Curated reverse engineering resources.

REA’s documented teaching case inspects the HTTP t-rex-runner edition and reconstructs its speed-update rule. A separate controlled original-game check and a new demonstration compare update counts, including the floating-point step that crosses the nominal speed threshold.

Documents a website-rebuild-skill case that decodes browser-delivered React Server Component Flight streams, reconstructs a buildable Next project and compares its output with a captured site. The reported rauchg.com campaign uses route-tree comparison and module-reference mapping; the new server source is inferred from observable output.

Documents BaoCut’s interactive slide editor, whose author says the implementation draws on Claude Slides. It adds a local deck store, HTML/CSS compiler and annotation-to-agent bridge for browser and desktop hosts; the design reports a Web-flow check, without establishing original backend recovery or full behavioral parity.

A Japanese field report connects REA 6.4.0 to Claude Code in a separate project directory, denies 43 of its 170 tools and common shell launch forms, and compares REA-enabled and REA-disabled runs on two real tasks: an Electron terminal’s packaged files and a saved HAR capture. Both arms answered correctly, while the REA arm took up to 2.00× the time and 1.67× the API-equivalent cost. It is an analysis-evaluation and safety-configuration case, not a reconstruction.

The author uses REA’s MCP browser tools to passively capture the JavaScript loaded by wayou’s open-source T-Rex Runner page, then has Codex rebuild its acceleration rule in one self-contained HTML5 Canvas game. The report identifies the captured script by SHA-256 and separates verified source facts from reconstruction choices; only the speed rule is claimed, not full gameplay equivalence.

An independent Rust market interface uses REA browser-scenario research on public logged-out TradingView chart interactions. The notes retain observed/documented/inferred/unknown labels; the result supplies its own chart engine and data providers rather than recovering TradingView or Bloomberg server software.

Documents BaoCut’s design-canvas and design-system editors, which the project says it ported 1:1 from TypeScript reconstructions of Claude Design’s editors and hosts in agent sessions with annotation and export. Its runtime notes record identifier fixes checked against the original scripts and a structural comparison matching 19,111 of 20,463 canvas main-page functions. Unreviewed differences, the unpublished reconstruction record and reuse rights remain open; no hosted-backend recovery is claimed.

Documents and reimplements the WebSocket protocol WhatsApp Web used while browser sessions mirrored a paired phone: QR pairing, Curve25519/HKDF key setup, AES/HMAC-protected binary messages, the token-based node encoding and end-to-end media encryption. A Python backend, Node.js relay and browser front end decode a logged-in session’s messages into inspectable JSON, and the README lists independent reimplementations such as Baileys and go-whatsapp. This is an older protocol generation from before WhatsApp’s 2021 multi-device architecture, not a description of current WhatsApp Web.

Reimplements Adobe Flash Player in Rust so that SWF content, from ActionScript 1/2 (AVM1) to ActionScript 3 (AVM2), runs in a native desktop player or in browsers through WebAssembly, as a self-hosted script or a browser extension. Its contributor guide says behavior comes from observing Flash Player's output or from license-compatible sources such as Adobe's open avmplus code, and forbids decompiling Flash Player, Flash Professional or Animate. Regression tests run contributor-made SWFs and compare their trace output, and optionally rendered images, with captures from the official debug Flash Player.

Rebuilds the Littlebird.ai home page in plain HTML/CSS/JavaScript from captured markup and assets, with source-wired mobile navigation, FAQ toggles, scroll reveals and OS-dependent call-to-action presentation. It illustrates a bounded website reconstruction, with uncaptured routes and product functionality left outside the scope.

Sheypoor MCP implements a client and MCP server for the Sheypoor classifieds site using API behavior documented from browser traffic. Its reference records observed endpoints, request headers, cookies and phone-based login. The server exposes listing search and details, account functions, chat room lists and unread message counts to MCP clients.

ZCode-Android recreates ZCode remote control on Android from captured traffic and analysis of its official web page. Its Kotlin client implements WebSocket relay, HMAC pairing, IPC encoding, fragmented RPC frames and Conversation V4 session messages.

Power BI API Scraper reconstructs the web client's undocumented query and response format for published reports. It sends SemanticQueryDataShapeCommand requests, follows restart tokens and expands bitsets and ValueDicts into CSV rows. The included example is hardcoded for an Ohio liquor permit report.

Improves JavaScript readability by reversing supported obfuscation patterns and unpacking webpack/Browserify bundles.

Rename identifiers in minified JavaScript with LLM-suggested names, applied through scope-aware AST rewriting so the program structure stays unchanged. The new names are model suggestions, not recovered original identifiers.

WebAssembly tools for binary-to-text conversion, section inspection, validation, interpretation and C translation.

Bytecode Alliance CLI and Rust libraries for inspecting WebAssembly modules, metadata, components and WIT interfaces.

Connect an agent to Chrome for live page inspection, network debugging, and performance traces.

Inspect and record HTTP traffic with an interactive proxy, web interface, or scriptable command-line tools.

Drive browser interactions through structured accessibility snapshots to investigate reproducible web behavior.

PortSwigger's Burp Suite extension serves an MCP endpoint, plus a packaged stdio proxy, so agents can query proxy HTTP and WebSocket history, send HTTP/1.1 or HTTP/2 requests, and open Repeater or Intruder tabs.

Recover readable modules from shipped JavaScript bundles by reversing recognized minifier and transpiler patterns. Supports bundle splitting and modern-syntax recovery for inspecting production frontend code.

Analyze captured application HTTP traffic with an LLM to generate MCP tools, OpenAPI 3.1 specifications, or GraphQL schemas. Generated tools call the observed API directly after capture and authentication setup.

Inspect JavaScript ASTs and variable scopes while building visual chains of Babel transforms. Save analysis projects and reusable plugins to iteratively simplify obfuscated scripts.

Capture browser-session evidence, crawl websites in a persistent Chromium session, and generate offline architecture/API reports plus OpenAPI, SDK and mock-server drafts from saved captures.

Generate HTML/CSS, Tailwind, React, Vue, Bootstrap or Ionic front-end code from screenshots, mockups, Figma designs or screen recordings with multimodal models; an optional headless-browser preview lets the model check its rendered output. The result is a visual reconstruction of the interface, not recovered original source or backend behavior.

Node.js CLI that renders a website in Playwright-driven Chromium or Firefox and reads computed styles from the DOM to extract its design system: logo, color roles with the evidence behind each pick, typography, spacing, borders, shadows, motion, breakpoints and component styles such as buttons and inputs. Results export as W3C design tokens (DTCG), Tailwind v4 or shadcn/ui themes, DESIGN.md, an HTML report or a brand-guide PDF, alongside WCAG contrast checks on real DOM pairs and a CI drift gate against a committed baseline. It also runs as an MCP server for agent clients.

Command-line tool that writes the original JavaScript and CSS sources embedded in source maps back out as files. It reads .map files, or JavaScript and CSS files whose sourceMappingURL holds an inline Base64 or URL-encoded map or points to a map in the same folder, and can walk directories with a regular-expression filter. Output is flattened to file names by default, or keeps the map's folder structure with --preserve.

Deobfuscator dedicated to JavaScript produced by Obfuscator.io (javascript-obfuscator), which its README says also handles most forks. Working statically on a Babel AST, it reveals strings hidden in rotated, Base64- or RC4-encoded string arrays, inlines proxy functions, simplifies objects, arithmetic and string concatenation, removes dead code and the obfuscator's anti-tamper wrappers, and reverses control-flow flattening. Its configuration is detected automatically, and the author also hosts an online version.

General-purpose JavaScript deobfuscator for common obfuscation patterns, published on npm as js-deobfuscator and usable as a library or CLI. It unpacks arrays of literals and replaces references to them, removes simple, array and arithmetic proxy functions, simplifies arithmetic and string concatenation, removes dead branches, turns computed member access into static properties, renames hexadecimal identifiers such as _0xca830a and beautifies the result. The author also hosts an online version and maintains a separate deobfuscator for Obfuscator.io output.

Command-line tool that reverse-engineers undocumented REST APIs from captured traffic. It reads a mitmproxy flow file, or a HAR export from the browser DevTools, and generates an OpenAPI 3.0 specification describing the observed endpoints. Running it again over further captures safely merges the new data into an existing schema.

Java desktop decompiler and editor for Adobe Flash SWF files. It decompiles ActionScript 1/2 and AS3 side by side with the P-code they came from, edits scripts as source (experimental) or through the assembler view, and exports or replaces images, shapes, sounds, video, fonts and texts, with SWF-to-FLA conversion, SWF-to-XML round trips and SVG or HTML5 Canvas output. It also opens SWC and ABC files, Scaleform GFx and 64-bit Iggy files, has an ActionScript debugger and deobfuscation passes for obfuscated AS3, and offers its parser and decompiler as the ffdec_lib Java library and a command line.

Python CLI with static paths for inspecting WebAssembly sections and function signatures, producing WAT-style instruction listings, and reconstructing limited C-like pseudocode. These are exploratory analysis aids for supported modules, not recovered original source or a complete WebAssembly runtime.

JavaScript cleaner and deobfuscator aimed mainly at output from javascript-obfuscator (obfuscator.io). It parses a script with acorn and runs a fixed pipeline of AST transformers that fold expressions, clean member accesses, remove dead branches, split sequence expressions, undo switch-based control-flow flattening and decode string arrays, re-implementing their base64 and RC4 decoders in TypeScript rather than executing the input. It ships on npm as deobfuscator with a synchrony CLI and a library API, and optional renaming replaces identifiers with generated word names rather than recovering the originals.

Go command-line tool that recreates a web front end's original JavaScript source tree from a source map generated by webpack or a similar bundler, writing each embedded source file under the path the map records. It takes a .map file by URL or local path, walks a directory of .map files, or fetches a JavaScript file and follows its sourceMappingURL comment or SourceMap response header, including inline data: maps.

Electron desktop application that statically analyzes an Angular project's TypeScript sources and draws interactive graphs of its NgModules, components, directives, pipes and providers and how they depend on each other, without running the application. A project is loaded through its tsconfig file; views move from the module tree to individual modules, templates and providers, with fuzzy symbol search and PNG export of the current graph.

Bishop Fox's Go library and command-line tool that parses JavaScript with tree-sitter to recover the endpoints a script calls, judging values by how the code uses them rather than by regular expressions alone. URL extraction follows location assignments, window.open, fetch, XMLHttpRequest and jQuery request calls, keeps the HTTP method, headers and query or body parameters, and stands in a placeholder for values only known at run time. Other modes flag credential-shaped values, print syntax trees, run tree-sitter queries and reformat minified code.

HUMAN Security's Node.js JavaScript deobfuscator. It identifies the obfuscation type, runs matching processors for obfuscator.io, Caesar Plus and array-based patterns, then iterates 40+ AST modules that rebuild strings, resolve expressions and calls and simplify control flow; unsafe modules evaluate code in a sandbox. It works as a CLI or library.

Browser extension and web page by Rob Wu for inspecting packaged browser extensions without installing them. On Chrome Web Store, Opera, Firefox, Thunderbird and Microsoft Edge add-on pages it adds a button that downloads the package as a zip or opens it in a viewer, and links to extension packages hosted elsewhere can be opened as well. The viewer reads CRX, NEX, XPI and ZIP files: it lists and filters files, searches content by string or regular expression, beautifies and syntax-highlights code, previews images, opens nested zips, shows per-file hashes and derives the extension ID from the package key, signature or manifest.

TypeScript library and CLI that infers OpenAPI 3.0 or 3.1 documents from HAR captures of HTTP traffic, loosely based on har2openapi. Requests are grouped into one document per domain, with options to turn IDs in paths into parameters, infer query, form and JSON body schemas from observed values, and merge several captures into the same operations. Optional settings extract reusable component schemas, keep multiple redacted examples, mark fields required only when every sample contains them, attach per-field observation counts as evidence and apply an OpenAPI Overlay so hand-written names and corrections survive regeneration.

Babel-based AST processor that turns obfuscated JavaScript back into readable source, with one target selected per run: javascript-obfuscator (obfuscator.io), JS-Confuser 2.x up to its high preset, sojson and its v7 variant for jsjiami.com.v7, sojson's jjencode variant, and a generic pass for unreachable code, nested blocks and constant expressions. A second, version-aware obfuscator.io target reports the encoder era it detects and returns nothing, with a reason, rather than a half-decoded program when a string-array layer cannot be read. The JS-Confuser notes list each transform it reverses and those, such as variable renaming, that destroy information and cannot be recovered.

Browser-based Vue app that restores the strings Obfuscator.io hides behind string-array lookups in JavaScript. The user pastes the obfuscated script and names its string array or decoder function, such as _0x439c; the tool classifies the calls as plain array indexing, a one-argument decoder or a two-argument RC4-style decoder, runs the script's own decoder to replace each call with its string literal, rewrites bracketed property access as dot notation and beautifies the result. The author hosts a demo at deo.sigr.io.

Airbus CERT's Rust deobfuscation engine for scripts: it parses PowerShell or JavaScript with tree-sitter, applies rules that infer the values of syntax-tree nodes and prints a simplified script. The PowerShell rules fold arithmetic, string operations, casts, -join, -replace and format operators, Base64 and UTF decoding, predictable variables and loops, and also resolve Gzip or Deflate streams and AES decryption when the data and key are in the script; the newer JavaScript rules cover literals, operators, string and array built-ins, atob and btoa, Buffer calls, predictable function calls and JSFuck constructs. The CLI can list, select or skip rules and export every rewrite step as HTML or JSON, and Python and WebAssembly bindings embed the engine, including in an online version linked from the README.

Node.js deobfuscator for JavaScript produced by Timofey Kachalov's javascript-obfuscator, also offered as obfuscator.io. It parses the sample with esprima and runs eleven stages named after the obfuscator's own, which remove injected self-defending and debug-protection code, unwind control-flow flattening and dead-code injection, restore converted literals and object keys, replace string-array calls with the decoded strings, simplify the result and recursively process code passed to eval. String-array code is detected automatically or supplied as separate files, and an Examples folder pairs original, obfuscated and deobfuscated samples.

Open-source HTTP(S) debugging proxy for Windows, Linux and macOS that sets up interception for browsers, terminals, backend runtimes, Electron apps and Android devices, then shows the full headers and body of every request and response with body decoding, inline header documentation and filtering. Its transparent proxy handles plain HTTP, HTTPS, HTTP/2 and WebSockets on one port; breakpoints rewrite live requests or responses, and a built-in client sends custom requests. This repository is the project's umbrella README and issue tracker, while the UI, server, Mockttp proxy library, Android app and desktop shell live in sibling repositories.

Browser-based workbench for deobfuscating JavaScript by hand, also hosted on GitHub Pages, that pairs a Monaco editor with step-by-step rewriting and evaluation commands instead of a one-click pipeline. Formatting commands beautify the code and, on a selection or the whole file, decode escaped strings, convert hex numbers, turn bracketed property access into dot notation and rename _0x-style identifiers to short names; evaluation commands push declarations onto a code stack, evaluate a selected expression against it and substitute JSON results, replace captured variables automatically and collapse chains of aliases. The README says the process is not automatic and expects the analyst to know JavaScript.

Go library for parsing, traversing, transforming and regenerating JavaScript abstract syntax trees, which its README presents for code analysis, obfuscation and deobfuscation. Its parser builds on goja's parsing code, a generated SWC-style visitor API supports depth-first rewriting and cloning of nodes, a resolver tracks scopes and bindings, the ext package adds node-removal, side-effect and value-inference helpers, and a generator prints JavaScript from the tree. The documentation calls it a lightweight, faster alternative to Babel that deliberately omits parent, sibling and reference maps and automated mutation helpers.

Open-source HTTP toolkit for security research, which its author aims to make an alternative to Burp Suite Pro. A single Go binary runs a machine-in-the-middle HTTP proxy backed by its own generated root CA, logs proxied requests and responses in per-project databases with search filters and scope rules, and serves a web admin interface. From that interface an analyst can hold requests and responses for manual review, then edit, forward or cancel them, or copy logged requests into a Sender module to edit and resend them.

Node.js command-line tool that unpacks JavaScript bundles produced by Browserify or Webpack back into a tree of module files, so a bundle can be read file by file instead of as one script. A JSON configuration gives the bundle type, the entry-point module and optional knownPaths that map numeric module IDs to output files or node_modules packages, and it can rewrite a minifier's renamed require identifier inline or through a variable so the output can be rebundled or run in Node. The README says it was built to learn how bundles are structured for a reverse-engineering project and that debundling is lossy: package.json settings and Webpack module names are not recovered, and minified code stays minified.

Minded Security's JavaScript deobfuscator, which Stefano Di Paola forked from esdeobfuscate in 2015, simplifies scripts by partial evaluation on an esprima AST. It folds constant and string expressions, propagates known values through variables and pure function calls, evaluates calls to built-in String, Array and Number methods and atob/btoa, and parses string arguments passed to eval back into code. It runs as a command-line tool on a file or stdin, as an Express server with a web UI and a REST endpoint, or as a browserified library.

Node.js utility for studying malicious JavaScript that runs a sample inside an emulated Windows JScript environment, with WScript, ActiveX, filesystem, registry, WMI and HTTP objects emulated and source rewriting that exposes eval calls and conditional-compilation code. Each analysis writes a results folder with the URLs requested and those that led to an executable payload, every code snippet executed (JavaScript, cmd.exe and PowerShell), files written with their types and hashes, and a list of IOCs; by default downloads are answered with simulated 404 errors so that fallback sites are revealed. Batch runs, an optional prepended file of browser-object stubs, a Docker image, a REST API and export to VirusTotal or Cuckoo support triage at scale.

breakinggood captures a website's screenshots, cleaned DOM, computed design values, images, and XHR/fetch responses, then generates a Vite, React, and Tailwind rebuild with a mock API replaying observed JSON. Its CLI and MCP server expose site capture alongside a separate Git repository setup workflow.

Facebook BitMap Codec encodes and decodes Facebook web API parameter values using the project's reverse-engineered bitmap, run-length and custom Base64 scheme. Its Python module exposes a FacebookCodec class for converting ID lists to encoded strings and back across parameters including __dyn and __csr.

DevLens Ultra is a Chrome extension for inspecting and extracting website component structure. It analyzes selected DOM elements, computed styles and framework state such as React Fiber props, then generates React JSX and Tailwind classes. An optional AI step refines selected snippets through a configured provider.

wasm-tools is a pure-Python parser and disassembler for WebAssembly core modules and Component Model binaries. It reports sections, decoded instructions, strings with memory provenance, imports, exports and static call graphs, then adds heuristic capability and risk findings in JSON.

web-crawler includes ReverseAgent for investigating website JavaScript and request signing. It hooks fetch, XHR, cookies, crypto.subtle and webpack activity in a browser, captures traffic, separates webpack modules and uses an LLM to reimplement a discovered signature algorithm in Python.

Mirrorframe captures webpages with Playwright and reconstructs their observed layout and behavior as a self-contained React app. It records computed styles, assets, motion and selected interaction states, then compares rendered nodes and replayed states against the original with image diffs.

unwebpack-sourcemap is a Python script that recovers TypeScript, JSX, and other source files from Webpack source maps. It accepts local or remote source maps and can search a web page's scripts for them.

Wirebrowser is a desktop tool for instrumenting browser JavaScript through the Chrome DevTools Protocol. It can hook functions, trace where values originate, search and modify runtime objects, and intercept or replay HTTP traffic.

Thug is a Python low-interaction honeyclient that mimics a web browser to detect and emulate malicious content. It supports the study of client-side attacks.

spy-debugger is a tool for remotely debugging pages in mobile browsers and app WebViews while capturing HTTP and HTTPS traffic. It injects weinre debugging code into HTML responses and can use its built-in proxy or an external one.

Recover one sound-pan function from instructions and constants; upstream cites 3,205 cases and a 63-byte match.

Inspect a 16-bit PC-98 DOS helper and relate its angle calculation to a pinned reconstruction and historical compiler checks.

Reconstructs Super Mario 64 DS functions as C/C++ and permitted assembly primitives, comparing compiled output with a user-supplied cartridge dump. Independent relocation-destination checks strengthen the matching gate; integration into the PC port is tracked separately.

Builds a native PC port on the existing GoldenEye 007 decompilation, with a host platform layer and assets extracted from the user’s ROM. The project documents agent collaboration, rendering comparisons, playtest scope and unresolved platform support.

Translates Super Smash Bros. Ultimate 13.0.4 AArch64 code ahead of time and supplies a Windows runtime with Vulkan/OpenGL rendering. It also reconstructs selected fighter scripts as editable C++ and compares translated/source behavior through differential and deterministic tests.

Builds Apple and Android integration around WiiCompiled’s ahead-of-time translation of Mario Kart Wii, with native graphics, input and optional Retro Rewind support. Its status and rights documents distinguish platform acceptance, unresolved device defects and game-content requirements.

Ports the existing Super Smash Bros. N64 decompilation using libultraship and Torch. The author’s earlier README describes agent-built graphics/audio comparison tools and differential debugging against emulator behavior, rather than claiming AI recovered the game from a cartridge without prior community work.

Maurice Heumann describes replacing plausible-looking agent output with compiler-based checks of reconstructed functions, relocations, data and types. The retrospective reports 99% function presence and 83% of all functions byte-exact, while keeping the reconstruction code private.

A public matching decompilation of the N64 game Snowboard Kids 2, begun in 2024 with community decompilation tools. The author’s dated posts document Claude, Codex and GLM workflows, including headless one-shot loops, similarity-based function scheduling and hook-guarded, hash-checked builds, through a reported complete function match.

Translates The Binding of Isaac’s Flash AVM1 bytecode into C++ functions and supplies a native rendering/input runtime. The project reads graphics and audio from the user’s original game and documents deterministic input, headless runs and screenshot regression checks.

Reimplements a Total Annihilation-compatible strategy-game engine in Go, with public file-format research and separate gameplay profiles. It distinguishes intended retail 3.1 behavior from community-patch research and deliberate modern changes, and separates synthetic checks from tests requiring original game data.

Reconstructs the original Japanese Touhou 8 version 1.00d against its binary and original compiler, then adapts the recovered code for other platforms. Source presence, strict function matching, whole-executable identity and playable-port checks are recorded as different milestones.

Uses N64Recomp to translate Majora’s Mask into a native application and RT64 for rendering. The project separates static recompilation from source decompilation while reusing decompilation headers and selected functions for patches and enhancements.

Reconstructs readable GOAL code from the original Jak binaries and compiles it with a new GOAL compiler for modern PCs. Its workflow combines a specialized decompiler, manually supplied type information, asset extraction and an interactive development runtime.

Reconstructs the English LEGO Island 1.1 source for its original 32-bit Windows target. The project distinguishes function-comparison reports, ReproBit’s reported byte-identical retail rebuilds and ordinary developer builds; its modern portable adaptation is a separate repository.

The author uses REA’s Ghidra workflow to investigate the DOS Ski or Die binary, document Snowball War rules and rebuild that one minigame in Rust with SDL2. The public notes distinguish recovered tables and mechanics from approximations and deliberate presentation changes.

Converts the reverse-engineered Space Cadet pinball game into compilable C++ for desktop platforms. The README identifies the Windows XP executable and public PDB, a Full Tilt executable, and the work of recovering structures, naming variables and adapting the decompiled routines.

Reconstructs Super Mario 64 source for Japanese, North American, European, Shindou and iQue releases. Its build files distinguish original-ROM hash comparison from nonmatching or modified configurations, while source naming and documentation remain ongoing.

Builds an unofficial Sonic Unleashed PC port by statically recompiling Xbox 360 PowerPC code with XenonRecomp and Xenos shaders with XenosRecomp. The port adds modern display and modding options while documenting original-engine limits and remaining compatibility issues.

Provides an independent engine for playing Morrowind and an alternative editor, OpenMW-CS. It loads original game content through its own runtime and documents script and mod compatibility differences; it is an engine replacement rather than a recovered Bethesda source tree.

Translates reverse-engineered Driver 2 MIPS routines into C/C++ and uses Psy-X/Psy-Cross to adapt PlayStation interfaces for desktop systems. The project documents symbol-assisted Ghidra/IDA work alongside intentional bug fixes and gameplay changes.

Builds a modern Diablo and Hellfire port on the Devilution reconstruction, with platform support, bug fixes and optional quality-of-life features. The project documents the original symbol-assisted reconstruction and includes selected dungeon-generation and saved-game regression checks.

An essay published on REA’s site, with pinned evidence notes, describes one author’s agent-driven reconstructions of TH08, TH095 and TH04. It dates milestones from public commits and progress ledgers, separates exact-comparison and playable-build oracles, and documents a TH08 check that missed wrong floating-literal data. Project results remain author-reported, and REA is credited with supplying analysis evidence, not the reconstructions themselves.

The author’s REA fork, posted as rea-engine and since renamed RE-Agent, decompiles the shipped .NET executable of the GPL-licensed TicTacToe-AI game, recompiles the recovered C# and resources, and repairs one decompiler error against the original IL. A differential probe runs original and rebuilt code on all 19,683 board assignments for one status method and compares six form renders. The report passes only that method; the whole game remains partial.

The author uses a pinned REA build with Ghidra to analyze a user-supplied Pokémon Ultra Sun base executable, rebuild it byte for byte from split objects, and swap in two small compiled C runtime routines. Both replacements are behavior-tested but nonmatching and every other byte stays original; one recorded input movie drives the original and hybrid builds to the same bedroom movement in the Azahar emulator. Retail compiler identity, exact matching, module loading and broader gameplay remain open.

The author has Codex use REA’s Ghidra tools to inspect the English DX-Ball 1.07 executable and recover it as typed C/C++, then compiles each function with the original-era Visual C++ 4.0 and compares it byte for byte with the original after mapping relocations. The same source also builds a MinGW Windows game and a portable core library. Exact reconstruction is still in progress; REA’s separate sound-pan showcase covers just one function.

Reimplements Resident Evil 2’s PS1 game rules in a native Nintendo DS engine, with converters that turn data from the user’s own disc into DS formats. A helper wraps the PS1 executable as an ELF for REA’s Ghidra lane, analysis notes name the PS1 functions and tables each part follows, and the Reddit post linking it credits REA and Claude Code. Leon’s disc 1 is reported playable, while Claire’s disc, most enemy types and some menus remain unfinished.

Rewrites Minecraft: Java Edition 26.3 as a native Rust client, dedicated server and launcher that prepare their resources from the user’s own copy of the game. Contributors are told to read the vanilla code first, and tools/rea_vanilla.py runs a pinned REA release with a headless JADX engine over the shipped client and server jars to inspect classes, methods and callers. Differential harnesses run Java oracles against the real game and Rust probes against Horizon; README reports all 281 passing, which covers only what they compare.

An author-documented REA/Ghidra investigation of the shipped Untangle Windows binary produces a single-page playable rebuild and a claim-by-claim grading receipt. The report separates frozen findings, a later source-code answer key and a prior-knowledge audit.

A C++20 reimplementation of Battlefield 2’s Refractor 2 engine reads original game data and documents menu rendering, level loading and server interoperability. Published crosshair research cites REA/Ghidra evidence IDs and binary addresses; major gameplay systems remain unfinished.

A native Linux and browser port of Commander Keen Episode One is documented as a function-by-function REA/Ghidra reconstruction of KEEN1.EXE. Published analysis artifacts accompany the C/SDL2 game; the scope is the first episode, rather than the entire series.

A documented REA/Ghidra investigation maps SA-MP 0.3.DL-R1 client subsystems to a new C++ DLL, loader and smoke-test executable. The result is an architectural reconstruction with explicitly unresolved network and graphics behavior, not an established retail-compatible client.

A Swift/macOS and JavaScript/browser port recreates the Desktop Games screen-smashing toy from a captured image. The author documents Claude and REA/Ghidra work on the Peter interpreter, a decompiled program tree and extracted assets, with explicit visual differences and no project license.

A Rust/Bevy port reads GunZ: The Duel files from the user's installation and provides native releases, browser build tooling, screenshots and a documented REA/Ghidra investigation framework. Its LAN protocol and inferred movement behavior remain distinct from retail-server compatibility and proven gameplay parity.

An essay on REA’s site by N0zoM1z0 (13 October 2026) uses dated Touhou reconstruction commits to ask whether exact function matching needs a larger general model, a compiler-specialist model or better retrieval. It walks through TH09, TH095, TH04 and TH08 cases where later GPT-6-series sessions closed stubborn matches, and the TH08 audit that found accepted functions with wrong floating constants. Specialist and reinforcement-learning comparisons are proposed as future experiments; no trained specialist was evaluated.

sh23ds rebuilds Silent Hill 2: Director's Cut as a native C engine for Nintendo 3DS using the player's PC game data. Game logic, camera, lighting and events were reconstructed from the PC executable; the research notes report analysis with Ghidra and REA. The author reports a complete playthrough in Azahar, while real-console testing and some PC behaviors remain unfinished.

A native desktop reconstruction of the 2019 Switch version of Link’s Awakening using static recompilation. The author attributes most code, tooling and reverse-engineering work to Claude Code with human direction and review.

Runs Spider-Man Remastered and Arkham Knight together, streaming Gotham collision into Spider-Man’s physics world and compositing his rendered frame into Arkham. This experimental runtime bridge is not a recovered standalone game or new engine.

Reconstructs Perfect Dark’s Nintendo 64 code with a documented matching-ROM build. The project combines reconstructed source with assets from a user-supplied original ROM, then checks version-specific artifact hashes. It is a reproducible-build research case, distinct from the separate native PC port; matching results remain project-reported here.

Builds a native PC port of Super Mario Sunshine’s North American release from a pinned matching-decompilation fork, adding a host platform layer for graphics, disc, audio, input and OS services. The fork’s README says AI was used extensively to reconstruct and match its code; the port documents scripted regression hashes and lockstep comparisons with retail captures. Functions that do not yet match can still behave differently from retail, and the game must come from the user’s own disc image.

Recreates a C source base for The Legend of Zelda: Majora’s Mask from information in the game and static or dynamic analysis, then rebuilds the US Nintendo 64 ROM. The build takes assets and assembly from a user-supplied ROM and checks the output against stored MD5 checksums. The team states it will not produce a PC port; the separately curated Zelda 64: Recompiled only credits it for headers and some functions.

Reimplements the neural-rendering network of NVIDIA’s DLSS 5 library as Vulkan compute shaders for AMD RX 9000 (RDNA4) cards and supplies it to games through an NGX-compatible core and ReShade or Vulkan-layer routes. The weights are not distributed: installers extract them, hash-checked, from the user’s own nvngx_dlssnr.dll 310.9.16 or 310.8.0. The project compares its output with NVIDIA’s DLL on an RTX 5090 and reports close, not bit-identical, pictures.

Reimplements part of Breath of the Wild’s Switch v1.5.0 main executable in C++ and checks each function against the original machine code. The project calls itself a hybrid decompilation/reimplementation: it contains no assets, its ELF holds only reimplemented functions and cannot run the game, and porting is an explicit non-goal.

Reconstructs C++ source for The Legend of Zelda: Skyward Sword’s Wii main.dol and REL modules, starting from the user’s NTSC-U 1.0 (SOUE01) disc files. Objects marked matching are compiled from source and linked with objects split from the original, and the result is checked against SHA-1 hashes; the repository ships no assets or assembly and is not a port.

Builds native Windows, Linux and macOS versions of The Legend of Zelda: Majora’s Mask from an adapted copy of the zeldaret/mm decompilation, with libultraship reimplementing N64 SDK functions. Game data comes from a user-supplied ROM and is packed into an archive that custom asset packs can override. It targets a playable PC port with enhancements, not a byte-identical ROM.

Builds Ocarina of Time as a native PC application from the OoT decompilation’s source, with libultraship standing in for the N64 libultra SDK and DirectX 11, OpenGL or Metal rendering. No game assets are shipped: they are converted from the user’s supported ROM into an .o2r archive, and the port adds save states, alternate and custom assets and other enhancements.

Recreates a C source base for The Legend of Zelda: The Minish Cap from information in the game and static or dynamic analysis, building five Game Boy Advance ROMs: USA, EU, JP and two demos. Each version takes its assets from a user-supplied original ROM, and normal builds check the output’s SHA-1 hash. The project remains a work in progress, and some parts of the ROM may not yet be shiftable.

Recreates a C source base for Ocarina of Time that rebuilds 16 Nintendo 64, GameCube and iQue Player ROM versions, using information from the game and static and dynamic analysis. Assets come from the user’s own ROM and each default build is checked against that version’s MD5; README states the project is not producing a PC port and still calls the repository a work in progress.

Disassembles Star Fox’s 65816 and SuperFX code from runtime coverage and recursive descent, reassembles it into the original ROM, then translates it statically to C on a from-scratch SNES runtime for Windows, macOS and Linux. Code never reached in recorded sessions, and RAM code that no longer matches the ROM, falls back to an interpreter; the README reports identical per-frame hashes for both paths. The generated C is a mechanical translation rather than hand-decompiled source, and results remain project-reported.

Rebuilds Star Fox 2 from a coverage-seeded 65816 and SuperFX disassembly that reassembles to the original ROM, then translates it statically to C for native Windows, macOS and Linux builds. Unreached code and RAM code that differs from the ROM run through an interpreter, and the README reports identical per-frame hashes against interpreted runs. It accepts the SNES Classic release image, not the 1995 prototypes; results remain project-reported.

Disassembles every executable file on the Sonic CD disc from runtime coverage and recursive descent, reassembles them byte-identically, and translates the code statically to C on a from-scratch Mega-CD runtime that replaces the BIOS with a high-level implementation. Recompiled blocks run only where memory still holds the code they came from, and a script compares 96 stage runs frame by frame against the interpreter. The project also patches in widescreen and per-zone saves; results remain project-reported.

Recovers Virtua Fighter 2 Version 2.1’s Sega Model 2A i960 program into portable, non-matching C17, accepting each recovered path only when it matches a reference i960 executor at controlled boundaries. The repository adds ROM validation, i960 and 68000 analysis tools, a bounded Model 2A hardware model and snapshot-based differential runners. README states that it is not yet a playable port; match flow, combat, physics, AI, rasterization and much of the audio remain open.

Rebuilds Zelda II: The Adventure of Link (NES) in Rust for desktop, browser and Android by replacing the game’s 6502 routines one at a time. A built-in interpreter still runs the user’s ROM and hands ported routines to Rust, while a verifier compares RAM, sprites, palette and frames with a reference emulator. It is a behavioral, clean-room-style reconstruction guided by a community disassembly, not a decompilation or a finished standalone engine.

Builds native Super Mario 64 executables from decompiled source, extending the sm64-port fork of the n64decomp reconstruction with renderer, input, camera, save-format and external-data options. Game assets are extracted from the user’s own ROM at build time. It is a non-matching enhanced port, not a byte-identical ROM reconstruction.

Builds Super Mario 64 as a native PC, Switch and Android program by compiling decompilation-style game source against the libultraship platform library. A bundled extractor converts the user’s US or Japanese ROM into an O2R archive at first launch or build time. The project ships modern renderers, configuration menus and mod-archive loading, not a matching ROM.

Reconstructs Super Mario Sunshine’s C++ source so that the original Metrowerks compiler reproduces byte-identical object files for four GameCube releases and the Switch 3D All-Stars build. The target binary comes from the user’s own disc image, and objdiff compares rebuilt objects function by function. The work is incomplete, and the repository publishes contribution rules for AI agents alongside its human workflow.

Reimplements Twilight Princess as a native application for desktop and mobile platforms, building on the zeldaret/tp decompilation and the Aurora GameCube/Wii compatibility layer. It runs from the user’s own disc image with no bundled assets and aims to stay accurate to the original while adding options, enhancements and mods.

Started in 2015 as a reverse-engineered reimplementation of the Metroid Prime engine, Metaforce has been rewritten on top of the PrimeDecomp matching decompilation. Its native app compiles that game code as non-matching C++ for desktop and mobile through the Aurora GameCube compatibility layer and loads a user-selected disc image. The README says builds are unavailable while the rewrite stabilizes.

Extends the doldecomp Super Mario Sunshine decompilation to the North American GMSE01 release. The README says AI was used extensively, and the repository’s agent rules, work order and progress files describe batch-based Claude and Codex orchestration. Its rebuilt DOL is reported byte-identical, but unfinished objects are still linked from code extracted from the user’s disc.

Uses N64Recomp to statically recompile the US Nintendo 64 release of Donkey Kong 64 into a native port, with RT64 as the renderer. The port is not built from decompiled source, but borrows headers and some functions from the in-progress DK64 decompilation for patches and enhancements. Its recompiler configuration reads a checked-in symbol dump and the ROM rather than a decompilation ELF.

Reconstructs Twilight Princess source that compiles back to binaries identical to the originals, building GameCube, Wii and Nvidia Shield releases from one codebase through conditional compilation. README reports the GameCube code as completely matching but not every translation unit linked yet, with Debug and Wii alignment ongoing; the repository ships no assets or assembly and will not produce a port.

Recreates C source for Castlevania: Symphony of the Night from its PlayStation, PSP and Saturn binaries, aiming for code that compiles byte for byte to the original game files. The work-in-progress build combines decompiled code with assets and assembly extracted from a user-supplied disc image, then checks per-version SHA-1 hashes. Native PC experiments in the same tree are documented as unfinished and are not a released port.

Adapts the LEGO Island decompilation into a portable build for desktop, mobile, console, DOS and Web targets. Windows-only subsystems are replaced with SDL3, miniaudio, iniparser and a custom Direct3D Retained Mode re-implementation, while core gameplay is meant to stay unchanged. It ports reconstructed source rather than checking byte-identical binaries, so it is distinct from the exact-rebuild decompilation case.

Ports the original PlayStation Crash Bandicoot game code to C function by function; its coding standard labels functions with the addresses of their original implementations. Only the PC build, using OpenGL, SDL2 and FluidSynth, currently works; it loads asset files from the user’s game disc and is only partially playable.

Compiles the PrimeDecomp decompilation of Metroid Prime’s game and engine code as native C++20 for Linux, Windows and Android, with an experimental macOS build. Aurora supplies the GameCube SDK compatibility layer and rendering, and the port reads a user-supplied disc image at run time. The author states that parts were written with AI coding assistants under their oversight.

Reconstructs source for The Wind Waker’s GameCube executable and REL modules across the USA/Korea, PAL and Japanese releases and a Japanese kiosk demo. Matched units are compiled from source and linked with objects split from the user’s disc, then checked against per-version SHA-1 hashes; the repository ships no assets or assembly and covers the GameCube game, not the HD remaster.

Reconstructs Sonic Mania’s game code in C and builds it with the separately decompiled RSDKv5 or RSDKv5U engine for Windows, Linux, Switch and Android. Assets must come from an official Sonic Mania (Plus) release; the project adds a mod loader and can build several retail versions. Its license describes the code as mostly functionally the same as the original, not byte-matching.

Statically recompiles the North American PlayStation release of MediEvil into C# with the RecompOne recompiler and runtime. The runtime stands in for BIOS, GPU, CD-ROM and other hardware services, and project patches change rendering, widescreen and terrain behavior. README stresses that this is a recompilation, not a decompilation, and labels it an open beta.

A Windows launcher that uses the PSXRecomp recompiler and runtime to translate the user’s Crash Bandicoot 2: Cortex Strikes Back disc to C and compile it locally, so the game runs as native code with an emulated PlayStation hardware layer. The repository holds the launcher, a patched vendored runtime and a long bring-up log; it distributes no game code or data.

Reconstructs Super Mario Galaxy’s Wii code as C++ that rebuilds, object by object, against main.dol files extracted from the user’s own Japanese, North American, PAL or Korean disc. Matched objects are linked from source and checked with objdiff and a target hash. The project describes itself as a work in progress, separate from any PC port, and says it does not accept AI-generated decompilation.

Statically recompiles The Wind Waker HD’s Wii U PowerPC code to C ahead of time, reimplements the Cafe OS libraries the game uses and implements GX2 graphics on Metal or Vulkan, producing native macOS, Linux, Windows and Android builds without a Cemu runtime. All game code and data are generated locally from the user’s own dump; an experimental macOS-only build can instead run functions from the separate ZeldaWWHDDecomp/wwhd decompilation.

Uses N64Recomp to statically recompile the US 1.0 Nintendo 64 release of Castlevania into a native PC port rendered with RT64. Game-specific C patches build against headers from a separate Castlevania 64 decompilation. A beta release tagged at the reviewed commit reports a working build with known issues, while the README there still describes an unfinished project.

Reconstructs the Retro Engine (RSDK) v5 and v5 Ultimate runtime, the engine that runs Sonic Mania’s game code, and builds it for Windows, Linux, Switch and Android. RSDKv5U can also run RSDKv3 and RSDKv4 games such as Sonic CD and Sonic 1 & 2. The project adds a mod loader, a shader compiler and extra Windows backends, and ships no game data.

An early reverse-engineering effort on PlayStation Crash Bandicoot 2 that converts the engine’s MIPS machine code directly into a very large C file and runs it against a modified PCSX-R emulator library for hardware I/O. Translated functions are meant to be decompiled by hand and moved into ordinary C, gradually replacing the mechanical translation.

Decompiles the US PlayStation release of MediEvil toward C source that rebuilds its main executable, game executable and 26 overlays. splat splits the user's own disc files, and the default build compares all 28 outputs with SHA-1 checksums. README describes the project as a work in progress and publishes no progress figure.

Statically recompiles the US Nintendo 64 release of Conker’s Bad Fur Day with N64Recomp into a native Windows, Linux and macOS port on N64ModernRuntime and RT64. Function names and boundaries come from a vendored, still mostly assembly decompilation, while the recompiled code is taken from the user’s ROM so unmatched decompiled C cannot change behavior. The author reports heavy use of Claude Code across the project.

Rebuilds the NTSC PlayStation 2 release of Sly Cooper and the Thievius Raccoonus as a native C++ game for Windows and Linux, running on data extracted from the player's own disc image. The README reports the full game as playable while work continues on accuracy and remaining differences from the original. It does not describe its reverse-engineering method or relate the port to the separate sly1 decompilation.

Eric S. Raymond’s terminal port of Firefighter, Eben Sprinsock’s 1985 DOS shareware game. The project history says ChatGPT 5.5 decompiled the DOS binary to Borland Pascal and translated it to Rust, after which Raymond modernized the interface and corrected a scoring mismatch. Unchanged gameplay is the author’s statement; the intermediate Pascal and any comparison runs are not published.

Compiles the C of the khdays-decomp matching decompilation for Windows x64 and supplies a native platform layer for the Nintendo DS hardware, SDK services and sound driver. README reports the whole game running without an ARM interpreter; its rendering, controls, mod support and network multiplayer are the port’s own additions. This is a decompilation-based port, distinct from the byte-matching DS reconstruction it builds on.

Compiles the decompiled C of the PlayStation 2 game ICO natively for Windows, Linux, Android, iPhone and Apple-silicon Macs, with host code standing in for the PS2 hardware and Sony libraries. No PS2 code is interpreted or recompiled, and the program reads the player's PAL disc image on first start. It is a native port of a separately byte-matched decompilation, with documented divergences and optional enhancements.

Reconstructs source code for SCUS_971.98, the NTSC-U PlayStation 2 executable of Sly Cooper and the Thievius Raccoonus, as a work-in-progress matching decompilation. Functions not yet matched are still assembled from code split out of the user's own executable, and the build checks the linked ELF's SHA-1. The result runs in PCSX2 with the original disc for assets; it is not a native PC port.

Reconstructs Pokémon Emerald for the Game Boy Advance as buildable C source, with game scripts and data kept as assembler directives. The default agbcc build produces pokeemerald.gba, and make compare checks it against the SHA-1 of the original English ROM; an optional modern-GCC build is not hash-checked. Graphics and audio sources are committed in the tree, so the documented build reads no base ROM.

Reconstructs Paper Mario’s Nintendo 64 code as C source that rebuilds the US, Japanese, PAL and iQue ROMs. The build takes assets and comparison inputs from a user-supplied original ROM, then checks each output against a recorded SHA-1. Mutable project reports list no remaining nonmatching functions, while the README still calls the decompilation work in progress; it is distinct from the PaperBoat native port.

Compiles the decompiled code of Dragon Ball Z: Budokai Tenkaichi 3 (PS2, USA release SLUS-21678) for PC on a new renderer, sound, input and platform layer rather than an emulator. The game code comes from the separate BT3-Decompiled matching decompilation, and the game's data is read from the user's own disc image. The README reports the full game loop and experimental online play and says AI helped make the project; these results remain project-reported.

Runs the Nintendo Switch release’s own aarch64 program natively on iPhone, iPad and Apple silicon Macs, rewriting only instructions that depend on the Horizon kernel and supplying its system services and the NVN graphics API on Metal. Shaders are translated offline from the user’s files, and the project adds its own touch interface and endgame features. It is a rehosting compatibility layer, not a decompilation or recompiled source.

Reconstructs C source for SCES_509.16, the PAL v2.00 PlayStation 2 executable of Ratchet & Clank (2002), with every function linked at its retail address. Functions not yet decompiled are still built from disassembly generated from the user's own executable, and the build audits functions, layout and the whole image against retail. The project documents an LLM-agent matching workflow and written build-fidelity rules for what counts as a match.

Uses N64Recomp to statically recompile the US 1.0 Nintendo 64 release of Banjo-Kazooie into a native port on N64ModernRuntime, rendered by RT64 and extended with mod support. Like Zelda 64: Recompiled, it is not built from decompiled source; a symbols repository generated from the Banjo-Kazooie decompilation supplies function names for locating code in the ROM and writing patches.

Reconstructs the English Game Boy Advance releases of Pokémon FireRed and LeafGreen as buildable C source, with game scripts and data kept as assembler directives. Default agbcc builds produce six ROM images, covering both games' 1.0 and 1.1 releases and two variants labeled switch, each checked against its own SHA-1 manifest. Graphics and audio sources are committed in the tree, so the documented build reads no base ROM.

Compiles Paper Mario decompilation sources, credited to the pmret and Paper Mario DX projects, into a native US-version application on libultraship. Torch converts the user’s own ROM into a local asset archive, and the port adds rendering backends, enhancements and archive-based mods. Desktop releases are published, while Android, iOS and web builds are documented on the development branch.

A work-in-progress matching decompilation of Halo 2 for the original Xbox: contributors write C and C++ that the period compiler, building the whole program with link-time code generation, must turn back into the retail executable's bytes function by function. The README reports just under half of the game-function bytes matched and leaves a native port for a later stage. It discloses that much of the maintainer's work runs in Claude and Codex coding-agent lanes.

Runs Diablo in web browsers by compiling a stripped-down fork of Devilution, the community reconstruction of the game’s original source, to WebAssembly behind a React front end. The fork removes the Storm, DiabloUI, DirectX and Windows dependencies and reworks event handling for the browser. It is a port built on a reconstruction and reports no matching or behavior-equivalence checks of its own.

Reconstructs the Game Boy games Pokémon Red and Blue as RGBDS assembly, with graphics and data kept as editable source files. One tree builds the USA/Europe Red and Blue ROMs, a Blue debug build and patches for the Virtual Console releases, each checked against a recorded SHA-1. It is a full disassembly rather than a decompilation into a higher-level language.

A native Windows, Linux and macOS port of Banjo-Kazooie that compiles game C sources, many tagged with their Banjo-Kazooie decompilation file paths, against libultraship, a reimplementation of the N64 SDK. Torch extracts the user’s ROM into an asset archive, and the port adds Anchor multiplayer, romhack and language-pack support and a randomizer. Unlike Banjo: Recompiled, it builds from decompiled source rather than statically recompiling the ROM’s code.

Translates Lost Odyssey’s Xbox 360 PowerPC executable with patched XenonRecomp tooling and runs the generated code on a native runtime that renders through Direct3D 12, Vulkan or Metal. Windows, Linux, macOS and Android packages import the user’s own disc data. The maintainer documents development with Claude Code and Codex CLI and records each release separately from validation and acceptance.

A matching decompilation of Super Smash Bros. Melee's US 1.02 release (GALE01) that rebuilds main.dol from C with the original Metrowerks compilers and checks it against the retail SHA-1. decomp.dev reports the code fully decompiled and linked at the reviewed commit, and the README says current work is mostly naming and cleanup. Because the build can be shifted, a separate non-matching mode lets modders add code to a DOL run with their own disc dump.

Reconstructs the Game Boy Color game Pokémon Crystal as RGBDS assembly, with graphics, maps and data stored as editable sources. One tree builds the international 1.0 and 1.1 releases, the Australian release, two debug builds and a Virtual Console patch, each checked against a recorded SHA-1. Companion documentation covers script command formats and known bugs in the original game.

Rebuilds the US Nintendo DS releases of Pokémon HeartGold and SoulSilver from a work-in-progress disassembly in which part of the code has been decompiled to C. Each default build checks the ARM9 and ARM7 binaries, the filesystem and the complete ROM against per-game SHA-1 manifests. README warns that, because decompilation is incomplete, edits that change code or data layout can crash the game.

Recompiles the user’s Final Fantasy Tactics Advance (USA) Game Boy Advance ROM ahead of time into native code for Windows, Linux and Steam Deck, building on JRickey’s gba-recomp toolkit. ARM and Thumb code is translated to C and compiled locally, while a Rust runtime models the console’s graphics, sound, DMA, timers and BIOS calls. The port adds widescreen, zoom, fast-forward and remappable controls.

Statically recompiles the North American PlayStation release of Castlevania: Symphony of the Night into C# with BlackLabelHQ’s RecompOne, whose runtime simulates the BIOS, memory-mapped I/O, GPU and CD-ROM so the game runs natively without a console BIOS. Per-overlay function maps and patches add widescreen, quality-of-life, randomizer and cheat features. References from the SOTN decompilation help name functions, but the project stresses that it is a recompilation, not a decompilation.

Statically recompiles the x86 code of The Lord of the Rings: The Two Towers (Xbox, USA, 2002) into C with the bundled xboxrecomp toolkit, producing native Windows, Linux and experimental macOS builds. The recompiled sources are generated locally from the player's own default.xbe, and game data comes from their disc image or extracted folder. README reports the game as fully playable, with visual, frame-rate and mod issues listed.

A beta Windows build of Super Smash Bros. Melee (NTSC 1.02) with two engines: a source port that compiles the doldecomp decompilation as a native library, and a static recompilation that translates the retail DOL's PowerPC code and Slippi's Gecko codes into C++. Both run on a native runtime with Direct3D rendering, unlocked display rates and natively implemented Slippi rollback play. The user's own ISO supplies all game data, and the README says the work was AI-assisted.

Reconstructs the Game Boy Advance games Pokémon Ruby and Sapphire as C source built with pret's agbcc compiler, alongside assembly data scripts and editable graphics. Matching builds cover the English 1.0, 1.1 and 1.2 revisions, debug builds and the first German editions, each checked against a stored SHA-1. A separate modern-GCC target is not expected to match.

Builds on shao113’s matching decompilation of PlayStation Vandal Hearts, adds a Japanese matching tree, and carries both through to a native Windows and Linux port. SDL2, OpenGL or Metal and OpenAL backends replace the console’s GPU, GTE, CD-ROM/XA, SPU, MDEC and pad interfaces, and one executable runs the USA, Asia and Japan discs. The matching builds are still checked on every change; PC-only features such as Tactical Mode and HD packs are opt-in.

Reconstructs the US Nintendo DS release of Pokémon Platinum as C source that rebuilds revision 1 by default and revision 0 on request. The default make target runs Meson checks of the code binaries, filesystem and complete ROM against SHA-1 manifests. README still calls the project work in progress; its contributing guide says the code is entirely C but much of it remains obfuscated, leaving documentation and tooling as the main work.

An unofficial native Windows port of Saints Row (Xbox 360, 2006) that statically recompiles the game's PowerPC executable to C++ for x86-64 with the ReXGlue SDK, which also reimplements the console's kernel, GPU (on Direct3D 12), audio and input. A recompiler manifest, game-specific function overrides and an SDK patch make the result run, and each user builds it locally from their own disc. The README reports the game fully playable with built-in co-op and lists known issues.

Builds native 64-bit Windows and Linux executables of Pokémon Platinum from a fork of pret’s decompilation, replacing NitroSDK with the author’s libntr libraries; the same tree keeps the DS ROM build and an experimental Switch target. README says the game should be playable from start to finish but may crash or show graphical bugs. Prebuilt binaries require the player’s own US ROM, and the fork’s default build no longer runs pret’s checksum tests.

Ports the PS2 game Fatal Frame to native PC builds without emulation; its repository description names the Himuro decompilation as its basis. Stubs replace PS2 kernel calls and a new SDL3-based layer handles rendering, audio and UI, while game data comes from the user’s own disc. The README calls the port very early work and publishes no matching or fidelity checks.

Uses N64: Recompiled to statically recompile the US 1.1 (Rev A) Nintendo 64 release of Star Fox 64 into a native port for Windows, Linux and macOS, rendered with RT64. Its patches and enhancements draw on headers and some functions from the separate sf64 decompilation, but the port is not compiled from that decompilation's source. The README reports high-frame-rate, widescreen and mod support, with assets loaded from the user's own ROM.

Reconstructs much of the NTSC-U PlayStation 2 executable of Syphon Filter: The Omega Strain as C; with the remaining functions kept as split assembly, the build reproduces the retail SCUS_972.64 byte for byte. Committed objdiff reports track per-function matching against the user’s own executable. This is a matching-decompilation case, not a PC port; progress figures remain project-reported.

Runs Animal Crossing’s decompiled GameCube C code natively on 32-bit x86, replacing the GX graphics API with an OpenGL 3.3 translation layer and console services with SDL2-based platform code. Game assets are read at startup from the user’s own disc image instead of being shipped. It is a port built on ACreTeam’s ac-decomp, not a matching rebuild of the original executable.

Reconstructs GoldenEye 007’s Nintendo 64 code as C source that rebuilds the US, Japanese and PAL ROMs. Assets come from a user-supplied US ROM, with Japanese and PAL differences taken from their own ROMs, and the default build compares each output with a recorded SHA-1. The README still calls the project work in progress, while a mutable status page reports all 208 files done; it is distinct from the separately curated PC port.

A native PC port of Star Fox 64 that compiles the game's decompiled C code against libultraship, an N64 porting library that reimplements libultra and renders through Fast3D. On first run it uses the Torch tool to turn the user's US ROM into an asset archive, and it ships for Windows, Linux, macOS and Switch. The README of the separate Starfox 64: Recompiled static recompilation calls this port its sibling, built with different technology.

Extends the Crash Team Racing: High Octane sourceport, which derives from the CTR Native port of the CTR-ModSDK PlayStation decompilation, into Windows and Linux builds with a native 3D renderer, selectable aspect ratios and frame rates up to 240 FPS. The decompiled game code still assumes 32-bit pointers and loads assets from the player’s own NTSC-U disc image. Renderer, timing and option tests exist, but device coverage and fidelity remain project-reported.

Builds a native Windows x64 port of The Darkness by translating its Xbox 360 executable to C++ ahead of time with a patched XenonRecomp. A D3D11 renderer draws from the engine’s original geometry, shader sources and device state instead of interpreting console GPU packets. Gameplay coverage and Linux results are project-reported, and the author discloses OpenAI Codex assistance.

Statically recompiles the US Nintendo 64 release of Mario Kart 64 into a native Windows, Linux and macOS application with N64Recomp, rendering through RT64. The README distinguishes this from a source port: game code is translated from the user’s ROM, while headers and some functions from a decompilation fork support patches and enhancements. Enhancement, fidelity and input-lag claims are project-reported.

Reconstructs Animal Crossing’s GameCube code as C and C++ source that rebuilds the USA release’s main executable and its foresta.rel module. The dtk-template build reads the original binaries and assets from a user-supplied disc image, then checks both outputs against SHA-1 hashes. A separate native PC port builds on it; completeness figures remain project-reported here.

Reconstructs the ARM9 program and overlays of the EU Nintendo DS release of Kingdom Hearts 358/2 Days as C that recompiles byte for byte with CodeWarrior. README reports all 306 modules byte-identical, with about 99.5% of functions in real C and library assembly counted separately; the ARM7 binary is outside its scope. The repository holds no ROM, game assets or extracted disassembly and produces no playable build.

Ports Tony Hawk’s Pro Skater (PlayStation, USA) to native Windows and Linux builds from a fork of an in-progress matching decompilation of the retail executable. The decompilation recompiles reconstructed functions with a Psy-Q toolchain and compares them byte for byte with the user’s retail executable, while the port replaces PlayStation hardware and libraries with SDL2 and OpenGL services. Play needs the user’s own disc image; matching and gameplay results remain project-reported.

Reimplements P.T.’s game logic in C++ on a new Vulkan engine that reads levels, models, textures, sounds, scripts and cutscenes from the user’s own PS4 copy at run time. The author documents reverse-engineered file formats and used the shadPS4 emulator as a behavior and frame reference. Fidelity to the original is author-reported, and the use of AI coding tools is disclosed.

Builds a native Mario Kart 64 port for Windows, Linux, macOS and Switch from source that keeps the Mario Kart 64 decompilation’s file layout, running on libultraship’s reimplemented N64 SDK. Its bundled Torch extractor converts the user’s US ROM into an asset archive, and the port adds mods, custom tracks and an editor. The README does not name its upstream decompilation, and no matching or fidelity checks are published.

Reconstructs the ARM9 game code of Animal Crossing: Wild World’s Korean DS release as one C or C++ source per function, checked against the user’s ROM with the original Metrowerks compiler and linker. Each function also has a readable Clean rewrite, and an included DS interpreter compares the ROM code, natively compiled sources and rewrites on recorded play. Data sections, the ARM7 binary, the linked SDK libraries and regrouping into original source files remain outside the reconstruction.

Translates the Xbox 360 release of Peter Jackson's King Kong into native Windows code with the ReXGlue static-recompilation SDK, adding a launcher and display, control and graphics options. Project code completes streamed disc reads the way the console does, which README credits with getting past an opening freeze seen under Xenia. The author discloses that the port was made almost entirely with Claude Code, directed and tested by the repository owner.

Reconstructs Mario Party 4’s GameCube main executable and REL modules as C source that rebuilds both USA releases. The build analyzes the user’s own disc image and checks every linked output against version-specific SHA-1 lists. PAL and Japanese work is stale and no PC port exists yet; matching results remain project-reported here.

Translates the Xbox 360 executable of Need for Speed: Most Wanted (2005) into native C++ with a patched XenonRecomp and runs it on a project runtime that stands in for the console’s kernel, Xenos GPU, XMA audio and controllers. Releases target SteamOS, Linux and Apple silicon Macs, with an experimental iPhone and iPad build, while all game data comes from the player’s own US disc. Rendering and frame-pacing improvements are project-reported.

Rebuilds the USA/Europe Game Boy Advance release of The Sims: Bustin' Out byte for byte while gradually replacing ROM regions with matching C compiled by agbcc. The README calls it an AI-driven experiment in which almost all code, analysis and tooling are AI-generated. Most of the ROM is still copied from the user’s dump, so whole-ROM equality does not mean the game has been decompiled.

A dated research report on the Sunrise/Dawn reconstruction of the archived Destiny 2 build 86657 client, which emulates platform sign-on and the examined Bungie service contracts locally and adds reconstructed mission host policy. It records transport, decoding, object creation, presentation and gameplay results separately, and keeps superseded conclusions with their cited sources. It documents the case rather than shipping the runtime implementation or a recovered Bungie backend; playthroughs and native results remain project-reported.

Translates the Xbox 360 executable of WWE SmackDown vs. Raw 2011 to C++ ahead of time with ReXGlue and builds it as a Windows program on a Vulkan runtime derived from Xenia. A hand-maintained manifest adds function entry points the automatic pass misses, and project patches address frame pacing, a music-player delay and pipeline stalls. Exhibition play is author-tested on one AMD GPU; career mode and online remain untested.

Uses N64Recomp to statically recompile the US Nintendo 64 release of Pokémon Snap into a native Windows, Linux, Steam Deck and macOS port rendered with RT64. The recompiler reads a relocatable ELF linked from the matching ethteck/pokemonsnap decompilation together with the user’s ROM, and game-side patches are modified copies of decompiled functions. The author reports building the port with Claude Code; results remain project-reported.

Builds a native Windows, Linux, Steam Deck and Apple Silicon port of the XBLA game Dead Rising 2: Case Zero by statically recompiling its Xbox 360 code with patched XenonRecomp and translating its shaders with patched XenosRecomp. A purpose-built runtime supplies a Vulkan renderer, XMA audio, keyboard/mouse input and online co-op through the author’s XenonLive service. Completion and platform results are project-reported.

Provides a C# engine for early Westwood real-time strategy games, with mods that reimagine Command & Conquer: Red Alert, Tiberian Dawn and Dune 2000. It loads the original games’ content through its own file-system, MiniYAML rules and Lua mission layers rather than running or recovering Westwood code. Gameplay and interface deliberately follow OpenRA’s own design, so it is not a faithful recreation of the original executables.

Builds a native Windows, Linux, Steam Deck and Apple Silicon port of the XBLA epilogue Dead Rising 2: Case West by statically recompiling its Xbox 360 code with patched XenonRecomp and translating its shaders with patched XenosRecomp. It shares most of its runtime with the author’s separate Case Zero port, executing the console GPU command stream on Vulkan with XMA audio and keyboard/mouse input. Completion and platform results are project-reported.

Translates the PlayStation game’s MIPS code to C with a pinned psxrecomp fork and builds Windows and Linux programs on its hardware-modelling runtime, with a launcher and a game-specific plugin. Without patching game code, the plugin adds 16:9 matches, 60 FPS by raising the emulated CPU clock and rescaling movement, intro skipping and unlocks. The user’s own NTSC-U disc image is required, and the measurements are author-reported.

Re-implements RollerCoaster Tycoon 2, originally written in x86 assembly, as a C++ engine that runs on the original game’s data. It loads RCT2 saves and scenarios, and RCT1 scenarios when those files are present, while saving to its own documented park format. Modern-platform support, interface and AI changes, higher limits and multiplayer are deliberate extensions, not reproductions of the original.

Reconstructs C++ source for the Windows executable of Touhou 6: Embodiment of Scarlet Devil version 1.02h, aiming at an exact rebuild with the original Visual Studio .NET 2002 and DirectX 8 toolchain. reccmp and objdiff compare the rebuilt binary with the user’s original executable function by function. The committed progress badge reports every function implemented but 98.03% byte accuracy, so whole-binary identity is not claimed.

Packages a psxrecomp static-recompilation project for Driver (PlayStation, USA) as a setup host: releases carry the recompiler, runtime and a recomp-ui launcher, and the player’s machine generates and compiles the game from the user’s own disc image. The repository holds configuration, Ghidra-derived function seeds and release automation rather than game code. Its documented status is thin: an operator-confirmed private build reaches gameplay, while package release gates remain open.

Reconstructs Fatal Frame’s PS2 executable as C for the US, EU and Japanese releases, built with the original EE-GCC 2.9 toolchain and checked by SHA-1 against the user’s own executables. Committed objdiff reports list the US and EU code as fully matched and the Japanese code as partial, and a few routines still rely on assembly or byte patches. Porting to modern hardware is a stated later goal, not part of this repository.

Lifts the original Xbox executable of Dead or Alive Xtreme Beach Volleyball to C with a fork of xboxrecomp and links it with a hand-written runtime that replaces kernel imports, audio and key Direct3D 8 and DirectSound APIs. Setup builds the runner locally from the user’s USA disc image and checks generated files against hashes in an authenticated recipe; releases carry only tools and source. Rewriting game logic as readable source has so far reached only the startup thread entry.

Compiles the reconstructed C++ source of the Japanese Touhou 8 1.00d release to WebAssembly with Emscripten, adding WebGL 2 rendering, Web Audio, browser input and IndexedDB saves behind the game’s D3D8-, DirectSound- and DirectInput-shaped interfaces. Players select their own retail DAT files locally. The web build makes no binary-exact claim and is a separate port from the curated TH08 reconstruction.

Reimplements MicroProse’s UFO: Enemy Unknown (X-COM: UFO Defense) and X-COM: Terror from the Deep as a C++/SDL engine that runs on the user’s original game resources. Game data such as items, craft, research and missions is expressed in YAML rulesets, which also carry its standard mods and a wider modding ecosystem. It is a clone that reuses original content, not recovered MicroProse code.

Recompiles the Xbox 360 version of Skate 3 into native Windows, Linux and macOS builds with a Skate-specific fork of the ReXGlue SDK. Since v2.0.0 a native Direct3D 12 and Vulkan renderer with ports of the game’s own material shading replaces emulation of the Xbox 360 GPU, which remains as a fallback. Game files come from the user’s disc image; the author calls the native renderer early and has not tested the game end to end.

Runs the PS4 Uncharted: The Nathan Drake Collection’s own x86-64 executables natively on Windows: a runtime supplies the PS4 system libraries and a shadPS4-derived Vulkan renderer executes the GPU work. The port adds a per-game launcher, resolution patches and modern upscaling, and its status table reports all three games playable with listed open issues. It is a compatibility-runtime port rather than a decompilation, and its results remain project-reported.

Reconstructs source for the original Japanese Touhou 9.5: Shoot the Bullet 1.02a executable, accepting function exactness only through reproducible byte comparison of pinned Visual C++ .NET 2003 builds against one hash-attested target. The whole program also compiles and links into a playable Windows i386 executable, while README keeps playability, function matching and whole-executable identity as separate statuses.

Reimplements the engine of Bullfrog’s 1997 Theme Hospital, with game logic in Lua and C++ for graphics, sound, movies and pathfinding, on top of the original game’s data files. The README reports that the full campaign can be completed, lists features that are still missing, and adds extensions such as high resolutions and a map editor. It recreates the game’s behaviour on original content rather than recovering Bullfrog source code.

Reimplements the Rise of Nations: Extended Edition engine as a native macOS app with a Metal renderer, a deterministic simulation, a computer opponent and a compatible BigHugeScript compiler and virtual machine, loading art, maps, rules and scripts from the user’s own Windows installation. Subsystem specifications written from Ghidra study of the symbol-bearing executable, together with JavaScript reference tools, guided a C++17 implementation built with heavy Claude Code assistance. The alpha plays tutorials and scenarios, and its bit-exactness checks remain project-reported.

Reconstructs source for the Japanese PC-98 Touhou 4: Lotus Land Story and rebuilds all four DOS programs, MAIN.EXE, OP.EXE, MAINE.EXE and ZUN.COM, with a pinned Borland toolchain under Wine. Function acceptance against the original binaries is tracked separately from emulator replays that compare inputs, RNG, object pools and video with the original game. Complete-campaign, original-timing and byte-identity goals remain open.

Runs the PS4 inFAMOUS Second Son’s own x86-64 code natively on Windows and Linux: a runtime reimplements the PS4 system libraries the game uses, and a shadPS4-derived core translates its GPU commands and shaders to Vulkan. The project reports a playable, in-development port that reaches gameplay and the first chapters, with unstable performance and remaining graphics glitches. It is a compatibility-runtime port rather than a decompilation, and its results remain project-reported.

Reimplements BioWare’s Aurora engine and its later derivatives as a portable C++ engine that runs on the user’s installed game data, targeting nine games from Neverwinter Nights to Dragon Age II. Resource management, many Aurora file formats, graphics and sound are in place, and every target shows partial in-game areas in a free-flying spectator mode. README states that normal gameplay is not implemented yet, so this is an early-stage engine case, not a playable replacement.

Re-implements a large part of the RenderWare Graphics middleware API as a portable C++ library that reads and writes its DFF model and TXD texture files for PS2, D3D8, D3D9 and Xbox and is meant to convert them between platforms. Direct3D 9 and OpenGL backends render the scenes, while PS2 rendering works only as a test. README names rendering GTA as its use; BSP world files are not supported.

Reconstructs C++ source for Super Mario Odyssey’s Switch 1.0 main executable and checks each function against the original AArch64 machine code with the shared nx-decomp-tools checker. At the pinned commit its function list marks 18,996 of 74,171 functions matching. The README warns that the build is not a playable game, the repository ships no game assets, and Nintendo libraries such as sead and agl come from open-ead’s separate reconstructions.

Reconstructs C source for the US 1.1 (Rev A) Nintendo 64 release of Star Fox 64 that, compiled with the IDO compiler through a static recompilation, rebuilds a ROM with the published MD5; the README badge counts all 2,951 functions as matching. Code and assets are split from the user’s own ROM at build time, and the repository contains no assets or assembly. The separately curated Starship PC port compiles this C code, while Starfox 64: Recompiled takes headers and some functions from it for its patches.

Reconstructs C++ source for Metroid Prime’s GameCube executable and its NES-emulator module so that CodeWarrior builds match the originals, across the USA, Korean, PAL and Japanese releases, with early configurations for demo discs and three Wii releases. Matched units are compiled from source and linked with objects split from the user’s disc, then checked against per-version SHA-1 hashes; the repository contains no game assets or assembly. The separately curated Metaforce and Metroid Prime Port build their native ports on this code.

C# server emulator for the 2015 Steam client of Batla 3D, covering HTTP account, shop and room services and Lidgren UDP gameplay. It includes a client-assembly patcher and protocol notes that distinguish recovered client evidence from emulator rules.

Decompiles Retro Engine (RSDK) v4, the engine behind Sonic the Hedgehog and Sonic the Hedgehog 2 (2013), together with the games’ natively coded menus, and builds it for Windows, Linux and Android. The engine runs the game scripts contained in the official releases’ data files, which users must supply. The project adds a script compiler, a mod loader and an experimental online mode for Sonic 2’s 2P VS; it is the predecessor of the same group’s RSDKv5 decompilation.

Re-implements Rockstar Games’ Grand Theft Auto III (2001) as a cross-platform C++ engine that runs on the data of a legitimate PC copy. It has its own loaders for the game’s RenderWare models, textures and archives, a script machine for the original mission scripts, and an optional Qt data viewer. Playability is partial: the project’s mission tracker marks six early Portland story missions as completable.

A Rust/Bevy reconstruction of Call of Duty 4 multiplayer systems, using assets from a local game installation. Source covers menus, local bots, movement and combat, and connects custom relay-based netplay to the game.

Zig libraries reconstructing Diablo II 1.14d seeded maps, item generation, saves, simulation rules and network formats. Selected components expose native and WebAssembly interfaces; verification notes distinguish retail map comparisons from weaker subsystem evidence.

Pairs reconstructed DOS sources with native ports of Ultima Underworld I and II. The upstream documents Exhume-based byte-matching builds, routine-level comparisons and recorded-session replay against DOS.

Provides an SDL3 backend for a portable-C reconstruction of the 1994 DOS game. Its build configuration links the reconstructed engine to video, input and audio adapters; the upstream documents differential gates against original machine code.

Documents an agent-assisted reconstruction of the USA PlayStation game with a pinned compiler and whole-binary SHA-1 gates. The verification recipe covers the main executable, resident engine and disc-loaded code modules, with explicit library and assembly exceptions.

A matching decompilation of the original Nintendo 64 Snowboard Kids that rebuilds SHA1-identical North American and Japanese ROMs from a user-supplied ROM. The author’s 84-day post-mortem describes coding agents run through his Nigel harness alongside m2c, the permuter and a shared file of compiler learnings, and declines to credit LLMs alone for the speed-up. It is a separate project from the Snowboard Kids 2 decompilation.

Macabeus’s dated study describes prompting Claude Sonnet 3.5 and DeepSeek R1 with assembly, similar decompiled functions and structs to write matching C for Marun, one enemy module of the community Sonic Advance 3 GBA decompilation. The resulting pull request replaced that module’s assembly and was merged; the author calls the setting unusually AI-friendly, and the project now bars LLM-origin contributions.

Reconstructs as C the firmware of the Pokéwalker, the pedometer accessory for Pokémon HeartGold and SoulSilver, for its Renesas H8/38606 microcontroller. With artwork from the user’s retail firmware image and a supported Renesas compiler suite, the README reports a byte-identical rebuild of the 48 KiB image; without that image, original placeholder art gives a non-matching reference build. The author describes disassembling and decompiling the retail binary, the HeartGold/SoulSilver ROMs and the candidate compilers, alongside published hardware research.

A work-in-progress decompilation of the Wii Menu, the console’s System Menu (IPL), targeting version 4.3 in its USA, European, Japanese and Korean builds. It recovers the menu’s own code together with the Revolution SDK, NintendoWare (NW4R), EGG and middleware libraries linked into it, matched unit by unit against the original executable with decomp-toolkit and objdiff. The repository holds no assets or assembly; a build needs the user’s own Wii Menu WAD and yields only main.dol.

Decompiles sead, the C++ standard library that Nintendo statically links into its first-party games, covering containers, heaps, strings, math, file devices, threads, the game framework and graphics. Compile-time presets target the recent versions used by Breath of the Wild, Super Mario Odyssey, Splatoon 3, Tears of the Kingdom and Super Mario Bros. Wonder, and game decompilations such as Breath of the Wild pull it in as a submodule. Names come from debugging symbols and assertions in retail titles, and the README warns that many inlined and templated names are guesses.

Rebuilds the Japanese Nintendo 64 release of Animal Forest (Dōbutsu no Mori) from C code reverse-engineered from the ROM, combined with assets and assembly extracted from a user-supplied ROM. Default builds compare the uncompressed and recompressed ROMs with stored MD5 checksums. The README rules out use as a port base or for commercial purposes, and decomp.dev reported 18.52% of code matched at the reviewed commit.

Recreates C++ source for The Legend of Zelda: Phantom Hourglass by hand-decompiling its European and US Nintendo DS releases, using the dsd toolkit to delink code from a user-supplied ROM and rebuild the ROM. objdiff tracks matches function by function, and the default build compares the output ROM with a stored SHA-1. The work is at an early stage: decomp.dev reported 2.82% of code matched at the reviewed commit.

Re-implements Mario Kart Wii’s physics engine in C++ as a command-line simulator, continuing stblr/Hanachan’s goal of perfectly accurate time-trial ghost replay. Each test case replays a recorded ghost through the engine and compares kart position, rotation, velocities, speed and checkpoint state frame by frame with a trace captured from the original game. It is a behavioural reimplementation of the physics only, not a matching decompilation, and has no graphical frontend.

A work-in-progress 1:1 decompilation of Mario Kart: Double Dash!! that rebuilds the GameCube main.dol of the US debug build (MarioClub_us) from C and C++ with the original Metrowerks compilers, checking it against a stored SHA-1. The build splits the binary from a user-supplied disc image, and objdiff compares objects during development. decomp.dev reported 47.09% of code matched at the reviewed commit; a European retail target is configured but marked as not working yet.

Decompiles the PlayStation 2 executable of Street Fighter III: 3rd Strike from Street Fighter Anniversary Collection into C that period Metrowerks and EE GCC compilers rebuild, then compares the rebuilt executable word by word with the user’s original. README reports the game code fully decompiled and the CRI middleware partly so. The separate 3SX native port describes itself as this project’s continuation.

A research project re-implementing the original Xbox Halo: Combat Evolved in C, one function at a time. Rewritten functions are compiled into a separate image and patched into the user’s original executable with redirects from the original implementations, so the hybrid game can be run and debugged in xemu or on an Xbox as work progresses. The project reports an early stage, and its sources document no byte-for-byte comparison with the original code.

A work-in-progress matching decompilation of Paper Mario: The Thousand-Year Door that targets the Japanese Rev 0 GameCube release (G8MJ01), rebuilding MarioSt.dol and 31 REL modules with the original Metrowerks compilers and checking each against a stored SHA-1. The build splits these binaries from a user-supplied disc image, and objdiff compares objects during development. decomp.dev reported 12.10% of code matched at the reviewed commit.

Builds Street Fighter III: 3rd Strike as native C for Windows, macOS and Linux, continuing the 3s-decomp PS2 decompilation, with SDL3 for video, input and audio and GekkoNet for rollback netplay. README stresses that it is neither a recompilation nor emulation. The port needs the player’s own PS2 game files and works toward arcade-accurate balance, which an optional Statcheck build tests against CPS3 RAM states recorded from Fightcade replays.

Reconstructs C and C++ source for the two-disc Resident Evil 4 GameCube debug prototype (G4BE08) and rebuilds main.dol and all 114 REL overlays with the compilers the README names, checking every output against a SHA-1 list. Function names are Capcom’s own from the debug build’s Bio4.sym files, and most struct and field names are aligned from the PS2 debug build’s debug information. The project’s research log says AI agents did the matching work; byte identity is project-reported.

A work-in-progress matching decompilation of Super Smash Bros. Brawl that targets the USA Rev 2 Wii release (RSBE01_02), splitting main.dol and 126 REL modules from a user-supplied disc image and checking the rebuilt binaries against stored SHA-1 values. objdiff compares objects during development, and six other regional revisions are listed but commented out of the supported set. decomp.dev reported 1.27% of code matched at the reviewed commit.

Reconstructs C++ source for Plants vs. Zombies on PopCap’s open-source SexyAppFramework, starting from an earlier community decompilation of version 0.9.9 and adding functionality reversed from the Game of the Year edition, with functions annotated by GOTY addresses. The project also modernizes the engine with current C++ and is replacing the DirectDraw and Direct3D 7 renderers with GLFW. It builds a fan executable that runs from an original game folder, aiming at a modernized, extensible game rather than an identical binary.

Reconstructs Sonic Advance and Sonic Advance 2 for the Game Boy Advance as C that rebuilds six hash-listed ROMs with SAT-R’s agbcc fork, and compiles the same code into widescreen SDL ports for Linux, macOS and Windows plus PSP and PS2 builds. README reports Sonic Advance 2 built entirely from C with about 60 functions still non-matching. Extracted graphics, music and data are committed, so the builds read no original ROM.

Rewrites code from Bloodborne’s PS4 executable (CUSA03173 with update 1.09) as readable C++, one function at a time, aiming at a native PC source port on a clean-room runtime of its own. It is a functional rather than matching decompilation: each replacement is hooked in, compared with the original machine code on recorded and generated inputs, and independently reviewed. Work is at an early stage: README reports 21 of 157,757 functions verified, and the game does not yet run on Paleblood’s own runtime.

A fan decompilation of Pikmin 2 that rebuilds main.dol for five GameCube releases (USA retail, two USA demos, PAL and Japan) with the original Metrowerks compilers, checking each against a stored SHA-1. The build reads main.dol from the user’s own copy of each release. decomp.dev reported all code matched and fully linked for every version at the reviewed commit, and a non-matching mode builds the US DOL entirely from C++ for modding.

Decompiles Gran Turismo 4’s PS2 engine executable (CORE.GT4, NTSC-U v1.01) into one C or C++ source per function for Sony’s ee-gcc 2.96, matching public libraries such as newlib and Expat from their own source. The README credits AI agents (Anthropic’s Claude) driving the project’s tools with most of the matching, each function accepted only on a compiler-and-judge comparison, and reports 95.4% of functions and 83.6% of code bytes matched for an October 2026 commit. A local full build links sources at their original addresses, fills the rest from disassembly and compares SHA-1 with the user’s executable.

A work-in-progress matching decompilation of Mario Kart Wii that targets the PAL release (RMCP01), rebuilding main.dol and the StaticR.rel module from C and C++ with Metrowerks compilers and checking both against stored SHA-1 values. The build splits these binaries from a user-supplied disc image, and objdiff compares objects during development. The README’s progress badges point to a decomp.dev page that did not resolve at review, and the default branch was last updated in September 2025.

Builds a native port of the Xbox 360 release of Forza Horizon by translating its PowerPC executable ahead of time into C++ with ShiftGlue, the author’s fork of ReXGlue, and compiling it on the player’s machine from their own disc. A renderer written for this game runs its GPU commands on Vulkan, and some translated library code, such as FMOD Ex DSP units, is replaced by independently written native code checked against the translated original. README presents it as a playable preview with rendering bugs and slowdowns.

Reconstructs C++ source for the Windows executable of Touhou 7: Perfect Cherry Blossom 1.00b and its custom.exe configuration tool, built with the original Visual Studio .NET 2002 and DirectX 8 toolchain and compared function by function with the user’s originals through reccmp. The committed progress badges report th07.exe fully implemented at 99.78% accuracy and custom.exe fully matched. The README says the game should be fully playable, but a matching build trips the game’s integrity check, and the cross-platform ports live on separate branches.

Statically recompiles the North American v1.0 SNES release of Donkey Kong Country into native Windows, macOS and iOS applications with a pinned fork of snesrecomp, which translates 65816 code to C and links it against a modelled SNES hardware runtime. Function boundaries, entry flag states and jump-table targets are ingested from a byte-identical community disassembly instead of discovered heuristically, and the game code is generated locally from the user’s verified ROM. Optional widescreen, CRT filters, MSU-1 music and a Dixie Kong Country variant are host-side additions to what the README calls a playable bring-up.

Reimplements the Grand Theft Auto: San Andreas engine in Unity (C#), loading the archives, RenderWare models and textures, collision, animations, audio, text and item definitions from the user’s own PC installation. README says it will not be a complete reimplementation; it focuses on gameplay features, multiplayer and a framework for extending and modding the game through C# plugins. Development has stalled: the newest commit on any branch dates from 2022-09-30.

Decompiles Minecraft: Nintendo Switch Edition v1.0.17, a Legacy Console Edition release, into C++ that is compared function by function with the original executable using a patched Clang 4.0.1 and the open-ead Switch decompilation tools. The README explains the choice of the Switch build for its matchable Clang toolchain and type information, with names ported from the symbol-bearing Wii U Edition. At the reviewed commit the function list marks about 11% of functions decompiled, most of them matching; the result cannot run the game.

Reconstructs C source for the US PlayStation release of Final Fantasy VII, aiming for code that compiles back to the original main executable and its game overlays. The build splits the user’s disc files with splat, compiles with period cc1-psx compilers and checks every rebuilt file against its SHA-1. A native build against the PsyZ PlayStation-library replacement is compiled in CI but is not documented as a playable port.

Statically translates the 65816 CPU code of the SNES Mega Man X (USA Rev 1) to C with the snesrecomp framework; the PPU, audio, DMA and other hardware run in the framework’s runtime, and a LakeSnes-derived interpreter executes whatever the static pass cannot prove. The C is generated locally from the user’s ROM, with function names imported from community DiztinGUIsh annotations. Playable Zero, co-op and rollback netplay, X2/X3 boss weapons and adaptive widescreen are layered on top, using assets extracted locally from the user’s own sequel ROMs.

Reimplements SimCity 4 as a Godot project in GDScript that reads DBPF archives, region folders and city saves from the user’s own SimCity 4 installation. The code draws a region view with city thumbnails and interface elements built from the game’s UI definitions, opens a saved city’s terrain and water in 3D, and includes a DAT explorer for previewing archive subfiles. It is an early, inactive engine case without simulation gameplay, not a playable replacement.

Reimplements the engine of Oddworld: Abe’s Oddysee and Abe’s Exoddus as an open-source replacement executable that runs from the user’s own game folder. The team decompiled the original executables and replaced their functions incrementally, using injected DLLs that hook reimplemented code into the patched retail executable, then rewrote the result into a standalone cross-platform engine. The project site says both games are playable in their entirety, with bug fixes and windowed, high-resolution and controller play.

Re-implements Microsoft’s Age of Empires and its Rise of Rome expansion as a cross-platform C++17 engine on SDL2 and OpenGL that loads the original game’s DRS archives and language.dll resources. README says it mimics the Windows API and the Genie engine for compatibility and reconstructs some code from the disassembly; the repository adds format notes and Python tools for inspecting the original data files. Only very basic gameplay through a multiplayer session exists so far, so it is an early engine case rather than a playable replacement.

Statically recompiles the MIPS R5900 code of the NTSC-U PlayStation 2 God of War executable (SCUS-97399) to C++ with PS2Recomp and builds it as a native Windows program. Since October 2026 the port builds on Waffle565’s runtime, which replaces the PS2 hardware with native code: VU1 microprograms and, optionally, the game’s IRX modules are compiled ahead of time, and an OpenGL renderer stands in for the GS. The repository holds only the game-specific function map, recompiler configuration, overrides and runtime patches; the README reports gameplay on the opening ship level, with sustained 60 fps and a full playthrough still pending.

Recompiles the USA Rev 1 Nintendo 64 release of Wave Race 64 into a native Windows application with N64Recomp and RSPRecomp, on modified copies of the N64ModernRuntime, RecompFrontend and RT64 stacks. Game and microcode C is generated locally from the user’s ROM, after an included widescreen patch is applied to a temporary copy, and checked against recorded checksums. The port adds higher resolutions, frame interpolation, ultrawide views, rasterized and ray-traced reflections and shadows, split-screen or separate-window two-player play and RetroAchievements; the maintainer calls it an AI-assisted recompilation.

Reimplements Jazz Jackrabbit 2 (1998) as a native C++ game on an extensively modified nCine engine, converting the user’s original game files into its own cache on first start. It runs on desktop, mobile, web and many homebrew console targets, with multiplayer, an enhanced Reforged mode and partial JJ2+ and MLLE support. A two-sided trajectory probe checks its non-Reforged movement against the original game, and the project reports 376 of 406 scenarios within 25 px/s.

Reimplements the engine of Little Big Adventure 2, and now also Little Big Adventure 1, in TypeScript, Three.js and React so that it runs in a browser on resources imported from the user’s copy of the game. README calls it a full re-engineering rather than a disassembly-based approach: every island and building can be explored and most graphics and part of the gameplay work, but the game cannot yet be completed. It adds an editor with an actor-script debugger, VR support and fan-made 3D replacement models for the isometric scenes.

Reimplements Remedy Entertainment’s Alan Wake engine, later known as Northlight, in C++ and OpenGL, aiming to run Alan Wake and Alan Wake’s American Nightmare portably from the user’s game data, with Quantum Break and possibly Control as later goals. README documents only a free camera for moving through loaded game data, and the American Nightmare script table implements 16 of its 278 native functions. The repository also includes command-line tools for the games’ archive, texture, Havok and sound formats.

Translates the 68000 game programs and Z80 sound programs of Capcom arcade boards ahead of time into C++ and runs them on a machine model written for the project, with an interpreter for code that has not been translated. One launcher covers Street Fighter Alpha and Alpha 2, Super Puzzle Fighter II Turbo, Vampire Savior and its variants, Vampire Hunter 2, Alien vs. Predator and the CPS-1 Cadillacs and Dinosaurs, adding training modes, widescreen and three-player options. Translated code is generated from the user’s own ROM sets, and a check build compares it block by block with the interpreter.

Reimplements the MAGES. visual-novel engine, used by the Science Adventure and Memories Off series, in C++ with OpenGL, running supported titles from the user’s original data files through per-game Lua profiles in one binary. README says all endings can be reached in at least one game, Memories Off 6 T-Wave, but no game is fully complete. The project’s tracking issue lists partial support for titles including Chaos;Head Love Chu Chu, Chaos;Child Love Chu Chu, Steins;Gate and Robotics;Notes Elite.

Decompiles the USA Wii U release of The Wind Waker HD function by function into readable C++ in zeldaret/tww’s style, and verifies each function by running it beside the original, statically recompiled from the user’s own copy, comparing return values, memory writes and calls on generated and recorded inputs, with coverage and mutation checks. README reports 28,244 of the game’s 39,713 functions verified, including 22,068 of 22,215 GameCube-derived functions. The code calls undecompiled functions by address, so it runs only inside the ZeldaWWHDRecomp port, not as a standalone game build.

A C#/.NET 10 engine loads Dungeon Siege's original archives, scripts and models, with published alpha builds and an audit/parity ledger. The project also provides SiegeSmith modding tools, while describing remaining fidelity and playthrough risks.

A from-scratch Rust port of the North American PlayStation Legend of Legaia includes native/browser play, asset extraction and disc patching. The author documents Ghidra/emulator research and a full-game ladder; this is a fresh implementation, not a matching decompilation or static recompilation.

Reconstructs Retro Engine v3, the engine behind the 2011 Sonic CD remaster, as a native C++ source port for Windows, Linux, macOS and Android. The engine runs the game's own scripts and assets from an official release, which the repository does not ship, and adds a mod loader, a settings file with remappable controls, support for the mobile versions' updated scripts and extra developer-menu debug keys. Its license describes the code as mostly functionally the same as the original rather than byte-matching; the same team's RSDKv5 decompilation is listed as a separate case.

Rebuilds the boot ELFs of ICO’s PAL (SCES-50760) and Japanese (SCPS-11003) PlayStation 2 discs from one source tree with the game’s original compiler versions, and checks that every loaded byte and the whole ELF file match the disc’s SHA-1. The 73 data-only archive members are generated at build time from the user’s own ELF, so most read-only data still comes from the disc rather than from source. Separate branches target the USA, Korean and August 2001 prototype builds, and the catalog’s ICO PC port is a fork of this tree.

Custom firmware for the Mario and Zelda Game & Watch consoles that patches new C code into the user's own stock firmware backups, so the original firmware runs alongside the retro-go emulator. A Python patcher hooks stock function calls, relocates and LZMA-compresses stock code and data to free flash, and can merge both models' firmware into one image. Committed symbol maps, a cross-reference mapper and an analysis-ELF builder support the reverse engineering, and a journal records the author's first firmware-patching work.

Implements a standalone runtime for Call of Duty: Modern Warfare 2 (2009) in Rust on Bevy and wgpu, loading maps, models, textures and weapons from the user’s installed game through native FastFile readers and translating its Direct3D 9 shaders to WGSL. Bots, demo recording and replay, and multiplayer over custom UDP with a QUIC master are implemented, while README warns that gameplay remains incomplete, with missing behavior, bugs and desyncs. README states that the whole project is written by an LLM; NOTICE names the community projects consulted and says the original binaries were read with Ghidra.

Reimplements Skate 3’s skating, tricks, grinds and offboard movement in a new Rust and Bevy engine that runs on assets converted from the user’s own Xbox 360 copy, adding difficulty settings and a .skate custom-map format. Physics notes cite functions and constants read from the original executable in IDA, and audio research reads traces from a research-hooks branch of a separate Skate 3 static recompilation. README says gameplay parity is still a work in progress, credits dumbad’s years of format research and states that AI coding tools were used to write the rewrite.

Reimplements the server side of Minecraft’s Alpha- and Beta-era multiplayer in Python on Twisted; its documentation calls it a reverse-engineered implementation written from scratch, credits network traffic dumps and says general Minecraft data went to a community wiki. The final 2.0 release speaks the 1.4.x client protocol for login, chunk transfer, entities, server-side inventories, lighting, physics and Anvil saves, while deliberately changing behaviour such as chunk loading and item stacking. A pluggable architecture adds terrain generation, seasons and commands, and small scripts inspect packets, NBT and region files.

Weeping of the Empire builds a native Windows port of The Legend of Zelda: Tears of the Kingdom from the user's Switch game dump. It recompiles ARM64 code ahead of time to x86-64, supplies Switch services through a host runtime and renders through Vulkan. The engine documentation credits totk-recomp as the starting point and identifies the added Windows port, renderer, controls and menus.

GTA Mode is a native plugin that adds direct control of spawned citizens and cars to SimCity 3000 Unlimited. It uses findings from Ghidra analysis of the game's binaries, GZCOM plugin loading, in-memory city structures and sprite archives. The C plugin runs in the original game, reads city data from its memory and decodes art from the user's installation; MODLOG.md records addresses, formats and dead ends.

FH2MP restores Forza Horizon 2 multiplayer with a replacement server based on protocol behavior recovered from the Xbox One game client. An in-game shim redirects sockets and web-service calls, while Python and Go servers handle lobbies, worlds and online features; a launcher manages setup and updates.

Cursed Lands reimplements the engine for Evil Islands and Lost in Astral in Godot, reading maps, models, audio, scripts and tables from the player's own game copy. Its native rendering, combat, AI, scripting and interface systems follow the original game's rules, with releases for desktop, Android and browsers.

nfs-mw reconstructs Need for Speed: Most Wanted 2005 PC v1.3 in Rust using data read from the user's installation. Its format readers decode bChunk, JDLZ, HUFF, cars, textures, and the streamed city; the current runtime provides viewers, driving, menus, and free roam.

bf-private-server recreates a self-hosted server for Brave Frontier client version 2.19.6. Its C++23 service answers the game's HTTP requests, stores saves in SQLite and works with CDN workers and a patcher for the user's Android client; request tables and boot-flow notes document the protocol investigation. The server builds on an earlier emulator fork.

OpenLF2 reimplements Little Fighter 2 v2.0a as a playable C++ and Lua engine. It loads resources from the original game installer and provides local modes, replays, mods and network matches between OpenLF2 players. The author states that gameplay compatibility is still being refined.

Atlantis Native ports the reverse-engineered CryOmni3D Atlantis engine to Rust for Atlantis: The Lost Tales and Atlantis II. It reads files from the user's own game copies and runs their scripts, panoramas, cinematics and puzzles on desktop systems and in browsers, with optional display and bug fixes.

SF2Recomp converts a user's Shadow Fight 2 Nintendo Switch game files into native builds for Linux, Windows, macOS, and Android. Its converter combines translated game code with a runtime and user-supplied assets, adding controls, graphics options, sparring, and LAN play.

dmc-recomp translates the PlayStation 2 PAL release of Devil May Cry into native PC code through PS2Recomp and a project runtime. Its pipeline rebuilds generated code locally from the user’s own game executable, while research notes and patches track boot, CD services, MPEG playback, rendering and gameplay behavior.

Sin & Punishment: Recompiled uses N64Recomp and RSPRecomp to build an experimental native C++ port from a user-supplied Japanese N64 ROM and the repository's symbol maps, with RT64 rendering. The author reports that it reaches the title screen; menu navigation, gameplay, audio validation, and a public pipeline for its patched working image remain unfinished.

scvk reconstructs SimCity 4's renderer interface as a native Vulkan DLL loaded through the game's GZCOM plugin system. It claims existing renderer class IDs and emulates the cIGZGDriver fixed-function API with pipeline state and shaders for terrain, buildings, lighting, textures and interface drawing.

Salamander UEFI ports the NES game Salamander to a native UEFI Shell application by translating its 6502 disassembly into a platform-independent C core. The repository includes a 6502 disassembler, a user-ROM resource extractor, host tests and a fidelity checklist. UEFI GOP, input and timing services replace the original console environment.

tMock-Server is an unfinished C++ reimplementation of the Terraria server's initial network flow. It uses socket code and packet classes to accept connections, check protocol versions, request passwords, and assign player slots; the README records packet IDs, fields, directions, and structures informed by traffic analysis.

NuVelocity Engine reimplements Reflexive Entertainment's Velocity Engine as a C++ and SDL3 game engine. It provides modular 2D rendering, asset and resource loading, audio playback, screen management, and a property-based object system, with decoder source included in the repository.

FreeRS42 is a C++ project to reimplement the PC game Ricochet Xtreme using the NuVelocity engine. The repository contains source for game objects, playfield behavior and screens, with a CMake build that includes the engine submodule.

DreadComp is an in-progress hand decompilation of Metroid Dread that recreates game source code in C++. The repository includes initial source files, build tooling and symbol data; building requires assets and the version 2.1.0 executable from the user's own game copy.

MTG Arena Collection Export reconstructs the Frontdoor request needed to export owned cards from Magic: The Gathering Arena. The Python client uses an account refresh token, opens a TLS Frontdoor socket, authenticates with the 2026 version 4 frame and protobuf command envelope, and requests Card_GetAllCards. A separate protocol document records the recovered wire format.

Void Client is an unfinished JavaScript rewrite of the Starblast.io browser game client based on study of its network protocol. Its current Node.js and browser components provide game-mode selection, server discovery, local WebSocket communication, and parsing and JSON export of some received packets.

OpenPigeon is a TypeScript codec for reading GamePigeon iMessage game state and encoding caller-supplied moves for eleven turn-based games. Its protocol documentation describes balloon identity, encrypted move URLs, the length-seeded cipher and the state envelope; captured-message vectors support codec tests.

Cosmo ports the reconstructed source of Cosmo's Cosmic Adventure: Forbidden Planet to macOS, Linux and Windows. It retains the game's logic and supplies an emulated EGA adapter, timer, keyboard controller, PC speaker and AdLib layer for the original code. The build uses the user's game data files.

This Left 4 Dead 2 study reconstructs the AI Director's pacing, intensity, encounter placement and music rules from an identified x86 server.dll and sanitized runtime traces. It publishes disassembly-derived findings, analysis scripts, evidence files and implementation specifications; a reference game library is in a separate repository.

MechRewired rebuilds the MechWarrior 2: 31st Century Combat experience around data imported from a user's DOS copy. Its code loads original resources and missions, while providing a new cockpit, terrain rendering and combat simulation for modern platforms.

d2mac-linux ports the Diablo II 1.14d Mac executable to 32-bit Linux by converting its i386 Mach-O container to ELF and reimplementing imported Darwin, Carbon and AGL interfaces in Zig. The shim translates graphics to GLX and adapts threading, files and sockets. The author reports that the game reaches its menu and character creation.

Spider-Man 2 PS2 Recomp applies static recompilation to the USA PlayStation 2 release SLUS-20776 for native PC execution. It combines a game-specific Ghidra function map with PS2Recomp source, runtime fixes and hardware comparison tests. The author reports that a native Windows build reaches the legal splash; the port is not playable.

touhou-engine reimplements Touhou danmaku gameplay in Python, with TH07: Perfect Cherry Blossom as its reference game. The author says its engine logic was ported frame by frame against a decompilation, while the new architecture supplies an event stream, replay handling, headless stepping, and a pygame renderer. It reads original game archives supplied by the user.

Open-source engine for classic Tomb Raider, with a WebGL build and a standalone release. Its format code defines object types for Tomb Raider 1 through 4.

Thyme is an open source reimplementation of Command & Conquer Generals: Zero Hour. It rewrites the game from the ground up and uses the original binary for functions it has not yet replaced.

Chariot is an open-source effort to reimplement the engine of the original Age of Empires (1997). It aims to support ports and enhancements; the README describes it as a work in progress with asset-loading demonstrations, not a playable game.

OpenDiablo2 is a cross-platform ARPG engine written in Go that supports playing Diablo 2. The project is being split into a separate engine and toolset, called Abyss Engine, and a game project retaining the OpenDiablo2 name.

OpenTomb is an open-source reimplementation of the classic Tomb Raider engine for playing levels from Tomb Raider 1–5 and custom TRLE levels. It is no longer maintained.

Savage Wind Recomp is an in-progress static recompilation of the Nintendo Switch version of The Legend of Zelda: Breath of the Wild for Windows and Linux. It builds native game code locally from the player's extracted files; the README reports playable early areas but says the full story remains unconfirmed.

retruxx is a reverse-engineered Hard Truck Apocalypse project that builds the game executable and separate renderer, input, and sound DLLs. Its 32-bit build matches the original game's memory layouts.

Inspect frame captures, draw calls, shaders, and graphics resources in your own game or graphics application.

Analyze Unity game files, inspect asset dependencies, and convert supported assets into Unity project formats.

Recover managed representations from Unity IL2CPP builds using binary and metadata analysis; reconstruction remains a work in progress.

Recover IL2CPP metadata and dummy assemblies, and generate helper scripts for native analysis tools; method code is not restored.

Expose existing RenderDoc captures to an agent for bounded frame, pipeline, resource, and shader inspection.

Browse and modify supported GameMaker data files, extract assets, and decompile or compile GML VM code. Includes room editing, scripted changes, a CLI, and the reusable UndertaleModLib library.

Inspect IL2CPP classes, methods, and fields in a live process, and trace or intercept method calls without supplying global-metadata.dat. Complements static IL2CPP dumpers with runtime observation.

Compare functions and data in reference and rebuilt object files to guide matching decompilation. Displays instruction-level differences, demangles C++ symbols, and can rebuild when source files change.

Randomly or systematically permutes one C function, recompiling each variant and scoring it against a target object file to search for matching compiler output. PERM macros specify manual alternatives, and the optional permuter@home mode distributes runs to other workers.

Diffs original and rebuilt assembly for one function or ROM address to guide matching decompilation; its watch mode can rerun make when sources change. The README describes it as decomp.me’s default diff viewer and points to objdiff as a modern alternative.

Explore Unreal packages through class, property, and dependency trees; decompile and export UnrealScript classes, inspect bytecode, and examine structured binary data.

Browse recognized visual-novel resource archives as folders, preview their contents, and extract images or audio with conversion to common formats.

Recover supported Godot project files, GDScript and imported resources from exported games. Includes PCK inspection and extraction, script decompilation, and resource conversion for examining and rebuilding project structure.

Inspect Unreal Engine games at runtime through live UObject property views, reflected C++ header dumps, property mappings and actor dumps. Lua and C++ APIs support experiments while reconstructing game structures.

Explore Unreal Engine game archives with CUE4Parse-backed package and property inspection, asset previews and export. The 2026 summer release adds USD world export for reconstructing supported scene content.

Translate PSP MIPS executables into C++ and WebAssembly, backed by a PSP high-level emulation runtime and WebGL2 renderer. Native tracing, frame capture and audio tools support investigating missing behavior during game porting.

Statically recompiles N64 MIPS binaries into C functions from symbol metadata, emitting function lookups and relocation macros so a runtime can handle statically linked and relocatable overlays. The output needs a runtime such as N64ModernRuntime; the repository also includes RSP microcode and mod tooling.

Converts Xbox 360 PowerPC executables into C++ that can be compiled for other platforms, with the XenonAnalyse companion detecting jump tables and function boundaries. Output is a literal instruction translation rather than decompiled code and needs a runtime that the project does not supply.

Collaborative decompilation website for matching work: its compile service builds candidate source with a selected platform compiler, assembles the target assembly and diffs the two objects with asm-differ. m2c drafts initial decompilations for its MIPS, PowerPC, ARM and SuperH platforms. The 18 platform definitions span N64, PlayStation, PS2, PSP, GameCube/Wii, Wii U, DS, GBA, 3DS, Switch, Saturn, Dreamcast and Xbox 360 plus IRIX, Mac OS X, MS-DOS, Win32 and Android x86.

Binary splitter for decompilation and modding projects: a YAML config says where and how to cut an N64 ROM or PSX, PS2 or PSP binary into code, data and asset segments. A scan phase disassembles code and data, with MIPS handled by spimdisasm; a split phase writes the files and a linker script for rebuilding the input. Custom segment types can extend the pipeline.

Decompiler for matching projects that turns GNU as-format 32-bit MIPS, ARM, PowerPC and SuperH assembly into draft C, with partial C++ support. A target combines platform, compiler (IDO, GCC or MetroWerks CodeWarrior) and language; context files supply types, and it can infer unknown struct fields and emit global initializers. The README places it alongside splat, asm-differ and decomp-permuter, and decomp.me calls it for initial decompilations.

GameCube/Wii matching-decompilation toolkit that analyzes DOL and REL executables and, from a project configuration, splits them into relocatable objects plus an ldscript.lcf for CodeWarrior's linker, so decompiled objects can replace original ones while the relinked binary is checked against the original. Analysis covers function boundaries, a Metrowerks/SDK signature database, relocations, sections and data objects, and objects are written without an assembler. Its CLI also handles disc images, archives, compression formats, CodeWarrior demangling and DWARF dumps.

Connects MCP clients to Cheat Engine through a Lua bridge script and a Python MCP server, so an agent can inspect a process the user runs under Cheat Engine: memory reads and value scans, pointer-chain resolution, structure dissection, RTTI class names, disassembly, cross-references and hardware or DBVM breakpoints. Further tool groups write memory, inject DLLs or code, automate input and use Cheat Engine's kernel-mode driver. The README limits it to educational and research use and disclaims multiplayer cheating and Terms of Service violations.

Statically recompiles the IRIX MIPS programs of SGI's IDO 5.3 and 7.1 C toolchain, such as cc, cfe, uopt, ugen and as1, into native Linux, macOS and Windows executables, so matching decompilation projects can build with the original compiler code on modern hosts. It recompiles compilers, not games: it neither decompiles nor translates game code.

Experimental static recompiler that translates MIPS R5900 code from PlayStation 2 ELF executables into C++ and links it with a bundled runtime. ps2xAnalyzer or a Ghidra export script produces a per-game TOML of functions, stubs, skips and instruction patches; ps2xRecomp emits a literal instruction-by-instruction translation; ps2xRuntime and ps2xIOP supply guest memory, syscall dispatch, IOP module execution with HLE fallbacks and partial, largely stubbed GS/VU hardware. Output is not decompiled source, and getting a game to run remains per-game porting work.

Checks a PS2 matching decompilation from outside its own build: the C is recompiled with a stock, unpatched ee-gcc 2.96 and assembler, then each function is byte-compared against the original and every difference is classified by its likely toolchain cause. Companion scripts export ELF symbol tables to CSV and convert them to splat symbol files. Defaults target Xenosaga Episode I; the README says the method generalises but the defaults do not.

Static recompiler that turns Game Boy and Game Boy Color ROMs into portable C projects: it decodes and analyzes banked LR35902 code, emits C with machine-readable metadata, and links it with a shared SDL2 runtime for video, audio, input, saves and hardware timing. Jump targets that static analysis missed fall back to an interpreter. The repository also carries differential, replay and frame and audio capture tooling, plus a Pokémon Crystal port that builds native features on hooks into the exact ROM.

Project template for starting GameCube and Wii matching-decompilation repositories around decomp-toolkit. Its configure.py generates a ninja build that analyzes and splits the game's DOL and REL files from per-version config.yml, symbols.txt and splits.txt files, compiles the decompiled C/C++ with period Metrowerks compilers, relinks the result and checks it against recorded SHA-1 hashes. It also wires in objdiff for per-object diffing, progress reporting for decomp.dev and an example GitHub Actions workflow.

Runtime for N64Recomp static recompilations and traditional source ports of N64 games, made of two libraries. ultramodern reimplements core libultra services (threads, message queues, timers, controllers, audio, RSP task handling and VI timing) and leaves controller input, audio playback and the graphics renderer, with RT64 recommended, to callbacks the host project registers. librecomp bridges N64Recomp-generated code to ultramodern and adds overlay handling, PI DMA ROM reads, and EEPROM, SRAM and Flash RAM saves.

Compiler and decompiler toolkit for REDscript, a statically typed, object-oriented language for writing scripts for REDengine, CD Projekt's engine used in Cyberpunk 2077. Its Rust crates parse and analyze source, generate bytecode with monomorphization of generics, decompile .redscripts bytecode bundles back into REDscript source, read and write REDengine's native binary format, and provide a drop-in replacement for CD Projekt's scc script compiler plus a C API with source mapping. The CLI exposes decompile, compile, lint and format commands; the language server and debugger live in a separate redscript-ide repository.

PC emulator for executing, reverse engineering and rewriting real-mode DOS programs whose source code is unavailable. While a program runs it builds a control-flow graph, and on exit it dumps memory, execution flow, Ghidra-compatible symbols and a self-contained, runnable C# project whose generated functions override the original assembly, so analysts can rewrite them function by function into readable code while the program keeps working. It also provides a GDB remote server with custom analysis commands, a built-in debugger with a C-header structure viewer, an optional HTTP memory API and an MCP server whose tools cover CPU, memory, breakpoints, CFG and device state; an optional Ghidra plugin imports the dumps.

Statically recompiles PlayStation 2 games for the browser: eerecomp translates the Emotion Engine code of a game's boot executable into C++ that is compiled to WebAssembly, and a runtime emulates the rest of the console, including a high-level EE kernel, an interpreted I/O processor running the disc's IRX modules, the vector units, SPU2 sound and the Graphics Synthesizer on WebGPU compute shaders. Its port script repeats headless runs to find functions reached through pointers and vector-unit microprograms to compile ahead of time, then builds the web page and a native runner.

Static-recompilation toolkit for original Xbox games: a Python pipeline parses a retail XBE, disassembles it, classifies library functions, recovers calling conventions and lifts every x86 function to C. The generated code is compiled in a separate game project that links the toolkit's runtime libraries, which stand in for the Xbox kernel and translate Direct3D 8, NV2A, audio and input to Direct3D 11 and Win32 APIs, or to SDL2 and OpenGL on Linux and macOS.

PlayStation 1 emulator forked from PCSX and built around development and reverse engineering, with an interpreter and dynamic recompiler, software and OpenGL renderers, a MIPS debugger, VRAM viewer, SPU and GPU debugging tools, and a built-in GDB server that its documentation connects to gdb, IDA Pro and Ghidra's debugger. A LuaJIT API exposes breakpoints, memory and registers, an assembler and an ISO builder, and an optional REST web server can dump RAM and VRAM. The repository also holds the OpenBIOS replacement BIOS, PS-EXE conversion and packing tools, a Psy-Q object-file converter, Ghidra scripts for exchanging symbols and overlays with the emulator, and PS1 hardware designs.

Static analysis tool for Unity IL2CPP applications that reads an IL2CPP binary with its global-metadata.dat and outputs the application's type structure and method addresses as C# stub code, .NET assembly shim DLLs for decompilers such as ILSpy and dnSpy, IDA and Ghidra Python scripts that apply symbols and types, C++ type scaffolding and JSON address maps. Three APIs, also published as a NuGet package, and a plugin SDK expose the binary metadata, .NET type model and C++ model for custom analysis. The README states that it is not a decompiler and does not recover method source code.

Mod loader for Unity games on both the Mono and IL2CPP runtimes, which loads plugins and mods from folders in a locally installed game; on Windows a proxy DLL, version.dll by default, starts it with the game. For IL2CPP games its assembly generator runs Cpp2IL and Il2CppInterop to produce managed interop assemblies, and HarmonyX and MonoMod are bundled for runtime patching. Its logs can capture Unity player output and Harmony messages, and debug options provide a Mono debug server for Mono games and a wait-for-debugger option for IL2CPP games.

Plugin and patching framework for Unity Mono, Unity IL2CPP and .NET Framework games such as XNA, FNA and MonoGame titles, which loads mods and analysis plugins into a locally installed game. Plugins patch methods at runtime with the bundled HarmonyX and MonoMod.RuntimeDetour, while preloader patchers rewrite managed assemblies with Mono.Cecil before the game loads them; on IL2CPP games it runs Cpp2IL and Il2CppInterop to generate interop assemblies from the game binary and global-metadata.dat. Its guides also cover configuration, logging, and debugging plugins and game assemblies with dnSpy.

Experimental SDK for statically recompiling Xbox 360 executables into portable C++23 that runs natively on Windows, Linux and macOS. Its rexglue CLI scaffolds a per-game CMake project and, from a TOML config, analyzes a XEX binary (import resolution, PDATA, block discovery, gap filling, jump resolution and call-target validation) before translating each PowerPC instruction into C++; a runtime derived from Xenia's emulator core, with D3D12 or Vulkan graphics, hosts the generated code. Generated functions are weak aliases that native C++ overrides or mid-function hooks can replace, so a port can be refined one function at a time.

Toolkit and runtime for statically recompiling PlayStation 3 games into native executables. Python tools parse PS3 ELF and PRX files, find functions and firmware imports, and lift PPU and SPU code to C/C++; a project template links that code with a C/C++ runtime providing LV2 system calls, high-level emulation of the system libraries and RSX graphics translation to Direct3D 12, Metal or Vulkan.

Work-in-progress decompiler for games made with Clickteam Fusion 2.5, with fixes for older Multimedia Fusion 1.5 files. Its .NET console app reads Windows executables, Android APKs, iOS IPAs, CCN data files and existing MFA projects, then runs plug-in tools: an MFA Parser that writes the game back out as an editable Fusion project, and an Asset Dumper for images, sounds, music, fonts, icons, shaders and packed files.

Work-in-progress Unity editor sample for importing and modifying Star Wars Episode I: Racer model blocks, then serializing them back through swe1r-assets. Its editor includes an unmodified import/export byte-comparison command; it is an asset-format workflow rather than a reimplementation of the game.

Decompiles LuaJIT bytecode files back into Lua source, written as a replacement for the older Python LuaJIT decompiler. The README reports full support for gotos and for stripped bytecode, including reconstructed locals and upvalues, and its boolean-expression recovery follows a published decompilation algorithm. It processes single files or whole folders and writes .lua output.

Ghidra loader and plugin for Nintendo DS programs. It checks the .nds header, maps either the ARM9 or the ARM7 binary at its RAM address together with the console's memory regions and I/O register labels, decompresses SDK-compressed ARM9 code and overlays, and fills the overlays the user selects at import, while an optional overlay-manager plugin swaps overlays in and out afterwards. The repository also keeps a small Ghidra Function ID database of NitroSDK 3.0 routines for function identification.

Python disassembler that turns a Game Boy or Game Boy Color ROM, including multi-bank ROMs, into RGBDS-compatible assembly plus a Makefile that reassembles it, so the rebuilt ROM can be compared with the input. An optional .sym file beside the ROM supplies labels and marks code, data, text, padding and 1bpp/2bpp tile-image blocks; images are written as PNG files that rgbgfx converts back, text can use custom character maps, and hardware registers get hardware.inc names. The README explains that SM83 instructions vary in length and data is interleaved with code, so marked code blocks keep it from disassembling mid-instruction.

Ghidra processor module for the Allegrex CPU of the PlayStation Portable, derived from Ghidra's MIPS module. It adds Allegrex-specific instructions, VFPU disassembly and basic decompilation, the PSP calling convention, and an ELF loader that detects PSP executables and applies the PSP-specific type A and B relocation sections, with rebasing after import. Bundled scripts import and export PPSSPP .sym function-label files, and an exporter writes kernel modules as relocatable object files for linking.

Command-line tool that turns games built with GameMaker 8.0 or 8.1 back into editable .gmk or .gm81 project files. It reads the gamedata section that a built executable carries next to the runner and writes its settings, sprites, sounds, backgrounds, paths, scripts, fonts, timelines, objects, rooms, extensions, included files and GML code in the project format matching the game's version. A Rust rewrite on the OpenGMK project's gm8exe library that replaced the team's fork of WastedMeerkat's gm81decompiler, it is now developed in the OpenGMK repository alongside the GM8Emulator runner reimplementation.

C# library that reads Unreal Engine 1, 2 and 3 package files such as .u, .upk and .udk, auto-detects a matching game build and deserializes their exports, imports and properties. Its main goal is decompiling UnrealScript bytecode back to source by reconstructing classes, states, functions, structs, enums and default properties; it also deserializes fonts, sounds, palettes and textures. The README’s per-game compatibility table runs from Unreal and Deus Ex to Splinter Cell, Mass Effect and the Batman: Arkham games, and the separate UE Explorer GUI is built on it.

Windows disassembler for Super NES ROMs in which the user marks bytes as code or data, steps through 65816 code while the tool tracks the M and X flags and the data bank and direct page registers, adds labels and comments, and exports assembly for the asar assembler that the README says compiles back into the original binary. Execution context can come from BizHawk or BSNES trace logs, BSNES usage maps and BizHawk code/data logs, or live capture over a socket from a custom bsnes-plus build. Project files keep the annotations in merge-friendly XML with a link and checksum for the ROM rather than the ROM itself, so several people can work on one disassembly.

Zygisk module by Perfare, the Il2CppDumper author, that dumps type metadata from inside a Unity IL2CPP Android app while it runs. Built for one package name, it waits for the app to load libil2cpp.so, resolves the runtime's il2cpp API exports, walks the classes of every loaded assembly and writes dump.cs to the app's files directory, listing namespaces, classes, interfaces and enums with field offsets, properties and method signatures annotated with RVA and virtual addresses. On x86 devices running an ARM build of the app, it loads its ARM library through the Houdini native bridge.

Cross-platform reader and writer for the asset bundles and serialized asset files of Unity games, originally based on, though not a fork of, the archived UABE. Its README presents it as a modding and research tool rather than an extractor and points users who only want to extract assets to AssetRipper or AssetStudio; it opens bundles from Unity's Addressables system, whose CRC checks must be cleared with a separate tool before edited bundles load. It builds on AssetsTools.NET with Cpp2IL and Mono.Cecil, and the repository includes texture, audio-clip, font and text-asset plugins.

Tool for exploring, extracting and exporting the assets and asset bundles of Unity versions 3.4 to 2022.1. It converts Texture2D and Sprite images to PNG, TGA, JPEG or BMP and AudioClip to MP3, OGG, WAV, M4A or FSB, with FSB-to-WAV conversion, and exports fonts, meshes as OBJ, text assets, shaders, movie and video clips and MonoBehaviour data as JSON; models export from the scene hierarchy, and Animators export to FBX with their bound AnimationClips. MonoBehaviour export asks for the folder holding the assemblies, such as Managed, or, for IL2CPP builds, the dummy DLLs that Il2CppDumper generates.

Library and tools that decode streamed, prerecorded video game audio in hundreds of formats and codecs, from common game engine files to single-game codecs, including looped music, subsongs, companion files, custom containers and encryption keys. TXTH text descriptors add support for further formats, including raw audio, and TXTP files set per-file options such as forced looping or merging files. It ships as the vgmstream-cli decoder, which converts supported files to WAV, the vgmstream123 player and plugins for Winamp, foobar2000, XMPlay and Audacious, and an online web player is available at vgmstream.org.

pkg-to-anyps5 extracts PS5 debug game packages or game folders into the layout expected by the AnyPS5 relinker. It parses FIH, PFS and NAPS structures, decodes supported Kraken blocks, and unwraps fake-signed SELF executables and modules into ELF files.

dfsdk dumps Delta Force object metadata by enumerating its object array, decoding per-entry XOR-encrypted names and walking class super chains and property lists. The README documents name-pool addressing, pointer masking, selected field offsets and example output.

KBot inspects and transforms Total Annihilation and TA: Kingdoms game files, pairing a Go CLI with a proprietary format reference. It decompiles COB bytecode to BOS source, disassembles scripts, checks round trips and examines formats including HPI archives, GAF sprites, TNT maps and 3DO models.

BNDExtract is a Go command-line tool for extracting the ALL.BND archive used by Kuon and some other FromSoftware PlayStation 2 games. It takes a .bnd file and an output directory, providing access to the archive's contents for inspection.

RE4METoolbox provides command-line utilities for examining and modifying Resident Evil 4 Mobile Edition files. RE4MEAcvTool unpacks and repacks ACV .bin archives, while RE4METextTool converts Mission and Resource .bin text files to TSV and repacks edited text.

Aspyr Archive Tool unpacks and rebuilds Android OBB archives used by three Aspyr game ports: Star Wars: Knights of the Old Republic II, Jade Empire: Special Edition and Fahrenheit: Indigo Prophecy Remastered. Its command-line options support full or selective compression and a CRC64 checksum for Jade Empire.

ScriptSource-Dumper extracts scripts from Call of Duty: Black Ops II scriptsrc.clump archives. Its C++ parser reads the archive table of contents and data chunks, locates the internal name table, and writes files under their recovered names and directories.

.AUP-File-Type-Decryptor-and-Viewer is a local browser tool for inspecting Dragon Soul .aup game asset files. It implements the documented LZSS variant, previews image, audio and text formats, and exports files while preserving folder structure. The README specifies the four-byte size header and ring-buffer command stream.

Universal GBA Pokedex scans Game Boy Advance Pokémon ROMs to locate and display evolution, name and item tables. It searches byte signatures, scores candidate tables using text and pointer patterns, and aligns entries against known anchors instead of requiring fixed offsets.

VG Reverse Engineering decodes Vainglory: Community Edition replay files into recorded player names, heroes, K/D/A, items, gold and scoreboard counters. Its offline tools also export JSON and CSV, maintain a SQLite catalog and document VGR record and event interpretation. Output records provenance and leaves unsupported values unresolved.

The c8-disassembler in Chip-8 Emulator translates CHIP-8 ROM opcodes into assembly instructions. Its source and sample Pong ROM listing show the supported output; the repository also contains a companion emulator whose SDL2 display is marked as work in progress.

BGI Converter TGA analyzes BGI-Ethornell game image files and converts custom RGB or RGBA layouts and BMP images into 32-bit TGA. Its C++17 utility detects formats from headers, reports dimensions and offsets, and supports single-file or batch conversion.

Xenus DT1 Decompiler extracts DT1 and DT2 texture caches from Xenus 2: White Gold and Boiling Point: Road to Hell; its current decoder has not been tested with The Precursors. Its C# decoder reimplements behavior recovered from VELoader.dll, handles zlib and UCL NRV2E streams, and exports DDS or converted image formats.

GRB Modding Knowledgebase documents Ghost Recon: Breakpoint’s Anvil .forge archives, nested .data resources and asset replacement workflow. Its Python inspectors examine MotionCloth files, list resource types, compare forge indexes and diff gameplay database records to explore field layouts.

psp-media-slopkit analyses PSP XMB ICON1.PMF and SND0.AT3 files using format findings derived from retail game samples. Its Python CLI checks media against documented XMB limits, converts video and audio into icon media, and inserts the results into a homebrew EBOOT.PBP. FINDINGS.md records PSMF container fields, H.264 constraints and AT3 playback behaviour.

DualRip extracts Nintendo DS sound effects and music from SDAT archives and Nintendo 3DS audio from CSAR archives, including ROM inputs. It parses sequence, wave and stream formats, emulates the consoles' sound drivers for rendering and exports WAV files with loop points through CLI and GUI frontends.

YGO-PoC Toolset handles resource and save formats from Yu-Gi-Oh! Power of Chaos – Joey the Passion. Its unpacker extracts compressed game resource files such as data.dat, while PoCTools decrypts, edits and re-encrypts system.dat saves; the repository also includes a card editor and DLL mod loader.

FH6 Model Tools parses reverse-engineered Forza Horizon 6 asset formats, including burG model and texture containers. Python converters export car meshes to GLB or OBJ, textures to DDS, and selected material, palette, lighting, and ambient-occlusion data to readable outputs.

Ed1th's PvZ Toolkit inspects and edits Plants vs. Zombies resource archives and files through a desktop or web interface backed by Rust format libraries. Its workspaces cover RSB/RSG, PAK and DZip archives, RTON and NEWTON data, PAM animation, Compiled Text and Wwise WEM audio, among other formats.

kenshi-modkit parses and writes Kenshi .mod and .base files and reads its .save, .zone and .platoon files using Python. Its format notes document filetypes 15–17 and inferred typecodes, while utilities dump records, compare saves, detect mod conflicts and check byte-identical round trips.

ffxii-tza-tools documents and processes FINAL FANTASY XII The Zodiac Age character formats, including .ca animations, .cm models and .phyre assets. Its Python tools decode chunk structures, export models and animations to glTF, edit curves and repack @FRP containers from files extracted from the user’s game copy.

sims-package2glb extracts models from The Sims 2, 3 and 4 .package files into glTF binary files. Its Rust parsers handle DBPF containers, RefPack compression, RCOL and GMDC geometry, textures, materials and recolours. The documentation records format findings including Sims 4 DST texture planes and relative RCOL chunk references.

vc64_240p analyses and patches the N64 Virtual Console emulator inside Wii WAD channels to output 240p. It finds render-mode structures by pattern, changes video fields and disables deflicker; an optional patch removes the emulator's dark filter.

Unrpyc is a tool that decompiles compiled Ren'Py game scripts into readable script files. It runs from the command line or through files placed in a game's directory; it does not extract RPA archives.

Java map decompiler that turns Source engine .bsp map files back into .vmf files that can be loaded in Hammer. It also has an integrated pakfile extractor.

PKHeX is a C# Windows Forms editor for Pokémon core-series save data. It can edit and save supported files, import Pokémon and teams, and convert data between game generations.

nxnative is a tool that packages Nintendo Switch games as apps that run their code natively on Apple hardware, with graphics translated to Metal. It builds iPhone, iPad, or Mac apps from supported Switch games; Switch 2 builds are documented for Mac only.

An official APK investigation follows TOTP methods in Aegis and publishes artifact identities and selected Evidence.

Trace a packaged Electron clipboard path using REA findings and separate source inspection; the dynamic wrapper remains a stated limit.

The author describes REA-assisted Android investigation followed by separate Hermes decompilation to support a Windows BLE printer.

An independent video editor whose authors document REA-assisted investigation of Jianying/CapCut behavior and project formats. The public implementation includes a local timeline, FFmpeg export and an experimental, lossy draft importer.

Reimplements the CF632BLE scale’s BLE protocol and body-composition calculations from research on the vendor’s Unique Health Android app. A static Web Bluetooth client receives measurements, manages device profiles and keeps its history in browser storage.

Reads and rewrites supported native Axure RP 11 documents through a binary-record codec, reference-aware cloning and constrained interaction writers. CLI and MCP interfaces expose inspected edits while keeping offline structure checks separate from native application acceptance.

An author-reported Claude Code and REA workflow replaces the macOS streamer’s capture, encoding, audio and input layer with Linux implementations while reusing vendor protocol libraries. The documented result targets desktop streaming and video playback, not Windows-only VR game streaming.

Publishes React components, motion helpers and design-system notes derived from the author’s reported REA investigation of Claude Desktop. It is useful as an interface-reconstruction case, with version-specific observations rather than proof of a complete assistant application or backend clone.

An unofficial Plex client built after the author investigated LG webOS native media interfaces with Ghidra and coding agents. It draws its own Rust/OpenGL interface and uses the television’s decoder, with documented host, simulator and real-device test tiers.

REA’s case traces the installed Windows Calculator model DLL to explain different percentage behavior for multiplication/division and other operations. An analyst-selected function is interpreted against public Microsoft source and demonstrated with fixed browser examples.

The author reports using Codex and REA analysis to adapt a separate macOS Feishu copy with its own application identity, data directory and single-instance lock. The account describes local signing and separation checks while retaining the original app unchanged.

The authors describe this Rust image editor as a clean-room reimplementation of Photoshop-style workflows. Its document engine, UI and automation interfaces share editing commands, while the source distinguishes PSD editor round trips from byte preservation in the standalone file codec.

The authors describe WordCraft as a clean-room Rust implementation of familiar Microsoft Word workflows. It provides its own document model, layout engine and DOCX reader/writer, with desktop and browser interfaces; source tests exercise selected editing and file-preservation behavior.

The authors describe GridCraft as a clean-room Rust implementation of Excel-style spreadsheet workflows. A workbook model, formula parser and dependency-driven recalculation are connected to XLSX I/O and a shared editing-command layer for desktop, browser and automation interfaces.

The authors describe DeckCraft as a clean-room Rust implementation of PowerPoint-style presentation workflows. Its slide model, rendering and command layers support desktop/browser editing and PPTX interchange; reviewed source tests check constructed decks and selected preserved package parts.

The maintainer reports using REA and Ghidra to study selected QuickBooks Desktop for Mac behavior, then independently implements a local accounting application. Its Python/SQLite engine persists double-entry journals, invoices, inventory and payments, while public synthetic fixtures test bounded accounting and rollback behavior.

A teaching case with disclosed prior source access carries a REA-assisted investigation of a small command-line app into a separate Node implementation. It preserves observed task editing, persistence and selection behavior, then compares scoped outputs against fixed expectations and captured reference sessions.

Reconstructs the Johnny Castaway screensaver engine in Rust, with author-disclosed REA and Claude Code use. It reads original files to run recovered animation scripts and calendar-based story state on modern desktops; documented deviations and limited tests stop short of complete behavioral equivalence.

The author reports using REA to map Screen Studio’s Electron package, reading six auto-zoom and cursor rules from its obfuscated code with Claude Code’s help, and having Claude Code write an independent recorder and renderer from those rules. The article describes the commands, evidence, a cursor-alignment check and the clone’s gaps; neither the clone nor the decoded code is published.

Reimplements the glyph-wind background of the Claude desktop app’s Claude Code New session view as an offline WebGL2 page with a 38-slider control panel. The author reports a static REA investigation of the desktop shell and its remote web bundle, followed by a newly written renderer that reuses recovered timing and layout values. It shares the original’s visual vocabulary and interaction model but is not a pixel-identical extraction.

A Chinese article breaks three versions of a Python CSV exporter that reproduces the Notes teaching app shipped with REA. It shows that a simple export-and-read-back test passes all three, while byte comparisons against the official JavaScript formatter on 215 fixed inputs catch each one. The author also connects REA 6.5.0 over MCP, reruns its JavaScript analysis and checks that an edited evidence record is rejected on import; this is a study of acceptance checks, not a new reconstruction.

An Android TV browser follows BrowseHere's remote-control interaction design with its own implementation. The author reports using REA to inspect the BrowseHere APK and Claude to build Sofa; the repository documents APK releases, screenshots and current feature limits.

A Rust desktop reconstruction of Mekhanotronika Fast View 5 uses REA and Ghidra research to reproduce oscillogram analysis and relay-characteristic views. The project publishes behavioral specifications, factual indexes, screenshots and cross-platform builds, with explicit format and visual-fidelity gaps.

A Rust/Tauri disk analyzer combines REA/Ghidra investigation of WinDirStat 2.5.0 with source-code ports of its treemap and color handling. Its documentation distinguishes binary-confirmed findings from source-derived algorithms and leaves several file actions and Windows integrations untested.

A Windows Sony-headphone client adopts existing libmdr/libmdr-bt engine DLLs after a documented REA-assisted binary inventory and source review. The desktop interface is modeled on Sound Connect, while protocol implementation and device support are inherited rather than newly reconstructed.

A macOS recorder is informed by OBS architecture research using REA package inspection, platform tools and public source references. It offers screen/camera recording and streaming with a deliberately smaller scene/source feature set; the research notes record unavailable native-analysis providers.

A Rust canvas models Paper-like editing behavior after REA investigation of the Paper Desktop shell. The hosted editor was not recovered: research separates observed shell integration from inferred editor features, and the new geometric document model differs from Paper HTML/CSS.

Uses measured USB-volume behavior and a macOS audio proxy to map volume keys to a KEF LSX II’s LAN control. The project reports more even steps while forwarding USB audio; the speaker firmware is unchanged.

Implements an unofficial native Linux host for NetEase UU Remote, using protocol behavior the maintainer says was recovered from official-client traffic and shipped programs. The Rust implementation connects selected desktop, input and auxiliary-tool channels to Linux services; an additional Linux viewer remains experimental. The author attributes development to Claude and Codex, without establishing REA use.

Implements selected TCL Home air-conditioner controls and electricity reporting in a native macOS menu-bar app. It adapts earlier community protocol work and documents an Android-module investigation to recover a separate statistics request. Reported validation checks cloud state, not independent physical operation or complete device equivalence.

Stands in for the Claude in Chrome extension side of Claude Code’s local browser bridge and runs the requested actions in Browserbase cloud browsers. The author’s thread describes the reverse-engineered framing, a 4-byte little-endian length before each JSON tool call, and the plugin maps 17 named tools onto Stagehand/CDP operations. It is an archived interoperability shim with several placeholder tools, not recovered Anthropic code or a verified equivalent of the extension.

Implements an Android replacement for the Meta AI companion app that speaks the Ray-Ban Meta glasses’ own Bluetooth and Wi-Fi Direct protocol, imports media, exposes settings and answers “Hey Meta” with a model the user chooses. The project wiki documents the link layers, encryption, services and Meta-side ownership steps, and lists 153 open questions. Testing is on real glasses rather than test suites, so behavior beyond the stated model and firmware remains unverified.

Extends Wine 11.17 so that signed MSIX Store apps, with Shapr3D as the main target, install and run on Linux without their source or symbols. About 49,000 changed lines add a DirectComposition implementation, composition swap chains and an app-model host, while Microsoft’s own XAML and app-model DLLs, harvested from a Windows 11 image on the user’s machine, run unmodified. The author says Claude did most of the reverse engineering and code; app support is uneven and checked by a project regression suite.

Documents the proprietary .rkd telemetry format written by Race-Keeper “Instant Video” recorders, whose bundled player runs only on Windows, and implements matching Python and Go parsers that export GPS and IMU channels as Telemetry Overlay CSV and GPX. The author credits Claude Code with the hex-dump analysis and hypothesis testing, anchored by known car IDs, circuit location and speeds. Field meanings rest on physical cross-checks from the author’s own recordings, and several record types remain partly unknown.

A native macOS app that reaches the Elgato 4K X capture card’s 10-bit P010 video mode, which the project says Apple’s built-in webcam driver does not expose to apps. A root helper detaches that driver and runs the card’s USB Video Class streaming directly through libusb, feeding a Metal HDR viewer, an HDR10 recorder and an editor. Latency figures and device coverage remain author-reported.

A native macOS menu-bar app that pairs with an LG webOS TV over its local encrypted WebSocket interface to launch apps, switch inputs, adjust volume and picture settings, send pointer input and cast selected media. The project credits the public Connect SDK for webOS protocol behavior and reuses PyWebOSTV’s registration manifest. Testing covers one TV on webOS 5.0.

Reimplements control of Samsung Galaxy Buds over their proprietary RFCOMM serial protocol in a cross-platform desktop and Android manager. The author reports recovering the message format by analyzing the earbuds’ binary stream and disassembling Samsung’s official Android apps, and publishes partial packet notes for the 2019 Buds and the Buds+. Beyond the official app’s settings, it exposes battery statistics, diagnostics, factory self-tests, hidden debug information and firmware flashing for supported models.

Native Windows client that aims to preserve the familiar Windows Mail and Calendar experience while rebuilding its functionality. The upstream README documents a WinUI 3 interface, mail and calendar providers, contacts, tasks and offline workflows.

Replaces Honda RoadSync’s Apple Music-only media control with an iOS app that pairs with a Honda PCX 2025 TFT dash over Bluetooth Low Energy and turns handlebar presses into system-wide commands for any player. The author documents the dash’s BLE services, key exchange, button registration and event bytes, reportedly worked out from the official Android app and logged traffic. Results are author-reported on one PCX125, and the protocol notes separate confirmed from unverified parts.

Replaces ScanSnap Home for a Fujitsu/PFU ScanSnap iX500 on macOS with a SwiftUI app and Python service that scan over Wi-Fi through the community-reverse-engineered VENS protocol, or over USB through SANE, and produce searchable PDFs. It vendors bramheerink’s GPL-2.0 driver, extends it for macOS, and documents further handshake and hardware-status fields, including the scan-button bit. Results are author-reported; the repository publishes no tests or captures.

Implements a Garmin watch companion as a native macOS menu-bar app that pairs over Bluetooth, receives live health notifications and original FIT files, and can upload them to Garmin Connect. Source comments attribute its GFDI framing, handshake, file-transfer and status fields to analysis of a supplied Garmin Android package, cross-checked against community implementations such as Gadgetbridge. Device verification covers one watch model, and the opt-in MCP and HTTP interfaces expose only locally cached data.

Reimplements the MASQUE mode of Cloudflare’s WARP client in Go, tunnelling IP traffic over QUIC/HTTP/3 with Connect-IP (RFC 9484) and exposing it as a native TUN device, SOCKS5 or HTTP proxies, TCP-only L4 proxies or port forwarding. RESEARCH.md describes how the author worked out device enrollment, TLS client authentication and Cloudflare’s non-standard cf-connect-ip variant by analyzing the official Android client with Frida, mitmproxy, JADX, IDA Free and Wireshark. It registers with and connects to Cloudflare’s service outside the official client.

Reimplements Winamp 2's main, equalizer and playlist windows in HTML5 and JavaScript, with Web Audio playback, volume, balance and equalizer, and renders original classic .wsz skins, which its documentation says match Winamp 2.9 pixel for pixel; Milkdrop presets run through the Butterchurn WebGL port. It ships as the webamp npm module for embedding in web pages, and the same monorepo runs webamp.org and the skins.webamp.org skin museum. Its webamp-modern prototype targets Winamp 3/5 modern skins with an interpreter for MAKI skin scripts, whose undocumented bytecode format the author reverse engineered and documents in the repository.

Replaces the WHOOP companion app with offline macOS, Android and iOS clients that pair with WHOOP 4.0 and 5.0/MG straps over Bluetooth, decode their vendor GATT frames, offload the strap’s history into local SQLite and compute recovery, strain, HRV and sleep on the device. A versioned protocol reference documents framing, checksums, commands and sensor records per strap family, building on the community my-whoop and goose projects. WHOOP 4.0 is the supported path; deeper WHOOP 5.0/MG metrics and Oura ring support remain experimental.

Replaces NIIMBOT's own label app with a browser client that designs labels and prints them over Web Bluetooth or Web Serial, with Android (Capacitor) and Windows (Tauri) builds of the same interface. Printer communication comes from the same author's NiimBlueLib, which the README calls the most complete implementation of the NIIMBOT protocol; the protocol is documented on the NIIMBOT Community Wiki, and owners of models that do not print are asked for a packet capture of a print made with the official app. The README says the client runs entirely in the browser and keeps label data there.

Reimplements the Bluetooth Low Energy protocol of the Oura Ring Gen 3/4/5 in Rust crates and an oura command-line client that pairs with, authenticates to and syncs a ring directly, with no Oura account or cloud service. The author reports recovering the GATT layout, packet framing and AES app-auth flow from the decompiled Android app, and porting history-event decoders and several on-device metrics, such as HRV, sleep debt and nightly temperature baselines, from Ghidra decompilations of the app's native libraries. Event bodies are stored raw in SQLite so they can be re-decoded as decoders improve.

Recreates part of Sony’s mobile-only Headphones app as a Windows, Linux and macOS desktop client that changes noise-cancelling, ambient-sound and virtual-sound settings over a Bluetooth RFCOMM connection to a paired headset. The author reports reverse engineering the phone app to define its control protocol, and the code rebuilds its message framing, with start and end markers, byte escaping, sequence numbers, a sum checksum and acknowledgements, together with the two set-parameter commands the client sends. Full support is reported for few models, mainly the WH-1000XM3, and the project is archived.

Reimplements the cloud control path of the C by GE (now Cync) smart-bulb app as a Go library and a small self-hosted web app. The author reports decompiling the Android app with Apktool, finding its JSON HTTP API for login and device lists and a separate raw TCP protocol to the vendor's server, then working out that protocol's type-and-length message framing and packet encodings from proxied traffic and the Smali code. The resulting API lists devices, reads their status and sets power, brightness, color tone and RGB color.

Clickwill reconstructs direct editing of iPod classic and iPod nano music libraries in a Swift Mac app. It reads and writes iTunesDB and ArtworkDB on the device, preserves unknown record bytes, handles hash58 signatures and publishes a byte map that distinguishes measured fields from uncertain ones.

spark-mail-linux rehosts the Windows Spark Mail desktop app on Linux with Wine, two compatibility DLL shims and launcher scripts. The project documents application startup, browser authentication, notifications, clipboard and file-opening behavior, then patches specific DLL imports and bridges those functions to the Linux desktop.

OpenTracks is an early UWP port of the OpenTracks7 BETA1 Windows Phone music app informed by the author's reverse engineering. Its C# and XAML implementation updates page control access and replaces WP7 MediaPlayerLauncher with UWP media playback APIs.

The RTO eChalan report investigates an Android APK impersonating an Indian government eChallan service through manifest review, JADX decompilation and sandbox analysis. The author reports identifying a BankBot variant, a REQUEST_INSTALL_PACKAGES permission, a BIND_VPN_SERVICE entry and extensive obfuscation that limited decompilation.

AOL 7.0 Retro Server implements local Python servers for the 2001 AOL 7.0 client. It reconstructs the proprietary P3 login and security exchange, the handoff between login and BOS servers, and post-login data used to display the welcome screen and buddy list.

SteelSeries Overlay Hook documents IDA analysis of SteelSeriesGameOverlay.dll’s window, object layout and Direct3D 11 swapchain, then uses recovered offsets in a C++ DLL hook. Its injector and hook render Dear ImGui content through the existing GameOverlay window by intercepting Present and ResizeBuffers.

An investigation of WeChat 4.1.10 for macOS reports recovering per-database SQLCipher keys by breaking on CommonCrypto encryption calls in LLDB. It compares that approach with memory scanning and sqlite3_key breakpoints, and describes an offline check against a decrypted SQLite page.

Siriously investigates how macOS 27 changed access to Writing Tools and restores its popover through a Services client. The author used Objective-C runtime introspection and behavioral tracing to identify private WritingToolsUI classes, then passes selected text to the popover and writes accepted results back through Accessibility APIs. The findings concern one macOS build.

tuya-mobile reconstructs Tuya mobile-app request signing, encrypted API calls and MQTT signaling credential derivation in Python. It replaces the app's native libthing_security.so signing step with HMAC-SHA256, SHA256 and MD5 calculations and includes versioned Smart Life and Tuya Smart profiles.

ddg-tenor-bridge redirects Gboard's Tenor GIF searches to a service that returns DuckDuckGo animated-image results in Tenor v2 response form. Its documented workflow changes Gboard's persisted search URL flag while leaving other Tenor features on their original endpoint.

MSP CSV Export Format reconstructs the undocumented CSV export of the My Stocks Portfolio & Market app. The author compared eleven iOS exports, app displays and public translation strings to describe columns, blocks and transaction replay. A dependency-free Python parser and synthetic export exercise the documented rules and flag malformed input.

Benro Polaris Firmware Patcher investigates the Polaris camera controller and repacks a user-supplied firmware image with a newer libgphoto2 stack and targeted pgphoto changes. Its documentation maps Benro Connect app behavior and the TCP messages used to control the device. The author reports end-to-end testing with a Canon EOS R5 Mark II.

This malware-analysis report investigates a trojanized FL Studio installer that bundles an Electron/NSIS wrapper and a Go information stealer. The author traces the wrapper statically and studies the payload in an isolated Windows environment with process, registry and network observations, recovering its reported command-and-control mechanism.

grsimwrite-mac reconstructs the Windows GRSIMWrite 4.4.10 SIM-writing workflow in Python for macOS. Its research records card-family profiles and APDU write behavior, while the implementation identifies cards, reads elementary files, writes selected fields, and builds formatting sequences.

JADX plugin paired with a Python MCP server to inspect decompiled Android classes, resources, cross-references and debugger context.

Python MCP server that drives a local Apktool install so agents can decode APKs; list, read, search and edit smali and resource files; read AndroidManifest.xml and apktool.yml; and rebuild the project.

Frida MCP server with persistent instrumentation sessions, runtime inspection and Android static-to-dynamic navigation.

Single-binary Frida MCP server for discovering devices, managing process sessions and loading instrumentation scripts.

Dynamic instrumentation toolkit for observing and scripting the behavior of live native and managed processes.

Dex-to-Java decompiler with CLI/GUI navigation, resource decoding and cross-reference search for Android packages.

Decodes Android resources and smali into a project-like tree and can rebuild modified packages.

Python toolkit for APK/DEX metadata, bytecode and reference analysis; the v5 source branch also documents agent skills and MCP.

.NET assembly browser and C# decompiler with whole-project export, metadata inspection and a scriptable command-line frontend.

Community continuation of dnSpy for debugging and editing .NET assemblies without the original source.

Electron's archive tool lists and extracts ASAR contents so packaged JavaScript and application assets can be inspected.

Inspect mobile application packages with static analysis and supported-device dynamic testing, including runtime behavior and network traffic, through a web interface and APIs.

Explore running Android and iOS apps with a Frida-backed command interface for inspecting app storage, memory, runtime objects, and instrumented behavior.

Inspect and hook running iOS and Android apps from a Frida-based web interface, with method and crypto-API hooks, filesystem and SQLite browsers, iOS keychain and UI-hierarchy views, and HTTP capture from common networking libraries.

Analyze Flutter Android ARM64 AOT binaries using the matching Dart runtime. Produces annotated assembly, object-pool dumps and a target-specific Frida script template for investigating compiled Dart application logic.

Parse, disassemble and partially decompile React Native Hermes bytecode bundles. Makes HBC headers and instructions inspectable and emits pseudocode for understanding compiled application logic.

Inspect and modify compiled JVM applications with integrated decompilers, bytecode assembly, reference search, mappings and deobfuscation tools. The reviewed 4.0 preview also provides basic read-only Android bytecode inspection.

Decode compiled iOS/macOS interface archives into object trees, Outlet/Action connections, custom classes and navigation relationships. Exports JSON or Mermaid diagrams and exposes read-only inspection commands through MCP.

Statically inspect Flutter/Dart AOT libapp.so files to recover available metadata, class structures, call edges and pseudocode without embedding a Dart VM or compiling a matching SDK. Supports ARM64 and x86_64 analysis paths.

Disassemble and reassemble supported React Native Hermes bytecode bundles through HASM files, enabling bytecode inspection and editing for the explicitly supported legacy HBC versions.

Fernflower-derived decompiler for Java and other JVM languages that continues the ForgeFlower, Fabric and Quiltflower forks, focused on output quality and modern Java, including records, sealed classes, switch expressions and pattern matching through Java 21+. Its command line takes a JAR, ZIP, folder or class file and writes a folder, an archive or console output, with multithreaded decompilation and automatic formatting. It can also be embedded as a library from Maven Central or used in IntelliJ IDEA through a plugin that replaces Fernflower, and the regular release JAR bundles three plugins, including Kotlin support and variable renaming.

Python Android decompiler that answers queries directly against an APK instead of first unpacking and indexing it. It probes compressed DEX entries in place, uses the layout that the R8 compiler’s constant relocation and instruction deduplication leave behind to search string, type, method and field references across DEX files, and for a requested class rebuilds a minimal, self-consistent DEX in memory that a bundled copy of Androguard’s decompiler turns into Java. The droidasc CLI and Tk GUI list classes, decompile single classes, decode AndroidManifest.xml and find subclasses or interface implementations; the README presents it as a lightweight back end for agents analyzing many APKs.

Command-line APK editor built on ARSCLib that decodes an APK's binary resources and DEX into editable JSON, XML or smali and rebuilds a package from them, independent of aapt and aapt2. It also merges split bundles such as XAPK, APKM and APKS, refactors obfuscated resource names, and prints package information.

Frida-based dynamic-analysis tool that traces an Android app's use of the JNI API, similar to frida-trace or strace but for the Java Native Interface. It logs the JNI calls that native libraries make through the JNIEnv and JavaVM structures, with include and exclude filters, backtraces and optional JSON output for later post-processing. The tracing engine is also published as a separate jnitrace-engine library.

C# library for reading, modifying and rebuilding Portable Executable files, covering both native Windows images and images with .NET metadata. It offers three levels of abstraction: raw headers and sections (PEFile); interpreted data directories such as imports, exports, TLS, exceptions, debug data and Win32 resources (PEImage); and a System.Reflection-like model of .NET assemblies and modules with managed, native and dynamic method bodies. It also extracts files from AppHost/single-file bundles, supports ReadyToRun images and reads PDB and Portable PDB symbols without DIA, and upstream designs it to stay robust against malformed or obfuscated binaries.

Cross-platform desktop .NET decompiler maintained by the original JustDecompile creators as a continuation of their JustDecompile Engine, built with Mono.Cecil and an Avalonia UI. It loads assemblies into a tree of namespaces, types, members and resolved references, shows decompiled C#, VB.NET or IL with go-to-definition and back/forward navigation, and searches names, types, string literals and instructions. A create-project command exports an assembly as a Visual Studio 2015, 2017 or 2019 project.

Desktop GUI for Windows and macOS, built with Wails, that unpacks WeChat mini-program .wxapkg packages for study. It scans the mini-program package folders of local WeChat 3.x and 4.x installations, including per-user folders, or takes a file or folder the user selects; packages that the PC client stores encrypted are decrypted first. Each packaged file is written to its recorded path, with optional beautification of JSON, HTML and JavaScript.

Alpha-stage Node.js CLI that splits a React Native JavaScript bundle (index.android.bundle or main.jsbundle), an unbundled js-modules folder, or Webpack entrypoint and chunk bundles into one readable file per module. Tagger, editor and decompiler plugins working on a Babel AST undo compilation artifacts such as Babel helpers, comma-operator chains and shortened booleans, turn element calls back into JSX and can rewrite modules as ES6 imports and exports, after which ESLint and Prettier tidy the output. Modules recognized as npm packages are skipped unless requested, and one module ID can limit output to that module and its dependencies.

Rust decompiler and analysis toolkit for Hermes bytecode (.hbc), the compiled form React Native apps ship for the Hermes engine; the README lists HBC versions 40 to 99. Its hermes-decomp CLI shows file information, disassembles, decompiles whole bundles or single functions to JavaScript, with a slower deep mode that recovers more names, and provides a terminal UI, cross-references, call graphs, control-flow graphs, Metro module and closure views and bytecode diffing. A separate hermes-mcp server exposes the read and analysis functions as MCP tools, and the hbc-decomp crate offers them as a Rust library.

Modular Frida-based framework for runtime analysis of Android and iOS apps the analyst is authorized to test. From a single coordinated script it loads plug-in modules to inspect network and WebView activity, trace API calls, examine memory and cryptographic operations, monitor malware behavior, and handle protections such as SSL pinning. The README reports it ships with over 90 reusable modules.

Tool from the mitmproxy project that removes certificate pinning from an Android APK you own or are authorized to test, without a rooted device. It marks the app debuggable, touching only AndroidManifest.xml, and injects a Frida Gadget over ADB so an interception proxy can read the app's traffic, reusing HTTP Toolkit's unpinning script. It bundles the Android SDK helpers it needs and can also handle split APKs delivered as XAPK.

Command-line tool that prepares an Android APK you own or are authorized to test for HTTPS traffic inspection. It decodes the package with Apktool, adjusts the network security configuration to trust user-added certificates, disables certificate pinning, then re-encodes and signs the patched APK, so a proxy can read the app's traffic without a rooted device. App bundles supplied as .xapk or .apks are also supported.

A set of Frida scripts from HTTP Toolkit for inspecting a mobile app's HTTPS traffic while analysing apps you own or are authorized to test. Injected into a running Android or iOS app, they redirect its connections to an interception proxy, add a user-supplied CA certificate to the trust stores, and disable certificate pinning and transparency checks so the proxy can read the traffic. Individual scripts can also be used on their own to hook specific behaviour.

Flutter reverse-engineering framework for apps the analyst is authorized to inspect. It repacks an app with a prebuilt patched Dart engine, or instruments the app's own engine at runtime, to emit a JSONL dump of every function's name, class, library and code offset into the Dart instructions image for Frida or IDA/Ghidra work. It can also route the app's HTTPS traffic through an inspection proxy with Flutter certificate pinning disabled.

Rust decompiler that turns Android DEX bytecode, versions 035 to 041, from APKs, multi-dex apps and XAPK/APKS/APKM containers into Java, folding lambdas and string concatenation back into Java syntax and giving locals jadx-style names. By default every file also goes through a source-level cleanup pass, described as semantics-preserving, that inlines copy chains, recovers ternaries and for-each loops and drops dead stores; --fast skips it. Alongside full decompilation, 15 query subcommands return app and manifest information, resources, strings, cross-references, class hierarchies, disassembly or single classes and methods on demand, and the same queries are served over REST and MCP.

Generic Android deobfuscator built on smalivm, a sandboxed Dalvik virtual machine that executes each method and records every possible register and class value along all execution paths, taking both branches when a value such as file or network input is unknown. Simplify then repeatedly applies constant propagation, dead-code removal, unreflection and peephole optimizations to the APK or DEX, which can decrypt strings and remove reflection while keeping behaviour the same; it does not rename classes or methods. smalivm can also be used as a library, and the last release adds sdbg, a step-through Smali debugger built on it.

Windows-native Dalvik decompiler and Android analysis workbench written in C++ that opens APK, DEX, ODEX, OAT, JAR, AAR and class files without installation. Besides Java and Smali views with cross-references, renaming and comments, it identifies packers, deobfuscates and decrypts strings, tracks data flow and taint, solves paths, runs rule-based malicious-behaviour, vulnerability and privacy-leak scans, and can dump device memory or hook methods with Frida. Shell and server CLI modes, Python and Java scripting and a sample malware-triage agent skill expose the same analysis to scripts and agents.

VS Code extension that turns the editor into an Android reverse-engineering workbench around Apktool, Jadx, smali-lsp and uber-apk-signer. It decodes an APK into resources and Smali, decompiles it to Java, gives Smali go-to-definition, references and diagnostics through a language server, and rebuilds, signs and installs the modified app. It can also generate Frida hooks for Smali methods, add a Frida gadget, prepare an app for HTTPS traffic inspection with apk-mitm and produce a Quark-Engine malware-analysis report.

JetBrains' analytical decompiler that turns Java class files back into Java source; IntelliJ IDEA bundles it to show code when debugging or browsing class files. The standalone console decompiler takes class files, JARs, ZIPs or directories, can load library files with -e only as analysis context, and writes Java sources to an output directory. Options cover generic signatures, lambdas, inner classes, record and switch patterns, per-method time limits and renaming of ambiguous or obfuscated identifiers, optionally through a user-supplied renamer class.

Desktop suite for inspecting compiled Java and Android programs: drop in a class, JAR, WAR, APK, DEX, XAPK or APKM file to browse its classes and resources, with up to three decompiler or disassembler views side by side. The README lists six bundled Java decompilers (Krakatau, CFR, Procyon, FernFlower, JADX and JD-GUI), Krakatau and Smali/baksmali disassemblers and assemblers plus javap, Dex2Jar and Enjarify for APK/DEX conversion, a built-in Java compiler for editing, and static search. Java and JavaScript plugins receive every loaded class as an ASM ClassNode for jobs such as string deobfuscation or malicious-code searches.

Experimental JavaScript source-analysis toolkit that classifies AST-token sequences into configured formula families after local training, and produces heuristic structure, call-graph and intent reports. It supports code-comprehension experiments; its predictions do not establish arbitrary program invariants or semantic equivalence.

Local Python APK triage tool that drives apktool and strings, checks manifest settings and source/native-library strings, and produces TXT/JSON findings for manual review. Its rules flag possible issues without proving exploitability or reconstructing application behavior.

Rust CLI that hosts an ILSpy C# bridge in-process for assembly, type and named-method decompilation, source search and structured JSON output. A separate PE-header detector identifies managed assemblies without loading the .NET runtime.

Static-analysis CLI for compiled React JavaScript that produces readable bundle output and inferred API-request, route and application-constant reports. It can extract embedded source-map contents when available.

Decompiler for HarmonyOS Ark bytecode (.abc), the format HarmonyOS app packages carry in modules.abc, built by adapting the jadx decompiler and reading files through a patched copy of the abcde library. Because much of Ark bytecode is semantically close to DEX, it reuses jadx's GUI, IR and passes: an .abc file dropped into the jadx-based window is shown as decompiled code. The README reports that all 227 usable instructions of the 282 Ark opcodes are implemented, most special instructions as pseudo-functions.

Browser-based Java reverse-engineering tool that loads class files and JAR/ZIP archives and disassembles or decompiles them with Vineflower (the default), CFR, Procyon or JASM, compiled to run in the browser, next to its own bytecode disassembler. It draws inheritance and interface graphs and per-method control-flow graphs, searches constant-pool entries, instructions and member declarations or usages, applies Tiny, SRG/TSRG/CSRG or ProGuard mappings, and offers generic transformers that strip or normalize bytecode attributes so decompilers cope better with obfuscation. A JavaScript scripting API can add disassemblers and manipulate the workspace; the README itself recommends Recaf for serious reverse engineering.

Qt6 desktop front end that drives Apktool, JADX, uber-apk-signer and ADB from an IDE-style workspace for Android packages. It decodes an APK into smali and resources, optionally adds JADX Java output, then rebuilds, signs (with optional keystore generation and zipalign) and installs the result on a selected device; manufacturer framework files and extra Apktool arguments can be supplied. Decoded projects open in a file tree with syntax-highlighted smali, Java, XML and YAML editing, an image viewer, a hex editor and search across files.

PEiD-style identifier for Android packages from RedNaga. It scans APK and DEX files, nested ZIP entries and the native ELF libraries, PE DLLs and resources inside them with YARA rules, using the yara-python-dex DEX module, and reports the compilers, packers, protectors, obfuscators and anti-VM or anti-disassembly tricks it recognizes, per file or as JSON. Optional tracker rules attributed to the Exodus API flag embedded tracking SDKs; APKiD only identifies, and does not unpack or deobfuscate anything.

Java toolkit that converts Android DEX bytecode, including DEX inside APKs, into JVM .class files packed as a jar for Java decompilers and bytecode tools. It also reads and writes DEX through an ASM-like API, disassembles and assembles smali with its own implementation, converts jars back to DEX and ships helpers such as d2j-decrypt-string.

Bash script that automates repetitive Android app analysis chores around apktool: pulling an installed package from a device or emulator, decoding resources and disassembling dex code, and rebuilding the decoded directory into an APK. Split APKs from app bundles are combined into a single APK when pulled, and the script can also prepare a copy for Frida instrumentation.

Client/server Android automation and dynamic-analysis platform for devices the analyst is authorized to test. An on-device server exposes UI automation, a browser-based remote desktop, HTTPS traffic capture (MITM), and bundled Frida instrumentation through one service, driven from a Python client library of 160+ APIs. The README reports it works on Android 6.0+ with or without root, maps Frida RPC to Python and JSON-RPC calls, and includes an MCP server and a natural-language agent command.

Frida-based terminal tool, described by its authors as "Wireshark for Binder", that intercepts the Binder IPC transactions an Android process sends and parses each message and its reply. Bundled structure files for specific Android releases map transaction codes back to AIDL interface and method names and decode parcel arguments into typed fields beside a hex dump. A frequency pane and a JSON filter file narrow the stream by interface, method or type, showing which system services an app calls and with what data.

Rule-based engine for analysing suspicious Android apps: it loads an APK's Dalvik bytecode and checks JSON behaviour rules, each naming permissions and a pair of framework API calls, through five confidence stages, from the permission being requested and either API being called up to both calls appearing in order in one method and passing the same register. Weighted rule matches produce a threat score, with summary, detail, JSON, web, call-graph and label reports, and Quark Script exposes the analysis as a Python API that the project presents for finding vulnerabilities. The repository also ships two Claude Code skills, for running an analysis and generating a rule, and an optional LangChain agent that uses the OpenAI API.

Android reverse-engineering platform that combines static analysis with Frida-based dynamic instrumentation; the master branch is Reversense (Dexcalibur 2.0), a rewrite that runs as a Node.js web server for collaborative projects. Its README describes modeling an app's files, Smali and native code into one searchable representation with Radare2 integration, generating hooks for Java methods, Objective-C and native functions, and building dynamic cross-references from traces collected on attached devices. Inspector plugins in the repository observe areas such as permissions, cryptography, file-system, network and UI activity.

Command-line C tool that extracts the Dex bytecode held in the Vdex containers that ART's dex2oat compiler writes beside Oat files since Android 8.0 (API 26), and by default reverts ART's dex-to-dex quickening so the output is ordinary Dex again. It can also dump the verified-dependency records stored in a Vdex file, disassemble the bytecode in a dexdump-like format and report the Android API level of a Vdex version. Android 9 and 10 Vdex files hold CompactDex, which the bundled deodex helper converts back to standard Dex through a separately built compact_dex_converter.

Java and Android decompiler written in C that recovers Java source from class, JAR, WAR, DEX and APK files on multiple threads; it also prints javap- or dexdump-style class listings, converts APK and DEX files to smali, searches their strings with regular expressions and generates call graphs for DEX and APK files. Running garlic -m starts a stdio MCP server whose seven tools decompile files, dump class information, build call graphs, load them into DuckDB for SQL queries and read the extracted AndroidManifest.xml. The README reports decompiling an APK of more than 200 MB with about 190,000 classes in 12 seconds.

On-device disassembler and binary viewer for Android, built on Capstone, that opens ELF shared libraries and executables, object files, Windows PE files, .NET assemblies, dex files and APKs chosen from storage or from installed apps. It shows ELF details and symbol tables, PE import and export tables, disassembly with jump following and navigation by symbol or address, a hex view, ASCII string search and byte statistics such as entropy and chi-square tests to help tell whether data is encrypted. Analyses are kept as projects and can be exported as raw, text, JSON or database files.

APK and DEX detector from hors, the author of Detect-It-Easy, that reports the build tools, libraries and protections it identifies in Android packages, using scan engines and signature databases from the Detect-It-Easy family. The Qt GUI also shows AndroidManifest.xml, MANIFEST.MF, DEX and ELF contents, strings, hex, entropy, hashes and the APK signature, and can scan whole directories. A console build runs recursive, deep, heuristic or all-types scans and writes XML, JSON, CSV or TSV results.

C++ decompiler for JSXBIN, the binary format of Adobe's legacy ExtendScript, the ECMAScript 3 dialect used to script applications such as Photoshop, InDesign and After Effects. It reads a JSXBIN 1.0, 2.0 or 2.1 literal, parses it into a syntax tree and prints JavaScript source with a header naming the format version. An experimental --unblind option renames symbols obfuscated by JsxBlind, and the same decompiler is exposed as a shared library with a ctypes-based Python binding.

Static helper by evilpan for reverse engineering Android JNI code. Its extract_jni.py script parses an APK's DEX files with Androguard, finds methods declared native, derives each one's mangled Java_ symbol name and C prototype, including overloaded methods, and saves them with the exported Java_ and JNI_OnLoad functions of the APK's arm64-v8a native libraries as a JSON signature file. Scripts for Ghidra, IDA Pro and Binary Ninja load that file and apply the prototypes and JNI types to the matching functions; a radare2 script is a work in progress.

Desktop reverse-engineering and AI-assisted analysis workbench for HarmonyOS NEXT packages (.hap, .app and .abc), whose binary releases add Android .apk/.aab, iOS .ipa and standalone PE, ELF and Mach-O analysis. The README describes browsing package structure, resources, signatures and metadata, ABC bytecode disassembly and decompilation with strings and cross-references, Java-like Android decompilation, native header, import and mitigation views, and HDC/ADB device workflows for installing apps, reading logs and mirroring screens. Its built-in ReArk Agent answers questions about the open package with OpenAI-compatible or local Ollama models, retrieving package evidence on demand behind approval flows for host and device actions.

Java library, modeled on AOSP's androidfw ResourceTypes.h and meant to replace aapt/aapt2, that reads, writes, modifies and creates Android resource tables (resources.arsc) and binary XML files such as AndroidManifest.xml. It decodes resources to readable JSON, which also handles obfuscated names, or to XML source when names are intact, and builds either form back into binary resources; APK module classes decode, merge and write whole packages. It also has an experimental DEX read/write package, and the APKEditor command-line tool is built on it.

Self-hostable Django platform behind the Pithus Android analysis service, which its README describes as built for activists, journalists, NGOs and researchers. An uploaded APK is stored under its SHA-256 and queued for static analyses: Androguard attribute and class extraction, APKiD compiler and packer identification, ssdeep and Dexofuzzy similarity, Quark-Engine behavior rules, androcfg call graphs, Exodus tracker signatures, a MobSF static report, APK signing-block metadata and analyst-written YARA rules with retrohunts over stored samples. Results are indexed in Elasticsearch and shown as web reports and through a REST API, optionally enriched with MalwareBazaar, VirusTotal, MISP and Google Play lookups.

NCC Group’s Python and Flask web interface for Frida-based runtime analysis of Android apps, intended to make writing Frida scripts simpler. From a local browser page the analyst can enumerate loaded classes, the classes in a DEX file, class loaders and a class’s methods, then generate and keep tracing scripts for several functions, including ones in dynamically loaded DEX or JAR files. A configurable monitor logs file, HTTP, WebView, SQL, IPC and SharedPreferences calls.

Kotlin toolkit for OpenHarmony reverse engineering that parses Ark bytecode (.abc) files, the format HarmonyOS app packages carry in modules.abc, along with HAP packages and resource index (.index) files. Its Compose desktop viewer browses classes, methods, fields, literal arrays, imports and exports and disassembles methods, showing imported modules and resource references in readable form; an experimental mode translates some methods literally into JavaScript, and a CLI dumps class lists and resource indexes. The parsing core is also published as a JVM library, and the separate abc-decompiler builds on a patched fork of it.

Browser-based JavaScript deobfuscator and unpacker, built as a Jekyll site that also works offline as a progressive web app. It detects or lets the user pick an encoding and reverses Dean Edwards' Packer, eval- and array-based obfuscators, some Obfuscator.IO output, JSFuck, JJencode, AAencode, URL encoding, My Obfuscate and WiseLoop, then beautifies and highlights the result, with options to unescape strings, merge strings, recover object paths and evaluate constant expressions. An optional userscript sends the code to the JS Nice service to rename unreadable identifiers.

C++ DEX parsing library with Kotlin and Java APIs that loads an APK, DEX bytes or an app’s class loader and finds classes, methods and fields by their characteristics rather than their obfuscated names. Matchers combine package scope, modifiers and raw access flags, field, parameter and return types, annotations, the strings and numeric constants a method uses and the methods it calls, while batch queries locate many targets from strings at once; results expose opcodes, callers, invoked methods and fields used. Its guides centre on keeping Xposed hook points working across obfuscated app versions, and the same queries serve as a fast, scriptable search over an app’s bytecode.

Node.js pipeline that recovers readable JavaScript from Bun-compiled standalone executables. It extracts the embedded module graph and assets, splits the bundle into one file per module, flags npm vendor code with a fingerprint database, and deobfuscates with wakaru, format-preserving renames recovered from export mappings and optional Gemini-suggested names. Dependency-graph clustering, manual or LLM-assisted cluster labels and cross-version artifact transfer then organize and update the output.

Pattern-based Dalvik deobfuscator that takes an APK, a DEX file or a Smali directory, disassembles it with baksmali and runs plugins that look for obfuscation patterns in the Smali code. To learn what a matched call returns, such as a decrypted string, it merges a small driver into the app's DEX, pushes it to a connected Android device or emulator and invokes the static method there through reflection; the result replaces the call as a constant before the APK or DEX is reassembled. Plugins cover simple string encryption, indexed string and class lookups, certain DexGuard patterns and some reflection, and the author describes it as the inspiration for Simplify.

Decompiler for HarmonyOS NEXT apps, published under the jd-opensource GitHub organization, that turns Panda binary files (.abc Ark bytecode) back into ArkTS source. Its xabc program parses the bytecode, lifts it into the Ark compiler's Panda IR for analysis, rebuilds an ArkTS syntax tree with loop, class, lexical-environment and module-variable reconstruction, and prints that tree as ArkTS code. A cross-platform GUI, built with either Electron or Tauri, adds a file explorer, function and symbol lists, cross-references, search and a hex view; the README links Black Hat Arsenal presentations from 2025 and 2026.

A Ghidra extension by Terry Chia (Ayrx) with scripts for analyzing the native libraries of Android NDK apps. JNIAnalyzer.java uses the bundled JADX decompiler to extract the signatures of all native methods declared in an APK and applies the return types, parameter names and parameter types to the matching functions in the loaded .so. RegisterNatives.java uses Ghidra's P-Code API to find RegisterNatives calls and lay down the JNINativeMethod structures for dynamically registered methods, and TraceRegisterNatives.java applies the output of the author's trace_registernatives tool. A JNI data-type archive sets up the jni.h types.

Android app, published only as release APKs, that runs an APK reverse-engineering workflow entirely on the phone, from package extraction and Java decompilation to native analysis, editing and rebuilding. It extracts APK, XAPK and split APKS packages from storage or installed apps, decompiles each class with Jadx (with fallback and IR modes), CFR, Procyon, JD-Core, Krakatau or Vineflower, analyzes native libraries through an embedded radare2 with pseudo-C, assembly, hex, control-flow-graph and call-graph views, and since v20 edits resources, binary XML, the manifest and smali before rebuilding and signing the APK. A built-in MCP server lets MCP clients edit those project files while rebuilding stays a manual step; the README also lists Flutter Dart AOT analysis through Unflutter and Unity il2cpp metadata parsing.

PHP decoder and decompiler for SpiderMonkey 34 JavaScript bytecode, which the README says may handle .jsc files compiled by cocos2d-x. It parses the XDR-serialized scripts with their atoms, constants, objects, regular expressions and try and scope notes, decodes instructions from a SpiderMonkey 34 opcode table and rebuilds approximate JavaScript for each function context, while a second script prints the decoded operations instead. The author describes it as unfinished and as an example of how a JavaScript virtual machine works.

Interactive command-line tool by Lasha Khasaia for first-pass reverse engineering of Android APKs, written in C/C++ for speed. It unpacks an APK, parses AndroidManifest.xml, the signing certificate and the DEX files at the archive root, then opens a shell with tab completion for listing permissions, activities, services, receivers and likely entry points, listing and searching classes, methods and strings, disassembling a method's Dalvik bytecode and listing, hashing or extracting native libraries. Further commands report whether the app is debuggable, a creation date taken from its certificate, URL and email strings, and a guess at whether it was written in Java, Kotlin or Xamarin .NET.

Work-in-progress Android app for editing DEX files on the device, built on a modified in-tree copy of Google's smali, baksmali and dexlib2. It loads one or more DEX files into a class tree and opens classes as smali in a Sora Editor view with method, field and string lists, label jumps, search and replace, method flow diagrams and Jadx decompilation of a class or method to Java, then deletes classes or recompiles the edited DEX files. The README credits MT Manager for the app's logic and interface ideas.

Assembler and disassembler for the dex format used by Android's Dalvik VM: baksmali turns dex, APK, odex and oat files into smali text, and smali assembles that text back into a dex file. The README says the syntax, loosely based on Jasmin's and dedexer's, supports the full dex format, including annotations and debug and line information. baksmali can also deodex odex and oat files and list a dex file's classes, methods, fields, strings and references, while the dexlib2 library reads and writes dex files from Java.

Desktop Android reverse-engineering and modification workbench built with Kotlin Compose Multiplatform. It opens APK and DEX files, edits the DEX classes inside an APK as smali without manual unpacking, with syntax highlighting and code completion, and shows decompiled Java from JADX, CFR or Vineflower. It also browses resources and XML through apktool, searches the class tree, string constants and method and field references, re-signs modified APKs with apksig and zipalign, and installs and starts them on a connected device over ADB.

Python command-line tool that recovers the strings hidden by the Paranoid and LSParanoid Android string-obfuscation plugins, so that smali code becomes readable for static analysis. It scans a smali directory for the obfuscator's string-lookup method and encoded chunk array, decodes the chunks with Python ports of the libraries' DeobfuscatorHelper and RandomHelper classes, and rewrites each lookup call in place as a const-string instruction with a marker comment. Helper commands list the recovered strings, save the chunks to a file and decode a single string from saved chunks.

Python emulator for Dalvik bytecode that its README likens to Unicorn: it parses a DEX file and executes methods one instruction at a time, substituting Python mocks for common Java and Android APIs such as String, StringBuilder, Base64, ArrayList, AES Cipher and part of reflection. Run over Android entry points, methods matching a name or one method with given arguments, it logs the strings that the code builds or decrypts, optionally as JSON, which helps recover obfuscated strings in apps and malware.

Python parser for the Dart AOT snapshots inside libapp.so, the compiled Dart code of an Android Flutter app. It finds the VM and isolate snapshot symbols with pyelftools, deserializes the snapshot clusters and writes a text dump of every class in the isolate snapshot, with fields, method signatures and each method's absolute code offset in libapp.so. It recovers declarations and offsets for further disassembly, not decompiled function bodies.

Local browser interface for Frida aimed at Android app testing: a FastAPI server lists USB, local and remote frida-server devices with their installed apps and running processes, and lets the analyst attach to a process, spawn an app, spawn it with a script injected at launch, detach or kill it. Scripts are written in a Monaco editor or loaded from files or Frida CodeShare, whose scripts can be queued to run at spawn, and each session's console output is kept and can be exported as text.

Python module that parses binary Dart VM snapshots, such as the libapp.so of a release Flutter app, into a navigable graph of VM objects with back-references, including the memory structures the snapshot dumps. It reads old, AppJIT and AppAOT snapshots, usually autodetects flags and settings from the snapshot itself, extracts the snapshot blobs from app.so or .snapshot files, and its darter.asm module disassembles ARM and ARM64 code with Capstone to find references to VM objects. The README's examples include extracting an app's string table, finding where an object is used, generating call and library-dependency graphs, exporting metadata for Radare2 and deobfuscating a snapshot by matching it against a reference one.

ByteDance's static taint-analysis engine for Android APKs, designed for very large apps, that scans an app against JSON rules naming entry methods, sources, sinks and sanitizers as Jimple signatures, for vulnerability and privacy-compliance review. It works on Soot's Jimple IR and reuses FlowDroid's manifest and resource parsing, but implements its own field-sensitive pointer and taint analysis. Results go to results.json, which records app, component and permission information, deep links and JavaScript bridge interfaces alongside each source-to-sink path, with an HTML page per finding.

Frida-based explorer for the live Java heap of a running Android app, loaded as an objection plugin or used through its small Python package. classsearch and objectsearch find loaded classes by pattern and live instances of a class, returning object handles; classdump prints a class's declared fields, static field values and methods, and objectdump prints an instance's field values, can view it as a superclass and lists every entry of a collection or map. Analysts use it to see the runtime data and concrete implementations that static decompilation leaves open.

Java library and command-line tool that parses Android binary XML, such as the compiled AndroidManifest.xml inside an APK, and prints it as readable XML. Red Naga's near-complete rewrite of the Android4ME AXMLPrinter tolerates manipulated files seen in the wild, including out-of-order string tables and mangled start tags, and can write the classic AXML format back out. Since v2.0.0 it also reads the protobuf XML used in Android App Bundles and detects which format it was given.

Static data-flow (taint) analysis for Android apps and Java programs, built on Soot and usable as a command-line tool or as Maven libraries. Given an APK, the Android SDK platforms directory and a definition of sources and sinks, it models component lifecycles and callbacks to build a call graph and reports flows from sensitive sources to sinks; the bundled SourcesAndSinks.txt is a starting point for privacy leaks, and StubDroid summaries model library methods. Options cover inter-component flows from a supplied ICC model file, path reconstruction, implicit flows, reflection and timeouts that trade precision and recall for speed, and the analysis is described in the PLDI 2014 paper “FlowDroid: precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for Android apps”.

Pure-Python 3 translator from Dalvik bytecode to equivalent Java bytecode, so Java analysis tools and decompilers can be applied to Android apps: given an APK, with every DEX file of a multidex APK combined into one jar, or a single DEX file, it writes a jar of class files. Its README contrasts it with dex2jar and lists edge cases it handles, such as Unicode class names, constants used as several types, implicit casts, exception handlers that jump into normal control flow, very long methods and classes that reference too many constants. By default it also applies readability optimizations such as copy propagation and unused-value removal.

Magisk, KernelSU and APatch module that installs frida-server on a rooted Android device and starts it at boot, so Frida clients can attach for dynamic instrumentation without starting the server by hand. A daily GitHub Actions job checks for a new Frida release, downloads Frida's official frida-server builds for arm64, arm, x86 and x86_64, and publishes a matching module ZIP with an updater.json for updates from the root manager. The server listens on 127.0.0.1:27042 unless another port is written to a file in the module directory, and the module's action button starts or stops it.