Star on GitHubStar1.1k stars

THE REVERSE ENGINEERING COLLECTION

Reverse-engineering case studies

431 case studies from 1,253 curated resources, with documented reconstruction methods, scope, and original evidence.

Software reconstruction artifact reviews · Beta

Review artifacts from REA workflows and independent reconstructions. Each entry retains its original sources and known limits.

Reconstruction scope
Implemented features, known gaps and required original assets.
Available artifacts
Original code, releases or demos.
Evidence and attribution
Pinned sources, review dates and documented REA roles.
About these cases

Each case appears once under its primary subject, with all its target labels.

Websites

13 cases

All sections

13 cases tagged Website · Show all 13 →

Documents a website-rebuild-skill case that decodes browser-delivered React Server Component Flight streams, reconstructs a buildable Next project and compares its output with a captured site. The reported rauchg.com campaign uses route-tree comparison and module-reference mapping; the new server source is inferred from observable output.

Documents BaoCut’s interactive slide editor, whose author says the implementation draws on Claude Slides. It adds a local deck store, HTML/CSS compiler and annotation-to-agent bridge for browser and desktop hosts; the design reports a Web-flow check, without establishing original backend recovery or full behavioral parity.

A Japanese field report connects REA 6.4.0 to Claude Code in a separate project directory, denies 43 of its 170 tools and common shell launch forms, and compares REA-enabled and REA-disabled runs on two real tasks: an Electron terminal’s packaged files and a saved HAR capture. Both arms answered correctly, while the REA arm took up to 2.00× the time and 1.67× the API-equivalent cost. It is an analysis-evaluation and safety-configuration case, not a reconstruction.

The author uses REA’s MCP browser tools to passively capture the JavaScript loaded by wayou’s open-source T-Rex Runner page, then has Codex rebuild its acceleration rule in one self-contained HTML5 Canvas game. The report identifies the captured script by SHA-256 and separates verified source facts from reconstruction choices; only the speed rule is claimed, not full gameplay equivalence.

An independent Rust market interface uses REA browser-scenario research on public logged-out TradingView chart interactions. The notes retain observed/documented/inferred/unknown labels; the result supplies its own chart engine and data providers rather than recovering TradingView or Bloomberg server software.

Documents BaoCut’s design-canvas and design-system editors, which the project says it ported 1:1 from TypeScript reconstructions of Claude Design’s editors and hosts in agent sessions with annotation and export. Its runtime notes record identifier fixes checked against the original scripts and a structural comparison matching 19,111 of 20,463 canvas main-page functions. Unreviewed differences, the unpublished reconstruction record and reuse rights remain open; no hosted-backend recovery is claimed.

Documents and reimplements the WebSocket protocol WhatsApp Web used while browser sessions mirrored a paired phone: QR pairing, Curve25519/HKDF key setup, AES/HMAC-protected binary messages, the token-based node encoding and end-to-end media encryption. A Python backend, Node.js relay and browser front end decode a logged-in session’s messages into inspectable JSON, and the README lists independent reimplementations such as Baileys and go-whatsapp. This is an older protocol generation from before WhatsApp’s 2021 multi-device architecture, not a description of current WhatsApp Web.

Reimplements Adobe Flash Player in Rust so that SWF content, from ActionScript 1/2 (AVM1) to ActionScript 3 (AVM2), runs in a native desktop player or in browsers through WebAssembly, as a self-hosted script or a browser extension. Its contributor guide says behavior comes from observing Flash Player's output or from license-compatible sources such as Adobe's open avmplus code, and forbids decompiling Flash Player, Flash Professional or Animate. Regression tests run contributor-made SWFs and compare their trace output, and optionally rendered images, with captures from the official debug Flash Player.

Littlebird.ai static home-page rebuild

Independent reconstruction project

Rebuilds the Littlebird.ai home page in plain HTML/CSS/JavaScript from captured markup and assets, with source-wired mobile navigation, FAQ toggles, scroll reveals and OS-dependent call-to-action presentation. It illustrates a bounded website reconstruction, with uncaptured routes and product functionality left outside the scope.

Sheypoor MCP implements a client and MCP server for the Sheypoor classifieds site using API behavior documented from browser traffic. Its reference records observed endpoints, request headers, cookies and phone-based login. The server exposes listing search and details, account functions, chat room lists and unread message counts to MCP clients.

Power BI API Scraper reconstructs the web client's undocumented query and response format for published reports. It sends SemanticQueryDataShapeCommand requests, follows restart tokens and expands bitsets and ValueDicts into CSV rows. The included example is hardcoded for an Ohio liquor permit report.

Games

239 cases

All sections

242 cases tagged Game · Show all 242 →

Matching decompilations and disassemblies

69 cases

Source or a full disassembly that the original toolchain rebuilds byte for byte, checked per function or against hashes of the original binaries.

Decompiles the PlayStation 2 executable of Street Fighter III: 3rd Strike from Street Fighter Anniversary Collection into C that period Metrowerks and EE GCC compilers rebuild, then compares the rebuilt executable word by word with the user’s original. README reports the game code fully decompiled and the CRI middleware partly so. The separate 3SX native port describes itself as this project’s continuation.

Reconstructs Animal Crossing’s GameCube code as C and C++ source that rebuilds the USA release’s main executable and its foresta.rel module. The dtk-template build reads the original binaries and assets from a user-supplied disc image, then checks both outputs against SHA-1 hashes. A separate native PC port builds on it; completeness figures remain project-reported here.

Reconstructs the ARM9 game code of Animal Crossing: Wild World’s Korean DS release as one C or C++ source per function, checked against the user’s ROM with the original Metrowerks compiler and linker. Each function also has a readable Clean rewrite, and an included DS interpreter compares the ROM code, natively compiled sources and rewrites on recorded play. Data sections, the ARM7 binary, the linked SDK libraries and regrouping into original source files remain outside the reconstruction.

Rebuilds the Japanese Nintendo 64 release of Animal Forest (Dōbutsu no Mori) from C code reverse-engineered from the ROM, combined with assets and assembly extracted from a user-supplied ROM. Default builds compare the uncompressed and recompressed ROMs with stored MD5 checksums. The README rules out use as a port base or for commercial purposes, and decomp.dev reported 18.52% of code matched at the reviewed commit.

Reimplements part of Breath of the Wild’s Switch v1.5.0 main executable in C++ and checks each function against the original machine code. The project calls itself a hybrid decompilation/reimplementation: it contains no assets, its ELF holds only reimplemented functions and cannot run the game, and porting is an explicit non-goal.

Recreates C source for Castlevania: Symphony of the Night from its PlayStation, PSP and Saturn binaries, aiming for code that compiles byte for byte to the original game files. The work-in-progress build combines decompiled code with assets and assembly extracted from a user-supplied disc image, then checks per-version SHA-1 hashes. Native PC experiments in the same tree are documented as unfinished and are not a released port.

The author has Codex use REA’s Ghidra tools to inspect the English DX-Ball 1.07 executable and recover it as typed C/C++, then compiles each function with the original-era Visual C++ 4.0 and compares it byte for byte with the original after mapping relocations. The same source also builds a MinGW Windows game and a portable core library. Exact reconstruction is still in progress; REA’s separate sound-pan showcase covers just one function.

Reconstructs C source for the US PlayStation release of Final Fantasy VII, aiming for code that compiles back to the original main executable and its game overlays. The build splits the user’s disc files with splat, compiles with period cc1-psx compilers and checks every rebuilt file against its SHA-1. A native build against the PsyZ PlayStation-library replacement is compiled in CI but is not documented as a playable port.

Reconstructs GoldenEye 007’s Nintendo 64 code as C source that rebuilds the US, Japanese and PAL ROMs. Assets come from a user-supplied US ROM, with Japanese and PAL differences taken from their own ROMs, and the default build compares each output with a recorded SHA-1. The README still calls the project work in progress, while a mutable status page reports all 208 files done; it is distinct from the separately curated PC port.

Decompiles Gran Turismo 4’s PS2 engine executable (CORE.GT4, NTSC-U v1.01) into one C or C++ source per function for Sony’s ee-gcc 2.96, matching public libraries such as newlib and Expat from their own source. The README credits AI agents (Anthropic’s Claude) driving the project’s tools with most of the matching, each function accepted only on a compiler-and-judge comparison, and reports 95.4% of functions and 83.6% of code bytes matched for an October 2026 commit. A local full build links sources at their original addresses, fills the rest from disassembly and compares SHA-1 with the user’s executable.

A work-in-progress matching decompilation of Halo 2 for the original Xbox: contributors write C and C++ that the period compiler, building the whole program with link-time code generation, must turn back into the retail executable's bytes function by function. The README reports just under half of the game-function bytes matched and leaves a native port for a later stage. It discloses that much of the maintainer's work runs in Claude and Codex coding-agent lanes.

Reconstructs Fatal Frame’s PS2 executable as C for the US, EU and Japanese releases, built with the original EE-GCC 2.9 toolchain and checked by SHA-1 against the user’s own executables. Committed objdiff reports list the US and EU code as fully matched and the Japanese code as partial, and a few routines still rely on assembly or byte patches. Porting to modern hardware is a stated later goal, not part of this repository.

Rebuilds the boot ELFs of ICO’s PAL (SCES-50760) and Japanese (SCPS-11003) PlayStation 2 discs from one source tree with the game’s original compiler versions, and checks that every loaded byte and the whole ELF file match the disc’s SHA-1. The 73 data-only archive members are generated at build time from the user’s own ELF, so most read-only data still comes from the disc rather than from source. Separate branches target the USA, Korean and August 2001 prototype builds, and the catalog’s ICO PC port is a fork of this tree.

Reconstructs the ARM9 program and overlays of the EU Nintendo DS release of Kingdom Hearts 358/2 Days as C that recompiles byte for byte with CodeWarrior. README reports all 306 modules byte-identical, with about 99.5% of functions in real C and library assembly counted separately; the ARM7 binary is outside its scope. The repository holds no ROM, game assets or extracted disassembly and produces no playable build.

Recreates a C source base for The Legend of Zelda: Majora’s Mask from information in the game and static or dynamic analysis, then rebuilds the US Nintendo 64 ROM. The build takes assets and assembly from a user-supplied ROM and checks the output against stored MD5 checksums. The team states it will not produce a PC port; the separately curated Zelda 64: Recompiled only credits it for headers and some functions.

A work-in-progress matching decompilation of Mario Kart Wii that targets the PAL release (RMCP01), rebuilding main.dol and the StaticR.rel module from C and C++ with Metrowerks compilers and checking both against stored SHA-1 values. The build splits these binaries from a user-supplied disc image, and objdiff compares objects during development. The README’s progress badges point to a decomp.dev page that did not resolve at review, and the default branch was last updated in September 2025.

A work-in-progress 1:1 decompilation of Mario Kart: Double Dash!! that rebuilds the GameCube main.dol of the US debug build (MarioClub_us) from C and C++ with the original Metrowerks compilers, checking it against a stored SHA-1. The build splits the binary from a user-supplied disc image, and objdiff compares objects during development. decomp.dev reported 47.09% of code matched at the reviewed commit; a European retail target is configured but marked as not working yet.

Reconstructs Mario Party 4’s GameCube main executable and REL modules as C source that rebuilds both USA releases. The build analyzes the user’s own disc image and checks every linked output against version-specific SHA-1 lists. PAL and Japanese work is stale and no PC port exists yet; matching results remain project-reported here.

Decompiles the US PlayStation release of MediEvil toward C source that rebuilds its main executable, game executable and 26 overlays. splat splits the user's own disc files, and the default build compares all 28 outputs with SHA-1 checksums. README describes the project as a work in progress and publishes no progress figure.

Reconstructs C++ source for Metroid Prime’s GameCube executable and its NES-emulator module so that CodeWarrior builds match the originals, across the USA, Korean, PAL and Japanese releases, with early configurations for demo discs and three Wii releases. Matched units are compiled from source and linked with objects split from the user’s disc, then checked against per-version SHA-1 hashes; the repository contains no game assets or assembly. The separately curated Metaforce and Metroid Prime Port build their native ports on this code.

Decompiles Minecraft: Nintendo Switch Edition v1.0.17, a Legacy Console Edition release, into C++ that is compared function by function with the original executable using a patched Clang 4.0.1 and the open-ead Switch decompilation tools. The README explains the choice of the Switch build for its matchable Clang toolchain and type information, with names ported from the symbol-bearing Wii U Edition. At the reviewed commit the function list marks about 11% of functions decompiled, most of them matching; the result cannot run the game.

Recreates a C source base for Ocarina of Time that rebuilds 16 Nintendo 64, GameCube and iQue Player ROM versions, using information from the game and static and dynamic analysis. Assets come from the user’s own ROM and each default build is checked against that version’s MD5; README states the project is not producing a PC port and still calls the repository a work in progress.

Reconstructs Paper Mario’s Nintendo 64 code as C source that rebuilds the US, Japanese, PAL and iQue ROMs. The build takes assets and comparison inputs from a user-supplied original ROM, then checks each output against a recorded SHA-1. Mutable project reports list no remaining nonmatching functions, while the README still calls the decompilation work in progress; it is distinct from the PaperBoat native port.

A work-in-progress matching decompilation of Paper Mario: The Thousand-Year Door that targets the Japanese Rev 0 GameCube release (G8MJ01), rebuilding MarioSt.dol and 31 REL modules with the original Metrowerks compilers and checking each against a stored SHA-1. The build splits these binaries from a user-supplied disc image, and objdiff compares objects during development. decomp.dev reported 12.10% of code matched at the reviewed commit.

Reconstructs Perfect Dark’s Nintendo 64 code with a documented matching-ROM build. The project combines reconstructed source with assets from a user-supplied original ROM, then checks version-specific artifact hashes. It is a reproducible-build research case, distinct from the separate native PC port; matching results remain project-reported here.

Reconstructs Super Mario Galaxy’s Wii code as C++ that rebuilds, object by object, against main.dol files extracted from the user’s own Japanese, North American, PAL or Korean disc. Matched objects are linked from source and checked with objdiff and a target hash. The project describes itself as a work in progress, separate from any PC port, and says it does not accept AI-generated decompilation.

Recreates C++ source for The Legend of Zelda: Phantom Hourglass by hand-decompiling its European and US Nintendo DS releases, using the dsd toolkit to delink code from a user-supplied ROM and rebuild the ROM. objdiff tracks matches function by function, and the default build compares the output ROM with a stored SHA-1. The work is at an early stage: decomp.dev reported 2.82% of code matched at the reviewed commit.

A fan decompilation of Pikmin 2 that rebuilds main.dol for five GameCube releases (USA retail, two USA demos, PAL and Japan) with the original Metrowerks compilers, checking each against a stored SHA-1. The build reads main.dol from the user’s own copy of each release. decomp.dev reported all code matched and fully linked for every version at the reviewed commit, and a non-matching mode builds the US DOL entirely from C++ for modding.

Reconstructs the Game Boy Color game Pokémon Crystal as RGBDS assembly, with graphics, maps and data stored as editable sources. One tree builds the international 1.0 and 1.1 releases, the Australian release, two debug builds and a Virtual Console patch, each checked against a recorded SHA-1. Companion documentation covers script command formats and known bugs in the original game.

Reconstructs the Game Boy games Pokémon Red and Blue as RGBDS assembly, with graphics and data kept as editable source files. One tree builds the USA/Europe Red and Blue ROMs, a Blue debug build and patches for the Virtual Console releases, each checked against a recorded SHA-1. It is a full disassembly rather than a decompilation into a higher-level language.

Reconstructs the Game Boy Advance games Pokémon Ruby and Sapphire as C source built with pret's agbcc compiler, alongside assembly data scripts and editable graphics. Matching builds cover the English 1.0, 1.1 and 1.2 revisions, debug builds and the first German editions, each checked against a stored SHA-1. A separate modern-GCC target is not expected to match.

Reconstructs Pokémon Emerald for the Game Boy Advance as buildable C source, with game scripts and data kept as assembler directives. The default agbcc build produces pokeemerald.gba, and make compare checks it against the SHA-1 of the original English ROM; an optional modern-GCC build is not hash-checked. Graphics and audio sources are committed in the tree, so the documented build reads no base ROM.

Reconstructs the English Game Boy Advance releases of Pokémon FireRed and LeafGreen as buildable C source, with game scripts and data kept as assembler directives. Default agbcc builds produce six ROM images, covering both games' 1.0 and 1.1 releases and two variants labeled switch, each checked against its own SHA-1 manifest. Graphics and audio sources are committed in the tree, so the documented build reads no base ROM.

Rebuilds the US Nintendo DS releases of Pokémon HeartGold and SoulSilver from a work-in-progress disassembly in which part of the code has been decompiled to C. Each default build checks the ARM9 and ARM7 binaries, the filesystem and the complete ROM against per-game SHA-1 manifests. README warns that, because decompilation is incomplete, edits that change code or data layout can crash the game.

Reconstructs the US Nintendo DS release of Pokémon Platinum as C source that rebuilds revision 1 by default and revision 0 on request. The default make target runs Meson checks of the code binaries, filesystem and complete ROM against SHA-1 manifests. README still calls the project work in progress; its contributing guide says the code is entirely C but much of it remains obfuscated, leaving documentation and tooling as the main work.

Reconstructs as C the firmware of the Pokéwalker, the pedometer accessory for Pokémon HeartGold and SoulSilver, for its Renesas H8/38606 microcontroller. With artwork from the user’s retail firmware image and a supported Renesas compiler suite, the README reports a byte-identical rebuild of the 48 KiB image; without that image, original placeholder art gives a non-matching reference build. The author describes disassembling and decompiling the retail binary, the HeartGold/SoulSilver ROMs and the candidate compilers, alongside published hardware research.

Reconstructs C source for SCES_509.16, the PAL v2.00 PlayStation 2 executable of Ratchet & Clank (2002), with every function linked at its retail address. Functions not yet decompiled are still built from disassembly generated from the user's own executable, and the build audits functions, layout and the whole image against retail. The project documents an LLM-agent matching workflow and written build-fidelity rules for what counts as a match.

Reconstructs C and C++ source for the two-disc Resident Evil 4 GameCube debug prototype (G4BE08) and rebuilds main.dol and all 114 REL overlays with the compilers the README names, checking every output against a SHA-1 list. Function names are Capcom’s own from the debug build’s Bio4.sym files, and most struct and field names are aligned from the PS2 debug build’s debug information. The project’s research log says AI agents did the matching work; byte identity is project-reported.

Decompiles sead, the C++ standard library that Nintendo statically links into its first-party games, covering containers, heaps, strings, math, file devices, threads, the game framework and graphics. Compile-time presets target the recent versions used by Breath of the Wild, Super Mario Odyssey, Splatoon 3, Tears of the Kingdom and Super Mario Bros. Wonder, and game decompilations such as Breath of the Wild pull it in as a submodule. Names come from debugging symbols and assertions in retail titles, and the README warns that many inlined and templated names are guesses.

Reconstructs C++ source for The Legend of Zelda: Skyward Sword’s Wii main.dol and REL modules, starting from the user’s NTSC-U 1.0 (SOUE01) disc files. Objects marked matching are compiled from source and linked with objects split from the original, and the result is checked against SHA-1 hashes; the repository ships no assets or assembly and is not a port.

Reconstructs source code for SCUS_971.98, the NTSC-U PlayStation 2 executable of Sly Cooper and the Thievius Raccoonus, as a work-in-progress matching decompilation. Functions not yet matched are still assembled from code split out of the user's own executable, and the build checks the linked ELF's SHA-1. The result runs in PCSX2 with the original disc for assets; it is not a native PC port.

A public matching decompilation of the N64 game Snowboard Kids 2, begun in 2024 with community decompilation tools. The author’s dated posts document Claude, Codex and GLM workflows, including headless one-shot loops, similarity-based function scheduling and hook-guarded, hash-checked builds, through a reported complete function match.

A matching decompilation of the original Nintendo 64 Snowboard Kids that rebuilds SHA1-identical North American and Japanese ROMs from a user-supplied ROM. The author’s 84-day post-mortem describes coding agents run through his Nigel harness alongside m2c, the permuter and a shared file of compiler learnings, and declines to credit LLMs alone for the speed-up. It is a separate project from the Snowboard Kids 2 decompilation.

Reconstructs Sonic Advance and Sonic Advance 2 for the Game Boy Advance as C that rebuilds six hash-listed ROMs with SAT-R’s agbcc fork, and compiles the same code into widescreen SDL ports for Linux, macOS and Windows plus PSP and PS2 builds. README reports Sonic Advance 2 built entirely from C with about 60 functions still non-matching. Extracted graphics, music and data are committed, so the builds read no original ROM.

Macabeus’s dated study describes prompting Claude Sonnet 3.5 and DeepSeek R1 with assembly, similar decompiled functions and structs to write matching C for Marun, one enemy module of the community Sonic Advance 3 GBA decompilation. The resulting pull request replaced that module’s assembly and was merged; the author calls the setting unusually AI-friendly, and the project now bars LLM-origin contributions.

Reconstructs C source for the US 1.1 (Rev A) Nintendo 64 release of Star Fox 64 that, compiled with the IDO compiler through a static recompilation, rebuilds a ROM with the published MD5; the README badge counts all 2,951 functions as matching. Code and assets are split from the user’s own ROM at build time, and the repository contains no assets or assembly. The separately curated Starship PC port compiles this C code, while Starfox 64: Recompiled takes headers and some functions from it for its patches.

Reconstructs C++ source for Super Mario Odyssey’s Switch 1.0 main executable and checks each function against the original AArch64 machine code with the shared nx-decomp-tools checker. At the pinned commit its function list marks 18,996 of 74,171 functions matching. The README warns that the build is not a playable game, the repository ships no game assets, and Nintendo libraries such as sead and agl come from open-ead’s separate reconstructions.

Extends the doldecomp Super Mario Sunshine decompilation to the North American GMSE01 release. The README says AI was used extensively, and the repository’s agent rules, work order and progress files describe batch-based Claude and Codex orchestration. Its rebuilt DOL is reported byte-identical, but unfinished objects are still linked from code extracted from the user’s disc.

Reconstructs Super Mario Sunshine’s C++ source so that the original Metrowerks compiler reproduces byte-identical object files for four GameCube releases and the Switch 3D All-Stars build. The target binary comes from the user’s own disc image, and objdiff compares rebuilt objects function by function. The work is incomplete, and the repository publishes contribution rules for AI agents alongside its human workflow.

A work-in-progress matching decompilation of Super Smash Bros. Brawl that targets the USA Rev 2 Wii release (RSBE01_02), splitting main.dol and 126 REL modules from a user-supplied disc image and checking the rebuilt binaries against stored SHA-1 values. objdiff compares objects during development, and six other regional revisions are listed but commented out of the supported set. decomp.dev reported 1.27% of code matched at the reviewed commit.

A matching decompilation of Super Smash Bros. Melee's US 1.02 release (GALE01) that rebuilds main.dol from C with the original Metrowerks compilers and checks it against the retail SHA-1. decomp.dev reports the code fully decompiled and linked at the reviewed commit, and the README says current work is mostly naming and cleanup. Because the build can be shifted, a separate non-matching mode lets modders add code to a DOL run with their own disc dump.

Reconstructs much of the NTSC-U PlayStation 2 executable of Syphon Filter: The Omega Strain as C; with the remaining functions kept as split assembly, the build reproduces the retail SCUS_972.64 byte for byte. Committed objdiff reports track per-function matching against the user’s own executable. This is a matching-decompilation case, not a PC port; progress figures remain project-reported.

Reconstructs source for the Japanese PC-98 Touhou 4: Lotus Land Story and rebuilds all four DOS programs, MAIN.EXE, OP.EXE, MAINE.EXE and ZUN.COM, with a pinned Borland toolchain under Wine. Function acceptance against the original binaries is tracked separately from emulator replays that compare inputs, RNG, object pools and video with the original game. Complete-campaign, original-timing and byte-identity goals remain open.

Reconstructs source for the original Japanese Touhou 9.5: Shoot the Bullet 1.02a executable, accepting function exactness only through reproducible byte comparison of pinned Visual C++ .NET 2003 builds against one hash-attested target. The whole program also compiles and links into a playable Windows i386 executable, while README keeps playability, function matching and whole-executable identity as separate statuses.

Recreates a C source base for The Legend of Zelda: The Minish Cap from information in the game and static or dynamic analysis, building five Game Boy Advance ROMs: USA, EU, JP and two demos. Each version takes its assets from a user-supplied original ROM, and normal builds check the output’s SHA-1 hash. The project remains a work in progress, and some parts of the ROM may not yet be shiftable.

Rebuilds the USA/Europe Game Boy Advance release of The Sims: Bustin' Out byte for byte while gradually replacing ROM regions with matching C compiled by agbcc. The README calls it an AI-driven experiment in which almost all code, analysis and tooling are AI-generated. Most of the ROM is still copied from the user’s dump, so whole-ROM equality does not mean the game has been decompiled.

Reconstructs source for The Wind Waker’s GameCube executable and REL modules across the USA/Korea, PAL and Japanese releases and a Japanese kiosk demo. Matched units are compiled from source and linked with objects split from the user’s disc, then checked against per-version SHA-1 hashes; the repository ships no assets or assembly and covers the GameCube game, not the HD remaster.

Reconstructs C++ source for the Windows executable of Touhou 6: Embodiment of Scarlet Devil version 1.02h, aiming at an exact rebuild with the original Visual Studio .NET 2002 and DirectX 8 toolchain. reccmp and objdiff compare the rebuilt binary with the user’s original executable function by function. The committed progress badge reports every function implemented but 98.03% byte accuracy, so whole-binary identity is not claimed.

Reconstructs C++ source for the Windows executable of Touhou 7: Perfect Cherry Blossom 1.00b and its custom.exe configuration tool, built with the original Visual Studio .NET 2002 and DirectX 8 toolchain and compared function by function with the user’s originals through reccmp. The committed progress badges report th07.exe fully implemented at 99.78% accuracy and custom.exe fully matched. The README says the game should be fully playable, but a matching build trips the game’s integrity check, and the cross-platform ports live on separate branches.

Reconstructs Twilight Princess source that compiles back to binaries identical to the originals, building GameCube, Wii and Nvidia Shield releases from one codebase through conditional compilation. README reports the GameCube code as completely matching but not every translation unit linked yet, with Debug and Wii alignment ongoing; the repository ships no assets or assembly and will not produce a port.

A work-in-progress decompilation of the Wii Menu, the console’s System Menu (IPL), targeting version 4.3 in its USA, European, Japanese and Korean builds. It recovers the menu’s own code together with the Revolution SDK, NintendoWare (NW4R), EGG and middleware libraries linked into it, matched unit by unit against the original executable with decomp-toolkit and objdiff. The repository holds no assets or assembly; a build needs the user’s own Wii Menu WAD and yields only main.dol.

Non-matching decompilations

19 cases

Recovered source checked by behavior or not at all, rather than rebuilt byte for byte.

c1: a C port of PlayStation Crash Bandicoot

Independent reconstruction project

Ports the original PlayStation Crash Bandicoot game code to C function by function; its coding standard labels functions with the addresses of their original implementations. Only the PC build, using OpenGL, SDL2 and FluidSynth, currently works; it loads asset files from the user’s game disc and is only partially playable.

Eric S. Raymond’s terminal port of Firefighter, Eben Sprinsock’s 1985 DOS shareware game. The project history says ChatGPT 5.5 decompiled the DOS binary to Borland Pascal and translated it to Rust, after which Raymond modernized the interface and corrected a scoring mismatch. Unchanged gameplay is the author’s statement; the intermediate Pascal and any comparison runs are not published.

A research project re-implementing the original Xbox Halo: Combat Evolved in C, one function at a time. Rewritten functions are compiled into a separate image and patched into the user’s original executable with redirects from the original implementations, so the hybrid game can be run and debugged in xemu or on an Xbox as work progresses. The project reports an early stage, and its sources document no byte-for-byte comparison with the original code.

Rewrites code from Bloodborne’s PS4 executable (CUSA03173 with update 1.09) as readable C++, one function at a time, aiming at a native PC source port on a clean-room runtime of its own. It is a functional rather than matching decompilation: each replacement is hooked in, compared with the original machine code on recorded and generated inputs, and independently reviewed. Work is at an early stage: README reports 21 of 157,757 functions verified, and the game does not yet run on Paleblood’s own runtime.

Reimplements the engine of Oddworld: Abe’s Oddysee and Abe’s Exoddus as an open-source replacement executable that runs from the user’s own game folder. The team decompiled the original executables and replaced their functions incrementally, using injected DLLs that hook reimplemented code into the patched retail executable, then rewrote the result into a standalone cross-platform engine. The project site says both games are playable in their entirety, with bug fixes and windowed, high-resolution and controller play.

Reconstructs C++ source for Plants vs. Zombies on PopCap’s open-source SexyAppFramework, starting from an earlier community decompilation of version 0.9.9 and adding functionality reversed from the Game of the Year edition, with functions annotated by GOTY addresses. The project also modernizes the engine with current C++ and is replacing the DirectDraw and Direct3D 7 renderers with GLFW. It builds a fan executable that runs from an original game folder, aiming at a modernized, extensible game rather than an identical binary.

Reconstructs Retro Engine v3, the engine behind the 2011 Sonic CD remaster, as a native C++ source port for Windows, Linux, macOS and Android. The engine runs the game's own scripts and assets from an official release, which the repository does not ship, and adds a mod loader, a settings file with remappable controls, support for the mobile versions' updated scripts and extra developer-menu debug keys. Its license describes the code as mostly functionally the same as the original rather than byte-matching; the same team's RSDKv5 decompilation is listed as a separate case.

Decompiles Retro Engine (RSDK) v4, the engine behind Sonic the Hedgehog and Sonic the Hedgehog 2 (2013), together with the games’ natively coded menus, and builds it for Windows, Linux and Android. The engine runs the game scripts contained in the official releases’ data files, which users must supply. The project adds a script compiler, a mod loader and an experimental online mode for Sonic 2’s 2P VS; it is the predecessor of the same group’s RSDKv5 decompilation.

Reconstructs the Retro Engine (RSDK) v5 and v5 Ultimate runtime, the engine that runs Sonic Mania’s game code, and builds it for Windows, Linux, Switch and Android. RSDKv5U can also run RSDKv3 and RSDKv4 games such as Sonic CD and Sonic 1 & 2. The project adds a mod loader, a shader compiler and extra Windows backends, and ships no game data.

Reconstructs Sonic Mania’s game code in C and builds it with the separately decompiled RSDKv5 or RSDKv5U engine for Windows, Linux, Switch and Android. Assets must come from an official Sonic Mania (Plus) release; the project adds a mod loader and can build several retail versions. Its license describes the code as mostly functionally the same as the original, not byte-matching.

The author’s REA fork, posted as rea-engine and since renamed RE-Agent, decompiles the shipped .NET executable of the GPL-licensed TicTacToe-AI game, recompiles the recovered C# and resources, and repairs one decompiler error against the original IL. A differential probe runs original and rebuilt code on all 19,683 board assignments for one status method and compares six form renders. The report passes only that method; the whole game remains partial.

The author uses a pinned REA build with Ghidra to analyze a user-supplied Pokémon Ultra Sun base executable, rebuild it byte for byte from split objects, and swap in two small compiled C runtime routines. Both replacements are behavior-tested but nonmatching and every other byte stays original; one recorded input movie drives the original and hybrid builds to the same bedroom movement in the Azahar emulator. Retail compiler identity, exact matching, module loading and broader gameplay remain open.

Recovers Virtua Fighter 2 Version 2.1’s Sega Model 2A i960 program into portable, non-matching C17, accepting each recovered path only when it matches a reference i960 executor at controlled boundaries. The repository adds ROM validation, i960 and 68000 analysis tools, a bounded Model 2A hardware model and snapshot-based differential runners. README states that it is not yet a playable port; match flow, combat, physics, AI, rasterization and much of the audio remain open.

Decompiles the USA Wii U release of The Wind Waker HD function by function into readable C++ in zeldaret/tww’s style, and verifies each function by running it beside the original, statically recompiled from the user’s own copy, comparing return values, memory writes and calls on generated and recorded inputs, with coverage and mutation checks. README reports 28,244 of the game’s 39,713 functions verified, including 22,068 of 22,215 GameCube-derived functions. The code calls undecompiled functions by address, so it runs only inside the ZeldaWWHDRecomp port, not as a standalone game build.

Static recompilations

48 cases

Original machine code or bytecode translated ahead of time into compilable code that runs natively on a replacement runtime.

Uses N64Recomp to statically recompile the US 1.0 Nintendo 64 release of Banjo-Kazooie into a native port on N64ModernRuntime, rendered by RT64 and extended with mod support. Like Zelda 64: Recompiled, it is not built from decompiled source; a symbols repository generated from the Banjo-Kazooie decompilation supplies function names for locating code in the ROM and writing patches.

An early reverse-engineering effort on PlayStation Crash Bandicoot 2 that converts the engine’s MIPS machine code directly into a very large C file and runs it against a modified PCSX-R emulator library for hardware I/O. Translated functions are meant to be decompiled by hand and moved into ordinary C, gradually replacing the mechanical translation.

Uses N64Recomp to statically recompile the US 1.0 Nintendo 64 release of Castlevania into a native PC port rendered with RT64. Game-specific C patches build against headers from a separate Castlevania 64 decompilation. A beta release tagged at the reviewed commit reports a working build with known issues, while the README there still describes an unfinished project.

Statically recompiles the US Nintendo 64 release of Conker’s Bad Fur Day with N64Recomp into a native Windows, Linux and macOS port on N64ModernRuntime and RT64. Function names and boundaries come from a vendored, still mostly assembly decompilation, while the recompiled code is taken from the user’s ROM so unmatched decompiled C cannot change behavior. The author reports heavy use of Claude Code across the project.

Translates the 68000 game programs and Z80 sound programs of Capcom arcade boards ahead of time into C++ and runs them on a machine model written for the project, with an interpreter for code that has not been translated. One launcher covers Street Fighter Alpha and Alpha 2, Super Puzzle Fighter II Turbo, Vampire Savior and its variants, Vampire Hunter 2, Alien vs. Predator and the CPS-1 Cadillacs and Dinosaurs, adding training modes, widescreen and three-player options. Translated code is generated from the user’s own ROM sets, and a check build compares it block by block with the interpreter.

A Windows launcher that uses the PSXRecomp recompiler and runtime to translate the user’s Crash Bandicoot 2: Cortex Strikes Back disc to C and compile it locally, so the game runs as native code with an emulated PlayStation hardware layer. The repository holds the launcher, a patched vendored runtime and a long bring-up log; it distributes no game code or data.

Builds a native Windows, Linux, Steam Deck and Apple Silicon port of the XBLA epilogue Dead Rising 2: Case West by statically recompiling its Xbox 360 code with patched XenonRecomp and translating its shaders with patched XenosRecomp. It shares most of its runtime with the author’s separate Case Zero port, executing the console GPU command stream on Vulkan with XMA audio and keyboard/mouse input. Completion and platform results are project-reported.

Builds a native Windows, Linux, Steam Deck and Apple Silicon port of the XBLA game Dead Rising 2: Case Zero by statically recompiling its Xbox 360 code with patched XenonRecomp and translating its shaders with patched XenosRecomp. A purpose-built runtime supplies a Vulkan renderer, XMA audio, keyboard/mouse input and online co-op through the author’s XenonLive service. Completion and platform results are project-reported.

dmc-recomp translates the PlayStation 2 PAL release of Devil May Cry into native PC code through PS2Recomp and a project runtime. Its pipeline rebuilds generated code locally from the user’s own game executable, while research notes and patches track boot, CD services, MPEG playback, rendering and gameplay behavior.

Statically recompiles the North American v1.0 SNES release of Donkey Kong Country into native Windows, macOS and iOS applications with a pinned fork of snesrecomp, which translates 65816 code to C and links it against a modelled SNES hardware runtime. Function boundaries, entry flag states and jump-table targets are ingested from a byte-identical community disassembly instead of discovered heuristically, and the game code is generated locally from the user’s verified ROM. Optional widescreen, CRT filters, MSU-1 music and a Dixie Kong Country variant are host-side additions to what the README calls a playable bring-up.

Lifts the original Xbox executable of Dead or Alive Xtreme Beach Volleyball to C with a fork of xboxrecomp and links it with a hand-written runtime that replaces kernel imports, audio and key Direct3D 8 and DirectSound APIs. Setup builds the runner locally from the user’s USA disc image and checks generated files against hashes in an authenticated recipe; releases carry only tools and source. Rewriting game logic as readable source has so far reached only the startup thread entry.

Uses N64Recomp to statically recompile the US Nintendo 64 release of Donkey Kong 64 into a native port, with RT64 as the renderer. The port is not built from decompiled source, but borrows headers and some functions from the in-progress DK64 decompilation for patches and enhancements. Its recompiler configuration reads a checked-in symbol dump and the ROM rather than a decompilation ELF.

Packages a psxrecomp static-recompilation project for Driver (PlayStation, USA) as a setup host: releases carry the recompiler, runtime and a recomp-ui launcher, and the player’s machine generates and compiles the game from the user’s own disc image. The repository holds configuration, Ghidra-derived function seeds and release automation rather than game code. Its documented status is thin: an operator-confirmed private build reaches gameplay, while package release gates remain open.

Recompiles the user’s Final Fantasy Tactics Advance (USA) Game Boy Advance ROM ahead of time into native code for Windows, Linux and Steam Deck, building on JRickey’s gba-recomp toolkit. ARM and Thumb code is translated to C and compiled locally, while a Rust runtime models the console’s graphics, sound, DMA, timers and BIOS calls. The port adds widescreen, zoom, fast-forward and remappable controls.

Statically recompiles the MIPS R5900 code of the NTSC-U PlayStation 2 God of War executable (SCUS-97399) to C++ with PS2Recomp and builds it as a native Windows program. Since October 2026 the port builds on Waffle565’s runtime, which replaces the PS2 hardware with native code: VU1 microprograms and, optionally, the game’s IRX modules are compiled ahead of time, and an OpenGL renderer stands in for the GS. The repository holds only the game-specific function map, recompiler configuration, overrides and runtime patches; the README reports gameplay on the opening ship level, with sustained 60 fps and a full playthrough still pending.

Translates the Xbox 360 release of Peter Jackson's King Kong into native Windows code with the ReXGlue static-recompilation SDK, adding a launcher and display, control and graphics options. Project code completes streamed disc reads the way the console does, which README credits with getting past an opening freeze seen under Xenia. The author discloses that the port was made almost entirely with Claude Code, directed and tested by the repository owner.

Disassembles every executable file on the Sonic CD disc from runtime coverage and recursive descent, reassembles them byte-identically, and translates the code statically to C on a from-scratch Mega-CD runtime that replaces the BIOS with a high-level implementation. Recompiled blocks run only where memory still holds the code they came from, and a script compares 96 stage runs frame by frame against the interpreter. The project also patches in widescreen and per-zone saves; results remain project-reported.

Translates Lost Odyssey’s Xbox 360 PowerPC executable with patched XenonRecomp tooling and runs the generated code on a native runtime that renders through Direct3D 12, Vulkan or Metal. Windows, Linux, macOS and Android packages import the user’s own disc data. The maintainer documents development with Claude Code and Codex CLI and records each release separately from validation and acceptance.

Statically recompiles the US Nintendo 64 release of Mario Kart 64 into a native Windows, Linux and macOS application with N64Recomp, rendering through RT64. The README distinguishes this from a source port: game code is translated from the user’s ROM, while headers and some functions from a decompilation fork support patches and enhancements. Enhancement, fidelity and input-lag claims are project-reported.

Statically recompiles the North American PlayStation release of MediEvil into C# with the RecompOne recompiler and runtime. The runtime stands in for BIOS, GPU, CD-ROM and other hardware services, and project patches change rendering, widescreen and terrain behavior. README stresses that this is a recompilation, not a decompilation, and labels it an open beta.

Statically translates the 65816 CPU code of the SNES Mega Man X (USA Rev 1) to C with the snesrecomp framework; the PPU, audio, DMA and other hardware run in the framework’s runtime, and a LakeSnes-derived interpreter executes whatever the static pass cannot prove. The C is generated locally from the user’s ROM, with function names imported from community DiztinGUIsh annotations. Playable Zero, co-op and rollback netplay, X2/X3 boss weapons and adaptive widescreen are layered on top, using assets extracted locally from the user’s own sequel ROMs.

A beta Windows build of Super Smash Bros. Melee (NTSC 1.02) with two engines: a source port that compiles the doldecomp decompilation as a native library, and a static recompilation that translates the retail DOL's PowerPC code and Slippi's Gecko codes into C++. Both run on a native runtime with Direct3D rendering, unlocked display rates and natively implemented Slippi rollback play. The user's own ISO supplies all game data, and the README says the work was AI-assisted.

Builds a native port of the Xbox 360 release of Forza Horizon by translating its PowerPC executable ahead of time into C++ with ShiftGlue, the author’s fork of ReXGlue, and compiling it on the player’s machine from their own disc. A renderer written for this game runs its GPU commands on Vulkan, and some translated library code, such as FMOD Ex DSP units, is replaced by independently written native code checked against the translated original. README presents it as a playable preview with rendering bugs and slowdowns.

Rebuilds Star Fox 2 from a coverage-seeded 65816 and SuperFX disassembly that reassembles to the original ROM, then translates it statically to C for native Windows, macOS and Linux builds. Unreached code and RAM code that differs from the ROM run through an interpreter, and the README reports identical per-frame hashes against interpreted runs. It accepts the SNES Classic release image, not the 1995 prototypes; results remain project-reported.

Disassembles Star Fox’s 65816 and SuperFX code from runtime coverage and recursive descent, reassembles it into the original ROM, then translates it statically to C on a from-scratch SNES runtime for Windows, macOS and Linux. Code never reached in recorded sessions, and RAM code that no longer matches the ROM, falls back to an interpreter; the README reports identical per-frame hashes for both paths. The generated C is a mechanical translation rather than hand-decompiled source, and results remain project-reported.

Recompiles the USA Rev 1 Nintendo 64 release of Wave Race 64 into a native Windows application with N64Recomp and RSPRecomp, on modified copies of the N64ModernRuntime, RecompFrontend and RT64 stacks. Game and microcode C is generated locally from the user’s ROM, after an included widescreen patch is applied to a temporary copy, and checked against recorded checksums. The port adds higher resolutions, frame interpolation, ultrawide views, rasterized and ray-traced reflections and shadows, split-screen or separate-window two-player play and RetroAchievements; the maintainer calls it an AI-assisted recompilation.

An unofficial native Windows port of Saints Row (Xbox 360, 2006) that statically recompiles the game's PowerPC executable to C++ for x86-64 with the ReXGlue SDK, which also reimplements the console's kernel, GPU (on Direct3D 12), audio and input. A recompiler manifest, game-specific function overrides and an SDK patch make the result run, and each user builds it locally from their own disc. The README reports the game fully playable with built-in co-op and lists known issues.

Savage Wind Recomp is an in-progress static recompilation of the Nintendo Switch version of The Legend of Zelda: Breath of the Wild for Windows and Linux. It builds native game code locally from the player's extracted files; the README reports playable early areas but says the full story remains unconfirmed.

Sin & Punishment: Recompiled uses N64Recomp and RSPRecomp to build an experimental native C++ port from a user-supplied Japanese N64 ROM and the repository's symbol maps, with RT64 rendering. The author reports that it reaches the title screen; menu navigation, gameplay, audio validation, and a public pipeline for its patched working image remain unfinished.

Recompiles the Xbox 360 version of Skate 3 into native Windows, Linux and macOS builds with a Skate-specific fork of the ReXGlue SDK. Since v2.0.0 a native Direct3D 12 and Vulkan renderer with ports of the game’s own material shading replaces emulation of the Xbox 360 GPU, which remains as a fallback. Game files come from the user’s disc image; the author calls the native renderer early and has not tested the game end to end.

Uses N64Recomp to statically recompile the US Nintendo 64 release of Pokémon Snap into a native Windows, Linux, Steam Deck and macOS port rendered with RT64. The recompiler reads a relocatable ELF linked from the matching ethteck/pokemonsnap decompilation together with the user’s ROM, and game-side patches are modified copies of decompiled functions. The author reports building the port with Claude Code; results remain project-reported.

Translates the Xbox 360 executable of Need for Speed: Most Wanted (2005) into native C++ with a patched XenonRecomp and runs it on a project runtime that stands in for the console’s kernel, Xenos GPU, XMA audio and controllers. Releases target SteamOS, Linux and Apple silicon Macs, with an experimental iPhone and iPad build, while all game data comes from the player’s own US disc. Rendering and frame-pacing improvements are project-reported.

Spider-Man 2 PS2 Recomp applies static recompilation to the USA PlayStation 2 release SLUS-20776 for native PC execution. It combines a game-specific Ghidra function map with PS2Recomp source, runtime fixes and hardware comparison tests. The author reports that a native Windows build reaches the legal splash; the port is not playable.

Uses N64: Recompiled to statically recompile the US 1.1 (Rev A) Nintendo 64 release of Star Fox 64 into a native port for Windows, Linux and macOS, rendered with RT64. Its patches and enhancements draw on headers and some functions from the separate sf64 decompilation, but the port is not compiled from that decompilation's source. The README reports high-frame-rate, widescreen and mod support, with assets loaded from the user's own ROM.

Translates the Xbox 360 executable of WWE SmackDown vs. Raw 2011 to C++ ahead of time with ReXGlue and builds it as a Windows program on a Vulkan runtime derived from Xenia. A hand-maintained manifest adds function entry points the automatic pass misses, and project patches address frame pacing, a music-player delay and pipeline stalls. Exhibition play is author-tested on one AMD GPU; career mode and online remain untested.

Statically recompiles the North American PlayStation release of Castlevania: Symphony of the Night into C# with BlackLabelHQ’s RecompOne, whose runtime simulates the BIOS, memory-mapped I/O, GPU and CD-ROM so the game runs natively without a console BIOS. Per-overlay function maps and patches add widescreen, quality-of-life, randomizer and cheat features. References from the SOTN decompilation help name functions, but the project stresses that it is a recompilation, not a decompilation.

Builds a native Windows x64 port of The Darkness by translating its Xbox 360 executable to C++ ahead of time with a patched XenonRecomp. A D3D11 renderer draws from the engine’s original geometry, shader sources and device state instead of interpreting console GPU packets. Gameplay coverage and Linux results are project-reported, and the author discloses OpenAI Codex assistance.

Translates the PlayStation game’s MIPS code to C with a pinned psxrecomp fork and builds Windows and Linux programs on its hardware-modelling runtime, with a launcher and a game-specific plugin. Without patching game code, the plugin adds 16:9 matches, 60 FPS by raising the emulated CPU clock and rescaling movement, intro skipping and unlocks. The user’s own NTSC-U disc image is required, and the measurements are author-reported.

Statically recompiles the x86 code of The Lord of the Rings: The Two Towers (Xbox, USA, 2002) into C with the bundled xboxrecomp toolkit, producing native Windows, Linux and experimental macOS builds. The recompiled sources are generated locally from the player's own default.xbe, and game data comes from their disc image or extracted folder. README reports the game as fully playable, with visual, frame-rate and mod issues listed.

Weeping of the Empire builds a native Windows port of The Legend of Zelda: Tears of the Kingdom from the user's Switch game dump. It recompiles ARM64 code ahead of time to x86-64, supplies Switch services through a host runtime and renders through Vulkan. The engine documentation credits totk-recomp as the starting point and identifies the added Windows port, renderer, controls and menus.

Statically recompiles The Wind Waker HD’s Wii U PowerPC code to C ahead of time, reimplements the Cafe OS libraries the game uses and implements GX2 graphics on Metal or Vulkan, producing native macOS, Linux, Windows and Android builds without a Cemu runtime. All game code and data are generated locally from the user’s own dump; an experimental macOS-only build can instead run functions from the separate ZeldaWWHDDecomp/wwhd decompilation.

Ports of reconstructed source

33 cases

A native or web build that compiles an existing decompilation or reconstruction on a new platform layer.

Builds native Windows, Linux and macOS versions of The Legend of Zelda: Majora’s Mask from an adapted copy of the zeldaret/mm decompilation, with libultraship reimplementing N64 SDK functions. Game data comes from a user-supplied ROM and is packed into an archive that custom asset packs can override. It targets a playable PC port with enhancements, not a byte-identical ROM.

Builds Street Fighter III: 3rd Strike as native C for Windows, macOS and Linux, continuing the 3s-decomp PS2 decompilation, with SDL3 for video, input and audio and GekkoNet for rollback netplay. README stresses that it is neither a recompilation nor emulation. The port needs the player’s own PS2 game files and works toward arcade-accurate balance, which an optional Statcheck build tests against CPS3 RAM states recorded from Fightcade replays.

Runs Animal Crossing’s decompiled GameCube C code natively on 32-bit x86, replacing the GX graphics API with an OpenGL 3.3 translation layer and console services with SDL2-based platform code. Game assets are read at startup from the user’s own disc image instead of being shipped. It is a port built on ACreTeam’s ac-decomp, not a matching rebuild of the original executable.

Atlantis Native ports the reverse-engineered CryOmni3D Atlantis engine to Rust for Atlantis: The Lost Tales and Atlantis II. It reads files from the user's own game copies and runs their scripts, panoramas, cinematics and puzzles on desktop systems and in browsers, with optional display and bug fixes.

Ports the existing Super Smash Bros. N64 decompilation using libultraship and Torch. The author’s earlier README describes agent-built graphics/audio comparison tools and differential debugging against emulator behavior, rather than claiming AI recovered the game from a cartridge without prior community work.

Compiles the decompiled code of Dragon Ball Z: Budokai Tenkaichi 3 (PS2, USA release SLUS-21678) for PC on a new renderer, sound, input and platform layer rather than an emulator. The game code comes from the separate BT3-Decompiled matching decompilation, and the game's data is read from the user's own disc image. The README reports the full game loop and experimental online play and says AI helped make the project; these results remain project-reported.

Extends the Crash Team Racing: High Octane sourceport, which derives from the CTR Native port of the CTR-ModSDK PlayStation decompilation, into Windows and Linux builds with a native 3D renderer, selectable aspect ratios and frame rates up to 240 FPS. The decompiled game code still assumes 32-bit pointers and loads assets from the player’s own NTSC-U disc image. Renderer, timing and option tests exist, but device coverage and fidelity remain project-reported.

d2mac-linux ports the Diablo II 1.14d Mac executable to 32-bit Linux by converting its i386 Mach-O container to ELF and reimplementing imported Darwin, Carbon and AGL interfaces in Zig. The shim translates graphics to GLX and adapts threading, files and sockets. The author reports that the game reaches its menu and character creation.

Runs Diablo in web browsers by compiling a stripped-down fork of Devilution, the community reconstruction of the game’s original source, to WebAssembly behind a React front end. The fork removes the Storm, DiabloUI, DirectX and Windows dependencies and reworks event handling for the browser. It is a port built on a reconstruction and reports no matching or behavior-equivalence checks of its own.

Reimplements Twilight Princess as a native application for desktop and mobile platforms, building on the zeldaret/tp decompilation and the Aurora GameCube/Wii compatibility layer. It runs from the user’s own disc image with no bundled assets and aims to stay accurate to the original while adding options, enhancements and mods.

Builds Super Mario 64 as a native PC, Switch and Android program by compiling decompilation-style game source against the libultraship platform library. A bundled extractor converts the user’s US or Japanese ROM into an O2R archive at first launch or build time. The project ships modern renderers, configuration menus and mod-archive loading, not a matching ROM.

Compiles the decompiled C of the PlayStation 2 game ICO natively for Windows, Linux, Android, iPhone and Apple-silicon Macs, with host code standing in for the PS2 hardware and Sony libraries. No PS2 code is interpreted or recompiled, and the program reads the player's PAL disc image on first start. It is a native port of a separately byte-matched decompilation, with documented divergences and optional enhancements.

Compiles the C of the khdays-decomp matching decompilation for Windows x64 and supplies a native platform layer for the Nintendo DS hardware, SDK services and sound driver. README reports the whole game running without an ARM interpreter; its rendering, controls, mod support and network multiplayer are the port’s own additions. This is a decompilation-based port, distinct from the byte-matching DS reconstruction it builds on.

Adapts the LEGO Island decompilation into a portable build for desktop, mobile, console, DOS and Web targets. Windows-only subsystems are replaced with SDL3, miniaudio, iniparser and a custom Direct3D Retained Mode re-implementation, while core gameplay is meant to stay unchanged. It ports reconstructed source rather than checking byte-identical binaries, so it is distinct from the exact-rebuild decompilation case.

A native Windows, Linux and macOS port of Banjo-Kazooie that compiles game C sources, many tagged with their Banjo-Kazooie decompilation file paths, against libultraship, a reimplementation of the N64 SDK. Torch extracts the user’s ROM into an asset archive, and the port adds Anchor multiplayer, romhack and language-pack support and a randomizer. Unlike Banjo: Recompiled, it builds from decompiled source rather than statically recompiling the ROM’s code.

Started in 2015 as a reverse-engineered reimplementation of the Metroid Prime engine, Metaforce has been rewritten on top of the PrimeDecomp matching decompilation. Its native app compiles that game code as non-matching C++ for desktop and mobile through the Aurora GameCube compatibility layer and loads a user-selected disc image. The README says builds are unavailable while the rewrite stabilizes.

Compiles the PrimeDecomp decompilation of Metroid Prime’s game and engine code as native C++20 for Linux, Windows and Android, with an experimental macOS build. Aurora supplies the GameCube SDK compatibility layer and rendering, and the port reads a user-supplied disc image at run time. The author states that parts were written with AI coding assistants under their oversight.

Ports the PS2 game Fatal Frame to native PC builds without emulation; its repository description names the Himuro decompilation as its basis. Stubs replace PS2 kernel calls and a new SDL3-based layer handles rendering, audio and UI, while game data comes from the user’s own disc. The README calls the port very early work and publishes no matching or fidelity checks.

Compiles Paper Mario decompilation sources, credited to the pmret and Paper Mario DX projects, into a native US-version application on libultraship. Torch converts the user’s own ROM into a local asset archive, and the port adds rendering backends, enhancements and archive-based mods. Desktop releases are published, while Android, iOS and web builds are documented on the development branch.

Builds native 64-bit Windows and Linux executables of Pokémon Platinum from a fork of pret’s decompilation, replacing NitroSDK with the author’s libntr libraries; the same tree keeps the DS ROM build and an experimental Switch target. README says the game should be playable from start to finish but may crash or show graphical bugs. Prebuilt binaries require the player’s own US ROM, and the fork’s default build no longer runs pret’s checksum tests.

Salamander UEFI ports the NES game Salamander to a native UEFI Shell application by translating its 6502 disassembly into a platform-independent C core. The repository includes a 6502 disassembler, a user-ROM resource extractor, host tests and a fidelity checklist. UEFI GOP, input and timing services replace the original console environment.

Builds Ocarina of Time as a native PC application from the OoT decompilation’s source, with libultraship standing in for the N64 libultra SDK and DirectX 11, OpenGL or Metal rendering. No game assets are shipped: they are converted from the user’s supported ROM into an .o2r archive, and the port adds save states, alternate and custom assets and other enhancements.

Builds native Super Mario 64 executables from decompiled source, extending the sm64-port fork of the n64decomp reconstruction with renderer, input, camera, save-format and external-data options. Game assets are extracted from the user’s own ROM at build time. It is a non-matching enhanced port, not a byte-identical ROM reconstruction.

Builds a native Mario Kart 64 port for Windows, Linux, macOS and Switch from source that keeps the Mario Kart 64 decompilation’s file layout, running on libultraship’s reimplemented N64 SDK. Its bundled Torch extractor converts the user’s US ROM into an asset archive, and the port adds mods, custom tracks and an editor. The README does not name its upstream decompilation, and no matching or fidelity checks are published.

A native PC port of Star Fox 64 that compiles the game's decompiled C code against libultraship, an N64 porting library that reimplements libultra and renders through Fast3D. On first run it uses the Torch tool to turn the user's US ROM into an asset archive, and it ships for Windows, Linux, macOS and Switch. The README of the separate Starfox 64: Recompiled static recompilation calls this port its sibling, built with different technology.

Builds a native PC port of Super Mario Sunshine’s North American release from a pinned matching-decompilation fork, adding a host platform layer for graphics, disc, audio, input and OS services. The fork’s README says AI was used extensively to reconstruct and match its code; the port documents scripted regression hashes and lockstep comparisons with retail captures. Functions that do not yet match can still behave differently from retail, and the game must come from the user’s own disc image.

Compiles the reconstructed C++ source of the Japanese Touhou 8 1.00d release to WebAssembly with Emscripten, adding WebGL 2 rendering, Web Audio, browser input and IndexedDB saves behind the game’s D3D8-, DirectSound- and DirectInput-shaped interfaces. Players select their own retail DAT files locally. The web build makes no binary-exact claim and is a separate port from the curated TH08 reconstruction.

Ports Tony Hawk’s Pro Skater (PlayStation, USA) to native Windows and Linux builds from a fork of an in-progress matching decompilation of the retail executable. The decompilation recompiles reconstructed functions with a Psy-Q toolchain and compares them byte for byte with the user’s retail executable, while the port replaces PlayStation hardware and libraries with SDL2 and OpenGL services. Play needs the user’s own disc image; matching and gameplay results remain project-reported.

Builds on shao113’s matching decompilation of PlayStation Vandal Hearts, adds a Japanese matching tree, and carries both through to a native Windows and Linux port. SDL2, OpenGL or Metal and OpenAL backends replace the console’s GPU, GTE, CD-ROM/XA, SPU, MDEC and pad interfaces, and one executable runs the USA, Asia and Japan discs. The matching builds are still checked on every change; PC-only features such as Tactical Mode and HD packs are opt-in.

Engine reimplementations

47 cases

New code that recreates an engine or its rules from file formats and observed behavior, usually running the original game data.

Re-implements Microsoft’s Age of Empires and its Rise of Rome expansion as a cross-platform C++17 engine on SDL2 and OpenGL that loads the original game’s DRS archives and language.dll resources. README says it mimics the Windows API and the Genie engine for compatibility and reconstructs some code from the disassembly; the repository adds format notes and Python tools for inspecting the original data files. Only very basic gameplay through a multiplayer session exists so far, so it is an early engine case rather than a playable replacement.

Bravo: a reverse-engineered Minecraft server

Independent reconstruction project

Reimplements the server side of Minecraft’s Alpha- and Beta-era multiplayer in Python on Twisted; its documentation calls it a reverse-engineered implementation written from scratch, credits network traffic dumps and says general Minecraft data went to a community wiki. The final 2.0 release speaks the 1.4.x client protocol for login, chunk transfer, entities, server-side inventories, lighting, physics and Anvil saves, while deliberately changing behaviour such as chunk loading and item stacking. A pluggable architecture adds terrain generation, seasons and commands, and small scripts inspect packets, NBT and region files.

Reimplements the engine of Bullfrog’s 1997 Theme Hospital, with game logic in Lua and C++ for graphics, sound, movies and pathfinding, on top of the original game’s data files. The README reports that the full campaign can be completed, lists features that are still missing, and adds extensions such as high resolutions and a map editor. It recreates the game’s behaviour on original content rather than recovering Bullfrog source code.

Cursed Lands reimplements the engine for Evil Islands and Lost in Astral in Godot, reading maps, models, audio, scripts and tables from the player's own game copy. Its native rendering, combat, AI, scripting and interface systems follow the original game's rules, with releases for desktop, Android and browsers.

Rewrites Minecraft: Java Edition 26.3 as a native Rust client, dedicated server and launcher that prepare their resources from the user’s own copy of the game. Contributors are told to read the vanilla code first, and tools/rea_vanilla.py runs a pinned REA release with a headless JADX engine over the shipped client and server jars to inspect classes, methods and callers. Differential harnesses run Java oracles against the real game and Rust probes against Horizon; README reports all 281 passing, which covers only what they compare.

Reimplements the MAGES. visual-novel engine, used by the Science Adventure and Memories Off series, in C++ with OpenGL, running supported titles from the user’s original data files through per-game Lua profiles in one binary. README says all endings can be reached in at least one game, Memories Off 6 T-Wave, but no game is fully complete. The project’s tracking issue lists partial support for titles including Chaos;Head Love Chu Chu, Chaos;Child Love Chu Chu, Steins;Gate and Robotics;Notes Elite.

Implements a standalone runtime for Call of Duty: Modern Warfare 2 (2009) in Rust on Bevy and wgpu, loading maps, models, textures and weapons from the user’s installed game through native FastFile readers and translating its Direct3D 9 shaders to WGSL. Bots, demo recording and replay, and multiplayer over custom UDP with a QUIC master are implemented, while README warns that gameplay remains incomplete, with missing behavior, bugs and desyncs. README states that the whole project is written by an LLM; NOTICE names the community projects consulted and says the original binaries were read with Ghidra.

Reimplements Jazz Jackrabbit 2 (1998) as a native C++ game on an extensively modified nCine engine, converting the user’s original game files into its own cache on first start. It runs on desktop, mobile, web and many homebrew console targets, with multiplayer, an enhanced Reforged mode and partial JJ2+ and MLLE support. A two-sided trajectory probe checks its non-Reforged movement against the original game, and the project reports 376 of 406 scenarios within 25 px/s.

Re-implements Mario Kart Wii’s physics engine in C++ as a command-line simulator, continuing stblr/Hanachan’s goal of perfectly accurate time-trial ghost replay. Each test case replays a recorded ghost through the engine and compares kart position, rotation, velocities, speed and checkpoint state frame by frame with a trace captured from the original game. It is a behavioural reimplementation of the physics only, not a matching decompilation, and has no graphical frontend.

Reimplements the engine of Little Big Adventure 2, and now also Little Big Adventure 1, in TypeScript, Three.js and React so that it runs in a browser on resources imported from the user’s copy of the game. README calls it a full re-engineering rather than a disassembly-based approach: every island and building can be explored and most graphics and part of the gameplay work, but the game cannot yet be completed. It adds an editor with an actor-script debugger, VR support and fan-made 3D replacement models for the isometric scenes.

Re-implements a large part of the RenderWare Graphics middleware API as a portable C++ library that reads and writes its DFF model and TXD texture files for PS2, D3D8, D3D9 and Xbox and is meant to convert them between platforms. Direct3D 9 and OpenGL backends render the scenes, while PS2 rendering works only as a test. README names rendering GTA as its use; BSP world files are not supported.

Reimplements a Total Annihilation-compatible strategy-game engine in Go, with public file-format research and separate gameplay profiles. It distinguishes intended retail 3.1 behavior from community-patch research and deliberate modern changes, and separates synthetic checks from tests requiring original game data.

Reimplements Remedy Entertainment’s Alan Wake engine, later known as Northlight, in C++ and OpenGL, aiming to run Alan Wake and Alan Wake’s American Nightmare portably from the user’s game data, with Quantum Break and possibly Control as later goals. README documents only a free camera for moving through loaded game data, and the American Nightmare script table implements 16 of its 278 native functions. The repository also includes command-line tools for the games’ archive, texture, Havok and sound formats.

Provides a C# engine for early Westwood real-time strategy games, with mods that reimagine Command & Conquer: Red Alert, Tiberian Dawn and Dune 2000. It loads the original games’ content through its own file-system, MiniYAML rules and Lua mission layers rather than running or recovering Westwood code. Gameplay and interface deliberately follow OpenRA’s own design, so it is not a faithful recreation of the original executables.

Re-implements RollerCoaster Tycoon 2, originally written in x86 assembly, as a C++ engine that runs on the original game’s data. It loads RCT2 saves and scenarios, and RCT1 scenarios when those files are present, while saving to its own documented park format. Modern-platform support, interface and AI changes, higher limits and multiplayer are deliberate extensions, not reproductions of the original.

Reimplements the Rise of Nations: Extended Edition engine as a native macOS app with a Metal renderer, a deterministic simulation, a computer opponent and a compatible BigHugeScript compiler and virtual machine, loading art, maps, rules and scripts from the user’s own Windows installation. Subsystem specifications written from Ghidra study of the symbol-bearing executable, together with JavaScript reference tools, guided a C++17 implementation built with heavy Claude Code assistance. The alpha plays tutorials and scenarios, and its bit-exactness checks remain project-reported.

Re-implements Rockstar Games’ Grand Theft Auto III (2001) as a cross-platform C++ engine that runs on the data of a legitimate PC copy. It has its own loaders for the game’s RenderWare models, textures and archives, a script machine for the original mission scripts, and an optional Qt data viewer. Playability is partial: the project’s mission tracker marks six early Portland story missions as completable.

Reimplements SimCity 4 as a Godot project in GDScript that reads DBPF archives, region folders and city saves from the user’s own SimCity 4 installation. The code draws a region view with city thumbnails and interface elements built from the game’s UI definitions, opens a saved city’s terrain and water in 3D, and includes a DAT explorer for previewing archive subfiles. It is an early, inactive engine case without simulation gameplay, not a playable replacement.

Reimplements MicroProse’s UFO: Enemy Unknown (X-COM: UFO Defense) and X-COM: Terror from the Deep as a C++/SDL engine that runs on the user’s original game resources. Game data such as items, craft, research and missions is expressed in YAML rulesets, which also carry its standard mods and a wider modding ecosystem. It is a clone that reuses original content, not recovered MicroProse code.

Reimplements P.T.’s game logic in C++ on a new Vulkan engine that reads levels, models, textures, sounds, scripts and cutscenes from the user’s own PS4 copy at run time. The author documents reverse-engineered file formats and used the shadPS4 emulator as a behavior and frame reference. Fidelity to the original is author-reported, and the use of AI coding tools is disclosed.

Reimplements Resident Evil 2’s PS1 game rules in a native Nintendo DS engine, with converters that turn data from the user’s own disc into DS formats. A helper wraps the PS1 executable as an ELF for REA’s Ghidra lane, analysis notes name the PS1 functions and tables each part follows, and the Reddit post linking it credits REA and Claude Code. Leon’s disc 1 is reported playable, while Claire’s disc, most enemy types and some menus remain unfinished.

Reimplements the Grand Theft Auto: San Andreas engine in Unity (C#), loading the archives, RenderWare models and textures, collision, animations, audio, text and item definitions from the user’s own PC installation. README says it will not be a complete reimplementation; it focuses on gameplay features, multiplayer and a framework for extending and modding the game through C# plugins. Development has stalled: the newest commit on any branch dates from 2022-09-30.

sh23ds rebuilds Silent Hill 2: Director's Cut as a native C engine for Nintendo 3DS using the player's PC game data. Game logic, camera, lighting and events were reconstructed from the PC executable; the research notes report analysis with Ghidra and REA. The author reports a complete playthrough in Azahar, while real-console testing and some PC behaviors remain unfinished.

Reimplements Skate 3’s skating, tricks, grinds and offboard movement in a new Rust and Bevy engine that runs on assets converted from the user’s own Xbox 360 copy, adding difficulty settings and a .skate custom-map format. Physics notes cite functions and constants read from the original executable in IDA, and audio research reads traces from a research-hooks branch of a separate Skate 3 static recompilation. README says gameplay parity is still a work in progress, credits dumbad’s years of format research and states that AI coding tools were used to write the rewrite.

touhou-engine reimplements Touhou danmaku gameplay in Python, with TH07: Perfect Cherry Blossom as its reference game. The author says its engine logic was ported frame by frame against a decompilation, while the new architecture supplies an event stream, replay handling, headless stepping, and a pygame renderer. It reads original game archives supplied by the user.

Reimplements BioWare’s Aurora engine and its later derivatives as a portable C++ engine that runs on the user’s installed game data, targeting nine games from Neverwinter Nights to Dragon Age II. Resource management, many Aurora file formats, graphics and sound are in place, and every target shows partial in-game areas in a free-flying spectator mode. README states that normal gameplay is not implemented yet, so this is an early-stage engine case, not a playable replacement.

Rebuilds Zelda II: The Adventure of Link (NES) in Rust for desktop, browser and Android by replacing the game’s 6502 routines one at a time. A built-in interpreter still runs the user’s ROM and hands ported routines to Rust, while a verifier compares RAM, sprites, palette and frames with a reference emulator. It is a behavioral, clean-room-style reconstruction guided by a community disassembly, not a decompilation or a finished standalone engine.

Other methods and analyses

23 cases

Rehosting runtimes, analyses, experiments and cases whose evidence does not establish one of the methods above.

bf-private-server recreates a self-hosted server for Brave Frontier client version 2.19.6. Its C++23 service answers the game's HTTP requests, stores saves in SQLite and works with CDN workers and a patcher for the user's Android client; request tables and boot-flow notes document the protocol investigation. The server builds on an earlier emulator fork.

Runs the Nintendo Switch release’s own aarch64 program natively on iPhone, iPad and Apple silicon Macs, rewriting only instructions that depend on the Horizon kernel and supplying its system services and the NVN graphics API on Metal. Shaders are translated offline from the user’s files, and the project adds its own touch interface and endgame features. It is a rehosting compatibility layer, not a decompilation or recompiled source.

A dated research report on the Sunrise/Dawn reconstruction of the archived Destiny 2 build 86657 client, which emulates platform sign-on and the examined Bungie service contracts locally and adds reconstructed mission host policy. It records transport, decoding, object creation, presentation and gameplay results separately, and keeps superseded conclusions with their cited sources. It documents the case rather than shipping the runtime implementation or a recovered Bungie backend; playthroughs and native results remain project-reported.

Reimplements the neural-rendering network of NVIDIA’s DLSS 5 library as Vulkan compute shaders for AMD RX 9000 (RDNA4) cards and supplies it to games through an NGX-compatible core and ReShade or Vulkan-layer routes. The weights are not distributed: installers extract them, hash-checked, from the user’s own nvngx_dlssnr.dll 310.9.16 or 310.8.0. The project compares its output with NVIDIA’s DLL on an RTX 5090 and reports close, not bit-identical, pictures.

An essay on REA’s site by N0zoM1z0 (13 October 2026) uses dated Touhou reconstruction commits to ask whether exact function matching needs a larger general model, a compiler-specialist model or better retrieval. It walks through TH09, TH095, TH04 and TH08 cases where later GPT-6-series sessions closed stubborn matches, and the TH08 audit that found accepted functions with wrong floating constants. Specialist and reinforcement-learning comparisons are proposed as future experiments; no trained specialist was evaluated.

FH2MP restores Forza Horizon 2 multiplayer with a replacement server based on protocol behavior recovered from the Xbox One game client. An in-game shim redirects sockets and web-service calls, while Python and Go servers handle lobbies, worlds and online features; a launcher manages setup and updates.

Custom firmware for the Mario and Zelda Game & Watch consoles that patches new C code into the user's own stock firmware backups, so the original firmware runs alongside the retro-go emulator. A Python patcher hooks stock function calls, relocates and LZMA-compresses stock code and data to free flash, and can merge both models' firmware into one image. Committed symbol maps, a cross-reference mapper and an analysis-ELF builder support the reverse engineering, and a journal records the author's first firmware-patching work.

GTA Mode is a native plugin that adds direct control of spawned citizens and cars to SimCity 3000 Unlimited. It uses findings from Ghidra analysis of the game's binaries, GZCOM plugin loading, in-memory city structures and sprite archives. The C plugin runs in the original game, reads city data from its memory and decodes art from the user's installation; MODLOG.md records addresses, formats and dead ends.

inFAMOUS Second Son native PC port

Independent reconstruction project

Runs the PS4 inFAMOUS Second Son’s own x86-64 code natively on Windows and Linux: a runtime reimplements the PS4 system libraries the game uses, and a shadPS4-derived core translates its GPU commands and shaders to Vulkan. The project reports a playable, in-development port that reaches gameplay and the first chapters, with unstable performance and remaining graphics glitches. It is a compatibility-runtime port rather than a decompilation, and its results remain project-reported.

This Left 4 Dead 2 study reconstructs the AI Director's pacing, intensity, encounter placement and music rules from an identified x86 server.dll and sanitized runtime traces. It publishes disassembly-derived findings, analysis scripts, evidence files and implementation specifications; a reference game library is in a separate repository.

MTG Arena Collection Export reconstructs the Frontdoor request needed to export owned cards from Magic: The Gathering Arena. The Python client uses an account refresh token, opens a TLS Frontdoor socket, authenticates with the 2026 version 4 frame and protobuf command envelope, and requests Card_GetAllCards. A separate protocol document records the recovered wire format.

OpenPigeon is a TypeScript codec for reading GamePigeon iMessage game state and encoding caller-supplied moves for eleven turn-based games. Its protocol documentation describes balloon identity, encrypted move URLs, the length-seeded cipher and the state envelope; captured-message vectors support codec tests.

Rebuilds the NTSC PlayStation 2 release of Sly Cooper and the Thievius Raccoonus as a native C++ game for Windows and Linux, running on data extracted from the player's own disc image. The README reports the full game as playable while work continues on accuracy and remaining differences from the original. It does not describe its reverse-engineering method or relate the port to the separate sly1 decompilation.

tMock-Server is an unfinished C++ reimplementation of the Terraria server's initial network flow. It uses socket code and packet classes to accept connections, check protocol versions, request passwords, and assign player slots; the README records packet IDs, fields, directions, and structures informed by traffic analysis.

An essay published on REA’s site, with pinned evidence notes, describes one author’s agent-driven reconstructions of TH08, TH095 and TH04. It dates milestones from public commits and progress ledgers, separates exact-comparison and playable-build oracles, and documents a TH08 check that missed wrong floating-literal data. Project results remain author-reported, and REA is credited with supplying analysis evidence, not the reconstructions themselves.

Runs the PS4 Uncharted: The Nathan Drake Collection’s own x86-64 executables natively on Windows: a runtime supplies the PS4 system libraries and a shadPS4-derived Vulkan renderer executes the GPU work. The port adds a per-game launcher, resolution patches and modern upscaling, and its status table reports all three games playable with listed open issues. It is a compatibility-runtime port rather than a decompilation, and its results remain project-reported.

Apps

62 cases

All sections

67 cases tagged App · Show all 67 →

The authors describe DeckCraft as a clean-room Rust implementation of PowerPoint-style presentation workflows. Its slide model, rendering and command layers support desktop/browser editing and PPTX interchange; reviewed source tests check constructed decks and selected preserved package parts.

The maintainer reports using REA and Ghidra to study selected QuickBooks Desktop for Mac behavior, then independently implements a local accounting application. Its Python/SQLite engine persists double-entry journals, invoices, inventory and payments, while public synthetic fixtures test bounded accounting and rollback behavior.

Reconstructs the Johnny Castaway screensaver engine in Rust, with author-disclosed REA and Claude Code use. It reads original files to run recovered animation scripts and calendar-based story state on modern desktops; documented deviations and limited tests stop short of complete behavioral equivalence.

The author reports using REA to map Screen Studio’s Electron package, reading six auto-zoom and cursor rules from its obfuscated code with Claude Code’s help, and having Claude Code write an independent recorder and renderer from those rules. The article describes the commands, evidence, a cursor-alignment check and the clone’s gaps; neither the clone nor the decoded code is published.

Reimplements the glyph-wind background of the Claude desktop app’s Claude Code New session view as an offline WebGL2 page with a 38-slider control panel. The author reports a static REA investigation of the desktop shell and its remote web bundle, followed by a newly written renderer that reuses recovered timing and layout values. It shares the original’s visual vocabulary and interaction model but is not a pixel-identical extraction.

A Chinese article breaks three versions of a Python CSV exporter that reproduces the Notes teaching app shipped with REA. It shows that a simple export-and-read-back test passes all three, while byte comparisons against the official JavaScript formatter on 215 fixed inputs catch each one. The author also connects REA 6.5.0 over MCP, reruns its JavaScript analysis and checks that an edited evidence record is rejected on import; this is a study of acceptance checks, not a new reconstruction.

A Windows Sony-headphone client adopts existing libmdr/libmdr-bt engine DLLs after a documented REA-assisted binary inventory and source review. The desktop interface is modeled on Sound Connect, while protocol implementation and device support are inherited rather than newly reconstructed.

Implements an unofficial native Linux host for NetEase UU Remote, using protocol behavior the maintainer says was recovered from official-client traffic and shipped programs. The Rust implementation connects selected desktop, input and auxiliary-tool channels to Linux services; an additional Linux viewer remains experimental. The author attributes development to Claude and Codex, without establishing REA use.

Implements selected TCL Home air-conditioner controls and electricity reporting in a native macOS menu-bar app. It adapts earlier community protocol work and documents an Android-module investigation to recover a separate statistics request. Reported validation checks cloud state, not independent physical operation or complete device equivalence.

Stands in for the Claude in Chrome extension side of Claude Code’s local browser bridge and runs the requested actions in Browserbase cloud browsers. The author’s thread describes the reverse-engineered framing, a 4-byte little-endian length before each JSON tool call, and the plugin maps 17 named tools onto Stagehand/CDP operations. It is an archived interoperability shim with several placeholder tools, not recovered Anthropic code or a verified equivalent of the extension.

Implements an Android replacement for the Meta AI companion app that speaks the Ray-Ban Meta glasses’ own Bluetooth and Wi-Fi Direct protocol, imports media, exposes settings and answers “Hey Meta” with a model the user chooses. The project wiki documents the link layers, encryption, services and Meta-side ownership steps, and lists 153 open questions. Testing is on real glasses rather than test suites, so behavior beyond the stated model and firmware remains unverified.

Extends Wine 11.17 so that signed MSIX Store apps, with Shapr3D as the main target, install and run on Linux without their source or symbols. About 49,000 changed lines add a DirectComposition implementation, composition swap chains and an app-model host, while Microsoft’s own XAML and app-model DLLs, harvested from a Windows 11 image on the user’s machine, run unmodified. The author says Claude did most of the reverse engineering and code; app support is uneven and checked by a project regression suite.

Documents the proprietary .rkd telemetry format written by Race-Keeper “Instant Video” recorders, whose bundled player runs only on Windows, and implements matching Python and Go parsers that export GPS and IMU channels as Telemetry Overlay CSV and GPX. The author credits Claude Code with the hex-dump analysis and hypothesis testing, anchored by known car IDs, circuit location and speeds. Field meanings rest on physical cross-checks from the author’s own recordings, and several record types remain partly unknown.

A native macOS app that reaches the Elgato 4K X capture card’s 10-bit P010 video mode, which the project says Apple’s built-in webcam driver does not expose to apps. A root helper detaches that driver and runs the card’s USB Video Class streaming directly through libusb, feeding a Metal HDR viewer, an HDR10 recorder and an editor. Latency figures and device coverage remain author-reported.

A native macOS menu-bar app that pairs with an LG webOS TV over its local encrypted WebSocket interface to launch apps, switch inputs, adjust volume and picture settings, send pointer input and cast selected media. The project credits the public Connect SDK for webOS protocol behavior and reuses PyWebOSTV’s registration manifest. Testing covers one TV on webOS 5.0.

Reimplements control of Samsung Galaxy Buds over their proprietary RFCOMM serial protocol in a cross-platform desktop and Android manager. The author reports recovering the message format by analyzing the earbuds’ binary stream and disassembling Samsung’s official Android apps, and publishes partial packet notes for the 2019 Buds and the Buds+. Beyond the official app’s settings, it exposes battery statistics, diagnostics, factory self-tests, hidden debug information and firmware flashing for supported models.

Replaces ScanSnap Home for a Fujitsu/PFU ScanSnap iX500 on macOS with a SwiftUI app and Python service that scan over Wi-Fi through the community-reverse-engineered VENS protocol, or over USB through SANE, and produce searchable PDFs. It vendors bramheerink’s GPL-2.0 driver, extends it for macOS, and documents further handshake and hardware-status fields, including the scan-button bit. Results are author-reported; the repository publishes no tests or captures.

Implements a Garmin watch companion as a native macOS menu-bar app that pairs over Bluetooth, receives live health notifications and original FIT files, and can upload them to Garmin Connect. Source comments attribute its GFDI framing, handshake, file-transfer and status fields to analysis of a supplied Garmin Android package, cross-checked against community implementations such as Gadgetbridge. Device verification covers one watch model, and the opt-in MCP and HTTP interfaces expose only locally cached data.

Reimplements the MASQUE mode of Cloudflare’s WARP client in Go, tunnelling IP traffic over QUIC/HTTP/3 with Connect-IP (RFC 9484) and exposing it as a native TUN device, SOCKS5 or HTTP proxies, TCP-only L4 proxies or port forwarding. RESEARCH.md describes how the author worked out device enrollment, TLS client authentication and Cloudflare’s non-standard cf-connect-ip variant by analyzing the official Android client with Frida, mitmproxy, JADX, IDA Free and Wireshark. It registers with and connects to Cloudflare’s service outside the official client.

Reimplements Winamp 2's main, equalizer and playlist windows in HTML5 and JavaScript, with Web Audio playback, volume, balance and equalizer, and renders original classic .wsz skins, which its documentation says match Winamp 2.9 pixel for pixel; Milkdrop presets run through the Butterchurn WebGL port. It ships as the webamp npm module for embedding in web pages, and the same monorepo runs webamp.org and the skins.webamp.org skin museum. Its webamp-modern prototype targets Winamp 3/5 modern skins with an interpreter for MAKI skin scripts, whose undocumented bytecode format the author reverse engineered and documents in the repository.

Replaces the WHOOP companion app with offline macOS, Android and iOS clients that pair with WHOOP 4.0 and 5.0/MG straps over Bluetooth, decode their vendor GATT frames, offload the strap’s history into local SQLite and compute recovery, strain, HRV and sleep on the device. A versioned protocol reference documents framing, checksums, commands and sensor records per strap family, building on the community my-whoop and goose projects. WHOOP 4.0 is the supported path; deeper WHOOP 5.0/MG metrics and Oura ring support remain experimental.

Replaces NIIMBOT's own label app with a browser client that designs labels and prints them over Web Bluetooth or Web Serial, with Android (Capacitor) and Windows (Tauri) builds of the same interface. Printer communication comes from the same author's NiimBlueLib, which the README calls the most complete implementation of the NIIMBOT protocol; the protocol is documented on the NIIMBOT Community Wiki, and owners of models that do not print are asked for a packet capture of a print made with the official app. The README says the client runs entirely in the browser and keeps label data there.

Reimplements the Bluetooth Low Energy protocol of the Oura Ring Gen 3/4/5 in Rust crates and an oura command-line client that pairs with, authenticates to and syncs a ring directly, with no Oura account or cloud service. The author reports recovering the GATT layout, packet framing and AES app-auth flow from the decompiled Android app, and porting history-event decoders and several on-device metrics, such as HRV, sleep debt and nightly temperature baselines, from Ghidra decompilations of the app's native libraries. Event bodies are stored raw in SQLite so they can be re-decoded as decoders improve.

Recreates part of Sony’s mobile-only Headphones app as a Windows, Linux and macOS desktop client that changes noise-cancelling, ambient-sound and virtual-sound settings over a Bluetooth RFCOMM connection to a paired headset. The author reports reverse engineering the phone app to define its control protocol, and the code rebuilds its message framing, with start and end markers, byte escaping, sequence numbers, a sum checksum and acknowledgements, together with the two set-parameter commands the client sends. Full support is reported for few models, mainly the WH-1000XM3, and the project is archived.

Reimplements the cloud control path of the C by GE (now Cync) smart-bulb app as a Go library and a small self-hosted web app. The author reports decompiling the Android app with Apktool, finding its JSON HTTP API for login and device lists and a separate raw TCP protocol to the vendor's server, then working out that protocol's type-and-length message framing and packet encodings from proxied traffic and the Smali code. The resulting API lists devices, reads their status and sets power, brightness, color tone and RGB color.

spark-mail-linux rehosts the Windows Spark Mail desktop app on Linux with Wine, two compatibility DLL shims and launcher scripts. The project documents application startup, browser authentication, notifications, clipboard and file-opening behavior, then patches specific DLL imports and bridges those functions to the Linux desktop.

The RTO eChalan report investigates an Android APK impersonating an Indian government eChallan service through manifest review, JADX decompilation and sandbox analysis. The author reports identifying a BankBot variant, a REQUEST_INSTALL_PACKAGES permission, a BIND_VPN_SERVICE entry and extensive obfuscation that limited decompilation.

SteelSeries Overlay Hook documents IDA analysis of SteelSeriesGameOverlay.dll’s window, object layout and Direct3D 11 swapchain, then uses recovered offsets in a C++ DLL hook. Its injector and hook render Dear ImGui content through the existing GameOverlay window by intercepting Present and ResizeBuffers.

Siriously investigates how macOS 27 changed access to Writing Tools and restores its popover through a Services client. The author used Objective-C runtime introspection and behavioral tracing to identify private WritingToolsUI classes, then passes selected text to the popover and writes accepted results back through Accessibility APIs. The findings concern one macOS build.

tuya-mobile reconstructs Tuya mobile-app request signing, encrypted API calls and MQTT signaling credential derivation in Python. It replaces the app's native libthing_security.so signing step with HMAC-SHA256, SHA256 and MD5 calculations and includes versioned Smart Life and Tuya Smart profiles.

MSP CSV Export Format reconstructs the undocumented CSV export of the My Stocks Portfolio & Market app. The author compared eleven iOS exports, app displays and public translation strings to describe columns, blocks and transaction replay. A dependency-free Python parser and synthetic export exercise the documented rules and flag malformed input.

Benro Polaris Firmware Patcher investigates the Polaris camera controller and repacks a user-supplied firmware image with a newer libgphoto2 stack and targeted pgphoto changes. Its documentation maps Benro Connect app behavior and the TCP messages used to control the device. The author reports end-to-end testing with a Canon EOS R5 Mark II.

This malware-analysis report investigates a trojanized FL Studio installer that bundles an Electron/NSIS wrapper and a Go information stealer. The author traces the wrapper statically and studies the payload in an isolated Windows environment with process, registry and network observations, recovering its reported command-and-control mechanism.

Native binaries

7 cases

All sections

36 cases tagged Binary · Show all 36 →

An unofficial field study that reads REA's source and then drives the running server through 1,012 recorded calls across 27 artifact classes, measuring its content-addressed Evidence records, revision-chained unknown ledger, typed refusals, cold starts and response limits. The author maps those mechanisms onto vulnerability-research agents as an argument for not overclaiming. It evaluates REA's tool surface; it is not a reconstruction or a vulnerability finding.

Fedele Mantuano reports using Codex with REA in an offline Docker lab to statically analyze a public Windows malware sample without executing it. The article separates behavior supported by the extracted JavaScript bundle from claims that would depend on remote components that were never obtained, and reclassifies a suspected infostealer as a loader. It is a defensive analysis case built on an author-reviewed agent report, not a reconstruction or a dynamic detonation.

A malware investigation examines njRAT and a UPX-packed Casdet executable with PEStudio static triage and ANY.RUN sandbox telemetry, alongside a malicious PDF and benign comparison files. The author reports process, registry and network behavior, extracted indicators and MITRE ATT&CK mappings in a report and screenshots.

Firmware and hardware

19 cases

All sections

23 cases tagged Firmware · Show all 23 →

An owner documents identifying an RK3229 TV box, investigating its stock Android ROM and repurposing it with a userspace gamepad driver and Armbian. REA assisted ADB inventory and Android-provider routing; APK analysis and device changes are reported as a mixed workflow, not firmware reconstruction.

An owner-authorized XM530V200 camera case uses REA/Ghidra to investigate native Sofia command handlers, then adds local control and Home Assistant integration while preserving stock drivers and recording. The source-only extension documents separate static, emulated-protocol and physical-device evidence.

Adds emulation of Real3D’s Pro-1000, the SCSI-attached image generator from which Sega’s Model 3 graphics hardware derives, to the Supermodel arcade emulator. It boots user-supplied Pro-1000 firmware from the SDK disc, emulates the board’s interrupt, JTAG and UART hardware, and exposes the firmware’s built-in monitor on the console. Nothing renders yet, and SCSI host communication is unimplemented.

Reimplements in C the firmware of the Wii U’s DMCU, the M68HC11-compatible display microcontroller in its AMD graphics controller, which in Wii mode reads the Video Interface state and configures display output, deinterlacing, scaling and overscan. The README says the work is based on reverse engineering of the original firmware but is not a byte-for-byte matching decompilation, and calls it a work in progress. The built image replaces the stock firmware in Wii mode when loaded through the evWii plugin.

Emulates the Lexicon 224, 224X and 224XL digital reverbs so that their own firmware runs in a browser page or a JUCE plugin. The repository layers KiCad schematics, gate-level and board-level Verilog models, an 8080-hosted C++ emulator and analog input/output models, and checks faster layers against slower ones using user-supplied ROMs. It is a work-in-progress hardware-and-firmware emulation whose documentation is still pending, not recovered algorithm source.

Reimplements the Boxine cloud services a Toniebox talks to as a self-hosted C server, so the box can fetch audio, settings and over-the-air content locally while the owner controls what reaches the manufacturer. It serves and caches tonie audio, converts other audio into the box’s TAF format, can pass requests through to the original cloud, and adds a web interface, MQTT and Home Assistant integration. Protobuf definitions in the repository describe the box’s freshness-check, RTNL log and TAF header messages.

Replaces the vendor cloud of supported robot vacuums with a local service that runs on the rooted robot beside the vendor firmware and emulates the cloud endpoints that firmware expects, including a miio dummycloud and a counterpart for Midea's MSmart protocol. Its FAQ says each new vendor backend meant reverse engineering data formats, authentication and communication without vendor documentation; Valetudo converts the proprietary map formats into one ValetudoMap format and keeps Kaitai Struct descriptions of Dreame, Roborock and Viomi map files and a Midea protobuf schema as references. It adds a web interface, a REST API with Swagger UI and MQTT/Home Assistant integration, while feature parity with the vendor apps is an explicit non-goal.

Replaces the software on an unlocked second-generation Amazon Echo Dot (2016, codename biscuit) so it works as a local Home Assistant voice satellite over the ESPHome API: EchoMuse's own Go firmware drives the microphones, speaker, LED ring and buttons, and a controller on the LAN handles wake words, devices and a dashboard. Its default emOS mode swaps Amazon's Android userspace for the project's own init and busybox while keeping the Dot's kernel from the owner's boot image. An engineering journal records how codec routes, the mute key and other hardware behavior were worked out by measuring the device and diffing the mixer and DAPM state while stock FireOS plays a sound.

OSIRIS replaces the DSP-board software of Onkyo TX-NR515 and TX-NR717 receivers with its own boot loader, Linux services and DSP code. The project documents the SPI exchange between the main MCU and DSP board, including 1032-byte transfers, frame structure and command meanings recovered from stock firmware and logs.

Virtual MPC Sample rehosts Akai MPC Sample 1.3.0.12 firmware in QEMU using a custom lab kernel and a browser panel for the device controls. The repository documents firmware and device architecture, emulates the panel's UART communication and provides a shell, tracing and mod testing against the user's own firmware files.

OpenJooki replaces the Jooki 2 music speaker's embedded Linux core and provides phone-based control, updates and SD-card recovery. Its technical notes map the device's Ingenic Linux and ESP32 split, storage partitions, Mender update slots and recovery behavior, while the repository contains the replacement Lua services and installer tooling.

sony-bravia-linux investigates the Linux-based, pre-Android Sony BRAVIA platform and reconstructs selected media and portal behavior for owner-run services. Its documentation records observations from 2011–2012 AZ1, AZ2 and AZ3 sets, including remote input, browser media handling and 3D signalling. The repository also contains tools for H.264 3D SEI and related media workflows.

open-picpak documents the PicPak 4.2-inch e-ink frame's stock firmware behavior, BLE GATT protocol, and image conversion pipeline. The author reports deriving byte-level findings from the stock ESP-IDF image and a device client, then using those findings in custom ESP-IDF firmware, host tools, and a self-hosted backend.

Hisense AEH-W41H1 local control replaces the air conditioner's cloud-connected Wi-Fi module with ESPHome firmware for an ESP32 board or the stock RTL8710C module. The implementation speaks the A/C's RS-485 bus and exposes climate controls and diagnostics to Home Assistant. Protocol notes describe the frame envelope, checksum, bus roles, and command/status behavior derived from device observation.

nRF52 e-paper tag reconstructs control of an undocumented electronic shelf label with an nRF52832 board and SSD1675A-class panel. The repository records the pinout, 9-bit SPI connection, waveform-table layout and refresh behavior, and provides replacement Zephyr firmware plus a portable C99 display driver.

Protocols

91 cases

All sections

134 cases tagged Protocol · Show all 134 →

Runs a local HTTPS and MQTT stack in place of Roborock’s cloud, so supported vacuums keep live maps and controls on an isolated network without rooting or hardware changes. The maintainer’s technical write-up recounts earlier app and traffic analysis and a later investigation in which Claude Code and Codex worked against an emulated firmware environment. Compatibility is reported per model by the project and its users.

Reimplements the client side of Apple’s private Apple Push Notification service (APNs) protocol in platform-independent Python: it activates as an Apple device, connects to the APNs courier, mints app-scoped tokens and receives push notifications. The project began as the author’s proof of concept for iMessage reverse engineering, but the current rewrite has removed IDS and iMessage support for now. It uses Apple’s services outside Apple’s official clients.

Recovers enough of the infrared protocol used by PixMob event wristbands to light them at home, starting from Flipper Zero recordings made at concerts and games and replaying them to bracelets. Pulse-timing analysis found 38 kHz signals with bit intervals of roughly 700 µs, and targeted brute forcing from an ESP32 discovered hundreds of colour, fade, random and motion-mode commands, now sent through Arduino, Python and web tools. The README calls the result far from exhaustive and points to a later repository that decoded most of the full IR protocol through MCU dumping.

Python command-line reimplementation of Apple's AirDrop protocol from SEEMOO Lab's reverse-engineering research. It finds receivers via _airdrop._tcp DNS-SD, sends binary-plist /Discover and /Ask requests over HTTPS and uploads gzip-compressed CPIO archives to exchange files with iOS and macOS. It is not affiliated with Apple.

Documents the Bluetooth Low Energy interface of Hasbro's Furby Connect toy, worked out, according to its notes, from the companion app's native library, sniffed BLE traffic and trial and error. It maps the GATT services and the command and response bytes of the toy's Nordic radio and GeneralPlus controller, covering action sequences, antenna colour, mood values, sensor reports and a hidden debug screen. fluffd, a Node.js daemon built on the noble BLE library, exposes these commands through an HTTP API and a browser control page.

Asyncio Python library and command-line tools that act as an independent client for Apple TV and AirPlay devices by reimplementing the DMAP/DACP, Media Remote Protocol, Companion Link, AirPlay and RAOP protocols, which its protocol documentation describes as reverse engineered. That page records the recovered binary formats, Zeroconf properties, the OPACK encoding, pair-setup and pair-verify exchanges and Companion commands, with some request headers taken from Wireshark captures of the iPhone Remote app, and the bundled atvproxy relays MRP, Companion and AirPlay sessions to print decrypted messages for further analysis. On this basis pyatv provides remote control, metadata with push updates, app and account switching, audio-output management and AirPlay streaming to Apple TVs, HomePods and third-party receivers.

Reimplements the Samsung Galaxy Buds Pro’s proprietary spatial-audio messages in a small Python script so that a PC can stream the earbuds’ head-tracking data in real time. It connects to the earbuds’ GEARMANAGER (or FACTORY) RFCOMM serial service, frames packets with start and end markers and a CRC16-CCITT checksum, enables the sensor stream with attach and two-second keep-alive messages, and decodes the rotation quaternion from the data events. A contributed script converts the quaternion to Euler angles and forwards it over local UDP to a Unity receiver; results are shown only as author-provided sample output.

Documents the Bluetooth Low Energy protocol between the Even app and Even Realities G2 smart glasses, worked out from captured traffic: GATT characteristic UUIDs, an 8-byte transport header with sequence, multi-packet and two-byte service-ID fields, a CRC-16/CCITT over the payload, and protobuf payloads with draft .proto definitions. A Python example built on bleak sends the seven-packet session handshake and drives the teleprompter service to show custom text. The README’s status table marks connection, handshake, teleprompter and calendar widget as working, notifications as partial, and Even AI and navigation as still under research.

Reimplements the Wi-Fi remote-control protocol of Fujifilm X-series cameras as a C++ library and an interactive command-line client that joins the camera's access point. Its headers name the control, event and JPEG live-view ports, message types and camera property codes, and source comments keep hex traces of exchanges along with what "the app" sends; the client connects, fires the shutter, records video, adjusts exposure settings and focus point, and streams live view, optionally into a Linux webcam device. README calls the tool very limited and mostly undocumented, so the protocol knowledge lives in code and comments rather than a specification.

Node.js bridge that reads power and cadence from exercise bikes whose own apps or services are gone or closed, and re-broadcasts them as standard Bluetooth LE Cycling Power and Cycling Speed and Cadence sensors and as an ANT+ bike power profile, so that Zwift, TrainerRoad, bike computers and watches can use the bike. The author's development notes describe working out the Flywheel Home Bike's stats packets on its Bluetooth UART service after the vendor shut its home service down; Peloton support reads the bike's data cable through a USB serial adapter, while the Schwinn IC4 and Keiser M clients parse the standard Fitness Machine Service and Keiser's documented broadcasts. Bike and app compatibility is project-reported.

Python library that talks to Garmin watches over their proprietary GFDI V2 Bluetooth LE protocol, with no Garmin Connect, phone or cloud service. It implements the handshake, multi-link routing, COBS framing, CRC16 checks and protobuf service messages, streams typed readings such as heart rate, HRV, SpO2, stress, Body Battery and accelerometer data, and adds a simulator and recorded-session replay for work without hardware. Its acknowledgements credit Gadgetbridge for the protocol logic and schemas, while a published journal shows how the author decoded the accelerometer payload, which Gadgetbridge only logged, from labelled recordings.

Controls Bose headphones from Linux and macOS without the Bose app, account or cloud, through Python, Rust and C++ libraries and command-line tools that implement Bose’s BMAP protocol over Bluetooth RFCOMM. The author documents BMAP’s function blocks, operators, payload layouts and error codes in NOTES.md, reportedly worked out by probing RFCOMM channels, capturing Bluetooth traffic while changing settings in the Bose app and testing each operator, and the libraries cover noise cancellation, EQ, spatial audio, button remapping, profiles and device settings. Support is reported per model by the author and contributors.

Reconstructs the DUML-over-BLE protocol that DJI's Mimo app uses with the Osmo Pocket 3 camera as a Node.js library and CLI for scanning, pairing, gimbal commands and roughly 20 Hz position telemetry without the vendor app. The author reports working from a third party's Wireshark captures and dissector of Mimo traffic, a Go client and trial-and-error debugging; PROTOCOL.md documents the frame layout, CRC parameters, BLE characteristic roles and command IDs. A write-up and bundled patch trace seven bugs that kept the earlier node-osmo library from working with the camera, and the author reports that the patched library completed pairing, Wi-Fi setup and RTMP streaming.

Documents the Bluetooth Low Energy message format that DJI's proprietary MIMO app uses to control DJI Osmo devices, as artifacts produced while building the independent djictl CLI. The author derives the framing — a magic byte, length, protocol version, header CRC8, subsystem and message-id fields, a payload and a message CRC16 — from the author's own Android BLE logs, and ships a Wireshark dissector plus an annotated catalog of message types. Many message types are labelled as guesses or unknown; the author reports reaching working livestreaming on a DJI Osmo Pocket 3 and pausing further analysis.

Replaces the vendor phone app for the MXW01 “cat printer”, a small Bluetooth Low Energy thermal printer, with a Windows command-line client. The author reports starting from the iOS-only Moblin implementation and then reverse-engineering the vendor's phone app further, and the client sends CRC8-checked commands to one GATT service while streaming 384-pixel image lines in 1-bit or 4-bit grayscale. Several command IDs remain marked as unknown, and the author tested only this one printer model.

Reconstructs the A0 serial protocol of R2000-family 915 MHz UHF RFID desktop readers, which ship with only Windows software and an Android app, from the vendor app's native command encoder rather than its misleading Java SDK. A userspace CH340 driver, a Python CLI and GUI, and a small Android app then talk to the reader directly for inventory and tag-memory reads. docs/PROTOCOL.md records the frame layout, checksum, command table, response formats and the different field orders of READ and WRITE.

Documents the closed Bluetooth Low Energy GATT protocol of the Xiaomi Kettle, which the author reconstructed by decompiling the Mi Home Android app and disassembling its native encryption library. The write-up covers the connection and authentication handshake, the layout of status notifications and the writable settings characteristics, with a small Go reimplementation of the cipher helpers. The author built a kettle-to-MQTT bridge for Home Assistant from it but did not publish that code, and gives no guarantee that the notes work for others.

Documents the medium-speed CAN bus that links the 6000CD radio and the dashboard of a restyled (post-2006) Ford Fiesta MK5, worked out by tapping the bus at the radio's QuadLock connector with a Seeed CAN-BUS Shield on an Arduino Uno. The README describes 18 partly or fully decoded message IDs on the 125 kbit/s bus, with byte layouts and scaling formulas: radio text sent to the dashboard LCD over ISO-TP, station names, volume, CD track and steering-column mode and seek buttons, as well as broadcast clock, door, lock, reverse-gear, indicator, light, handbrake, airbag-lamp, pedal, RPM, speed, coolant, key-position, battery and partial VIN data. An incomplete Kayak .kcd definition encodes only the clock and gas-pedal/RPM/speed messages.

Decodes the undocumented Bluetooth Low Energy output of a Uniden R8 radar detector into a receive-only collector for a Raspberry Pi, with live telemetry, alert start/update/end events, SQLite history and optional MQTT and Home Assistant publishing. The author worked the protocol out from the wire on a real detector, building on earlier R8w findings from AegisX86/UnidenR8wlink, and grades every claim in PROTOCOL.md by its evidence: measured on this R8, seen on another model, decompiled from an app but untested, or inference. Unknown fields are carried through raw rather than given invented meanings.

Speaks the undocumented protocol of the Scanmatik SM3, a J2534 vehicle interface that otherwise talks only to its own Windows software, and exposes it to an Android phone as an ELM327 bridge with a diagnostics app on top. The author recovered the framing — a 16-byte header with sequence, CRC-based and sum-based check words, opcode and length — by capturing the device's bundled driver and measuring the replies, and docs/protocol.md separates what was established from what is still open. Reported results come from one Opel Astra J over five sessions with the car present.

Reimplements Apple Wireless Direct Link (AWDL), the proprietary Wi-Fi ad hoc protocol Apple devices use for peer-to-peer links such as AirDrop, as a user-space C daemon for Linux and macOS; the README calls it the result of reverse engineering by the Open Wireless Link project at TU Darmstadt's SEEMOO lab. OWL runs the master election, synchronises availability windows and the channel sequence, parses and crafts AWDL action and data frames, and provides an awdl0 virtual interface with a link-local IPv6 address, so unmodified IPv6 programs such as SEEMOO's OpenDrop AirDrop client can reach Apple devices. The authors describe the recovered protocol in a MobiCom 2018 paper.

QuestPad implements the Quest Touch controllers' private 2.4 GHz radio protocol on nRF52840 firmware so a computer can use them as a USB gamepad. Its protocol reference documents pairing, AES-CCM encrypted controller packets, 2 ms link frames and input data; the firmware exposes generic gamepad, DS4 and XInput modes.

Stadiacast recreates the network service used by the Stadia Controller's Wi-Fi firmware so the controller can connect to a local computer. The receiver answers boot and discovery requests, completes WebRTC and DTLS sessions, decodes input and sends rumble commands. Protocol notes record findings from firmware reading and live controller runs, with protobuf schemas and receiver code in the repository.

LibreMP casts desktop screens to Epson EasyMP projectors using a protocol reconstructed from Windows client packet captures. Its Rust core handles registration and login messages, projector QR decoding, JPEG tile streaming and changed-region updates; a CLI and Tauri interface use the same core. The project documents control on TCP 3620 and video on TCP 3621.

Sound Blaster AE-9 Linux support reconstructs card and Audio Control Module behavior using static analysis of Creative's Windows drivers and hardware observations. The included investigations document CtxHda.sys, CtxHdb.sys, and the ACM's SysEx-framed UART protocol; the driver implements selected playback and controls.

open-rknpu reconstructs a task-program interface for the Rockchip RV1103/RV1106 NPU from board experiments and black-box comparisons. Its Python compiler emits register commands, weight and quantization blocks, and a container for bounded static ONNX convolution graphs; a C runtime submits them through /dev/rknpu. Research files document register and numerical findings.

hardsid4u reconstructs the HardSID 4U USB protocol and implements a libusb Python driver for its SID-chip sockets. The investigation combines vendor-binary analysis, USB captures, and hardware probes to document command framing, initialization, register writes, timing, and flow control; a MIDI instrument uses the driver.

PyEilik implements control of an Eilik desk robot over a recovered USB serial protocol. Its C library and Python wrapper move four servos, read and update the 128×64 display, and play video with synchronized movement. The protocol reference documents 125000-baud framing, command IDs, checksums and acknowledgements.

libfprint-goodixtls reconstructs communication with the Goodix GXFP5187 SPI fingerprint sensor in the Huawei MateBook X Pro as a libfprint TOD driver. It reads a PSK from sensor RAM, establishes the sensor's TLS-PSK channel, decodes captured images, and uses local descriptors for host-side matching. The author reports enrolment and verification through fprintd and GNOME Settings; detailed reverse-engineering notes are kept outside the repository.

RazerStream replaces the retired control software for the Razer Stream Controller with a macOS app, Swift protocol library and CLI. Its documented device protocol runs over a USB serial port, performs a WebSocket upgrade, then exchanges framed commands and input events. The app configures touchscreen tiles, knobs, buttons and LEDs.

PocketPrinter5890 reconstructs the BLE printing protocol of Lidl's Tronic, SILVERCREST, and Parkside model 5890 pocket printers. Its specification documents activation writes, flow-control credits, and raster bands; Swift, Kotlin, and TypeScript libraries implement printing for Apple devices, Android, and browsers.

This parking-sensor investigation reconstructs the signal sent from a kit's controller to its display. Oscilloscope observations and tests with different sensor states identify fields in roughly 48-bit frames for sensor address, connection and proximity. A PlatformIO example for ATmega328P reads and reports the parsed frames.

pyhaseiq reconstructs the local WebSocket protocol of Hase iQ wood stoves used with the flamemonitor app and implements an asynchronous read-only Python client. The specification records base64-encoded request and response frames, serial dialogue and observation status for each finding; the client reads combustion phase, temperature and performance.

LED Controller uses BanlanX BLE commands to control SP611E-family LED strips from a desktop app. Its documentation maps GATT commands and state notifications, and reports probing an audio-feed message used by the controller’s music effects; included tools inspect advertisements, GATT state and Bluetooth captures.

vanmoof-certificates decodes the access certificates used with VanMoof SA5 and Series 6 bikes. It documents an Ed25519 signature followed by a CBOR payload containing bike serials, user identity, access role and expiry, and provides Go code to request, parse and check certificates. The source says the SA5 verification key was recovered from a bike BLE certificate.

Cosmic Byte Firestorm Controller implements a Linux client for the mouse's recovered USB settings protocol. Its Python CLI sends control and interrupt transfers to configure lighting effects, per-DPI indicator colours and sensitivity levels, while PROTOCOL.md records packet structures and command sequences.

FAAC E145 Gate Connect implements local control of an FAAC E145 gate through serial commands reconstructed from EasyBoard software traffic. The documentation lists POLL, OPEN, CLOSE and STOP byte sequences and describes their framing and checksum. The Python gateway adds position monitoring plus web, REST and MQTT interfaces.

TOZO Control provides a Linux GTK4 client for TOZO earbuds using a BLE GATT protocol recovered from the vendor's Android app. It sends commands to characteristic B611, receives notifications on B612, and documents GET and SET packet layouts and parameter IDs. The author reports testing the T10 model for battery, game mode, equalizer and balance controls.

BMS RS485 Service Suite documents an observed ASCII RS485 protocol for battery-management services and implements frame building and decoding in Node-RED. The specification covers framing, length and checksum fields, request and response rules and decoded service IDs; the wider suite connects JK and DALY BLE data to MQTT and dashboards.

K1 Pro OpenDeck Suite includes a Linux OpenDeck driver for the HOTSPOTEK/Mirabox Stream Dock K1 Pro based on its reverse-engineered USB/HID CRT protocol. The driver handles connection and keepalive messages, 64×64 JPEG key displays, RGB ring controls, and three knob inputs. Four accompanying plugins add generic OpenDeck functions.

Dell ControlVault 2 fingerprint on Linux adapts a locally obtained Broadcom driver to the older BCM5880 fingerprint reader through five signature-matched byte patches. The accompanying investigation maps the device’s USB endpoints, command header and driver checks. The author reports working capture, while enrollment and matching remain unreliable or unconfirmed.

epson-l3110-driver investigates the Epson L3110's USB printing exchanges while developing a Linux driver in C. Its notes use captured print-job traffic to identify the IEEE 1284 device ID, EJL session setup and ESC/P-R command framing. USB communication is still in progress, and the driver cannot yet print pages.

MS5 WiFi Microscope reconstructs the MS5 camera's UDP command and video protocol and supplies a Python client that serves its reassembled JPEG stream as MJPEG. The documentation specifies command headers, the OpenVideo port handshake, chunk layout and resolution queries; the author reports 1280×720 streaming at roughly 25–30 fps on MS5 hardware.

Magene L308 interop tools reconstruct the smart taillight's BLE control protocol and light_mode.bin pattern format. A protocol specification records GATT characteristics, command frames and upload sequences; browser, Python and Garmin clients use those findings to control settings and patterns directly.

ak820 implements macOS control of the AJAZZ AK820 Pro keyboard through its vendor HID feature-report protocol. The Python CLI sets the clock, RGB lighting, and sleep timer over USB; accompanying notes describe Windows-driver analysis, packet framing, transaction handshakes, and the unresolved key-remapping commands.

GameTrak Liberation implements a client for the GameTrak controller's reverse-engineered USB HID behavior. It sends the initialization and rolling-key keepalive messages needed for sustained reports, then exposes six-axis data through stdout, OSC, MIDI or WebSockets. Protocol notes, report captures and Processing and p5.js examples accompany the Python tools.

Cooper Hunter AC documents the COM1 UART and infrared control messages of CH-IF140RK and CH-IF140RK2 units with a Gree GRZQ3-R V1 board. The author inferred UART status fields by comparing packets while operating the infrared remote. The resulting ESPHome design receives UART status and sends control through an infrared signal path.

aw5d-linux drives the round LCD on an iBUYPOWER AW5/AW5D cooler from Linux using a 64-byte USB-HID output report. Its research notes document report ID 0x10 and byte positions for CPU usage, clock, temperature and gauge styling. The author reports a working display on one 3402:0407 unit; other device variants remain unconfirmed.

MyJBxHeadsetControl provides Stream Deck controls for the JBL Quantum 950 Wireless headset through its USB dongle's reverse-engineered HID exchange. It receives status packets for battery and sound modes, sends feature reports for settings, and uses the user's QuantumENGINE DLL to calculate EQ coefficients.

zlt reconstructs the LAN JSON API of the MTN ZLT T10D MAX router from its served JavaScript and observed responses. Its Python client handles reqproc requests, login and CSRF behavior, while a CLI and local dashboard expose signal, network mode, SMS and USSD operations. The protocol document identifies firmware-specific fields and porting limits.

claude-rc-api reconstructs the private HTTP interface used to control local Claude Code sessions from claude.ai/code. Its reference derives session endpoints, OAuth authentication, event envelopes, and streaming behavior from the CLI binary; a Python library and CLI use that interface to observe and steer sessions.

MSI Mystic Light on Linux implements lighting control for an MSI motherboard from USB traffic captured while MSI Center ran in a Windows VM. Its Python script sends a 290-byte HID Feature report to controller 0db0:0076, while the documentation maps modes, RGB palette bytes, brightness, direction and the flash-save flag.

j2208-band-tools implements a direct BLE client for J2208-family fitness bands using protocol findings recovered from the FitTrack Health companion app. Its Python tools read stored health history and live sensor values, probe GATT services and collect readings into SQLite. The author checked the documented 16-byte frame protocol against one Hume Band V2.

OpenPeats reconstructs the SoundPEATS earbud control protocol for desktop and Android clients. Its specification describes frames and opcodes derived from analysis of the official Android app and checked against SOUNDPEATS H3 hardware. Go and Kotlin implementations expose ANC, equalizer and multipoint controls, plus battery status.

hongtai-panel implements Linux control of a LovingCool AIO cooler LCD using a USB CDC-ACM serial protocol reconstructed from the vendor's Electron application. Its documentation describes control-frame layout, checksums, JSON replies, and opcodes; the client displays system statistics, media, or screen mirroring.

An ESPHome component recreates L&S Emotion Control remote commands so an ESP32 with a CC2500 radio can control furniture lights and reflect physical remote presses in Home Assistant. Its documented radio configuration uses MSK at 2436.2 MHz, a sync word, and 14-byte payloads carrying the remote ID, command, and value.

RND Companion reconstructs the Cymaforma RND Synth's SysEx control vocabulary and implements a C++ codec and companion plugin for patch seeds. The protocol notes identify framing and seed or status commands from a web app and one hardware capture. The client can use a direct MIDI port or host MIDI routing and stores a curated seed library.

viture-v2 documents and implements the USB HID protocol used by VITURE Gen2 XR glasses. The author matched usbmon captures to SDK frame logs, then wrote a Rust driver with hidraw, usbfs and io_uring transports for queries and IMU streams. Measurements and compatibility claims cover the VITURE Pro 2 XR.

BikeStation is a local Windows client for Echelon Connect exercise bikes built on community research into their proprietary Bluetooth LE protocol. It reads cadence and resistance telemetry, queries the bike's resistance range, writes motorized resistance commands and records rides without the vendor cloud.

↑↓ move↵ open⌘↵ new tab