Ghidra is a software reverse engineering (SRE) framework
THE REPOSITORY DIRECTORY
Native binaries
Browse 837 repositories with project descriptions, upstream links, and license information.
About this index
This published selection contains 3,500 captured repository records and 3,309 browsable entries. The 187 scope-excluded entries and 4 whose upstream repository is no longer available remain in the published JSON.
This repository index is discovered automatically and unreviewed. Categories come from metadata; descriptions have AI-assisted translations. Stars and last-push months are collection-time snapshots.
837 repositories
Selection published: 2026-10-20 UTC
🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.
UNIX-like reverse engineering framework and command-line toolset
Free and Open Source Reverse Engineering Platform powered by rizin
A FREE comprehensive reverse engineering tutorial covering x86, x64, 32-bit/64-bit ARM, 8-bit AVR and 32-bit RISC-V architectures.
AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.
Program for determining types of files for Windows, Linux and MacOS.
MCP Server for Ghidra
Unicorn CPU emulator framework (ARM, AArch64, M68K, Mips, Sparc, PowerPC, RiscV, S390x, TriCore, X86)
A powerful and user-friendly binary analysis platform!
A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.
Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.
Reverse Engineering: Decompiling Binary Code with Large Language Models
The FLARE team's open-source tool to identify capabilities in executable files.
Reverse engineering focusing on x64 Windows.
Ghidra MCP Server — 200+ MCP tools for AI-powered reverse engineering. GUI plugin + headless server, lazy tool loading, convention enforcement, batch operations, Ghidra Server integration, and Docker deployment.
LIEF - Library to Instrument Executable Formats (C++, Python, Rust)
Disassembly of Pokémon Red/Blue
Kaitai Struct: declarative language to generate binary data parsers in C++ / C# / Go / Java / JavaScript / Lua / Nim / Perl / PHP / Python / Ruby / Rust
C++ python bytecode disassembler and decompiler
PyInstaller Extractor
This tool lets you search your gadgets on your binaries to facilitate your ROP exploitation. ROPgadget supports ELF, PE and Mach-O format on x86, x64, ARM, ARM64, PowerPC, SPARC, MIPS, RISC-V 64, and RISC-V Compressed architectures.
Analyze ELF binaries like a boss 😼🕵️♂️
Diaphora, the most advanced Free and Open Source program diffing tool.
Fast and lightweight x86/x86-64 disassembler and code generation library
Triton is a dynamic binary analysis library. Build your own program analysis tools, automate your reverse engineering, perform software verification or just emulate code.
A cross-version Python bytecode decompiler
FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
Reverse engineering framework in Python
UNIX-like reverse engineering framework and command-line toolset.
Blazing fast and correct x86/x64 disassembler, assembler, decoder, encoder for Rust, .NET, Java, Python, Lua
Open-source code analysis platform for C/C++/Java/Binary/Javascript/Python/Kotlin based on code property graphs. Discord https://discord.gg/vv4MH284Hc
IDA plugin which queries language models to speed up reverse-engineering
Agent skills for solving CTF challenges - web exploitation, binary pwn, crypto, reverse engineering, forensics, OSINT, and more
DIE engine
Quickly find differences and similarities in disassembled code
Plasma is an interactive disassembler for x86/ARM/MIPS. It can generates indented pseudo-code with colored syntax.
Reko is a binary decompiler.
Binary Analysis Platform
Reconstruct and validate C/C++ code from compiled programs with AI.
IDA Pro plugin with a rich set of features: decryption, deobfuscation, patching, lib code recognition and various pseudocode transformations
An Agent Skill for designing cross-platform desktop apps that feel native — distilled from Raycast's 2.0 deep-dive and reverse engineering of Raycast Beta.app. Eight architectural tenets, four-layer architecture, WebKit/WebView2 survival guide, 75-item ship audit.
Multi-architecture assembler for IDA Pro. Powered by Keystone Engine.
Binary code static analyser, with IDA integration. Performs value and taint analysis, type reconstruction, use-after-free and double-free detection
The Open Source Disassembler
Automated static analysis tools for binary programs
BinAbsInspector: Vulnerability Scanner for Binaries
A FREE Windows C development course where we will learn the Win32API and reverse engineer each step utilizing IDA Free in both an x86 and x64 environment.
Heimdall is an advanced EVM smart contract toolkit specializing in bytecode analysis and extracting information from unverified contracts.
Virtual-machine Translation Intermediate Language
An impish, cross-platform binary parsing crate, written in Rust
IDA Pro plugin which improves work with HexRays decompiler and helps in process of reconstruction structures and classes
Free educational content on reverse engineering and malware analysis from the FLARE team
Agent-Native multi-platform reverse engineering and CWE-602 client-side authorization audit workbench.
This project has been moved to:
BARF : A multiplatform open source Binary Analysis and Reverse engineering Framework
Make your IDA Lazy!
An IDA plugin for binary file analysis, powered by AI models such as OpenAI and DeepSeek.
Python decompiler for modern Python versions.
cwe_checker finds vulnerable patterns in binary executables
Powerful Disassembler Library For x86/AMD64
A reverse engineering tool to restore stripped symbol table for iOS app.
Lua Decompiler for lua 5.1 , 5.2 and 5.3
Public API, examples, documentation and issues for Binary Ninja
Stop your AI from making things up — it proposes, deterministic tools decide, every claim checked against ground truth with evidence. Grounded facts and context survive resets. Reverse engineering is the proving ground. MCP server + CLI.
Python decompiler for 3.7-3.8 Stripped down from uncompyle6 so we can refactor and start to fix up some long-standing problems
Advanced Game Hacking Library for C, Modern C++, Rust and Python (Windows/Linux/FreeBSD) (Process/Memory Hacking) (Hooking/Detouring) (Cross Platform) (x86/x64) (DLL/SO Injection) (Internal/External) (Assembler/Disassembler)
PE file viewer/editor for Windows, Linux and MacOS.
The world's first agentic reverse engineer.
Export disassemblies into Protocol Buffers
PE Tools - Portable executable (PE) manipulation toolkit
Official Hex-Rays IDA MCP Server.
Scripts for the Ghidra software reverse engineering suite.
bddisasm is a fast, lightweight, x86/x64 instruction decoder. The project also features a fast, basic, x86/x64 instruction emulator, designed specifically to detect shellcode-like behavior.
An open source interactive disassembler
The ultimate AI-powered toolkit for python reverse engineering
Static recompilation of Link's Awakening (Switch) to native macOS, Windows and Linux
No description supplied by the upstream repository.
An integration for IDA and VS Code which connects both to easily execute and debug IDAPython scripts.
Deep ghidra decompiler and sleigh disassembler integration for rizin
Reverse Engineering and Malware Analysis Roadmap
The Official Radare2 Book
Karta - source code assisted fast binary matching plugin for IDA
Deobfuscation via optimization with usage of LLVM IR and parsing assembly.
Python snippets for Ghidra's Program and Decompiler APIs
Vulnerability detection framework by Binarly's REsearch team
An easy-to-use library for emulating memory dumps. Useful for malware analysis (config extraction, unpacking) and dynamic analysis in general (sandboxing).
An OSINT tool to quickly extract IP and URL endpoints from APKs by disassembling and decompiling
AI-Powered Reverse Engineering Plugin for IDA Pro
A fast and accurate disassembler
MCP server for reverse engineering tasks in Ghidra 👩💻
CTF Cheat Sheet + Writeups / Files for some of the Security CTFs that I've done
IDA7.0_SP is ida's bugfix
IPython console integration for IDA Pro
DECAF (short for Dynamic Executable Code Analysis Framework) is a binary analysis platform based on QEMU. This is also the home of the DroidScope dynamic Android malware analysis platform. DroidScope is now an extension to DECAF.
Integrate LLM models directly into Ghidra for AI-enhanced reverse engineering.
No description supplied by the upstream repository.
A bunch of Windows anti-debugging tricks for x86 and x64.
Python Command-Line Ghidra Binary Diffing Engine
The PE file analysis toolkit
An native MCP server extension for Ghidra
IDA Pro plugin to examine the glibc heap, focused on exploit development
An optimizing decompiler
An LLM extension for Ghidra to enable AI assistance in RE.
A reversing plugin for cross-decompiler collaboration, built on git.
RetroWrite -- Retrofitting compiler passes through binary rewriting
PyInstaller Extractor Next Generation
A curated list of awesome projects, articles and the other materials powered by Radare2
RISC-V simulator for x86-64
A collection of pwn/CTF related utilities for Ghidra
iblessing is an iOS security exploiting toolkit, it mainly includes application information gathering, static analysis and dynamic analysis. It can be used for reverse engineering, binary analysis and vulnerability mining.
:dart: Advanced debugging skills used in iOS project development, including dynamic debugging, static analysis, and decompilation of third-party libraries.
An Interactive Hex-Rays Microcode Explorer
#supply #chain #attack #detection
IDApython Scripts for Analyzing Golang Binaries
IDA Pro plugin for query based searching within the binary useful mainly for vulnerability research.
IDAPython Made Easy
A comprehensive collection of cheatsheets for reverse engineering, binary analysis, and assembly programming tools. This repository serves as a one-stop reference for security researchers, reverse engineers, and low-level programmers.
BinData - Reading and Writing Binary Data in Ruby
The Kam1n0 Assembly Analysis Platform
Use angr in Ghidra
Rellic produces goto-free C output from LLVM bitcode
An agent-first decompiler designed to be refined by other agents. Kuna is written in Rust and was originally ported from Ghidra.
r2dec-js is a JavaScript-based decompiler that converts assembly code into pseudo-C. It aids users in understanding assembly by providing readable high-level explanations, making low-level programming more accessible and facilitating debugging across diverse hardware platforms.
Ghidra extension for exporting relocatable object files
A Binary Genetic Traits Lexer Framework
Binary Analysis Framework in Rust
Pintool example and PoC for dynamic binary analysis
🔍 Go binary size SVG treemap
B2R2 is a fully managed binary analysis framework written in F#. It provides a rich set of algorithms, functions, and tools for reverse engineering, program analysis, and binary-level inspection.
IDA Pro's FindCrypt ported to Ghidra, with an updated and customizable signature database
BeaEngine disasm project
Framework for Automating Fuzzable Target Discovery with Static Analysis.
Binee: binary emulation environment
A series of tutorials about radare2 framework from https://www.megabeets.net
An ad-free BiliBili client implemented through iOS reverse engineering. Thanks for using it; stars are welcome.
The multiplayer AI offensive security OS - open, self-improving, extensible. Find, verify, and fix vulnerabilities.
Yet Another Ghidra Integration for IDA
Rust implementation of SPIR-V module processing functionalities
IFL - Interactive Functions List (plugin for IDA Pro)
Port of devttyS0's IDA plugins to the Ghidra plugin framework, new plugins as well.
Components of a decompilation pipeline.
A VBA p-code disassembler
SHAREM is a shellcode analysis framework, capable of emulating more than 45,000 WinAPIs and virutally all Windows syscalls. It also contains its own custom disassembler, with many innovative features, such as being able to show the deobfuscated disassembly of an encoded shellcode, or integrating emulation data to enhance the disassembly.
LLM-based reversing for radare2
Enhanced IDA Pro signature generator plugin.
Hexrays Toolbox - Find code patterns within the Hexrays ctree
Signature maker plugin for IDA 9.x and 8.x
Agent-first reverse engineering for macOS, Windows and Linux: any ACP agent reads, renames and patches binaries, Android apps and GPU kernels next to you.
Driver Buddy Reloaded is an IDA Pro Python plugin that helps automate some tedious Windows Kernel Drivers reverse engineering tasks
The dissection of a simple "hello world" ELF binary.
Access radare2 via pipe from any programming language!
IDAPython plugin that synchronizes disassembler and decompiler views
:notebook: Some security related notes
Precompiled Decompyle++ (pycdc) binaries for Windows & Linux
A Binary Ninja plugin containing an MCP server that enables seamless integration with your favorite LLM/MCP client.
:wolf: Malware analysis platform
Remove OLLVM control-flow flattening obfuscation using Binary Ninja.
HexRays ctree visualization plugin
A Full-Featured HexEditor compatible with Linux/Windows/MacOS
Karonte is a static analysis tool to detect multi-binary vulnerabilities in embedded firmware
A collection of types & functions definitions useful for iOS/macOS binaries analysis.
an ida plugin used to decompile vmp
Opcode calculator / ASM calculator
Easily retargetable and hackable interactive disassembler with IDAPython-compatible plugin API
Boomerang Decompiler - Fighting the code-rot :)
GptHidra is a Ghidra plugin that uses the OpenAI Chat GPT to explain functions. With GptHidra, you can easily understand the purpose and behavior of functions in your codebase. Now with GPT4 Support!
a multi-threads tool for decompile exe,elf,pyz,pyc packed by python which is base on pycdc and uncompyle6.
radare2-based decompiler and symbol executor
A :zap: lightweight Go package to parse, analyze and extract metadata from Portable Executable (PE) binaries. Designed for malware analysis tasks and robust against PE malformations.
idenLib - Library Function Identification [This project is not maintained anymore]
A binary lifter and analysis framework for Ethereum smart contracts
GhidRust: Rust decompiler plugin for Ghidra
Intermediate Representation for Binary analysis and transformation
A terminal-first reverse engineering toolkit in Rust: PE/ELF/Mach-O analysis through CLI, TUI, and MCP. Installs as knife.
LLVM based static binary analysis framework
Companion source code for the book macOS Software Security and Reverse Engineering.
Nintendo Switch loader for Ghidra
A guide that explains how programs transform from source code to executables. Deep dive into ELF format, linking processes, and binary optimization techniques. Perfect for systems programmers, C developers, and anyone interested in low-level programming concepts.
Python cross-version bytecode library and disassembler
Python 3 bridge to Ghidra's Python scripting
Unity IL2CPP Disassembler (for apk)
Coefficient-Based Reconstruction of Arithmetic — a Mixed Boolean-Arithmetic (MBA) expression simplifier for deobfuscation
ClassInformer backported for IDA Pro 7.0
IDA ClassInformer PlugIn
abyss - augmentation of Hexrays decompiler output
Reverse Engineering Tools (deobf, decompiler etc..)
Plugin for Ghidra to assist reversing Golang binaries
A plugin based on IDAPython for a functional DWIM interface. Current development against most recent IDA is in the "persistence-refactor" branch, ancient (but stable) work is in "master", so... create an issue if you want/need something backported. Use "Wiki" or "Discussions" for examples, and smash that "Star" button if you like this.
r0crawl_skills is a massive reverse-engineering skill arsenal for web, Android, iOS, Frida, native binaries, protocols, malware, firmware, and anti-analysis—built for beginners, tuned for pros, and engineered for reproducible results.
An AVX Lifter for the Hex-Rays Decompiler
Debug Child Process Tool (auto attach)
Security analysis of the hypervisor drm method used to bypass denuvo. Reverse engineering of the driver loaders and boot components using Ghidra
MCP stdio server for radare2
D810-ng (Next Generation) is an updated, tested, refactored, and optimized IDA Pro plugin used to deobfuscate code at decompilation time by modifying IDA Pro microcode.
FLARE Team's Binary Navigator
A Nintendo GameCube binary loader for Ghidra
x86 malware emulator
Ghidra Analysis Enhancer 🐉
Scripts for the Ghidra.
Medigate plugin for c++ reverse engineering and other utils
Native Pcode emulator
A collection of my Ghidra scripts to facilitate reverse engineering and vulnerability research.
Ghidra analysis plugin to locate cryptographic constants
Articles and tools related to research in the Apple environment (mainly macOS).
*Decompile All the Things* - IDA Batch Decompile plugin and script for Hex-Ray's IDA Pro that adds the ability to batch decompile multiple files and their imports with additional annotations (xref, stack var size) to the pseudocode .c file
Ghidra Extension to integrate BinDiff for function matching
A modern, modular, and robust TUI hex editor.
Silent Hill: Downpour — native Windows PC port via static recompilation of the Xbox 360 binary. v1.0 stable: 60 FPS unlocked, ROV warm-cache, standalone launcher, DualSense adaptive triggers, portable saves. Tested on USA + Europe X360 dumps.
REPL-integrated Clojure-to-Java decompiler
Obfuscator-llvm Control Flow Flattening Deobfuscator
DrSemu - Sandboxed Malware Detection and Classification Tool Based on Dynamic Behavior
📡🐧 Linux kernel syscall implementation tracker
IDAPython loader to help with AArch64 iBoot, iBEC, and SecureROM reverse engineering
SMDA is a minimalist recursive disassembler library that is optimized for accurate Control Flow Graph (CFG) recovery from memory dumps.
Ghidra Client/Server Docker Image
IDA Pro plugin to make bitfield accesses easier to grep
Analyze Golang with Ghidra
Source graveyard and random candy for radare2
sleigh craft!
Open source binary analysis tools.
An extension for Ghidra that adds support for the PlayStation 2.
IDA Pro plugin that speeds up the initial binary auto analysis through a caching technique
Yara rule making tool (IDA Pro & Binary Ninja & Cutter & Ghidra Plugin)
Quarkslab Bindiffer but not only !
Automate Ghidra reverse engineering from the command line — headless analysis, decompilation, and structured JSON output for AI agents like Claude Code
Book: Reverse Engineering — Fundamentals and Practice
An AI agent skill for automated malware analysis with IDA Pro, enabling agents to analyze malicious samples like a security analyst.
eBPF Processor for Ghidra
Code and exercises for a workshop on z3 and angr
A research decompiler implemented as a Binary Ninja plugin.
A fast and lightweight decoder for x86 and x86-64 and encoder for x86-64.
ChatGPT Agent analyses your IDA pseudocode
A Ghidra script to save small patches back to the executable file
No description supplied by the upstream repository.
Binary & scripts associated with "The Poor Man's Obfuscator" presentation
Native multi-arch disassembler & decompiler - PE/ELF/Mach-O, x86/x64/ARM64, Lua scripting, RTTI recovery
Play Skate 3 natively on Android. Download one APK, select your own ISO, and skate. ARM64 recompilation with Vulkan rendering.
Quokka: A Fast and Accurate Binary Exporter
🐉 Export ghidra decompiled code to dwarf sections inside ELF binary
sigmaker is a zero-dependency IDA Pro 9.0+ cross-platform signature maker plugin with optional SIMD (e.g. AVX2/NEON/SSE2) speedups that works on MacOS/Linux/Windows. It allows configurable wildcard operand patterns, nibbles, and signature generation just by right clicking.
A macOS utility to extract dynamic libraries from the dyld_shared_cache of macOS and iOS.
An ethereum evm bytecode disassembler and static/dynamic analysis tool
Python bindings to Ghidra's SLEIGH library for disassembly and lifting to P-Code IR
ScanCode.io is a server to script and automate software composition analysis with pipelines. This project is sponsored by the European Commission, NLnet NGI0, the Google Summer of Code, nexB and others generous sponsors!
Decompiler for x86 and x86-64 ELF binaries
Apply IDA FLIRT signatures for Ghidra
Pyhidra is a Python library that provides direct access to the Ghidra API within a native CPython interpreter using jpype.
A workbench for developing 6502 code.
A security-first MCP server that empowers AI agents to perform automated reverse engineering, malware analysis, forensics, vulnerability research, and SAST — powered by Radare2, YARA, LIEF, Capstone, and more.
Native 100% ARM64 Android port of the 2007 cosmic gravity platformer with OpenGL ES 3.2, AAudio, Hor+ ultrawide, and touch controls.
A lightweight ARM64 dynamic tracing and emulation tool based on Unicorn, supporting IDA Pro, Tenet log generation, native code emulation, memory dumps, register-state tracking, and instruction-level logging.
A plugin for IDA that renames functions by system call numbers.
AI-Assisted Reverse Engineering with Ghidra
Arkose Labs / FunCaptcha solver for Go, Python and Node — produces sup=1 suppressed tokens. The site RSA key is derived from api.js on every solve: no capture, no replay, no headless browser. Includes a full VM disassembly.
BTD - Bin To DNN: A DNN Executables Decompiler
Efficient Deobfuscation of Linear Mixed Boolean-Arithmetic Expressions
RevEng.AI Ghidra Plugin
Decompilation of snowboard kids 2 (N64)
Unofficial CMake build for Ghidra's C++ SLEIGH code
Delphi debug framework
Plugin to ease reversing iOS projects
The Java Disassembler
A Pythonic Ghidra standard library
Hex-Rays Decompiler Enhanced View
A binary analysis framework written in Rust.
IdaClu is a version agnostic IDA Pro plugin for grouping similar functions. Pick an existing grouping algorithm or create your own.
Complete static recompilation of Virtua Racing for the Sega 32X (optimization in progress)
Binary Code Similarity Analysis (BCSA) Benchmark
Useful Scripts for helping in reverse engeenering
MIPS instruction decoder
Slides & Hands-on for the reverse engineering workshop
Automatically identify and extract potential anti-debugging techniques used by malware.
Let's document Emacs Lisp Bytecode (Lisp Assembly Program) instructions
PE32 (x86) and PE32+ (x64) binaries analysis tool, resources viewer/extractor.
A multiline (and ultimate) assembler (and disassembler) plugin for x64dbg and OllyDbg. A perfect tool for modifying and extending a compiled executable functionality.
An IDA MIPS static scanning script to assist assembly-code auditing.
DelphiHelper is a python IDA Pro plugin aiming to help the analysis of x86/x86_64 binaries written in Delphi programming language.
Library for parsing internal structures of PE32/PE32+ binary files.
Modern dark theme based on the original ghidra-dark
Reverse engineering of Panzer Dragoon Saga
Deep memory analysis for Windows processes — the tool that saves you hours of debugging
An unofficial implementation of asm2vec as a standalone python package
A six-stage orchestration skill for mobile security analysis, coordinating APK static reconnaissance, traffic-to-code alignment, in-depth SO/JNI analysis, combined cryptography and vulnerability analysis, validation design, and report delivery. Supports JADX MCP, Burp/Yakit MCP, and IDA/Ghidra MCP.
Reverse engineering TikTok's JavaScript VM - 77 opcodes mapped, string deobfuscation, bytecode disassembly, and crypto function identification. Educational VM analysis toolkit.
Library and tool for reading IDApro databases.
A suite of tools for creating disassemblies of ZX Spectrum games.
Control-flow-flattening and string deobfuscator
AI-Powered Malware Analysis & Threat Intelligence for Ghidra Transform your static analysis workflow with cutting-edge AI capabilities, comprehensive malware detection, and advanced threat intelligence.
RevEng.AI IDA Pro Plugin
Disassembler for Windows executables. Supports 16-bit NE (New Executable), MZ (DOS), and PE (Portable Executable, i.e. Win32) files.
Yet another IDA Pro/Home plugin for deobfuscating stack strings
A python library for reading IDA pro databases.
Make your Ghidra Lazy!
A binary to LLVM translator
Python Command-Line Ghidra Decompiler
Classic Mac OS resource fork and application disassembler, with reverse-engineering tools for specific applications
WIP Decompilation of Kirby & The Amazing Mirror (USA)
This repository contains writeups for various CTFs I've participated in (Including Hack The Box).
Graphical disassembler for multiple architectures for easy navigation
REmatch, a complete binary diffing framework that is free and strives to be open source and community driven.
A Ghidra script that enables the analysis of selected functions and instructions using Large Language Models (LLMs). It aims to make reverse-engineering more efficient by using Ollama's API directly within Ghidra.
A Java Class File Disassembler
IDA Plugin that fills in missing indirect CALL & JMP target information
"Just Another ReVersIng Suite" or whatever other bullshit you can think of
Automatic vtable detection, inheritance analysis, and function override tracking for reverse engineering compiled C++ binaries. Supports IDA Pro 9+ on any OS
Portable modification of IDA Pro for macOS.
BINNY: an open source agent harness for reverse engineering. Plug in any model, or a local one.
CERT Kaiju is a binary analysis framework extension for the Ghidra software reverse engineering suite. This repository is a "mirror" -- please file tickets, bug reports, or pull requests at the upstream home in @CERTCC: https://github.com/certcc/kaiju
hotspot disassembler hsdis
An improved nm + Objective-C & Swift class-dump
Package Manager for Radare2
Some useful books related to Cybersecurity, Linux and more.
IDA plugin to pinpoint obfuscated code
A Python Bytecode Disassembler helping reverse engineers in dissecting Python binaries by disassembling and analyzing the compiled python byte-code(.pyc) files across all python versions (including Python 3.10.*)
Hexrays decompiler plugin that colorizes and filters the decompiler's output based on regular expressions
Ghidra scripts for recovering string definitions in Go binaries
A collection of over 200 Ghidra themes to make long hours of reverse-engineering even more enjoyable!
For our CCS24 paper 🏆 "ReSym: Harnessing LLMs to Recover Variable and Data Structure Symbols from Stripped Binaries" by Danning Xie, Zhuo Zhang, Nan Jiang, Xiangzhe Xu, Lin Tan, and Xiangyu Zhang. 🏆 ACM SIGSAC Distinguished Paper Award Winner
Decyx: AI-powered Ghidra extension for enhanced reverse engineering and binary analysis.
r2con2019 - slides and materials
Vulnerability research assistant that locates calls to potentially insecure API functions in a binary file.
Bindings of the r2 api for Valabind and friends
Ghidra language definition for the Gekko and Broadway CPU variant used in the Nintendo GameCube and Nintendo Wii respectively
Unpack pkg, nexe, caxa, Node.js SEA and Bun single-file binaries.
QtREAnalyzer, a Ghidra extension to reverse-engineer Qt binaries.
CLI tool, Ghidra plug-in, and Haskell library for analyzing binaries using under-constrained symbolic execution
Vulnerability research assistant that extracts pseudocode from the IDA Hex-Rays decompiler.
IDAPython plugin for finding function strings recursively
LummaC2 extracted binaries by reversing & LummaC2 Stealer Analysis
Run real Windows 98 apps and games in your browser. An x86 emulator and Win32 layer written directly in WebAssembly Text, no OS image, no source ports.
DarkNight theme for Ghidra
An IDA Pro plugin that display cross-references to functions or variables across the entire binary in Hex-Rays pseudocode
MrsPicky - An IDAPython decompiler script that helps auditing memcpy() and memmove() calls
A CHIP-8 interpreter, assembler and disassembler in C
Hextor - Hexadecimal editor and binary data analyzing toolkit
Xbox Executable Format (XBE) Loader Extension for Ghidra SRE framework
Reverse engineering assistant that extracts strings and related pseudocode from a binary file.
ASM2HEX is a powerful tool for bidirectional conversion between assembly language and hexadecimal machine code. Its intuitive graphical interface makes conversion easy and provides accurate, reliable results for ARM64, ARM, and Thumb instruction sets.
An installer and compiler for Ghidra for MacOS ARM64 or "Apple Silicon"
Ghidra decompiler plugin for LLDB
Extract labels from IDA, Ghidra, Binary Ninja, and Relyze files and export x64dbg database. Including radare2 main address.
IDA Pro plugin to show functions in a tree view
A Symbolic Ethereum Virtual Machine (EVM) bytecode interpreter, parser and decompiler, along with several other utils for programmatically extracting information from EVM bytecode.
Radare2 cheat-sheet
IDA Migrator is an IDA Pro plugin which helps migrate existing work from one database instance to another. It Conveniently migrates function names, structures and enums.
Automation tool for locating symbols & structs in binary (primary IDA focused)
Just a simple radare2 Jupyter kernel
Speculative disassembly, CFG recovery, and call-graph recovery from stripped binaries.
Stash for Binary Exploitation and Reverse Engineering Resources
An IntelliJ IDEA plugin for working on Ghidra Extensions.
A collection of IDA loaders for various game console ELF's. (PS3, PSVita, WiiU)
Binary rewriter for 64-bit PE files.
Ghidra scripts for malware analysis
Dive into Python code
radare2 + miasm2 = ♥
Headless AI agent for deterministic reverse engineering.
A Model Context Protocol (MCP) server that enables AI assistants to interact with IDA Pro for reverse engineering and binary analysis tasks.
Zydis Rust Bindings
jni.h compiled for Ghidra
Lua Encode/Decoder/Disassembler/Decompiler in C#
x86 Disassembler and Analyzer
webui repository for radare2
A plugin for IDA that can dump the ELF file easily.
Ghidra analysis plugin to locate cryptographic constants
Collaborative reverse engineering plugin for IDA Pro. Latest version, including IDA 7.0 support, is not back ward compatible with earlier versions. Substantial changes have been made to the protocol and database.
A (SLEIGH) disassembler that supports multiple architectures
Offline reverse-engineering toolchain for Bitwig Studio's Nitro DSP format — decrypt, decompile, and read the DSP behind every native device and Grid module. Tools + format specs only; no Bitwig source or keys.
Assembler/disassembler of Windows keyboard layouts in flat assembler
Various scripts for the Hexrays decompiler
No description supplied by the upstream repository.
A general purpose machine code manipulation library for x86-32 (IA-32) and x86-64 (AMD64) architectures (Assembler, Disassembler, Library).
Binary Ninja plugin for loading VTIL routines and lifting VTIL instructions to LLIL for analysis.
Symbol Recovery Tool for Nuitka Binaries
Discord rich presence plugin for IDA Pro 7.0
An ad-free Douban client implemented through iOS reverse engineering. Thanks for using it; stars are welcome.
The AI-friendly binary analysis & decompilation engine — 1:1 lift, built on LLVM [WIP]
Usermode NT Explorer - Query kernel addresses, translate virtual to physical addresses, inspect the PFN database, and more.
A verified map of reverse engineering and malware analysis. Disassemblers, unpacking, exploit dev, fuzzing, DFIR, and the deep-cut writeups other lists miss.
IDA Pro to Ghidra Key Bindings to feel like if you were in IDA Pro when navigating
Watcom Disassembly Tool (wcdatool) - Tool to aid disassembling DOS applications created with the Watcom Toolchain
An IDA pro plugin to display user-added comments in disassembly and pseudocode views.
Control Flow Flattening Deobfuscator for Obfuscator-LLVM as a plugin for IDA Pro.
School 42 project // Implementation of programming game “Core War” [Champions + Assembler + Disassembler + Virtual Machine + Visualizer]
Ghidra scripts for SNES ROM reverse engineering
An IDA Pro plugin to export data better
Python command-line tool and GDB extension to view and save x86, ARM and objdump assembly files as control-flow graph (CFG) pdf files
retools: a reverse engineering toolkit for normies
Unofficial YARA IDA Pro plugin, along with an unparalleled crypto/hash/compression rule set based on Luigi Auriemma's signsrch signatures.
Patchestry is a binary patching framework built with MLIR and Ghidra.
sigmaker for Ghidra
ida plugin to parse qt meta data
Software reverse engineering tool for Java
Pbd is a Python module to disassemble serialized protocol buffers descriptors (https://developers.google.com/protocol-buffers/).
A tracing disassembler & UI for Gameboy ROMs — integrated with Sameboy for emulation & debugging.
Ultimate Ghidra loader for the LX/LE executable file format (OS/2, DOS4GW, VxD)
A collection of modules and scripts to help with analyzing Nim binaries
IDA Pro plugin to display and search comments in the database
Disassembler for Racket
AI-Powered Autonomous Binary Reverse Engineering CLI — the native reverse engine from Innora-Sentinel. Local LLM inference (MLX), MPS GPU acceleration, multi-round iterative analysis, zero API cost.
A fully playable, work-in-progress native Sonic Adventure port for Windows, Linux and Steam Deck. Powered by KatanaRecomp.
Inlay hints for hex-rays
Tool that automates some useful structure routines in IDA PRO
A decompiler to automatically reverse-engineer the DNN semantics from its compiled binary using program analysis
ESP8266 and EPS32 firmware binaries analysis toolkit
Browser Assembler/Disassembler/Emulator Tool
IDA plugin to support automatic reverse engineering
Have you ever wondered: what if IDA had great Ctrl+F search support for Pseudocode windows? No longer!
Unofficial native PC port of WWE SmackDown vs. Raw 2011 (Xbox 360). Bring your own disc.
Learn the fundamentals of Binary Auditing. Know how HLL mapping works, get more inner file understanding than ever.
ViDi Visual Disassembler (experimental)
Executables created while writing "Introduction to Manual Backdooring".
Ubuntu on QNAP TS-453Be
Maybe the headless Ghidra MCP you are looking for.
Decompilation of Xenogears.
Leveraging CVEs as North Stars in vulnerability discovery and comprehension.
Docker image for building ghidra RE framework from source
Hide function calls to prevent reverse-engineering
A command line tool for extracting machine learning ready data from software binaries powered by Radare2
An AI-powered reverse-engineering copilot for assisting tedious malware analysis in IDA Pro.
Hashlink bytecode disassembler, analyzer, decompiler and assembler.
Framework to automate working with AST in IDA Pro
Tools for creating, modifying, assembling and disassembling RemObjects PascalScript files.
Easy-to-use IDA plugin for code emulation
Binja (sort of) headless
A Ghidra headless analyzer tailored for Qt binary analysis
Ghidra plugin to communicate with radare2
Alternative API for IDA / Hex-Rays
Matching decompilation of Brave Fencer Musashi (PS1, SLUS-00726): 218 binaries rebuild byte-identical from C
ElectroPaint Automatic No-source Object reaSsembler (a MIPS to C decompiler)
Solutions to some crackmes that I have done.
Ghidra plugin for https://analyze.intezer.com
An end-to-end pipeline for firmware analysis and cryptographic function detection. Static analysis (Ghidra), dynamic tracing (Qiling), and feature extraction to produce datasets for binary analysis.
IDA plugin that displays the P-code for the current function
RAIR: RAdare In Rust
IDA Pro plugin to aid PS4 user mode ELF reverse engineering.
a IDA 7.0 plugins that helps to attach process created by pwntools and debug pwn
Simple emulator of the Intel 4004 chip. Mirror from https://gitlab.com/lpg2709/emulator-Intel-4004
A deobfuscation plugin for IDA
Practical P-Code examples
libil2cpp symbol parser for ida
Builds of Ghidra 10.1 with additional components included.
Android Dex disassembler and Binary Ninja plugin
The reverse-engineering framework you can run anywhere, with nothing installed, and actually trust.
Best Open-Source Luau Obfuscator and Decompiler Suite 2026
Tiny RISC-V machine code monitor written in RISC-V assembly.
Resolve and invoke native APIs from Swift, Objective-C++, and C++ without writing mangled names or manual ABI casts.
Simple decompiler for Rizin. It's capable of generating readable pseudo code even on handmade assembly.
Semantic analysis engine for detecting vulnerability fixes in Windows kernel driver patches — 58 YAML rules, Ghidra decompilation, reachability tracing, and scoring
Binary Ninja plugin that can be used to apply Triton's dead store eliminitation pass on basic blocks or functions.
⚙️ Simple Step to Step Tutorials for Disassembling / Code Injection & getting Pointer Addresses 🔧
Reconstructing DX-Ball 1.07 with REA, backed by original-x86 differential tests and pinned MSVC byte-exact oracles.
Advanced reverse engineering platform combining traditional static analysis with AI-powered insights. Supports multiple decompilers (Ghidra, IDA Pro, Binary Ninja), automated function analysis, and interactive web visualization for comprehensive binary analysis workflows.
Binary Ninja plugin for reverse engineering PTX -- the virtual instruction set architecture of CUDA-based GPUs.
Block Redo & Undo To Achieve Legacy IDA
A Ghidra extension for scripting with GraalVM languages, including Javascript, Python3, R, and Ruby.
Corewars but within r2
IDA-names automatically renames pseudocode windows with the current function name.
Image preview plugin for IDA disassembler.
Hex-Rays Block Highlighter plugin for IDA to highlight if/for/do/switch/while blocks
No description supplied by the upstream repository.
Install and browse 100+ community themes for IDA Pro (Dracula, Monokai, Solarized and more)
bsdiff is a library for building and applying patches to binary files.
Hands-on challenges for learning how to reverse engineer Flutter applications.
Dragon Ball Z: Burst Limit Recompiled - native PC port via ReXGlue static recompilation
Ghidra Emulates Functions
It does the same thing as plugin FunctionStringAssociate for IDA, Now the script just works, in the future it is planned to increase the speed of work and bring it closer to the speed of the plugin.
Binary View plugin for reverse engineering iBoot like binaries with Binary Ninja
nanoMIPS module for Ghidra
Parse and disassemble .metallib files in browser
match functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.
r2inspect is a professional malware analysis framework that automates deep static inspection for PE, ELF, and Mach-O binaries using the radare2 ecosystem. It combines format parsing, detection heuristics, and rich reporting to support reverse engineers, incident responders, and threat analysts.
Access radare2 from anywhere, anytime.
A metamorphic binary transformation engine based on r2pipe and radare2.
The reverse-engineering expert agent: plans its own analysis path, derives every fact from raw evidence, and converges under mechanical verification gates — firmware, protocols, web/JS, risk-control, binaries.
Ruby, Kotlin, Groovy, Clojure, and JShell support for Ghidra scripting and interactive sessions.
High Level API on top of the R2Pipe interface
Proof of concept for reverse engineering and exploiting Android Unity IL2CPP games by patching assembly at runtime.
IDA, Ghidra and Radare2 scripts. Also Android scripts to make your life easier.
Chameleon is a polymorphic engine for x86_64 position independent shellcode that has been created out of the need to evade signature-based detections in red team environments.
Docker configuration (and only docker configuration) files for hosting self-hosted Hexvault, Lumina and Hexlicsrv.
A book on learning radare2.
Decompiler and reverse engineering tool for wasm binaries
A simple library focusing on demangling symbols for different programing languages
Track and analyze binary size and memory footprint in embedded firmware
Disassembly/Decompilation of Harvest Moon: Friends of Mineral Town
Example code for the online course Introduction to x86/x64 Software Reverse Engineering.
Neural Variable Renaming for Decompiled Binaries
Rust crate for r2pipe
An ad-free BiliBili jailbreak tweak. Thanks for using it; stars are welcome.
Transform binaries into source-code-like projects that coding agents can traverse, analyze, and use as an oracle for large binaries. Supports IDA Pro, radare2, angr and Binary Ninja.
Use binaryninja workflow to deflat ollvm cff
A simple but useful project maybe help you reverse Windows.
A Python 3.10+ library to pack and unpack structured binary data.
Import Device Tree Information onto your Ghidra memory map
Rebuilding SA-MP 0.3.7 R5 from source, byte for byte. AI-assisted reverse engineering with verifiable binary matches.
Boot real iPhone OS 3 — Apple's actual kernel, launchd & SpringBoard — inside an app on a modern iPhone. A from-scratch, full-system S5L8900/ARMv6 emulator in portable C.
Ultimate Mortal Kombat 3 (iOS, EA Mobile 2011), fully decompiled: all 2,572 game functions are readable C, checked against a static ARM-to-C recompiler. Native port in progress: menus, sound and saves run; fight data tables extracted from your copy and verified; not playable yet. No game assets - bring your own copy.
Reverse engineer Unity games with radare2
Static recompilation of Command & Conquer: Red Alert 2 / Yuri's Revenge (Westwood, 2000-01) to native C, with the remaster the engine never got: a D3D11 presenter, 720p to 4K, HD voxel units. Built on pcrecomp.
genpatch is IDA plugin that generates a python script for patching binary
Helper script for Linux kernel disassemble or debugging with IDA Pro on VMware + GDB stub (including some symbols helpers)
JavaScript bindings for Ghidra with AI agent support
User friendly ways to parse small code snippets into data types in Ghidra.
An IDA plugin which demangles Rust function names
Ctrl+P plugin for Ghidra: quick search and command palette.
A Ghidra script to export data to a x64dbg database
An old CLI tool to parse Intel/Motorola formatted HEX ASCII firmware files into binary blobs
Static recompiler for Nintendo 3DS games, from ARM to C
Binary blob analyzer and extractor based on C++
A visual and colorized diff for binary files.
deollvm arm64 based unicorn
Ghidra NES / Famicom ROM Decompiler Plugin
Discord Rich Presence plugin for Ghidra
How Tencent ACE (anogs) anti-cheat is built on iOS, and why naive attacks fail. Analysis, not a bypass
Standalone static version of Triton's x86/x64 translator
a radare2 plugin that decodes packets with Scapy
Supplement to radare2-explorations.
A repository of example plugins for Relyze Desktop.
msp430 Architecture plugin for Binary Ninja
Conversational black-box reverse-engineering agent on the pi coding agent — analyzes apk/.o/.hex/exe with a self-provisioning toolchain (radare2 · Ghidra · angr · jadx). Static analysis. Claude Code & Codex compatible.
A radare2 Python script to dump a raw IA32 binary to an NASM source file
Collection of malware analysis, binary exploitation and reverse engineering related resources
IDA Taskr is a pure Python library for IDA Pro related parallel computing. It lets you use the power of Qt (built-in to IDA!) and Python's powerful multiprocessing and asyncio systems to quickly process computationally intensive tasks without freezing IDA Pro. Oh, and it's super fast too.
Bump your ida python script automatically!
Open source release of the dirtyJOE - editor for the compiled java .class files.
A collection of useful radare2 scripts!
self-contained il2cpp to windows pdb generator (rust, x64, metadata v39)
BSimVis is a tool to analyze similarities across a collection of binaries, based on Ghidra analyzers and the BSim (Behavioral Similarity) plugin. It provides an API and Web interface to upload large quantities of decompiled binaries and BSim feature vectors to a Kvrocks database for similarity analysis, function diffing, and family clustering.
yara and radare2, better together
Tools to reverse the Toshiba FlashAir SD cards
Automatically identify and extract potential anti-debugging techniques used by malware.
Stack String Explorer is a ghidra plugin to find and report stack strings (and other constant strings). Identified strings are commented and placed in the defined strings window for easy analysis.
PS Vita port of The Binding of Isaac: Repentance by static recompilation of the PC executable to ARM.
rune - radare2 based symbolic emulator
Golang wrapper for @mendsley's bsdiff C library.
A very basic debundler for Javascript bundles compiled with React Native's bundler
Discover similar functions structures in binaries using graph theory.
Ghidra loader for decrypted iBoot, LLB, iBEC, iBSS and SecureROM images
IoT firmware vulnerability analysis tool based on binary code similarity analysis (BCSA)
IDA's Lumina feature, reimplemented for Ghidra
An unofficial French-language educational guide to REA (Reverse Engineer Anything): analyze applications and binaries with a coding agent through MCP and CLI, Hopper or Ghidra, backed by evidence. Includes the legal framework for reverse engineering. Upstream project: morluto/rea.
Import il2cppdumper data into a Binary Ninja plugin.
XrefsExt plugin for IDA Pro(idapython,ida plugin,ida plugins)
WIP Decompilation of Tactics Ogre: The Knight of Lodis (USA)
Python Module for Parsing & Reverse Engineering Mach-O Executables.
Generate data-flow graph and def-use graph for a function based on miasm and IDA Pro.
A Ghidra loader for 3DS files
Launch radare2 like a boss from pwntools in tmux
A IDA CLI tool built on Rust, idalib-rs, and idalib. Supports batch and concurrent IDA analysis processes, design for stateless, agent first, skill first, and automation first. Reduce AI understanding and friction costs, make agents to efficiently execute complex binary analysis tasks.
IDA Pro script to find interesting syscalls and patterns in binaries
Apple runtime introspection tools
Vagrant setup for building a machine for CTF/exploit development
BomLens — a local-first SBOM generator & open-source risk assessor (CycloneDX). Produce an SBOM, an open-source notice, and a security/license risk report from source code, containers, binaries, firmware, or an SBOM you received. CLI or web UI, no SaaS.
Agentic binary reverse engineering for ELF binaries on ARM64, ARMv7, x86_64 - hypothesis-driven analysis with radare2, Ghidra, GDB, QEMU
macOS port of opainject - ROP-based dylib injection to arm64(e) processes.
A practical handbook on reverse engineering. Covers embedded firmware (ARM Cortex-M, Xtensa/ESP32, RISC-V, 8051, MIPS), Linux userland, kernel modules and device trees, plus hardware attacks (fault injection, side-channel analysis). Uses radare2 as the primary tool example. PDF + web book.
MCP server for automated binary diffing.
AArch64 FEAT_CSSC support for IDA Pro (disassembler/Hex-Rays) and Ghidra
Scrape files for sensitive information, and generate an interactive HTML report. Based on Rabin2.
A better ghidra mcp, without bridges or external dependecies, just install and run. It uses the natvie MCP protocol
The GhidraLookup plugin aims to help user lookup documentations of Win API functions.
Reverse-engineering & re-implementation of OpenAI Computer Use macOS plugin for DeepSeek Harness: 10 MCP tools, JSON-RPC wire protocol, native Swift AX/screenshot/input daemon.
WIP Decompilation of Summon Night: Craft Sword Monogatari Hajimari no Ishi
Work with spice86 data into Ghidra
Binary, Analysis, and Disassembler Radare2 Plugins for Dan32 architechture binaries
A Python-based tool for analyzing IoT firmware, supporting both filesystem-based and RTOS-based (e.g. FreeRTOS, Zephyr) images. Features include binary header parsing, interrupt vector analysis, string extraction, entropy scanning, and more.
A Ghidra script to improve decompiled code readability by re-writing it (Using DeepSeek) in a better way, Along with renaming/assigning variables based on their usage.
r2 the Rhme3! The RHme (Riscure Hack me) is a low level hardware CTF that comes in the form of an Arduino board (AVR architecture). It involves a set of SW and HW challenges to test your skills in different areas such as side channel analysis, fault injection, reverse-engineering and software exploitation. In our talk we will briefly recap RHme2 and introduce the upcoming RHme3. This year we decided to create a special target called the Riscurino board which features CAN controllers for a real automotive hacking experience! During the r2con we challenge you to solve as many challenges as you can using radare2. Are you up to the task? By the time the r2con takes place the registration for RHme3 will be closed. However, we reserved 5 Riscurino boards for giving away during the conference. Be at r2con and win one of these boards by solving the qualification challenge(s) using radare2!
PoC code and tools for Black Hat EU 2020
An AI-powered extension for Ghidra that enhances analysis.
ARM 32-bit Raspberry Pi Hacking Hello World example in Kali Linux.
Source code of the paper "FirmRCA: Towards Post-Fuzzing Analysis on ARM Embedded Firmware with Efficient Event-based Fault Localization"
Sample radare2 project templates
The first-ever native PC port of the original Xbox Dashboard (build 3944) — static recompilation of xboxdash.xbe (x86 → C) on the xboxrecomp toolkit, with a D3D8→D3D11 backend.
Firmware analysis console for Magic Lantern
Reverse-engineering Legend of Legaia (PSX, 1999): Ghidra-traced format documentation, Rust extractors for every asset on the disc, and an engine reimplementation targeting wgpu/SDL3 with optional WASM. BYO-disc model, no assets distributed.
Anti Cheat runtime import resolver, how it rebuilds its IAT at load time to hide API usage from static analysis.
MediaTek MD32 processor module for Ghidra.
A protocol reverse engineering tool for industrial binary protocol based on pin tool
RevEng.AI Radare2 Plugin
Hub for iOS UE4 reverse-engineering notes (arm64/arm64e) and how they fit together
Reversing Roblox's Luau VM on iOS: functions, anchors, lua_State layout
Collection of IDA helpers
A Ghidra MCP Server for Claude Code - Binary Analysis Made Adorable. Keywords: ghidra, mcp, ghidra-mcp, model-context-protocol, binary-analysis, reverse-engineering, decompiler
Learning assembly x86 programming and reverse engineering
PICO8 Extractor is a user-friendly tool designed to convert PICO-8 JavaScript cart exports into binary .p8.rom files that can be directly loaded in the PICO-8 fantasy console.
Open source Filza Jailed tweak injector for iOS 17.0-26.0.1, adding jailed support for Filza IPA on supported devices
Local-first, deterministic MCP server for IDA Pro/Home: 109 strict-schema reverse-engineering operations, evidence-backed findings, and policy-gated IDB edits.
Memory Engine and Scanner for iOS/MacOS using Mach API
Advanced Python tool for extracting Protocol Buffer schemas from iOS IPA files. Perfect for reverse engineering, security research, and API analysis. Supports automatic .proto reconstruction, binary analysis, and comprehensive protobuf extraction from any iOS application.
C++ tool that converts WebAssembly (`.wasm`) binaries to JavaScript, with an optional AI-powered pass using the Gemini API to rename variables and summarize functions.
MediaTek CCPU (GCPU) processor module for Ghidra.
Beyond Dark Castle (1987, Mac) game disassembly, in Motorola 68000 assembly language.
Reverse engineering exchange format
Multi-LLM iOS reverse-engineering toolkit. 10-phase workflow with adapters for Claude Opus/Code, Cursor, Qwen Coder, MiniMax, Codex/GPT-5, Aider, Cline. Adapted from incogbyte/iOS-reverse-engineering-claude-skill (Unlicense).
A hexagonal, adapter-headed reverse-engineering platform — durable RE domain core + disposable protocol heads (MCP first). Sibling to GayHydra (Ghidra fork.)
A processor module for Ghidra for ASMedia's 8051-based chips.
Reverse-engineered Rust reimplementation of the Johnny Castaway screensaver (Screen Antics, Sierra/Dynamix, 1992) for Windows, macOS and Linux
Midnight Club: Los Angeles on iPhone and iPad — ARM64 static recompilation, native Metal, and an experimental 60 FPS patch. Bring your own game files.
ARM 32-bit Raspberry Pi Hacking Int example in Kali Linux.
Substrate tweak that fixes WPA2/WPA3 transitional WiFi on iOS 3.x-12.x by stripping unsupported AKM suites from the RSN IE parser
Hexagon disassembler code generator from the official instruction manual.
Gears of War 2 native PC port: the Xbox 360 game statically recompiled to x64 (not an emulator). 1440p/4K, FSR, 4K texture packs, keyboard & mouse, Android in progress. Bring your own copy.
Ghidra's development plugins, scripts, contributing. Presentation
Dump ntoskrnl.exe important offsets for building your navigation system in the Windows Kernel, using Radare2 and Rust
ReaCut — REA × CapCut: an independent, open-source video editor rebuilt from REA-assisted, authorized local behavior and format research. No copied CapCut proprietary code or assets. Offline desktop app + Codex plugin.
A learning-focused PE analysis engine with modular detectors, heuristic analysis, and HTML reporting.
A little commandline tool to start PowerPoint in merge mode.
Fast iOS decompiler & Mach-O disassembler in Rust — arm64, Objective-C class-dump, Swift metadata, and a native desktop GUI. Reads .ipa/App Store binaries directly, no Ghidra, IDA, radare2, or LLVM.
Naruto: Rise of a Ninja (Xbox 360) running natively on Android ARM64 — static recompilation, Vulkan, 360p to 4K, FXAA/FSR.
A Calculator plugin for Ghidra that adds a GUI calculator and right-click options for adding addresses, memory, and constant values to the calculator, as well as options for calculating distance between addresses.
Evaluating function diffing existing techniques
radare2 script to help on COM objects reverse engineering
Recover symbols, types, interfaces, and method signatures from stripped Go binaries. Ghidra, IDA, and Binary Ninja exporters included.
AI assisted tools for Ghidra. Azure OpenAI, DeepSeek, Anthropic Claude, Ollama.
Rust library to interface with BinDiff
What if Ghidra had a responsive UI?
Patches The Amazing Spider-Man 2 (iOS 1.3.1) to launch, play and save entirely offline, years after Gameloft's servers went dark. Nine arm64 instructions, no injected code, no size change.
A cross platform framework to recover driver's communication interface.
Reverse-engineering suite for omp: radare2 tools, evidence store, signed audit log, RE status band, and report generator.
Ghidra's plugin recursively search dependencies of the variable and change their names and types.
IDA Pro + ImGui
A library for creating and patching binary diffs. Based on bsdiff.
A Radare2 based Python module for Binary Analysis and Reverse Engineering.
MediaTek PCM (SPM) processor module for Ghidra.
radare2 based alternative to apktool
A toolsuite of advanced WASM static binary analysis tools designed to reverse engineer WebAssembly binaries.
Grand Theft Auto IV's engine, being rewritten in Rust one function at a time by AI agents, for 64-bit Windows, Windows on ARM and macOS. Contains no game code or assets.
r2 plugin to add MSDN documentation URLs and parameter names to imported function calls
Build and apply binary patches to Docker Images
Notes on Reverse Engineering EVM Bytecode
🔎 Function Change Differ | A diffing tool for binary files when comparing obfuscated and changed function contents between versions 🛠️
AMD Radeon F32 processor module for Ghidra.
Useful plugin for reverse engineering code that makes use of C++ protobuf
An open-source Python implementation and protocol mapping for the Even Realities G2 smart glasses, enabling full third-party interoperability, native dashboard control, and raw LC3 audio streaming via BlueZ.
A program diffing extension for Ghidra.
Midtown Madness 3 PC Native: an improved and modded MM3 PC port for Windows 10/11 x64. Xbox static recompilation with Direct3D 11, keyboard controls, widescreen, custom cars, gameplay fixes and performance improvements. Build from your own game disc.
Version Control Tool for Binary Format Files.
No description supplied by the upstream repository.
Radare2's ESIL in Rust
Automated Static, Hardware-Rooted & Dynamic HIL Security Analysis for Bare-Metal ESP32 (Xtensa & RISC-V) Firmware
An ad-free Douban jailbreak tweak. Thanks for using it; stars are welcome.
Writeups, scripts and solutions for CTFs, Hack the Box, Vulnhub, exploit challenges, pwnables, crackmes, etc. Anything goes.
A debloater for iOS apps
TriCore decompiler plugin for IDA Pro 9.2+
AI-Powered Reverse Engineering with 100% Ghidra API Access
Go package to interface with BinDiff
Reverse-engineering Atari ST binaries back into readable, verified C.
FASM .fas symbolic debug information loader for radare2
Call of Duty (2003) multiplayer, rebuilt from scratch in Rust. Client, dedicated server and bots that speak the original wire protocol for patch 1.1, 1.5 and United Offensive, dug out of the binaries and held to retail by captures. Bring your own copy of the game. Your 2003 aim is not included.
Experimental PSP static recompiler and native runtime using user-supplied lawful inputs.
Binwalk plugin for IDA Pro and Binary Ninja
Add read-only REST API to your Ghidra project
Matching decompilation of irix binary makemask
A feature-rich markdown editor plugin for Ghidra that supports collections of notes without leaving Ghidra.
A Raspberry Pi Pico RP2040 debug template repo with step-by-step instructions on how to freeze your MicroPython files into C firmware and reverse engineer the binary with OpenOCD and GDB.
Ghidra extension that parses C/C++ headers using libclang via Panama FFI and imports types into Ghidra's data type manager
Catch22 Hex Editor
Automation plugins for various reversing tasks in IDA.
A Ghidra plugin for native code metrics
XNU Image Tools is a multi-platform image processing toolkit for fuzzing UTI file formats.
iNES ghidra loader for Flare-on 6 challenge level 8
Binary Ninja plugin adding C166/ST10 architecture support for embedded firmware. Enables accurate disassembly and decompilation of C166/ST10 binaries for security analysis and reverse engineering.
Browse, extract and preview Black Desert Online .paz archives, with parsers for BDO binary formats.
Now you can 'disassemble' Reddit!
resource for learning & playing with radare
Open-source engine & MCP server for AI to read, write, and generate native Axure RP 11 prototype (.rp) files. Zero dependencies. Independent project, not affiliated with Axure.
Local, capability-aware MCP server for authorized AI-assisted macOS and iOS debugging, Simulator/device workflows, Apple binary analysis, profiling, and reproducible evidence.
Complete static recompilation of Aerobiz Supersonic for the Sega Genesis
Amiga m68k asm exporter for Ghidra
Qi-NX — reverse-engineering agents for DeepSeek Harness A reverse-engineering toolkit for DSH: three selectable Agent presets, an MCP server exposing the analysis tools, and a dependency-light Python toolkit for binaries and firmware.
Fast & clean & simple binary diffing plugin for IDA Pro 9.x – finds patched functions in seconds. No Diaphora slowness, no crashes, no bloat. Made by Sin.
Micro Machines (PC, 1994) rewritten in TypeScript from the disassembly, running natively in the browser. No emulator. Bring your own copy.
Desktop app for analysing iOS and macOS binaries. View headers, strings, classes, symbols, security findings, and more.
Reverse engineering and analysis of binary data
Enables the development of python ghidra plugins through pyghidra without Java.
Reverse-engineering toolchain for Denso SH705x ECUs featuring Ghidra scripts for calibration map extraction and a standalone PyQt6 viewer
🏗️ Template for building Revenge plugins
A Ghidra script to paste a raw blob into an analysed binary
radare2 script to fix disasm with call tricks for strings
I created r2-syscall-printer (radare r2pipe script) because I need now Linux-kernel interface call convention support (x86 & x86_64): %rdi, %rsi, %rdx, %r10, %r8, %r9. Also you can use this tool as standalone-app to print syscall table info
Purpose-built reverse engineering platform for Nintendo Switch firmware analysis. Parses NSO binaries, decodes AArch64 instructions, maps syscalls, and diffs firmware versions — designed to find what Ghidra can't.
A structured reverse-engineering field notebook for binary analysis, exploitation, mobile, firmware, wireless, and defensive research.
iOS 27 kernelcache RE: SEP dispatch map, AMFI diff, Ghidra workflow
Hacked script to show similarities between two samples using radare2 framework.
A cargo subcommand that displays ghidra function output through the use of the {rizin, radare2}-ghidra project
Performs firmware analysis on a given binary file.
A fully self-contained, isolated Ghidra 12.1.2 installation bundled with GhidraMCP, lx-loader, GhidraDosToolbox, and MCP bridge
AIDA-AUDIT: IDA Pro + MCP + AI agents for automated binary audit.
Run OFRAK remotely to modify and repack binaries from your browser
goodname.cfg for IDA Pro
MCP server exposing IDA reverse-engineering tools to LLM clients.
Repository to contain my notes from my self-study of binary exploitation and reverse engineering.
🛡️ The most comprehensive deobfuscation framework for Ghidra — OLLVM/Tigress deflattening, 60 MBA rules with Z3 proof, opaque predicates, BCF removal, string decryption, VM devirtualization, full pipeline. CLI + Plugin + Analyzer.
Modern Windows UI plugin for IDA Pro 9.3: rounded panels, dark styling, customizable fonts, and persistent appearance settings.
Decompiler for compiled iOS/macOS interface files (.nib, .storyboardc): object tree, wiring, custom classes, navigation graphs
A Python-based tool to synchronize Ghidra and x64dbg/x32dbg with minimal setup.
Security Research Suite for macOS binaries in Hopper Disassembler
This repository contains the dumped and deobfuscated version of GandCrabv5 JS Binary Dropper, along with the webpage files dropped on a GandCrab v5.1 infected system. The goal of this Repository is to attempt to make the files easier to work with and understand.
Windows x64 Unity IL2CPP metadata workbench for static dumping, package inspection, cross-version migration, and deterministic C++20 SDK generation with UniResolver.
Annotated disassembly of Temptations (Topo Soft, MSX, 1988). All 40,449 bytes of the game are explained, 100%, reproducible byte for byte.
Fugue database importer and exporter for IDA Pro.
Reverse engineering the Star NX-1020 9-pin dot-matrix printer: extracted resident fonts, labeled firmware disassembly, ROM maps, and full documentation
Matching decompilation research for StarCraft: Brood War 1.16.1 — reproducible x86 function reconstruction and exact byte comparison.
⚡ Autonomous reverse engineering engine & Model Context Protocol (MCP) server for binaries and applications in Systems Rust
The SandBlaster Plugin is a sophisticated extension for Ghidra that seamlessly integrates the functionalities of the SandBlaster tool into the Ghidra environment.
Static recompilation of Shufflepuck Cafe (Broderbund, 1988): the copy-protected 68k Mac binary reverse-engineered, unpacked byte-exact, and lifted to native C. Runs through a Toolbox HAL over SDL2.
macho_re is a lightweight lib for parsing Mach-O binaries.
IDA scripts for the REshare reverse-engineering exchange format
Patch iOS binaries to run on macOS
BMK4 (Braxton · Metal · Kisak · 4): a work-in-progress arm64 iOS port of LWSS's GPL-3.0 KisakCOD Call of Duty 4 decompilation. DXVK's D3D9 frontend proven on physical iPadOS. No game assets.
Open-source Windows app for ECU binary analysis and editing: automatic map and axis detection, hex/2D/3D views, supported checksum correction, and RomRaider / TunerPro XDF / CSV / JSON export.
Native C++/Win32 PE analysis & binary triage toolkit. Inspects headers/entropy, strips ASLR/NX, inverts branch logic (Jcc/RET), scans AOB signatures, and generates instant .1337 patches, Cheat Engine scripts, or trampoline DLL hooks
SmartFoxServer 2X binary protocol implementation for Python
Advanced Ghidra processor module for flawlessly reverse-engineering, disassembling, and decompiling AVR microcontrollers.
Reverse engineering with AI agents on Windows: verifying, measuring and visualising the tools agents use, with rea and Ghidra
Simple binary diffing tool written in python and built on top of angr.
Awesome Reverse Engineering Anything: tools, projects, case studies and research papers for websites, games, apps, binaries and firmware.
Enable full Ghidra support for the ESP32-P4 RISC-V microcontroller with custom Sleigh processor definitions, peripheral memory maps, and ROM symbol loading.
Lightweight PE/ELF binary analyzer written in C++17.
Nasty Bytes Detector — A Ghidra plugin that identifies tricky byte patterns designed to confuse disassembly and disrupt control flow analysis, helping reverse engineers uncover obfuscated code.
An IDA Pro plugin for binary pattern analysis and generation, featuring ARM64 assembly-to-pattern conversion capabilities.
Pure-Go IPA tweak injector. Inject dylibs into IPA files & sideload on iOS 17+. Byte-faithful pyzule/cyan rewrite.
Ghidra processor module (SLEIGH spec) for the Nintendo SuperFX / GSU-1 / GSU-2 co-processor — the enhancement chip in Star Fox, Yoshi's Island, Stunt Race FX, and Doom SNES.
An all-in-one binary designed to help with locating, extracting and identifying changes between APK versions
Hand-translating console games from disassembly into readable, modifiable JavaScript, not emulation. Every ROM routine becomes a JS function you own, verified frame-by-frame against the real ROM running in an emulator. Batman (Game Boy) complete; Gradius (NES) plays end to end; DoDonPachi DaiOuJou (arcade) in progress. No ROM included.
The 1994 DOS game LineWars II, reconstructed in C from its shipped binary and held to the original by 41 test gates, 27 of which execute the 1994 machine code in an emulator. Builds with Open Watcom, runs in DOSBox-X. Freeware with the original author's permission.
Save editor for DragonSword Awakening (2026): decrypts the SQLCipher save, edits currency, items, cooking recipes, costumes, mounts and titles in a local browser UI. Pure Go, no CGO, single static binary for Linux & Windows.
AI-assisted reverse engineering tool built on Ghidra and MCP.
Divide-and-conquer binary diffing framework
A personal project aiming to solve real systems problems within a specific domain: a modular desktop and cloud systems platform for automated crash diagnostics (SAGE RAG), content-addressed storage (Aduana), static JVM bytecode security, and binary NBT recovery.
Unofficial disassembly-backed native Windows port of SimTower (source only; original game assets excluded)
Reverse engineer anything. Port it anywhere. One CLI and MCP server that lets any coding agent take apart apps, games, binaries and websites — and port them to Godot, Unity, Unreal, three.js or any language.
Read-only iOS system monitor for TrollStore. Processes, entitlements, Mach-O layout, XPC daemons, IOKit registry. Low-level C/C++ + Swift/UIKit.
A native C++ CLI toolkit for reverse engineering binaries.
Simple script for ghidra to rename the default function names into better looking names that can be differed from afar
Binary reverse engineering toolkit in C - file analysis, ELF/PE parsing, entropy scanning, string extraction, and optional disassembly.
Decompile the web's bleeding edge. The premier Ghidra processor module for reverse-engineering Wasmtime's portable Pulley ISA.
Reassembles split Qualcomm firmware for Ghidra, and recovers source file and line from the debug metadata left in the binary
A small, code-first home hub for reverse-engineered and custom devices. Every device is a package with its own screens, settings and safety rules. Local, self-hosted, next to Home Assistant.
A Claude Code mod that keeps a live casebook of the Evidence rea gives the agent: Ghidra cold start, findings that must cite real evidence_id values, Markdown export.
The reader you can read. Dependency-free Mach-O introspection for reverse engineers, security researchers, and build engineers — fat headers, symbols, instruction boundaries and branch edges, with a versioned JSON contract, an MCP server and an Agent Skill. Live audit report: https://ranjithrajv.github.io/MachO-explorer/
WebAssembly analysis and decompilation support for Ghidra, developed and maintained for Ghidra 12.1.4.
Patched PEDA for modern Python and GDB environments
This repository contains a detailed technical report documenting the unpacking process of a Dridex malware sample. The analysis was performed in a controlled virtualized environment using x32dbg, Process Hacker, and PE-bear to locate, extract, and partially reconstruct PE images from memory.
Identifies machine code in binary files.
Visualize binary data and C struct memory layouts as interactive SVG diagrams in Obsidian
MCP server exposing the ghidriff Ghidra binary-diffing engine as tools for AI agents
A restrained, modern desktop theme plugin for IDA Pro 9.3, featuring scoped Qt styling and automatic theme persistence.
A file-first editor with a native macOS shell and shared Rust core. Markdown today, broader document editing over time.
Generate intelligent wildcard byte signatures from x86 disassembly. Supports x64dbg, Cheat Engine, and raw hex formats.
Dragon Quest IX (EU) research: Nintendo DS decompilation tooling, ARM/Thumb static recompilation, and experimental SDL2/Godot native runtime. No game data.
A collection of personal ghidra scripts
BinExport for Ghidra 12.x (12.1.2). Patched build of google/binexport that fixes the NoSuchFieldError LabelString$LabelType.CODE_LABEL crash (issue #166) blocking BinExport + BinDiff on Ghidra 12.0+. Prebuilt Ghidra extension + headless export. Ghidra → BinExport → BinDiff pipeline restored.
Browser-based x86-64 assembly visualizer: instruction breakdown, stack frame behavior, and control flow in AT&T syntax. Built as a learning companion for Harvard CS61.
A simple Ghidra plugin to keep notes while reverse engineering
Windows ChatGPT/Codex frontend reverse-engineering workspace: recovered UI contracts, original-runtime demos, evidence, and a deferred native Rust port.
User-mode reverse-engineering memory dumper for Windows. Reconstructs packed, hollowed, and manually-mapped processes into IDA/Ghidra-loadable PEs with rebuilt imports.
Reverse-engineering Anarchy Sound Software's SwarmSynth (2003) by measuring it, not disassembling it. Wine-hosted VST2 rig, JUCE recreation, WebAssembly build.
Firmware image in, CycloneDX SBOM and EU Cyber Resilience Act gap checklist out. Reads opkg/dpkg package databases, Yocto SPDX manifests and ESP-IDF headers straight out of a binary, with no unblob or binwalk required.
No description supplied by the upstream repository.
Bridge Ghidra to MCP and WebSocket JSON-RPC for program analysis and automation
Diff two firmware images and surface exactly what changed: new binaries, flipped config flags, added certs, and shifted entropy regions.
IDA static analysis and runtime memory verification for classic WinMine
BinaryPacketsDSL is a domain-specific language and toolkit for describing, parsing, and analyzing binary protocol packets. It is designed for clarity, robustness, and testability, with support for structured definitions, modifiers, and dynamic field handling.
Alley Cat (1984): byte-exact disassembly, static JavaScript translation, and HD graphics with a live CGA comparison slider.
Epson S1C33000 support in Ghidra
🔐 AI/ML-powered tool for identifying cryptographic primitives in multi-architecture firmware binaries. Built with Streamlit, scikit-learn & Plotly.
Full-stack C decompilation (ARM9/ARM7/overlays, 7,140 functions), asset extraction pipelines and hardware research for Dragon Quest Monsters: Joker (NDS). Contact: [email protected]
Browser-based viewer for ELF file structure, focused on RISC-V.
Fast, zero-dependency, no_std Rust crate for scanning PE signatures with IDA-style patterns
Local web dashboard unifying OSINT, reverse engineering, binary exploitation, web/directory recon, and cryptography tools for CTF and authorized security research — upload a file, click Run, get a result.
Static security analyzer for Android APK and iOS IPA packages (authorized review, static only). Built-in binary AXML decoder, manifest and Info.plist checks, JSON and SARIF output.
A Ghidra processor extension for the Altera Nios II
No description supplied by the upstream repository.
Binwalk FZ scans firmware/binary files on Flipper microSD for validated signatures and offsets. Adds Linux/Raspberry Pi mode using upstream Binwalk, with Flipper as UART controller and results display.
reverse engineering assistant for strings, IOCs, imports, and Ghidra assisted analysis
Compare binaries inside Binary Ninja with synchronized graph and linear diffs, corpus comparisons, and symbol transfer.
Automated static-analysis pipeline for embedded Linux firmware. Systematically extracts and audits credentials, cryptographic keys, password hashes, ELF binary hardening, unsafe C functions, and debug interfaces.
Automated vulnerability assessment and risk analysis platform with Nmap scanning, CVE intelligence, binary analysis, YARA threat detection, and PDF security reporting
An in-depth technical investigation of REA: source-code mechanisms, original papers, reproducible experiments, and evidence-driven behavior reconstruction.
Fast, open binary diff for ELF/PE — reports structural changes and, for x86-64, which functions were added, removed, or modified. Rust CLI + library.
TypingMaster 12.0.1.981 - full reverse-engineering source tree, analysis and documentation
PS2 look for GTA San Andreas – The Definitive Edition: skygfx-style colour filter, PS2 timecyc, radiosity, SpeedFX, grain, neo water drops, GTA fog – on top of DE's modern renderer. x64 ASI plugin with an in-game debug menu.
Complete static reconstruction of vgui2.dll (GoldSrc) from its binary: our own code, the original ABI, 349/349 methods, 18 tests, GPL v3.
A Steam installation of The Murder of Sonic the Hedgehog (SEGA, 2023), measured file by file: 178 files, 468,913,725 bytes; four UnityFS bundles opened with residue 0; 996,569,296 headerless side-file bytes attributed, 433 left over; and 124 of 137 binaries carrying a hash where a date should be. No game assets here, only measurements.
A set of five plugins designed to work in Ghidra providing support for Debugging, Config Extraction, API Mapping, Visualisation and Taint Analysis
Discord Rich Presence extension for Ghidra with customizable display, privacy and session options.
100% client-side multi-architecture static disassembler
Ghidra for local AI models — decompile, inspect, and patch GGUF / LoRA / Ollama models in a visual workbench, and build new ones from modular "sector" adapters. No retraining required.
Reverse-engineer runnable targets (websites, SPAs, browser apps, mini programs, Electron, binaries) into evidence-backed mechanism notes, then distill them into build-ready functional specs.
Real-world reverse engineering with AI agents. Explore REA case studies, software reconstructions, demos, source code, and the evidence behind each result.
Learn assembly from zero: ARM64 on Apple Silicon, plus x86-64, RISC-V, reverse engineering, WebAssembly, and hands-on projects — served as a clean Astro course site.
Open, local-first reverse engineering platform — PE/ELF/Mach-O, x86/x64/AArch64 disassembly, graphs, pseudocode. Rust engine, desktop app.
A browser re-implementation of PopCap's Insaniquarium Deluxe (2004), built on constants recovered by decompiling the original binary rather than tuned by feel. TypeScript, Phaser 3, a pure deterministic simulation, 4,967 tests.
AXI-compliant CLI for agent-driven Flutter app automation - widget-tree snapshots, driver interactions, native device control, multi-app orchestration
Learn reverse-engineering techniques, covering static and dynamic analysis as well as advanced binary protections such as packing, obfuscation and encryption.
Firmware binary analysis tool in Rust — magic byte scanning, Shannon entropy analysis, string extraction and JSON reporting for embedded security research.
Ω Zero-dependency JS security scanner — deobfuscates webpack bundles, AST taint tracking, SW analysis, chunk graph. 273 findings on Juice Shop in 10.7s. Termux-native.
A blog post on how i reverse engineered the osu!collector app
ARMv7-M (Thumb) instruction decoder and disassembler in Python - full instruction set, objdump-compatible output, generated from a YAML spec.
Python library for analyzing malicious binaries through emulation, pattern matching, and integration with reverse engineering tools.
EA Sports Cricket 07 (2006) running in the browser: every function statically recompiled from x86 to C, then WebAssembly, with Direct3D 8 rebuilt on WebGPU. Bring your own copy.
Non-destructive reverse engineering of the TP-Link Archer C7 v1.1 router. Includes UART access, full NOR flash dump without desoldering, firmware analysis, kernel binary patching, proprietary image reconstruction, and temporary RAM boot (TFTP) to obtain an early root shell.
A local multi-agent AI system featuring two specialised assistants: a software development assistant for code generation and review, and a reverse engineering assistant for analysing assembly and decompiled binaries.
Play EA Sports Rugby 08 (PC, 2007) in the browser: static recompilation of the x86 game to WebAssembly, Direct3D 8 on WebGL 2. Installable PWA. Bring your own copy.
Academic security project demonstrating an Android repackaging attack, where a legitimate APK is disassembled, modified with malicious smali code, re-signed, and redeployed to perform privacy-invasive actions such as contact deletion and location tracking (Information Technology Security, UNIWA).
Educational, cloud-free React Native companion for Oura rings, built on the reverse-engineered open_oura BLE protocol. Scores computed on-device. Not affiliated with Oura.
A single-file, offline analyzer for source code, binaries, packages, documents, SBOMs, and security metadata — entirely in your browser.
Python tooling for embedded benchmark analysis — objdump call-graph parser, .map code-size extractor, ARM vs RISC-V visualisation
Windows build & precompiled binaries for blutter - Flutter/Dart AOT snapshot reverse engineering tool (upstream: worawit/blutter)
A byte-oriented matching language for finding meaning in changing binaries. MAML stands for Mahmoud's Address Matching Language
Marimo notebook to compare and search the binary diffing results.
No description supplied by the upstream repository.
Evidence-first binary and firmware analysis. Every finding is a structured claim linked to the artifacts that support it - free-text security claims are unrepresentable by design. Builds on Ghidra headless and binwalk; zero runtime dependencies.
Preserve compiled ARM64 code and initialized objects as portable Node and browser APIs.
Learn binary file structure from examples and build guarded standalone editors, entirely in your browser.
Digging symbols out of TI WiLink firmware. Ghidra loader plus symbolisation: starts from the debug trace database TI forgot to strip, deduces the rest from the binary itself. 435 named functions, 358 inferred MMIO registers, 82 source modules.
Automated Ghidra headless scripts for batch decompilation, metadata extraction, and programmatic memory constant retrieval.
Ghidra extension that resolves x86 DOS/BIOS interrupt calls using Ralf Brown's Interrupt List
Unofficial Zalo Linux port (x86_64) — every native module ported: file-utils, file-utilities, zwalker, zfile, v8-profiles, mp4thumb, zimage, zjxl, zcall wire bridge + live call recon
KUDU (KUliah DUlu) is a personal hobby project combining UIN Jakarta campus services, such as academics, e-letters, and other services, in one integrated application.
Scriptable multi-format disassembler & decompiler — a browser-based Hopper alternative
Automotive Red Team platform featuring CAN spoofing, CAN replay attacks, Gateway IDS/IPS, native C SocketCAN ECUs, ARM firmware analysis, and Ghidra-based reverse engineering.
DVFA: A FinTech security lab mapping 10 vulnerabilities to the OWASP Mobile Top 10. Focused on AOT binary analysis, deep link hijacking, and SQL injection, featuring a Dockerized mock backend.
Ghidra language module for Infineon C166/XC166 (Tasking VX-C166) firmware
A reproducible firmware-security pipeline for OpenWRT 22.03 on ath79/MIPS
Hermes bytecode disassembler and assembler for React Native bundles
A security-first, API-driven data workbench being built in Rust. Inspired by CyberChef, designed for encoding, decoding, cryptography, and binary analysis through composable recipes, with browser-based WebAssembly and optional server execution.
See inside a Windows DLL: colour-coded memory map, explained PE headers, imports/exports, PDB symbols and live disassembly - 100% in your browser.
MONSTRUM (Team Junkfish, Unity 5.5, 2018) from a GOG Galaxy install, read as bytes: 19 serialized files, 825 textures closed and rendered, 2,215 FSB5 banks, 9 escape films, the assembly to its members, a co-op at zero, the owner's play log and a 2018 minidump.
A GOG offline installer measured as an object: 2 files, 2,891,523,108 B, 100.0000 % placed with residue 0. Inno Setup 5.6.2 Unicode over a shop naming layer derived here -- 788 files it would write, never run. Five content descriptors. 101 of 101 script opcodes of the 1994 original in the 2024 assembly.
A high-performance C++ forensic tool for deep binary analysis of Qualcomm (SD665) firmware dumps. Specialized in identifying Gatekeeper hash patterns and secure element signatures using advanced heuristic pattern matching.
Picture Man 1.55 (1991-1993), the true-color image editor for Windows 3.x, rebuilt in Rust from its binaries - runs on the desktop and in the browser
Static analyzer for Flutter/Dart AOT snapshots
Unofficial REA tutorials and comparisons for installing and using Reverse Engineer Anything with coding agents.