{ "version": "https://jsonfeed.org/version/1.1", "title": "AwesomeREA.org: newly added entries", "description": "Curated resources, case studies and research papers newly added to Awesome Reverse Engineering Anything.", "home_page_url": "https://awesomerea.org/", "feed_url": "https://awesomerea.org/feed.json", "language": "en", "authors": [ { "name": "Awesome REA contributors", "url": "https://github.com/reacher-z/Awesome-REA" } ], "_awesome_rea": { "rights": "Original editorial content: MIT. Linked projects and papers retain their own rights and licenses.", "atom_feed": "https://awesomerea.org/feed.xml" }, "items": [ { "id": "tag:awesomerea.org,2026:discovery-batch:run-42259510952-1:en", "url": "https://awesomerea.org/discoveries/", "title": "Unreviewed discoveries: 300 repositories from scan run 42259510952", "summary": "shortsspectrumai-del/GameDecomp, JonathanSigmund/luadicrous, Dominik-O22/recore, greyblue9/apk2project, yuv422/qb30decomp, TheMaster1127/HT-RE, RussDev7/CMZ-Stats-SAV-Decompiler, aseroff/pear and 292 more. Automated README scans, unreviewed.", "content_text": "shortsspectrumai-del/GameDecomp, JonathanSigmund/luadicrous, Dominik-O22/recore, greyblue9/apk2project, yuv422/qb30decomp, TheMaster1127/HT-RE, RussDev7/CMZ-Stats-SAV-Decompiler, aseroff/pear and 292 more. Automated README scans, unreviewed.", "date_published": "2026-11-06T17:38:26Z", "date_modified": "2026-11-06T17:38:26Z", "tags": [ "unreviewed-discovery", "Unreviewed automated discovery" ] }, { "id": "tag:awesomerea.org,2026:discovery-batch:run-42250580748-1:en", "url": "https://awesomerea.org/discoveries/", "title": "Unreviewed discoveries: 300 repositories from scan run 42250580748", "summary": "Erik-Castro/DevSecurity, mushiDiam/File-Monitor, meltedinhex/meltedinhex.github.io, wailhassanali-tech/malware-analysis-investigation, MatthewKuKanich/CivSwitch-ControlCenter, Thug-Dracula/rondorecomp, TheBozos/BozoEngine, CoastRedWood/splashdown and 292 more. Automated README scans, unreviewed.", "content_text": "Erik-Castro/DevSecurity, mushiDiam/File-Monitor, meltedinhex/meltedinhex.github.io, wailhassanali-tech/malware-analysis-investigation, MatthewKuKanich/CivSwitch-ControlCenter, Thug-Dracula/rondorecomp, TheBozos/BozoEngine, CoastRedWood/splashdown and 292 more. Automated README scans, unreviewed.", "date_published": "2026-11-06T16:31:51Z", "date_modified": "2026-11-06T16:31:51Z", "tags": [ "unreviewed-discovery", "Unreviewed automated discovery" ] }, { "id": "tag:awesomerea.org,2026:discovery-batch:run-42241100246-1:en", "url": "https://awesomerea.org/discoveries/", "title": "Unreviewed discoveries: 300 repositories from scan run 42241100246", "summary": "haise-dev/martian-notifier-toolkit, 0x1q2s/sp1cyreverse, panming/syntec-plc-ladder, tudorek12345/decomptwdgame1season, Fluxionics/Aquadecomp, onlycareone/Mystia-Guest-Helper, santipaez/midea-mf200-tools, Juliii-p/e88-drone-pc-control and 292 more. Automated README scans, unreviewed.", "content_text": "haise-dev/martian-notifier-toolkit, 0x1q2s/sp1cyreverse, panming/syntec-plc-ladder, tudorek12345/decomptwdgame1season, Fluxionics/Aquadecomp, onlycareone/Mystia-Guest-Helper, santipaez/midea-mf200-tools, Juliii-p/e88-drone-pc-control and 292 more. Automated README scans, unreviewed.", "date_published": "2026-11-06T15:41:48Z", "date_modified": "2026-11-06T15:41:48Z", "tags": [ "unreviewed-discovery", "Unreviewed automated discovery" ] }, { "id": "tag:awesomerea.org,2026:discovery-batch:run-42232277609-1:en", "url": "https://awesomerea.org/discoveries/", "title": "Unreviewed discoveries: 300 repositories from scan run 42232277609", "summary": "SecurityM/IntegrityGap, Trivexqbn/iMonitor-System-Activity-Monitor, 0xInitZer0/MalStat, ATRAPSLLC/autoit-rs, israaelnour/ctf-writeups, abc1230940/SOC336-Windows-OLE-Zero-Click-RCE-Exploitation-Detected-CVE-2025-21298, dhcybsec256/Malware-Analysis-Project, druserx/scrutator and 292 more. Automated README scans, unreviewed.", "content_text": "SecurityM/IntegrityGap, Trivexqbn/iMonitor-System-Activity-Monitor, 0xInitZer0/MalStat, ATRAPSLLC/autoit-rs, israaelnour/ctf-writeups, abc1230940/SOC336-Windows-OLE-Zero-Click-RCE-Exploitation-Detected-CVE-2025-21298, dhcybsec256/Malware-Analysis-Project, druserx/scrutator and 292 more. Automated README scans, unreviewed.", "date_published": "2026-11-06T14:32:13Z", "date_modified": "2026-11-06T14:32:13Z", "tags": [ "unreviewed-discovery", "Unreviewed automated discovery" ] }, { "id": "tag:awesomerea.org,2026:discovery-batch:run-42216804018-1:en", "url": "https://awesomerea.org/discoveries/", "title": "Unreviewed discoveries: 300 repositories from scan run 42216804018", "summary": "Cratis/Prologue, Louiselate441/reverseloom, Rishi-Goyal/led-hue-cycle, Shalom-Karr/q-zheng-android-decompiled, Shalom-Karr/futronic-android-sdk-decompiled, Shalom-Karr/acs-smartcard-android-decompiled, pueblokc/unifi-protect-audio-control, MoriartyPuth-Labs/LYKN-CTF-Writeup and 292 more. Automated README scans, unreviewed.", "content_text": "Cratis/Prologue, Louiselate441/reverseloom, Rishi-Goyal/led-hue-cycle, Shalom-Karr/q-zheng-android-decompiled, Shalom-Karr/futronic-android-sdk-decompiled, Shalom-Karr/acs-smartcard-android-decompiled, pueblokc/unifi-protect-audio-control, MoriartyPuth-Labs/LYKN-CTF-Writeup and 292 more. Automated README scans, unreviewed.", "date_published": "2026-11-06T13:02:54Z", "date_modified": "2026-11-06T13:02:54Z", "tags": [ "unreviewed-discovery", "Unreviewed automated discovery" ] }, { "id": "tag:awesomerea.org,2026:discovery-batch:run-42216232619-1:en", "url": "https://awesomerea.org/discoveries/", "title": "Unreviewed discoveries: 300 repositories from scan run 42216232619", "summary": "jamesfmackenzie/ymf-dos-research, LuizORAS/fft-decomp, RetrolariumLab/sonic2_src, LIN4CRE/DigimonWorld1Web, elephantlover2/tizen-kts-research, NilsBe/Asmonite, sdars/GameGuardian-Open, aleeraser/faba-tools and 292 more. Automated README scans, unreviewed.", "content_text": "jamesfmackenzie/ymf-dos-research, LuizORAS/fft-decomp, RetrolariumLab/sonic2_src, LIN4CRE/DigimonWorld1Web, elephantlover2/tizen-kts-research, NilsBe/Asmonite, sdars/GameGuardian-Open, aleeraser/faba-tools and 292 more. Automated README scans, unreviewed.", "date_published": "2026-11-06T12:39:53Z", "date_modified": "2026-11-06T12:39:53Z", "tags": [ "unreviewed-discovery", "Unreviewed automated discovery" ] }, { "id": "tag:awesomerea.org,2026:discovery-batch:run-42208549742-1:en", "url": "https://awesomerea.org/discoveries/", "title": "Unreviewed discoveries: 300 repositories from scan run 42208549742", "summary": "gage-marshall/lp-engine, RAZORRZR0/gtasa-de-morphe-patches, brilolo5/ProjectClassic22, ekamalbekuulu-ai/ST-Manager, Sliv3er/Silverbud, cnjswangyu/gba-ai-daisenryaku, only9464/TscanPlus-Wails-RE, coldwaterkimkim/bose-usb-bridge and 292 more. Automated README scans, unreviewed.", "content_text": "gage-marshall/lp-engine, RAZORRZR0/gtasa-de-morphe-patches, brilolo5/ProjectClassic22, ekamalbekuulu-ai/ST-Manager, Sliv3er/Silverbud, cnjswangyu/gba-ai-daisenryaku, only9464/TscanPlus-Wails-RE, coldwaterkimkim/bose-usb-bridge and 292 more. Automated README scans, unreviewed.", "date_published": "2026-11-06T11:38:12Z", "date_modified": "2026-11-06T11:38:12Z", "tags": [ "unreviewed-discovery", "Unreviewed automated discovery" ] }, { "id": "tag:awesomerea.org,2026:discovery-batch:run-42201075883-1:en", "url": "https://awesomerea.org/discoveries/", "title": "Unreviewed discoveries: 148 repositories from scan run 42201075883", "summary": "6K6666/unifi-g4-doorbell-modding, nekomancer01/DarkSoulsPS2, diand26/tcomas-lg600-lcd, vs-sr-dev/wskit, izvoranumarius/apkspy, darksemfiltro/clonar-programa, eduardosmulero-tech/eden-trace, Kalmarv/forzatech-formats and 140 more. Automated README scans, unreviewed.", "content_text": "6K6666/unifi-g4-doorbell-modding, nekomancer01/DarkSoulsPS2, diand26/tcomas-lg600-lcd, vs-sr-dev/wskit, izvoranumarius/apkspy, darksemfiltro/clonar-programa, eduardosmulero-tech/eden-trace, Kalmarv/forzatech-formats and 140 more. Automated README scans, unreviewed.", "date_published": "2026-11-06T10:43:34Z", "date_modified": "2026-11-06T10:43:34Z", "tags": [ "unreviewed-discovery", "Unreviewed automated discovery" ] }, { "id": "tag:awesomerea.org,2026:discovery-batch:run-42186805426-1:en", "url": "https://awesomerea.org/discoveries/", "title": "Unreviewed discoveries: 102 repositories from scan run 42186805426", "summary": "ogabrielalonso/website-cloner, haojiezhe12345/PCQQTweaks, geoffrey-diederichs/LA_CTF_2025, EllE961/LA-CTF-McFlagChecker, saruman9/ida_scripts, Mqlvin/keyboard-colour, Texthead1/Custom-Mixed-Variant-Skylander-IDs, Texthead1/Skylanders-Portal-IDs and 94 more. Automated README scans, unreviewed.", "content_text": "ogabrielalonso/website-cloner, haojiezhe12345/PCQQTweaks, geoffrey-diederichs/LA_CTF_2025, EllE961/LA-CTF-McFlagChecker, saruman9/ida_scripts, Mqlvin/keyboard-colour, Texthead1/Custom-Mixed-Variant-Skylander-IDs, Texthead1/Skylanders-Portal-IDs and 94 more. Automated README scans, unreviewed.", "date_published": "2026-11-06T08:44:42Z", "date_modified": "2026-11-06T08:44:42Z", "tags": [ "unreviewed-discovery", "Unreviewed automated discovery" ] }, { "id": "tag:awesomerea.org,2026:discovery-batch:run-42161587295-1:en", "url": "https://awesomerea.org/discoveries/", "title": "Unreviewed discoveries: 61 repositories from scan run 42161587295", "summary": "proteinklumpen/spl-lab-web, 4noha/SainSmartDDS140, Yarfer800/aiowapy, Reverie1145/veladec, f4mrfaux/psychonauts-controller-fix, yymz072-beep/ps2-game-hanhua, error9098x/ps5-native-mac, alxmtzr/brickwork and 53 more. Automated README scans, unreviewed.", "content_text": "proteinklumpen/spl-lab-web, 4noha/SainSmartDDS140, Yarfer800/aiowapy, Reverie1145/veladec, f4mrfaux/psychonauts-controller-fix, yymz072-beep/ps2-game-hanhua, error9098x/ps5-native-mac, alxmtzr/brickwork and 53 more. Automated README scans, unreviewed.", "date_published": "2026-11-06T04:34:51Z", "date_modified": "2026-11-06T04:34:51Z", "tags": [ "unreviewed-discovery", "Unreviewed automated discovery" ] }, { "id": "https://awesomerea.org/papers/paper-llm-malware-deobfuscation/", "url": "https://awesomerea.org/papers/paper-llm-malware-deobfuscation/", "title": "Assessing LLMs in Malicious Code Deobfuscation of Real-world Malware Campaigns", "summary": "The paper evaluates four LLMs on deobfuscating real-world malicious scripts from the Emotet malware campaign and examines their use in reverse engineering.", "content_text": "The paper evaluates four LLMs on deobfuscating real-world malicious scripts from the Emotet malware campaign and examines their use in reverse engineering.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-protocol-format-state-machine/", "url": "https://awesomerea.org/papers/paper-protocol-format-state-machine/", "title": "Extracting Protocol Format as State Machine via Controlled Static Loop Analysis", "summary": "The paper extracts protocol message formats from parser code by analyzing parsing loops as state machines. It evaluates format inference and the use of the extracted machines in protocol fuzzers.", "content_text": "The paper extracts protocol message formats from parser code by analyzing parsing loops as state machines. It evaluates format inference and the use of the extracted machines in protocol fuzzers.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-ref-decompile/", "url": "https://awesomerea.org/papers/paper-ref-decompile/", "title": "ReF Decompile: Relabeling and Function Call Enhanced Decompile", "summary": "ReF Decompile relabels jump targets and uses function calls to recover variable information when converting binary code to source code. It was evaluated on the HumanEval-Decompile Benchmark.", "content_text": "ReF Decompile relabels jump targets and uses function calls to recover variable information when converting binary code to source code. It was evaluated on the HumanEval-Decompile Benchmark.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-attack-synthesis-fsm/", "url": "https://awesomerea.org/papers/paper-attack-synthesis-fsm/", "title": "Automated Attack Synthesis by Extracting Finite State Machines from Protocol Specification Documents", "summary": "Extracts protocol FSMs from RFC prose using technical word representations, zero-shot text mapping, and rules, then uses the extracted FSMs to synthesize attacks.", "content_text": "Extracts protocol FSMs from RFC prose using technical word representations, zero-shot text mapping, and rules, then uses the extracted FSMs to synthesize attacks.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-ktrans/", "url": "https://awesomerea.org/papers/paper-ktrans/", "title": "kTrans: Knowledge-Aware Transformer for Binary Code Embedding", "summary": "kTrans uses a knowledge-aware Transformer to embed binary code. It evaluates the embeddings through outlier detection and visualization, and on binary code similarity, function type recovery, and indirect call recognition.", "content_text": "kTrans uses a knowledge-aware Transformer to embed binary code. It evaluates the embeddings through outlier detection and visualization, and on binary code similarity, function type recovery, and indirect call recognition.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-helios/", "url": "https://awesomerea.org/papers/paper-helios/", "title": "HELIOS: Hierarchical Graph Abstraction for Structure-Aware LLM Decompilation", "summary": "HELIOS gives an LLM a hierarchical summary of binary control flow and function calls alongside decompiler output, with optional compiler feedback. It evaluates compilability and functional correctness.", "content_text": "HELIOS gives an LLM a hierarchical summary of binary control flow and function calls alongside decompiler output, with optional compiler feedback. It evaluates compilability and functional correctness.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-cebin/", "url": "https://awesomerea.org/papers/paper-cebin/", "title": "CEBin: A Cost-Effective Framework for Large-Scale Binary Code Similarity Detection", "summary": "CEBin combines code embeddings to shortlist candidate functions with pairwise comparison to detect similar binary code, including vulnerable functions.", "content_text": "CEBin combines code embeddings to shortlist candidate functions with pairwise comparison to detect similar binary code, including vulnerable functions.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-isadetect/", "url": "https://awesomerea.org/papers/paper-isadetect/", "title": "Towards usable automated detection of CPU architecture and endianness for arbitrary binary files and object code sequences", "summary": "The paper builds open datasets and tools to identify CPU architecture and endianness in binary files and object code. It evaluates classifiers on executable code sections, reporting over 98% accuracy.", "content_text": "The paper builds open datasets and tools to identify CPU architecture and endianness in binary files and object code. It evaluates classifiers on executable code sections, reporting over 98% accuracy.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-rex86/", "url": "https://awesomerea.org/papers/paper-rex86/", "title": "REx86: A Local Large Language Model for Assisting in x86 Assembly Reverse Engineering", "summary": "The paper fine-tunes eight local models from CodeLlama, Qwen2.5-Coder, and CodeGemma on 5,981 x86 assembly examples and evaluates their help with binary reverse engineering.", "content_text": "The paper fine-tunes eight local models from CodeLlama, Qwen2.5-Coder, and CodeGemma on 5,981 x86 assembly examples and evaluates their help with binary reverse engineering.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-dynamic-firmware-analysis-at-scale/", "url": "https://awesomerea.org/papers/paper-dynamic-firmware-analysis-at-scale/", "title": "Automated Dynamic Firmware Analysis at Scale: A Case Study on Embedded Web Interfaces", "summary": "The paper emulates firmware images and uses static and dynamic tools to find vulnerabilities in embedded web interfaces. It evaluated 1,925 images from 54 vendors and found vulnerabilities in 185 images.", "content_text": "The paper emulates firmware images and uses static and dynamic tools to find vulnerabilities in embedded web interfaces. It evaluated 1,925 images from 54 vendors and found vulnerabilities in 185 images.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-ecmo/", "url": "https://awesomerea.org/papers/paper-ecmo/", "title": "ECMO: Peripheral Transplantation to Rehost Embedded Linux Kernels", "summary": "ECMO transplants peripheral drivers into embedded Linux kernels to boot firmware in QEMU. It evaluated 815 firmware images across 20 kernel versions, 37 device models, and 24 vendors; 710 reached a user-space shell.", "content_text": "ECMO transplants peripheral drivers into embedded Linux kernels to boot firmware in QEMU. It evaluated 815 firmware images across 20 kernel versions, 37 device models, and 24 vendors; 710 reached a user-space shell.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-manticore/", "url": "https://awesomerea.org/papers/paper-manticore/", "title": "Manticore: A User-Friendly Symbolic Execution Framework for Binaries and Smart Contracts", "summary": "Manticore uses dynamic symbolic execution to analyze binaries and Ethereum smart contracts. The paper presents its architecture and demonstrates bug finding and code verification used for commercial clients.", "content_text": "Manticore uses dynamic symbolic execution to analyze binaries and Ethereum smart contracts. The paper presents its architecture and demonstrates bug finding and code verification used for commercial clients.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-internalblue/", "url": "https://awesomerea.org/papers/paper-internalblue/", "title": "InternalBlue - Bluetooth Binary Patching and Experimentation Framework", "summary": "The paper reverse engineers Broadcom Bluetooth controllers and presents InternalBlue for patching their firmware. It evaluates the framework through vulnerability tests, bug fixes, and added security features.", "content_text": "The paper reverse engineers Broadcom Bluetooth controllers and presents InternalBlue for patching their firmware. It evaluates the framework through vulnerability tests, bug fixes, and added security features.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-gpt4-binary-re/", "url": "https://awesomerea.org/papers/paper-gpt4-binary-re/", "title": "Exploring the Efficacy of Large Language Models (GPT-4) in Binary Reverse Engineering", "summary": "The paper evaluates GPT-4 for binary reverse engineering through interpretation of human-written and decompiled code, from basic code explanation to malware analysis.", "content_text": "The paper evaluates GPT-4 for binary reverse engineering through interpretation of human-written and decompiled code, from basic code explanation to malware analysis.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-asteria/", "url": "https://awesomerea.org/papers/paper-asteria/", "title": "Asteria: Deep Learning-based AST-Encoding for Cross-platform Binary Code Similarity Detection", "summary": "ASTERIA uses a Tree-LSTM to encode function ASTs and compare binary functions across platforms. It was evaluated on function pairs and used to search IoT firmware for vulnerabilities.", "content_text": "ASTERIA uses a Tree-LSTM to encode function ASTs and compare binary functions across platforms. It was evaluated on function pairs and used to search IoT firmware for vulnerabilities.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-snipuzz/", "url": "https://awesomerea.org/papers/paper-snipuzz/", "title": "Snipuzz: Black-box Fuzzing of IoT Firmware via Message Snippet Inference", "summary": "Snipuzz fuzzes IoT firmware as a client, using device responses to infer message snippets that guide mutations. It was evaluated on 20 real-world IoT devices and compared with four IoT fuzzing approaches.", "content_text": "Snipuzz fuzzes IoT firmware as a client, using device responses to infer message snippets that guide mutations. It was evaluated on 20 real-world IoT devices and compared with four IoT fuzzing approaches.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-asteria-pro/", "url": "https://awesomerea.org/papers/paper-asteria-pro/", "title": "Asteria-Pro: Enhancing Deep-Learning Based Binary Code Similarity Detection by Incorporating Domain Knowledge", "summary": "Asteria-Pro adds domain-knowledge pre-filtration and re-ranking to Tree-LSTM-based binary code similarity detection. It evaluates firmware vulnerability search across diverse IoT hardware architectures.", "content_text": "Asteria-Pro adds domain-knowledge pre-filtration and re-ranking to Tree-LSTM-based binary code similarity detection. It evaluates firmware vulnerability search across diverse IoT hardware architectures.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-foc/", "url": "https://awesomerea.org/papers/paper-foc/", "title": "FoC: Figure out the Cryptographic Functions in Stripped Binaries with LLMs", "summary": "FoC uses FoC-BinLLM to summarize cryptographic functions in stripped binaries and FoC-Sim to retrieve similar implementations. It evaluates both models and applications to virus analysis and 1-day vulnerability detection.", "content_text": "FoC uses FoC-BinLLM to summarize cryptographic functions in stripped binaries and FoC-Sim to retrieve similar implementations. It evaluates both models and applications to virus analysis and 1-day vulnerability detection.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-neural-decompilation/", "url": "https://awesomerea.org/papers/paper-neural-decompilation/", "title": "Towards Neural Decompilation", "summary": "The paper trains a neural machine translation decompiler using a compiler. It evaluates translation from LLVM IR and x86 assembly to C, successfully decompiling over 97% and 88% of its respective benchmarks.", "content_text": "The paper trains a neural machine translation decompiler using a compiler. It evaluates translation from LLVM IR and x86 assembly to C, successfully decompiling over 97% and 88% of its respective benchmarks.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-basesafe/", "url": "https://awesomerea.org/papers/paper-basesafe/", "title": "BaseSAFE: Baseband SAnitized Fuzzing through Emulation", "summary": "BaseSAFE partially rehosts closed-source cellular baseband firmware for instrumented fuzzing and uses a sanitizing allocator to detect heap buffer overflows.", "content_text": "BaseSAFE partially rehosts closed-source cellular baseband firmware for instrumented fuzzing and uses a sanitizing allocator to detect heap buffer overflows.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-d-lift/", "url": "https://awesomerea.org/papers/paper-d-lift/", "title": "D-LiFT: Improving LLM-based Decompiler Backend via Code Quality-driven Fine-tuning", "summary": "D-LIFT uses D-Score to guide LLM fine-tuning and output selection, improving decompiled code while prioritizing accuracy. It evaluates Ghidra output from coreutils and util-linux.", "content_text": "D-LIFT uses D-Score to guide LLM fine-tuning and output selection, improving decompiled code while prioritizing accuracy. It evaluates Ghidra output from coreutils and util-linux.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-cross-arch-instruction-embedding/", "url": "https://awesomerea.org/papers/paper-cross-arch-instruction-embedding/", "title": "A Cross-Architecture Instruction Embedding Model for Natural Language Processing-Inspired Binary Code Analysis", "summary": "The paper learns instruction embeddings that capture semantic relationships within and across architectures. It evaluates them on semantic basic-block comparison, outperforming a code-statistics approach.", "content_text": "The paper learns instruction embeddings that capture semantic relationships within and across architectures. It evaluates them on semantic basic-block comparison, outperforming a code-statistics approach.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-trex/", "url": "https://awesomerea.org/papers/paper-trex/", "title": "Trex: Learning Execution Semantics from Micro-Traces for Binary Similarity", "summary": "Trex learns execution semantics from function micro-traces, then uses that knowledge to match semantically similar binary functions.", "content_text": "Trex learns execution semantics from function micro-traces, then uses that knowledge to match semantically similar binary functions.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-para-rehosting/", "url": "https://awesomerea.org/papers/paper-para-rehosting/", "title": "From Library Portability to Para-rehosting: Natively Executing Microcontroller Software on Commodity Hardware", "summary": "The paper uses a POSIX-based portable MCU and replaceable peripheral drivers to rehost MCU software for native execution and security testing on commodity hardware.", "content_text": "The paper uses a POSIX-based portable MCU and replaceable peripheral drivers to rehost MCU software for native execution and security testing on commodity hardware.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-frankenstein/", "url": "https://awesomerea.org/papers/paper-frankenstein/", "title": "Frankenstein: Advanced Wireless Fuzzing to Exploit New Bluetooth Escalation Targets", "summary": "Frankenstein emulates Bluetooth firmware dumps and fuzzes a virtual modem. It evaluates Broadcom and Cypress stacks, finding three zero-click vulnerabilities, host escalation issues, and BlueFrag on Android.", "content_text": "Frankenstein emulates Bluetooth firmware dumps and fuzzes a virtual modem. It evaluates Broadcom and Cypress stacks, finding three zero-click vulnerabilities, host escalation issues, and BlueFrag on Android.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-manually-re-iot-protocols/", "url": "https://awesomerea.org/papers/paper-manually-re-iot-protocols/", "title": "On Manually Reverse Engineering Communication Protocols of Linux Based IoT Systems", "summary": "Presents a manual framework for reverse engineering communication protocols in embedded Linux IoT systems. It applies the framework to several systems and details a WeMo smart plug case study.", "content_text": "Presents a manual framework for reverse engineering communication protocols in embedded Linux IoT systems. It applies the framework to several systems and details a WeMo smart plug case study.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-icsref/", "url": "https://awesomerea.org/papers/paper-icsref/", "title": "ICSREF: A Framework for Automated Reverse Engineering of Industrial Control Systems Binaries", "summary": "ICSREF automates reverse engineering of PLC binaries compiled with CODESYS. It was evaluated on collected and in-house PLC binaries and used to generate an attack against a chemical process testbed.", "content_text": "ICSREF automates reverse engineering of PLC binaries compiled with CODESYS. It was evaluated on collected and in-house PLC binaries and used to generate an attack against a chemical process testbed.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/papers/paper-dec-gpt/", "url": "https://awesomerea.org/papers/paper-dec-gpt/", "title": "Refining Decompiled C Code with Large Language Models", "summary": "The paper proposes a two-step hybrid LLM approach to refine IDA-Pro decompiled C code for recompilation. On popular C test cases, it reports a recompilation success rate above 75% with moderate effort.", "content_text": "The paper proposes a two-step hybrid LLM approach to refine IDA-Pro decompiled C code for recompilation. On popular C test cases, it reports a recompilation success rate above 75% with moderate effort.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "paper", "Research paper" ] }, { "id": "https://awesomerea.org/resources/spy-debugger/", "url": "https://awesomerea.org/resources/spy-debugger/", "title": "spy-debugger", "summary": "spy-debugger is a tool for remotely debugging pages in mobile browsers and app WebViews while capturing HTTP and HTTPS traffic. It injects weinre debugging code into HTML responses and can use its built-in proxy or an external one.", "content_text": "spy-debugger is a tool for remotely debugging pages in mobile browsers and app WebViews while capturing HTTP and HTTPS traffic. It injects weinre debugging code into HTML responses and can use its built-in proxy or an external one.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "tool", "Tool" ] }, { "id": "https://awesomerea.org/resources/justtrustme/", "url": "https://awesomerea.org/resources/justtrustme/", "title": "JustTrustMe", "summary": "JustTrustMe is an Xposed module that disables SSL certificate checks in Android apps. It can help expose network traffic from apps that use certificate pinning.", "content_text": "JustTrustMe is an Xposed module that disables SSL certificate checks in Android apps. It can help expose network traffic from apps that use certificate pinning.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "tool", "Tool" ] }, { "id": "https://awesomerea.org/resources/vector-lsposed/", "url": "https://awesomerea.org/resources/vector-lsposed/", "title": "Vector Framework", "summary": "Vector Framework is a Zygisk module that provides ART hooking for Android apps. It supports Xposed APIs and lets modules change app and system behavior in memory without modifying APK files.", "content_text": "Vector Framework is a Zygisk module that provides ART hooking for Android apps. It supports Xposed APIs and lets modules change app and system behavior in memory without modifying APK files.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "tool", "Tool" ] }, { "id": "https://awesomerea.org/resources/edxposed/", "url": "https://awesomerea.org/resources/edxposed/", "title": "EdXposed Framework", "summary": "EdXposed is a Riru module that provides an Xposed-compatible ART hooking framework for Android 8.0 through 11. It lets Xposed modules change system and app behavior without modifying APKs.", "content_text": "EdXposed is a Riru module that provides an Xposed-compatible ART hooking framework for Android 8.0 through 11. It lets Xposed modules change system and app behavior without modifying APKs.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "tool", "Tool" ] }, { "id": "https://awesomerea.org/resources/virtualxposed/", "url": "https://awesomerea.org/resources/virtualxposed/", "title": "VirtualXposed", "summary": "VirtualXposed is an Android app that runs Xposed modules alongside apps in a virtual environment without root access, an unlocked bootloader, or a custom system image. It is based on VirtualApp and epic.", "content_text": "VirtualXposed is an Android app that runs Xposed modules alongside apps in a virtual environment without root access, an unlocked bootloader, or a custom system image. It is based on VirtualApp and epic.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "tool", "Tool" ] }, { "id": "https://awesomerea.org/resources/somcp/", "url": "https://awesomerea.org/resources/somcp/", "title": "SOMCP", "summary": "SOMCP is an Android MCP server for analyzing and modifying native SO libraries. It exposes ELF analysis, disassembly, patching, and optional dynamic analysis tools to MCP clients.", "content_text": "SOMCP is an Android MCP server for analyzing and modifying native SO libraries. It exposes ELF analysis, disassembly, patching, and optional dynamic analysis tools to MCP clients.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "integration", "Integration" ] }, { "id": "https://awesomerea.org/resources/r0idamcp/", "url": "https://awesomerea.org/resources/r0idamcp/", "title": "r0idamcp", "summary": "r0idamcp is a single-file MCP server that connects IDA Pro to an MCP-capable assistant for automated reverse engineering. Its tools expose functions, strings, decompilation, cross-references, comments, and renaming through an SSE connection.", "content_text": "r0idamcp is a single-file MCP server that connects IDA Pro to an MCP-capable assistant for automated reverse engineering. Its tools expose functions, strings, decompilation, cross-references, comments, and renaming through an SSE connection.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "integration", "Integration" ] }, { "id": "https://awesomerea.org/resources/impacket/", "url": "https://awesomerea.org/resources/impacket/", "title": "Impacket", "summary": "Impacket is a Python library for constructing and parsing network packets and working with protocol implementations. It covers protocols including SMB and MSRPC and includes example tools.", "content_text": "Impacket is a Python library for constructing and parsing network packets and working with protocol implementations. It covers protocols including SMB and MSRPC and includes example tools.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "tool", "Tool" ] }, { "id": "https://awesomerea.org/resources/nxnative/", "url": "https://awesomerea.org/resources/nxnative/", "title": "nxnative", "summary": "nxnative is a tool that packages Nintendo Switch games as apps that run their code natively on Apple hardware, with graphics translated to Metal. It builds iPhone, iPad, or Mac apps from supported Switch games; Switch 2 builds are documented for Mac only.", "content_text": "nxnative is a tool that packages Nintendo Switch games as apps that run their code natively on Apple hardware, with graphics translated to Metal. It builds iPhone, iPad, or Mac apps from supported Switch games; Switch 2 builds are documented for Mac only.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "tool", "Tool" ] }, { "id": "https://awesomerea.org/resources/retruxx/", "url": "https://awesomerea.org/resources/retruxx/", "title": "retruxx: reverse-engineered Hard Truck Apocalypse", "summary": "retruxx is a reverse-engineered Hard Truck Apocalypse project that builds the game executable and separate renderer, input, and sound DLLs. Its 32-bit build matches the original game's memory layouts.", "content_text": "retruxx is a reverse-engineered Hard Truck Apocalypse project that builds the game executable and separate renderer, input, and sound DLLs. Its 32-bit build matches the original game's memory layouts.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "case-study", "Case study" ] }, { "id": "https://awesomerea.org/resources/savagewindrecomp/", "url": "https://awesomerea.org/resources/savagewindrecomp/", "title": "Savage Wind Recomp: statically recompiling The Legend of Zelda: Breath of the Wild", "summary": "Savage Wind Recomp is an in-progress static recompilation of the Nintendo Switch version of The Legend of Zelda: Breath of the Wild for Windows and Linux. It builds native game code locally from the player's extracted files; the README reports playable early areas but says the full story remains unconfirmed.", "content_text": "Savage Wind Recomp is an in-progress static recompilation of the Nintendo Switch version of The Legend of Zelda: Breath of the Wild for Windows and Linux. It builds native game code locally from the player's extracted files; the README reports playable early areas but says the full story remains unconfirmed.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "case-study", "Case study" ] }, { "id": "https://awesomerea.org/resources/opentomb/", "url": "https://awesomerea.org/resources/opentomb/", "title": "OpenTomb: Tomb Raider engine reimplementation", "summary": "OpenTomb is an open-source reimplementation of the classic Tomb Raider engine for playing levels from Tomb Raider 1–5 and custom TRLE levels. It is no longer maintained.", "content_text": "OpenTomb is an open-source reimplementation of the classic Tomb Raider engine for playing levels from Tomb Raider 1–5 and custom TRLE levels. It is no longer maintained.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "case-study", "Case study" ] }, { "id": "https://awesomerea.org/resources/metasm/", "url": "https://awesomerea.org/resources/metasm/", "title": "Metasm", "summary": "Metasm is a Ruby suite for assembling, disassembling, debugging, and modifying executable binaries. It supports formats including PE, ELF, Mach-O, and shellcode.", "content_text": "Metasm is a Ruby suite for assembling, disassembling, debugging, and modifying executable binaries. It supports formats including PE, ELF, Mach-O, and shellcode.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "tool", "Tool" ] }, { "id": "https://awesomerea.org/resources/innoextract/", "url": "https://awesomerea.org/resources/innoextract/", "title": "innoextract", "summary": "Unpacks Inno Setup installers on non-Windows systems without running them. It also handles modified variants, including GOG.com's Inno Setup-based game installers.", "content_text": "Unpacks Inno Setup installers on non-Windows systems without running them. It also handles modified variants, including GOG.com's Inno Setup-based game installers.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "tool", "Tool" ] }, { "id": "https://awesomerea.org/resources/fq/", "url": "https://awesomerea.org/resources/fq/", "title": "fq", "summary": "fq is a command-line tool and query language for inspecting and decoding binary formats. It provides a structural hex viewer, bit-level decoding, nested format parsing, and an interactive query interface.", "content_text": "fq is a command-line tool and query language for inspecting and decoding binary formats. It provides a structural hex viewer, bit-level decoding, nested format parsing, and an interactive query interface.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "tool", "Tool" ] }, { "id": "https://awesomerea.org/resources/cuckoo-sandbox/", "url": "https://awesomerea.org/resources/cuckoo-sandbox/", "title": "Cuckoo Sandbox", "summary": "Cuckoo Sandbox is an automated malware analysis system that executes suspicious files in an isolated environment and reports their behavior.", "content_text": "Cuckoo Sandbox is an automated malware analysis system that executes suspicious files in an isolated environment and reports their behavior.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "tool", "Tool" ] }, { "id": "https://awesomerea.org/resources/cuckoo3/", "url": "https://awesomerea.org/resources/cuckoo3/", "title": "Cuckoo3", "summary": "Cuckoo3 is a malware analysis tool that tests suspicious files and links in sandboxed platform emulators. It reports what the files or websites did during the test.", "content_text": "Cuckoo3 is a malware analysis tool that tests suspicious files and links in sandboxed platform emulators. It reports what the files or websites did during the test.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "tool", "Tool" ] }, { "id": "https://awesomerea.org/resources/thug/", "url": "https://awesomerea.org/resources/thug/", "title": "Thug", "summary": "Thug is a Python low-interaction honeyclient that mimics a web browser to detect and emulate malicious content. It supports the study of client-side attacks.", "content_text": "Thug is a Python low-interaction honeyclient that mimics a web browser to detect and emulate malicious content. It supports the study of client-side attacks.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "tool", "Tool" ] }, { "id": "https://awesomerea.org/resources/pkhex/", "url": "https://awesomerea.org/resources/pkhex/", "title": "PKHeX", "summary": "PKHeX is a C# Windows Forms editor for Pokémon core-series save data. It can edit and save supported files, import Pokémon and teams, and convert data between game generations.", "content_text": "PKHeX is a C# Windows Forms editor for Pokémon core-series save data. It can edit and save supported files, import Pokémon and teams, and convert data between game generations.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "tool", "Tool" ] }, { "id": "https://awesomerea.org/resources/droidlysis/", "url": "https://awesomerea.org/resources/droidlysis/", "title": "DroidLysis", "summary": "DroidLysis is a pre-analysis tool for Android apps that disassembles samples, organizes their contents, and flags code patterns for further inspection. It accepts APK, DEX, ODEX, ARM executable, ZIP, RAR, and directory inputs.", "content_text": "DroidLysis is a pre-analysis tool for Android apps that disassembles samples, organizes their contents, and flags code patterns for further inspection. It accepts APK, DEX, ODEX, ARM executable, ZIP, RAR, and directory inputs.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "tool", "Tool" ] }, { "id": "https://awesomerea.org/resources/viper-framework/", "url": "https://awesomerea.org/resources/viper-framework/", "title": "Viper", "summary": "Viper is a framework for binary analysis and for organizing malware samples, exploit samples, and research scripts. The Viper 1.x repository is archived and development has ended.", "content_text": "Viper is a framework for binary analysis and for organizing malware samples, exploit samples, and research scripts. The Viper 1.x repository is archived and development has ended.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "tool", "Tool" ] }, { "id": "https://awesomerea.org/resources/libpeconv/", "url": "https://awesomerea.org/resources/libpeconv/", "title": "libPeConv", "summary": "libPeConv is a Windows library for loading and manipulating PE files. It supports tasks such as section remapping, relocation, import loading, resource parsing, and rebuilding import address tables from memory dumps.", "content_text": "libPeConv is a Windows library for loading and manipulating PE files. It supports tasks such as section remapping, relocation, import loading, resource parsing, and rebuilding import address tables from memory dumps.", "date_published": "2026-11-06T00:00:00Z", "date_modified": "2026-11-06T00:00:00Z", "tags": [ "tool", "Tool" ] } ] }