https://awesomerea.org/feed.xmlAwesomeREA.org: newly added entriesCurated resources, case studies and research papers newly added to Awesome Reverse Engineering Anything.2026-11-06T17:38:26ZAwesome REA contributorshttps://github.com/reacher-z/Awesome-REAOriginal editorial content: MIT. Linked projects and papers retain their own rights and licenses.tag:awesomerea.org,2026:discovery-batch:run-42259510952-1:enUnreviewed discoveries: 300 repositories from scan run 422595109522026-11-06T17:38:26Z2026-11-06T17:38:26Zshortsspectrumai-del/GameDecomp, JonathanSigmund/luadicrous, Dominik-O22/recore, greyblue9/apk2project, yuv422/qb30decomp, TheMaster1127/HT-RE, RussDev7/CMZ-Stats-SAV-Decompiler, aseroff/pear and 292 more. Automated README scans, unreviewed.tag:awesomerea.org,2026:discovery-batch:run-42250580748-1:enUnreviewed discoveries: 300 repositories from scan run 422505807482026-11-06T16:31:51Z2026-11-06T16:31:51ZErik-Castro/DevSecurity, mushiDiam/File-Monitor, meltedinhex/meltedinhex.github.io, wailhassanali-tech/malware-analysis-investigation, MatthewKuKanich/CivSwitch-ControlCenter, Thug-Dracula/rondorecomp, TheBozos/BozoEngine, CoastRedWood/splashdown and 292 more. Automated README scans, unreviewed.tag:awesomerea.org,2026:discovery-batch:run-42241100246-1:enUnreviewed discoveries: 300 repositories from scan run 422411002462026-11-06T15:41:48Z2026-11-06T15:41:48Zhaise-dev/martian-notifier-toolkit, 0x1q2s/sp1cyreverse, panming/syntec-plc-ladder, tudorek12345/decomptwdgame1season, Fluxionics/Aquadecomp, onlycareone/Mystia-Guest-Helper, santipaez/midea-mf200-tools, Juliii-p/e88-drone-pc-control and 292 more. Automated README scans, unreviewed.tag:awesomerea.org,2026:discovery-batch:run-42232277609-1:enUnreviewed discoveries: 300 repositories from scan run 422322776092026-11-06T14:32:13Z2026-11-06T14:32:13ZSecurityM/IntegrityGap, Trivexqbn/iMonitor-System-Activity-Monitor, 0xInitZer0/MalStat, ATRAPSLLC/autoit-rs, israaelnour/ctf-writeups, abc1230940/SOC336-Windows-OLE-Zero-Click-RCE-Exploitation-Detected-CVE-2025-21298, dhcybsec256/Malware-Analysis-Project, druserx/scrutator and 292 more. Automated README scans, unreviewed.tag:awesomerea.org,2026:discovery-batch:run-42216804018-1:enUnreviewed discoveries: 300 repositories from scan run 422168040182026-11-06T13:02:54Z2026-11-06T13:02:54ZCratis/Prologue, Louiselate441/reverseloom, Rishi-Goyal/led-hue-cycle, Shalom-Karr/q-zheng-android-decompiled, Shalom-Karr/futronic-android-sdk-decompiled, Shalom-Karr/acs-smartcard-android-decompiled, pueblokc/unifi-protect-audio-control, MoriartyPuth-Labs/LYKN-CTF-Writeup and 292 more. Automated README scans, unreviewed.tag:awesomerea.org,2026:discovery-batch:run-42216232619-1:enUnreviewed discoveries: 300 repositories from scan run 422162326192026-11-06T12:39:53Z2026-11-06T12:39:53Zjamesfmackenzie/ymf-dos-research, LuizORAS/fft-decomp, RetrolariumLab/sonic2_src, LIN4CRE/DigimonWorld1Web, elephantlover2/tizen-kts-research, NilsBe/Asmonite, sdars/GameGuardian-Open, aleeraser/faba-tools and 292 more. Automated README scans, unreviewed.tag:awesomerea.org,2026:discovery-batch:run-42208549742-1:enUnreviewed discoveries: 300 repositories from scan run 422085497422026-11-06T11:38:12Z2026-11-06T11:38:12Zgage-marshall/lp-engine, RAZORRZR0/gtasa-de-morphe-patches, brilolo5/ProjectClassic22, ekamalbekuulu-ai/ST-Manager, Sliv3er/Silverbud, cnjswangyu/gba-ai-daisenryaku, only9464/TscanPlus-Wails-RE, coldwaterkimkim/bose-usb-bridge and 292 more. Automated README scans, unreviewed.tag:awesomerea.org,2026:discovery-batch:run-42201075883-1:enUnreviewed discoveries: 148 repositories from scan run 422010758832026-11-06T10:43:34Z2026-11-06T10:43:34Z6K6666/unifi-g4-doorbell-modding, nekomancer01/DarkSoulsPS2, diand26/tcomas-lg600-lcd, vs-sr-dev/wskit, izvoranumarius/apkspy, darksemfiltro/clonar-programa, eduardosmulero-tech/eden-trace, Kalmarv/forzatech-formats and 140 more. Automated README scans, unreviewed.tag:awesomerea.org,2026:discovery-batch:run-42186805426-1:enUnreviewed discoveries: 102 repositories from scan run 421868054262026-11-06T08:44:42Z2026-11-06T08:44:42Zogabrielalonso/website-cloner, haojiezhe12345/PCQQTweaks, geoffrey-diederichs/LA_CTF_2025, EllE961/LA-CTF-McFlagChecker, saruman9/ida_scripts, Mqlvin/keyboard-colour, Texthead1/Custom-Mixed-Variant-Skylander-IDs, Texthead1/Skylanders-Portal-IDs and 94 more. Automated README scans, unreviewed.tag:awesomerea.org,2026:discovery-batch:run-42161587295-1:enUnreviewed discoveries: 61 repositories from scan run 421615872952026-11-06T04:34:51Z2026-11-06T04:34:51Zproteinklumpen/spl-lab-web, 4noha/SainSmartDDS140, Yarfer800/aiowapy, Reverie1145/veladec, f4mrfaux/psychonauts-controller-fix, yymz072-beep/ps2-game-hanhua, error9098x/ps5-native-mac, alxmtzr/brickwork and 53 more. Automated README scans, unreviewed.https://awesomerea.org/papers/paper-llm-malware-deobfuscation/Assessing LLMs in Malicious Code Deobfuscation of Real-world Malware Campaigns2026-11-06T00:00:00Z2026-11-06T00:00:00ZThe paper evaluates four LLMs on deobfuscating real-world malicious scripts from the Emotet malware campaign and examines their use in reverse engineering.https://awesomerea.org/papers/paper-protocol-format-state-machine/Extracting Protocol Format as State Machine via Controlled Static Loop Analysis2026-11-06T00:00:00Z2026-11-06T00:00:00ZThe paper extracts protocol message formats from parser code by analyzing parsing loops as state machines. It evaluates format inference and the use of the extracted machines in protocol fuzzers.https://awesomerea.org/papers/paper-ref-decompile/ReF Decompile: Relabeling and Function Call Enhanced Decompile2026-11-06T00:00:00Z2026-11-06T00:00:00ZReF Decompile relabels jump targets and uses function calls to recover variable information when converting binary code to source code. It was evaluated on the HumanEval-Decompile Benchmark.https://awesomerea.org/papers/paper-attack-synthesis-fsm/Automated Attack Synthesis by Extracting Finite State Machines from Protocol Specification Documents2026-11-06T00:00:00Z2026-11-06T00:00:00ZExtracts protocol FSMs from RFC prose using technical word representations, zero-shot text mapping, and rules, then uses the extracted FSMs to synthesize attacks.https://awesomerea.org/papers/paper-ktrans/kTrans: Knowledge-Aware Transformer for Binary Code Embedding2026-11-06T00:00:00Z2026-11-06T00:00:00ZkTrans uses a knowledge-aware Transformer to embed binary code. It evaluates the embeddings through outlier detection and visualization, and on binary code similarity, function type recovery, and indirect call recognition.https://awesomerea.org/papers/paper-helios/HELIOS: Hierarchical Graph Abstraction for Structure-Aware LLM Decompilation2026-11-06T00:00:00Z2026-11-06T00:00:00ZHELIOS gives an LLM a hierarchical summary of binary control flow and function calls alongside decompiler output, with optional compiler feedback. It evaluates compilability and functional correctness.https://awesomerea.org/papers/paper-cebin/CEBin: A Cost-Effective Framework for Large-Scale Binary Code Similarity Detection2026-11-06T00:00:00Z2026-11-06T00:00:00ZCEBin combines code embeddings to shortlist candidate functions with pairwise comparison to detect similar binary code, including vulnerable functions.https://awesomerea.org/papers/paper-isadetect/Towards usable automated detection of CPU architecture and endianness for arbitrary binary files and object code sequences2026-11-06T00:00:00Z2026-11-06T00:00:00ZThe paper builds open datasets and tools to identify CPU architecture and endianness in binary files and object code. It evaluates classifiers on executable code sections, reporting over 98% accuracy.https://awesomerea.org/papers/paper-rex86/REx86: A Local Large Language Model for Assisting in x86 Assembly Reverse Engineering2026-11-06T00:00:00Z2026-11-06T00:00:00ZThe paper fine-tunes eight local models from CodeLlama, Qwen2.5-Coder, and CodeGemma on 5,981 x86 assembly examples and evaluates their help with binary reverse engineering.https://awesomerea.org/papers/paper-dynamic-firmware-analysis-at-scale/Automated Dynamic Firmware Analysis at Scale: A Case Study on Embedded Web Interfaces2026-11-06T00:00:00Z2026-11-06T00:00:00ZThe paper emulates firmware images and uses static and dynamic tools to find vulnerabilities in embedded web interfaces. It evaluated 1,925 images from 54 vendors and found vulnerabilities in 185 images.https://awesomerea.org/papers/paper-ecmo/ECMO: Peripheral Transplantation to Rehost Embedded Linux Kernels2026-11-06T00:00:00Z2026-11-06T00:00:00ZECMO transplants peripheral drivers into embedded Linux kernels to boot firmware in QEMU. It evaluated 815 firmware images across 20 kernel versions, 37 device models, and 24 vendors; 710 reached a user-space shell.https://awesomerea.org/papers/paper-manticore/Manticore: A User-Friendly Symbolic Execution Framework for Binaries and Smart Contracts2026-11-06T00:00:00Z2026-11-06T00:00:00ZManticore uses dynamic symbolic execution to analyze binaries and Ethereum smart contracts. The paper presents its architecture and demonstrates bug finding and code verification used for commercial clients.https://awesomerea.org/papers/paper-internalblue/InternalBlue - Bluetooth Binary Patching and Experimentation Framework2026-11-06T00:00:00Z2026-11-06T00:00:00ZThe paper reverse engineers Broadcom Bluetooth controllers and presents InternalBlue for patching their firmware. It evaluates the framework through vulnerability tests, bug fixes, and added security features.https://awesomerea.org/papers/paper-gpt4-binary-re/Exploring the Efficacy of Large Language Models (GPT-4) in Binary Reverse Engineering2026-11-06T00:00:00Z2026-11-06T00:00:00ZThe paper evaluates GPT-4 for binary reverse engineering through interpretation of human-written and decompiled code, from basic code explanation to malware analysis.https://awesomerea.org/papers/paper-asteria/Asteria: Deep Learning-based AST-Encoding for Cross-platform Binary Code Similarity Detection2026-11-06T00:00:00Z2026-11-06T00:00:00ZASTERIA uses a Tree-LSTM to encode function ASTs and compare binary functions across platforms. It was evaluated on function pairs and used to search IoT firmware for vulnerabilities.https://awesomerea.org/papers/paper-snipuzz/Snipuzz: Black-box Fuzzing of IoT Firmware via Message Snippet Inference2026-11-06T00:00:00Z2026-11-06T00:00:00ZSnipuzz fuzzes IoT firmware as a client, using device responses to infer message snippets that guide mutations. It was evaluated on 20 real-world IoT devices and compared with four IoT fuzzing approaches.https://awesomerea.org/papers/paper-asteria-pro/Asteria-Pro: Enhancing Deep-Learning Based Binary Code Similarity Detection by Incorporating Domain Knowledge2026-11-06T00:00:00Z2026-11-06T00:00:00ZAsteria-Pro adds domain-knowledge pre-filtration and re-ranking to Tree-LSTM-based binary code similarity detection. It evaluates firmware vulnerability search across diverse IoT hardware architectures.https://awesomerea.org/papers/paper-foc/FoC: Figure out the Cryptographic Functions in Stripped Binaries with LLMs2026-11-06T00:00:00Z2026-11-06T00:00:00ZFoC uses FoC-BinLLM to summarize cryptographic functions in stripped binaries and FoC-Sim to retrieve similar implementations. It evaluates both models and applications to virus analysis and 1-day vulnerability detection.https://awesomerea.org/papers/paper-neural-decompilation/Towards Neural Decompilation2026-11-06T00:00:00Z2026-11-06T00:00:00ZThe paper trains a neural machine translation decompiler using a compiler. It evaluates translation from LLVM IR and x86 assembly to C, successfully decompiling over 97% and 88% of its respective benchmarks.https://awesomerea.org/papers/paper-basesafe/BaseSAFE: Baseband SAnitized Fuzzing through Emulation2026-11-06T00:00:00Z2026-11-06T00:00:00ZBaseSAFE partially rehosts closed-source cellular baseband firmware for instrumented fuzzing and uses a sanitizing allocator to detect heap buffer overflows.https://awesomerea.org/papers/paper-d-lift/D-LiFT: Improving LLM-based Decompiler Backend via Code Quality-driven Fine-tuning2026-11-06T00:00:00Z2026-11-06T00:00:00ZD-LIFT uses D-Score to guide LLM fine-tuning and output selection, improving decompiled code while prioritizing accuracy. It evaluates Ghidra output from coreutils and util-linux.https://awesomerea.org/papers/paper-cross-arch-instruction-embedding/A Cross-Architecture Instruction Embedding Model for Natural Language Processing-Inspired Binary Code Analysis2026-11-06T00:00:00Z2026-11-06T00:00:00ZThe paper learns instruction embeddings that capture semantic relationships within and across architectures. It evaluates them on semantic basic-block comparison, outperforming a code-statistics approach.https://awesomerea.org/papers/paper-trex/Trex: Learning Execution Semantics from Micro-Traces for Binary Similarity2026-11-06T00:00:00Z2026-11-06T00:00:00ZTrex learns execution semantics from function micro-traces, then uses that knowledge to match semantically similar binary functions.https://awesomerea.org/papers/paper-para-rehosting/From Library Portability to Para-rehosting: Natively Executing Microcontroller Software on Commodity Hardware2026-11-06T00:00:00Z2026-11-06T00:00:00ZThe paper uses a POSIX-based portable MCU and replaceable peripheral drivers to rehost MCU software for native execution and security testing on commodity hardware.https://awesomerea.org/papers/paper-frankenstein/Frankenstein: Advanced Wireless Fuzzing to Exploit New Bluetooth Escalation Targets2026-11-06T00:00:00Z2026-11-06T00:00:00ZFrankenstein emulates Bluetooth firmware dumps and fuzzes a virtual modem. It evaluates Broadcom and Cypress stacks, finding three zero-click vulnerabilities, host escalation issues, and BlueFrag on Android.https://awesomerea.org/papers/paper-manually-re-iot-protocols/On Manually Reverse Engineering Communication Protocols of Linux Based IoT Systems2026-11-06T00:00:00Z2026-11-06T00:00:00ZPresents a manual framework for reverse engineering communication protocols in embedded Linux IoT systems. It applies the framework to several systems and details a WeMo smart plug case study.https://awesomerea.org/papers/paper-icsref/ICSREF: A Framework for Automated Reverse Engineering of Industrial Control Systems Binaries2026-11-06T00:00:00Z2026-11-06T00:00:00ZICSREF automates reverse engineering of PLC binaries compiled with CODESYS. It was evaluated on collected and in-house PLC binaries and used to generate an attack against a chemical process testbed.https://awesomerea.org/papers/paper-dec-gpt/Refining Decompiled C Code with Large Language Models2026-11-06T00:00:00Z2026-11-06T00:00:00ZThe paper proposes a two-step hybrid LLM approach to refine IDA-Pro decompiled C code for recompilation. On popular C test cases, it reports a recompilation success rate above 75% with moderate effort.https://awesomerea.org/resources/spy-debugger/spy-debugger2026-11-06T00:00:00Z2026-11-06T00:00:00Zspy-debugger is a tool for remotely debugging pages in mobile browsers and app WebViews while capturing HTTP and HTTPS traffic. It injects weinre debugging code into HTML responses and can use its built-in proxy or an external one.https://awesomerea.org/resources/justtrustme/JustTrustMe2026-11-06T00:00:00Z2026-11-06T00:00:00ZJustTrustMe is an Xposed module that disables SSL certificate checks in Android apps. It can help expose network traffic from apps that use certificate pinning.https://awesomerea.org/resources/vector-lsposed/Vector Framework2026-11-06T00:00:00Z2026-11-06T00:00:00ZVector Framework is a Zygisk module that provides ART hooking for Android apps. It supports Xposed APIs and lets modules change app and system behavior in memory without modifying APK files.https://awesomerea.org/resources/edxposed/EdXposed Framework2026-11-06T00:00:00Z2026-11-06T00:00:00ZEdXposed is a Riru module that provides an Xposed-compatible ART hooking framework for Android 8.0 through 11. It lets Xposed modules change system and app behavior without modifying APKs.https://awesomerea.org/resources/virtualxposed/VirtualXposed2026-11-06T00:00:00Z2026-11-06T00:00:00ZVirtualXposed is an Android app that runs Xposed modules alongside apps in a virtual environment without root access, an unlocked bootloader, or a custom system image. It is based on VirtualApp and epic.https://awesomerea.org/resources/somcp/SOMCP2026-11-06T00:00:00Z2026-11-06T00:00:00ZSOMCP is an Android MCP server for analyzing and modifying native SO libraries. It exposes ELF analysis, disassembly, patching, and optional dynamic analysis tools to MCP clients.https://awesomerea.org/resources/r0idamcp/r0idamcp2026-11-06T00:00:00Z2026-11-06T00:00:00Zr0idamcp is a single-file MCP server that connects IDA Pro to an MCP-capable assistant for automated reverse engineering. Its tools expose functions, strings, decompilation, cross-references, comments, and renaming through an SSE connection.https://awesomerea.org/resources/impacket/Impacket2026-11-06T00:00:00Z2026-11-06T00:00:00ZImpacket is a Python library for constructing and parsing network packets and working with protocol implementations. It covers protocols including SMB and MSRPC and includes example tools.https://awesomerea.org/resources/nxnative/nxnative2026-11-06T00:00:00Z2026-11-06T00:00:00Znxnative is a tool that packages Nintendo Switch games as apps that run their code natively on Apple hardware, with graphics translated to Metal. It builds iPhone, iPad, or Mac apps from supported Switch games; Switch 2 builds are documented for Mac only.https://awesomerea.org/resources/retruxx/retruxx: reverse-engineered Hard Truck Apocalypse2026-11-06T00:00:00Z2026-11-06T00:00:00Zretruxx is a reverse-engineered Hard Truck Apocalypse project that builds the game executable and separate renderer, input, and sound DLLs. Its 32-bit build matches the original game's memory layouts.https://awesomerea.org/resources/savagewindrecomp/Savage Wind Recomp: statically recompiling The Legend of Zelda: Breath of the Wild2026-11-06T00:00:00Z2026-11-06T00:00:00ZSavage Wind Recomp is an in-progress static recompilation of the Nintendo Switch version of The Legend of Zelda: Breath of the Wild for Windows and Linux. It builds native game code locally from the player's extracted files; the README reports playable early areas but says the full story remains unconfirmed.https://awesomerea.org/resources/opentomb/OpenTomb: Tomb Raider engine reimplementation2026-11-06T00:00:00Z2026-11-06T00:00:00ZOpenTomb is an open-source reimplementation of the classic Tomb Raider engine for playing levels from Tomb Raider 1–5 and custom TRLE levels. It is no longer maintained.https://awesomerea.org/resources/metasm/Metasm2026-11-06T00:00:00Z2026-11-06T00:00:00ZMetasm is a Ruby suite for assembling, disassembling, debugging, and modifying executable binaries. It supports formats including PE, ELF, Mach-O, and shellcode.https://awesomerea.org/resources/innoextract/innoextract2026-11-06T00:00:00Z2026-11-06T00:00:00ZUnpacks Inno Setup installers on non-Windows systems without running them. It also handles modified variants, including GOG.com's Inno Setup-based game installers.https://awesomerea.org/resources/fq/fq2026-11-06T00:00:00Z2026-11-06T00:00:00Zfq is a command-line tool and query language for inspecting and decoding binary formats. It provides a structural hex viewer, bit-level decoding, nested format parsing, and an interactive query interface.https://awesomerea.org/resources/cuckoo-sandbox/Cuckoo Sandbox2026-11-06T00:00:00Z2026-11-06T00:00:00ZCuckoo Sandbox is an automated malware analysis system that executes suspicious files in an isolated environment and reports their behavior.https://awesomerea.org/resources/cuckoo3/Cuckoo32026-11-06T00:00:00Z2026-11-06T00:00:00ZCuckoo3 is a malware analysis tool that tests suspicious files and links in sandboxed platform emulators. It reports what the files or websites did during the test.https://awesomerea.org/resources/thug/Thug2026-11-06T00:00:00Z2026-11-06T00:00:00ZThug is a Python low-interaction honeyclient that mimics a web browser to detect and emulate malicious content. It supports the study of client-side attacks.https://awesomerea.org/resources/pkhex/PKHeX2026-11-06T00:00:00Z2026-11-06T00:00:00ZPKHeX is a C# Windows Forms editor for Pokémon core-series save data. It can edit and save supported files, import Pokémon and teams, and convert data between game generations.https://awesomerea.org/resources/droidlysis/DroidLysis2026-11-06T00:00:00Z2026-11-06T00:00:00ZDroidLysis is a pre-analysis tool for Android apps that disassembles samples, organizes their contents, and flags code patterns for further inspection. It accepts APK, DEX, ODEX, ARM executable, ZIP, RAR, and directory inputs.https://awesomerea.org/resources/viper-framework/Viper2026-11-06T00:00:00Z2026-11-06T00:00:00ZViper is a framework for binary analysis and for organizing malware samples, exploit samples, and research scripts. The Viper 1.x repository is archived and development has ended.https://awesomerea.org/resources/libpeconv/libPeConv2026-11-06T00:00:00Z2026-11-06T00:00:00ZlibPeConv is a Windows library for loading and manipulating PE files. It supports tasks such as section remapping, relocation, import loading, resource parsing, and rebuilding import address tables from memory dumps.