# Native binaries

> Browse 837 repositories with project descriptions, upstream links, and license information.

Automatically discovered repository index, unreviewed. Stars, licenses and last-push times are collection-time snapshots.
Selection published: 2026-10-20 UTC

- HTML: <https://awesomerea.org/browse/native-analysis/>
- JSON: <https://awesomerea.org/browse/native-analysis/index.json>
- 简体中文: <https://awesomerea.org/zh/browse/native-analysis/index.md>

- [NationalSecurityAgency/ghidra](https://github.com/NationalSecurityAgency/ghidra): 88,799 stars · Apache-2.0 · last push 2026-10 · Ghidra is a software reverse engineering (SRE) framework
- [WerWolv/ImHex](https://github.com/WerWolv/ImHex): 55,252 stars · GPL-2.0 · last push 2026-10 · 🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.
- [radareorg/radare2](https://github.com/radareorg/radare2): 25,054 stars · last push 2026-10 · UNIX-like reverse engineering framework and command-line toolset
- [rizinorg/cutter](https://github.com/rizinorg/cutter): 20,030 stars · GPL-3.0 · last push 2026-09 · Free and Open Source Reverse Engineering Platform powered by rizin
- [mytechnotalent/Reverse-Engineering](https://github.com/mytechnotalent/Reverse-Engineering): 14,719 stars · Apache-2.0 · last push 2026-10 · A FREE comprehensive reverse engineering tutorial covering x86, x64, 32-bit/64-bit ARM, 8-bit AVR and 32-bit RISC-V architectures.
- [mrexodia/ida-pro-mcp](https://github.com/mrexodia/ida-pro-mcp): 12,922 stars · MIT · last push 2026-09 · AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.
- [horsicq/Detect-It-Easy](https://github.com/horsicq/Detect-It-Easy): 11,732 stars · MIT · last push 2026-10 · Program for determining types of files for Windows, Linux and MacOS.
- [LaurieWired/GhidraMCP](https://github.com/LaurieWired/GhidraMCP): 11,297 stars · Apache-2.0 · last push 2026-10 · MCP Server for Ghidra
- [unicorn-engine/unicorn](https://github.com/unicorn-engine/unicorn): 9,451 stars · GPL-2.0 · last push 2026-08 · Unicorn CPU emulator framework (ARM, AArch64, M68K, Mips, Sparc, PowerPC, RiscV, S390x, TriCore, X86)
- [angr/angr](https://github.com/angr/angr): 9,189 stars · BSD-2-Clause · last push 2026-10 · A powerful and user-friendly binary analysis platform!
- [mandiant/flare-vm](https://github.com/mandiant/flare-vm): 9,147 stars · Apache-2.0 · last push 2026-10 · A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.
- [capstone-engine/capstone](https://github.com/capstone-engine/capstone): 9,107 stars · last push 2026-10 · Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.
- [albertan017/LLM4Decompile](https://github.com/albertan017/LLM4Decompile): 7,134 stars · MIT · last push 2026-02 · Reverse Engineering: Decompiling Binary Code with Large Language Models
- [mandiant/capa](https://github.com/mandiant/capa): 6,247 stars · Apache-2.0 · last push 2026-10 · The FLARE team's open-source tool to identify capabilities in executable files.
- [0xZ0F/Z0FCourse_ReverseEngineering](https://github.com/0xZ0F/Z0FCourse_ReverseEngineering): 5,962 stars · AGPL-3.0 · last push 2026-07 · Reverse engineering focusing on x64 Windows.
- [bethington/ghidra-mcp](https://github.com/bethington/ghidra-mcp): 5,659 stars · Apache-2.0 · last push 2026-10 · Ghidra MCP Server — 200+ MCP tools for AI-powered reverse engineering. GUI plugin + headless server, lazy tool loading, convention enforcement, batch operations, Ghidra Server integration, and Docker deployment.
- [lief-project/LIEF](https://github.com/lief-project/LIEF): 5,595 stars · Apache-2.0 · last push 2026-10 · LIEF - Library to Instrument Executable Formats (C++, Python, Rust)
- [pret/pokered](https://github.com/pret/pokered): 4,993 stars · last push 2026-10 · Disassembly of Pokémon Red/Blue
- [kaitai-io/kaitai_struct](https://github.com/kaitai-io/kaitai_struct): 4,712 stars · last push 2026-10 · Kaitai Struct: declarative language to generate binary data parsers in C++ / C# / Go / Java / JavaScript / Lua / Nim / Perl / PHP / Python / Ruby / Rust
- [zrax/pycdc](https://github.com/zrax/pycdc): 4,651 stars · GPL-3.0 · last push 2026-04 · C++ python bytecode disassembler and decompiler
- [extremecoders-re/pyinstxtractor](https://github.com/extremecoders-re/pyinstxtractor): 4,505 stars · GPL-3.0 · last push 2026-07 · PyInstaller Extractor
- [JonathanSalwan/ROPgadget](https://github.com/JonathanSalwan/ROPgadget): 4,498 stars · last push 2026-06 · This tool lets you search your gadgets on your binaries to facilitate your ROP exploitation. ROPgadget supports ELF, PE and Mach-O format on x86, x64, ARM, ARM64, PowerPC, SPARC, MIPS, RISC-V 64, and RISC-V Compressed architectures.
- [orhun/binsider](https://github.com/orhun/binsider): 4,481 stars · Apache-2.0 · last push 2026-10 · Analyze ELF binaries like a boss 😼🕵️‍♂️
- [joxeankoret/diaphora](https://github.com/joxeankoret/diaphora): 4,428 stars · AGPL-3.0 · last push 2026-10 · Diaphora, the most advanced Free and Open Source program diffing tool.
- [zyantific/zydis](https://github.com/zyantific/zydis): 4,393 stars · MIT · last push 2026-07 · Fast and lightweight x86/x86-64 disassembler and code generation library
- [JonathanSalwan/Triton](https://github.com/JonathanSalwan/Triton): 4,332 stars · Apache-2.0 · last push 2026-10 · Triton is a dynamic binary analysis library. Build your own program analysis tools, automate your reverse engineering, perform software verification or just emulate code.
- [rocky/python-uncompyle6](https://github.com/rocky/python-uncompyle6): 4,331 stars · GPL-3.0 · last push 2026-10 · A cross-version Python bytecode decompiler
- [mandiant/flare-floss](https://github.com/mandiant/flare-floss): 4,189 stars · Apache-2.0 · last push 2026-10 · FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
- [cea-sec/miasm](https://github.com/cea-sec/miasm): 3,992 stars · GPL-2.0 · last push 2026-09 · Reverse engineering framework in Python
- [rizinorg/rizin](https://github.com/rizinorg/rizin): 3,972 stars · LGPL-3.0 · last push 2026-10 · UNIX-like reverse engineering framework and command-line toolset.
- [icedland/iced](https://github.com/icedland/iced): 3,592 stars · MIT · last push 2026-10 · Blazing fast and correct x86/x64 disassembler, assembler, decoder, encoder for Rust, .NET, Java, Python, Lua
- [joernio/joern](https://github.com/joernio/joern): 3,576 stars · Apache-2.0 · last push 2026-10 · Open-source code analysis platform for C/C++/Java/Binary/Javascript/Python/Kotlin based on code property graphs. Discord https://discord.gg/vv4MH284Hc
- [JusticeRage/Gepetto](https://github.com/JusticeRage/Gepetto): 3,487 stars · GPL-3.0 · last push 2026-08 · IDA plugin which queries language models to speed up reverse-engineering
- [ljagiello/ctf-skills](https://github.com/ljagiello/ctf-skills): 3,459 stars · MIT · last push 2026-10 · Agent skills for solving CTF challenges - web exploitation, binary pwn, crypto, reverse engineering, forensics, OSINT, and more
- [horsicq/DIE-engine](https://github.com/horsicq/DIE-engine): 3,314 stars · MIT · last push 2026-10 · DIE engine
- [google/bindiff](https://github.com/google/bindiff): 3,207 stars · Apache-2.0 · last push 2026-09 · Quickly find differences and similarities in disassembled code
- [plasma-disassembler/plasma](https://github.com/plasma-disassembler/plasma): 3,071 stars · GPL-3.0 · last push 2021-08 · Plasma is an interactive disassembler for x86/ARM/MIPS. It can generates indented pseudo-code with colored syntax.
- [uxmal/reko](https://github.com/uxmal/reko): 2,617 stars · GPL-2.0 · last push 2026-10 · Reko is a binary decompiler.
- [BinaryAnalysisPlatform/bap](https://github.com/BinaryAnalysisPlatform/bap): 2,262 stars · MIT · last push 2026-05 · Binary Analysis Platform
- [Dryxio/reagent](https://github.com/Dryxio/reagent): 2,100 stars · MIT · last push 2026-09 · Reconstruct and validate C/C++ code from compiled programs with AI.
- [KasperskyLab/hrtng](https://github.com/KasperskyLab/hrtng): 1,949 stars · GPL-3.0 · last push 2026-09 · IDA Pro plugin with a rich set of features: decryption, deobfuscation, patching, lib code recognition and various pseudocode transformations
- [yetone/native-feel-skill](https://github.com/yetone/native-feel-skill): 1,931 stars · MIT · last push 2026-05 · An Agent Skill for designing cross-platform desktop apps that feel native — distilled from Raycast's 2.0 deep-dive and reverse engineering of Raycast Beta.app. Eight architectural tenets, four-layer architecture, WebKit/WebView2 survival guide, 75-item ship audit.
- [keystone-engine/keypatch](https://github.com/keystone-engine/keypatch): 1,882 stars · GPL-2.0 · last push 2024-09 · Multi-architecture assembler for IDA Pro. Powered by Keystone Engine.
- [airbus-seclab/bincat](https://github.com/airbus-seclab/bincat): 1,880 stars · last push 2025-02 · Binary code static analyser, with IDA integration. Performs value and taint analysis, type reconstruction, use-after-free and double-free detection
- [redasm-dev/redasm](https://github.com/redasm-dev/redasm): 1,822 stars · GPL-3.0 · last push 2026-10 · The Open Source Disassembler
- [cmu-sei/pharos](https://github.com/cmu-sei/pharos): 1,739 stars · last push 2026-09 · Automated static analysis tools for binary programs
- [KeenSecurityLab/BinAbsInspector](https://github.com/KeenSecurityLab/BinAbsInspector): 1,681 stars · GPL-3.0 · last push 2024-06 · BinAbsInspector: Vulnerability Scanner for Binaries
- [mytechnotalent/Hacking-Windows](https://github.com/mytechnotalent/Hacking-Windows): 1,637 stars · Apache-2.0 · last push 2026-10 · A FREE Windows C development course where we will learn the Win32API and reverse engineer each step utilizing IDA Free in both an x86 and x64 environment.
- [Jon-Becker/heimdall-rs](https://github.com/Jon-Becker/heimdall-rs): 1,626 stars · MIT · last push 2026-10 · Heimdall is an advanced EVM smart contract toolkit specializing in bytecode analysis and extracting information from unverified contracts.
- [vtil-project/VTIL-Core](https://github.com/vtil-project/VTIL-Core): 1,607 stars · BSD-3-Clause · last push 2026-07 · Virtual-machine Translation Intermediate Language
- [m4b/goblin](https://github.com/m4b/goblin): 1,555 stars · MIT · last push 2026-08 · An impish, cross-platform binary parsing crate, written in Rust
- [igogo-x86/HexRaysPyTools](https://github.com/igogo-x86/HexRaysPyTools): 1,541 stars · last push 2024-08 · IDA Pro plugin which improves work with HexRays decompiler and helps in process of reconstruction structures and classes
- [mandiant/flare-learning-hub](https://github.com/mandiant/flare-learning-hub): 1,496 stars · Apache-2.0 · last push 2026-03 · Free educational content on reverse engineering and malware analysis from the FLARE team
- [angusdevgo/Seep-Reverse-Lab](https://github.com/angusdevgo/Seep-Reverse-Lab): 1,462 stars · GPL-3.0 · last push 2026-10 · Agent-Native multi-platform reverse engineering and CWE-602 client-side authorization audit workbench.
- [hteso/iaito](https://github.com/hteso/iaito): 1,461 stars · GPL-3.0 · last push 2021-04 · This project has been moved to:
- [programa-stic/barf-project](https://github.com/programa-stic/barf-project): 1,455 stars · BSD-2-Clause · last push 2019-11 · BARF : A multiplatform open source Binary Analysis and Reverse engineering Framework
- [L4ys/LazyIDA](https://github.com/L4ys/LazyIDA): 1,447 stars · MIT · last push 2026-01 · Make your IDA Lazy!
- [WPeace-HcH/WPeGPT](https://github.com/WPeace-HcH/WPeGPT): 1,425 stars · last push 2026-05 · An IDA plugin for binary file analysis, powered by AI models such as OpenAI and DeepSeek.
- [syssec-utd/pylingual](https://github.com/syssec-utd/pylingual): 1,420 stars · GPL-3.0 · last push 2026-10 · Python decompiler for modern Python versions.
- [fkie-cad/cwe_checker](https://github.com/fkie-cad/cwe_checker): 1,362 stars · LGPL-3.0 · last push 2026-09 · cwe_checker finds vulnerable patterns in binary executables
- [gdabah/distorm](https://github.com/gdabah/distorm): 1,340 stars · last push 2023-10 · Powerful Disassembler Library For x86/AMD64
- [tobefuturer/restore-symbol](https://github.com/tobefuturer/restore-symbol): 1,338 stars · last push 2020-08 · A reverse engineering tool to restore stripped symbol table for iOS app.
- [viruscamp/luadec](https://github.com/viruscamp/luadec): 1,334 stars · last push 2024-02 · Lua Decompiler for lua 5.1 , 5.2 and 5.3
- [Vector35/binaryninja-api](https://github.com/Vector35/binaryninja-api): 1,327 stars · MIT · last push 2026-10 · Public API, examples, documentation and issues for Binary Ninja
- [2akouwu/reverify](https://github.com/2akouwu/reverify): 1,297 stars · MIT · last push 2026-10 · Stop your AI from making things up — it proposes, deterministic tools decide, every claim checked against ground truth with evidence. Grounded facts and context survive resets. Reverse engineering is the proving ground. MCP server + CLI.
- [rocky/python-decompile3](https://github.com/rocky/python-decompile3): 1,275 stars · GPL-3.0 · last push 2026-07 · Python decompiler for 3.7-3.8 Stripped down from uncompyle6 so we can refactor and start to fix up some long-standing problems
- [rdbo/libmem](https://github.com/rdbo/libmem): 1,263 stars · AGPL-3.0 · last push 2026-08 · Advanced Game Hacking Library for C, Modern C++, Rust and Python (Windows/Linux/FreeBSD) (Process/Memory Hacking) (Hooking/Detouring) (Cross Platform) (x86/x64) (DLL/SO Injection) (Internal/External) (Assembler/Disassembler)
- [horsicq/XPEViewer](https://github.com/horsicq/XPEViewer): 1,241 stars · MIT · last push 2026-10 · PE file viewer/editor for Windows, Linux and MacOS.
- [amruth-sn/kong](https://github.com/amruth-sn/kong): 1,227 stars · Apache-2.0 · last push 2026-04 · The world's first agentic reverse engineer.
- [google/binexport](https://github.com/google/binexport): 1,214 stars · Apache-2.0 · last push 2026-10 · Export disassemblies into Protocol Buffers
- [petoolse/petools](https://github.com/petoolse/petools): 1,201 stars · MIT · last push 2025-10 · PE Tools - Portable executable (PE) manipulation toolkit
- [HexRaysSA/ida-mcp](https://github.com/HexRaysSA/ida-mcp): 1,196 stars · MIT · last push 2026-10 · Official Hex-Rays IDA MCP Server.
- [ghidraninja/ghidra_scripts](https://github.com/ghidraninja/ghidra_scripts): 1,177 stars · GPL-3.0 · last push 2020-10 · Scripts for the Ghidra software reverse engineering suite.
- [bitdefender/bddisasm](https://github.com/bitdefender/bddisasm): 1,089 stars · Apache-2.0 · last push 2026-10 · bddisasm is a fast, lightweight, x86/x64 instruction decoder. The project also features a fast, basic, x86/x64 instruction emulator, designed specifically to detect shellcode-like behavior.
- [wisk/medusa](https://github.com/wisk/medusa): 1,089 stars · last push 2026-04 · An open source interactive disassembler
- [Fadi002/de4py](https://github.com/Fadi002/de4py): 1,009 stars · last push 2026-08 · The ultimate AI-powered toolkit for python reverse engineering
- [peiikai/LASRecomp](https://github.com/peiikai/LASRecomp): 1,009 stars · last push 2026-10 · Static recompilation of Link's Awakening (Switch) to native macOS, Windows and Linux
- [vivisect/vivisect](https://github.com/vivisect/vivisect): 1,003 stars · Apache-2.0 · last push 2026-10 · No description supplied by the upstream repository.
- [ioncodes/idacode](https://github.com/ioncodes/idacode): 994 stars · last push 2025-09 · An integration for IDA and VS Code which connects both to easily execute and debug IDAPython scripts.
- [rizinorg/rz-ghidra](https://github.com/rizinorg/rz-ghidra): 993 stars · LGPL-3.0 · last push 2026-10 · Deep ghidra decompiler and sleigh disassembler integration for rizin
- [x86byte/RE-MA-Roadmap](https://github.com/x86byte/RE-MA-Roadmap): 951 stars · last push 2025-10 · Reverse Engineering and Malware Analysis Roadmap
- [radareorg/radare2-book](https://github.com/radareorg/radare2-book): 921 stars · CC-BY-SA-4.0 · last push 2026-09 · The Official Radare2 Book
- [CheckPointSW/Karta](https://github.com/CheckPointSW/Karta): 912 stars · MIT · last push 2026-03 · Karta - source code assisted fast binary matching plugin for IDA
- [NaC-L/Mergen](https://github.com/NaC-L/Mergen): 912 stars · GPL-3.0 · last push 2026-09 · Deobfuscation via optimization with usage of LLVM IR and parsing assembly.
- [HackOvert/GhidraSnippets](https://github.com/HackOvert/GhidraSnippets): 893 stars · CC0-1.0 · last push 2023-07 · Python snippets for Ghidra's Program and Decompiler APIs
- [vulhunt-re/vulhunt](https://github.com/vulhunt-re/vulhunt): 893 stars · GPL-3.0 · last push 2026-08 · Vulnerability detection framework by Binarly's REsearch team
- [mrexodia/dumpulator](https://github.com/mrexodia/dumpulator): 887 stars · BSL-1.0 · last push 2024-02 · An easy-to-use library for emulating memory dumps. Useful for malware analysis (config extraction, unpacking) and dynamic analysis in general (sandboxing).
- [n0mi1k/apk2url](https://github.com/n0mi1k/apk2url): 880 stars · MIT · last push 2024-02 · An OSINT tool to quickly extract IP and URL endpoints from APKs by disassembling and decompiling
- [symgraph/IDAssist](https://github.com/symgraph/IDAssist): 880 stars · MIT · last push 2026-09 · AI-Powered Reverse Engineering Plugin for IDA Pro
- [GrammaTech/ddisasm](https://github.com/GrammaTech/ddisasm): 876 stars · AGPL-3.0 · last push 2026-10 · A fast and accurate disassembler
- [cyberkaida/reverse-engineering-assistant](https://github.com/cyberkaida/reverse-engineering-assistant): 875 stars · Apache-2.0 · last push 2026-10 · MCP server for reverse engineering tasks in Ghidra 👩‍💻
- [Adamkadaban/CTFs](https://github.com/Adamkadaban/CTFs): 869 stars · last push 2025-11 · CTF Cheat Sheet + Writeups / Files for some of the Security CTFs that I've done
- [fjh658/IDA7.0_SP](https://github.com/fjh658/IDA7.0_SP): 863 stars · Apache-2.0 · last push 2022-09 · IDA7.0_SP is ida's bugfix
- [eset/ipyida](https://github.com/eset/ipyida): 857 stars · last push 2026-08 · IPython console integration for IDA Pro
- [decaf-project/DECAF](https://github.com/decaf-project/DECAF): 841 stars · GPL-3.0 · last push 2024-11 · DECAF (short for Dynamic Executable Code Analysis Framework) is a binary analysis platform based on QEMU. This is also the home of the DroidScope dynamic Android malware analysis platform. DroidScope is now an extension to DECAF.
- [weirdmachine64/GhidraGPT](https://github.com/weirdmachine64/GhidraGPT): 826 stars · Apache-2.0 · last push 2026-07 · Integrate LLM models directly into Ghidra for AI-enhanced reverse engineering.
- [Cisco-Talos/GhIDA](https://github.com/Cisco-Talos/GhIDA): 820 stars · Apache-2.0 · last push 2021-02 · No description supplied by the upstream repository.
- [HackOvert/AntiDBG](https://github.com/HackOvert/AntiDBG): 818 stars · CC0-1.0 · last push 2021-05 · A bunch of Windows anti-debugging tricks for x86 and x64.
- [clearbluejar/ghidriff](https://github.com/clearbluejar/ghidriff): 813 stars · GPL-3.0 · last push 2026-05 · Python Command-Line Ghidra Binary Diffing Engine
- [mentebinaria/readpe](https://github.com/mentebinaria/readpe): 789 stars · GPL-2.0 · last push 2026-08 · The PE file analysis toolkit
- [symgraph/GhidrAssistMCP](https://github.com/symgraph/GhidrAssistMCP): 774 stars · MIT · last push 2026-10 · An native MCP server extension for Ghidra
- [danigargu/heap-viewer](https://github.com/danigargu/heap-viewer): 773 stars · GPL-3.0 · last push 2022-07 · IDA Pro plugin to examine the glibc heap, focused on exploit development
- [fay59/fcd](https://github.com/fay59/fcd): 773 stars · last push 2021-03 · An optimizing decompiler
- [symgraph/GhidrAssist](https://github.com/symgraph/GhidrAssist): 760 stars · MIT · last push 2026-09 · An LLM extension for Ghidra to enable AI assistance in RE.
- [binsync/binsync](https://github.com/binsync/binsync): 752 stars · BSD-2-Clause · last push 2026-08 · A reversing plugin for cross-decompiler collaboration, built on git.
- [HexHive/retrowrite](https://github.com/HexHive/retrowrite): 751 stars · last push 2025-04 · RetroWrite -- Retrofitting compiler passes through binary rewriting
- [pyinstxtractor/pyinstxtractor-ng](https://github.com/pyinstxtractor/pyinstxtractor-ng): 741 stars · GPL-3.0 · last push 2026-10 · PyInstaller Extractor Next Generation
- [radareorg/awesome-radare2](https://github.com/radareorg/awesome-radare2): 739 stars · CC0-1.0 · last push 2020-04 · A curated list of awesome projects, articles and the other materials powered by Radare2
- [larkmjc/rv8](https://github.com/larkmjc/rv8): 727 stars · MIT · last push 2022-02 · RISC-V simulator for x86-64
- [0xb0bb/pwndra](https://github.com/0xb0bb/pwndra): 710 stars · Apache-2.0 · last push 2024-09 · A collection of pwn/CTF related utilities for Ghidra
- [Soulghost/iblessing](https://github.com/Soulghost/iblessing): 687 stars · GPL-3.0 · last push 2022-02 · iblessing is an iOS security exploiting toolkit, it mainly includes application information gathering, static analysis and dynamic analysis. It can be used for reverse engineering, binary analysis and vulnerability mining.
- [aozhimin/iOS-Debug-Hacks](https://github.com/aozhimin/iOS-Debug-Hacks): 682 stars · MIT · last push 2017-09 · :dart: Advanced debugging skills used in iOS project development, including dynamic debugging, static analysis, and decompilation of third-party libraries.
- [gaasedelen/lucid](https://github.com/gaasedelen/lucid): 679 stars · MIT · last push 2024-02 · An Interactive Hex-Rays Microcode Explorer
- [chainguard-dev/malcontent](https://github.com/chainguard-dev/malcontent): 678 stars · Apache-2.0 · last push 2026-10 · #supply #chain #attack #detection
- [SentineLabs/AlphaGolang](https://github.com/SentineLabs/AlphaGolang): 675 stars · GPL-3.0 · last push 2024-08 · IDApython Scripts for Analyzing Golang Binaries
- [Accenture/VulFi](https://github.com/Accenture/VulFi): 673 stars · Apache-2.0 · last push 2025-05 · IDA Pro plugin for query based searching within the binary useful mainly for vulnerability research.
- [tmr232/Sark](https://github.com/tmr232/Sark): 672 stars · MIT · last push 2025-02 · IDAPython Made Easy
- [mohitmishra786/reversingBits](https://github.com/mohitmishra786/reversingBits): 662 stars · MIT · last push 2025-07 · A comprehensive collection of cheatsheets for reverse engineering, binary analysis, and assembly programming tools. This repository serves as a one-stop reference for security researchers, reverse engineers, and low-level programmers.
- [dmendel/bindata](https://github.com/dmendel/bindata): 653 stars · BSD-2-Clause · last push 2026-10 · BinData - Reading and Writing Binary Data in Ruby
- [McGill-DMaS/Kam1n0-Community](https://github.com/McGill-DMaS/Kam1n0-Community): 627 stars · Apache-2.0 · last push 2023-03 · The Kam1n0 Assembly Analysis Platform
- [Nalen98/AngryGhidra](https://github.com/Nalen98/AngryGhidra): 623 stars · MIT · last push 2024-07 · Use angr in Ghidra
- [lifting-bits/rellic](https://github.com/lifting-bits/rellic): 621 stars · Apache-2.0 · last push 2026-02 · Rellic produces goto-free C output from LLVM bitcode
- [Noelo-Lab/kuna](https://github.com/Noelo-Lab/kuna): 614 stars · Apache-2.0 · last push 2026-10 · An agent-first decompiler designed to be refined by other agents. Kuna is written in Rust and was originally ported from Ghidra.
- [wargio/r2dec-js](https://github.com/wargio/r2dec-js): 611 stars · last push 2026-08 · r2dec-js is a JavaScript-based decompiler that converts assembly code into pseudo-C. It aids users in understanding assembly by providing readable high-level explanations, making low-level programming more accessible and facilitating debugging across diverse hardware platforms.
- [boricj/ghidra-delinker-extension](https://github.com/boricj/ghidra-delinker-extension): 608 stars · Apache-2.0 · last push 2026-09 · Ghidra extension for exporting relocatable object files
- [c3rb3ru5d3d53c/binlex](https://github.com/c3rb3ru5d3d53c/binlex): 604 stars · MIT · last push 2026-07 · A Binary Genetic Traits Lexer Framework
- [falconre/falcon](https://github.com/falconre/falcon): 593 stars · Apache-2.0 · last push 2026-03 · Binary Analysis Framework in Rust
- [JonathanSalwan/PinTools](https://github.com/JonathanSalwan/PinTools): 593 stars · last push 2022-02 · Pintool example and PoC for dynamic binary analysis
- [nikolaydubina/go-binsize-treemap](https://github.com/nikolaydubina/go-binsize-treemap): 587 stars · MIT · last push 2026-08 · 🔍 Go binary size SVG treemap
- [B2R2-org/B2R2](https://github.com/B2R2-org/B2R2): 552 stars · MIT · last push 2026-10 · B2R2 is a fully managed binary analysis framework written in F#. It provides a rich set of algorithms, functions, and tools for reverse engineering, program analysis, and binary-level inspection.
- [d3v1l401/FindCrypt-Ghidra](https://github.com/d3v1l401/FindCrypt-Ghidra): 550 stars · GPL-3.0 · last push 2023-06 · IDA Pro's FindCrypt ported to Ghidra, with an updated and customizable signature database
- [BeaEngine/beaengine](https://github.com/BeaEngine/beaengine): 549 stars · last push 2020-12 · BeaEngine disasm project
- [ex0dus-0x/fuzzable](https://github.com/ex0dus-0x/fuzzable): 548 stars · MIT · last push 2026-06 · Framework for Automating Fuzzable Target Discovery with Static Analysis.
- [carbonblack/binee](https://github.com/carbonblack/binee): 531 stars · GPL-2.0 · last push 2023-02 · Binee: binary emulation environment
- [ITAYC0HEN/A-journey-into-Radare2](https://github.com/ITAYC0HEN/A-journey-into-Radare2): 528 stars · last push 2021-01 · A series of tutorials about radare2 framework from https://www.megabeets.net
- [TouchFriend/BiliBiliMApp](https://github.com/TouchFriend/BiliBiliMApp): 518 stars · MIT · last push 2026-07 · An ad-free BiliBili client implemented through iOS reverse engineering. Thanks for using it; stars are welcome.
- [0sec-labs/0](https://github.com/0sec-labs/0): 513 stars · last push 2026-10 · The multiplayer AI offensive security OS - open, self-improving, extensible. Find, verify, and fix vulnerabilities.
- [airbus-cert/Yagi](https://github.com/airbus-cert/Yagi): 511 stars · Apache-2.0 · last push 2024-08 · Yet Another Ghidra Integration for IDA
- [gfx-rs/rspirv](https://github.com/gfx-rs/rspirv): 504 stars · Apache-2.0 · last push 2026-09 · Rust implementation of SPIR-V module processing functionalities
- [hasherezade/ida_ifl](https://github.com/hasherezade/ida_ifl): 502 stars · last push 2026-06 · IFL - Interactive Functions List (plugin for IDA Pro)
- [grayhatacademy/ghidra_scripts](https://github.com/grayhatacademy/ghidra_scripts): 498 stars · last push 2021-05 · Port of devttyS0's IDA plugins to the Ghidra plugin framework, new plugins as well.
- [decomp/decomp](https://github.com/decomp/decomp): 493 stars · Unlicense · last push 2023-02 · Components of a decompilation pipeline.
- [bontchev/pcodedmp](https://github.com/bontchev/pcodedmp): 492 stars · GPL-3.0 · last push 2021-06 · A VBA p-code disassembler
- [Bw3ll/sharem](https://github.com/Bw3ll/sharem): 492 stars · GPL-3.0 · last push 2026-03 · SHAREM is a shellcode analysis framework, capable of emulating more than 45,000 WinAPIs and virutally all Windows syscalls. It also contains its own custom disassembler, with many innovative features, such as being able to show the deobfuscated disassembly of an encoded shellcode, or integrating emulation data to enhance the disassembly.
- [radareorg/r2ai](https://github.com/radareorg/r2ai): 490 stars · MIT · last push 2026-10 · LLM-based reversing for radare2
- [kweatherman/sigmakerex](https://github.com/kweatherman/sigmakerex): 485 stars · MIT · last push 2025-10 · Enhanced IDA Pro signature generator plugin.
- [patois/HexraysToolbox](https://github.com/patois/HexraysToolbox): 483 stars · CC0-1.0 · last push 2023-06 · Hexrays Toolbox - Find code patterns within the Hexrays ctree
- [A200K/IDA-Pro-SigMaker](https://github.com/A200K/IDA-Pro-SigMaker): 481 stars · last push 2025-09 · Signature maker plugin for IDA 9.x and 8.x
- [Zfinix/eleven](https://github.com/Zfinix/eleven): 478 stars · Apache-2.0 · last push 2026-10 · Agent-first reverse engineering for macOS, Windows and Linux: any ACP agent reads, renames and patches binaries, Android apps and GPU kernels next to you.
- [VoidSec/DriverBuddyReloaded](https://github.com/VoidSec/DriverBuddyReloaded): 472 stars · last push 2026-07 · Driver Buddy Reloaded is an IDA Pro Python plugin that helps automate some tedious Windows Kernel Drivers reverse engineering tasks
- [mewmew/dissection](https://github.com/mewmew/dissection): 470 stars · last push 2020-12 · The dissection of a simple "hello world" ELF binary.
- [radareorg/radare2-r2pipe](https://github.com/radareorg/radare2-r2pipe): 466 stars · last push 2026-10 · Access radare2 via pipe from any programming language!
- [patois/dsync](https://github.com/patois/dsync): 459 stars · MIT · last push 2021-01 · IDAPython plugin that synchronizes disassembler and decompiler views
- [jaybosamiya/security-notes](https://github.com/jaybosamiya/security-notes): 458 stars · last push 2017-08 · :notebook: Some security related notes
- [extremecoders-re/decompyle-builds](https://github.com/extremecoders-re/decompyle-builds): 454 stars · last push 2026-05 · Precompiled Decompyle++ (pycdc) binaries for Windows & Linux
- [fosdickio/binary_ninja_mcp](https://github.com/fosdickio/binary_ninja_mcp): 454 stars · GPL-3.0 · last push 2026-10 · A Binary Ninja plugin containing an MCP server that enables seamless integration with your favorite LLM/MCP client.
- [cristianzsh/freki](https://github.com/cristianzsh/freki): 446 stars · AGPL-3.0 · last push 2024-01 · :wolf: Malware analysis platform
- [amimo/ollvm-breaker](https://github.com/amimo/ollvm-breaker): 445 stars · MIT · last push 2020-02 · Remove OLLVM control-flow flattening obfuscation using Binary Ninja.
- [patois/HRDevHelper](https://github.com/patois/HRDevHelper): 443 stars · last push 2024-09 · HexRays ctree visualization plugin
- [echo-devim/fhex](https://github.com/echo-devim/fhex): 436 stars · GPL-3.0 · last push 2024-11 · A Full-Featured HexEditor compatible with Linux/Windows/MacOS
- [ucsb-seclab/karonte](https://github.com/ucsb-seclab/karonte): 434 stars · BSD-2-Clause · last push 2021-09 · Karonte is a static analysis tool to detect multi-binary vulnerabilities in embedded firmware
- [PoomSmart/IDAObjcTypes](https://github.com/PoomSmart/IDAObjcTypes): 421 stars · last push 2026-05 · A collection of types & functions definitions useful for iOS/macOS binaries analysis.
- [fjqisba/VmpHelper](https://github.com/fjqisba/VmpHelper): 416 stars · last push 2026-07 · an ida plugin used to decompile vmp
- [horsicq/XOpcodeCalc](https://github.com/horsicq/XOpcodeCalc): 413 stars · MIT · last push 2026-10 · Opcode calculator / ASM calculator
- [pfalcon/ScratchABit](https://github.com/pfalcon/ScratchABit): 413 stars · GPL-3.0 · last push 2020-11 · Easily retargetable and hackable interactive disassembler with IDAPython-compatible plugin API
- [BoomerangDecompiler/boomerang](https://github.com/BoomerangDecompiler/boomerang): 405 stars · last push 2020-12 · Boomerang Decompiler - Fighting the code-rot :)
- [evyatar9/GptHidra](https://github.com/evyatar9/GptHidra): 405 stars · last push 2023-09 · GptHidra is a Ghidra plugin that uses the OpenAI Chat GPT to explain functions. With GptHidra, you can easily understand the purpose and behavior of functions in your codebase. Now with GPT4 Support!
- [serfend/pydumpck](https://github.com/serfend/pydumpck): 400 stars · last push 2024-05 · a multi-threads tool for decompile exe,elf,pyz,pyc packed by python which is base on pycdc and uncompyle6.
- [radareorg/radeco](https://github.com/radareorg/radeco): 399 stars · last push 2026-05 · radare2-based decompiler and symbol executor
- [saferwall/pe](https://github.com/saferwall/pe): 397 stars · MIT · last push 2026-05 · A :zap: lightweight Go package to parse, analyze and extract metadata from Portable Executable (PE) binaries. Designed for malware analysis tasks and robust against PE malformations.
- [secrary/idenLib](https://github.com/secrary/idenLib): 395 stars · MIT · last push 2019-03 · idenLib - Library Function Identification [This project is not maintained anymore]
- [nevillegrech/gigahorse-toolchain](https://github.com/nevillegrech/gigahorse-toolchain): 388 stars · last push 2026-10 · A binary lifter and analysis framework for Ethereum smart contracts
- [DMaroo/GhidRust](https://github.com/DMaroo/GhidRust): 385 stars · MIT · last push 2024-05 · GhidRust: Rust decompiler plugin for Ghidra
- [GrammaTech/gtirb](https://github.com/GrammaTech/gtirb): 382 stars · last push 2026-06 · Intermediate Representation for Binary analysis and transformation
- [bl4ckr0ss3/knife](https://github.com/bl4ckr0ss3/knife): 380 stars · MIT · last push 2026-10 · A terminal-first reverse engineering toolkit in Rust: PE/ELF/Mach-O analysis through CLI, TUI, and MCP. Installs as knife.
- [Colton1skees/Dna](https://github.com/Colton1skees/Dna): 380 stars · last push 2026-08 · LLVM based static binary analysis framework
- [feicong/macbook](https://github.com/feicong/macbook): 377 stars · AGPL-3.0 · last push 2017-08 · Companion source code for the book macOS Software Security and Reverse Engineering.
- [Adubbz/Ghidra-Switch-Loader](https://github.com/Adubbz/Ghidra-Switch-Loader): 374 stars · ISC · last push 2026-09 · Nintendo Switch loader for Ghidra
- [mohitmishra786/underTheHoodOfExecutables](https://github.com/mohitmishra786/underTheHoodOfExecutables): 374 stars · MIT · last push 2025-07 · A guide that explains how programs transform from source code to executables. Deep dive into ELF format, linking processes, and binary optimization techniques. Perfect for systems programmers, C developers, and anyone interested in low-level programming concepts.
- [rocky/python-xdis](https://github.com/rocky/python-xdis): 372 stars · GPL-2.0 · last push 2026-09 · Python cross-version bytecode library and disassembler
- [justfoxing/ghidra_bridge](https://github.com/justfoxing/ghidra_bridge): 364 stars · MIT · last push 2023-01 · Python 3 bridge to Ghidra's Python scripting
- [yukiarrr/Il2cppSpy](https://github.com/yukiarrr/Il2cppSpy): 360 stars · MIT · last push 2020-08 · Unity IL2CPP Disassembler (for apk)
- [trailofbits/CoBRA](https://github.com/trailofbits/CoBRA): 355 stars · Apache-2.0 · last push 2026-08 · Coefficient-Based Reconstruction of Arithmetic — a Mixed Boolean-Arithmetic (MBA) expression simplifier for deobfuscation
- [rcx/classinformer-ida7](https://github.com/rcx/classinformer-ida7): 354 stars · last push 2020-03 · ClassInformer backported for IDA Pro 7.0
- [kweatherman/IDA_ClassInformer_PlugIn](https://github.com/kweatherman/IDA_ClassInformer_PlugIn): 350 stars · last push 2026-08 · IDA ClassInformer PlugIn
- [patois/abyss](https://github.com/patois/abyss): 349 stars · MIT · last push 2022-10 · abyss - augmentation of Hexrays decompiler output
- [ret42/RE-Thing](https://github.com/ret42/RE-Thing): 348 stars · last push 2025-04 · Reverse Engineering Tools (deobf, decompiler etc..)
- [felberj/gotools](https://github.com/felberj/gotools): 343 stars · MIT · last push 2021-04 · Plugin for Ghidra to assist reversing Golang binaries
- [arizvisa/ida-minsc](https://github.com/arizvisa/ida-minsc): 336 stars · BSD-3-Clause · last push 2026-09 · A plugin based on IDAPython for a functional DWIM interface. Current development against most recent IDA is in the "persistence-refactor" branch, ancient (but stable) work is in "master", so... create an issue if you want/need something backported. Use "Wiki" or "Discussions" for examples, and smash that "Star" button if you like this.
- [manyuegong33/r0crawl_skills](https://github.com/manyuegong33/r0crawl_skills): 332 stars · last push 2026-09 · r0crawl_skills is a massive reverse-engineering skill arsenal for web, Android, iOS, Frida, native binaries, protocols, malware, firmware, and anti-analysis—built for beginners, tuned for pros, and engineered for reproducible results.
- [gaasedelen/microavx](https://github.com/gaasedelen/microavx): 331 stars · MIT · last push 2023-04 · An AVX Lifter for the Hex-Rays Decompiler
- [therealdreg/DbgChild](https://github.com/therealdreg/DbgChild): 328 stars · last push 2023-08 · Debug Child Process Tool (auto attach)
- [reetamdan/hypervisor-crack-audit](https://github.com/reetamdan/hypervisor-crack-audit): 327 stars · last push 2026-03 · Security analysis of the hypervisor drm method used to bypass denuvo. Reverse engineering of the driver loaders and boot components using Ghidra
- [radareorg/radare2-mcp](https://github.com/radareorg/radare2-mcp): 325 stars · MIT · last push 2026-10 · MCP stdio server for radare2
- [w00tzenheimer/d810-ng](https://github.com/w00tzenheimer/d810-ng): 325 stars · AGPL-3.0 · last push 2026-09 · D810-ng (Next Generation) is an updated, tested, refactored, and optimized IDA Pro plugin used to deobfuscate code at decompilation time by modifying IDA Pro microcode.
- [mandiant/xrefer](https://github.com/mandiant/xrefer): 323 stars · Apache-2.0 · last push 2026-08 · FLARE Team's Binary Navigator
- [Cuyler36/Ghidra-GameCube-Loader](https://github.com/Cuyler36/Ghidra-GameCube-Loader): 322 stars · Apache-2.0 · last push 2026-05 · A Nintendo GameCube binary loader for Ghidra
- [mwemuorg/mwemu](https://github.com/mwemuorg/mwemu): 316 stars · Apache-2.0 · last push 2026-10 · x86 malware emulator
- [reb311ion/replica](https://github.com/reb311ion/replica): 315 stars · GPL-3.0 · last push 2020-05 · Ghidra Analysis Enhancer 🐉
- [PAGalaxyLab/ghidra_scripts](https://github.com/PAGalaxyLab/ghidra_scripts): 312 stars · MIT · last push 2021-11 · Scripts for the Ghidra.
- [medigateio/ida_medigate](https://github.com/medigateio/ida_medigate): 311 stars · last push 2023-05 · Medigate plugin for c++ reverse engineering and other utils
- [Nalen98/GhidraEmu](https://github.com/Nalen98/GhidraEmu): 308 stars · MIT · last push 2024-07 · Native Pcode emulator
- [0xdea/ghidra-scripts](https://github.com/0xdea/ghidra-scripts): 303 stars · MIT · last push 2026-08 · A collection of my Ghidra scripts to facilitate reverse engineering and vulnerability research.
- [TorgoTorgo/ghidra-findcrypt](https://github.com/TorgoTorgo/ghidra-findcrypt): 302 stars · GPL-3.0 · last push 2023-06 · Ghidra analysis plugin to locate cryptographic constants
- [Karmaz95/Snake_Apple](https://github.com/Karmaz95/Snake_Apple): 300 stars · GPL-3.0 · last push 2026-10 · Articles and tools related to research in the Apple environment (mainly macOS).
- [tintinweb/ida-batch_decompile](https://github.com/tintinweb/ida-batch_decompile): 300 stars · GPL-3.0 · last push 2020-05 · *Decompile All the Things* - IDA Batch Decompile plugin and script for Hex-Ray's IDA Pro that adds the ability to batch decompile multiple files and their imports with additional annotations (xref, stack var size) to the pseudocode .c file
- [ubfx/BinDiffHelper](https://github.com/ubfx/BinDiffHelper): 297 stars · last push 2026-09 · Ghidra Extension to integrate BinDiff for function matching
- [thetacom/hexabyte](https://github.com/thetacom/hexabyte): 294 stars · GPL-3.0 · last push 2026-08 · A modern, modular, and robust TUI hex editor.
- [LittleBitUA/DownpourRecomp](https://github.com/LittleBitUA/DownpourRecomp): 293 stars · BSD-3-Clause · last push 2026-09 · Silent Hill: Downpour — native Windows PC port via static recompilation of the Xbox 360 binary. v1.0 stable: 60 FPS unlocked, ROV warm-cache, standalone launcher, DualSense adaptive triggers, portable saves. Tested on USA + Europe X360 dumps.
- [clojure-goes-fast/clj-java-decompiler](https://github.com/clojure-goes-fast/clj-java-decompiler): 285 stars · EPL-1.0 · last push 2025-09 · REPL-integrated Clojure-to-Java decompiler
- [cdong1012/ollvm-unflattener](https://github.com/cdong1012/ollvm-unflattener): 284 stars · Apache-2.0 · last push 2025-04 · Obfuscator-llvm Control Flow Flattening Deobfuscator
- [secrary/DrSemu](https://github.com/secrary/DrSemu): 280 stars · GPL-3.0 · last push 2019-11 · DrSemu - Sandboxed Malware Detection and Classification Tool Based on Dynamic Behavior
- [mebeim/systrack](https://github.com/mebeim/systrack): 275 stars · GPL-3.0 · last push 2025-10 · 📡🐧 Linux kernel syscall implementation tracker
- [argp/iBoot64helper](https://github.com/argp/iBoot64helper): 266 stars · last push 2022-02 · IDAPython loader to help with AArch64 iBoot, iBEC, and SecureROM reverse engineering
- [danielplohmann/smda](https://github.com/danielplohmann/smda): 264 stars · BSD-2-Clause · last push 2026-10 · SMDA is a minimalist recursive disassembler library that is optimized for accurate Control Flow Graph (CFG) recovery from memory dumps.
- [blacktop/docker-ghidra](https://github.com/blacktop/docker-ghidra): 263 stars · Apache-2.0 · last push 2026-09 · Ghidra Client/Server Docker Image
- [JustasMasiulis/ida_bitfields](https://github.com/JustasMasiulis/ida_bitfields): 262 stars · MPL-2.0 · last push 2025-08 · IDA Pro plugin to make bitfield accesses easier to grep
- [mooncat-greenpy/Ghidra_GolangAnalyzerExtension](https://github.com/mooncat-greenpy/Ghidra_GolangAnalyzerExtension): 262 stars · last push 2026-07 · Analyze Golang with Ghidra
- [radareorg/radare2-extras](https://github.com/radareorg/radare2-extras): 262 stars · LGPL-3.0 · last push 2026-10 · Source graveyard and random candy for radare2
- [StarCrossPortal/sleighcraft](https://github.com/StarCrossPortal/sleighcraft): 261 stars · Apache-2.0 · last push 2021-10 · sleigh craft!
- [GaloisInc/macaw](https://github.com/GaloisInc/macaw): 258 stars · BSD-3-Clause · last push 2026-10 · Open source binary analysis tools.
- [chaoticgd/ghidra-emotionengine-reloaded](https://github.com/chaoticgd/ghidra-emotionengine-reloaded): 252 stars · Apache-2.0 · last push 2026-10 · An extension for Ghidra that adds support for the PlayStation 2.
- [Imrglop/IDA-FastAnalysis](https://github.com/Imrglop/IDA-FastAnalysis): 252 stars · MIT · last push 2026-09 · IDA Pro plugin that speeds up the initial binary auto analysis through a caching technique
- [hyuunnn/Hyara](https://github.com/hyuunnn/Hyara): 250 stars · MIT · last push 2026-10 · Yara rule making tool (IDA Pro & Binary Ninja & Cutter & Ghidra Plugin)
- [quarkslab/qbindiff](https://github.com/quarkslab/qbindiff): 247 stars · Apache-2.0 · last push 2025-05 · Quarkslab Bindiffer but not only !
- [akiselev/ghidra-cli](https://github.com/akiselev/ghidra-cli): 245 stars · GPL-3.0 · last push 2026-10 · Automate Ghidra reverse engineering from the command line — headless analysis, decompilation, and structured JSON output for AI agents like Claude Code
- [mentebinaria/fundamentos-engenharia-reversa](https://github.com/mentebinaria/fundamentos-engenharia-reversa): 238 stars · last push 2026-05 · Book: Reverse Engineering — Fundamentals and Practice
- [miunasu/IDA-Skill](https://github.com/miunasu/IDA-Skill): 237 stars · AGPL-3.0 · last push 2026-08 · An AI agent skill for automated malware analysis with IDA Pro, enabling agents to analyze malicious samples like a security analyst.
- [Nalen98/eBPF-for-Ghidra](https://github.com/Nalen98/eBPF-for-Ghidra): 237 stars · MIT · last push 2024-06 · eBPF Processor for Ghidra
- [ReversecLabs/z3_and_angr_binary_analysis_workshop](https://github.com/ReversecLabs/z3_and_angr_binary_analysis_workshop): 237 stars · last push 2020-12 · Code and exercises for a workshop on z3 and angr
- [fkie-cad/dewolf](https://github.com/fkie-cad/dewolf): 236 stars · LGPL-2.1 · last push 2026-10 · A research decompiler implemented as a Binary Ninja plugin.
- [aengelke/fadec](https://github.com/aengelke/fadec): 235 stars · BSD-3-Clause · last push 2026-10 · A fast and lightweight decoder for x86 and x86-64 and encoder for x86-64.
- [DearVa/ida_copilot](https://github.com/DearVa/ida_copilot): 234 stars · MIT · last push 2023-11 · ChatGPT Agent analyses your IDA pseudocode
- [schlafwandler/ghidra_SavePatch](https://github.com/schlafwandler/ghidra_SavePatch): 233 stars · last push 2020-12 · A Ghidra script to save small patches back to the executable file
- [Cisco-Talos/Ghidraaas](https://github.com/Cisco-Talos/Ghidraaas): 229 stars · Apache-2.0 · last push 2023-05 · No description supplied by the upstream repository.
- [romainthomas/the-poor-mans-obfuscator](https://github.com/romainthomas/the-poor-mans-obfuscator): 229 stars · last push 2022-07 · Binary & scripts associated with "The Poor Man's Obfuscator" presentation
- [Sidenai/hyperion-disassembler](https://github.com/Sidenai/hyperion-disassembler): 228 stars · last push 2026-06 · Native multi-arch disassembler & decompiler - PE/ELF/Mach-O, x86/x64/ARM64, Lua scripting, RTTI recovery
- [Buku313/Skate3-Mobile](https://github.com/Buku313/Skate3-Mobile): 227 stars · last push 2026-09 · Play Skate 3 natively on Android. Download one APK, select your own ISO, and skate. ARM64 recompilation with Vulkan rendering.
- [quarkslab/quokka](https://github.com/quarkslab/quokka): 227 stars · Apache-2.0 · last push 2026-10 · Quokka: A Fast and Accurate Binary Exporter
- [cesena/ghidra2dwarf](https://github.com/cesena/ghidra2dwarf): 226 stars · MIT · last push 2023-11 · 🐉 Export ghidra decompiled code to dwarf sections inside ELF binary
- [mahmoudimus/ida-sigmaker](https://github.com/mahmoudimus/ida-sigmaker): 226 stars · MIT · last push 2026-09 · sigmaker is a zero-dependency IDA Pro 9.0+ cross-platform signature maker plugin with optional SIMD (e.g. AVX2/NEON/SSE2) speedups that works on MacOS/Linux/Windows. It allows configurable wildcard operand patterns, nibbles, and signature generation just by right clicking.
- [macmade/dyld_cache_extract](https://github.com/macmade/dyld_cache_extract): 225 stars · MIT · last push 2023-06 · A macOS utility to extract dynamic libraries from the dyld_shared_cache of macOS and iOS.
- [tintinweb/ethereum-dasm](https://github.com/tintinweb/ethereum-dasm): 223 stars · GPL-2.0 · last push 2019-07 · An ethereum evm bytecode disassembler and static/dynamic analysis tool
- [angr/pypcode](https://github.com/angr/pypcode): 222 stars · last push 2026-10 · Python bindings to Ghidra's SLEIGH library for disassembly and lifting to P-Code IR
- [aboutcode-org/scancode.io](https://github.com/aboutcode-org/scancode.io): 220 stars · Apache-2.0 · last push 2026-10 · ScanCode.io is a server to script and automate software composition analysis with pipelines. This project is sponsored by the European Commission, NLnet NGI0, the Google Summer of Code, nexB and others generous sponsors!
- [Cararasu/holodec](https://github.com/Cararasu/holodec): 220 stars · MIT · last push 2019-04 · Decompiler for x86 and x86-64 ELF binaries
- [NWMonster/ApplySig](https://github.com/NWMonster/ApplySig): 214 stars · LGPL-3.0 · last push 2020-05 · Apply IDA FLIRT signatures for Ghidra
- [dod-cyber-crime-center/pyhidra](https://github.com/dod-cyber-crime-center/pyhidra): 212 stars · last push 2024-10 · Pyhidra is a Python library that provides direct access to the Ghidra API within a native CPython interpreter using jpype.
- [fadden/6502bench](https://github.com/fadden/6502bench): 212 stars · Apache-2.0 · last push 2026-08 · A workbench for developing 6502 code.
- [sjkim1127/Reversecore_MCP](https://github.com/sjkim1127/Reversecore_MCP): 211 stars · MIT · last push 2026-10 · A security-first MCP server that empowers AI agents to perform automated reverse engineering, malware analysis, forensics, vulnerability research, and SAST — powered by Radare2, YARA, LIEF, Capstone, and more.
- [OpenPort-Labs/Galaxy-Android](https://github.com/OpenPort-Labs/Galaxy-Android): 210 stars · GPL-3.0 · last push 2026-10 · Native 100% ARM64 Android port of the 2007 cosmic gravity platformer with OpenGL ES 3.2, AAudio, Hor+ ultrawide, and touch controls.
- [chenxvb/Unicorn-Trace](https://github.com/chenxvb/Unicorn-Trace): 209 stars · MIT · last push 2026-05 · A lightweight ARM64 dynamic tracing and emulation tool based on Unicorn, supporting IDA Pro, Tenet log generation, native code emulation, memory dumps, register-state tracking, and instruction-level logging.
- [WPeace-HcH/SysNR-FuncFinder](https://github.com/WPeace-HcH/SysNR-FuncFinder): 208 stars · last push 2023-09 · A plugin for IDA that renames functions by system call numbers.
- [biniamf/ai-reverse-engineering](https://github.com/biniamf/ai-reverse-engineering): 206 stars · last push 2026-07 · AI-Assisted Reverse Engineering with Ghidra
- [buggerlogger/arkose-solver](https://github.com/buggerlogger/arkose-solver): 202 stars · MIT · last push 2026-09 · Arkose Labs / FunCaptcha solver for Go, Python and Node — produces sup=1 suppressed tokens. The site RSA key is derived from api.js on every solve: no capture, no replay, no headless browser. Includes a full VM disassembly.
- [monkbai/DNN-decompiler](https://github.com/monkbai/DNN-decompiler): 199 stars · last push 2026-03 · BTD - Bin To DNN: A DNN Executables Decompiler
- [DenuvoSoftwareSolutions/SiMBA](https://github.com/DenuvoSoftwareSolutions/SiMBA): 197 stars · GPL-3.0 · last push 2023-10 · Efficient Deobfuscation of Linear Mixed Boolean-Arithmetic Expressions
- [RevEngAI/plugin-ghidra](https://github.com/RevEngAI/plugin-ghidra): 195 stars · GPL-3.0 · last push 2026-08 · RevEng.AI Ghidra Plugin
- [cdlewis/snowboardkids2-decomp](https://github.com/cdlewis/snowboardkids2-decomp): 193 stars · last push 2026-10 · Decompilation of snowboard kids 2 (N64)
- [lifting-bits/sleigh](https://github.com/lifting-bits/sleigh): 193 stars · Apache-2.0 · last push 2026-10 · Unofficial CMake build for Ghidra's C++ SLEIGH code
- [MahdiSafsafi/DebugEngine](https://github.com/MahdiSafsafi/DebugEngine): 193 stars · MPL-2.0 · last push 2021-06 · Delphi debug framework
- [yoavst/ida-ios-helper](https://github.com/yoavst/ida-ios-helper): 193 stars · GPL-3.0 · last push 2026-08 · Plugin to ease reversing iOS projects
- [LLVM-but-worse/java-disassembler](https://github.com/LLVM-but-worse/java-disassembler): 192 stars · GPL-3.0 · last push 2025-07 · The Java Disassembler
- [msm-code/ghidralib](https://github.com/msm-code/ghidralib): 191 stars · Apache-2.0 · last push 2026-02 · A Pythonic Ghidra standard library
- [ax330d/hrdev](https://github.com/ax330d/hrdev): 186 stars · MIT · last push 2018-09 · Hex-Rays Decompiler Enhanced View
- [fugue-re/fugue-core](https://github.com/fugue-re/fugue-core): 186 stars · MIT · last push 2026-08 · A binary analysis framework written in Rust.
- [harlamism/IdaClu](https://github.com/harlamism/IdaClu): 186 stars · MIT · last push 2026-02 · IdaClu is a version agnostic IDA Pro plugin for grouping similar functions. Pick an existing grouping algorithm or create your own.
- [matiaszanolli/sega-vr-disasm](https://github.com/matiaszanolli/sega-vr-disasm): 183 stars · last push 2026-09 · Complete static recompilation of Virtua Racing for the Sega 32X (optimization in progress)
- [SoftSec-KAIST/BinKit](https://github.com/SoftSec-KAIST/BinKit): 183 stars · MIT · last push 2023-12 · Binary Code Similarity Analysis (BCSA) Benchmark
- [vallejocc/Reverse-Engineering-Arsenal](https://github.com/vallejocc/Reverse-Engineering-Arsenal): 183 stars · last push 2020-09 · Useful Scripts for helping in reverse engeenering
- [Decompollaborate/rabbitizer](https://github.com/Decompollaborate/rabbitizer): 182 stars · MIT · last push 2026-05 · MIPS instruction decoder
- [romainthomas/reverse-engineering-workshop](https://github.com/romainthomas/reverse-engineering-workshop): 182 stars · last push 2022-12 · Slides & Hands-on for the reverse engineering workshop
- [LAC-Japan/IDA_Plugin_AntiDebugSeeker](https://github.com/LAC-Japan/IDA_Plugin_AntiDebugSeeker): 181 stars · BSD-3-Clause · last push 2024-11 · Automatically identify and extract potential anti-debugging techniques used by malware.
- [rocky/elisp-bytecode](https://github.com/rocky/elisp-bytecode): 181 stars · last push 2025-04 · Let's document Emacs Lisp Bytecode (Lisp Assembly Program) instructions
- [jovibor/Pepper](https://github.com/jovibor/Pepper): 179 stars · Apache-2.0 · last push 2026-08 · PE32 (x86) and PE32+ (x64) binaries analysis tool, resources viewer/extractor.
- [m417z/Multiline-Ultimate-Assembler](https://github.com/m417z/Multiline-Ultimate-Assembler): 179 stars · GPL-3.0 · last push 2026-08 · A multiline (and ultimate) assembler (and disassembler) plugin for x64dbg and OllyDbg. A perfect tool for modifying and extending a compiled executable functionality.
- [giantbranch/mipsAudit](https://github.com/giantbranch/mipsAudit): 175 stars · last push 2026-07 · An IDA MIPS static scanning script to assist assembly-code auditing.
- [eset/DelphiHelper](https://github.com/eset/DelphiHelper): 174 stars · last push 2026-08 · DelphiHelper is a python IDA Pro plugin aiming to help the analysis of x86/x86_64 binaries written in Delphi programming language.
- [jovibor/libpe](https://github.com/jovibor/libpe): 174 stars · MIT · last push 2026-02 · Library for parsing internal structures of PE32/PE32+ binary files.
- [zackelia/ghidra-dark-theme](https://github.com/zackelia/ghidra-dark-theme): 174 stars · MIT · last push 2023-04 · Modern dark theme based on the original ghidra-dark
- [yaz0r/Azel](https://github.com/yaz0r/Azel): 173 stars · MIT · last push 2026-09 · Reverse engineering of Panzer Dragoon Saga
- [AlexanderBagel/ProcessMemoryMap](https://github.com/AlexanderBagel/ProcessMemoryMap): 172 stars · MPL-2.0 · last push 2026-09 · Deep memory analysis for Windows processes — the tool that saves you hours of debugging
- [Lancern/asm2vec](https://github.com/Lancern/asm2vec): 172 stars · last push 2021-01 · An unofficial implementation of asm2vec as a standalone python package
- [Fausto-404/ai-mobile-reverse-skills](https://github.com/Fausto-404/ai-mobile-reverse-skills): 171 stars · MIT · last push 2026-08 · A six-stage orchestration skill for mobile security analysis, coordinating APK static reconnaissance, traffic-to-code alignment, in-depth SO/JNI analysis, combined cryptography and vulnerability analysis, validation design, and report delivery. Supports JADX MCP, Burp/Yakit MCP, and IDA/Ghidra MCP.
- [notemrovsky/tiktok-reverse-engineering](https://github.com/notemrovsky/tiktok-reverse-engineering): 167 stars · last push 2026-07 · Reverse engineering TikTok's JavaScript VM - 77 opcodes mapped, string deobfuscation, bytecode disassembly, and crypto function identification. Educational VM analysis toolkit.
- [nlitsme/idbutil](https://github.com/nlitsme/idbutil): 165 stars · MIT · last push 2023-11 · Library and tool for reading IDApro databases.
- [skoolkid/skoolkit](https://github.com/skoolkid/skoolkit): 165 stars · GPL-3.0 · last push 2026-10 · A suite of tools for creating disassemblies of ZX Spectrum games.
- [eset/stadeo](https://github.com/eset/stadeo): 164 stars · last push 2021-11 · Control-flow-flattening and string deobfuscator
- [securityjoes/AskJOE](https://github.com/securityjoes/AskJOE): 164 stars · GPL-2.0 · last push 2026-03 · AI-Powered Malware Analysis & Threat Intelligence for Ghidra Transform your static analysis workflow with cutting-edge AI capabilities, comprehensive malware detection, and advanced threat intelligence.
- [RevEngAI/plugin-ida](https://github.com/RevEngAI/plugin-ida): 163 stars · GPL-3.0 · last push 2026-09 · RevEng.AI IDA Pro Plugin
- [zfigura/semblance](https://github.com/zfigura/semblance): 163 stars · GPL-3.0 · last push 2024-02 · Disassembler for Windows executables. Supports 16-bit NE (New Executable), MZ (DOS), and PE (Portable Executable, i.e. Win32) files.
- [SamuelTulach/unxorer](https://github.com/SamuelTulach/unxorer): 162 stars · last push 2026-03 · Yet another IDA Pro/Home plugin for deobfuscating stack strings
- [nlitsme/pyidbutil](https://github.com/nlitsme/pyidbutil): 161 stars · MIT · last push 2025-03 · A python library for reading IDA pro databases.
- [AllsafeCyberSecurity/LazyGhidra](https://github.com/AllsafeCyberSecurity/LazyGhidra): 159 stars · MIT · last push 2020-08 · Make your Ghidra Lazy!
- [cojocar/bin2llvm](https://github.com/cojocar/bin2llvm): 159 stars · Apache-2.0 · last push 2018-06 · A binary to LLVM translator
- [clearbluejar/ghidrecomp](https://github.com/clearbluejar/ghidrecomp): 158 stars · GPL-3.0 · last push 2026-01 · Python Command-Line Ghidra Decompiler
- [fuzziqersoftware/resource_dasm](https://github.com/fuzziqersoftware/resource_dasm): 158 stars · MIT · last push 2026-10 · Classic Mac OS resource fork and application disassembler, with reverse-engineering tools for specific applications
- [jiangzhengwenjz/katam](https://github.com/jiangzhengwenjz/katam): 158 stars · last push 2026-09 · WIP Decompilation of Kirby & The Amazing Mirror (USA)
- [evyatar9/Writeups](https://github.com/evyatar9/Writeups): 157 stars · last push 2025-11 · This repository contains writeups for various CTFs I've participated in (Including Hack The Box).
- [SimonKagstrom/emilpro](https://github.com/SimonKagstrom/emilpro): 157 stars · MIT · last push 2025-04 · Graphical disassembler for multiple architectures for easy navigation
- [nirizr/rematch](https://github.com/nirizr/rematch): 156 stars · GPL-3.0 · last push 2018-11 · REmatch, a complete binary diffing framework that is free and strives to be open source and community driven.
- [lr-m/GhidrOllama](https://github.com/lr-m/GhidrOllama): 155 stars · last push 2024-11 · A Ghidra script that enables the analysis of selected functions and instructions using Large Language Models (LLMs). It aims to make reverse-engineering more efficient by using Ollama's API directly within Ghidra.
- [tinylcy/ClassAnalyzer](https://github.com/tinylcy/ClassAnalyzer): 155 stars · MIT · last push 2023-07 · A Java Class File Disassembler
- [kweatherman/ida_missinglink](https://github.com/kweatherman/ida_missinglink): 153 stars · MIT · last push 2026-02 · IDA Plugin that fills in missing indirect CALL & JMP target information
- [carlosgprado/JARVIS](https://github.com/carlosgprado/JARVIS): 151 stars · last push 2023-04 · "Just Another ReVersIng Suite" or whatever other bullshit you can think of
- [K4ryuu/IDA-VTableExplorer](https://github.com/K4ryuu/IDA-VTableExplorer): 149 stars · MIT · last push 2026-03 · Automatic vtable detection, inheritance analysis, and function override tracking for reverse engineering compiled C++ binaries. Supports IDA Pro 9+ on any OS
- [feicong/ida_for_mac_green](https://github.com/feicong/ida_for_mac_green): 148 stars · AGPL-3.0 · last push 2017-10 · Portable modification of IDA Pro for macOS.
- [openbin-ai/binny](https://github.com/openbin-ai/binny): 148 stars · AGPL-3.0 · last push 2026-10 · BINNY: an open source agent harness for reverse engineering. Plug in any model, or a local one.
- [cmu-sei/kaiju](https://github.com/cmu-sei/kaiju): 147 stars · last push 2026-03 · CERT Kaiju is a binary analysis framework extension for the Ghidra software reverse engineering suite. This repository is a "mirror" -- please file tickets, bug reports, or pull requests at the upstream home in @CERTCC: https://github.com/certcc/kaiju
- [liuzhengyang/hsdis](https://github.com/liuzhengyang/hsdis): 147 stars · last push 2023-02 · hotspot disassembler hsdis
- [paradiseduo/dsdump](https://github.com/paradiseduo/dsdump): 146 stars · last push 2023-11 · An improved nm + Objective-C & Swift class-dump
- [radareorg/radare2-pm](https://github.com/radareorg/radare2-pm): 146 stars · last push 2026-10 · Package Manager for Radare2
- [0x00ctrl/CyberSec-Books](https://github.com/0x00ctrl/CyberSec-Books): 145 stars · last push 2026-10 · Some useful books related to Cybersecurity, Linux and more.
- [mcdulltii/obfDetect](https://github.com/mcdulltii/obfDetect): 145 stars · GPL-3.0 · last push 2022-04 · IDA plugin to pinpoint obfuscated code
- [knight0x07/pyc2bytecode](https://github.com/knight0x07/pyc2bytecode): 143 stars · last push 2023-05 · A Python Bytecode Disassembler helping reverse engineers in dissecting Python binaries by disassembling and analyzing the compiled python byte-code(.pyc) files across all python versions (including Python 3.10.*)
- [patois/xray](https://github.com/patois/xray): 142 stars · last push 2023-12 · Hexrays decompiler plugin that colorizes and filters the decompiler's output based on regular expressions
- [nccgroup/ghostrings](https://github.com/nccgroup/ghostrings): 141 stars · GPL-3.0 · last push 2026-05 · Ghidra scripts for recovering string definitions in Go binaries
- [lr-m/Ghidra-Themes](https://github.com/lr-m/Ghidra-Themes): 140 stars · last push 2024-12 · A collection of over 200 Ghidra themes to make long hours of reverse-engineering even more enjoyable!
- [lt-asset/resym](https://github.com/lt-asset/resym): 139 stars · BSD-3-Clause · last push 2025-04 · For our CCS24 paper 🏆 "ReSym: Harnessing LLMs to Recover Variable and Data Structure Symbols from Stripped Binaries" by Danning Xie, Zhuo Zhang, Nan Jiang, Xiangzhe Xu, Lin Tan, and Xiangyu Zhang. 🏆 ACM SIGSAC Distinguished Paper Award Winner
- [philsajdak/decyx](https://github.com/philsajdak/decyx): 139 stars · MIT · last push 2026-03 · Decyx: AI-powered Ghidra extension for enhanced reverse engineering and binary analysis.
- [radareorg/r2con2019](https://github.com/radareorg/r2con2019): 137 stars · last push 2020-02 · r2con2019 - slides and materials
- [0xdea/rhabdomancer](https://github.com/0xdea/rhabdomancer): 136 stars · MIT · last push 2026-10 · Vulnerability research assistant that locates calls to potentially insecure API functions in a binary file.
- [radareorg/radare2-bindings](https://github.com/radareorg/radare2-bindings): 136 stars · LGPL-3.0 · last push 2026-04 · Bindings of the r2 api for Valabind and friends
- [aldelaro5/ghidra-gekko-broadway-lang](https://github.com/aldelaro5/ghidra-gekko-broadway-lang): 135 stars · last push 2022-02 · Ghidra language definition for the Gekko and Broadway CPU variant used in the Nintendo GameCube and Nintendo Wii respectively
- [LockBlock-dev/pkg-unpacker](https://github.com/LockBlock-dev/pkg-unpacker): 135 stars · MIT · last push 2026-10 · Unpack pkg, nexe, caxa, Node.js SEA and Bun single-file binaries.
- [diommsantos/QtREAnalyzer](https://github.com/diommsantos/QtREAnalyzer): 134 stars · last push 2025-04 · QtREAnalyzer, a Ghidra extension to reverse-engineer Qt binaries.
- [GaloisInc/grease](https://github.com/GaloisInc/grease): 134 stars · BSD-3-Clause · last push 2026-10 · CLI tool, Ghidra plug-in, and Haskell library for analyzing binaries using under-constrained symbolic execution
- [0xdea/haruspex](https://github.com/0xdea/haruspex): 133 stars · MIT · last push 2026-10 · Vulnerability research assistant that extracts pseudocode from the IDA Hex-Rays decompiler.
- [darx0r/Stingray](https://github.com/darx0r/Stingray): 133 stars · GPL-3.0 · last push 2022-05 · IDAPython plugin for finding function strings recursively
- [x86byte/LummaC2-Stealer](https://github.com/x86byte/LummaC2-Stealer): 130 stars · last push 2025-02 · LummaC2 extracted binaries by reversing & LummaC2 Stealer Analysis
- [vgrichina/berrry-wine](https://github.com/vgrichina/berrry-wine): 129 stars · MIT · last push 2026-10 · Run real Windows 98 apps and games in your browser. An x86 emulator and Win32 layer written directly in WebAssembly Text, no OS image, no source ports.
- [elliiot/ghidra_darknight](https://github.com/elliiot/ghidra_darknight): 128 stars · last push 2020-09 · DarkNight theme for Ghidra
- [L4ys/LazyCross](https://github.com/L4ys/LazyCross): 128 stars · GPL-3.0 · last push 2026-01 · An IDA Pro plugin that display cross-references to functions or variables across the entire binary in Hex-Rays pseudocode
- [patois/mrspicky](https://github.com/patois/mrspicky): 128 stars · last push 2024-03 · MrsPicky - An IDAPython decompiler script that helps auditing memcpy() and memmove() calls
- [wernsey/chip8](https://github.com/wernsey/chip8): 127 stars · Apache-2.0 · last push 2025-02 · A CHIP-8 interpreter, assembler and disassembler in C
- [digitalw0lf/hextor](https://github.com/digitalw0lf/hextor): 125 stars · last push 2026-04 · Hextor - Hexadecimal editor and binary data analyzing toolkit
- [XboxDev/ghidra-xbe](https://github.com/XboxDev/ghidra-xbe): 125 stars · last push 2026-10 · Xbox Executable Format (XBE) Loader Extension for Ghidra SRE framework
- [0xdea/augur](https://github.com/0xdea/augur): 121 stars · MIT · last push 2026-10 · Reverse engineering assistant that extracts strings and related pseudocode from a binary file.
- [suifei/asm2hex](https://github.com/suifei/asm2hex): 120 stars · MIT · last push 2026-07 · ASM2HEX is a powerful tool for bidirectional conversion between assembly language and hexadecimal machine code. Its intuitive graphical interface makes conversion easy and provides accurate, reliable results for ARM64, ARM, and Thumb instruction sets.
- [ytisf/GhidraMacOS](https://github.com/ytisf/GhidraMacOS): 118 stars · MIT · last push 2026-07 · An installer and compiler for Ghidra for MacOS ARM64 or "Apple Silicon"
- [ant4g0nist/decompiler](https://github.com/ant4g0nist/decompiler): 116 stars · MIT · last push 2026-02 · Ghidra decompiler plugin for LLDB
- [utkonos/lst2x64dbg](https://github.com/utkonos/lst2x64dbg): 116 stars · GPL-3.0 · last push 2023-11 · Extract labels from IDA, Ghidra, Binary Ninja, and Relyze files and export x64dbg database. Including radare2 main address.
- [ax330d/functions-plus](https://github.com/ax330d/functions-plus): 115 stars · MIT · last push 2021-04 · IDA Pro plugin to show functions in a tree view
- [acuarica/evm](https://github.com/acuarica/evm): 114 stars · MIT · last push 2026-05 · A Symbolic Ethereum Virtual Machine (EVM) bytecode interpreter, parser and decompiler, along with several other utils for programmatically extracting information from EVM bytecode.
- [zxgio/r2-cheatsheet](https://github.com/zxgio/r2-cheatsheet): 114 stars · GPL-3.0 · last push 2018-11 · Radare2 cheat-sheet
- [giladreich/ida_migrator](https://github.com/giladreich/ida_migrator): 113 stars · MIT · last push 2021-05 · IDA Migrator is an IDA Pro plugin which helps migrate existing work from one database instance to another. It Conveniently migrates function names, structures and enums.
- [doronz88/fa](https://github.com/doronz88/fa): 112 stars · GPL-3.0 · last push 2026-03 · Automation tool for locating symbols & structs in binary (primary IDA focused)
- [guedou/jupyter-radare2](https://github.com/guedou/jupyter-radare2): 110 stars · LGPL-3.0 · last push 2017-12 · Just a simple radare2 Jupyter kernel
- [abenkhadra/spedi](https://github.com/abenkhadra/spedi): 109 stars · BSD-3-Clause · last push 2018-07 · Speculative disassembly, CFG recovery, and call-graph recovery from stripped binaries.
- [0xroman1/Scuffed_Low_Level_Stash](https://github.com/0xroman1/Scuffed_Low_Level_Stash): 108 stars · last push 2020-09 · Stash for Binary Exploitation and Reverse Engineering Resources
- [garyttierney/intellij-ghidra](https://github.com/garyttierney/intellij-ghidra): 107 stars · last push 2026-07 · An IntelliJ IDEA plugin for working on Ghidra Extensions.
- [aerosoul94/ida_gel](https://github.com/aerosoul94/ida_gel): 106 stars · last push 2019-10 · A collection of IDA loaders for various game console ELF's. (PS3, PSVita, WiiU)
- [jonomango/chum](https://github.com/jonomango/chum): 106 stars · MIT · last push 2024-02 · Binary rewriter for 64-bit PE files.
- [AllsafeCyberSecurity/ghidra_scripts](https://github.com/AllsafeCyberSecurity/ghidra_scripts): 105 stars · last push 2024-01 · Ghidra scripts for malware analysis
- [davep/dhv](https://github.com/davep/dhv): 103 stars · GPL-3.0 · last push 2026-02 · Dive into Python code
- [guedou/r2m2](https://github.com/guedou/r2m2): 103 stars · LGPL-3.0 · last push 2020-01 · radare2 + miasm2 = ♥
- [Karib0u/kernagent](https://github.com/Karib0u/kernagent): 103 stars · Apache-2.0 · last push 2025-12 · Headless AI agent for deterministic reverse engineering.
- [fdrechsler/mcp-server-idapro](https://github.com/fdrechsler/mcp-server-idapro): 101 stars · MIT · last push 2025-03 · A Model Context Protocol (MCP) server that enables AI assistants to interact with IDA Pro for reverse engineering and binary analysis tasks.
- [zyantific/zydis-rs](https://github.com/zyantific/zydis-rs): 101 stars · MIT · last push 2025-11 · Zydis Rust Bindings
- [extremecoders-re/ghidra-jni](https://github.com/extremecoders-re/ghidra-jni): 100 stars · last push 2020-03 · jni.h compiled for Ghidra
- [ferib/LuaToolkit](https://github.com/ferib/LuaToolkit): 100 stars · MIT · last push 2023-07 · Lua Encode/Decoder/Disassembler/Decompiler in C#
- [MahdiSafsafi/UnivDisasm](https://github.com/MahdiSafsafi/UnivDisasm): 100 stars · MPL-2.0 · last push 2019-01 · x86 Disassembler and Analyzer
- [radareorg/radare2-webui](https://github.com/radareorg/radare2-webui): 100 stars · last push 2026-08 · webui repository for radare2
- [WPeace-HcH/ElfDumper](https://github.com/WPeace-HcH/ElfDumper): 100 stars · last push 2023-04 · A plugin for IDA that can dump the ELF file easily.
- [antoniovazquezblanco/GhidraFindcrypt](https://github.com/antoniovazquezblanco/GhidraFindcrypt): 99 stars · GPL-3.0 · last push 2026-10 · Ghidra analysis plugin to locate cryptographic constants
- [cseagle/collabREate](https://github.com/cseagle/collabREate): 98 stars · GPL-2.0 · last push 2021-09 · Collaborative reverse engineering plugin for IDA Pro. Latest version, including IDA 7.0 support, is not back ward compatible with earlier versions. Substantial changes have been made to the protocol and database.
- [black-binary/sleigh](https://github.com/black-binary/sleigh): 96 stars · Apache-2.0 · last push 2022-04 · A (SLEIGH) disassembler that supports multiple architectures
- [blakebratcher/bitwig-nitro-tools](https://github.com/blakebratcher/bitwig-nitro-tools): 95 stars · MIT · last push 2026-08 · Offline reverse-engineering toolchain for Bitwig Studio's Nitro DSP format — decrypt, decompile, and read the DSP behind every native device and Grid module. Tools + format specs only; no Bitwig source or keys.
- [grompe/kbdasm](https://github.com/grompe/kbdasm): 95 stars · last push 2017-03 · Assembler/disassembler of Windows keyboard layouts in flat assembler
- [patois/hexrays_scripts](https://github.com/patois/hexrays_scripts): 95 stars · CC0-1.0 · last push 2023-07 · Various scripts for the Hexrays decompiler
- [SourceDiver42/Ghidra-ChatGPT](https://github.com/SourceDiver42/Ghidra-ChatGPT): 95 stars · GPL-3.0 · last push 2022-12 · No description supplied by the upstream repository.
- [swojtasiak/fcml-lib](https://github.com/swojtasiak/fcml-lib): 95 stars · LGPL-2.1 · last push 2026-05 · A general purpose machine code manipulation library for x86-32 (IA-32) and x86-64 (AMD64) architectures (Assembler, Disassembler, Library).
- [vtil-project/VTIL-BinaryNinja](https://github.com/vtil-project/VTIL-BinaryNinja): 95 stars · last push 2026-04 · Binary Ninja plugin for loading VTIL routines and lifting VTIL instructions to LLIL for analysis.
- [goatmilkkk/nuitka-helper](https://github.com/goatmilkkk/nuitka-helper): 94 stars · GPL-3.0 · last push 2024-12 · Symbol Recovery Tool for Nuitka Binaries
- [ntpopgetdope/ida-rpc](https://github.com/ntpopgetdope/ida-rpc): 94 stars · MIT · last push 2019-04 · Discord rich presence plugin for IDA Pro 7.0
- [TouchFriend/DoubanMApp](https://github.com/TouchFriend/DoubanMApp): 94 stars · MIT · last push 2026-09 · An ad-free Douban client implemented through iOS reverse engineering. Thanks for using it; stars are welcome.
- [NeverSight/NeverD](https://github.com/NeverSight/NeverD): 93 stars · last push 2026-10 · The AI-friendly binary analysis & decompilation engine — 1:1 lift, built on LLVM [WIP]
- [zer0condition/NTMemory](https://github.com/zer0condition/NTMemory): 93 stars · MIT · last push 2026-03 · Usermode NT Explorer - Query kernel addresses, translate virtual to physical addresses, inspect the PFN database, and more.
- [ZX41R/awesome-reverse-engineering-and-malware-analysis](https://github.com/ZX41R/awesome-reverse-engineering-and-malware-analysis): 92 stars · CC0-1.0 · last push 2026-10 · A verified map of reverse engineering and malware analysis. Disassemblers, unpacking, exploit dev, fuzzing, DFIR, and the deep-cut writeups other lists miss.
- [enovella/ida2ghidra-kb](https://github.com/enovella/ida2ghidra-kb): 91 stars · last push 2019-04 · IDA Pro to Ghidra Key Bindings to feel like if you were in IDA Pro when navigating
- [fonic/wcdatool](https://github.com/fonic/wcdatool): 91 stars · last push 2026-02 · Watcom Disassembly Tool (wcdatool) - Tool to aid disassembling DOS applications created with the Watcom Toolchain
- [JayRE114514/UserComment](https://github.com/JayRE114514/UserComment): 91 stars · MIT · last push 2023-06 · An IDA pro plugin to display user-added comments in disassembly and pseudocode views.
- [maskelihileci/IDA_Ollvm-unflattener](https://github.com/maskelihileci/IDA_Ollvm-unflattener): 91 stars · Apache-2.0 · last push 2025-04 · Control Flow Flattening Deobfuscator for Obfuscator-LLVM as a plugin for IDA Pro.
- [VBrazhnik/Corewar](https://github.com/VBrazhnik/Corewar): 91 stars · last push 2019-01 · School 42 project // Implementation of programming game “Core War” [Champions + Assembler + Disassembler + Virtual Machine + Visualizer]
- [joshleaves/ghidra-snes](https://github.com/joshleaves/ghidra-snes): 90 stars · MIT · last push 2026-05 · Ghidra scripts for SNES ROM reverse engineering
- [Krietz7/IDA-DataExportPlus](https://github.com/Krietz7/IDA-DataExportPlus): 90 stars · MIT · last push 2026-01 · An IDA Pro plugin to export data better
- [Kazhuu/asm2cfg](https://github.com/Kazhuu/asm2cfg): 89 stars · MIT · last push 2024-04 · Python command-line tool and GDB extension to view and save x86, ARM and objdump assembly files as control-flow graph (CFG) pdf files
- [agustingianni/retools](https://github.com/agustingianni/retools): 88 stars · MIT · last push 2017-12 · retools: a reverse engineering toolkit for normies
- [kweatherman/yara4ida](https://github.com/kweatherman/yara4ida): 88 stars · last push 2025-10 · Unofficial YARA IDA Pro plugin, along with an unparalleled crypto/hash/compression rule set based on Luigi Auriemma's signsrch signatures.
- [lifting-bits/patchestry](https://github.com/lifting-bits/patchestry): 88 stars · Apache-2.0 · last push 2026-09 · Patchestry is a binary patching framework built with MLIR and Ghidra.
- [vega-979/Sigga](https://github.com/vega-979/Sigga): 88 stars · GPL-3.0 · last push 2026-10 · sigmaker for Ghidra
- [fjqisba/QtMetaParser](https://github.com/fjqisba/QtMetaParser): 87 stars · MIT · last push 2025-01 · ida plugin to parse qt meta data
- [firstfault/Trinity](https://github.com/firstfault/Trinity): 86 stars · Apache-2.0 · last push 2026-08 · Software reverse engineering tool for Java
- [rsc-dev/pbd](https://github.com/rsc-dev/pbd): 86 stars · MIT · last push 2021-01 · Pbd is a Python module to disassemble serialized protocol buffers descriptors (https://developers.google.com/protocol-buffers/).
- [jverkoey/windfish](https://github.com/jverkoey/windfish): 85 stars · Apache-2.0 · last push 2021-02 · A tracing disassembler & UI for Gameboy ROMs — integrated with Sameboy for emulation & debugging.
- [yetmorecode/ghidra-lx-loader](https://github.com/yetmorecode/ghidra-lx-loader): 85 stars · Apache-2.0 · last push 2026-08 · Ultimate Ghidra loader for the LX/LE executable file format (OS/2, DOS4GW, VxD)
- [eset/nimfilt](https://github.com/eset/nimfilt): 84 stars · BSD-2-Clause · last push 2024-10 · A collection of modules and scripts to help with analyzing Nim binaries
- [merces/showcomments](https://github.com/merces/showcomments): 84 stars · GPL-3.0 · last push 2026-06 · IDA Pro plugin to display and search comments in the database
- [samth/disassemble](https://github.com/samth/disassemble): 84 stars · MIT · last push 2026-09 · Disassembler for Racket
- [sgInnora/sentinel-reverse](https://github.com/sgInnora/sentinel-reverse): 84 stars · MIT · last push 2026-02 · AI-Powered Autonomous Binary Reverse Engineering CLI — the native reverse engine from Innora-Sentinel. Local LLM inference (MLX), MPS GPU acceleration, multi-round iterative analysis, zero API cost.
- [sonicfreak1337/SARecomp](https://github.com/sonicfreak1337/SARecomp): 84 stars · last push 2026-10 · A fully playable, work-in-progress native Sonic Adventure port for Windows, Linux and Steam Deck. Powered by KatanaRecomp.
- [milankovo/hexinlay](https://github.com/milankovo/hexinlay): 83 stars · MIT · last push 2026-04 · Inlay hints for hex-rays
- [Mizari/phrank](https://github.com/Mizari/phrank): 83 stars · MIT · last push 2024-03 · Tool that automates some useful structure routines in IDA PRO
- [purseclab/DnD](https://github.com/purseclab/DnD): 83 stars · Apache-2.0 · last push 2024-12 · A decompiler to automatically reverse-engineer the DNN semantics from its compiled binary using program analysis
- [serene-brew/ESPionage](https://github.com/serene-brew/ESPionage): 83 stars · BSD-3-Clause · last push 2025-10 · ESP8266 and EPS32 firmware binaries analysis toolkit
- [futo-org/ret](https://github.com/futo-org/ret): 82 stars · GPL-2.0 · last push 2026-10 · Browser Assembler/Disassembler/Emulator Tool
- [stuxnet147/IDA-Assistant](https://github.com/stuxnet147/IDA-Assistant): 82 stars · MIT · last push 2025-02 · IDA plugin to support automatic reverse engineering
- [cristeigabriela/IDAFind](https://github.com/cristeigabriela/IDAFind): 81 stars · Unlicense · last push 2026-03 · Have you ever wondered: what if IDA had great Ctrl+F search support for Pseudocode windows? No longer!
- [KaikoClanworth1/wwe-svr2011-pc](https://github.com/KaikoClanworth1/wwe-svr2011-pc): 81 stars · last push 2026-10 · Unofficial native PC port of WWE SmackDown vs. Raw 2011 (Xbox 360). Bring your own disc.
- [ayoubfaouzi/binary-auditing-solutions](https://github.com/ayoubfaouzi/binary-auditing-solutions): 80 stars · last push 2020-12 · Learn the fundamentals of Binary Auditing. Know how HLL mapping works, get more inner file understanding than ever.
- [hasherezade/ViDi](https://github.com/hasherezade/ViDi): 80 stars · BSD-2-Clause · last push 2025-10 · ViDi Visual Disassembler (experimental)
- [abatchy17/Introduction-To-Manual-Backdooring](https://github.com/abatchy17/Introduction-To-Manual-Backdooring): 79 stars · last push 2017-05 · Executables created while writing "Introduction to Manual Backdooring".
- [guedou/TS-453Be](https://github.com/guedou/TS-453Be): 79 stars · last push 2020-09 · Ubuntu on QNAP TS-453Be
- [elliottophellia/Ryuumonbuchi](https://github.com/elliottophellia/Ryuumonbuchi): 78 stars · GPL-2.0 · last push 2026-08 · Maybe the headless Ghidra MCP you are looking for.
- [yaz0r/Noah](https://github.com/yaz0r/Noah): 78 stars · MIT · last push 2026-04 · Decompilation of Xenogears.
- [cve-north-stars/cve-north-stars.github.io](https://github.com/cve-north-stars/cve-north-stars.github.io): 77 stars · CC-BY-4.0 · last push 2024-04 · Leveraging CVEs as North Stars in vulnerability discovery and comprehension.
- [dukebarman/ghidra-builder](https://github.com/dukebarman/ghidra-builder): 77 stars · Apache-2.0 · last push 2022-11 · Docker image for building ghidra RE framework from source
- [TomashuTTTT7/Hidecall](https://github.com/TomashuTTTT7/Hidecall): 77 stars · MIT · last push 2021-04 · Hide function calls to prevent reverse-engineering
- [br0kej/bin2ml](https://github.com/br0kej/bin2ml): 76 stars · MIT · last push 2025-05 · A command line tool for extracting machine learning ready data from software binaries powered by Radare2
- [CSIT-SG/AETHER](https://github.com/CSIT-SG/AETHER): 76 stars · GPL-3.0 · last push 2026-09 · An AI-powered reverse-engineering copilot for assisting tedious malware analysis in IDA Pro.
- [Gui-Yom/hlbc](https://github.com/Gui-Yom/hlbc): 76 stars · MIT · last push 2024-08 · Hashlink bytecode disassembler, analyzer, decompiler and assembler.
- [Mizari/herast](https://github.com/Mizari/herast): 76 stars · last push 2024-04 · Framework to automate working with AST in IDA Pro
- [Wack0/IFPSTools.NET](https://github.com/Wack0/IFPSTools.NET): 76 stars · last push 2026-08 · Tools for creating, modifying, assembling and disassembling RemObjects PascalScript files.
- [AzzOnFire/emuit](https://github.com/AzzOnFire/emuit): 75 stars · GPL-3.0 · last push 2025-11 · Easy-to-use IDA plugin for code emulation
- [hugsy/binja-headless](https://github.com/hugsy/binja-headless): 75 stars · MIT · last push 2025-02 · Binja (sort of) headless
- [OSUSecLab/QtRE](https://github.com/OSUSecLab/QtRE): 75 stars · Apache-2.0 · last push 2024-10 · A Ghidra headless analyzer tailored for Qt binary analysis
- [radareorg/r4ghidra](https://github.com/radareorg/r4ghidra): 75 stars · last push 2026-10 · Ghidra plugin to communicate with radare2
- [zerotypic/wilhelm](https://github.com/zerotypic/wilhelm): 75 stars · GPL-3.0 · last push 2023-09 · Alternative API for IDA / Hex-Rays
- [Druthulu/BFM-decomp](https://github.com/Druthulu/BFM-decomp): 74 stars · AGPL-3.0 · last push 2026-10 · Matching decompilation of Brave Fencer Musashi (PS1, SLUS-00726): 218 binaries rebuild byte-identical from C
- [drvink/epanos](https://github.com/drvink/epanos): 74 stars · last push 2014-05 · ElectroPaint Automatic No-source Object reaSsembler (a MIPS to C decompiler)
- [gabimarti/crackmes-solutions](https://github.com/gabimarti/crackmes-solutions): 73 stars · last push 2022-11 · Solutions to some crackmes that I have done.
- [intezer/analyze-community-ghidra-plugin](https://github.com/intezer/analyze-community-ghidra-plugin): 73 stars · BSD-3-Clause · last push 2022-10 · Ghidra plugin for https://analyze.intezer.com
- [pointblank-club/vestigo](https://github.com/pointblank-club/vestigo): 73 stars · Apache-2.0 · last push 2026-04 · An end-to-end pipeline for firmware analysis and cryptographic function detection. Static analysis (Ghidra), dynamic tracing (Qiling), and feature extraction to produce datasets for binary analysis.
- [binarly-io/idapcode](https://github.com/binarly-io/idapcode): 72 stars · last push 2025-11 · IDA plugin that displays the P-code for the current function
- [rair-project/rair](https://github.com/rair-project/rair): 72 stars · LGPL-3.0 · last push 2026-07 · RAIR: RAdare In Rust
- [aerosoul94/dynlib](https://github.com/aerosoul94/dynlib): 71 stars · last push 2018-03 · IDA Pro plugin to aid PS4 user mode ELF reverse engineering.
- [anic/ida2pwntools](https://github.com/anic/ida2pwntools): 71 stars · Apache-2.0 · last push 2023-03 · a IDA 7.0 plugins that helps to attach process created by pwntools and debug pwn
- [lpg2709/emulator-Intel-4004](https://github.com/lpg2709/emulator-Intel-4004): 71 stars · MIT · last push 2025-04 · Simple emulator of the Intel 4004 chip. Mirror from https://gitlab.com/lpg2709/emulator-Intel-4004
- [teapotd/xdeobf](https://github.com/teapotd/xdeobf): 70 stars · last push 2022-07 · A deobfuscation plugin for IDA
- [kohnakagawa/PracticalPCode](https://github.com/kohnakagawa/PracticalPCode): 69 stars · MIT · last push 2021-02 · Practical P-Code examples
- [tacesrever/Il2CppParser](https://github.com/tacesrever/Il2CppParser): 69 stars · MIT · last push 2020-01 · libil2cpp symbol parser for ida
- [garyttierney/ghidra-batteries-included](https://github.com/garyttierney/ghidra-batteries-included): 68 stars · last push 2023-03 · Builds of Ghidra 10.1 with additional components included.
- [ivision-research/banjo](https://github.com/ivision-research/banjo): 68 stars · MIT · last push 2025-07 · Android Dex disassembler and Binary Ninja plugin
- [mytechnotalent/rea](https://github.com/mytechnotalent/rea): 68 stars · MIT · last push 2026-10 · The reverse-engineering framework you can run anywhere, with nothing installed, and actually trust.
- [sarb2u/luau-bytecode-lens](https://github.com/sarb2u/luau-bytecode-lens): 68 stars · last push 2026-10 · Best Open-Source Luau Obfuscator and Decompiler Suite 2026
- [krakenlake/vmon](https://github.com/krakenlake/vmon): 67 stars · MIT · last push 2026-05 · Tiny RISC-V machine code monitor written in RISC-V assembly.
- [lynnswap/ABIBridge](https://github.com/lynnswap/ABIBridge): 67 stars · MIT · last push 2026-10 · Resolve and invoke native APIs from Swift, Objective-C++, and C++ without writing mangled names or manual ABI casts.
- [rizinorg/jsdec](https://github.com/rizinorg/jsdec): 67 stars · last push 2026-07 · Simple decompiler for Rizin. It's capable of generating readable pseudo code even on handmade assembly.
- [splintersfury/AutoPiff](https://github.com/splintersfury/AutoPiff): 67 stars · MIT · last push 2026-02 · Semantic analysis engine for detecting vulnerability fixes in Windows kernel driver patches — 58 YAML rules, Ghidra decompilation, reachability tracing, and scoring
- [ergrelet/triton-bn](https://github.com/ergrelet/triton-bn): 66 stars · Apache-2.0 · last push 2024-07 · Binary Ninja plugin that can be used to apply Triton's dead store eliminitation pass on basic blocks or functions.
- [IDouble/Simple-Disassembly-Notes](https://github.com/IDouble/Simple-Disassembly-Notes): 66 stars · MIT · last push 2024-02 · ⚙️ Simple Step to Step Tutorials for Disassembling / Code Injection & getting Pointer Addresses 🔧
- [N0zoM1z0/dx-ball](https://github.com/N0zoM1z0/dx-ball): 66 stars · MIT · last push 2026-10 · Reconstructing DX-Ball 1.07 with REA, backed by original-x86 differential tests and pinned MSVC byte-exact oracles.
- [pandaadir05/re-architect](https://github.com/pandaadir05/re-architect): 66 stars · MIT · last push 2025-09 · Advanced reverse engineering platform combining traditional static analysis with AI-powered insights. Supports multiple decompilers (Ghidra, IDA Pro, Binary Ninja), automated function analysis, and interactive web visualization for comprehensive binary analysis workflows.
- [seekbytes/ptxNinja](https://github.com/seekbytes/ptxNinja): 66 stars · GPL-3.0 · last push 2026-03 · Binary Ninja plugin for reverse engineering PTX -- the virtual instruction set architecture of CUDA-based GPUs.
- [tmr232/BRUTAL-IDA](https://github.com/tmr232/BRUTAL-IDA): 65 stars · MIT · last push 2019-08 · Block Redo & Undo To Achieve Legacy IDA
- [jpleasu/ghidraal](https://github.com/jpleasu/ghidraal): 64 stars · last push 2021-04 · A Ghidra extension for scripting with GraalVM languages, including Javascript, Python3, R, and Ruby.
- [radareorg/r2wars](https://github.com/radareorg/r2wars): 64 stars · last push 2026-09 · Corewars but within r2
- [archercreat/ida_names](https://github.com/archercreat/ida_names): 63 stars · last push 2022-12 · IDA-names automatically renames pseudocode windows with the current function name.
- [rr-/ida-images](https://github.com/rr-/ida-images): 63 stars · MIT · last push 2022-09 · Image preview plugin for IDA disassembler.
- [vmallet/ida-hex-highlighter](https://github.com/vmallet/ida-hex-highlighter): 63 stars · MIT · last push 2022-04 · Hex-Rays Block Highlighter plugin for IDA to highlight if/for/do/switch/while blocks
- [Accenture/Condstanta](https://github.com/Accenture/Condstanta): 62 stars · Apache-2.0 · last push 2022-03 · No description supplied by the upstream repository.
- [kevinmuoz/ida-theme-explorer](https://github.com/kevinmuoz/ida-theme-explorer): 62 stars · MIT · last push 2026-03 · Install and browse 100+ community themes for IDA Pro (Dracula, Monokai, Solarized and more)
- [zhuyie/bsdiff](https://github.com/zhuyie/bsdiff): 61 stars · last push 2026-03 · bsdiff is a library for building and applying patches to binary files.
- [brnpl/Flutter-Reverse-Engineering-Labs](https://github.com/brnpl/Flutter-Reverse-Engineering-Labs): 59 stars · MIT · last push 2026-09 · Hands-on challenges for learning how to reverse engineer Flutter applications.
- [iExplosiveRage/DBZ-Burst-Limit-Recompiled](https://github.com/iExplosiveRage/DBZ-Burst-Limit-Recompiled): 59 stars · last push 2026-10 · Dragon Ball Z: Burst Limit Recompiled - native PC port via ReXGlue static recompilation
- [TheRomanXpl0it/ghidra-emu-fun](https://github.com/TheRomanXpl0it/ghidra-emu-fun): 59 stars · Apache-2.0 · last push 2020-10 · Ghidra Emulates Functions
- [partoftheworlD/GHIDRApy_FunctionStringAssociate](https://github.com/partoftheworlD/GHIDRApy_FunctionStringAssociate): 57 stars · MIT · last push 2026-09 · It does the same thing as plugin FunctionStringAssociate for IDA, Now the script just works, in the future it is planned to increase the speed of work and bring it closer to the speed of the plugin.
- [BlackwingHQ/iBoot64Binja](https://github.com/BlackwingHQ/iBoot64Binja): 56 stars · MIT · last push 2024-01 · Binary View plugin for reverse engineering iBoot like binaries with Binary Ninja
- [nccgroup/ghidra-nanomips](https://github.com/nccgroup/ghidra-nanomips): 56 stars · GPL-3.0 · last push 2025-11 · nanoMIPS module for Ghidra
- [YuAo/MetalLibraryExplorer](https://github.com/YuAo/MetalLibraryExplorer): 56 stars · MIT · last push 2023-07 · Parse and disassemble .metallib files in browser
- [1rhino2/fnprint](https://github.com/1rhino2/fnprint): 55 stars · MIT · last push 2026-10 · match functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.
- [seifreed/r2inspect](https://github.com/seifreed/r2inspect): 55 stars · GPL-3.0 · last push 2026-09 · r2inspect is a professional malware analysis framework that automates deep static inspection for PE, ELF, and Mach-O binaries using the radare2 ecosystem. It combines format parsing, detection heuristics, and rich reporting to support reverse engineers, incident responders, and threat analysts.
- [radareorg/r2web](https://github.com/radareorg/r2web): 53 stars · MIT · last push 2026-10 · Access radare2 from anywhere, anytime.
- [seifreed/r2morph](https://github.com/seifreed/r2morph): 53 stars · MIT · last push 2026-09 · A metamorphic binary transformation engine based on r2pipe and radare2.
- [amd2g2zz/kunglao-agent](https://github.com/amd2g2zz/kunglao-agent): 52 stars · AGPL-3.0 · last push 2026-10 · The reverse-engineering expert agent: plans its own analysis path, derives every fact from raw evidence, and converges under mechanical verification gates — firmware, protocols, web/JS, risk-control, binaries.
- [goatshriek/ruby-dragon](https://github.com/goatshriek/ruby-dragon): 51 stars · Apache-2.0 · last push 2025-12 · Ruby, Kotlin, Groovy, Clojure, and JShell support for Ghidra scripting and interactive sessions.
- [radareorg/radare2-r2papi](https://github.com/radareorg/radare2-r2papi): 51 stars · last push 2026-10 · High Level API on top of the R2Pipe interface
- [ac3ss0r/Il2Cpp-Reversal-POC](https://github.com/ac3ss0r/Il2Cpp-Reversal-POC): 50 stars · Apache-2.0 · last push 2026-10 · Proof of concept for reverse engineering and exploiting Android Unity IL2CPP games by patching assembly at runtime.
- [enovella/re-scripts](https://github.com/enovella/re-scripts): 50 stars · last push 2019-07 · IDA, Ghidra and Radare2 scripts. Also Android scripts to make your life easier.
- [gum3t/chameleon](https://github.com/gum3t/chameleon): 50 stars · MIT · last push 2025-10 · Chameleon is a polymorphic engine for x86_64 position independent shellcode that has been created out of the need to evade signature-based detections in red team environments.
- [RenardDev/IDATeamsDocker](https://github.com/RenardDev/IDATeamsDocker): 50 stars · MIT · last push 2026-07 · Docker configuration (and only docker configuration) files for hosting self-hosted Hexvault, Lumina and Hexlicsrv.
- [monosource/radare2-explorations](https://github.com/monosource/radare2-explorations): 49 stars · last push 2020-09 · A book on learning radare2.
- [wasmkit/diswasm](https://github.com/wasmkit/diswasm): 49 stars · MIT · last push 2024-12 · Decompiler and reverse engineering tool for wasm binaries
- [radareorg/libdemangle](https://github.com/radareorg/libdemangle): 48 stars · last push 2020-12 · A simple library focusing on demangling symbols for different programing languages
- [membrowse/membrowse-action](https://github.com/membrowse/membrowse-action): 47 stars · GPL-3.0 · last push 2026-10 · Track and analyze binary size and memory footprint in embedded firmware
- [not-alons/hmfomt](https://github.com/not-alons/hmfomt): 47 stars · last push 2021-05 · Disassembly/Decompilation of Harvest Moon: Friends of Mineral Town
- [zmrbak/ReverseAnalysis](https://github.com/zmrbak/ReverseAnalysis): 47 stars · MIT · last push 2021-05 · Example code for the online course Introduction to x86/x64 Software Reverse Engineering.
- [pcyin/dire](https://github.com/pcyin/dire): 45 stars · last push 2020-05 · Neural Variable Renaming for Decompiled Binaries
- [radareorg/r2pipe.rs](https://github.com/radareorg/r2pipe.rs): 45 stars · last push 2026-03 · Rust crate for r2pipe
- [TouchFriend/BiliBiliTweak](https://github.com/TouchFriend/BiliBiliTweak): 45 stars · MIT · last push 2026-04 · An ad-free BiliBili jailbreak tweak. Thanks for using it; stars are welcome.
- [buzzer-re/ToCode](https://github.com/buzzer-re/ToCode): 43 stars · MIT · last push 2026-10 · Transform binaries into source-code-like projects that coding agents can traverse, analyze, and use as an oracle for large binaries. Supports IDA Pro, radare2, angr and Binary Ninja.
- [ltlly/MikuCffHelper](https://github.com/ltlly/MikuCffHelper): 42 stars · last push 2026-09 · Use binaryninja workflow to deflat ollvm cff
- [tinysec/rtypes](https://github.com/tinysec/rtypes): 41 stars · GPL-3.0 · last push 2024-04 · A simple but useful project maybe help you reverse Windows.
- [MatrixEditor/caterpillar](https://github.com/MatrixEditor/caterpillar): 40 stars · GPL-3.0 · last push 2026-08 · A Python 3.10+ library to pack and unpack structured binary data.
- [antoniovazquezblanco/GhidraDeviceTreeBlob](https://github.com/antoniovazquezblanco/GhidraDeviceTreeBlob): 38 stars · last push 2026-10 · Import Device Tree Information onto your Ghidra memory map
- [Dryxio/samp-source](https://github.com/Dryxio/samp-source): 38 stars · last push 2026-09 · Rebuilding SA-MP 0.3.7 R5 from source, byte for byte. AI-assisted reverse engineering with verifiable binary matches.
- [j0shua-SYSON/S5LBox](https://github.com/j0shua-SYSON/S5LBox): 38 stars · MIT · last push 2026-10 · Boot real iPhone OS 3 — Apple's actual kernel, launchd & SpringBoard — inside an app on a modern iPhone. A from-scratch, full-system S5L8900/ARMv6 emulator in portable C.
- [MaryNCRT/Ultimate-Mortal-Kombat-3-iOS-Recomp](https://github.com/MaryNCRT/Ultimate-Mortal-Kombat-3-iOS-Recomp): 38 stars · last push 2026-10 · Ultimate Mortal Kombat 3 (iOS, EA Mobile 2011), fully decompiled: all 2,572 game functions are readable C, checked against a static ARM-to-C recompiler. Native port in progress: menus, sound and saves run; fight data tables extracted from your copy and verified; not playable yet. No game assets - bring your own copy.
- [radareorg/r2unity](https://github.com/radareorg/r2unity): 38 stars · MIT · last push 2026-10 · Reverse engineer Unity games with radare2
- [sp00nznet/redalert2-recomp](https://github.com/sp00nznet/redalert2-recomp): 38 stars · last push 2026-10 · Static recompilation of Command & Conquer: Red Alert 2 / Yuri's Revenge (Westwood, 2000-01) to native C, with the remaster the engine never got: a D3D11 presenter, 720p to 4K, HD voxel units. Built on pcrecomp.
- [sterrasec/genpatch](https://github.com/sterrasec/genpatch): 38 stars · MIT · last push 2023-12 · genpatch is IDA plugin that generates a python script for patching binary
- [therealdreg/linux_kernel_debug_disassemble_ida_vmware](https://github.com/therealdreg/linux_kernel_debug_disassemble_ida_vmware): 38 stars · MIT · last push 2023-08 · Helper script for Linux kernel disassemble or debugging with IDA Pro on VMware + GDB stub (including some symbols helpers)
- [vaguue/Ghidra.js](https://github.com/vaguue/Ghidra.js): 38 stars · GPL-3.0 · last push 2026-09 · JavaScript bindings for Ghidra with AI agent support
- [antoniovazquezblanco/GhidraExtendedSourceParser](https://github.com/antoniovazquezblanco/GhidraExtendedSourceParser): 37 stars · last push 2026-10 · User friendly ways to parse small code snippets into data types in Ghidra.
- [cxiao/ida-rust-untangler](https://github.com/cxiao/ida-rust-untangler): 37 stars · MIT · last push 2023-12 · An IDA plugin which demangles Rust function names
- [msm-code/GhidraCtrlP](https://github.com/msm-code/GhidraCtrlP): 37 stars · last push 2024-12 · Ctrl+P plugin for Ghidra: quick search and command palette.
- [schlafwandler/ghidra_ExportToX64dbg](https://github.com/schlafwandler/ghidra_ExportToX64dbg): 37 stars · last push 2023-01 · A Ghidra script to export data to a x64dbg database
- [E3V3A/hex2bin](https://github.com/E3V3A/hex2bin): 36 stars · last push 2018-11 · An old CLI tool to parse Intel/Motorola formatted HEX ASCII firmware files into binary blobs
- [fearkov/3dsrecomp](https://github.com/fearkov/3dsrecomp): 36 stars · last push 2026-10 · Static recompiler for Nintendo 3DS games, from ARM to C
- [gcarmix/hexdig](https://github.com/gcarmix/hexdig): 36 stars · GPL-3.0 · last push 2026-06 · Binary blob analyzer and extractor based on C++
- [jjazzboss/colorbindiff](https://github.com/jjazzboss/colorbindiff): 36 stars · LGPL-3.0 · last push 2022-02 · A visual and colorized diff for binary files.
- [GeT1t/deollvm](https://github.com/GeT1t/deollvm): 35 stars · last push 2019-07 · deollvm arm64 based unicorn
- [ilyakharlamov/Ghidra-Nes-Rom-Decompiler-Plugin](https://github.com/ilyakharlamov/Ghidra-Nes-Rom-Decompiler-Plugin): 35 stars · last push 2021-09 · Ghidra NES / Famicom ROM Decompiler Plugin
- [imxeno/ghidracord](https://github.com/imxeno/ghidracord): 35 stars · Apache-2.0 · last push 2026-09 · Discord Rich Presence plugin for Ghidra
- [shiedless/tencent-ace-anogs-notes](https://github.com/shiedless/tencent-ace-anogs-notes): 35 stars · MIT · last push 2026-09 · How Tencent ACE (anogs) anti-cheat is built on iOS, and why naive attacks fail. Analysis, not a bypass
- [Colton1skees/TritonTranslator](https://github.com/Colton1skees/TritonTranslator): 34 stars · last push 2026-05 · Standalone static version of Triton's x86/x64 translator
- [guedou/r2scapy](https://github.com/guedou/r2scapy): 34 stars · last push 2017-11 · a radare2 plugin that decodes packets with Scapy
- [monosource/radare2-explorations-binaries](https://github.com/monosource/radare2-explorations-binaries): 34 stars · last push 2017-01 · Supplement to radare2-explorations.
- [relyze-ltd/plugins](https://github.com/relyze-ltd/plugins): 34 stars · BSD-3-Clause · last push 2020-04 · A repository of example plugins for Relyze Desktop.
- [joshwatson/binaryninja-msp430](https://github.com/joshwatson/binaryninja-msp430): 33 stars · MIT · last push 2022-03 · msp430 Architecture plugin for Binary Ninja
- [maosasagawa/blackbox-re-agent](https://github.com/maosasagawa/blackbox-re-agent): 33 stars · Apache-2.0 · last push 2026-08 · Conversational black-box reverse-engineering agent on the pi coding agent — analyzes apk/.o/.hex/exe with a self-provisioning toolchain (radare2 · Ghidra · angr · jadx). Static analysis. Claude Code & Codex compatible.
- [mytbk/r2dumpbin](https://github.com/mytbk/r2dumpbin): 33 stars · MIT · last push 2025-12 · A radare2 Python script to dump a raw IA32 binary to an NASM source file
- [RazviOverflow/Malware_Resources](https://github.com/RazviOverflow/Malware_Resources): 33 stars · last push 2026-03 · Collection of malware analysis, binary exploitation and reverse engineering related resources
- [mahmoudimus/ida-taskr](https://github.com/mahmoudimus/ida-taskr): 32 stars · MIT · last push 2026-07 · IDA Taskr is a pure Python library for IDA Pro related parallel computing. It lets you use the power of Qt (built-in to IDA!) and Python's powerful multiprocessing and asyncio systems to quickly process computationally intensive tasks without freezing IDA Pro. Oh, and it's super fast too.
- [rand-tech/ida9rewriter](https://github.com/rand-tech/ida9rewriter): 32 stars · GPL-3.0 · last push 2025-04 · Bump your ida python script automatically!
- [rwfpl/rewolf-dirtyjoe](https://github.com/rwfpl/rewolf-dirtyjoe): 32 stars · GPL-3.0 · last push 2023-01 · Open source release of the dirtyJOE - editor for the compiled java .class files.
- [WithSecureLabs/radare2-scripts](https://github.com/WithSecureLabs/radare2-scripts): 32 stars · BSD-3-Clause · last push 2018-02 · A collection of useful radare2 scripts!
- [vmx7/rust_pdb](https://github.com/vmx7/rust_pdb): 31 stars · MIT · last push 2026-09 · self-contained il2cpp to windows pdb generator (rust, x64, metadata v39)
- [MISP/bsimvis](https://github.com/MISP/bsimvis): 30 stars · Apache-2.0 · last push 2026-10 · BSimVis is a tool to analyze similarities across a collection of binaries, based on Ghidra analyzers and the BSim (Behavioral Similarity) plugin. It provides an API and Web interface to upload large quantities of decompiled binaries and BSim feature vectors to a Kvrocks database for similarity analysis, function diffing, and family clustering.
- [radareorg/r2yara](https://github.com/radareorg/r2yara): 30 stars · LGPL-3.0 · last push 2026-08 · yara and radare2, better together
- [guedou/flashre](https://github.com/guedou/flashre): 29 stars · LGPL-3.0 · last push 2019-07 · Tools to reverse the Toshiba FlashAir SD cards
- [LAC-Japan/Ghidra_AntiDebugSeeker](https://github.com/LAC-Japan/Ghidra_AntiDebugSeeker): 29 stars · BSD-3-Clause · last push 2024-11 · Automatically identify and extract potential anti-debugging techniques used by malware.
- [foundryzero/ghidra-stack-string-explorer](https://github.com/foundryzero/ghidra-stack-string-explorer): 28 stars · MIT · last push 2024-08 · Stack String Explorer is a ghidra plugin to find and report stack strings (and other constant strings). Identified strings are commented and placed in the defined strings window for easy analysis.
- [0xl0cal/repentogxm](https://github.com/0xl0cal/repentogxm): 27 stars · GPL-2.0 · last push 2026-10 · PS Vita port of The Binding of Isaac: Repentance by static recompilation of the PC executable to ARM.
- [sushant94/rune](https://github.com/sushant94/rune): 27 stars · Apache-2.0 · last push 2017-08 · rune - radare2 based symbolic emulator
- [icedream/go-bsdiff](https://github.com/icedream/go-bsdiff): 26 stars · BSD-2-Clause · last push 2026-09 · Golang wrapper for @mendsley's bsdiff C library.
- [nickw444/rn-debundle](https://github.com/nickw444/rn-debundle): 26 stars · last push 2021-05 · A very basic debundler for Javascript bundles compiled with React Native's bundler
- [buzzer-re/eqfunc](https://github.com/buzzer-re/eqfunc): 25 stars · last push 2021-10 · Discover similar functions structures in binaries using graph theory.
- [ExhoAR22/ghidra-iboot](https://github.com/ExhoAR22/ghidra-iboot): 25 stars · MIT · last push 2022-03 · Ghidra loader for decrypted iBoot, LLB, iBEC, iBSS and SecureROM images
- [SysSec-KAIST/FirmKit](https://github.com/SysSec-KAIST/FirmKit): 25 stars · MIT · last push 2022-07 · IoT firmware vulnerability analysis tool based on binary code similarity analysis (BCSA)
- [ubcctf/lumina-ghidra](https://github.com/ubcctf/lumina-ghidra): 25 stars · MIT · last push 2023-05 · IDA's Lumina feature, reimplemented for Ghidra
- [valorisa/Reverse-Engineer-Anything](https://github.com/valorisa/Reverse-Engineer-Anything): 25 stars · MIT · last push 2026-10 · An unofficial French-language educational guide to REA (Reverse Engineer Anything): analyze applications and binaries with a coding agent through MCP and CLI, Hopper or Ghidra, backed by evidence. Includes the legal framework for reverse engineering. Upstream project: morluto/rea.
- [VNRev/il2cpp_bn](https://github.com/VNRev/il2cpp_bn): 25 stars · MIT · last push 2024-04 · Import il2cppdumper data into a Binary Ninja plugin.
- [zengfr/XrefsExt](https://github.com/zengfr/XrefsExt): 25 stars · Apache-2.0 · last push 2024-11 · XrefsExt plugin for IDA Pro(idapython,ida plugin,ida plugins)
- [jiangzhengwenjz/totkol](https://github.com/jiangzhengwenjz/totkol): 24 stars · last push 2024-01 · WIP Decompilation of Tactics Ogre: The Knight of Lodis (USA)
- [CYB3RMX/Wh1teM0cha](https://github.com/CYB3RMX/Wh1teM0cha): 23 stars · GPL-3.0 · last push 2024-03 · Python Module for Parsing & Reverse Engineering Mach-O Executables.
- [Learner0x5a/DataFlowAnalysis-miasm](https://github.com/Learner0x5a/DataFlowAnalysis-miasm): 22 stars · GPL-2.0 · last push 2022-05 · Generate data-flow graph and def-use graph for a function based on miasm and IDA Pro.
- [Martmists-GH/ghidra-ctr-loader](https://github.com/Martmists-GH/ghidra-ctr-loader): 22 stars · last push 2024-01 · A Ghidra loader for 3DS files
- [ps1337/pwntools-r2](https://github.com/ps1337/pwntools-r2): 22 stars · last push 2019-08 · Launch radare2 like a boss from pwntools in tmux
- [ylca0/idalib-cli](https://github.com/ylca0/idalib-cli): 22 stars · Apache-2.0 · last push 2026-09 · A IDA CLI tool built on Rust, idalib-rs, and idalib. Supports batch and concurrent IDA analysis processes, design for stateless, agent first, skill first, and automation first. Reduce AI understanding and friction costs, make agents to efficiently execute complex binary analysis tasks.
- [alexander-pick/ida-pro-function-hunter](https://github.com/alexander-pick/ida-pro-function-hunter): 21 stars · MIT · last push 2024-10 · IDA Pro script to find interesting syscalls and patterns in binaries
- [DerekSelander/homebrew-funpack](https://github.com/DerekSelander/homebrew-funpack): 21 stars · last push 2024-11 · Apple runtime introspection tools
- [kapaw/pwnmachine](https://github.com/kapaw/pwnmachine): 21 stars · last push 2019-04 · Vagrant setup for building a machine for CTF/exploit development
- [sktelecom/bomlens](https://github.com/sktelecom/bomlens): 21 stars · Apache-2.0 · last push 2026-10 · BomLens — a local-first SBOM generator & open-source risk assessor (CycloneDX). Produce an SBOM, an open-source notice, and a security/license risk report from source code, containers, binaries, firmware, or an SBOM you received. CLI or web UI, no SaaS.
- [2389-research/binary-re](https://github.com/2389-research/binary-re): 20 stars · MIT · last push 2026-09 · Agentic binary reverse engineering for ELF binaries on ARM64, ARMv7, x86_64 - hypothesis-driven analysis with radare2, Ghidra, GDB, QEMU
- [assemblew/opainject_macos](https://github.com/assemblew/opainject_macos): 20 stars · MIT · last push 2025-11 · macOS port of opainject - ROP-based dylib injection to arm64(e) processes.
- [DatanoiseTV/practical-reverse-engineering](https://github.com/DatanoiseTV/practical-reverse-engineering): 20 stars · last push 2026-05 · A practical handbook on reverse engineering. Covers embedded firmware (ARM Cortex-M, Xtensa/ESP32, RISC-V, 8051, MIPS), Linux userland, kernel modules and device trees, plus hardware attacks (fault injection, side-channel analysis). Uses radare2 as the primary tool example. PDF + web book.
- [xTeardx/diaphora-mcp](https://github.com/xTeardx/diaphora-mcp): 20 stars · MIT · last push 2026-10 · MCP server for automated binary diffing.
- [blacktop/aarch64-cssc](https://github.com/blacktop/aarch64-cssc): 19 stars · MIT · last push 2025-09 · AArch64 FEAT_CSSC support for IDA Pro (disassembler/Hex-Rays) and Ghidra
- [ivan-sincek/file-scraper](https://github.com/ivan-sincek/file-scraper): 19 stars · MIT · last push 2026-02 · Scrape files for sensitive information, and generate an interactive HTML report. Based on Rabin2.
- [TheFlashBold/Better-Ghidra-MCP](https://github.com/TheFlashBold/Better-Ghidra-MCP): 19 stars · MIT · last push 2026-09 · A better ghidra mcp, without bridges or external dependecies, just install and run. It uses the natvie MCP protocol
- [XYFC128/GhidraLookup](https://github.com/XYFC128/GhidraLookup): 19 stars · Apache-2.0 · last push 2021-08 · The GhidraLookup plugin aims to help user lookup documentations of Win API functions.
- [AzaiSakura/dsh-computer-use](https://github.com/AzaiSakura/dsh-computer-use): 18 stars · MIT · last push 2026-08 · Reverse-engineering & re-implementation of OpenAI Computer Use macOS plugin for DeepSeek Harness: 10 MCP tools, JSON-RPC wire protocol, native Swift AX/screenshot/input daemon.
- [jiangzhengwenjz/csm3](https://github.com/jiangzhengwenjz/csm3): 18 stars · last push 2024-06 · WIP Decompilation of Summon Night: Craft Sword Monogatari Hajimari no Ishi
- [OpenRakis/spice86-ghidra-plugin](https://github.com/OpenRakis/spice86-ghidra-plugin): 18 stars · Apache-2.0 · last push 2026-04 · Work with spice86 data into Ghidra
- [safiire/radare2-dan32](https://github.com/safiire/radare2-dan32): 18 stars · last push 2017-08 · Binary, Analysis, and Disassembler Radare2 Plugins for Dan32 architechture binaries
- [sondt99/firmvisor](https://github.com/sondt99/firmvisor): 18 stars · MIT · last push 2025-04 · A Python-based tool for analyzing IoT firmware, supporting both filesystem-based and RTOS-based (e.g. FreeRTOS, Zephyr) images. Features include binary header parsing, interrupt vector analysis, string extraction, entropy scanning, and more.
- [Zeyad-Azima/GhidraDeepSeekDecomprove](https://github.com/Zeyad-Azima/GhidraDeepSeekDecomprove): 18 stars · GPL-3.0 · last push 2025-10 · A Ghidra script to improve decompiled code readability by re-writing it (Using DeepSeek) in a better way, Along with renaming/assigning variables based on their usage.
- [enovella/r2con-prequals-rhme3](https://github.com/enovella/r2con-prequals-rhme3): 17 stars · last push 2017-10 · r2 the Rhme3! The RHme (Riscure Hack me) is a low level hardware CTF that comes in the form of an Arduino board (AVR architecture). It involves a set of SW and HW challenges to test your skills in different areas such as side channel analysis, fault injection, reverse-engineering and software exploitation. In our talk we will briefly recap RHme2 and introduce the upcoming RHme3. This year we decided to create a special target called the Riscurino board which features CAN controllers for a real automotive hacking experience! During the r2con we challenge you to solve as many challenges as you can using radare2. Are you up to the task? By the time the r2con takes place the registration for RHme3 will be closed. However, we reserved 5 Riscurino boards for giving away during the conference. Be at r2con and win one of these boards by solving the qualification challenge(s) using radare2!
- [FFRI/XtaTools](https://github.com/FFRI/XtaTools): 17 stars · Apache-2.0 · last push 2020-12 · PoC code and tools for Black Hat EU 2020
- [mooncat-greenpy/KinGAidra](https://github.com/mooncat-greenpy/KinGAidra): 17 stars · last push 2026-10 · An AI-powered extension for Ghidra that enhances analysis.
- [mytechnotalent/0x01-ARM-32-Hacking-Hello-World](https://github.com/mytechnotalent/0x01-ARM-32-Hacking-Hello-World): 17 stars · Apache-2.0 · last push 2025-11 · ARM 32-bit Raspberry Pi Hacking Hello World example in Kali Linux.
- [NESA-Lab/FirmRCA](https://github.com/NESA-Lab/FirmRCA): 17 stars · GPL-3.0 · last push 2026-01 · Source code of the paper "FirmRCA: Towards Post-Fuzzing Analysis on ARM Embedded Firmware with Efficient Event-based Fault Localization"
- [radareorg/radare2-skel](https://github.com/radareorg/radare2-skel): 17 stars · last push 2026-01 · Sample radare2 project templates
- [sp00nznet/xboxdashboard](https://github.com/sp00nznet/xboxdashboard): 17 stars · last push 2026-10 · The first-ever native PC port of the original Xbox Dashboard (build 3944) — static recompilation of xboxdash.xbe (x86 → C) on the xboxrecomp toolkit, with a D3D8→D3D11 backend.
- [alexdu/ARM-console](https://github.com/alexdu/ARM-console): 16 stars · last push 2012-01 · Firmware analysis console for Magic Lantern
- [AndrewAltimit/legend-of-legaia-re](https://github.com/AndrewAltimit/legend-of-legaia-re): 16 stars · Unlicense · last push 2026-10 · Reverse-engineering Legend of Legaia (PSX, 1999): Ghidra-traced format documentation, Rust extractors for every asset on the disc, and an engine reimplementation targeting wgpu/SDL3 with optional WASM. BYO-disc model, no assets distributed.
- [Aspasia1337/IATResolution](https://github.com/Aspasia1337/IATResolution): 16 stars · last push 2026-02 · Anti Cheat runtime import resolver, how it rebuilds its IAT at load time to hide API usage from static analysis.
- [cyrozap/ghidra-md32](https://github.com/cyrozap/ghidra-md32): 16 stars · Apache-2.0 · last push 2024-04 · MediaTek MD32 processor module for Ghidra.
- [nesclab/ProtocolTaint](https://github.com/nesclab/ProtocolTaint): 16 stars · MIT · last push 2020-10 · A protocol reverse engineering tool for industrial binary protocol based on pin tool
- [RevEngAI/reai-r2](https://github.com/RevEngAI/reai-r2): 16 stars · last push 2025-07 · RevEng.AI Radare2 Plugin
- [shiedless/ios-ue4-re](https://github.com/shiedless/ios-ue4-re): 16 stars · MIT · last push 2026-09 · Hub for iOS UE4 reverse-engineering notes (arm64/arm64e) and how they fit together
- [shiedless/roblox-ios-luau-vm-notes](https://github.com/shiedless/roblox-ios-luau-vm-notes): 16 stars · MIT · last push 2026-09 · Reversing Roblox's Luau VM on iOS: functions, anchors, lua_State layout
- [VoidSec/ida-helpers](https://github.com/VoidSec/ida-helpers): 16 stars · last push 2022-07 · Collection of IDA helpers
- [wagonbomb/kawaiidra-mcp](https://github.com/wagonbomb/kawaiidra-mcp): 16 stars · MIT · last push 2026-10 · A Ghidra MCP Server for Claude Code - Binary Analysis Made Adorable. Keywords: ghidra, mcp, ghidra-mcp, model-context-protocol, binary-analysis, reverse-engineering, decompiler
- [Catherine22/Assembly](https://github.com/Catherine22/Assembly): 15 stars · MIT · last push 2020-12 · Learning assembly x86 programming and reverse engineering
- [erenkaraoglu/PICO8-Extractor](https://github.com/erenkaraoglu/PICO8-Extractor): 15 stars · last push 2025-09 · PICO8 Extractor is a user-friendly tool designed to convert PICO-8 JavaScript cart exports into binary .p8.rom files that can be directly loaded in the PICO-8 fantasy console.
- [Fazechristian00/FilzaJailedDS](https://github.com/Fazechristian00/FilzaJailedDS): 15 stars · last push 2026-10 · Open source Filza Jailed tweak injector for iOS 17.0-26.0.1, adding jailed support for Filza IPA on supported devices
- [GrecAndrei/ida-pro-mcp](https://github.com/GrecAndrei/ida-pro-mcp): 15 stars · last push 2026-10 · Local-first, deterministic MCP server for IDA Pro/Home: 109 strict-schema reverse-engineering operations, evidence-backed findings, and policy-gated IDB edits.
- [OPSphystech420/CGuardProbe](https://github.com/OPSphystech420/CGuardProbe): 15 stars · last push 2024-11 · Memory Engine and Scanner for iOS/MacOS using Mach API
- [riyadmondol2006/iOS-Protobuf-Extractor](https://github.com/riyadmondol2006/iOS-Protobuf-Extractor): 15 stars · last push 2025-06 · Advanced Python tool for extracting Protocol Buffer schemas from iOS IPA files. Perfect for reverse engineering, security research, and API analysis. Supports automatic .proto reconstruction, binary analysis, and comprehensive protobuf extraction from any iOS application.
- [SerialHooker/WASM2JS-Transpiler](https://github.com/SerialHooker/WASM2JS-Transpiler): 15 stars · last push 2026-02 · C++ tool that converts WebAssembly (`.wasm`) binaries to JavaScript, with an optional AI-powered pass using the Gemini API to rename variables and summarize functions.
- [cyrozap/ghidra-ccpu](https://github.com/cyrozap/ghidra-ccpu): 14 stars · Apache-2.0 · last push 2023-10 · MediaTek CCPU (GCPU) processor module for Ghidra.
- [r41n60w/bdc_disasm](https://github.com/r41n60w/bdc_disasm): 14 stars · last push 2023-04 · Beyond Dark Castle (1987, Mac) game disassembly, in Motorola 68000 assembly language.
- [v-p-b/reshare](https://github.com/v-p-b/reshare): 14 stars · last push 2026-03 · Reverse engineering exchange format
- [anatoly505/ios-reverse-skills](https://github.com/anatoly505/ios-reverse-skills): 13 stars · Unlicense · last push 2026-05 · Multi-LLM iOS reverse-engineering toolkit. 10-phase workflow with adapters for Claude Opus/Code, Cursor, Qwen Coder, MiniMax, Codex/GPT-5, Aider, Cline. Adapted from incogbyte/iOS-reverse-engineering-claude-skill (Unlicense).
- [CryptoJones/Scylla](https://github.com/CryptoJones/Scylla): 13 stars · Apache-2.0 · last push 2026-09 · A hexagonal, adapter-headed reverse-engineering platform — durable RE domain core + disposable protocol heads (MCP first). Sibling to GayHydra (Ghidra fork.)
- [cyrozap/ghidra-asmedia-8051](https://github.com/cyrozap/ghidra-asmedia-8051): 13 stars · Apache-2.0 · last push 2025-12 · A processor module for Ghidra for ASMedia's 8051-based chips.
- [glauberlima/open-scrantic](https://github.com/glauberlima/open-scrantic): 13 stars · MIT · last push 2026-10 · Reverse-engineered Rust reimplementation of the Johnny Castaway screensaver (Screen Antics, Sierra/Dynamix, 1992) for Windows, macOS and Linux
- [KoreanSeats1/MCLA-4iOS](https://github.com/KoreanSeats1/MCLA-4iOS): 13 stars · GPL-3.0 · last push 2026-10 · Midnight Club: Los Angeles on iPhone and iPad — ARM64 static recompilation, native Metal, and an experimental 60 FPS patch. Bring your own game files.
- [mytechnotalent/0x02-ARM-32-Hacking-Int](https://github.com/mytechnotalent/0x02-ARM-32-Hacking-Int): 13 stars · Apache-2.0 · last push 2025-11 · ARM 32-bit Raspberry Pi Hacking Int example in Kali Linux.
- [PlayDay-iOS/LegacyWiFiFix](https://github.com/PlayDay-iOS/LegacyWiFiFix): 13 stars · MIT · last push 2026-04 · Substrate tweak that fixes WPA2/WPA3 transitional WiFi on iOS 3.x-12.x by stripping unsupported AKM suites from the RSN IE parser
- [radareorg/r2hexagon](https://github.com/radareorg/r2hexagon): 13 stars · BSD-2-Clause · last push 2020-04 · Hexagon disassembler code generator from the official instruction manual.
- [santiquiroz/gears-of-war-2-pc-port](https://github.com/santiquiroz/gears-of-war-2-pc-port): 13 stars · BSD-3-Clause · last push 2026-10 · Gears of War 2 native PC port: the Xbox 360 game statically recompiled to x64 (not an emulator). 1440p/4K, FSR, 4K texture packs, keyboard & mouse, Android in progress. Bring your own copy.
- [saruman9/ghidra_dev_pres](https://github.com/saruman9/ghidra_dev_pres): 13 stars · last push 2020-08 · Ghidra's development plugins, scripts, contributing. Presentation
- [vtorres/ntoskrnl-offsets-dumper](https://github.com/vtorres/ntoskrnl-offsets-dumper): 13 stars · last push 2022-11 · Dump ntoskrnl.exe important offsets for building your navigation system in the Windows Kernel, using Radare2 and Rust
- [Xiangyu-CAS/rea-capcut](https://github.com/Xiangyu-CAS/rea-capcut): 13 stars · MIT · last push 2026-10 · ReaCut — REA × CapCut: an independent, open-source video editor rebuilt from REA-assisted, authorized local behavior and format research. No copied CapCut proprietary code or assets. Offline desktop app + Codex plugin.
- [bilal-ctf/Windows-PE-Analyzer](https://github.com/bilal-ctf/Windows-PE-Analyzer): 12 stars · MIT · last push 2026-05 · A learning-focused PE analysis engine with modular detectors, heuristic analysis, and HTML reporting.
- [jessehouwing/ppt-diffmerge](https://github.com/jessehouwing/ppt-diffmerge): 12 stars · MIT · last push 2026-10 · A little commandline tool to start PowerPoint in merge mode.
- [JRBusiness/REipa](https://github.com/JRBusiness/REipa): 12 stars · MIT · last push 2026-10 · Fast iOS decompiler & Mach-O disassembler in Rust — arm64, Objective-C class-dump, Swift metadata, and a native desktop GUI. Reads .ipa/App Store binaries directly, no Ghidra, IDA, radare2, or LLVM.
- [Masterllgod/naruto-rise-of-a-ninja-port-nativo](https://github.com/Masterllgod/naruto-rise-of-a-ninja-port-nativo): 12 stars · last push 2026-10 · Naruto: Rise of a Ninja (Xbox 360) running natively on Android ARM64 — static recompilation, Vulkan, 360p to 4K, FXAA/FSR.
- [mobilemutex/GhidraCalculator](https://github.com/mobilemutex/GhidraCalculator): 12 stars · Apache-2.0 · last push 2025-09 · A Calculator plugin for Ghidra that adds a GUI calculator and right-click options for adding addresses, memory, and constant values to the calculator, as well as options for calculating distance between addresses.
- [MohamadMansouri/funcDiffEval](https://github.com/MohamadMansouri/funcDiffEval): 12 stars · last push 2019-02 · Evaluating function diffing existing techniques
- [newlog/r2com](https://github.com/newlog/r2com): 12 stars · last push 2017-04 · radare2 script to help on COM objects reverse engineering
- [riven-labs/unstrip](https://github.com/riven-labs/unstrip): 12 stars · Apache-2.0 · last push 2026-07 · Recover symbols, types, interfaces, and method signatures from stripped Go binaries. Ghidra, IDA, and Binary Ninja exporters included.
- [APiTJLillo/GhAIdra](https://github.com/APiTJLillo/GhAIdra): 11 stars · last push 2025-02 · AI assisted tools for Ghidra. Azure OpenAI, DeepSeek, Anthropic Claude, Ollama.
- [blacktop/bindiff-rs](https://github.com/blacktop/bindiff-rs): 11 stars · MIT · last push 2025-01 · Rust library to interface with BinDiff
- [garyttierney/ghidralite](https://github.com/garyttierney/ghidralite): 11 stars · last push 2024-07 · What if Ghidra had a responsive UI?
- [Jonathan8520/patch-tasm2](https://github.com/Jonathan8520/patch-tasm2): 11 stars · MIT · last push 2026-07 · Patches The Amazing Spider-Man 2 (iOS 1.3.1) to launch, play and save entirely offline, years after Gameloft's servers went dark. Nine arm64 instructions, no injected code, no size change.
- [kirasys/irec](https://github.com/kirasys/irec): 11 stars · BSD-3-Clause · last push 2021-03 · A cross platform framework to recover driver's communication interface.
- [lancejames221b/omp-re](https://github.com/lancejames221b/omp-re): 11 stars · MIT · last push 2026-08 · Reverse-engineering suite for omp: radare2 tools, evidence store, signed audit log, RE status band, and report generator.
- [saruman9/recaster](https://github.com/saruman9/recaster): 11 stars · Apache-2.0 · last push 2023-06 · Ghidra's plugin recursively search dependencies of the variable and change their names and types.
- [thebabush/idagui](https://github.com/thebabush/idagui): 11 stars · last push 2025-08 · IDA Pro + ImGui
- [woodruffw/libbdiff](https://github.com/woodruffw/libbdiff): 11 stars · last push 2014-11 · A library for creating and patching binary diffs. Based on bsdiff.
- [CYB3RMX/Zepu1chr3](https://github.com/CYB3RMX/Zepu1chr3): 10 stars · Apache-2.0 · last push 2022-02 · A Radare2 based Python module for Binary Analysis and Reverse Engineering.
- [cyrozap/ghidra-pcm](https://github.com/cyrozap/ghidra-pcm): 10 stars · Apache-2.0 · last push 2023-05 · MediaTek PCM (SPM) processor module for Ghidra.
- [h4ng3r/r2apktool](https://github.com/h4ng3r/r2apktool): 10 stars · GPL-3.0 · last push 2017-09 · radare2 based alternative to apktool
- [Lucrehulk/WasmCrack](https://github.com/Lucrehulk/WasmCrack): 10 stars · MIT · last push 2026-07 · A toolsuite of advanced WASM static binary analysis tools designed to reverse engineer WebAssembly binaries.
- [monstercameron/LibertyFlux](https://github.com/monstercameron/LibertyFlux): 10 stars · MIT · last push 2026-10 · Grand Theft Auto IV's engine, being rewritten in Rust one function at a time by AI agents, for 64-bit Windows, Windows on ARM and macOS. Contains no game code or assets.
- [newlog/r2msdn](https://github.com/newlog/r2msdn): 10 stars · last push 2017-04 · r2 plugin to add MSDN documentation URLs and parameter names to imported function calls
- [parrotmac/docker-patcher](https://github.com/parrotmac/docker-patcher): 10 stars · Apache-2.0 · last push 2023-08 · Build and apply binary patches to Docker Images
- [refcell/reversevm](https://github.com/refcell/reversevm): 10 stars · AGPL-3.0 · last push 2022-01 · Notes on Reverse Engineering EVM Bytecode
- [user1342/Just-Another-Differ](https://github.com/user1342/Just-Another-Differ): 10 stars · GPL-3.0 · last push 2024-04 · 🔎 Function Change Differ | A diffing tool for binary files when comparing obfuscated and changed function contents between versions 🛠️
- [cyrozap/ghidra-radeon-f32](https://github.com/cyrozap/ghidra-radeon-f32): 9 stars · Apache-2.0 · last push 2024-10 · AMD Radeon F32 processor module for Ghidra.
- [devgianlu/GhidraProtobufCpp](https://github.com/devgianlu/GhidraProtobufCpp): 9 stars · last push 2023-12 · Useful plugin for reverse engineering code that makes use of C++ protobuf
- [ithinkthisiscool/even-g2-protocol](https://github.com/ithinkthisiscool/even-g2-protocol): 9 stars · last push 2026-10 · An open-source Python implementation and protocol mapping for the Even Realities G2 smart glasses, enabling full third-party interoperability, native dashboard control, and raw LC3 audio streaming via BlueZ.
- [johnfxgalea/Dragon-Fang](https://github.com/johnfxgalea/Dragon-Fang): 9 stars · Apache-2.0 · last push 2022-02 · A program diffing extension for Ghidra.
- [lakshya16157/midtown-madness-3-PC-Native](https://github.com/lakshya16157/midtown-madness-3-PC-Native): 9 stars · last push 2026-10 · Midtown Madness 3 PC Native: an improved and modded MM3 PC port for Windows 10/11 x64. Xbox static recompilation with Direct3D 11, keyboard controls, widescreen, custom cars, gameplay fixes and performance improvements. Build from your own game disc.
- [peitaosu/Cardiff](https://github.com/peitaosu/Cardiff): 9 stars · MIT · last push 2023-04 · Version Control Tool for Binary Format Files.
- [psxvoid/idapython-debugging-dynamic-enrichment](https://github.com/psxvoid/idapython-debugging-dynamic-enrichment): 9 stars · MIT · last push 2019-10 · No description supplied by the upstream repository.
- [radareorg/esil-rs](https://github.com/radareorg/esil-rs): 9 stars · BSD-3-Clause · last push 2020-10 · Radare2's ESIL in Rust
- [Srikanth-Rudrarapu/firm-lens](https://github.com/Srikanth-Rudrarapu/firm-lens): 9 stars · MIT · last push 2026-10 · Automated Static, Hardware-Rooted & Dynamic HIL Security Analysis for Bare-Metal ESP32 (Xtensa & RISC-V) Firmware
- [TouchFriend/DoubanTweak](https://github.com/TouchFriend/DoubanTweak): 9 stars · MIT · last push 2026-09 · An ad-free Douban jailbreak tweak. Thanks for using it; stars are welcome.
- [alichtman/writeups](https://github.com/alichtman/writeups): 8 stars · last push 2021-06 · Writeups, scripts and solutions for CTFs, Hack the Box, Vulnhub, exploit challenges, pwnables, crackmes, etc. Anything goes.
- [andreihirgau/ios-app-debloating](https://github.com/andreihirgau/ios-app-debloating): 8 stars · last push 2017-07 · A debloater for iOS apps
- [arkup/tc_deer](https://github.com/arkup/tc_deer): 8 stars · last push 2026-04 · TriCore decompiler plugin for IDA Pro 9.2+
- [AuraFriday/ghidra_mcp](https://github.com/AuraFriday/ghidra_mcp): 8 stars · Apache-2.0 · last push 2026-01 · AI-Powered Reverse Engineering with 100% Ghidra API Access
- [blacktop/go-bindiff](https://github.com/blacktop/go-bindiff): 8 stars · MIT · last push 2025-12 · Go package to interface with BinDiff
- [geogeo28/atari_reverse](https://github.com/geogeo28/atari_reverse): 8 stars · GPL-2.0 · last push 2026-10 · Reverse-engineering Atari ST binaries back into readable, verified C.
- [hamidrezakp/r2fas](https://github.com/hamidrezakp/r2fas): 8 stars · MIT · last push 2026-08 · FASM .fas symbolic debug information loader for radare2
- [janost/vcod](https://github.com/janost/vcod): 8 stars · GPL-3.0 · last push 2026-10 · Call of Duty (2003) multiplayer, rebuilt from scratch in Rust. Client, dedicated server and bots that speak the original wire protocol for patch 1.1, 1.5 and United Offensive, dug out of the binaries and held to retail by captures. Bring your own copy of the game. Your 2003 aim is not included.
- [Jstar269/nakagawa-recomp](https://github.com/Jstar269/nakagawa-recomp): 8 stars · GPL-3.0 · last push 2026-10 · Experimental PSP static recompiler and native runtime using user-supplied lawful inputs.
- [kevinmuoz/binwalk-reversing-plugin](https://github.com/kevinmuoz/binwalk-reversing-plugin): 8 stars · Apache-2.0 · last push 2026-03 · Binwalk plugin for IDA Pro and Binary Ninja
- [kotcrab/ghidra-rest-api](https://github.com/kotcrab/ghidra-rest-api): 8 stars · Apache-2.0 · last push 2026-08 · Add read-only REST API to your Ghidra project
- [LLONSIT/makemask_re](https://github.com/LLONSIT/makemask_re): 8 stars · last push 2022-12 · Matching decompilation of irix binary makemask
- [lr-m/Ghidra-Markdown-Notepad](https://github.com/lr-m/Ghidra-Markdown-Notepad): 8 stars · last push 2026-03 · A feature-rich markdown editor plugin for Ghidra that supports collections of notes without leaving Ghidra.
- [mytechnotalent/pico-micropython-debug-template](https://github.com/mytechnotalent/pico-micropython-debug-template): 8 stars · MIT · last push 2025-11 · A Raspberry Pi Pico RP2040 debug template repo with step-by-step instructions on how to freeze your MicroPython files into C firmware and reverse engineer the binary with OpenOCD and GDB.
- [playday3008/GhidraClangPoweredParse](https://github.com/playday3008/GhidraClangPoweredParse): 8 stars · Apache-2.0 · last push 2026-03 · Ghidra extension that parses C/C++ headers using libclang via Panama FFI and imports types into Ghidra's data type manager
- [strobejb/q22](https://github.com/strobejb/q22): 8 stars · GPL-3.0 · last push 2026-09 · Catch22 Hex Editor
- [twisted-fun/IDARE](https://github.com/twisted-fun/IDARE): 8 stars · MIT · last push 2021-09 · Automation plugins for various reversing tasks in IDA.
- [westfox-5/GhidraMetrics](https://github.com/westfox-5/GhidraMetrics): 8 stars · Apache-2.0 · last push 2023-03 · A Ghidra plugin for native code metrics
- [xsscx/xnuimagetools](https://github.com/xsscx/xnuimagetools): 8 stars · GPL-3.0 · last push 2026-09 · XNU Image Tools is a multi-platform image processing toolkit for fuzzing UTI file formats.
- [bruce30262/flareon6_NES_ghidra_loader](https://github.com/bruce30262/flareon6_NES_ghidra_loader): 7 stars · last push 2019-09 · iNES ghidra loader for Flare-on 6 challenge level 8
- [idaholab/bn-st10-arch](https://github.com/idaholab/bn-st10-arch): 7 stars · MIT · last push 2026-09 · Binary Ninja plugin adding C166/ST10 architecture support for embedded firmware. Enables accurate disassembly and decompilation of C166/ST10 binaries for security analysis and reverse engineering.
- [iSayZes/BDO-PAZ-Browser](https://github.com/iSayZes/BDO-PAZ-Browser): 7 stars · MIT · last push 2026-10 · Browse, extract and preview Black Desert Online .paz archives, with parsers for BDO binary formats.
- [kokseen1/Reddida](https://github.com/kokseen1/Reddida): 7 stars · last push 2022-10 · Now you can 'disassemble' Reddit!
- [kr1tzy/r2Playground](https://github.com/kr1tzy/r2Playground): 7 stars · last push 2019-12 · resource for learning & playing with radare
- [LilZeeCN/zee-rp](https://github.com/LilZeeCN/zee-rp): 7 stars · MIT · last push 2026-10 · Open-source engine & MCP server for AI to read, write, and generate native Axure RP 11 prototype (.rp) files. Zero dependencies. Independent project, not affiliated with Axure.
- [MarlonJD/apple-debug-mcp](https://github.com/MarlonJD/apple-debug-mcp): 7 stars · last push 2026-08 · Local, capability-aware MCP server for authorized AI-assisted macOS and iOS debugging, Simulator/device workflows, Apple binary analysis, profiling, and reproducible evidence.
- [matiaszanolli/aerobiz-disasm](https://github.com/matiaszanolli/aerobiz-disasm): 7 stars · last push 2026-02 · Complete static recompilation of Aerobiz Supersonic for the Sega Genesis
- [Pyrdacor/AmigaAsm](https://github.com/Pyrdacor/AmigaAsm): 7 stars · last push 2025-11 · Amiga m68k asm exporter for Ghidra
- [Shiyou-Qi/Qi-NX-Agent](https://github.com/Shiyou-Qi/Qi-NX-Agent): 7 stars · last push 2026-10 · Qi-NX — reverse-engineering agents for DeepSeek Harness A reverse-engineering toolkit for DSH: three selectable Agent presets, an MCP server exposing the analysis tools, and a dependency-light Python toolkit for binaries and firmware.
- [devilofen/SinDiff](https://github.com/devilofen/SinDiff): 6 stars · MIT · last push 2026-09 · Fast & clean & simple binary diffing plugin for IDA Pro 9.x – finds patched functions in seconds. No Diaphora slowness, no crashes, no bloat. Made by Sin.
- [hivvu/scale-miniatures](https://github.com/hivvu/scale-miniatures): 6 stars · GPL-3.0 · last push 2026-09 · Micro Machines (PC, 1994) rewritten in TypeScript from the disassembly, running natively in the browser. No emulator. Bring your own copy.
- [iCrazeiOS/AppInspect](https://github.com/iCrazeiOS/AppInspect): 6 stars · last push 2026-10 · Desktop app for analysing iOS and macOS binaries. View headers, strings, classes, symbols, security findings, and more.
- [Jubulani/carta](https://github.com/Jubulani/carta): 6 stars · GPL-3.0 · last push 2023-01 · Reverse engineering and analysis of binary data
- [nightwing-us/pyghidra-decaf](https://github.com/nightwing-us/pyghidra-decaf): 6 stars · Apache-2.0 · last push 2026-07 · Enables the development of python ghidra plugins through pyghidra without Java.
- [PabloSoage/Denso-ECU-Toolkit](https://github.com/PabloSoage/Denso-ECU-Toolkit): 6 stars · GPL-3.0 · last push 2026-09 · Reverse-engineering toolchain for Denso SH705x ECUs featuring Ghidra scripts for calibration map extraction and a standalone PyQt6 viewer
- [revenge-mod/revenge-plugin-template](https://github.com/revenge-mod/revenge-plugin-template): 6 stars · GPL-3.0 · last push 2026-10 · 🏗️ Template for building Revenge plugins
- [schlafwandler/ghidra_WriteBlob](https://github.com/schlafwandler/ghidra_WriteBlob): 6 stars · last push 2019-12 · A Ghidra script to paste a raw blob into an analysed binary
- [therealdreg/call_trick_r2pipe](https://github.com/therealdreg/call_trick_r2pipe): 6 stars · MIT · last push 2023-08 · radare2 script to fix disasm with call tricks for strings
- [therealdreg/r2-syscall-printer](https://github.com/therealdreg/r2-syscall-printer): 6 stars · MIT · last push 2023-08 · I created r2-syscall-printer (radare r2pipe script) because I need now Linux-kernel interface call convention support (x86 & x86_64): %rdi, %rsi, %rdx, %r10, %r8, %r9. Also you can use this tool as standalone-app to print syscall table info
- [TomOstt/SwitchBlade](https://github.com/TomOstt/SwitchBlade): 6 stars · last push 2026-04 · Purpose-built reverse engineering platform for Nintendo Switch firmware analysis. Parses NSO binaries, decodes AArch64 instructions, maps syscalls, and diffs firmware versions — designed to find what Ghidra can't.
- [victorQ8/reverse-engineering-vault](https://github.com/victorQ8/reverse-engineering-vault): 6 stars · last push 2026-08 · A structured reverse-engineering field notebook for binary analysis, exploitation, mobile, firmware, wireless, and defensive research.
- [vvirei333/ABrake27](https://github.com/vvirei333/ABrake27): 6 stars · last push 2026-10 · iOS 27 kernelcache RE: SEP dispatch map, AMFI diff, Ghidra workflow
- [W3ndige/r2sim](https://github.com/W3ndige/r2sim): 6 stars · GPL-3.0 · last push 2021-04 · Hacked script to show similarities between two samples using radare2 framework.
- [wcampbell0x2a/cargo-decompile](https://github.com/wcampbell0x2a/cargo-decompile): 6 stars · last push 2025-01 · A cargo subcommand that displays ghidra function output through the use of the {rizin, radare2}-ghidra project
- [ericyoc/iot_device_firmware_analysis_poc](https://github.com/ericyoc/iot_device_firmware_analysis_poc): 5 stars · last push 2024-09 · Performs firmware analysis on a given binary file.
- [felipe-dos-santos81/ghidra-bundle](https://github.com/felipe-dos-santos81/ghidra-bundle): 5 stars · MIT · last push 2026-10 · A fully self-contained, isolated Ghidra 12.1.2 installation bundled with GhidraMCP, lx-loader, GhidraDosToolbox, and MCP bridge
- [fire3/aida-audit](https://github.com/fire3/aida-audit): 5 stars · MIT · last push 2026-06 · AIDA-AUDIT: IDA Pro + MCP + AI agents for automated binary audit.
- [jstrieb/remote-ofrak](https://github.com/jstrieb/remote-ofrak): 5 stars · MIT · last push 2023-05 · Run OFRAK remotely to modify and repack binaries from your browser
- [Mizari/idagoodnames](https://github.com/Mizari/idagoodnames): 5 stars · last push 2021-12 · goodname.cfg for IDA Pro
- [nightwing-us/mcpyida](https://github.com/nightwing-us/mcpyida): 5 stars · Apache-2.0 · last push 2026-08 · MCP server exposing IDA reverse-engineering tools to LLM clients.
- [one2blame/the-dark-arts](https://github.com/one2blame/the-dark-arts): 5 stars · last push 2022-04 · Repository to contain my notes from my self-study of binary exploitation and reverse engineering.
- [overkazaf/D810G](https://github.com/overkazaf/D810G): 5 stars · Apache-2.0 · last push 2026-10 · 🛡️ The most comprehensive deobfuscation framework for Ghidra — OLLVM/Tigress deflattening, 60 MBA rules with Z3 proof, opaque predicates, BCF removal, string decryption, VM devirtualization, full pipeline. CLI + Plugin + Analyzer.
- [PoP-Lin/IDAPro-MuiLs](https://github.com/PoP-Lin/IDAPro-MuiLs): 5 stars · MIT · last push 2026-10 · Modern Windows UI plugin for IDA Pro 9.3: rounded panels, dark styling, customizable fonts, and persistent appearance settings.
- [tokenbleed/nibkit](https://github.com/tokenbleed/nibkit): 5 stars · MIT · last push 2026-10 · Decompiler for compiled iOS/macOS interface files (.nib, .storyboardc): object tree, wiring, custom classes, navigation graphs
- [totekuh/x64dra](https://github.com/totekuh/x64dra): 5 stars · last push 2025-04 · A Python-based tool to synchronize Ghidra and x64dbg/x32dbg with minimal setup.
- [Zeyad-Azima/HopperSRK](https://github.com/Zeyad-Azima/HopperSRK): 5 stars · MIT · last push 2025-12 · Security Research Suite for macOS binaries in Hopper Disassembler
- [a0zhar/GandCrab](https://github.com/a0zhar/GandCrab): 4 stars · last push 2023-10 · This repository contains the dumped and deobfuscated version of GandCrabv5 JS Binary Dropper, along with the webpage files dropped on a GandCrab v5.1 infected system. The goal of this Repository is to attempt to make the files easier to work with and understand.
- [AlembicOrg/UniDumper](https://github.com/AlembicOrg/UniDumper): 4 stars · GPL-3.0 · last push 2026-09 · Windows x64 Unity IL2CPP metadata workbench for static dumping, package inspection, cross-version migration, and deterministic C++20 SDK generation with UniResolver.
- [antxiko/temptations-disassembly](https://github.com/antxiko/temptations-disassembly): 4 stars · last push 2026-10 · Annotated disassembly of Temptations (Topo Soft, MSX, 1988). All 40,449 bytes of the game are explained, 100%, reproducible byte for byte.
- [fugue-re/fugue-idapro](https://github.com/fugue-re/fugue-idapro): 4 stars · MIT · last push 2023-06 · Fugue database importer and exporter for IDA Pro.
- [keithgh1/star-nx1020-re](https://github.com/keithgh1/star-nx1020-re): 4 stars · MIT · last push 2026-08 · Reverse engineering the Star NX-1020 9-pin dot-matrix printer: extracted resident fonts, labeled firmware disassembly, ROM maps, and full documentation
- [nicodlz/starcraft-match](https://github.com/nicodlz/starcraft-match): 4 stars · MIT · last push 2026-10 · Matching decompilation research for StarCraft: Brood War 1.16.1 — reproducible x86 function reconstruction and exact byte comparison.
- [ronitgupta138/rev-core](https://github.com/ronitgupta138/rev-core): 4 stars · MIT · last push 2026-10 · ⚡ Autonomous reverse engineering engine & Model Context Protocol (MCP) server for binaries and applications in Systems Rust
- [shark4ce/Ghidra-SandBlaster-Plugin](https://github.com/shark4ce/Ghidra-SandBlaster-Plugin): 4 stars · last push 2023-09 · The SandBlaster Plugin is a sophisticated extension for Ghidra that seamlessly integrates the functionalities of the SandBlaster tool into the Ghidra environment.
- [sp00nznet/shufflepuck-cafe](https://github.com/sp00nznet/shufflepuck-cafe): 4 stars · MIT · last push 2026-10 · Static recompilation of Shufflepuck Cafe (Broderbund, 1988): the copy-protected 68k Mac binary reverse-engineered, unpacked byte-exact, and lifted to native C. Runs through a Toolbox HAL over SDL2.
- [tony-go/macho_re](https://github.com/tony-go/macho_re): 4 stars · last push 2025-01 · macho_re is a lightweight lib for parsing Mach-O binaries.
- [v-p-b/reshare-ida](https://github.com/v-p-b/reshare-ida): 4 stars · last push 2025-12 · IDA scripts for the REshare reverse-engineering exchange format
- [Xplo8E/ios2catalyst](https://github.com/Xplo8E/ios2catalyst): 4 stars · last push 2026-01 · Patch iOS binaries to run on macOS
- [Braxton-Bevis/bmk4](https://github.com/Braxton-Bevis/bmk4): 3 stars · GPL-3.0 · last push 2026-07 · BMK4 (Braxton · Metal · Kisak · 4): a work-in-progress arm64 iOS port of LWSS's GPL-3.0 KisakCOD Call of Duty 4 decompilation. DXVK's D3D9 frontend proven on physical iPadOS. No game assets.
- [CAATZ/bimmerstein-bin-analyzer](https://github.com/CAATZ/bimmerstein-bin-analyzer): 3 stars · GPL-3.0 · last push 2026-09 · Open-source Windows app for ECU binary analysis and editing: automatic map and axis detection, hex/2D/3D views, supported checksum correction, and RomRaider / TunerPro XDF / CSV / JSON export.
- [eloyssync/axianware](https://github.com/eloyssync/axianware): 3 stars · last push 2026-09 · Native C++/Win32 PE analysis & binary triage toolkit. Inspects headers/entropy, strips ASLR/NX, inverts branch logic (Jcc/RET), scans AOB signatures, and generates instant .1337 patches, Cheat Engine scripts, or trampoline DLL hooks
- [KeepALifeUS/sfs2x-py](https://github.com/KeepALifeUS/sfs2x-py): 3 stars · MIT · last push 2026-03 · SmartFoxServer 2X binary protocol implementation for Python
- [mytechnotalent/G-AVR](https://github.com/mytechnotalent/G-AVR): 3 stars · MIT · last push 2026-06 · Advanced Ghidra processor module for flawlessly reverse-engineering, disassembling, and decompiling AVR microcontrollers.
- [pablodiazjorge/rea-lab](https://github.com/pablodiazjorge/rea-lab): 3 stars · MIT · last push 2026-10 · Reverse engineering with AI agents on Windows: verifying, measuring and visualising the tools agents use, with rea and Ghidra
- [patacca/differ](https://github.com/patacca/differ): 3 stars · GPL-3.0 · last push 2022-04 · Simple binary diffing tool written in python and built on top of angr.
- [reacher-z/Awesome-REA](https://github.com/reacher-z/Awesome-REA): 3 stars · MIT · last push 2026-10 · Awesome Reverse Engineering Anything: tools, projects, case studies and research papers for websites, games, apps, binaries and firmware.
- [Seemafir6626/esp32-p4-decompiler-plugin](https://github.com/Seemafir6626/esp32-p4-decompiler-plugin): 3 stars · last push 2026-10 · Enable full Ghidra support for the ESP32-P4 RISC-V microcontroller with custom Sleigh processor definitions, peripheral memory maps, and ROM symbol loading.
- [thyrn90/ThyrnAnalyzer](https://github.com/thyrn90/ThyrnAnalyzer): 3 stars · MIT · last push 2026-05 · Lightweight PE/ELF binary analyzer written in C++17.
- [TrustedMechanism/NastyBitez](https://github.com/TrustedMechanism/NastyBitez): 3 stars · last push 2025-07 · Nasty Bytes Detector — A Ghidra plugin that identifies tricky byte patterns designed to confuse disassembly and disrupt control flow analysis, helping reverse engineers uncover obfuscated code.
- [xliee/ida_mask_plugin](https://github.com/xliee/ida_mask_plugin): 3 stars · MIT · last push 2026-05 · An IDA Pro plugin for binary pattern analysis and generation, featuring ARM64 assembly-to-pattern conversion capabilities.
- [blessed0x/xkvm-ios-injector](https://github.com/blessed0x/xkvm-ios-injector): 2 stars · MIT · last push 2026-09 · Pure-Go IPA tweak injector. Inject dylibs into IPA files & sideload on iOS 17+. Byte-faithful pyzule/cyan rewrite.
- [ChekeEdd/ghidra-superfx](https://github.com/ChekeEdd/ghidra-superfx): 2 stars · BSD-3-Clause · last push 2026-05 · Ghidra processor module (SLEIGH spec) for the Nintendo SuperFX / GSU-1 / GSU-2 co-processor — the enhancement chip in Star Fox, Yoshi's Island, Stunt Race FX, and Doom SNES.
- [ChowChowSonic/apkhound](https://github.com/ChowChowSonic/apkhound): 2 stars · MIT · last push 2026-10 · An all-in-one binary designed to help with locating, extracting and identifying changes between APK versions
- [Fabulu/Mixup](https://github.com/Fabulu/Mixup): 2 stars · last push 2026-09 · Hand-translating console games from disassembly into readable, modifiable JavaScript, not emulation. Every ROM routine becomes a JS function you own, verified frame-by-frame against the real ROM running in an emulator. Batman (Game Boy) complete; Gradius (NES) plays end to end; DoDonPachi DaiOuJou (arcade) in progress. No ROM included.
- [fredangstadt-lang/LineWarsII-DOS](https://github.com/fredangstadt-lang/LineWarsII-DOS): 2 stars · last push 2026-07 · The 1994 DOS game LineWars II, reconstructed in C from its shipped binary and held to the original by 41 test gates, 27 of which execute the 1994 machine code in an emulator. Builds with Open Watcom, runs in DOSBox-X. Freeware with the original author's permission.
- [gfriloux/dragonsword-save-editor](https://github.com/gfriloux/dragonsword-save-editor): 2 stars · Apache-2.0 · last push 2026-08 · Save editor for DragonSword Awakening (2026): decrypts the SQLCipher save, edits currency, items, cooking recipes, costumes, mounts and titles in a local browser UI. Pure Go, no CGO, single static binary for Linux & Windows.
- [hexria/GhidraInsight](https://github.com/hexria/GhidraInsight): 2 stars · last push 2026-02 · AI-assisted reverse engineering tool built on Ghidra and MCP.
- [huku-/reveal](https://github.com/huku-/reveal): 2 stars · last push 2026-06 · Divide-and-conquer binary diffing framework
- [Ian9Franco/MIM](https://github.com/Ian9Franco/MIM): 2 stars · MIT · last push 2026-10 · A personal project aiming to solve real systems problems within a specific domain: a modular desktop and cloud systems platform for automated crash diagnostics (SAGE RAG), content-addressed storage (Aduana), static JVM bytecode security, and binary NBT recovery.
- [kandowontu2/simtower-native-windows-port](https://github.com/kandowontu2/simtower-native-windows-port): 2 stars · last push 2026-10 · Unofficial disassembly-backed native Windows port of SimTower (source only; original game assets excluded)
- [laaielichter/Reverseport](https://github.com/laaielichter/Reverseport): 2 stars · MIT · last push 2026-10 · Reverse engineer anything. Port it anywhere. One CLI and MCP server that lets any coding agent take apart apps, games, binaries and websites — and port them to Godot, Unity, Unreal, three.js or any language.
- [lavochkaa/SystemExplorer](https://github.com/lavochkaa/SystemExplorer): 2 stars · MIT · last push 2026-07 · Read-only iOS system monitor for TrollStore. Processes, entitlements, Mach-O layout, XPC daemons, IOKit registry. Low-level C/C++ + Swift/UIKit.
- [manop55555/roe](https://github.com/manop55555/roe): 2 stars · Apache-2.0 · last push 2026-05 · A native C++ CLI toolkit for reverse engineering binaries.
- [Mohamed-Adil-Cyber/Ghidra_Sequential_Function_Renaming](https://github.com/Mohamed-Adil-Cyber/Ghidra_Sequential_Function_Renaming): 2 stars · last push 2023-11 · Simple script for ghidra to rename the default function names into better looking names that can be differed from afar
- [MorenoLopez/RevTool](https://github.com/MorenoLopez/RevTool): 2 stars · last push 2026-10 · Binary reverse engineering toolkit in C - file analysis, ELF/PE parsing, entropy scanning, string extraction, and optional disassembly.
- [mytechnotalent/G-Pulley](https://github.com/mytechnotalent/G-Pulley): 2 stars · MIT · last push 2026-06 · Decompile the web's bleeding edge. The premier Ghidra processor module for reverse-engineering Wasmtime's portable Pulley ISA.
- [NerdTIV/QDig](https://github.com/NerdTIV/QDig): 2 stars · MIT · last push 2026-08 · Reassembles split Qualcomm firmware for Ghidra, and recovers source file and line from the debug metadata left in the binary
- [olofd/kraftverk](https://github.com/olofd/kraftverk): 2 stars · MIT · last push 2026-10 · A small, code-first home hub for reverse-engineered and custom devices. Every device is a package with its own screens, settings and safety rules. Local, self-hosted, next to Home Assistant.
- [pablodiazjorge/rea-casebook](https://github.com/pablodiazjorge/rea-casebook): 2 stars · MIT · last push 2026-10 · A Claude Code mod that keeps a live casebook of the Evidence rea gives the agent: Ghidra cold start, findings that must cite real evidence_id values, Markdown export.
- [ranjithrajv/MachO-explorer](https://github.com/ranjithrajv/MachO-explorer): 2 stars · MPL-2.0 · last push 2026-10 · The reader you can read. Dependency-free Mach-O introspection for reverse engineers, security researchers, and build engineers — fat headers, symbols, instruction boundaries and branch edges, with a versioned JSON contract, an MCP server and an Agent Skill. Live audit report: https://ranjithrajv.github.io/MachO-explorer/
- [Ryxm-a/Ghidra-WebAssembly-WASM-Plugin](https://github.com/Ryxm-a/Ghidra-WebAssembly-WASM-Plugin): 2 stars · GPL-3.0 · last push 2026-10 · WebAssembly analysis and decompilation support for Ghidra, developed and maintained for Ghidra 12.1.4.
- [sayseven7/peda-modern-gdb](https://github.com/sayseven7/peda-modern-gdb): 2 stars · MIT · last push 2026-04 · Patched PEDA for modern Python and GDB environments
- [Vieira-Orchid/Dridex-Malware-Unpacking-Report](https://github.com/Vieira-Orchid/Dridex-Malware-Unpacking-Report): 2 stars · last push 2025-10 · This repository contains a detailed technical report documenting the unpacking process of a Dridex malware sample. The analysis was performed in a controlled virtualized environment using x32dbg, Process Hacker, and PE-bear to locate, extract, and partially reconstruct PE images from memory.
- [vobst/coderec](https://github.com/vobst/coderec): 2 stars · Apache-2.0 · last push 2026-08 · Identifies machine code in binary files.
- [waaraawa/ByteGrid](https://github.com/waaraawa/ByteGrid): 2 stars · MIT · last push 2026-06 · Visualize binary data and C struct memory layouts as interactive SVG diagrams in Obsidian
- [waterofriver/ghidriff-mcp](https://github.com/waterofriver/ghidriff-mcp): 2 stars · last push 2026-09 · MCP server exposing the ghidriff Ghidra binary-diffing engine as tools for AI agents
- [yangwar/IDAPro-MuiLs](https://github.com/yangwar/IDAPro-MuiLs): 2 stars · MIT · last push 2026-10 · A restrained, modern desktop theme plugin for IDA Pro 9.3, featuring scoped Qt styling and automatic theme persistence.
- [yruichen/lino](https://github.com/yruichen/lino): 2 stars · MIT · last push 2026-10 · A file-first editor with a native macOS shell and shared Rust core. Markdown today, broader document editing over time.
- [ZxPwdz/Signature-Forge](https://github.com/ZxPwdz/Signature-Forge): 2 stars · MIT · last push 2026-01 · Generate intelligent wildcard byte signatures from x86 disassembly. Supports x64dbg, Cheat Engine, and raw hex formats.
- [0bAndyWirus/DQ9-Decomp](https://github.com/0bAndyWirus/DQ9-Decomp): 1 stars · last push 2026-10 · Dragon Quest IX (EU) research: Nintendo DS decompilation tooling, ARM/Thumb static recompilation, and experimental SDL2/Godot native runtime. No game data.
- [0xdad0/ghidra-scripts](https://github.com/0xdad0/ghidra-scripts): 1 stars · last push 2026-02 · A collection of personal ghidra scripts
- [abd3lraouf-studios/binexport-ghidra-12](https://github.com/abd3lraouf-studios/binexport-ghidra-12): 1 stars · Apache-2.0 · last push 2026-08 · BinExport for Ghidra 12.x (12.1.2). Patched build of google/binexport that fixes the NoSuchFieldError LabelString$LabelType.CODE_LABEL crash (issue #166) blocking BinExport + BinDiff on Ghidra 12.0+. Prebuilt Ghidra extension + headless export. Ghidra → BinExport → BinDiff pipeline restored.
- [AbdallaElzedy/AsmViz](https://github.com/AbdallaElzedy/AsmViz): 1 stars · last push 2025-12 · Browser-based x86-64 assembly visualizer: instruction breakdown, stack frame behavior, and control flow in AT&T syntax. Built as a learning companion for Harvard CS61.
- [agatti/ghidranotes](https://github.com/agatti/ghidranotes): 1 stars · Apache-2.0 · last push 2024-01 · A simple Ghidra plugin to keep notes while reverse engineering
- [antonio-in-stem/chatgpt-rea](https://github.com/antonio-in-stem/chatgpt-rea): 1 stars · last push 2026-10 · Windows ChatGPT/Codex frontend reverse-engineering workspace: recovered UI contracts, original-runtime demos, evidence, and a deferred native Rust port.
- [ataoytun/revdump](https://github.com/ataoytun/revdump): 1 stars · MIT · last push 2026-06 · User-mode reverse-engineering memory dumper for Windows. Reconstructs packed, hollowed, and manually-mapped processes into IDA/Ghidra-loadable PEs with rebuilt imports.
- [audiodestrukt/smarmsynth](https://github.com/audiodestrukt/smarmsynth): 1 stars · last push 2026-08 · Reverse-engineering Anarchy Sound Software's SwarmSynth (2003) by measuring it, not disassembling it. Wine-hosted VST2 rig, JUCE recreation, WebAssembly build.
- [BeirlaenSander/cra-scan](https://github.com/BeirlaenSander/cra-scan): 1 stars · AGPL-3.0 · last push 2026-09 · Firmware image in, CycloneDX SBOM and EU Cyber Resilience Act gap checklist out. Reads opkg/dpkg package databases, Yocto SPDX manifests and ESP-IDF headers straight out of a binary, with no unblob or binwalk required.
- [blazeleechgravity/IDA-Pro-2026-Reverse-Engineering-Toolkit](https://github.com/blazeleechgravity/IDA-Pro-2026-Reverse-Engineering-Toolkit): 1 stars · last push 2026-07 · No description supplied by the upstream repository.
- [ByteLandTechnology/ghidra-bridge](https://github.com/ByteLandTechnology/ghidra-bridge): 1 stars · Apache-2.0 · last push 2026-10 · Bridge Ghidra to MCP and WebSocket JSON-RPC for program analysis and automation
- [cognis-digital/fwxray](https://github.com/cognis-digital/fwxray): 1 stars · last push 2026-09 · Diff two firmware images and surface exactly what changed: new binaries, flipped config flags, added certs, and shifted entropy regions.
- [danielcho02/win_minesweeper_hack](https://github.com/danielcho02/win_minesweeper_hack): 1 stars · MIT · last push 2026-07 · IDA static analysis and runtime memory verification for classic WinMine
- [diff3/BinaryPacketsDSL](https://github.com/diff3/BinaryPacketsDSL): 1 stars · MIT · last push 2026-04 · BinaryPacketsDSL is a domain-specific language and toolkit for describing, parsing, and analyzing binary protocol packets. It is designed for clarity, robustness, and testability, with support for structured definitions, modifiers, and dynamic field handling.
- [dk8827/alleycat-remastered](https://github.com/dk8827/alleycat-remastered): 1 stars · last push 2026-10 · Alley Cat (1984): byte-exact disassembly, static JavaScript translation, and HD graphics with a live CGA comparison slider.
- [dogtopus/slac33](https://github.com/dogtopus/slac33): 1 stars · last push 2025-06 · Epson S1C33000 support in Ghidra
- [Drago1314/cryptofirmware-analyzer](https://github.com/Drago1314/cryptofirmware-analyzer): 1 stars · MIT · last push 2026-04 · 🔐 AI/ML-powered tool for identifying cryptographic primitives in multi-architecture firmware binaries. Built with Streamlit, scikit-learn & Plotly.
- [FantasmaGlad/DQMJ1_Ultimate_Decompilation](https://github.com/FantasmaGlad/DQMJ1_Ultimate_Decompilation): 1 stars · MIT · last push 2026-10 · Full-stack C decompilation (ARM9/ARM7/overlays, 7,140 functions), asset extraction pipelines and hardware research for Dragon Quest Monsters: Joker (NDS). Contact: fanta@dqmj1.wiki
- [gpthimble/elf-studio](https://github.com/gpthimble/elf-studio): 1 stars · last push 2026-09 · Browser-based viewer for ELF file structure, focused on RISC-V.
- [H0llyW00dzZ/pe-sigscan](https://github.com/H0llyW00dzZ/pe-sigscan): 1 stars · Apache-2.0 · last push 2026-08 · Fast, zero-dependency, no_std Rust crate for scanning PE signatures with IDA-style patterns
- [JerenzeLevi/cyberdesk](https://github.com/JerenzeLevi/cyberdesk): 1 stars · last push 2026-09 · Local web dashboard unifying OSINT, reverse engineering, binary exploitation, web/directory recon, and cryptography tools for CTF and authorized security research — upload a file, click Run, get a result.
- [joemunene-by/ghostmobile](https://github.com/joemunene-by/ghostmobile): 1 stars · MIT · last push 2026-06 · Static security analyzer for Android APK and iOS IPA packages (authorized review, static only). Built-in binary AXML decoder, manifest and Info.plist checks, JSON and SARIF output.
- [jtang613/ghidra_processor_nios_II](https://github.com/jtang613/ghidra_processor_nios_II): 1 stars · last push 2025-03 · A Ghidra processor extension for the Altera Nios II
- [keremmisik/freertos-ghidra](https://github.com/keremmisik/freertos-ghidra): 1 stars · MIT · last push 2026-06 · No description supplied by the upstream repository.
- [KernFerm/Binwalk-FZ](https://github.com/KernFerm/Binwalk-FZ): 1 stars · GPL-3.0 · last push 2026-10 · Binwalk FZ scans firmware/binary files on Flipper microSD for validated signatures and offsets. Adds Linux/Raspberry Pi mode using upstream Binwalk, with Flipper as UART controller and results display.
- [Luvvydev/reassist](https://github.com/Luvvydev/reassist): 1 stars · MIT · last push 2026-01 · reverse engineering assistant for strings, IOCs, imports, and Ghidra assisted analysis
- [meerkatone/binja_diff_view](https://github.com/meerkatone/binja_diff_view): 1 stars · MIT · last push 2026-10 · Compare binaries inside Binary Ninja with synchronized graph and linear diffs, corpus comparisons, and symbol transfer.
- [mosfaqur/firmware-extract](https://github.com/mosfaqur/firmware-extract): 1 stars · MIT · last push 2026-09 · Automated static-analysis pipeline for embedded Linux firmware. Systematically extracts and audits credentials, cryptographic keys, password hashes, ELF binary hardening, unsafe C functions, and debug interfaces.
- [mustafajaved304/VulnX](https://github.com/mustafajaved304/VulnX): 1 stars · last push 2026-09 · Automated vulnerability assessment and risk analysis platform with Nmap scanning, CVE intelligence, binary analysis, YARA threat detection, and PDF security reporting
- [neuralsun/rea-deep-dive](https://github.com/neuralsun/rea-deep-dive): 1 stars · last push 2026-10 · An in-depth technical investigation of REA: source-code mechanisms, original papers, reproducible experiments, and evidence-driven behavior reconstruction.
- [nico-perales/deltabin](https://github.com/nico-perales/deltabin): 1 stars · Apache-2.0 · last push 2026-09 · Fast, open binary diff for ELF/PE — reports structural changes and, for x86-64, which functions were added, removed, or modified. Rust CLI + library.
- [NurMohammadDuari/TypingMaster12-Source-Code-Decoded](https://github.com/NurMohammadDuari/TypingMaster12-Source-Code-Decoded): 1 stars · last push 2026-10 · TypingMaster 12.0.1.981 - full reverse-engineering source tree, analysis and documentation
- [RAZORRZR0/SkyGfxDE](https://github.com/RAZORRZR0/SkyGfxDE): 1 stars · MIT · last push 2026-10 · PS2 look for GTA San Andreas – The Definitive Edition: skygfx-style colour filter, PS2 timecyc, radiosity, SpeedFX, grain, neo water drops, GTA fog – on top of DE's modern renderer. x64 ASI plugin with an in-game debug menu.
- [V3tR1l1oN/vgui2-reconstruction](https://github.com/V3tR1l1oN/vgui2-reconstruction): 1 stars · GPL-3.0 · last push 2026-09 · Complete static reconstruction of vgui2.dll (GoldSrc) from its binary: our own code, the original ABI, 349/349 methods, 18 tests, GPL v3.
- [vs-sr-dev/pc-themurderofsonicthehedgehog-doc](https://github.com/vs-sr-dev/pc-themurderofsonicthehedgehog-doc): 1 stars · last push 2026-09 · A Steam installation of The Murder of Sonic the Hedgehog (SEGA, 2023), measured file by file: 178 files, 468,913,725 bytes; four UnityFS bundles opened with residue 0; 996,569,296 headerless side-file bytes attributed, 433 left over; and 124 of 137 binaries carrying a hash where a date should be. No game assets here, only measurements.
- [x0prc/PrismGhidra](https://github.com/x0prc/PrismGhidra): 1 stars · MIT · last push 2026-02 · A set of five plugins designed to work in Ghidra providing support for Debugging, Config Extraction, API Mapping, Visualisation and Taint Analysis
- [Zoxemik/GhidraRichPresence](https://github.com/Zoxemik/GhidraRichPresence): 1 stars · Apache-2.0 · last push 2026-06 · Discord Rich Presence extension for Ghidra with customizable display, privacy and session options.
- [zrnge/webasm](https://github.com/zrnge/webasm): 1 stars · last push 2026-06 · 100% client-side multi-architecture static disassembler
- [zxkuhl/SectorForge](https://github.com/zxkuhl/SectorForge): 1 stars · MIT · last push 2026-10 · Ghidra for local AI models — decompile, inspect, and patch GGUF / LoRA / Ollama models in a visual workbench, and build new ones from modular "sector" adapters. No retraining required.
- [zz2007327-code/Open-Source-Everything](https://github.com/zz2007327-code/Open-Source-Everything): 1 stars · last push 2026-10 · Reverse-engineer runnable targets (websites, SPAs, browser apps, mini programs, Electron, binaries) into evidence-backed mechanism notes, then distill them into build-ready functional specs.
- [aliaihub/rea-casebook](https://github.com/aliaihub/rea-casebook): 0 stars · MIT · last push 2026-10 · Real-world reverse engineering with AI agents. Explore REA case studies, software reconstructions, demos, source code, and the evidence behind each result.
- [aliakbar-zohour/ASM_ZERO](https://github.com/aliakbar-zohour/ASM_ZERO): 0 stars · last push 2026-07 · Learn assembly from zero: ARM64 on Apple Silicon, plus x86-64, RISC-V, reverse engineering, WebAssembly, and hands-on projects — served as a clean Astro course site.
- [Altumptic/paranoia](https://github.com/Altumptic/paranoia): 0 stars · Apache-2.0 · last push 2026-10 · Open, local-first reverse engineering platform — PE/ELF/Mach-O, x86/x64/AArch64 disassembly, graphs, pseudocode. Rust engine, desktop app.
- [AmeerMH/insaniquarium-web](https://github.com/AmeerMH/insaniquarium-web): 0 stars · last push 2026-09 · A browser re-implementation of PopCap's Insaniquarium Deluxe (2004), built on constants recovered by decompiling the original binary rather than tuned by feel. TypeScript, Phaser 3, a pure deterministic simulation, 4,967 tests.
- [ammar00sheikh/flutter-axi](https://github.com/ammar00sheikh/flutter-axi): 0 stars · MIT · last push 2026-07 · AXI-compliant CLI for agent-driven Flutter app automation - widget-tree snapshots, driver interactions, native device control, multi-app orchestration
- [atomjay/reverse_analysis](https://github.com/atomjay/reverse_analysis): 0 stars · last push 2025-06 · Learn reverse-engineering techniques, covering static and dynamic analysis as well as advanced binary protections such as packing, obfuscation and encryption.
- [Benjaminjacob443/firmware-analyzer](https://github.com/Benjaminjacob443/firmware-analyzer): 0 stars · last push 2026-04 · Firmware binary analysis tool in Rust — magic byte scanning, Shannon entropy analysis, string extraction and JSON reporting for embedded security research.
- [Black0ffR/omega-unified](https://github.com/Black0ffR/omega-unified): 0 stars · last push 2026-07 · Ω Zero-dependency JS security scanner — deobfuscates webpack bundles, AST taint tracking, SW analysis, chunk graph. 273 findings on Juice Shop in 10.7s. Termux-native.
- [borgox/osu-collector-reverse](https://github.com/borgox/osu-collector-reverse): 0 stars · last push 2025-12 · A blog post on how i reverse engineered the osu!collector app
- [chgroeling/armv7m-decoder](https://github.com/chgroeling/armv7m-decoder): 0 stars · GPL-3.0 · last push 2026-08 · ARMv7-M (Thumb) instruction decoder and disassembler in Python - full instruction set, objdump-compatible output, generated from a YAML spec.
- [deja666/azazel](https://github.com/deja666/azazel): 0 stars · MIT · last push 2026-04 · Python library for analyzing malicious binaries through emulation, pattern matching, and integration with reverse engineering tools.
- [Dhaiwat10/cricket07-browser](https://github.com/Dhaiwat10/cricket07-browser): 0 stars · MIT · last push 2026-10 · EA Sports Cricket 07 (2006) running in the browser: every function statically recompiled from x86 to C, then WebAssembly, with Direct3D 8 rebuilt on WebGPU. Bring your own copy.
- [frontal1660/archer-c7-firmware-reverse](https://github.com/frontal1660/archer-c7-firmware-reverse): 0 stars · last push 2026-09 · Non-destructive reverse engineering of the TP-Link Archer C7 v1.1 router. Includes UART access, full NOR flash dump without desoldering, firmware analysis, kernel binary patching, proprietary image reconstruction, and temporary RAM boot (TFTP) to obtain an early root shell.
- [hui-joyce/local-multi-agent-dev](https://github.com/hui-joyce/local-multi-agent-dev): 0 stars · last push 2026-08 · A local multi-agent AI system featuring two specialised assistants: a software development assistant for code generation and review, and a reverse engineering assistant for analysing assembly and decompiled binaries.
- [IFAKA/rugby08-web](https://github.com/IFAKA/rugby08-web): 0 stars · last push 2026-10 · Play EA Sports Rugby 08 (PC, 2007) in the browser: static recompilation of the x86 game to WebAssembly, Direct3D 8 on WebGL 2. Installable PWA. Bring your own copy.
- [Information-Technology-Security/Android-Repackaging](https://github.com/Information-Technology-Security/Android-Repackaging): 0 stars · last push 2026-02 · Academic security project demonstrating an Android repackaging attack, where a legitimate APK is disassembled, modified with malicious smali code, re-signed, and redeployed to perform privacy-invasive actions such as contact deletion and location tracking (Information Technology Security, UNIWA).
- [jlm0/kore-health](https://github.com/jlm0/kore-health): 0 stars · last push 2026-09 · Educational, cloud-free React Native companion for Oura rings, built on the reverse-engineered open_oura BLE protocol. Scores computed on-device. Not affiliated with Oura.
- [Kaklaber/Momus](https://github.com/Kaklaber/Momus): 0 stars · MIT · last push 2026-08 · A single-file, offline analyzer for source code, binaries, packages, documents, SBOMs, and security metadata — entirely in your browser.
- [Karthik-Swaminathan98/mcu-function-size-analyser](https://github.com/Karthik-Swaminathan98/mcu-function-size-analyser): 0 stars · last push 2026-03 · Python tooling for embedded benchmark analysis — objdump call-graph parser, .map code-size extractor, ARM vs RISC-V visualisation
- [luotianyiismywife/blutter-windows](https://github.com/luotianyiismywife/blutter-windows): 0 stars · MIT · last push 2026-09 · Windows build & precompiled binaries for blutter - Flutter/Dart AOT snapshot reverse engineering tool (upstream: worawit/blutter)
- [mahmoudimus/maml](https://github.com/mahmoudimus/maml): 0 stars · last push 2026-10 · A byte-oriented matching language for finding meaning in changing binaries. MAML stands for Mahmoud's Address Matching Language
- [meerkatone/binary_diffing_and_marimo_rust](https://github.com/meerkatone/binary_diffing_and_marimo_rust): 0 stars · MIT · last push 2026-08 · Marimo notebook to compare and search the binary diffing results.
- [motan1337/ghidra-py](https://github.com/motan1337/ghidra-py): 0 stars · MIT · last push 2026-10 · No description supplied by the upstream repository.
- [n-3-0-l-d-3-v/ultron](https://github.com/n-3-0-l-d-3-v/ultron): 0 stars · Apache-2.0 · last push 2026-09 · Evidence-first binary and firmware analysis. Every finding is a structured claim linked to the artifacts that support it - free-text security claims are unrepresentable by design. Builds on Ghidra headless and binwalk; zero runtime dependencies.
- [nazeeh111/Capsulith](https://github.com/nazeeh111/Capsulith): 0 stars · GPL-2.0 · last push 2026-10 · Preserve compiled ARM64 code and initialized objects as portable Node and browser APIs.
- [nazeeh111/Reclay](https://github.com/nazeeh111/Reclay): 0 stars · MIT · last push 2026-10 · Learn binary file structure from examples and build guarded standalone editors, entirely in your browser.
- [NerdTIV/WiDig](https://github.com/NerdTIV/WiDig): 0 stars · MIT · last push 2026-08 · Digging symbols out of TI WiLink firmware. Ghidra loader plus symbolisation: starts from the debug trace database TI forgot to strip, deduces the rest from the binary itself. 435 named functions, 358 inferred MMIO registers, 82 source modules.
- [olivercase/ghidra_headless](https://github.com/olivercase/ghidra_headless): 0 stars · MIT · last push 2026-04 · Automated Ghidra headless scripts for batch decompilation, metadata extraction, and programmatic memory constant retrieval.
- [playday3008/GhidraDosInterruptResolver](https://github.com/playday3008/GhidraDosInterruptResolver): 0 stars · Apache-2.0 · last push 2026-03 · Ghidra extension that resolves x86 DOS/BIOS interrupt calls using Ralf Brown's Interrupt List
- [RuriMeiko/zalo-linux-native](https://github.com/RuriMeiko/zalo-linux-native): 0 stars · last push 2026-10 · Unofficial Zalo Linux port (x86_64) — every native module ported: file-utils, file-utilities, zwalker, zfile, v8-profiles, mp4thumb, zimage, zjxl, zcall wire bridge + live call recon
- [RyyzDev/kudu](https://github.com/RyyzDev/kudu): 0 stars · MIT · last push 2026-10 · KUDU (KUliah DUlu) is a personal hobby project combining UIN Jakarta campus services, such as academics, e-letters, and other services, in one integrated application.
- [sagarchive/rdis](https://github.com/sagarchive/rdis): 0 stars · MIT · last push 2026-10 · Scriptable multi-format disassembler & decompiler — a browser-based Hopper alternative
- [samartha-2601/AutoRed](https://github.com/samartha-2601/AutoRed): 0 stars · last push 2026-06 · Automotive Red Team platform featuring CAN spoofing, CAN replay attacks, Gateway IDS/IPS, native C SocketCAN ECUs, ARM firmware analysis, and Ghidra-based reverse engineering.
- [Schmiemandev/dvfa](https://github.com/Schmiemandev/dvfa): 0 stars · MIT · last push 2026-03 · DVFA: A FinTech security lab mapping 10 vulnerabilities to the OWASP Mobile Top 10. Focused on AOT binary analysis, deep link hijacking, and SQL injection, featuring a Dockerized mock backend.
- [TheFlashBold/ghidra-c166-haldex](https://github.com/TheFlashBold/ghidra-c166-haldex): 0 stars · last push 2026-09 · Ghidra language module for Infineon C166/XC166 (Tasking VX-C166) firmware
- [thunderstornX/firmware-analysis-walkthrough](https://github.com/thunderstornX/firmware-analysis-walkthrough): 0 stars · MIT · last push 2026-06 · A reproducible firmware-security pipeline for OpenWRT 22.03 on ath79/MIPS
- [tuvior/Talaria](https://github.com/tuvior/Talaria): 0 stars · MIT · last push 2026-05 · Hermes bytecode disassembler and assembler for React Native bundles
- [valkyoth/runasmidja](https://github.com/valkyoth/runasmidja): 0 stars · EUPL-1.2 · last push 2026-10 · A security-first, API-driven data workbench being built in Rust. Inspired by CyberChef, designed for encoding, decoding, cryptography, and binary analysis through composable recipes, with browser-based WebAssembly and optional server execution.
- [vineeththomasalex/dll-visualizer](https://github.com/vineeththomasalex/dll-visualizer): 0 stars · MIT · last push 2026-07 · See inside a Windows DLL: colour-coded memory map, explained PE headers, imports/exports, PDB symbols and live disassembly - 100% in your browser.
- [vs-sr-dev/pc-monstrum-doc](https://github.com/vs-sr-dev/pc-monstrum-doc): 0 stars · last push 2026-09 · MONSTRUM (Team Junkfish, Unity 5.5, 2018) from a GOG Galaxy install, read as bytes: 19 serialized files, 825 textures closed and rendered, 2,215 FSB5 banks, 9 escape films, the assembly to its members, a co-op at zero, the owner's play log and a 2018 minidump.
- [vs-sr-dev/pc-twinsensquest-doc](https://github.com/vs-sr-dev/pc-twinsensquest-doc): 0 stars · last push 2026-09 · A GOG offline installer measured as an object: 2 files, 2,891,523,108 B, 100.0000 % placed with residue 0. Inno Setup 5.6.2 Unicode over a shop naming layer derived here -- 788 files it would write, never run. Five content descriptors. 101 of 101 script opcodes of the 1994 original in the 2024 assembly.
- [Waseemshahazad/trinket-core-analyzer](https://github.com/Waseemshahazad/trinket-core-analyzer): 0 stars · GPL-3.0 · last push 2026-05 · A high-performance C++ forensic tool for deep binary analysis of Qualcomm (SD665) firmware dumps. Specialized in identifying Gatekeeper hash patterns and secure element signatures using advanced heuristic pattern matching.
- [yovico-ai/pictureman](https://github.com/yovico-ai/pictureman): 0 stars · MIT · last push 2026-10 · Picture Man 1.55 (1991-1993), the true-color image editor for Windows 3.x, rebuilt in Rust from its binaries - runs on the desktop and in the browser
- [zboralski/unflutter](https://github.com/zboralski/unflutter): 0 stars · BSD-3-Clause · last push 2026-07 · Static analyzer for Flutter/Dart AOT snapshots
- [ZooHero500/reatool](https://github.com/ZooHero500/reatool): 0 stars · last push 2026-10 · Unofficial REA tutorials and comparisons for installing and using Reverse Engineer Anything with coding agents.