# Runtime and debugging

> Browse 152 repositories with project descriptions, upstream links, and license information.

Automatically discovered repository index, unreviewed. Stars, licenses and last-push times are collection-time snapshots.
Selection published: 2026-10-20 UTC

- HTML: <https://awesomerea.org/browse/dynamic-analysis/>
- JSON: <https://awesomerea.org/browse/dynamic-analysis/index.json>
- 简体中文: <https://awesomerea.org/zh/browse/dynamic-analysis/index.md>

- [x64dbg/x64dbg](https://github.com/x64dbg/x64dbg): 49,888 stars · last push 2026-10 · An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.
- [frida/frida](https://github.com/frida/frida): 22,317 stars · last push 2026-10 · Main repo for hosting release binaries
- [pwndbg/pwndbg](https://github.com/pwndbg/pwndbg): 11,064 stars · MIT · last push 2026-10 · Exploit Development and Reverse Engineering with GDB & LLDB Made Easy
- [rr-debugger/rr](https://github.com/rr-debugger/rr): 10,707 stars · last push 2026-10 · Record and Replay Framework
- [hugsy/gef](https://github.com/hugsy/gef): 8,399 stars · MIT · last push 2026-08 · GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux
- [AloneMonkey/MonkeyDev](https://github.com/AloneMonkey/MonkeyDev): 6,800 stars · GPL-3.0 · last push 2022-07 · Patch iOS apps without jailbreaking using CaptainHook Tweak, Logos Tweak, and command-line tools.
- [qilingframework/qiling](https://github.com/qilingframework/qiling): 6,139 stars · GPL-2.0 · last push 2026-09 · A True Instrumentable Binary Emulation Framework
- [HyperDbg/HyperDbg](https://github.com/HyperDbg/HyperDbg): 4,133 stars · GPL-3.0 · last push 2026-10 · State-of-the-art native debugging tools
- [kevoreilly/CAPEv2](https://github.com/kevoreilly/CAPEv2): 3,570 stars · last push 2026-10 · Malware Configuration And Payload Extraction
- [DynamoRIO/dynamorio](https://github.com/DynamoRIO/dynamorio): 3,181 stars · last push 2026-10 · Dynamic Instrumentation Tool Platform
- [korcankaraokcu/PINCE](https://github.com/korcankaraokcu/PINCE): 3,124 stars · last push 2026-09 · Reverse engineering tool for Linux
- [m0bilesecurity/RMS-Runtime-Mobile-Security](https://github.com/m0bilesecurity/RMS-Runtime-Mobile-Security): 3,111 stars · GPL-3.0 · last push 2026-10 · Runtime Mobile Security (RMS) 📱🔥 - is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime
- [duty1g/x64dbg-mcp-server](https://github.com/duty1g/x64dbg-mcp-server): 2,514 stars · MIT · last push 2026-10 · x64dbg-MCP Server is a native MCP (Model Context Protocol) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Connect any MCP-compatible AI assistant and control x64dbg programmatically: set breakpoints, step through code, read memory, dump registers, and more. Built with Zig — zero dependencies, single-binary output, cros
- [bootleg/ret-sync](https://github.com/bootleg/ret-sync): 2,401 stars · GPL-3.0 · last push 2026-02 · ret-sync is a set of plugins that helps to synchronize a debugging session (WinDbg/GDB/LLDB/OllyDbg2/x64dbg) with IDA/Ghidra/Binary Ninja disassemblers.
- [QBDI/QBDI](https://github.com/QBDI/QBDI): 1,828 stars · last push 2026-09 · A Dynamic Binary Instrumentation framework based on LLVM.
- [hasherezade/tiny_tracer](https://github.com/hasherezade/tiny_tracer): 1,711 stars · GPL-2.0 · last push 2026-06 · A Pin Tool for tracing API calls etc
- [0xdea/frida-scripts](https://github.com/0xdea/frida-scripts): 1,672 stars · MIT · last push 2026-08 · A collection of my Frida instrumentation scripts to reverse engineer mobile apps and more.
- [illera88/Ponce](https://github.com/illera88/Ponce): 1,635 stars · last push 2025-06 · IDA 2016 plugin contest winner! Symbolic Execution just one-click away!
- [nowsecure/r2frida](https://github.com/nowsecure/r2frida): 1,450 stars · MIT · last push 2026-10 · Radare2 and Frida better together.
- [darbra/sperm](https://github.com/darbra/sperm): 1,422 stars · GPL-3.0 · last push 2026-04 · A collection of excellent reverse engineering articles I have read, well worth a look.
- [CERT-Polska/drakvuf-sandbox](https://github.com/CERT-Polska/drakvuf-sandbox): 1,355 stars · last push 2026-10 · DRAKVUF Sandbox - automated hypervisor-level malware analysis system
- [ansjdnakjdnajkd/iOS](https://github.com/ansjdnakjdnajkd/iOS): 1,327 stars · Apache-2.0 · last push 2023-11 · Most usable tools for iOS penetration testing
- [iGio90/Dwarf](https://github.com/iGio90/Dwarf): 1,321 stars · GPL-3.0 · last push 2024-05 · Full featured multi arch/os debugger built on top of PyQt5 and frida
- [LING71671/open-reverselab](https://github.com/LING71671/open-reverselab): 1,265 stars · GPL-3.0 · last push 2026-10 · Open-source AI reverse-engineering agent platform and MCP server for Ghidra, Frida, x64dbg and Rizin — automated PE/APK/binary analysis, CTF and malware research, with 100+ MCP tools and a 194-article runnable knowledge base.
- [yazgx97/frida-ios-hook](https://github.com/yazgx97/frida-ios-hook): 1,191 stars · MIT · last push 2026-05 · A tool that helps you easy trace classes, functions, and modify the return values of methods on iOS platform
- [GJDuck/e9patch](https://github.com/GJDuck/e9patch): 1,156 stars · GPL-3.0 · last push 2026-06 · A powerful static binary rewriting tool
- [QQBackup/qq-win-db-key](https://github.com/QQBackup/qq-win-db-key): 1,103 stars · last push 2026-10 · Cross-platform decryption of QQ chat databases
- [frida/frida-gum](https://github.com/frida/frida-gum): 1,032 stars · last push 2026-10 · Cross-platform instrumentation and introspection library written in C
- [JLospinoso/gargoyle](https://github.com/JLospinoso/gargoyle): 916 stars · AGPL-3.0 · last push 2026-05 · Historical Windows temporal memory-state research artifact for studying time-bound memory observations, validation limits, and defensive visibility.
- [dyninst/dyninst](https://github.com/dyninst/dyninst): 838 stars · LGPL-2.1 · last push 2026-10 · DyninstAPI: Tools for binary instrumentation, analysis, and modification.
- [Simp1er/MobileSec](https://github.com/Simp1er/MobileSec): 809 stars · last push 2023-09 · Notes on interesting things I encounter while learning Android reverse engineering.
- [frida/frida-core](https://github.com/frida/frida-core): 782 stars · last push 2026-10 · Frida core library
- [danigargu/deREferencing](https://github.com/danigargu/deREferencing): 775 stars · GPL-3.0 · last push 2026-09 · IDA Pro plugin that implements more user-friendly register and stack views
- [robalb/x86-64-playground](https://github.com/robalb/x86-64-playground): 758 stars · ISC · last push 2026-01 · An online assembly editor, emulator and debugger for the x86-64 architecture
- [ChiChou/vscode-frida](https://github.com/ChiChou/vscode-frida): 592 stars · MIT · last push 2026-09 · Unofficial frida extension for VSCode
- [a1ext/labeless](https://github.com/a1ext/labeless): 587 stars · last push 2026-02 · Labeless is a multipurpose IDA Pro plugin system for labels/comments synchronization with a debugger backend, with complex memory dumping and interactive Python scripting capabilities.
- [wechaty/puppet-xp](https://github.com/wechaty/puppet-xp): 551 stars · Apache-2.0 · last push 2025-07 · Wechaty Puppet WeChat Windows Protocol
- [HynekPetrak/malware-jail](https://github.com/HynekPetrak/malware-jail): 480 stars · MIT · last push 2023-06 · Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js
- [vah13/extractTVpasswords](https://github.com/vah13/extractTVpasswords): 465 stars · last push 2018-07 · tool to extract passwords from TeamViewer memory using Frida
- [ab-rizk/xpcspy](https://github.com/ab-rizk/xpcspy): 452 stars · Apache-2.0 · last push 2026-05 · Bidirectional XPC message interception and more. Powered by Frida
- [Exo1i/MagiskHluda](https://github.com/Exo1i/MagiskHluda): 433 stars · last push 2026-02 · Run a more undetectable frida server on boot using magisk 🔐✅
- [ivan-sincek/ios-penetration-testing-cheat-sheet](https://github.com/ivan-sincek/ios-penetration-testing-cheat-sheet): 425 stars · MIT · last push 2026-02 · Work in progress...
- [hanbinglengyue/FridaManager](https://github.com/hanbinglengyue/FridaManager): 420 stars · last push 2022-03 · A persistence solution for Frida
- [zeropointdynamics/zelos](https://github.com/zeropointdynamics/zelos): 420 stars · AGPL-3.0 · last push 2023-01 · A comprehensive binary emulation and instrumentation platform.
- [paradiseduo/IPAPatch](https://github.com/paradiseduo/IPAPatch): 412 stars · MIT · last push 2025-03 · Patch iOS Apps, The Easy Way, Without Jailbreak.
- [beehive-lab/mambo](https://github.com/beehive-lab/mambo): 400 stars · Apache-2.0 · last push 2025-01 · A low-overhead dynamic binary instrumentation and modification tool for ARM (both AArch32 and AArch64 support) and RISC-V (RV64GC).
- [nowsecure/frida-cycript](https://github.com/nowsecure/frida-cycript): 396 stars · AGPL-3.0 · last push 2023-03 · Cycript fork powered by Frida.
- [FrenchYeti/interruptor](https://github.com/FrenchYeti/interruptor): 360 stars · last push 2026-09 · Human-friendly cross-platform system call tracing and hooking library based on Frida's Stalker
- [deathmemory/fridaRegstNtv](https://github.com/deathmemory/fridaRegstNtv): 353 stars · last push 2023-03 · Use Frida to retrieve functions dynamically registered through JNI RegisterNatives.
- [roger1337/JDBG](https://github.com/roger1337/JDBG): 331 stars · Apache-2.0 · last push 2025-02 · Java Dynamic Reverse Engineering and Debugging Tool
- [Comsecuris/gdbghidra](https://github.com/Comsecuris/gdbghidra): 324 stars · MIT · last push 2019-10 · gdbghidra - a visual bridge between a GDB session and GHIDRA
- [leonjza/frida-boot](https://github.com/leonjza/frida-boot): 320 stars · last push 2023-09 · Frida Boot 👢- A binary instrumentation workshop, with Frida, for beginners!
- [libdebug/libdebug](https://github.com/libdebug/libdebug): 315 stars · last push 2026-09 · A Python library to debug binary executables, your own way.
- [ttdennis/fpicker](https://github.com/ttdennis/fpicker): 298 stars · MIT · last push 2025-07 · fpicker is a Frida-based fuzzing suite supporting various modes (including AFL++ in-process fuzzing)
- [iGio90/frick](https://github.com/iGio90/frick): 296 stars · MIT · last push 2018-12 · frick - aka the first debugger built on top of frida
- [patois/IDACyber](https://github.com/patois/IDACyber): 296 stars · MIT · last push 2022-12 · Data Visualization Plugin for IDA Pro
- [andreafioraldi/IDAngr](https://github.com/andreafioraldi/IDAngr): 286 stars · BSD-2-Clause · last push 2020-07 · Use angr in the IDA Pro debugger generating a state from the current debug session
- [raoshaab/Pen-Andro](https://github.com/raoshaab/Pen-Andro): 273 stars · GPL-3.0 · last push 2024-01 · Script to Automate installtion of Apps ,frida server and moving Burpsuite certificate to root folder
- [aadog/fd-back](https://github.com/aadog/fd-back): 250 stars · last push 2024-03 · frida runtime (no python required, only a single file),One-click support for ios dump
- [nowsecure/frida-trace](https://github.com/nowsecure/frida-trace): 237 stars · MIT · last push 2025-06 · Trace APIs declaratively through Frida.
- [std-microblock/fripack](https://github.com/std-microblock/fripack): 233 stars · last push 2026-03 · Package your Frida script into an executable.
- [dmaivel/ntoseye](https://github.com/dmaivel/ntoseye): 218 stars · MIT · last push 2026-10 · WinDbg-like kernel debugger for Windows, from Linux and macOS
- [enovella/r2frida-wiki](https://github.com/enovella/r2frida-wiki): 203 stars · last push 2020-12 · This repo aims at providing practical examples on how to use r2frida
- [index-login/MobileRE-Skill](https://github.com/index-login/MobileRE-Skill): 185 stars · MIT · last push 2026-10 · An AI-agent skill system for mobile reverse engineering: Frida hooks, one-click unpacking, anti-detection bypasses, in-memory DEX dumps, and symbol/structure recovery through Ghidra MCP.
- [as0ler/r2flutch](https://github.com/as0ler/r2flutch): 184 stars · GPL-3.0 · last push 2026-09 · Tool to decrypt iOS apps using r2frida
- [talsec/Free-RASP-iOS](https://github.com/talsec/Free-RASP-iOS): 184 stars · MIT · last push 2026-10 · iOS library (SDK) providing app security and threat monitoring. Shield your app with free RASP. Detect reverse engineering, jailbreak, Frida, emulators, bots, signature and integrity issues, VPN usage, and monitor device identification and more.
- [antojoseph/diff-gui](https://github.com/antojoseph/diff-gui): 182 stars · last push 2016-11 · GUI for Frida -Scripts
- [kaifcodec/freefire-like-and-guest-api](https://github.com/kaifcodec/freefire-like-and-guest-api): 175 stars · last push 2026-04 · Automates creating and capturing Free Fire guest accounts via Frida, formats and manages them, obtains JWTs, and sends encrypted like requests to a target UID with concurrency controls and one-like-per-guest-per-target guarantees.
- [ngwg/ceasta](https://github.com/ngwg/ceasta): 169 stars · GPL-3.0 · last push 2026-09 · disassembler, decompiler and debugger in one, with a built-in mcp server: point an ai at a binary and it can debug it, not just read it. ida-style listing, pseudocode (f5), x64dbg-style debugger (windows and linux), binary diff, lua plugins. reads pe, elf and mach-o. runs on windows, linux and macos.
- [ReverseApple/gxpc](https://github.com/ReverseApple/gxpc): 167 stars · MIT · last push 2026-02 · Sniff XPC communication using Frida and Go
- [ricardoquesada/regenerator2000](https://github.com/ricardoquesada/regenerator2000): 164 stars · Apache-2.0 · last push 2026-08 · An interactive disassembler for the CPU 6502, focused on Commodore 8-bit computers. Features a TUI with modern features like x-ref, undo/redo, flow arrows, keyboard-driven, MCP server for auto analysis, VICE debugger and more!
- [vadim-a-yegorov/iOS-Internals-and-Security-Testing](https://github.com/vadim-a-yegorov/iOS-Internals-and-Security-Testing): 154 stars · CC-BY-SA-4.0 · last push 2024-05 · iOS is Apple's proprietary operating system that runs on the iPhone, iPod Touch and iPad. A lot of components are specific to iOS. Here are key features of the iOS hardware and software security architecture and guide how to test your applications.
- [nowsecure/airspy](https://github.com/nowsecure/airspy): 152 stars · MIT · last push 2023-01 · AirSpy - Frida-based tool for exploring and tracking the evolution of Apple's AirDrop protocol implementation on i/macOS, from the server's perspective. Released during BH USA 2019 Training https://www.nowsecure.com/event/advanced-frida-and-radare-a-hackers-delight/
- [jiaxw32/iNote](https://github.com/jiaxw32/iNote): 150 stars · MIT · last push 2023-11 · Personal study and research notes on Objective-C, C++, iOS reverse engineering, assembly and Python.
- [Fleynaro/SDA](https://github.com/Fleynaro/SDA): 140 stars · Apache-2.0 · last push 2023-12 · SDA is a rich cross-platform tool for reverse engineering that focused firstly on analysis of computer games. I'm trying to create a mix of the Ghidra, Cheat Engine and x64dbg. My tool will combine static and dynamic analysis of programs. Now SDA is being developed.
- [alphaSeclab/DBI-Stuff](https://github.com/alphaSeclab/DBI-Stuff): 139 stars · last push 2020-03 · Resources About Dynamic Binary Instrumentation and Dynamic Binary Analysis
- [vadim-a-yegorov/Jailbreak-detection-The-modern-way](https://github.com/vadim-a-yegorov/Jailbreak-detection-The-modern-way): 136 stars · last push 2022-12 · Jailbreak detection was changed through the years. This is a history overview and analysis of modern applications like Snapchat and Pokemon GO.
- [ate47/atian-cod-tools](https://github.com/ate47/atian-cod-tools): 135 stars · last push 2026-10 · Random things
- [Guardsquare/mocxx](https://github.com/Guardsquare/mocxx): 133 stars · GPL-3.0 · last push 2022-10 · A versatile C++ function mocking framework.
- [Pilfer/ultimate-guitar-scraper](https://github.com/Pilfer/ultimate-guitar-scraper): 132 stars · last push 2023-11 · A simple scraper for Ultimate-Guitar.com's mobile API, written in Go.
- [diommsantos/Gx64Sync](https://github.com/diommsantos/Gx64Sync): 131 stars · last push 2025-11 · A set of plugins for Ghidra and x64Dbg synchronization. A faster, more flexible ret-sync.
- [vibheksoni/dma-spoofer](https://github.com/vibheksoni/dma-spoofer): 130 stars · MIT · last push 2026-03 · First open-source DMA-based HWID spoofer written in Rust. Spoof hardware IDs via direct memory access.
- [DerekSelander/mobdevim](https://github.com/DerekSelander/mobdevim): 129 stars · last push 2024-02 · Command line utility that interacts with plugged in iOS devices. Uses Apple's MobileDevice framework
- [lautarovculic/frida-ipa-extract](https://github.com/lautarovculic/frida-ipa-extract): 129 stars · WTFPL · last push 2026-03 · Robust Frida-based tool to dump decrypted iOS apps as .ipa from a jailbroken device supports App Store, sideloaded and system.
- [NSEcho/furlzz](https://github.com/NSEcho/furlzz): 129 stars · MIT · last push 2026-02 · Fuzz iOS URL schemes
- [iamtorsten/SherlockElf](https://github.com/iamtorsten/SherlockElf): 119 stars · MIT · last push 2026-10 · SherlockElf is a powerful tool designed for both static and dynamic analysis of Android ELF binaries and dynamic iOS Macho-O binaries (experimental).
- [juliangrtz/frida-iOS-syscall-tracer](https://github.com/juliangrtz/frida-iOS-syscall-tracer): 111 stars · last push 2026-04 · Traces syscalls on iOS via Frida, including Mach syscalls.
- [n1ght-w0lf/HawkEye](https://github.com/n1ght-w0lf/HawkEye): 111 stars · last push 2020-06 · Malware dynamic instrumentation tool based on frida framework
- [revercc/gumTVM](https://github.com/revercc/gumTVM): 111 stars · last push 2026-10 · Use frida-gum's stalker for tracing
- [davuxcom/frida-scripts](https://github.com/davuxcom/frida-scripts): 107 stars · last push 2019-07 · Inject JS and C# into Windows apps, call COM and WinRT APIs
- [miyagaw61/exgdb](https://github.com/miyagaw61/exgdb): 107 stars · MIT · last push 2024-04 · Extension for GDB
- [CYRUS-STUDIO/frida_stalker](https://github.com/CYRUS-STUDIO/frida_stalker): 103 stars · last push 2025-09 · Using Frida Stalker to Bypass OLLVM and Restore (Function Call Analysis, Parameter Analysis, Stack Trace Printing, Instruction & Registers Trace).
- [axhlzy/ARTHookScripts](https://github.com/axhlzy/ARTHookScripts): 94 stars · last push 2026-09 · frida runtime resolves smali
- [rubaljain/frida-jb-bypass](https://github.com/rubaljain/frida-jb-bypass): 88 stars · last push 2019-03 · Frida script to bypass the iOS application Jailbreak Detection
- [freehuntx/frida-inject](https://github.com/freehuntx/frida-inject): 81 stars · MIT · last push 2026-10 · This module allows you to easily inject javascript using frida and frida-load.
- [icloudza/algokiller-plugin](https://github.com/icloudza/algokiller-plugin): 79 stars · MIT · last push 2026-05 · ARM64 trace evidence analysis & cipher algorithm recovery — Claude Desktop plugin with skills + local MCP server driving the native ak_search engine over GB-scale trace files
- [Baron-von-Riedesel/DOS-debug](https://github.com/Baron-von-Riedesel/DOS-debug): 77 stars · last push 2025-06 · Debug and DebugX (short: Debug/X) are extended versions of MS DEBUG
- [freehuntx/frida-mono](https://github.com/freehuntx/frida-mono): 76 stars · MIT · last push 2026-10 · All the mono c exports, ready to be used in frida!
- [vah13/Win_ZIP_password](https://github.com/vah13/Win_ZIP_password): 75 stars · last push 2018-05 · Python script to hook ZIP files passwords in Windows 10
- [beevik/go6502](https://github.com/beevik/go6502): 74 stars · BSD-2-Clause · last push 2026-03 · 6502 CPU emulator, assembler, disassembler, debugger and host written in go
- [BullyWiiPlaza/JGeckoU](https://github.com/BullyWiiPlaza/JGeckoU): 73 stars · last push 2025-09 · Wii U RAM TCP Debugger Client/Cheat Code Manager
- [wwweeeqqu/honor-of-kings-RE-research](https://github.com/wwweeeqqu/honor-of-kings-RE-research): 73 stars · last push 2026-06 · Full-stack mobile game-security research (Honor of Kings / sgame): kernel-mode cross-process memory reading (KernelPatch KPM), Tencent ACE anti-cheat & IL2CPP/native engine reverse engineering, and a real-time ESP overlay. Educational / research only; no proprietary binaries.
- [LeanVel/iInject](https://github.com/LeanVel/iInject): 72 stars · GPL-3.0 · last push 2017-07 · Tool to automate the process of embedding dynamic libraries into iOS applications from GNU/Linux
- [vichhka-git/universal-flutter-ssl-pinning](https://github.com/vichhka-git/universal-flutter-ssl-pinning): 69 stars · last push 2026-09 · Automated SSL pinning bypass for any Flutter & Shorebird version — PyGhidra static analysis auto-discovers BoringSSL and generates ready-to-run Frida & Renef scripts
- [jankais3r/Frida-iOS-15-TLS-Keylogger](https://github.com/jankais3r/Frida-iOS-15-TLS-Keylogger): 64 stars · MIT · last push 2022-11 · Hooks libboringssl.dylib to extract TLS keys and enables the traffic from iOS apps to be decrypted.
- [imugee/xdv](https://github.com/imugee/xdv): 56 stars · GPL-3.0 · last push 2019-09 · XDV is disassembler or debugger that works based on the extension plugin.
- [heeeyaaaa/vmem-decrypt](https://github.com/heeeyaaaa/vmem-decrypt): 55 stars · MIT · last push 2026-07 · Decrypt VMware vTPM-encrypted .vmem/.vmsn/.vmss/.nvram from the VM password, and flatten the .vmem to a Volatility-ready image.
- [crissyfield/super-trouper](https://github.com/crissyfield/super-trouper): 54 stars · MIT · last push 2026-10 · MCP server for Frida.
- [irql/nokd](https://github.com/irql/nokd): 44 stars · last push 2024-07 · reverse engineering of the windows nt kernel debugger protocol & reimplementation.
- [StackOverflowExcept1on/ida75demo-linux](https://github.com/StackOverflowExcept1on/ida75demo-linux): 35 stars · last push 2023-12 · Unofficial patches for IDA 7.5 Demo on Linux x86_64. Suffering from success: Hex-Rays SA DMCA’d repository.
- [andreafioraldi/r2angrdbg](https://github.com/andreafioraldi/r2angrdbg): 34 stars · BSD-2-Clause · last push 2019-06 · Use angr inside the radare2 debugger. Create an angr state from the current debugger state.
- [NSEcho/fnoios](https://github.com/NSEcho/fnoios): 31 stars · MIT · last push 2025-01 · Redirect spawned iOS application stdout and stderr to pty
- [EmadAbedini/Dumplyzer](https://github.com/EmadAbedini/Dumplyzer): 29 stars · Apache-2.0 · last push 2026-10 · Open-source memory forensics platform for DFIR, threat hunting, malware analysis, and incident response.
- [Tixul/Ngpcraft_emulator](https://github.com/Tixul/Ngpcraft_emulator): 29 stars · MIT · last push 2026-10 · Neo Geo Pocket / Color emulator with a full debugger and fan-translation & ROM hacking tools (.tbl tables, relative search, pointer finder, ROM diff). Save states, rewind, Windows/Linux/macOS builds.
- [AkashaCorporation/HikariSystem-HexCore](https://github.com/AkashaCorporation/HikariSystem-HexCore): 27 stars · MIT · last push 2026-09 · The Native Reverse Engineering IDE. Zero-overhead binary analysis, full CPU emulation (PE/ELF), and headless automation. Powered by Capstone, Unicorn, LLVM & Remill via N-API.
- [riyadmondol2006/ios-ssl-bypass-and-traffic-monitor](https://github.com/riyadmondol2006/ios-ssl-bypass-and-traffic-monitor): 24 stars · last push 2025-03 · iOS SSL Bypass & Real-Time Traffic Monitor – A Frida-based script for bypassing SSL pinning and monitoring network traffic on iOS apps in real-time. Designed for security researchers and ethical testing. 📡🔓
- [yfe404/frida-mcp](https://github.com/yfe404/frida-mcp): 24 stars · last push 2026-07 · MCP server for Frida 17 dynamic instrumentation
- [qtmleap/revkit](https://github.com/qtmleap/revkit): 19 stars · MIT · last push 2026-10 · A reverse-engineering toolkit for iOS and Android applications (Frida, mitmproxy, Ghidra, Theos)
- [2233admin/reverse-skill-evolver](https://github.com/2233admin/reverse-skill-evolver): 17 stars · MIT · last push 2026-10 · Reverse-engineering skills for AI coding agents, with IDA/MCP integration, APK and JavaScript workflows, bounded agent swarms, and routing evaluation.
- [Fi5t/iDump](https://github.com/Fi5t/iDump): 17 stars · MIT · last push 2026-07 · Decrypt and dump iOS app binaries to an IPA file via USB and SSH/SFTP
- [p1tsi/wormhole](https://github.com/p1tsi/wormhole): 14 stars · last push 2025-10 · Frida wrapper for iOS/macOS penetration testers and reverse engineers. (WIP)
- [Cristallin2006/ghidra-skill-for-dsh](https://github.com/Cristallin2006/ghidra-skill-for-dsh): 11 stars · MIT · last push 2026-10 · Custom-built for dsh (DeepSeek Harness): a persistent Ghidra headless daemon and reverse-engineering agent skills (triage/unpack/decompile/pwn/pcap/APK), with circuit breakers against agent failure loops and skills that evolve through retrospectives.
- [ejfkdev/dae](https://github.com/ejfkdev/dae): 9 stars · MIT · last push 2026-10 · Dart AOT snapshot analyzer: exports blutter-compatible symbols and structs for IDA / radare2 / Frida, and decompiles functions into dart-analyze-clean Dart. Desktop and real-device mobile (compressed pointers), Dart 2.7-3.14. No Dart SDK, never runs the target.
- [Veridiff/Veridiff](https://github.com/Veridiff/Veridiff): 8 stars · Apache-2.0 · last push 2026-10 · Dynamic branch-divergence finder for native code -- traces two Frida executions and finds the exact instruction where they diverge.
- [Cross2pro/FridaMemoryBrowser](https://github.com/Cross2pro/FridaMemoryBrowser): 6 stars · last push 2026-01 · Browse, scan, modify, custom by frida
- [juliangrtz/iOS-re-lab](https://github.com/juliangrtz/iOS-re-lab): 6 stars · MIT · last push 2026-01 · A reverse engineering laboratory for iOS applications.
- [iss4cf0ng/issac-reverse-toolbox](https://github.com/iss4cf0ng/issac-reverse-toolbox): 5 stars · MIT · last push 2026-04 · Personal reverse engineering toolbox with custom tools, scripts, and malware analysis notes.
- [Loonaro/loonaro-sandbox](https://github.com/Loonaro/loonaro-sandbox): 5 stars · last push 2025-12 · Loonaro - Automated Malware Analysis
- [vitri0l/NewWorldInterface](https://github.com/vitri0l/NewWorldInterface): 5 stars · MIT · last push 2026-06 · Driver-backed Windows kernel interface for VAD-tree inspection/manipulation, PTE relinking, and cross-process memory operations, with runtime symbol resolution from ntoskrnl's PDB.
- [AvivShabtay/BlackEnergyDriver](https://github.com/AvivShabtay/BlackEnergyDriver): 4 stars · last push 2020-10 · Reverse engineering the Black Energy Driver
- [chase-irql/StrataDMA](https://github.com/chase-irql/StrataDMA): 4 stars · AGPL-3.0 · last push 2026-10 · Modern C++17 wrapper for MemProcFS/VMMDLL with structured DMA memory APIs, process introspection, scanning, input support, and hardware-free tests.
- [hackThacker/awesome-reverse-engineering](https://github.com/hackThacker/awesome-reverse-engineering): 4 stars · Apache-2.0 · last push 2026-05 · Expert reverse engineer specializing in binary analysis, malware research, and low-level system internals. Experienced in dissecting complex software, uncovering vulnerabilities, and understanding code beyond source-level abstraction
- [ahmedMhesham12/flutter-tls-frida-generator](https://github.com/ahmedMhesham12/flutter-tls-frida-generator): 3 stars · MIT · last push 2026-07 · Generate layered Frida TLS testing agents from Flutter engine binaries.
- [gabryxdev/RuntimeMemoryGuardian](https://github.com/gabryxdev/RuntimeMemoryGuardian): 3 stars · MIT · last push 2026-08 · Defensive C++20 library for runtime memory integrity, hook detection, and anti-tamper monitoring on Windows/Linux
- [Maxamedxasa/SakoREStudio](https://github.com/Maxamedxasa/SakoREStudio): 3 stars · MIT · last push 2026-09 · 🛡️ Mobile-first Interactive Disassembler & Decompiler Framework — IDA Pro / Ghidra-class RE on Android. APK · ELF · PE · DEX · ARM64 · x86-64 · IR decompiler · call graph · ptrace debugger · SakoScript plugins. Created by Maxamed Xasan Muse 🇸🇴
- [rahimgujjar/WhatsApp-WAL-XRay](https://github.com/rahimgujjar/WhatsApp-WAL-XRay): 3 stars · last push 2026-07 · A deterministic memory-mapping and database forensic suite engineered to audit client-side data leakage and bypass ephemeral privacy controls via SQLite Write-Ahead Logs (.db-wal).
- [13shivam/offset-zero](https://github.com/13shivam/offset-zero): 2 stars · last push 2026-09 · Offset Zero: A free, open-source field guide to digital forensics, reverse engineering, and detection engineering. Start at the first byte. YEAHH, ITS MORE OF A MINDSET!
- [AlexGRDev/apple-seclab](https://github.com/AlexGRDev/apple-seclab): 2 stars · MIT · last push 2026-09 · Reproducible Apple security research environments for macOS, iOS and iPadOS.
- [Ashibalt/minusOne-mcp-reverse](https://github.com/Ashibalt/minusOne-mcp-reverse): 2 stars · MIT · last push 2026-09 · MCP server for reverse engineering — 77 semantic operations: static triage, unpacking, decompilation (Ghidra/IDA), dynamic instrumentation (frida/TTD), emulation (Unicorn), symbolic execution (angr), evidence handling. Works with any MCP-compatible agent host.
- [ip2867/ctf-re-tool](https://github.com/ip2867/ctf-re-tool): 2 stars · MIT · last push 2026-10 · An Electron-based AI workbench for CTF reverse-engineering challenges on Windows. It combines an AI tool loop with local validation, connects to IDA, JEB, and Burp through MCP, and automatically tackles APK, PE, ELF, PYC, DEX, JAR, Mach-O, Lua, and Web-JS challenges. Includes 11 methodology skills, a 54-page structured knowledge base, and self-improvement from experience.
- [PyModel/reverse-engineering-skill](https://github.com/PyModel/reverse-engineering-skill): 2 stars · MIT · last push 2026-09 · Deterministic binary analysis, runtime instrumentation & protocol reverse-engineering skill for AI coding agents.
- [siaginw/HexWitness](https://github.com/siaginw/HexWitness): 2 stars · last push 2026-10 · Give your reverse-engineering agent a memory, a map, and receipts.
- [Acousticdevicemercouri734/androidReverse](https://github.com/Acousticdevicemercouri734/androidReverse): 1 stars · last push 2026-10 · Reverse engineer APKs and analyze native binaries directly on your Android device without a PC or ADB.
- [awareride/packscope](https://github.com/awareride/packscope): 1 stars · MIT · last push 2026-09 · Inspect, analyze, and debug JavaScript bundles from webpack, rspack, rollup, esbuild, and Vite.
- [hanphanr1/Forge](https://github.com/hanphanr1/Forge): 1 stars · MIT · last push 2026-10 · Give a coding agent evidence, not screenshots: local workbench to reverse Android, iOS, desktop and web protocol clients with JADX, radare2, ADB, Frida and live HTTP probes.
- [joshrad-dev/frida-flutterfire](https://github.com/joshrad-dev/frida-flutterfire): 1 stars · MIT · last push 2026-05 · A set of Frida scripts to help inspect Firebase calls in Flutter apps on iOS
- [Real-Fruit-Snacks/x86-x64-assembly-lab](https://github.com/Real-Fruit-Snacks/x86-x64-assembly-lab): 1 stars · MIT · last push 2026-07 · Interactive x86 & x86-64 assembly simulator and reverse-engineering lab — step-through 32/64-bit engines, stack playground, register quiz, 28 tutorials, and 7 tools. Pure browser, no build, no dependencies.
- [BattlePriestBarbara/Revlab](https://github.com/BattlePriestBarbara/Revlab): 0 stars · MIT · last push 2026-10 · An AI-assisted, multi-platform reverse engineering workbench integrating Ghidra, Frida, and MCP. Features zero-dependency triage for APK/ELF/PE, entropy-based packer detection, and strict default-deny authorization for secure, reproducible analysis.
- [Msr7799/Android-Deep-Analysis-Lab](https://github.com/Msr7799/Android-Deep-Analysis-Lab): 0 stars · MIT · last push 2026-08 · Open-source Android security auditing and ethical hacking toolkit for authorized ADB inspection, APK analysis, reverse engineering, network test Ethical Hacker Toolkit for Android security auditing, reverse engineering, dynamic analysis, network inspection, and APK analysis using ADB, JADX, Apktool, Ghidra, Frida, MobSF and TShark.
- [Prajwal-kp-18/crypto-firmware-detector](https://github.com/Prajwal-kp-18/crypto-firmware-detector): 0 stars · last push 2025-12 · Automated firmware analysis framework combining recursive extraction, Ghidra-based static analysis, and dynamic binary instrumentation to detect cryptographic primitives and hardcoded secrets in stripped binaries
- [SenjuWoo/reverse-this](https://github.com/SenjuWoo/reverse-this): 0 stars · MIT · last push 2026-10 · One-click Windows modkit with stable sandbox/bin paths for the current Ghidra, Unity, Unreal and reverse-engineering tools an agent should call.
- [yuw868349-commits/occ](https://github.com/yuw868349-commits/occ): 0 stars · last push 2026-10 · A Windows PE runtime for Linux: native guest execution, in-process debugging, offline de-virtualization. No Wine, no emulator.