "ios-app-shielding",
        "ios-lib",
        "ios-rasp",
        "ios-sdk",
        "ios-security",
        "jailbreak",
        "jailbreak-detection",
        "repackagin-protection",
        "repackaging-detection",
        "shadow-detection",
        "tampering-detection"
      ],
      "url": "https://github.com/talsec/Free-RASP-iOS",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "GUI for Frida -Scripts ",
      "description_language": "bilingual",
      "description_zh": "Frida 脚本的图形界面",
      "full_name": "antojoseph/diff-gui",
      "id": "scan-62171810",
      "license": null,
      "observed_at": "2026-10-16T01:36:06.309593Z",
      "pushed_at": "2016-11-03T11:23:25Z",
      "readme_sha256": "6228007ddce0a0062ae645ecf0ac9c2ea2582a39d96896c64563ce0ea00463f6",
      "readme_url": "https://github.com/antojoseph/diff-gui/blob/master/README.md",
      "stars": 182,
      "targets": [
        "binary"
      ],
      "topics": [
        "diff-gui",
        "frida",
        "frida-server",
        "gui"
      ],
      "url": "https://github.com/antojoseph/diff-gui",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Automates creating and capturing Free Fire guest accounts via Frida, formats and manages them, obtains JWTs, and sends encrypted like requests to a target UID with concurrency controls and one-like-per-guest-per-target guarantees.",
      "description_language": "bilingual",
      "description_zh": "通过 Frida 自动创建并捕获 Free Fire 游客账户，格式化和管理账户、获取 JWT，并向目标 UID 发送加密点赞请求；具有并发控制，并保证每个游客对每个目标只点赞一次。",
      "full_name": "kaifcodec/freefire-like-and-guest-api",
      "id": "scan-1055522493",
      "license": "NOASSERTION",
      "observed_at": "2026-10-18T18:08:48.219371Z",
      "pushed_at": "2026-04-30T17:22:01Z",
      "readme_sha256": "c63ca444b8232df2fd3c15c913f42e9329ebcd248d9bbd2c3c902161af3d49a7",
      "readme_url": "https://github.com/kaifcodec/freefire-like-and-guest-api/blob/75eb7b1b370c12a480e5193a6a5ff942574a3a48/README.md",
      "stars": 175,
      "targets": [
        "binary"
      ],
      "topics": [
        "ff-guest-generator",
        "free-fire-api",
        "free-fire-like-api",
        "freefire",
        "freefire-api",
        "freefire-guest",
        "freefire-like-api",
        "freefire-mod",
        "freefireapi",
        "freefirelike",
        "freefiremax",
        "frida"
      ],
      "url": "https://github.com/kaifcodec/freefire-like-and-guest-api",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "disassembler, decompiler and debugger in one, with a built-in mcp server: point an ai at a binary and it can debug it, not just read it. ida-style listing, pseudocode (f5), x64dbg-style debugger (windows and linux), binary diff, lua plugins. reads pe, elf and mach-o. runs on windows, linux and macos.",
      "description_language": "bilingual",
      "description_zh": "集反汇编器、反编译器和调试器于一体，内置 MCP 服务器，让 AI 不仅能读取二进制文件，还能调试它。提供 IDA 风格列表、伪代码（F5）、x64dbg 风格调试器（Windows 和 Linux）、二进制差异比对及 Lua 插件。可读取 PE、ELF 和 Mach-O，运行于 Windows、Linux 和 macOS。",
      "full_name": "ngwg/ceasta",
      "id": "scan-1071327554",
      "license": "GPL-3.0",
      "observed_at": "2026-10-16T01:36:12.142642Z",
      "pushed_at": "2026-09-26T18:16:47Z",
      "readme_sha256": "267eac58c7d0487b163667b13338a3fc8ae40c2d2cdcfb3efee186664bc91d21",
      "readme_url": "https://github.com/ngwg/ceasta/blob/main/README.md",
      "stars": 169,
      "targets": [
        "binary"
      ],
      "topics": [
        "capstone",
        "capstone-project",
        "cpp",
        "debugger",
        "decompiler",
        "disassembler",
        "elf",
        "imgui",
        "lua",
        "macos",
        "ptrace",
        "reverse-engineering",
        "x86-64"
      ],
      "url": "https://github.com/ngwg/ceasta",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Sniff XPC communication using Frida and Go",
      "description_language": "bilingual",
      "description_zh": "使用 Frida 和 Go 嗅探 XPC 通信",
      "full_name": "ReverseApple/gxpc",
      "id": "scan-648722050",
      "license": "MIT",
      "observed_at": "2026-10-16T10:47:38.109163Z",
      "pushed_at": "2026-02-10T01:50:06Z",
      "readme_sha256": "c45a3f97b62416470a39adef82b61140a73e553a13aac8dd9b34b6554284392b",
      "readme_url": "https://github.com/ReverseApple/gxpc/blob/main/README.md",
      "stars": 167,
      "targets": [
        "app",
        "binary",
        "protocol"
      ],
      "topics": [
        "frida",
        "ios",
        "macos",
        "reverse-engineering",
        "xnu",
        "xpc"
      ],
      "url": "https://github.com/ReverseApple/gxpc",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "An interactive disassembler for the CPU 6502, focused on Commodore 8-bit computers. Features a TUI with modern features like x-ref, undo/redo, flow arrows, keyboard-driven, MCP server for auto analysis, VICE debugger and more!",
      "description_language": "bilingual",
      "description_zh": "面向 Commodore 8 位计算机的 6502 CPU 交互式反汇编器。提供终端界面及交叉引用、撤销/重做、流程箭头、键盘操作、用于自动分析的 MCP 服务器、VICE 调试器等现代功能！",
      "full_name": "ricardoquesada/regenerator2000",
      "id": "scan-1120157666",
      "license": "Apache-2.0",
      "observed_at": "2026-10-16T01:36:16.570720Z",
      "pushed_at": "2026-08-25T17:57:05Z",
      "readme_sha256": "7d370151c424fc244a162f469734e3206a6e80ab43676394466d7dbf9a32777f",
      "readme_url": "https://github.com/ricardoquesada/regenerator2000/blob/main/README.md",
      "stars": 164,
      "targets": [
        "binary"
      ],
      "topics": [
        "6502",
        "6502-disassembly",
        "commodore-64",
        "commodore64",
        "disassembler",
        "mcp-server"
      ],
      "url": "https://github.com/ricardoquesada/regenerator2000",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "iOS is Apple's proprietary operating system that runs on the iPhone, iPod Touch and iPad. A lot of components are specific to iOS. Here are key features of the iOS hardware and software security architecture and guide how to test your applications.",
      "description_language": "bilingual",
      "description_zh": "iOS 是 Apple 的专有操作系统，运行于 iPhone、iPod Touch 和 iPad。许多组件为 iOS 特有。这里介绍 iOS 硬件和软件安全架构的关键特性，并提供应用测试指南。",
      "full_name": "vadim-a-yegorov/iOS-Internals-and-Security-Testing",
      "id": "scan-500733184",
      "license": "CC-BY-SA-4.0",
      "observed_at": "2026-10-16T10:47:37.471300Z",
      "pushed_at": "2024-05-01T23:20:08Z",
      "readme_sha256": "d426fe26bd8eb79be2c08d1821eaa0a9e3e92a491695f613380dc876ff97a837",
      "readme_url": "https://github.com/vadim-a-yegorov/iOS-Internals-and-Security-Testing/blob/master/README.md",
      "stars": 154,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "frida",
        "ios",
        "reverse-engineering",
        "security"
      ],
      "url": "https://github.com/vadim-a-yegorov/iOS-Internals-and-Security-Testing",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "AirSpy - Frida-based tool for exploring and tracking the evolution of Apple's AirDrop protocol implementation on i/macOS, from the server's perspective. Released during BH USA 2019 Training https://www.nowsecure.com/event/advanced-frida-and-radare-a-hackers-delight/",
      "description_language": "bilingual",
      "description_zh": "AirSpy：基于 Frida 的工具，从服务端视角探索并跟踪 Apple 在 iOS／macOS 中的 AirDrop 协议实现演变。在 BH USA 2019 培训期间发布：https://www.nowsecure.com/event/advanced-frida-and-radare-a-hackers-delight/",
      "full_name": "nowsecure/airspy",
      "id": "scan-201551895",
      "license": "MIT",
      "observed_at": "2026-10-18T18:08:48.223183Z",
      "pushed_at": "2023-01-04T07:43:36Z",
      "readme_sha256": "c6fdcb6e7ff222fb1cd8202fe6209a5998ff4ed007c72280c9140e83de3e00ec",
      "readme_url": "https://github.com/nowsecure/airspy/blob/7ea1d36f2e178043a799443d70982dd63f755d70/README.md",
      "stars": 152,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "airdrop",
        "dynamic-analysis",
        "frida",
        "ios"
      ],
      "url": "https://github.com/nowsecure/airspy",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Personal study and research notes on Objective-C, C++, iOS reverse engineering, assembly and Python.",
      "description_language": "bilingual",
      "description_zh": "个人学习研究笔记，OC、C++、iOS 逆向、汇编、Python。",
      "full_name": "jiaxw32/iNote",
      "id": "scan-258725007",
      "license": "MIT",
      "observed_at": "2026-10-18T18:08:53.284973Z",
      "pushed_at": "2023-11-19T14:07:07Z",
      "readme_sha256": "ebec2de90c2c0472640fa74cc1d12a60c02c5899240b0fd7653f67ac367a2993",
      "readme_url": "https://github.com/jiaxw32/iNote/blob/52a227251d9bfc76ca6514ff3b076976094a037d/README.md",
      "stars": 150,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "cpp",
        "frida",
        "lldb",
        "objective-c",
        "python",
        "reverse-engineering"
      ],
      "url": "https://github.com/jiaxw32/iNote",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "SDA is a rich cross-platform tool for reverse engineering that focused firstly on analysis of computer games. I'm trying to create a mix of the Ghidra, Cheat Engine and x64dbg. My tool will combine static and dynamic analysis of programs. Now SDA is being developed.",
      "description_language": "bilingual",
      "description_zh": "SDA 是功能丰富的跨平台逆向工程工具，最初侧重电脑游戏分析。我希望将 Ghidra、Cheat Engine 和 x64dbg 的特点结合，整合程序静态与动态分析。SDA 目前正在开发中。",
      "full_name": "Fleynaro/SDA",
      "id": "scan-233063028",
      "license": "Apache-2.0",
      "observed_at": "2026-10-16T01:36:12.963702Z",
      "pushed_at": "2023-12-28T10:30:26Z",
      "readme_sha256": "88cdeb586f95cdd02fb9b2a8da13607cd08733cebeefe4a8c09584aa53cc916e",
      "readme_url": "https://github.com/Fleynaro/SDA/blob/master/README.md",
      "stars": 140,
      "targets": [
        "binary",
        "game"
      ],
      "topics": [
        "analysis",
        "debugger",
        "decompiler",
        "disassembler",
        "dynamic-analysis",
        "games",
        "pe-format",
        "reverse-engineering",
        "static-analysis",
        "tool",
        "x86",
        "x86-64"
      ],
      "url": "https://github.com/Fleynaro/SDA",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Resources About Dynamic Binary Instrumentation and Dynamic Binary Analysis",
      "description_language": "bilingual",
      "description_zh": "动态二进制插桩与动态二进制分析资源。",
      "full_name": "alphaSeclab/DBI-Stuff",
      "id": "scan-244806212",
      "license": null,
      "observed_at": "2026-10-18T18:08:53.289333Z",
      "pushed_at": "2020-03-04T04:23:11Z",
      "readme_sha256": "af880670d0eaccf351351b4e6d2313bb5aab24243c3cd45f1e6d7ee979a57c99",
      "readme_url": "https://github.com/alphaSeclab/DBI-Stuff/blob/fa3cdb8d9bf0921bb6534164e0954fc7c6ac2e70/Readme.md",
      "stars": 139,
      "targets": [
        "binary"
      ],
      "topics": [
        "adbi",
        "drmemory",
        "dynamic-binary-analysis",
        "dynamic-binary-instrumentation",
        "dynamorio",
        "frida",
        "intelpin",
        "manticore",
        "qbdi",
        "triton",
        "valgrind"
      ],
      "url": "https://github.com/alphaSeclab/DBI-Stuff",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Jailbreak detection was changed through the years. This is a history overview and analysis of modern applications like Snapchat and Pokemon GO.",
      "description_language": "bilingual",
      "description_zh": "越狱检测技术多年来不断变化。本项目回顾其历史，并分析 Snapchat 和 Pokemon GO 等现代应用。",
      "full_name": "vadim-a-yegorov/Jailbreak-detection-The-modern-way",
      "id": "scan-568780694",
      "license": null,
      "observed_at": "2026-10-16T10:47:37.770508Z",
      "pushed_at": "2022-12-12T18:27:37Z",
      "readme_sha256": "84a05427bb8f0b55589d60b187689e8269402b3c8aedc6f8fcda227b63ba02ea",
      "readme_url": "https://github.com/vadim-a-yegorov/Jailbreak-detection-The-modern-way/blob/master/README.md",
      "stars": 136,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "arsenal",
        "blackhat",
        "forensics",
        "frida",
        "hacking",
        "hacking-tool",
        "ios",
        "jailbreak",
        "jailbreak-detection",
        "reverse-engineering",
        "security"
      ],
      "url": "https://github.com/vadim-a-yegorov/Jailbreak-detection-The-modern-way",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Random things",
      "description_language": "bilingual",
      "description_zh": "各种杂项",
      "full_name": "ate47/atian-cod-tools",
      "id": "scan-674836704",
      "license": "NOASSERTION",
      "observed_at": "2026-10-16T01:36:17.425635Z",
      "pushed_at": "2026-10-11T08:57:40Z",
      "readme_sha256": "1fae0805bd5496478d54ed19fb2768f759a4a11698c41830ab5f0e6650a9939c",
      "readme_url": "https://github.com/ate47/atian-cod-tools/blob/main/README.md",
      "stars": 135,
      "targets": [
        "binary"
      ],
      "topics": [
        "blackops3",
        "blackops4",
        "blackops6",
        "blackops7",
        "callofduty",
        "cold-war",
        "compiler",
        "debugger",
        "decompiler",
        "disassembler",
        "dump",
        "fastfile",
        "fastfile-linker",
        "gsc",
        "hash",
        "modern-warfare-3",
        "ps4",
        "vanguard"
      ],
      "url": "https://github.com/ate47/atian-cod-tools",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "A versatile C++ function mocking framework.",
      "description_language": "bilingual",
      "description_zh": "多用途 C++ 函数模拟（mock）框架。",
      "full_name": "Guardsquare/mocxx",
      "id": "scan-305667675",
      "license": "GPL-3.0",
      "observed_at": "2026-10-18T18:08:53.291203Z",
      "pushed_at": "2022-10-17T11:17:03Z",
      "readme_sha256": "141ee8c6ba60ce2ed3bd4f25a383a27511068bdfc7a748b9bbf19be9ebb84c3f",
      "readme_url": "https://github.com/Guardsquare/mocxx/blob/02160de7b01a33b300ec1dd4123366874c2e503c/README.md",
      "stars": 133,
      "targets": [
        "binary"
      ],
      "topics": [
        "cpp",
        "frida",
        "instrumentation",
        "mocking",
        "testing"
      ],
      "url": "https://github.com/Guardsquare/mocxx",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "A simple scraper for Ultimate-Guitar.com's mobile API, written in Go.",
      "description_language": "bilingual",
      "description_zh": "用 Go 编写的简单抓取器，面向 Ultimate-Guitar.com 的移动 API。",
      "full_name": "Pilfer/ultimate-guitar-scraper",
      "id": "scan-196539831",
      "license": null,
      "observed_at": "2026-10-18T18:08:53.292122Z",
      "pushed_at": "2023-11-27T15:22:43Z",
      "readme_sha256": "cea9539f7da5c2be3d730a5edfc74de05710c9b0c771daa5db9cb634aecd6b3a",
      "readme_url": "https://github.com/Pilfer/ultimate-guitar-scraper/blob/80bee08c0060d99f211bf6774a8e68744677837d/README.md",
      "stars": 132,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "frida",
        "golang",
        "guitar",
        "reverse-engineering",
        "scraper",
        "tablature",
        "tabs",
        "ultimate-guitar"
      ],
      "url": "https://github.com/Pilfer/ultimate-guitar-scraper",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "A set of plugins for Ghidra and x64Dbg synchronization. A faster, more flexible ret-sync.",
      "description_language": "bilingual",
      "description_zh": "用于同步 Ghidra 和 x64dbg 的插件套件，是更快、更灵活的 ret-sync。",
      "full_name": "diommsantos/Gx64Sync",
      "id": "scan-822605753",
      "license": null,
      "observed_at": "2026-10-16T01:35:51.345510Z",
      "pushed_at": "2025-11-11T15:18:38Z",
      "readme_sha256": "234bd53133666863d05941cb6cc4536290ad3f032c1a92cf29f62834983501e6",
      "readme_url": "https://github.com/diommsantos/Gx64Sync/blob/master/README.md",
      "stars": 131,
      "targets": [
        "binary"
      ],
      "topics": [
        "debugger",
        "debugging",
        "decompiler",
        "disassembler",
        "ghidra",
        "ghidra-plugin",
        "ghidra-plugins",
        "x64dbg",
        "x64dbg-plugin"
      ],
      "url": "https://github.com/diommsantos/Gx64Sync",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "First open-source DMA-based HWID spoofer written in Rust. Spoof hardware IDs via direct memory access.",
      "description_language": "bilingual",
      "description_zh": "首个用 Rust 编写、基于 DMA 的开源 HWID 伪装工具。通过直接内存访问伪装硬件 ID。",
      "full_name": "vibheksoni/dma-spoofer",
      "id": "scan-1165991266",
      "license": "MIT",
      "observed_at": "2026-10-18T14:36:39.547170Z",
      "pushed_at": "2026-03-26T15:52:59Z",
      "readme_sha256": "7ebb15e8d479756deb4b007c23d24e6979718d40e052f1b9d06f602456f0fb8f",
      "readme_url": "https://github.com/vibheksoni/dma-spoofer/blob/bad1b7c54a6fab3e0ba19a841d322b23f9b358c4/README.md",
      "stars": 130,
      "targets": [
        "binary"
      ],
      "topics": [
        "anti-cheat",
        "cybersecurity",
        "dma",
        "dse-bypass",
        "hardware-id",
        "hardware-spoofing",
        "hwid",
        "hwid-spoofer",
        "kernel-bypass",
        "memory-forensics",
        "memprocfs",
        "patchguard-bypass",
        "pcie",
        "reverse-engineering",
        "rust",
        "security-research",
        "smbios",
        "windows-security"
      ],
      "url": "https://github.com/vibheksoni/dma-spoofer",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Command line utility that interacts with plugged in iOS devices. Uses Apple's MobileDevice framework ",
      "description_language": "bilingual",
      "description_zh": "与已连接的 iOS 设备交互的命令行工具，使用 Apple 的 MobileDevice 框架。",
      "full_name": "DerekSelander/mobdevim",
      "id": "scan-112987531",
      "license": null,
      "observed_at": "2026-10-16T10:47:34.769890Z",
      "pushed_at": "2024-02-01T23:30:02Z",
      "readme_sha256": "33e5f37eb6641ad43b8e563446f19eb1af9869af7ccc8409520ddce9db0f7681",
      "readme_url": "https://github.com/DerekSelander/mobdevim/blob/main/README.md",
      "stars": 129,
      "targets": [
        "app"
      ],
      "topics": [
        "apple",
        "command-line",
        "ios",
        "mobiledevice",
        "reverse-engineering"
      ],
      "url": "https://github.com/DerekSelander/mobdevim",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Robust Frida-based tool to dump decrypted iOS apps as .ipa from a jailbroken device supports App Store, sideloaded and system.",
      "description_language": "bilingual",
      "description_zh": "基于 Frida 的稳健工具，从越狱设备将已解密的 iOS 应用转储为 .ipa，支持 App Store、侧载及系统应用。",
      "full_name": "lautarovculic/frida-ipa-extract",
      "id": "scan-1136924652",
      "license": "WTFPL",
      "observed_at": "2026-10-18T18:08:53.292831Z",
      "pushed_at": "2026-03-20T02:39:55Z",
      "readme_sha256": "af02d28f1aaa9e916cb109395646a49068682b901e64db5d4f3d076fb125a208",
      "readme_url": "https://github.com/lautarovculic/frida-ipa-extract/blob/e213b67c8261d4f96e32502d336a6a5ee056abe8/README.md",
      "stars": 129,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "apple",
        "frida",
        "frida-dump",
        "frida-ios-dump",
        "frida-scripts",
        "frida-server",
        "ios-hacking",
        "ios-security",
        "ios-security-tool",
        "ipa",
        "ipa-extractor",
        "mobile-hacking",
        "mobile-security"
      ],
      "url": "https://github.com/lautarovculic/frida-ipa-extract",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Fuzz iOS URL schemes",
      "description_language": "bilingual",
      "description_zh": "对 iOS URL scheme 进行模糊测试。",
      "full_name": "NSEcho/furlzz",
      "id": "scan-690763851",
      "license": "MIT",
      "observed_at": "2026-10-18T18:08:53.292346Z",
      "pushed_at": "2026-02-16T16:10:25Z",
      "readme_sha256": "2184178b1910fb9c9c6e6998e73d7c51c3db78602a4f4c97d0bd09b05b83017d",
      "readme_url": "https://github.com/NSEcho/furlzz/blob/4c5cac756d08166fb48642c47f86e2cd20ddcf1b/README.md",
      "stars": 129,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "frida",
        "fuzzing",
        "ios"
      ],
      "url": "https://github.com/NSEcho/furlzz",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "SherlockElf is a powerful tool designed for both static and dynamic analysis of Android ELF binaries and dynamic iOS Macho-O binaries (experimental).",
      "description_language": "bilingual",
      "description_zh": "SherlockElf 是功能强大的分析工具，支持 Android ELF 二进制文件的静态和动态分析，以及 iOS Mach-O 二进制文件的动态分析（实验性）。",
      "full_name": "iamtorsten/SherlockElf",
      "id": "scan-839807307",
      "license": "MIT",
      "observed_at": "2026-10-16T01:36:49.890221Z",
      "pushed_at": "2026-10-10T00:27:38Z",
      "readme_sha256": "86c9d72061b781b817833d2a7b8ee02cfe232ab875065825646c4b7714736786",
      "readme_url": "https://github.com/iamtorsten/SherlockElf/blob/main/README.md",
      "stars": 119,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "android",
        "android-app",
        "android-emulator",
        "deobfuscation",
        "deobfuscator",
        "dynamic-analysis",
        "elf",
        "elf-parser",
        "emulator",
        "frida",
        "ios",
        "ios-reverse",
        "libart",
        "libc",
        "libso",
        "memory",
        "memory-injection",
        "native-library",
        "reverse-engineering",
        "static-analysis"
      ],
      "url": "https://github.com/iamtorsten/SherlockElf",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Traces syscalls on iOS via Frida, including Mach syscalls.",
      "description_language": "bilingual",
      "description_zh": "通过 Frida 跟踪 iOS 系统调用，包含 Mach 系统调用。",
      "full_name": "juliangrtz/frida-iOS-syscall-tracer",
      "id": "scan-723700095",
      "license": null,
      "observed_at": "2026-10-18T18:08:53.296101Z",
      "pushed_at": "2026-04-03T18:33:17Z",
      "readme_sha256": "2c8bb3df52078fb911eb805e79da3d0c702c5c9a6be220587f8df2846b286c47",
      "readme_url": "https://github.com/juliangrtz/frida-iOS-syscall-tracer/blob/3b0108f09c10d56d80749501fdb6b48c1279f696/README.md",
      "stars": 111,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "frida",
        "frida-stalker",
        "ios",
        "ios-security",
        "strace",
        "syscall",
        "tracer"
      ],
      "url": "https://github.com/juliangrtz/frida-iOS-syscall-tracer",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Malware dynamic instrumentation tool based on frida framework",
      "description_language": "bilingual",
      "description_zh": "基于 Frida 框架的恶意软件动态插桩工具。",
      "full_name": "n1ght-w0lf/HawkEye",
      "id": "scan-270290980",
      "license": null,
      "observed_at": "2026-10-18T18:08:58.782599Z",
      "pushed_at": "2020-06-07T18:55:50Z",
      "readme_sha256": "1a83cda3fba7abf7135140322d59a9e551fca66fe4da9cc87e58ee044e54284b",
      "readme_url": "https://github.com/n1ght-w0lf/HawkEye/blob/e708e219a80fdf0a0a0693f4ecf78c1db6ab1d33/README.md",
      "stars": 111,
      "targets": [
        "binary"
      ],
      "topics": [
        "frida",
        "hawkeye",
        "hooking",
        "malware-analysis"
      ],
      "url": "https://github.com/n1ght-w0lf/HawkEye",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Use frida-gum's stalker for tracing",
      "description_language": "bilingual",
      "description_zh": "使用 frida-gum 的 Stalker 进行跟踪。",
      "full_name": "revercc/gumTVM",
      "id": "scan-986163653",
      "license": null,
      "observed_at": "2026-10-18T18:08:53.295736Z",
      "pushed_at": "2026-10-14T10:59:51Z",
      "readme_sha256": "54399ad075815b930bbe765097bb93b7f3df378d621ff13f10ae514f795ed03a",
      "readme_url": "https://github.com/revercc/gumTVM/blob/6ce0bc14d1cb4ee1c88b5564fd095778855531c1/readme.md",
      "stars": 111,
      "targets": [
        "binary"
      ],
      "topics": [
        "frida",
        "gum",
        "stalker"
      ],
      "url": "https://github.com/revercc/gumTVM",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Inject JS and C# into Windows apps, call COM and WinRT APIs",
      "description_language": "bilingual",
      "description_zh": "向 Windows 应用注入 JS 和 C#，并调用 COM 与 WinRT API。",
      "full_name": "davuxcom/frida-scripts",
      "id": "scan-129847959",
      "license": null,
      "observed_at": "2026-10-18T18:08:58.783546Z",
      "pushed_at": "2019-07-29T04:53:03Z",
      "readme_sha256": "a645b884d978fe56ce22ecc89e13aafaf40b49454a08250655963e4ac6e254cb",
      "readme_url": "https://github.com/davuxcom/frida-scripts/blob/0870a25f7f620e0018b3975400bc0f95a50ff86b/README.md",
      "stars": 107,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "com",
        "framework",
        "frida",
        "frida-javascript",
        "hooking",
        "win32",
        "win32api",
        "win32com",
        "windows",
        "windows10",
        "winrt"
      ],
      "url": "https://github.com/davuxcom/frida-scripts",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Extension for GDB",
      "description_language": "bilingual",
      "description_zh": "GDB 扩展",
      "full_name": "miyagaw61/exgdb",
      "id": "scan-89777519",
      "license": "MIT",
      "observed_at": "2026-10-16T01:36:18.128211Z",
      "pushed_at": "2024-04-15T05:44:41Z",
      "readme_sha256": "d7057fd28bd026c94933f6dca120669e7c93ac10c1ebd096c40cbc8a606554c9",
      "readme_url": "https://github.com/miyagaw61/exgdb/blob/master/README.md",
      "stars": 107,
      "targets": [
        "binary"
      ],
      "topics": [
        "ctf",
        "debug",
        "debugger",
        "debugging",
        "debugging-tool",
        "debugging-tools",
        "disassembler",
        "exploit",
        "exploit-kit",
        "exploitation",
        "exploits",
        "gdb",
        "gdb-peda",
        "plugin",
        "pwn",
        "software-analysis"
      ],
      "url": "https://github.com/miyagaw61/exgdb",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Using Frida Stalker to Bypass OLLVM and Restore (Function Call Analysis, Parameter Analysis, Stack Trace Printing, Instruction & Registers Trace).",
      "description_language": "bilingual",
      "description_zh": "使用 Frida Stalker 反 OLLVM 算法还原（函数调用分析、参数分析、打印调用堆栈、指令&寄存器Trace）。",
      "full_name": "CYRUS-STUDIO/frida_stalker",
      "id": "scan-957211323",
      "license": null,
      "observed_at": "2026-10-18T18:08:58.785047Z",
      "pushed_at": "2025-09-18T16:17:48Z",
      "readme_sha256": "374ce02d1c473f66535c52c62c07048d1be33941576d66b36c3fed0ece4105be",
      "readme_url": "https://github.com/CYRUS-STUDIO/frida_stalker/blob/ebb6504cb91b320604fc8f608c205251dfeb7c96/README.md",
      "stars": 103,
      "targets": [
        "binary"
      ],
      "topics": [
        "frida",
        "frida-stalker",
        "ollvm",
        "trace"
      ],
      "url": "https://github.com/CYRUS-STUDIO/frida_stalker",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "frida runtime resolves smali",
      "description_language": "bilingual",
      "description_zh": "通过 Frida 在运行时解析 smali。",
      "full_name": "axhlzy/ARTHookScripts",
      "id": "scan-735217128",
      "license": null,
      "observed_at": "2026-10-18T18:08:58.801858Z",
      "pushed_at": "2026-09-10T07:33:08Z",
      "readme_sha256": "0155108463753f600f3fc3be44a4ed8aa0bc3e15f9720b01a54fd98937bfca67",
      "readme_url": "https://github.com/axhlzy/ARTHookScripts/blob/e37a5c803efa3927f58b29610b68264430deb564/README.md",
      "stars": 94,
      "targets": [
        "binary"
      ],
      "topics": [
        "artruntime",
        "dexfile",
        "frida",
        "smali"
      ],
      "url": "https://github.com/axhlzy/ARTHookScripts",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Frida script to bypass the iOS application Jailbreak Detection",
      "description_language": "bilingual",
      "description_zh": "绕过 iOS 应用越狱检测的 Frida 脚本。",
      "full_name": "rubaljain/frida-jb-bypass",
      "id": "scan-173923982",
      "license": null,
      "observed_at": "2026-10-18T18:08:58.803416Z",
      "pushed_at": "2019-03-05T11:36:57Z",
      "readme_sha256": "062d10afafda51663dd0c57b57e41b6d9689a44bc310b5e91a08a6bb1e972aff",
      "readme_url": "https://github.com/rubaljain/frida-jb-bypass/blob/579678d8b0ec6fccd15d20566587a189f07a4005/README.md",
      "stars": 88,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "bypassjailbreak",
        "frida",
        "fridaios",
        "jailbreak",
        "jailbreak-detection",
        "jailbreak-tweak",
        "jailbreaking"
      ],
      "url": "https://github.com/rubaljain/frida-jb-bypass",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "This module allows you to easily inject javascript using frida and frida-load.",
      "description_language": "bilingual",
      "description_zh": "通过 Frida 和 frida-load 轻松注入 JavaScript 的模块。",
      "full_name": "freehuntx/frida-inject",
      "id": "scan-88385953",
      "license": "MIT",
      "observed_at": "2026-10-18T18:08:58.805762Z",
      "pushed_at": "2026-10-10T14:52:43Z",
      "readme_sha256": "9953c10f35ff31b4d82016a9cc0d3b1fd7bf2ef805ae828455e8dbe281d17bd0",
      "readme_url": "https://github.com/freehuntx/frida-inject/blob/e80cd1fadf6466df5d1fefeb43393d45522c9aac/README.md",
      "stars": 81,
      "targets": [
        "binary"
      ],
      "topics": [
        "frida"
      ],
      "url": "https://github.com/freehuntx/frida-inject",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "ARM64 trace evidence analysis & cipher algorithm recovery — Claude Desktop plugin with skills + local MCP server driving the native ak_search engine over GB-scale trace files",
      "description_language": "bilingual",
      "description_zh": "ARM64 跟踪证据分析与密码算法恢复：Claude Desktop 插件，结合技能与本地 MCP 服务器，驱动原生 ak_search 引擎处理 GB 级跟踪文件。",
      "full_name": "icloudza/algokiller-plugin",
      "id": "scan-1235535108",
      "license": "MIT",
      "observed_at": "2026-10-18T18:09:03.698145Z",
      "pushed_at": "2026-05-14T06:56:12Z",
      "readme_sha256": "62cc431a6be832be7949497a7bdb8e9458549dc8ba30bb21b1f6d635262f9e8f",
      "readme_url": "https://github.com/icloudza/algokiller-plugin/blob/045fa6162c655e6d054c94a8b78ebc22db3cd97c/README.md",
      "stars": 79,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "arm64",
        "binary-analysis",
        "claude-code",
        "claude-desktop",
        "cryptanalysis",
        "frida",
        "gumtrace",
        "mcp",
        "reverse-engineering",
        "trace-analysis"
      ],
      "url": "https://github.com/icloudza/algokiller-plugin",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Debug and DebugX (short: Debug/X) are extended versions of MS DEBUG",
      "description_language": "bilingual",
      "description_zh": "Debug 和 DebugX（简称 Debug/X）是 MS DEBUG 的扩展版本。",
      "full_name": "Baron-von-Riedesel/DOS-debug",
      "id": "scan-139948200",
      "license": null,
      "observed_at": "2026-10-18T18:09:37.112957Z",
      "pushed_at": "2025-06-17T11:46:21Z",
      "readme_sha256": "1072ec29dbd0eeed3d38b09c30ff0c8dbfd11c5f395959b1ae89bb24a3ff5140",
      "readme_url": "https://github.com/Baron-von-Riedesel/DOS-debug/blob/4ac7cd6ae61a4218eea63b1956eafad328e3d3f7/README.TXT",
      "stars": 77,
      "targets": [
        "binary"
      ],
      "topics": [
        "debugger",
        "disassembler",
        "x86"
      ],
      "url": "https://github.com/Baron-von-Riedesel/DOS-debug",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "All the mono c exports, ready to be used in frida!",
      "description_language": "bilingual",
      "description_zh": "所有 Mono C 导出函数，可直接在 Frida 中使用！",
      "full_name": "freehuntx/frida-mono",
      "id": "scan-142703549",
      "license": "MIT",
      "observed_at": "2026-10-18T18:09:03.700021Z",
      "pushed_at": "2026-10-13T08:07:30Z",
      "readme_sha256": "1d5414d5af1c333bacc3af929b8f52bca3ea9248c2711dcddfa9d4f74c816d31",
      "readme_url": "https://github.com/freehuntx/frida-mono/blob/7d43a8dd07668a8156153b8181c4629ac7b18903/README.md",
      "stars": 76,
      "targets": [
        "binary"
      ],
      "topics": [
        "frida"
      ],
      "url": "https://github.com/freehuntx/frida-mono",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Python script to hook ZIP files passwords in Windows 10",
      "description_language": "bilingual",
      "description_zh": "在 Windows 10 中通过 hook 获取 ZIP 文件密码的 Python 脚本。",
      "full_name": "vah13/Win_ZIP_password",
      "id": "scan-132915257",
      "license": null,
      "observed_at": "2026-10-18T18:09:03.700335Z",
      "pushed_at": "2018-05-10T19:43:32Z",
      "readme_sha256": "7d2bafea110204740a41df13efafa906a5292a38847a690ff06325c53e338c51",
      "readme_url": "https://github.com/vah13/Win_ZIP_password/blob/03b3d7d87a9cbb8c153ea71059a95e35bd682c64/README.md",
      "stars": 75,
      "targets": [
        "binary"
      ],
      "topics": [
        "frida",
        "security",
        "windows-10"
      ],
      "url": "https://github.com/vah13/Win_ZIP_password",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "6502 CPU emulator, assembler, disassembler, debugger and host written in go",
      "description_language": "bilingual",
      "description_zh": "用 Go 编写的 6502 CPU 模拟器、汇编器、反汇编器、调试器及宿主程序。",
      "full_name": "beevik/go6502",
      "id": "scan-25433327",
      "license": "BSD-2-Clause",
      "observed_at": "2026-10-18T18:09:37.114506Z",
      "pushed_at": "2026-03-01T01:36:01Z",
      "readme_sha256": "38d7e56f0e7239fb0b008ac6c06465bd2beee2660543a6a43de385c7e68d08a7",
      "readme_url": "https://github.com/beevik/go6502/blob/e8b7f8a84a4084ad03be639d719f5fc8ad2d8ec0/README.md",
      "stars": 74,
      "targets": [
        "binary"
      ],
      "topics": [
        "6502",
        "assembler",
        "debugger",
        "disassembler",
        "emulator",
        "go"
      ],
      "url": "https://github.com/beevik/go6502",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Wii U RAM TCP Debugger Client/Cheat Code Manager",
      "description_language": "bilingual",
      "description_zh": "Wii U RAM TCP 调试客户端与作弊码管理器。",
      "full_name": "BullyWiiPlaza/JGeckoU",
      "id": "scan-51077593",
      "license": "NOASSERTION",
      "observed_at": "2026-10-18T18:09:37.115106Z",
      "pushed_at": "2025-09-17T19:25:48Z",
      "readme_sha256": "8898c6795bc324f77d88472c11568213f0eddfed68314ce9a0afd5c8d6eb93c4",
      "readme_url": "https://github.com/BullyWiiPlaza/JGeckoU/blob/c24ef6adc3bf02075c75fc66ba99a4b8b19aaf83/README.md",
      "stars": 73,
      "targets": [
        "binary"
      ],
      "topics": [
        "cafe-cheat-codes",
        "cafe-codes",
        "cheat-codes",
        "code-manager",
        "code-wizard",
        "disassembler",
        "filesystem-access",
        "homebrew",
        "java",
        "memory-viewer",
        "modding",
        "nintendo-homebrew",
        "nintendo-wiiu",
        "ram-hacking",
        "reverse-engineering",
        "scripting",
        "tcp-client",
        "tcp-gecko",
        "tcp-gecko-installer",
        "wiiu"
      ],
      "url": "https://github.com/BullyWiiPlaza/JGeckoU",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Full-stack mobile game-security research (Honor of Kings / sgame): kernel-mode cross-process memory reading (KernelPatch KPM), Tencent ACE anti-cheat & IL2CPP/native engine reverse engineering, and a real-time ESP overlay. Educational / research only; no proprietary binaries.",
      "description_language": "bilingual",
      "description_zh": "全栈移动游戏安全研究，针对《王者荣耀》/sgame：内核态跨进程内存读取（KernelPatch KPM）、腾讯 ACE 反作弊及 IL2CPP/原生引擎逆向工程，以及实时 ESP 叠加显示。仅用于教学与研究，不包含专有二进制文件。",
      "full_name": "wwweeeqqu/honor-of-kings-RE-research",
      "id": "scan-1263123146",
      "license": "NOASSERTION",
      "observed_at": "2026-10-16T01:37:26.505253Z",
      "pushed_at": "2026-06-08T17:07:13Z",
      "readme_sha256": "e30ad69be30c534ea12eec186406dc5aa8bb546e7067a059378fc779a3dd4853",
      "readme_url": "https://github.com/wwweeeqqu/honor-of-kings-RE-research/blob/main/README.md",
      "stars": 73,
      "targets": [
        "app",
        "binary",
        "game"
      ],
      "topics": [
        "android",
        "anti-cheat",
        "arm64",
        "esp",
        "frida",
        "game-hacking",
        "game-security",
        "honor-of-kings",
        "il2cpp",
        "kernel-module",
        "kernelpatch",
        "memory-analysis",
        "mobile-security",
        "reverse-engineering",
        "security-research",
        "unity"
      ],
      "url": "https://github.com/wwweeeqqu/honor-of-kings-RE-research",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Tool to automate the process of embedding dynamic libraries into iOS applications from GNU/Linux",
      "description_language": "bilingual",
      "description_zh": "在 GNU/Linux 上自动将动态库嵌入 iOS 应用的工具。",
      "full_name": "LeanVel/iInject",
      "id": "scan-95218213",
      "license": "GPL-3.0",
      "observed_at": "2026-10-18T18:09:03.702111Z",
      "pushed_at": "2017-07-15T20:27:45Z",
      "readme_sha256": "bae6285a04eaf0163bf9d05a2814a9bdbdebdf426063e90da45b8fb971dae320",
      "readme_url": "https://github.com/LeanVel/iInject/blob/48f2123143ede8eb85403edb7ca16043084e2e97/README.md",
      "stars": 72,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "codesigning",
        "dylib",
        "embedding-dynamic-libraries",
        "frida",
        "ideviceinstaller",
        "insert-dylib",
        "ios",
        "isign",
        "libimobiledevice",
        "linux"
      ],
      "url": "https://github.com/LeanVel/iInject",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Automated SSL pinning bypass for any Flutter & Shorebird version — PyGhidra static analysis auto-discovers BoringSSL and generates ready-to-run Frida & Renef scripts",
      "description_language": "bilingual",
      "description_zh": "对任意 Flutter 和 Shorebird 版本自动绕过 SSL 证书固定；使用 PyGhidra 静态分析自动发现 BoringSSL，并生成可直接运行的 Frida 与 Renef 脚本。",
      "full_name": "vichhka-git/universal-flutter-ssl-pinning",
      "id": "scan-1176558363",
      "license": null,
      "observed_at": "2026-10-18T18:08:08.643801Z",
      "pushed_at": "2026-09-02T09:16:16Z",
      "readme_sha256": "78ccbc8d1ea0c33a2ad31fbd51cda9dad6c024b9c4ea9b14fd171464d9ca5668",
      "readme_url": "https://github.com/vichhka-git/universal-flutter-ssl-pinning/blob/f7ead4343bfc86dca735b63da6a2e3e019c87736/README.md",
      "stars": 69,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "dart",
        "flutter",
        "frida",
        "ghidra",
        "mobile",
        "penetration-testing-tools",
        "python3",
        "renef",
        "ssl-pinning"
      ],
      "url": "https://github.com/vichhka-git/universal-flutter-ssl-pinning",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Hooks libboringssl.dylib to extract TLS keys and enables the traffic from iOS apps to be decrypted.",
      "description_language": "bilingual",
      "description_zh": "通过 hook libboringssl.dylib 提取 TLS 密钥，使 iOS 应用流量能够被解密。",
      "full_name": "jankais3r/Frida-iOS-15-TLS-Keylogger",
      "id": "scan-569003123",
      "license": "MIT",
      "observed_at": "2026-10-18T18:09:03.705811Z",
      "pushed_at": "2022-11-21T21:58:23Z",
      "readme_sha256": "d2321216d3e57102757a53c9c16f1b09cd229c3d9bb5a1a55a7aa0e503300464",
      "readme_url": "https://github.com/jankais3r/Frida-iOS-15-TLS-Keylogger/blob/908e1b23104d2b8ad5d1931f5c4e5882e3ea9db0/README.md",
      "stars": 64,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "boringssl",
        "frida",
        "frida-scripts",
        "frida-snippets",
        "ssl-bypass",
        "ssl-pinning",
        "tls"
      ],
      "url": "https://github.com/jankais3r/Frida-iOS-15-TLS-Keylogger",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "XDV is disassembler or debugger that works based on the extension plugin.",
      "description_language": "bilingual",
      "description_zh": "XDV 是基于扩展插件工作的反汇编器或调试器。",
      "full_name": "imugee/xdv",
      "id": "scan-172156465",
      "license": "GPL-3.0",
      "observed_at": "2026-10-16T01:37:16.261410Z",
      "pushed_at": "2019-09-03T07:54:52Z",
      "readme_sha256": "e80c2fb50447ef3e7131d23eea191eab74b73dc59e2fd657e6aa6650257cf4c9",
      "readme_url": "https://github.com/imugee/xdv/blob/master/README.md",
      "stars": 56,
      "targets": [
        "binary"
      ],
      "topics": [
        "debugger",
        "debuggers",
        "debugging-tool",
        "disassembler",
        "qt5",
        "reverse-engineering",
        "reversing",
        "windbg",
        "x86",
        "x86-64"
      ],
      "url": "https://github.com/imugee/xdv",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Decrypt VMware vTPM-encrypted .vmem/.vmsn/.vmss/.nvram from the VM password, and flatten the .vmem to a Volatility-ready image.",
      "description_language": "bilingual",
      "description_zh": "使用虚拟机密码解密经 VMware vTPM 加密的 .vmem/.vmsn/.vmss/.nvram，并将 .vmem 扁平化为可供 Volatility 使用的镜像。",
      "full_name": "heeeyaaaa/vmem-decrypt",
      "id": "scan-1281365567",
      "license": "MIT",
      "observed_at": "2026-10-18T14:36:39.781425Z",
      "pushed_at": "2026-07-04T14:14:29Z",
      "readme_sha256": "ddecfdd0b5a43ce4f9bcacf96961b4d5b211460fd2bc1eb5e21d4ebb6c7f4829",
      "readme_url": "https://github.com/heeeyaaaa/vmem-decrypt/blob/9182adf1bd70c6c0f85a212e5be6194b4c6c3340/README.md",
      "stars": 55,
      "targets": [
        "binary"
      ],
      "topics": [
        "decryption",
        "dfir",
        "encobj",
        "forensics",
        "incident-response",
        "memory-forensics",
        "python",
        "reverse-engineering",
        "vmem",
        "vmsn",
        "vmware",
        "vmware-workstation",
        "volatility",
        "volatility3",
        "vtpm",
        "windows11"
      ],
      "url": "https://github.com/heeeyaaaa/vmem-decrypt",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "MCP server for Frida.",
      "description_language": "bilingual",
      "description_zh": "Frida 的 MCP 服务器。",
      "full_name": "crissyfield/super-trouper",
      "id": "scan-1353687754",
      "license": "MIT",
      "observed_at": "2026-10-16T07:14:44.084116Z",
      "pushed_at": "2026-10-15T12:52:58Z",
      "readme_sha256": "063edd26f7163b49f64415b8740463a8368c9c1e1e38db3522a5415ada40d34d",
      "readme_url": "https://github.com/crissyfield/super-trouper/blob/main/README.md",
      "stars": 54,
      "targets": [
        "app",
        "binary",
        "game"
      ],
      "topics": [
        "application-security",
        "frida",
        "ios-security",
        "mcp",
        "mobile-security",
        "model-context-protocol",
        "pentesting",
        "reverse-engineering"
      ],
      "url": "https://github.com/crissyfield/super-trouper",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "reverse engineering of the windows nt kernel debugger protocol & reimplementation.",
      "description_language": "bilingual",
      "description_zh": "Windows NT 内核调试器协议的逆向工程与重新实现。",
      "full_name": "irql/nokd",
      "id": "scan-375171447",
      "license": null,
      "observed_at": "2026-10-16T10:47:57.899179Z",
      "pushed_at": "2024-07-02T16:18:14Z",
      "readme_sha256": "712c72a79cc73412d0cd4e22cca1e18e9b52ff782f4e09e71a2b0b7f31278092",
      "readme_url": "https://github.com/irql/nokd/blob/master/README.md",
      "stars": 44,
      "targets": [],
      "topics": [
        "reverse-engineering",
        "windbg",
        "windows"
      ],
      "url": "https://github.com/irql/nokd",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Unofficial patches for IDA 7.5 Demo on Linux x86_64. Suffering from success: Hex-Rays SA DMCA’d repository.",
      "description_language": "bilingual",
      "description_zh": "针对 Linux x86_64 上 IDA 7.5 Demo 的非官方补丁。受成功所累：仓库被 Hex-Rays SA 提出了 DMCA 下架要求。",
      "full_name": "StackOverflowExcept1on/ida75demo-linux",
      "id": "scan-560977364",
      "license": null,
      "observed_at": "2026-10-18T14:37:59.719992Z",
      "pushed_at": "2023-12-17T10:33:22Z",
      "readme_sha256": "931a7c3d1c8204a49a1baeeda93324a0df1be54c1f25372908edf30756625b98",
      "readme_url": "https://github.com/StackOverflowExcept1on/ida75demo-linux/blob/2a85075adf951bcbc7803f60ad938a16bfc51f91/README.md",
      "stars": 35,
      "targets": [
        "binary"
      ],
      "topics": [
        "frida",
        "idapro",
        "linux",
        "patching",
        "reverse-engineering"
      ],
      "url": "https://github.com/StackOverflowExcept1on/ida75demo-linux",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Use angr inside the radare2 debugger. Create an angr state from the current debugger state.",
      "description_language": "bilingual",
      "description_zh": "在 radare2 调试器中使用 angr，并根据当前调试器状态创建 angr 状态。",
      "full_name": "andreafioraldi/r2angrdbg",
      "id": "scan-140069318",
      "license": "BSD-2-Clause",
      "observed_at": "2026-10-16T01:37:07.530321Z",
      "pushed_at": "2019-06-11T07:40:13Z",
      "readme_sha256": "90d1f6e817cb176f19599a1515a7314e93010e567aacab7b9904365fee424864",
      "readme_url": "https://github.com/andreafioraldi/r2angrdbg/blob/master/README.md",
      "stars": 34,
      "targets": [
        "binary"
      ],
      "topics": [
        "angr",
        "angrdbg",
        "concrete",
        "debugger",
        "integration",
        "r2",
        "radare2"
      ],
      "url": "https://github.com/andreafioraldi/r2angrdbg",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Redirect spawned iOS application stdout and stderr to pty",
      "description_language": "bilingual",
      "description_zh": "将启动的 iOS 应用的标准输出（stdout）和标准错误（stderr）重定向至伪终端（pty）",
      "full_name": "NSEcho/fnoios",
      "id": "scan-735417491",
      "license": "MIT",
      "observed_at": "2026-10-16T10:47:38.435896Z",
      "pushed_at": "2025-01-29T21:05:37Z",
      "readme_sha256": "cdd251a42d6a609f5b5b2dcfc2391f48cf3f81923e9f377223c1ed77f6a22efd",
      "readme_url": "https://github.com/NSEcho/fnoios/blob/main/README.md",
      "stars": 31,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "frida",
        "golang",
        "ios",
        "reverse-engineering"
      ],
      "url": "https://github.com/NSEcho/fnoios",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Open-source memory forensics platform for DFIR, threat hunting, malware analysis, and incident response.",
      "description_language": "bilingual",
      "description_zh": "用于 DFIR、威胁狩猎、恶意软件分析和事件响应的开源内存取证平台。",
      "full_name": "EmadAbedini/Dumplyzer",
      "id": "scan-1367451072",
      "license": "Apache-2.0",
      "observed_at": "2026-10-18T14:36:40.804156Z",
      "pushed_at": "2026-10-05T16:48:29Z",
      "readme_sha256": "1ffd1ea9211e2218fc270962b141d6a7a0163eb83a6efb5c255d1a72806dd300",
      "readme_url": "https://github.com/EmadAbedini/Dumplyzer/blob/22631a3734f83393fb2123559120bd5eb3c5b48f/README.md",
      "stars": 29,
      "targets": [
        "binary"
      ],
      "topics": [
        "dfir",
        "dfir-tools",
        "digital-forensics",
        "forensics",
        "incident-response",
        "memory-forensics",
        "reverse-engineering",
        "threat-hunting",
        "volatility"
      ],
      "url": "https://github.com/EmadAbedini/Dumplyzer",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Neo Geo Pocket / Color emulator with a full debugger and fan-translation & ROM hacking tools (.tbl tables, relative search, pointer finder, ROM diff). Save states, rewind, Windows/Linux/macOS builds.",
      "description_language": "bilingual",
      "description_zh": "Neo Geo Pocket / Color 模拟器，配有完整调试器以及同人翻译和 ROM 修改工具（.tbl 表、相对搜索、指针查找器、ROM 差异比较）。支持即时存档、倒带，提供 Windows/Linux/macOS 构建版本。",
      "full_name": "Tixul/Ngpcraft_emulator",
      "id": "scan-1303345805",
      "license": "MIT",
      "observed_at": "2026-10-18T14:35:45.303626Z",
      "pushed_at": "2026-10-17T20:08:49Z",
      "readme_sha256": "8d02f3d9daca01d464546f7d8d931c92d8c5e1194ebd198b3bb140a7b380d7b8",
      "readme_url": "https://github.com/Tixul/Ngpcraft_emulator/blob/0b9d9ba17edd5915fb13fbc540ebe22b5ccfe460/README.md",
      "stars": 29,
      "targets": [
        "binary"
      ],
      "topics": [
        "cycle-accurate",
        "debugger",
        "disassembler",
        "emulator",
        "fan-translation",
        "handheld",
        "homebrew",
        "neo-geo-pocket",
        "ngpc",
        "ngpcraft",
        "ram-search",
        "retro-gaming",
        "reverse-engineering-tools",
        "rom-hacking",
        "romhacking",
        "snk",
        "tile-viewer",
        "tlcs900",
        "translation-tools",
        "z80"
      ],
      "url": "https://github.com/Tixul/Ngpcraft_emulator",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "The Native Reverse Engineering IDE. Zero-overhead binary analysis, full CPU emulation (PE/ELF), and headless automation. Powered by Capstone, Unicorn, LLVM & Remill via N-API. ",
      "description_language": "bilingual",
      "description_zh": "原生逆向工程 IDE。提供零开销二进制分析、完整 CPU 模拟（PE/ELF）和无界面自动化，通过 N-API 集成 Capstone、Unicorn、LLVM 与 Remill。",
      "full_name": "AkashaCorporation/HikariSystem-HexCore",
      "id": "scan-1137090416",
      "license": "MIT",
      "observed_at": "2026-10-16T07:14:57.333413Z",
      "pushed_at": "2026-09-23T05:38:24Z",
      "readme_sha256": "62982d9545d2045d777f180be68df7ebe6e7f4b1a4aff2b504739925f6aedecf",
      "readme_url": "https://github.com/AkashaCorporation/HikariSystem-HexCore/blob/main/README.md",
      "stars": 27,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "better-sqlite3",
        "binary-analysis",
        "debugger",
        "disassembler",
        "electron",
        "hexcore-ide",
        "llvm-mc",
        "malware-analysis",
        "n-api",
        "remill",
        "reverse-engineering"
      ],
      "url": "https://github.com/AkashaCorporation/HikariSystem-HexCore",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "iOS SSL Bypass & Real-Time Traffic Monitor – A Frida-based script for bypassing SSL pinning and monitoring network traffic on iOS apps in real-time. Designed for security researchers and ethical testing. 📡🔓",
      "description_language": "bilingual",
      "description_zh": "iOS SSL 绕过与实时流量监控：基于 Frida 的脚本，可绕过 SSL 证书固定并实时监控 iOS 应用的网络流量。面向安全研究人员与合乎伦理的测试。📡🔓",
      "full_name": "riyadmondol2006/ios-ssl-bypass-and-traffic-monitor",
      "id": "scan-946333640",
      "license": null,
      "observed_at": "2026-10-16T10:47:38.663965Z",
      "pushed_at": "2025-03-11T22:18:20Z",
      "readme_sha256": "3393bc2797a49a34ae77d5fac5c930a96a7536c6635719d25c80ceb9e9711f7a",
      "readme_url": "https://github.com/riyadmondol2006/ios-ssl-bypass-and-traffic-monitor/blob/main/README.md",
      "stars": 24,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "app-debugging",
        "frida",
        "ios",
        "mobile-security",
        "network-monitor",
        "reverse-engineering",
        "ssl-bypass",
        "traffic-analysis"
      ],
      "url": "https://github.com/riyadmondol2006/ios-ssl-bypass-and-traffic-monitor",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "MCP server for Frida 17 dynamic instrumentation",
      "description_language": "bilingual",
      "description_zh": "用于 Frida 17 动态插桩的 MCP 服务器。",
      "full_name": "yfe404/frida-mcp",
      "id": "scan-1153899337",
      "license": null,
      "observed_at": "2026-10-16T07:14:46.110707Z",
      "pushed_at": "2026-07-20T11:09:09Z",
      "readme_sha256": "48ed60a23cb17087d5b613f4111feba7bab024587e89137a15ee912f00391efc",
      "readme_url": "https://github.com/yfe404/frida-mcp/blob/main/README.md",
      "stars": 24,
      "targets": [
        "app",
        "game"
      ],
      "topics": [],
      "url": "https://github.com/yfe404/frida-mcp",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "A reverse-engineering toolkit for iOS and Android applications (Frida, mitmproxy, Ghidra, Theos)",
      "description_language": "bilingual",
      "description_zh": "iOS 和 Android 应用逆向工程工具包（Frida、mitmproxy、Ghidra、Theos）。",
      "full_name": "qtmleap/revkit",
      "id": "scan-1203843014",
      "license": "MIT",
      "observed_at": "2026-10-16T01:37:08.805113Z",
      "pushed_at": "2026-10-04T07:34:32Z",
      "readme_sha256": "f1ef13fcc3e9d3a5630fd80b41fd477ce1b43660d451662aeff1c17ad489bfe2",
      "readme_url": "https://github.com/qtmleap/revkit/blob/master/README.md",
      "stars": 19,
      "targets": [
        "app",
        "binary",
        "website"
      ],
      "topics": [
        "android",
        "frida",
        "ghidra",
        "ios",
        "jadx",
        "mitmproxy",
        "radare2",
        "reverse-engineering",
        "security-research",
        "theos"
      ],
      "url": "https://github.com/qtmleap/revkit",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Reverse-engineering skills for AI coding agents, with IDA/MCP integration, APK and JavaScript workflows, bounded agent swarms, and routing evaluation.",
      "description_language": "bilingual",
      "description_zh": "面向 AI 编程智能体的逆向工程技能，包含 IDA/MCP 集成、APK 和 JavaScript 工作流、受限的智能体集群及路由评估。",
      "full_name": "2233admin/reverse-skill-evolver",
      "id": "scan-1251226171",
      "license": "MIT",
      "observed_at": "2026-10-16T07:14:52.843316Z",
      "pushed_at": "2026-10-14T09:08:18Z",
      "readme_sha256": "8ce2217de8d7c6ae147ce1c1af4f980a515a1cc7400621d0508cbeb99021707e",
      "readme_url": "https://github.com/2233admin/reverse-skill-evolver/blob/main/README.md",
      "stars": 17,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "agent-skills",
        "agent-swarm",
        "ai-agents",
        "android",
        "frida",
        "ida-pro",
        "javascript",
        "mcp",
        "reverse-engineering",
        "skill-routing",
        "skills"
      ],
      "url": "https://github.com/2233admin/reverse-skill-evolver",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Decrypt and dump iOS app binaries to an IPA file via USB and SSH/SFTP",
      "description_language": "bilingual",
      "description_zh": "通过 USB 和 SSH／SFTP 解密并转储 iOS 应用二进制文件，生成 IPA 文件",
      "full_name": "Fi5t/iDump",
      "id": "scan-1230215286",
      "license": "MIT",
      "observed_at": "2026-10-16T11:54:23.267474Z",
      "pushed_at": "2026-07-10T12:01:38Z",
      "readme_sha256": "184c76696e82860f5d0f72f346034363530d22fec54545fe1a290c1543ec5136",
      "readme_url": "https://github.com/Fi5t/iDump/blob/develop/README.md",
      "stars": 17,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "frida",
        "ios",
        "reverse-engineering"
      ],
      "url": "https://github.com/Fi5t/iDump",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Frida wrapper for iOS/macOS penetration testers and reverse engineers. (WIP)",
      "description_language": "bilingual",
      "description_zh": "面向 iOS／macOS 渗透测试人员和逆向工程师的 Frida 封装，仍在开发中。",
      "full_name": "p1tsi/wormhole",
      "id": "scan-896192939",
      "license": null,
      "observed_at": "2026-10-16T11:54:18.445327Z",
      "pushed_at": "2025-10-20T11:11:15Z",
      "readme_sha256": "d522e1e94810838050a045833661c6b07edf9d31156f3e31b16dba6e00a72035",
      "readme_url": "https://github.com/p1tsi/wormhole/blob/main/README.md",
      "stars": 14,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "frida",
        "ios",
        "macos",
        "penetration-testing",
        "reverse-engineering"
      ],
      "url": "https://github.com/p1tsi/wormhole",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Custom-built for dsh (DeepSeek Harness): a persistent Ghidra headless daemon and reverse-engineering agent skills (triage/unpack/decompile/pwn/pcap/APK), with circuit breakers against agent failure loops and skills that evolve through retrospectives.",
      "description_language": "bilingual",
      "description_zh": "为 dsh（DeepSeek Harness）深度定制：持久化 Ghidra 无界面守护进程及逆向工程智能体技能，涵盖初步分析、脱壳、反编译、漏洞利用、pcap 和 APK，具有阻断智能体失败循环的熔断机制，并能从复盘中演进。",
      "full_name": "Cristallin2006/ghidra-skill-for-dsh",
      "id": "scan-1368475560",
      "license": "MIT",
      "observed_at": "2026-10-16T01:36:27.873059Z",
      "pushed_at": "2026-10-11T08:12:59Z",
      "readme_sha256": "7a8d87c87a676f02ab4477975dbb5f8d62a6e31ec7992089574d656666c71fed",
      "readme_url": "https://github.com/Cristallin2006/ghidra-skill-for-dsh/blob/main/README.md",
      "stars": 11,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "agent-skills",
        "ai-agent",
        "android-reverse-engineering",
        "binary-analysis",
        "ctf",
        "ctf-reverse-engineering",
        "ctf-tools",
        "cybersecurity",
        "decompiler",
        "deepseek-harness",
        "dsh-plugin",
        "dsh-skills",
        "frida",
        "ghidra",
        "malware-analysis",
        "network-forensics",
        "pcap",
        "pyghidra",
        "reverse-engineering",
        "unpacking"
      ],
      "url": "https://github.com/Cristallin2006/ghidra-skill-for-dsh",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Dart AOT snapshot analyzer: exports blutter-compatible symbols and structs for IDA / radare2 / Frida, and decompiles functions into dart-analyze-clean Dart. Desktop and real-device mobile (compressed pointers), Dart 2.7-3.14. No Dart SDK, never runs the target.",
      "description_language": "bilingual",
      "description_zh": "Dart AOT 快照分析器：为 IDA、radare2 和 Frida 导出兼容 blutter 的符号及结构体，并将函数反编译为可通过 dart analyze 检查的 Dart 代码。支持桌面端和真实移动设备（压缩指针），涵盖 Dart 2.7–3.14。无需 Dart SDK，且不会运行目标程序。",
      "full_name": "ejfkdev/dae",
      "id": "scan-1352271245",
      "license": "MIT",
      "observed_at": "2026-10-16T01:37:11.144918Z",
      "pushed_at": "2026-10-04T01:27:09Z",
      "readme_sha256": "f744156be3d51ceb4c56372f646ff5f778995a79507d993c64c5b87a7b336641",
      "readme_url": "https://github.com/ejfkdev/dae/blob/main/README.md",
      "stars": 9,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "android",
        "binary-analysis",
        "compressed-pointers",
        "dart",
        "dart-aot",
        "decompiler",
        "flutter",
        "frida",
        "ida",
        "radare2",
        "reverse-engineering",
        "rust",
        "snapshot-analysis"
      ],
      "url": "https://github.com/ejfkdev/dae",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Dynamic branch-divergence finder for native code -- traces two Frida executions and finds the exact instruction where they diverge.",
      "description_language": "bilingual",
      "description_zh": "原生代码的动态分支分歧定位工具：跟踪两次 Frida 执行，找到它们开始分歧的精确指令。",
      "full_name": "Veridiff/Veridiff",
      "id": "scan-1373479267",
      "license": "Apache-2.0",
      "observed_at": "2026-10-16T01:37:03.188187Z",
      "pushed_at": "2026-10-01T12:16:16Z",
      "readme_sha256": "8440e17d0663be464072baff4c87a1d30f78d1a5b2e96976da98549b7d190837",
      "readme_url": "https://github.com/Veridiff/Veridiff/blob/main/README.md",
      "stars": 8,
      "targets": [
        "binary"
      ],
      "topics": [
        "anti-cheat",
        "binary-diffing",
        "control-flow-analysis",
        "ctf",
        "deobfuscation",
        "dynamic-analysis",
        "dynamic-instrumentation",
        "frida",
        "instrumentation",
        "malware-analysis",
        "ollvm",
        "python",
        "reverse-engineering",
        "rust",
        "security-research"
      ],
      "url": "https://github.com/Veridiff/Veridiff",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Browse, scan, modify, custom by frida",
      "description_language": "bilingual",
      "description_zh": "通过 Frida 浏览、扫描、修改和定制。",
      "full_name": "Cross2pro/FridaMemoryBrowser",
      "id": "scan-928837833",
      "license": null,
      "observed_at": "2026-10-16T11:54:18.652748Z",
      "pushed_at": "2026-01-28T11:39:09Z",
      "readme_sha256": "681e81bbd66527e7e8d57cec6a98a0a6be2ed508050864186b3bec8a4152027a",
      "readme_url": "https://github.com/Cross2pro/FridaMemoryBrowser/blob/desktop/README.md",
      "stars": 6,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "frida",
        "frida-scripts",
        "ios",
        "reverse-engineering"
      ],
      "url": "https://github.com/Cross2pro/FridaMemoryBrowser",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "A reverse engineering laboratory for iOS applications.",
      "description_language": "bilingual",
      "description_zh": "iOS 应用逆向工程实验室。",
      "full_name": "juliangrtz/iOS-re-lab",
      "id": "scan-1065004017",
      "license": "MIT",
      "observed_at": "2026-10-16T11:54:19.710178Z",
      "pushed_at": "2026-01-22T23:42:26Z",
      "readme_sha256": "9c854da29a586a482c5ee4f4499392d48f5a73895f29e8ee47bf4040fcd7960f",
      "readme_url": "https://github.com/juliangrtz/iOS-re-lab/blob/main/README.md",
      "stars": 6,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "anti-debugging",
        "anti-reverse-engineering",
        "capstone",
        "frida",
        "ios",
        "ios-security",
        "jailbreak-detection",
        "jailbreak-detection-bypass",
        "lief",
        "reverse-engineering",
        "yara"
      ],
      "url": "https://github.com/juliangrtz/iOS-re-lab",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Personal reverse engineering toolbox with custom tools, scripts, and malware analysis notes.",
      "description_language": "bilingual",
      "description_zh": "个人逆向工程工具箱，包含自定义工具、脚本和恶意软件分析笔记。",
      "full_name": "iss4cf0ng/issac-reverse-toolbox",
      "id": "scan-1188498129",
      "license": "MIT",
      "observed_at": "2026-10-16T01:37:20.167243Z",
      "pushed_at": "2026-04-14T18:31:42Z",
      "readme_sha256": "9064955b20672803a7f65050c9724cca95e3d6831bfc48d222508d010ba8a8a4",
      "readme_url": "https://github.com/iss4cf0ng/issac-reverse-toolbox/blob/main/README.md",
      "stars": 5,
      "targets": [
        "binary"
      ],
      "topics": [
        "collection",
        "collections",
        "debugger",
        "decompiler",
        "packer",
        "reverse-engineering",
        "reverse-engineering-tools",
        "toolb",
        "tools",
        "unpacker"
      ],
      "url": "https://github.com/iss4cf0ng/issac-reverse-toolbox",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Loonaro - Automated Malware Analysis",
      "description_language": "bilingual",
      "description_zh": "Loonaro：自动化恶意软件分析。",
      "full_name": "Loonaro/loonaro-sandbox",
      "id": "scan-1087471967",
      "license": null,
      "observed_at": "2026-10-18T14:36:56.958474Z",
      "pushed_at": "2025-12-22T02:58:23Z",
      "readme_sha256": "a865c199ea2e3816525dffdebf8aac087321cefb7b16610e43f8fbed33445795",
      "readme_url": "https://github.com/Loonaro/loonaro-sandbox/blob/f95a0b9941913048279f4fcaec6f6cfbb27a4547/README.md",
      "stars": 5,
      "targets": [
        "binary"
      ],
      "topics": [
        "blue-team",
        "cybersecurity",
        "dfir",
        "dll-injection",
        "dynamic-analysis",
        "edr",
        "etw",
        "malware-analysis",
        "memory-forensics",
        "process-monitoring",
        "reverse-engineering",
        "rust",
        "sandbox",
        "security-tools",
        "threat-detection",
        "windows",
        "windows-internals"
      ],
      "url": "https://github.com/Loonaro/loonaro-sandbox",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Driver-backed Windows kernel interface for VAD-tree inspection/manipulation, PTE relinking, and cross-process memory operations, with runtime symbol resolution from ntoskrnl's PDB.",
      "description_language": "bilingual",
      "description_zh": "由驱动支持的 Windows 内核接口，用于 VAD 树检查与修改、PTE 重链接及跨进程内存操作，并从 ntoskrnl 的 PDB 在运行时解析符号。",
      "full_name": "vitri0l/NewWorldInterface",
      "id": "scan-1267397805",
      "license": "MIT",
      "observed_at": "2026-10-18T14:36:56.959664Z",
      "pushed_at": "2026-06-21T17:55:30Z",
      "readme_sha256": "5b2bc0a0b60cbf1f5c55d5dd35d585635ebfd5c414485e92e360ae943c385326",
      "readme_url": "https://github.com/vitri0l/NewWorldInterface/blob/4d0b412e8ffca7bf38b9a78fdbfe68da57f9ef24/README.md",
      "stars": 5,
      "targets": [
        "binary"
      ],
      "topics": [
        "cpp",
        "dbghelp",
        "ipc",
        "kernel-driver",
        "memory-forensics",
        "ntoskrnlexe",
        "pdb-symbols",
        "pte",
        "red-team",
        "reverse-engineering",
        "shared-memory",
        "vad",
        "windows-internals",
        "windows-kernel",
        "windows-security"
      ],
      "url": "https://github.com/vitri0l/NewWorldInterface",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Reverse engineering the Black Energy Driver ",
      "description_language": "bilingual",
      "description_zh": "对 Black Energy 驱动进行逆向工程。",
      "full_name": "AvivShabtay/BlackEnergyDriver",
      "id": "scan-307779068",
      "license": null,
      "observed_at": "2026-10-18T14:37:03.380307Z",
      "pushed_at": "2020-10-27T17:39:57Z",
      "readme_sha256": "bebef374a77305f43dd3ed46412dbd9d848d26d2e46464fd716828c47cbb0ecb",
      "readme_url": "https://github.com/AvivShabtay/BlackEnergyDriver/blob/5ab529f56f2b37c112d822dc6bd377f68f8d596e/README.md",
      "stars": 4,
      "targets": [
        "binary"
      ],
      "topics": [
        "iat",
        "ida-pro",
        "memory-forensics",
        "reverse-engineering",
        "volatility",
        "windows-driver"
      ],
      "url": "https://github.com/AvivShabtay/BlackEnergyDriver",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Modern C++17 wrapper for MemProcFS/VMMDLL with structured DMA memory APIs, process introspection, scanning, input support, and hardware-free tests.",
      "description_language": "bilingual",
      "description_zh": "MemProcFS／VMMDLL 的现代 C++17 封装，提供结构化 DMA 内存 API、进程内省、扫描、输入支持及无需硬件的测试。",
      "full_name": "chase-irql/StrataDMA",
      "id": "scan-1162137041",
      "license": "AGPL-3.0",
      "observed_at": "2026-10-18T14:37:03.376322Z",
      "pushed_at": "2026-10-16T19:02:19Z",
      "readme_sha256": "c210b5c1b70d87f1cc913633e963c5d31689cb56a8d90a894c3521a91c50af31",
      "readme_url": "https://github.com/chase-irql/StrataDMA/blob/0f784b5ce6bd96b5638fef6d26af037a80bc3688/README.md",
      "stars": 4,
      "targets": [
        "binary"
      ],
      "topics": [
        "cpp",
        "cpp17",
        "dma",
        "memory-forensics",
        "memprocfs",
        "reverse-engineering",
        "vmmdll",
        "windows"
      ],
      "url": "https://github.com/chase-irql/StrataDMA",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Expert reverse engineer specializing in binary analysis, malware research, and low-level system internals. Experienced in dissecting complex software, uncovering vulnerabilities, and understanding code beyond source-level abstraction",
      "description_language": "bilingual",
      "description_zh": "专注于二进制分析、恶意软件研究和底层系统内部机制的逆向工程专家，擅长剖析复杂软件、发现漏洞，并超越源代码抽象理解程序。",
      "full_name": "hackThacker/awesome-reverse-engineering",
      "id": "scan-1224817081",
      "license": "Apache-2.0",
      "observed_at": "2026-10-16T01:37:20.500708Z",
      "pushed_at": "2026-05-10T02:00:08Z",
      "readme_sha256": "96235e1eeee9eeb7666901c426a6cff9ae030ed7b34705ab8ec05a25d2896b5e",
      "readme_url": "https://github.com/hackThacker/awesome-reverse-engineering/blob/main/README.md",
      "stars": 4,
      "targets": [
        "binary"
      ],
      "topics": [
        "assembly-x86",
        "binary-analysis",
        "deobfuscation",
        "dynamic-analysis",
        "frida",
        "obfuscation",
        "reverse-engineering",
        "reverse-engineering-tools",
        "static-analysis",
        "x64dbg"
      ],
      "url": "https://github.com/hackThacker/awesome-reverse-engineering",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Generate layered Frida TLS testing agents from Flutter engine binaries.",
      "description_language": "bilingual",
      "description_zh": "从 Flutter 引擎二进制生成分层的 Frida TLS 测试代理。",
      "full_name": "ahmedMhesham12/flutter-tls-frida-generator",
      "id": "scan-1300588133",
      "license": "MIT",
      "observed_at": "2026-10-16T10:48:05.175333Z",
      "pushed_at": "2026-07-14T14:24:28Z",
      "readme_sha256": "dc3f1ccbc3ccaf27dc409c28bb88d29f3d1b164c84e554d1a2a6d351574a54b8",
      "readme_url": "https://github.com/ahmedMhesham12/flutter-tls-frida-generator/blob/main/README.md",
      "stars": 3,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "flutter",
        "frida",
        "mobile-security",
        "reverse-engineering",
        "security-testing",
        "tls"
      ],
      "url": "https://github.com/ahmedMhesham12/flutter-tls-frida-generator",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Defensive C++20 library for runtime memory integrity, hook detection, and anti-tamper monitoring on Windows/Linux",
      "description_language": "bilingual",
      "description_zh": "防御性 C++20 库，用于 Windows／Linux 上的运行时内存完整性、钩子检测及防篡改监控。",
      "full_name": "gabryxdev/RuntimeMemoryGuardian",
      "id": "scan-1302781080",
      "license": "MIT",
      "observed_at": "2026-10-18T14:37:03.386823Z",
      "pushed_at": "2026-08-23T11:16:28Z",
      "readme_sha256": "fd0e6f03432037e4a57e2fe03f0c11ba71568504c8c22d2df0773be612cf82df",
      "readme_url": "https://github.com/gabryxdev/RuntimeMemoryGuardian/blob/4d699a2eb0679754547d4a193e7ca72e1320ae22/README.md",
      "stars": 3,
      "targets": [
        "binary"
      ],
      "topics": [
        "anti-cheat-safe",
        "anti-tamper",
        "cmake",
        "cpp",
        "cpp20",
        "cybersecurity",
        "defensive-security",
        "dll-injection",
        "hook-detection",
        "infosec",
        "integrity-checker",
        "linux",
        "malware-detection",
        "memory-forensics",
        "memory-safety",
        "process-monitoring",
        "reverse-engineering",
        "runtime-security",
        "security",
        "windows"
      ],
      "url": "https://github.com/gabryxdev/RuntimeMemoryGuardian",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "🛡️ Mobile-first Interactive Disassembler & Decompiler Framework — IDA Pro / Ghidra-class RE on Android. APK · ELF · PE · DEX · ARM64 · x86-64 · IR decompiler · call graph · ptrace debugger · SakoScript plugins. Created by Maxamed Xasan Muse 🇸🇴",
      "description_language": "bilingual",
      "description_zh": "🛡️ 移动优先的交互式反汇编与反编译框架，在 Android 上提供 IDA Pro/Ghidra 级逆向工程能力。支持 APK、ELF、PE、DEX、ARM64、x86-64、IR 反编译器、调用图、ptrace 调试器和 SakoScript 插件，由 Maxamed Xasan Muse 创建。🇸🇴",
      "full_name": "Maxamedxasa/SakoREStudio",
      "id": "scan-1355825589",
      "license": "MIT",
      "observed_at": "2026-10-16T01:36:32.841846Z",
      "pushed_at": "2026-09-03T11:38:43Z",
      "readme_sha256": "a184c8a1cca66b1665d067c30195ba616032e3d27ec7ab8f5ca8b554d57c58c1",
      "readme_url": "https://github.com/Maxamedxasa/SakoREStudio/blob/main/README.md",
      "stars": 3,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "android",
        "android-security",
        "apk-analysis",
        "binary-analysis",
        "call-graph",
        "capstone",
        "debugger",
        "decompiler",
        "disassembler",
        "ghidra",
        "ghidra-mobile",
        "ida-pro",
        "ida-pro-alternative",
        "jetpack-compose",
        "malware-analysis",
        "mobile-security",
        "reverse-engineering",
        "sako",
        "security-tools",
        "somalia"
      ],
      "url": "https://github.com/Maxamedxasa/SakoREStudio",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "A deterministic memory-mapping and database forensic suite engineered to audit client-side data leakage and bypass ephemeral privacy controls via SQLite Write-Ahead Logs (.db-wal).",
      "description_language": "bilingual",
      "description_zh": "确定性的内存映射与数据库取证套件，用于审计客户端数据泄露，并通过 SQLite 预写日志（.db-wal）绕过临时性隐私控制。",
      "full_name": "rahimgujjar/WhatsApp-WAL-XRay",
      "id": "scan-1297312885",
      "license": null,
      "observed_at": "2026-10-18T14:37:03.389130Z",
      "pushed_at": "2026-07-19T18:10:42Z",
      "readme_sha256": "f37c7d0256680e9d3bf4315c4d145ebcdea35120652899d9456ebb30e4ec68fc",
      "readme_url": "https://github.com/rahimgujjar/WhatsApp-WAL-XRay/blob/533290efb403cd30256cbaef008805bc9d5601b2/README.md",
      "stars": 3,
      "targets": [
        "binary"
      ],
      "topics": [
        "cybersecurity",
        "digital-forensics",
        "memory-forensics",
        "python",
        "reverse-engineering",
        "sqlite-wal",
        "threat-intelligence",
        "uwp-framework",
        "vulnerability-research",
        "wal",
        "whatsapp",
        "whatsapp-web",
        "write-ahead-logging"
      ],
      "url": "https://github.com/rahimgujjar/WhatsApp-WAL-XRay",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Offset Zero: A free, open-source field guide to digital forensics, reverse engineering, and detection engineering. Start at the first byte. YEAHH, ITS MORE OF A MINDSET!",
      "description_language": "bilingual",
      "description_zh": "Offset Zero：免费开源的数字取证、逆向工程和检测工程实战指南。从第一个字节开始——这更是一种思维方式！",
      "full_name": "13shivam/offset-zero",
      "id": "scan-1341073482",
      "license": null,
      "observed_at": "2026-10-16T01:37:21.765872Z",
      "pushed_at": "2026-09-02T12:28:44Z",
      "readme_sha256": "255ba5d5d1e6809f50b3e4636021e77855ae684db26fddca39de7a6c502883f4",
      "readme_url": "https://github.com/13shivam/offset-zero/blob/main/README.md",
      "stars": 2,
      "targets": [
        "binary"
      ],
      "topics": [
        "blue-team",
        "cloud-security",
        "cybersecurity",
        "detection-engineering",
        "dfir",
        "digital-forensics",
        "incident-response",
        "lore",
        "malware-analysis",
        "memory-forensics",
        "philosophy",
        "pirate-mindset",
        "reverse-engineering",
        "reverse-engineering-tools",
        "security-education",
        "steganography",
        "threat-hunting",
        "threat-intelligence",
        "volatility",
        "yara"
      ],
      "url": "https://github.com/13shivam/offset-zero",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Reproducible Apple security research environments for macOS, iOS and iPadOS.",
      "description_language": "bilingual",
      "description_zh": "面向 macOS、iOS 和 iPadOS 的可复现 Apple 安全研究环境。",
      "full_name": "AlexGRDev/apple-seclab",
      "id": "scan-1232820837",
      "license": "MIT",
      "observed_at": "2026-10-16T11:54:23.478186Z",
      "pushed_at": "2026-09-21T12:51:42Z",
      "readme_sha256": "d30dbeec27c9d52956e95663a9f67e648dee136265840da0a9900330d47cf822",
      "readme_url": "https://github.com/AlexGRDev/apple-seclab/blob/main/README.md",
      "stars": 2,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "apple-security",
        "apple-silicon",
        "arm64",
        "frida",
        "ghidra",
        "ios",
        "ipados",
        "lldb",
        "macho",
        "macos",
        "reverse-engineering",
        "sandbox",
        "security-research",
        "tcc",
        "xnu"
      ],
      "url": "https://github.com/AlexGRDev/apple-seclab",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "MCP server for reverse engineering — 77 semantic operations: static triage, unpacking, decompilation (Ghidra/IDA), dynamic instrumentation (frida/TTD), emulation (Unicorn), symbolic execution (angr), evidence handling. Works with any MCP-compatible agent host.",
      "description_language": "bilingual",
      "description_zh": "逆向工程 MCP 服务器，提供 77 项语义操作：静态初筛、解包、反编译（Ghidra／IDA）、动态插桩（frida／TTD）、模拟（Unicorn）、符号执行（angr）及证据处理。可用于任何兼容 MCP 的智能体宿主。",
      "full_name": "Ashibalt/minusOne-mcp-reverse",
      "id": "scan-1349428351",
      "license": "MIT",
      "observed_at": "2026-10-18T14:36:25.626071Z",
      "pushed_at": "2026-09-06T07:53:34Z",
      "readme_sha256": "a2d0e6d872b43df5aaea1a8bd442ecc61a73faa43ca845543714aded18889829",
      "readme_url": "https://github.com/Ashibalt/minusOne-mcp-reverse/blob/b6bb4394f20aaed36b9cfb7646fffc6d98962af2/README.md",
      "stars": 2,
      "targets": [
        "binary"
      ],
      "topics": [
        "agent-tools",
        "angr",
        "binary-analysis",
        "decompiler",
        "frida",
        "ghidra",
        "ida-pro-ai",
        "llm-tools",
        "malware-analysis",
        "mcp",
        "model-context-protocol",
        "reverse-engineering",
        "unicorn",
        "unpacking"
      ],
      "url": "https://github.com/Ashibalt/minusOne-mcp-reverse",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "An Electron-based AI workbench for CTF reverse-engineering challenges on Windows. It combines an AI tool loop with local validation, connects to IDA, JEB, and Burp through MCP, and automatically tackles APK, PE, ELF, PYC, DEX, JAR, Mach-O, Lua, and Web-JS challenges. Includes 11 methodology skills, a 54-page structured knowledge base, and self-improvement from experience.",
      "description_language": "bilingual",
      "description_zh": "基于 Electron、面向 Windows 的 CTF 逆向 AI 解题工作台，结合 AI 工具循环与本地验证闭环，通过 MCP 接入 IDA、JEB 和 Burp，自动求解 APK、PE、ELF、PYC、DEX、JAR、Mach-O、Lua 和 Web-JS，内置 11 个方法论技能、54 页结构化知识库及经验自进化机制。",
      "full_name": "ip2867/ctf-re-tool",
      "id": "scan-1411934395",
      "license": "MIT",
      "observed_at": "2026-10-16T07:14:58.419135Z",
      "pushed_at": "2026-10-15T10:46:44Z",
      "readme_sha256": "21c99dc3e202734df0dc7426e3c1168d034c96661e28f9cd474e0093e9197624",
      "readme_url": "https://github.com/ip2867/ctf-re-tool/blob/main/README.md",
      "stars": 2,
      "targets": [
        "app",
        "binary",
        "firmware",
        "website"
      ],
      "topics": [
        "ai-agent",
        "android",
        "apk",
        "burp-suite",
        "ctf",
        "electron",
        "firmware",
        "frida",
        "ida-pro",
        "jeb",
        "llm",
        "mcp",
        "reverse-engineering"
      ],
      "url": "https://github.com/ip2867/ctf-re-tool",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Deterministic binary analysis, runtime instrumentation & protocol reverse-engineering skill for AI coding agents.",
      "description_language": "bilingual",
      "description_zh": "面向 AI 编码智能体的确定性二进制分析、运行时插桩和协议逆向工程技能。",
      "full_name": "PyModel/reverse-engineering-skill",
      "id": "scan-1355086611",
      "license": "MIT",
      "observed_at": "2026-10-16T01:36:57.269886Z",
      "pushed_at": "2026-09-02T18:24:19Z",
      "readme_sha256": "e68fca0cbfcc6c6275821ebad6639ec0897d4229402b5aeb432258c24e3bd74a",
      "readme_url": "https://github.com/PyModel/reverse-engineering-skill/blob/main/README.md",
      "stars": 2,
      "targets": [
        "binary"
      ],
      "topics": [
        "agent-skill",
        "antigravity",
        "binary-analysis",
        "clean-room",
        "elf",
        "frida",
        "ghidra",
        "golang",
        "mach-o",
        "pe",
        "protocol-analysis",
        "reverse-engineering",
        "rust",
        "wasm"
      ],
      "url": "https://github.com/PyModel/reverse-engineering-skill",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Give your reverse-engineering agent a memory, a map, and receipts.",
      "description_language": "bilingual",
      "description_zh": "为逆向工程智能体提供记忆、地图和证据记录。",
      "full_name": "siaginw/HexWitness",
      "id": "scan-1331477857",
      "license": "NOASSERTION",
      "observed_at": "2026-10-16T01:37:21.329926Z",
      "pushed_at": "2026-10-01T19:08:26Z",
      "readme_sha256": "05c708bf79e83d84d0cc0df160b3dd6a8ff492214cda483530be8d49f9347945",
      "readme_url": "https://github.com/siaginw/HexWitness/blob/main/README.md",
      "stars": 2,
      "targets": [
        "binary"
      ],
      "topics": [
        "agent-memory",
        "ai-agents",
        "ai-memory",
        "binary-analysis",
        "binary-instrumentation",
        "binary-ninja",
        "decompiler",
        "developer-tools",
        "dynamic-analysis",
        "evidence-graph",
        "frida",
        "ghidra",
        "ida",
        "knowledge-graph",
        "mcp",
        "mcp-server",
        "reverse-engineering",
        "reverse-engineering-tools",
        "sqlite",
        "static-analysis"
      ],
      "url": "https://github.com/siaginw/HexWitness",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Reverse engineer APKs and analyze native binaries directly on your Android device without a PC or ADB.",
      "description_language": "bilingual",
      "description_zh": "直接在 Android 设备上逆向分析 APK 和原生二进制文件，无需 PC 或 ADB。",
      "full_name": "Acousticdevicemercouri734/androidReverse",
      "id": "scan-1277601990",
      "license": null,
      "observed_at": "2026-10-16T01:36:29.854482Z",
      "pushed_at": "2026-10-14T07:26:38Z",
      "readme_sha256": "96510eec23f083b18ea29238d028259d01bf49cc94ff6ceabf33cae71762e9d2",
      "readme_url": "https://github.com/Acousticdevicemercouri734/androidReverse/blob/main/README.md",
      "stars": 1,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "android",
        "android-reverse",
        "android-reverse-engineering",
        "androidide",
        "arm64",
        "bytecode",
        "ctf",
        "decompiler",
        "frida",
        "ghidra",
        "kotlin-android",
        "radare2",
        "reverse",
        "reverse-engineering",
        "reverse-shell",
        "smali",
        "static-analysis",
        "tunnel"
      ],
      "url": "https://github.com/Acousticdevicemercouri734/androidReverse",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Inspect, analyze, and debug JavaScript bundles from webpack, rspack, rollup, esbuild, and Vite.",
      "description_language": "bilingual",
      "description_zh": "检查、分析和调试由 webpack、rspack、rollup、esbuild 与 Vite 生成的 JavaScript 包。",
      "full_name": "awareride/packscope",
      "id": "scan-1303466171",
      "license": "MIT",
      "observed_at": "2026-10-16T10:48:10.622153Z",
      "pushed_at": "2026-09-22T03:13:06Z",
      "readme_sha256": "6c21af7d02879bd44a6a3542374ff07956220b4d36f184be994708f4234ebca8",
      "readme_url": "https://github.com/awareride/packscope/blob/main/README.md",
      "stars": 1,
      "targets": [
        "binary"
      ],
      "topics": [
        "bundle",
        "cli",
        "debugger",
        "esbuild",
        "javascript",
        "mono-bundle",
        "reverse-engineering",
        "rollup",
        "rspack",
        "vite",
        "webpack"
      ],
      "url": "https://github.com/awareride/packscope",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Give a coding agent evidence, not screenshots: local workbench to reverse Android, iOS, desktop and web protocol clients with JADX, radare2, ADB, Frida and live HTTP probes.",
      "description_language": "bilingual",
      "description_zh": "为编码智能体提供证据而非截图：本地工作台，使用 JADX、radare2、ADB、Frida 和实时 HTTP 探测，逆向分析 Android、iOS、桌面端及 Web 协议客户端。",
      "full_name": "hanphanr1/Forge",
      "id": "scan-1404631911",
      "license": "MIT",
      "observed_at": "2026-10-16T01:36:58.556136Z",
      "pushed_at": "2026-10-15T15:57:21Z",
      "readme_sha256": "aef4c0952830fea0c5639986290f4909f19308fc87600a10cae0e3030069b147",
      "readme_url": "https://github.com/hanphanr1/Forge/blob/main/README.md",
      "stars": 1,
      "targets": [
        "app",
        "binary",
        "website"
      ],
      "topics": [
        "adb",
        "ai-agents",
        "android",
        "apk",
        "developer-tools",
        "frida",
        "har",
        "http-client",
        "ios",
        "jadx",
        "mobile-security",
        "protocol-analysis",
        "python",
        "radare2",
        "reverse-engineering",
        "security-tools"
      ],
      "url": "https://github.com/hanphanr1/Forge",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "A set of Frida scripts to help inspect Firebase calls in Flutter apps on iOS",
      "description_language": "bilingual",
      "description_zh": "一组 Frida 脚本，用于检查 iOS 上 Flutter 应用中的 Firebase 调用。",
      "full_name": "joshrad-dev/frida-flutterfire",
      "id": "scan-1245064219",
      "license": "MIT",
      "observed_at": "2026-10-16T10:48:06.223473Z",
      "pushed_at": "2026-05-24T01:37:17Z",
      "readme_sha256": "ad3d884fec9e07b4bc4fcba76c64ddf86c91d15de3e585eb887ed6f9114c6166",
      "readme_url": "https://github.com/joshrad-dev/frida-flutterfire/blob/main/README.md",
      "stars": 1,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "firebase",
        "flutter",
        "frida",
        "reverse-engineering"
      ],
      "url": "https://github.com/joshrad-dev/frida-flutterfire",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Interactive x86 & x86-64 assembly simulator and reverse-engineering lab — step-through 32/64-bit engines, stack playground, register quiz, 28 tutorials, and 7 tools. Pure browser, no build, no dependencies.",
      "description_language": "bilingual",
      "description_zh": "交互式 x86 与 x86-64 汇编模拟器和逆向工程实验室：32/64 位引擎单步执行、栈实验区、寄存器测验、28 篇教程及 7 个工具。纯浏览器运行，无需构建，无依赖。",
      "full_name": "Real-Fruit-Snacks/x86-x64-assembly-lab",
      "id": "scan-1209926798",
      "license": "MIT",
      "observed_at": "2026-10-16T10:48:08.864178Z",
      "pushed_at": "2026-07-12T23:43:41Z",
      "readme_sha256": "91c6acd8032df745da6fa2b74434e12bcce2e7b5dca98f13a1f03ffe4c3200f9",
      "readme_url": "https://github.com/Real-Fruit-Snacks/x86-x64-assembly-lab/blob/main/README.md",
      "stars": 1,
      "targets": [
        "binary",
        "website"
      ],
      "topics": [
        "asm",
        "assembly",
        "browser-based",
        "ctf",
        "debugger",
        "disassembly",
        "education",
        "emulator",
        "interactive",
        "javascript",
        "learning-tool",
        "reverse-engineering",
        "simulator",
        "stack-visualization",
        "teaching-tool",
        "tutorial",
        "x64",
        "x86",
        "x86-64",
        "x86-assembly"
      ],
      "url": "https://github.com/Real-Fruit-Snacks/x86-x64-assembly-lab",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "An AI-assisted, multi-platform reverse engineering workbench integrating Ghidra, Frida, and MCP. Features zero-dependency triage for APK/ELF/PE, entropy-based packer detection, and strict default-deny authorization for secure, reproducible analysis.",
      "description_language": "bilingual",
      "description_zh": "AI 辅助多平台逆向工程工作台，集成 Ghidra、Frida 和 MCP。提供 APK/ELF/PE 零依赖初步分析、基于熵的加壳检测，以及严格默认拒绝的授权机制，以支持安全、可复现的分析。",
      "full_name": "BattlePriestBarbara/Revlab",
      "id": "scan-1413344188",
      "license": "MIT",
      "observed_at": "2026-10-16T01:36:36.570969Z",
      "pushed_at": "2026-10-10T15:28:23Z",
      "readme_sha256": "c59bf4a784dedebd05d5793c5bb83e7c552b36bd88b7518e4ea2cfbf4da23ef0",
      "readme_url": "https://github.com/BattlePriestBarbara/Revlab/blob/main/README.md",
      "stars": 0,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "ai-assisted",
        "android-security",
        "apk-analysis",
        "binary-analysis",
        "cybersecurity",
        "entropy-analysis",
        "frida",
        "ghidra",
        "mcp",
        "reverse-engineering",
        "windows-pe"
      ],
      "url": "https://github.com/BattlePriestBarbara/Revlab",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Open-source Android security auditing and ethical hacking toolkit for authorized ADB inspection, APK analysis, reverse engineering,  network test Ethical Hacker Toolkit for Android security auditing, reverse engineering, dynamic analysis, network inspection, and APK analysis using ADB, JADX, Apktool, Ghidra, Frida, MobSF and TShark.",
      "description_language": "bilingual",
      "description_zh": "开源 Android 安全审计与道德黑客工具包，用于授权 ADB 检查、APK 分析、逆向工程、动态分析和网络检查，使用 ADB、JADX、Apktool、Ghidra、Frida、MobSF 和 TShark。",
      "full_name": "Msr7799/Android-Deep-Analysis-Lab",
      "id": "scan-1341479421",
      "license": "MIT",
      "observed_at": "2026-10-16T01:37:35.635454Z",
      "pushed_at": "2026-08-21T06:52:29Z",
      "readme_sha256": "05fdf9eb7721358e8671b3b3863dd6ce7597d9915d5e90a8112eaa9238bde43b",
      "readme_url": "https://github.com/Msr7799/Android-Deep-Analysis-Lab/blob/main/README.md",
      "stars": 0,
      "targets": [
        "app",
        "binary"
      ],
      "topics": [
        "adb",
        "android",
        "android-security",
        "apk-analysis-",
        "apktool",
        "cybersecurity",
        "ethical-hacking-tools",
        "frida",
        "ghidra",
        "ghidra-analyzer",
        "hacking",
        "hacking-tools",
        "jadx",
        "mobile-security",
        "mobsf",
        "network-security",
        "penetration-testing",
        "python",
        "reverse-engineering",
        "wireshark"
      ],
      "url": "https://github.com/Msr7799/Android-Deep-Analysis-Lab",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "Automated firmware analysis framework combining recursive extraction, Ghidra-based static analysis, and dynamic binary instrumentation to detect cryptographic primitives and hardcoded secrets in stripped binaries",
      "description_language": "bilingual",
      "description_zh": "自动化固件分析框架，结合递归提取、基于 Ghidra 的静态分析及动态二进制插桩，检测去符号二进制中的密码学原语及硬编码秘密信息。",
      "full_name": "Prajwal-kp-18/crypto-firmware-detector",
      "id": "scan-1116970730",
      "license": null,
      "observed_at": "2026-10-18T14:36:05.235770Z",
      "pushed_at": "2025-12-30T15:08:17Z",
      "readme_sha256": "152b31b34b0994592bf2a5b1f0bb5453b0c435ece6ca8f6a04e01cd7917e18c6",
      "readme_url": "https://github.com/Prajwal-kp-18/crypto-firmware-detector/blob/4be46292191203a477ecb43a397e8cbfaa426320/README.md",
      "stars": 0,
      "targets": [
        "binary",
        "firmware"
      ],
      "topics": [
        "binary-analysis",
        "binwalk",
        "dynamic-analysis",
        "gnn-model",
        "reverse-engineering",
        "static-analysis"
      ],
      "url": "https://github.com/Prajwal-kp-18/crypto-firmware-detector",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "One-click Windows modkit with stable sandbox/bin paths for the current Ghidra, Unity, Unreal and reverse-engineering tools an agent should call.",
      "description_language": "bilingual",
      "description_zh": "一键式 Windows 模组工具包，为智能体应调用的现有 Ghidra、Unity、Unreal 和逆向工程工具提供稳定的 sandbox/bin 路径。",
      "full_name": "SenjuWoo/reverse-this",
      "id": "scan-1413732654",
      "license": "MIT",
      "observed_at": "2026-10-16T10:47:44.606573Z",
      "pushed_at": "2026-10-11T23:24:42Z",
      "readme_sha256": "b747691c41f2b1ebb92d428d4f4dfdeb106c8a1dfb787d5fd4f8eb853bfe31c4",
      "readme_url": "https://github.com/SenjuWoo/reverse-this/blob/main/README.md",
      "stars": 0,
      "targets": [
        "binary",
        "game"
      ],
      "topics": [
        "ai-agents",
        "binary-analysis",
        "claude",
        "frida",
        "game-modding",
        "ghidra",
        "il2cpp",
        "mcp",
        "modding-tools",
        "modkit",
        "renderdoc",
        "reverse-engineering",
        "sandbox",
        "unity",
        "unreal-engine"
      ],
      "url": "https://github.com/SenjuWoo/reverse-this",
      "verification": "automated-readme-scan"
    },
    {
      "category": "dynamic-analysis",
      "description_en": "A Windows PE runtime for Linux: native guest execution, in-process debugging, offline de-virtualization. No Wine, no emulator.",
      "description_language": "bilingual",
      "description_zh": "在 Linux 上运行 Windows PE 的运行时：原生执行来宾代码、进程内调试及离线去虚拟化。不使用 Wine 或模拟器。",
      "full_name": "yuw868349-commits/occ",
      "id": "scan-1403363659",
      "license": null,
      "observed_at": "2026-10-18T14:36:25.632359Z",
      "pushed_at": "2026-10-18T12:01:31Z",
      "readme_sha256": "9447ec4fa56f87b5657c0b0504757eca443916710ed619981bfb13ee7b51bde6",
      "readme_url": "https://github.com/yuw868349-commits/occ/blob/5e0748e80866b4198db8b44dfa898cec2b107c03/README.md",
      "stars": 0,
      "targets": [
        "binary"
      ],
      "topics": [
        "binary-analysis",
        "cpp23",
        "debugger",
        "devirtualization",
        "linux",
        "malware-analysis",
        "pe-loader",
        "portable-executable",
        "reverse-engineering",
        "runtime",
        "seccomp",
        "unpacking",
        "windows",
        "x86-64"
      ],
      "url": "https://github.com/yuw868349-commits/occ",
      "verification": "automated-readme-scan"
    }
  ],
  "snapshot": "2026-10-20",
  "verification": "automated-readme-scan",
  "version": 1
}