Open-source reverse-engineering software
562 open-source libraries, tools and applications tagged reverse-engineering, ranked by how closely reverse-engineering is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
562 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| LEGO Island (decompilation) A functionally complete reverse-engineered decompilation of the 1997 game LEGO Island, reconstructing C++ source code that matches the orig… | 90 | 3491 | active |
| JusticeRage/Gepetto Gepetto is an IDA Pro plugin that queries large language models (OpenAI, Anthropic, Gemini, Ollama, and others) to explain decompiled funct… | 73 | 3487 | active |
| SteamAutoCracks/Steam-auto-crack A C# tool that automatically cracks Steam games by unpacking SteamStub-protected executables and applying the Goldberg Steam emulator. It a… | 97 | 3360 | active |
| malmeloo/FindMy.py FindMy.py is a Python library for querying Apple's Find My network to fetch and decrypt the location of AirTags, Apple devices, and custom … | 91 | 3321 | active |
| jehna/humanify A Rust CLI tool that unminifies and deobfuscates JavaScript by using LLMs (OpenAI, Anthropic, Gemini, OpenRouter, or local Ollama) to sugge… | 83 | 3288 | active |
| QiuChenly/CoreInject CoreInject (successor to InjectLib) is a macOS application injection and binary-patching tool by QiuChenly, distributed alongside a communi… | 81 | 3264 | active |
| biggerstar/wedecode Wedecode is a fully automated tool that decompiles WeChat mini-program and mini-game wxapkg packages back into readable source code (JS, WX… | 66 | 3239 | active |
| LaurieWired/Malimite Malimite is a Java-based decompiler for iOS and macOS binaries, built on Ghidra, that analyzes IPA files and Application Bundles with direc… | 34 | 3222 | active |
| BinDiff BinDiff is an open-source comparison tool for binary files that finds differences and similarities in disassembled code using graph-theoret… | 62 | 3206 | active |
| pxb1988/dex2jar dex2jar is a set of Java-based command-line tools for working with Android .dex and Java .class files. It converts Dalvik executables (e.g.… | 23 | 13148 | maintenance |
| ttttupup/wxhelper wxhelper is a C++ DLL that hooks the Windows PC WeChat client, exposing its internal functions through a local HTTP server (default port 19… | 58 | 3164 | active |
| korcankaraokcu/PINCE PINCE is a GDB front-end and reverse engineering tool for Linux, focused on game hacking but usable for general reverse engineering. It pro… | 96 | 3130 | active |
| m0bilesecurity/RMS-Runtime-Mobile-Security Runtime Mobile Security (RMS) is a NodeJS-powered web interface built on FRIDA for manipulating Android and iOS apps at runtime. It lets us… | 83 | 3130 | active |
| RfidResearchGroup/ChameleonUltra ChameleonUltra is the open-source firmware for an RFID/NFC card emulation device based on the NRF52840, capable of reading, writing, decryp… | 80 | 3040 | active |
| cilame/v_jstools v_jstools is a Chrome extension (Manifest V3) for debugging and reverse-engineering JavaScript on web pages. It provides API hooking, code … | 55 | 3016 | active |
| eteran/edb-debugger edb is a cross-platform AArch32/x86/x86-64 debugger inspired by OllyDbg, built with Qt and Capstone. It provides a graphical interface for … | 67 | 2974 | active |
| j4k0xb/webcrack webcrack is a JavaScript reverse-engineering tool that deobfuscates code obfuscated with obfuscator.io, unminifies minified code, and unpac… | 73 | 2962 | active |
| gildor2/UEViewer UE Viewer (umodel) is a desktop application for viewing and exporting visual resources (meshes, animations, textures, sounds) from games bu… | 23 | 2949 | active |
| zinja-coder/jadx-ai-mcp A JADX plugin that bundles an MCP server, allowing LLM clients like Claude to interact with the JADX decompiler for Android APK analysis. I… | 88 | 2915 | active |
| zhizhuodemao/js-reverse-mcp An MCP server that gives AI coding agents (Claude, Cursor, Copilot) tools for JavaScript reverse engineering in a headed Chrome browser, in… | 79 | 2881 | active |
| mrexodia/TitanHide TitanHide is a Windows kernel driver that hides debuggers from selected processes by hooking Nt* kernel functions via SSDT hooks and alteri… | 68 | 2872 | active |
| littledivy/mimic mimic is a Python tool that captures traffic from mobile or web apps via mitmproxy, extracts authentication material, and uses AI to genera… | 52 | 2870 | active |
| gdbinit/MachOView A macOS GUI application for viewing and exploring Mach-O binary files, revived as a maintained fork with a universal x86_64/arm64 build. It… | 32 | 2869 | active |
| evi0s/WMPFDebugger A debugger tweak for WeChat's Mini-Program Framework (WMPF) that exploits the remote debug feature of WeChat devtools to enable full Chrome… | 64 | 2832 | active |
| hasherezade/pe_to_shellcode A C++ command-line tool that converts Windows PE executables into shellcode-compatible form, adding a reflective loading stub post-compilat… | 37 | 2797 | active |
| panda-re/panda PANDA is an open-source Platform for Architecture-Neutral Dynamic Analysis built on the QEMU whole-system emulator, supporting record and r… | 91 | 2782 | active |
| Impact-I/reFlutter reFlutter is a Python CLI framework for reverse engineering Flutter mobile apps by repacking APK/IPA files with a specially patched, precom… | 99 | 2776 | active |
| AxtMueller/Windows-Kernel-Explorer Windows Kernel Explorer (WKE) is a free Windows kernel research and inspection tool supporting Windows XP through Windows 11. It loads a ke… | 54 | 2724 | active |
| decompiler-explorer/decompiler-explorer A web service (like Compiler Explorer in reverse) that lets users upload small binaries and compare the decompiled C-like output from many … | 77 | 2711 | active |
| worawit/blutter Blutter is a reverse engineering tool for Flutter mobile applications that compiles the Dart AOT runtime to extract symbols and objects fro… | 69 | 2711 | active |
| Artikash/Textractor Textractor is an open-source x86/x64 text hooker for Windows that extracts text from video games and visual novels by injecting into text o… | 23 | 2699 | active |
| bug-bit/fckvip An Android module (likely Magisk/LSPosed-based) that unlocks paid VIP memberships and enhances extended features in certain apps. It requir… | 79 | 2654 | active |
| Keystone Assembler Engine Keystone is a lightweight multi-platform, multi-architecture assembler framework implemented in C/C++ with bindings for many languages. It … | 67 | 2649 | active |
| REhints/HexRaysCodeXplorer HexRaysCodeXplorer is a Hex-Rays Decompiler plugin written in C++ that improves code navigation during reverse engineering. It automates re… | 44 | 2641 | active |
| EDL (Qualcomm Sahara/Firehose Tools) A Python CLI tool for communicating with Qualcomm devices in EDL (Emergency Download) mode via the Sahara, Firehose, Streaming, and Diag pr… | 66 | 2611 | active |
| gaasedelen/lighthouse Lighthouse is a code coverage explorer plugin for IDA Pro and Binary Ninja that lets reverse engineers interactively visualize execution co… | 49 | 2609 | stable |
| uxmal/reko Reko is a general-purpose binary decompiler that translates machine code executables back into high-level language source. It supports mult… | 89 | 2607 | active |
| rednaga/APKiD APKiD is a command-line tool that identifies how an Android APK was built, detecting compilers, packers, obfuscators, and app-shielding/RAS… | 75 | 2577 | active |
| onekey-sec/unblob unblob is an extraction suite that parses unknown binary blobs for 78+ archive, compression, and file-system formats, recursively extractin… | 88 | 2570 | active |
| DidierStevens/DidierStevensSuite A bundled collection of Didier Stevens' security research tools, distributed as a ZIP and GitHub repository of Python scripts and utilities… | 75 | 2546 | active |
| VirusTotal/yara YARA is a pattern matching tool used to identify and classify malware families and other files based on textual or binary pattern rules. It… | 94 | 9907 | maintenance |
| solemnwarning/rehex Rehex is a cross-platform hex editor designed for reverse engineering binary files, with features like large file support, inline disassemb… | 79 | 2481 | active |
| duty1g/x64dbg-mcp-server A native MCP (Model Context Protocol) plugin for x64dbg written in Zig that exposes the debugger's full functionality over HTTP with Stream… | 80 | 2473 | active |
| mandiant/flare-ida A collection of IDA Pro plugins and IDAPython scripts from Mandiant's FLARE team for reverse engineering and malware analysis. It includes … | 10 | 2450 | active |
| msojocs/fiddler-everywhere-enhance An auto-patch tool that modifies the Fiddler Everywhere web debugging proxy (an Electron app) on Windows and Linux, replacing DLLs and patc… | 85 | 2437 | active |
| Yuyz0112/claude-code-reverse A tool that reverse engineers Claude Code by capturing and visualizing its LLM API interactions. It monkey-patches Claude Code's request co… | 34 | 2432 | active |
| bitcookies/winrar-keygen An open-source tool and educational write-up explaining the principle behind WinRAR's 'rarreg.key' license file generation, with implementa… | 90 | 2407 | active |
| a2x/cs2-dumper An external offset/interface dumper for Counter-Strike 2 that reads the game process memory via memflow and generates offset files in forma… | 70 | 2398 | active |
| bootleg/ret-sync ret-sync is a set of plugins that synchronize a debugging session (WinDbg, GDB, LLDB, OllyDbg, x64dbg) with disassemblers (IDA, Ghidra, Bin… | 49 | 2395 | active |
| hzqst/VmwareHardenedLoader A Windows kernel driver that mitigates VMware VM detection by filtering VMware-related firmware strings and blocking VMware PnP registry en… | 94 | 2392 | active |
| Vineflower/vineflower Vineflower is a modern Java and JVM bytecode decompiler forked from Fernflower, focused on producing accurate, readable output with support… | 78 | 2380 | active |
| UMSKT/UMSKT UMSKT (Universal MS Key Toolkit) is an open-source C++ CLI toolkit for researching and experimenting with Microsoft's pre-Vista (pre-2012) … | 75 | 2357 | active |
| jxhczhl/JsRpc JsRpc is a Go-based RPC server that lets you remotely invoke JavaScript methods running in a browser via WebSocket, avoiding the need to ex… | 78 | 2350 | active |
| REAndroid/APKEditor APKEditor is a Java command-line tool for editing Android APK resources without depending on aapt/aapt2. It can decode binary resources to … | 84 | 2335 | active |
| Encryqed/Dumper-7 Dumper-7 is a C++ DLL that, when injected into an Unreal Engine game, generates a full C++ SDK (headers for engine classes, functions, and … | 95 | 2318 | active |
| DanOps-1/Gpt-Agreement-Payment A Python toolkit that reverse-engineers and replays the end-to-end ChatGPT Plus/Team/Pro subscription payment flow (Stripe Checkout, PayPal… | 50 | 2288 | active |
| BAP (Binary Analysis Platform) CMU Binary Analysis Platform (BAP) is a suite of OCaml libraries and a plugin-extensible CLI tool for analyzing binary programs. It lifts b… | 56 | 2262 | active |
| Storyyeller/Krakatau Krakatau is a Rust-based CLI tool for assembling, disassembling, and decompiling Java bytecode. It is specifically designed to handle obfus… | 75 | 2257 | active |
| e0e1-wx A Windows GUI tool (PySide6, Python 3.10+) for analyzing and penetration-testing WeChat mini-programs locally. It automates mini-program pa… | 74 | 2243 | active |
| grimdoomer/Xbox360BadUpdate A non-persistent, software-only hypervisor exploit for the Xbox 360 that runs unsigned code on the latest dashboard (17559) using a support… | 10 | 2239 | active |
| Ylarod/Florida Florida is an automatically patched, anti-detection build of frida-server for Android, tracking the upstream FRIDA project. It rebuilds fri… | 91 | 2236 | active |
| GlasgowEmbedded/glasgow Glasgow Interface Explorer is an open-source software stack (Python-based) for the Glasgow open hardware tool, an FPGA-based USB interface … | 77 | 2226 | active |
| RetDec RetDec is a retargetable machine-code decompiler based on LLVM that converts native binaries back into readable C or Python-like source cod… | 57 | 8640 | maintenance |
| ReClass.NET ReClass.NET is a .NET-based memory inspection and class structure reconstruction tool for analyzing remote processes, a modernized port of … | 23 | 2212 | active |
| AntiDebug_Breaker A Chrome browser extension built on the Hook_JS library that assists with JavaScript reverse engineering and penetration testing reconnaiss… | 83 | 2203 | active |
| Jar Analyzer A free, open-source GUI tool for analyzing Java JAR files, offering method call relationship search, DFS call chain analysis, taint analysi… | 90 | 2179 | active |
| Ropper Ropper is a Python CLI tool that displays information about binary files (ELF, PE, Mach-O, RAW) and finds ROP/JOP gadgets to build exploit … | 73 | 2152 | active |
| aixed/WeChat-Hook A Windows x64 DLL (loaded as a version.dll proxy into WeChat PC) that hooks WeChat 3.9.10.16 / 4.1.10.27 and exposes a local HTTP API for s… | 94 | 2129 | active |
| tyilo/insert_dylib A command line utility written in C that inserts a dylib load command (LC_LOAD_DYLIB or LC_LOAD_WEAK_DYLIB) into Mach-O binaries, including… | 34 | 2098 | active |
| mandiant/speakeasy Speakeasy is a Windows user-mode and kernel-mode emulation framework that runs binaries, drivers, and shellcode inside a modeled Windows ru… | 79 | 2081 | active |
| lasting-yang/frida_dump A collection of Frida scripts for dumping DEX files and native shared libraries (.so) from running Android processes. It includes SoFixer-b… | 45 | 2081 | active |
| erocarrera/pefile pefile is a multi-platform Python module for parsing and working with Portable Executable (PE) files such as EXE and DLL binaries. It expos… | 67 | 2076 | stable |
| redballoonsecurity/ofrak OFRAK is a binary analysis and modification platform that identifies, unpacks, analyzes, modifies, and repacks binaries, with first-class s… | 63 | 2070 | active |
| Undertale Mod Tool A GUI and CLI tool for modding, decompiling, and unpacking Undertale, Deltarune, and other GameMaker Studio games. It provides editors for … | 90 | 2068 | active |
| CYB3RMX/Qu1cksc0pe Qu1cksc0pe is an all-in-one malware analysis tool that statically and dynamically analyzes many file types, including Windows/Linux/macOS e… | 75 | 2067 | active |
| ainfosec/FISSURE FISSURE is an open-source RF and reverse engineering framework built around software-defined radios, supporting signal detection, classific… | 86 | 2063 | active |
| ReAgent auto-re-agent is an open-source AI reverse-engineering agent that combines Ghidra binary analysis with LLMs (Claude, Codex, OpenAI-compatib… | 79 | 2063 | active |
| vmoranv/jshookmcp An MCP server exposing 600+ tools across 34 domains for JavaScript reverse engineering and security research, including browser automation,… | 72 | 2056 | active |
| IDA-NO-MCP A collection of reverse engineering skills (prompt/plugin packages) for AI coding assistants like Claude Code, designed to work with IDA-NO… | 55 | 2026 | active |
| dqzg12300/fridaUiTools fridaUiTools is a PyQt5 desktop workbench that wraps Frida into a unified GUI for attaching to processes, managing hook script templates, v… | 80 | 2018 | active |
| endrazine/wcc The Witchcraft Compiler Collection (WCC) is a set of compilation tools for performing binary manipulation on ELF executables across POSIX p… | 84 | 2014 | active |
| EgeBalci/sgn SGN is a polymorphic binary encoder that encodes shellcode using an additive feedback loop similar to an LFSR, producing statically undetec… | 85 | 2005 | active |
| google/android-classyshark ClassyShark is a standalone binary inspection tool for Android developers that browses Android executables and shows class interfaces, memb… | 10 | 7552 | maintenance |
| ipwndfu ipwndfu is an open-source Python tool that exploits iOS device bootroms, most notably via the checkm8 exploit, to put devices into pwned DF… | 32 | 7430 | maintenance |
| de4dot/de4dot de4dot is an open-source .NET deobfuscator and unpacker written in C# that restores packed and obfuscated .NET assemblies to near-original … | 10 | 7429 | maintenance |
| KasperskyLab/hrtng An IDA Pro plugin (C++) providing a rich toolkit for reverse engineering: string/data decryption, deobfuscation of Hex-Rays pseudocode, unf… | 87 | 1949 | active |
| vxunderground/VX-API VX-API is a C++ collection of functions implementing malicious functionality to aid in malware development, maintained by vx-underground. I… | 32 | 1949 | active |
| JustasMasiulis/lazy_importer A header-only C++ library for resolving Windows DLL exports at runtime in a way that hides imports from static analysis tools. It uses comp… | 32 | 1930 | stable |
| PolyHook PolyHook 2.0 is a C++20 library for hooking functions at runtime on x86 and x64 architectures. It supports multiple hooking techniques (inl… | 69 | 1902 | active |
| federicodotta/Brida Brida is a Burp Suite extension that bridges Burp Suite and Frida, letting testers invoke and manipulate an application's own methods while… | 43 | 1899 | active |
| DerekSelander/LLDB A collection of LLDB aliases, regexes, and Python scripts that extend Apple's LLDB debugger with commands for heap searching, class dumping… | 44 | 1881 | active |
| airbus-seclab/bincat BinCAT is a static binary code analysis toolkit that performs value analysis, taint analysis, type reconstruction, and use-after-free/doubl… | 23 | 1876 | active |
| DosX-dev/obfus.h A macro-only C header library that obfuscates code at compile time, designed for the Tiny C Compiler on Windows x86/x64. It provides contro… | 70 | 1867 | active |
| collin80/SavvyCAN SavvyCAN is a Qt-based cross-platform CAN bus analysis tool for capturing, visualizing, saving, and loading CAN frames. It supports many lo… | 67 | 1867 | active |
| lifting-bits/remill Remill is a C++ library that statically translates machine code instructions (x86, amd64, AArch64, SPARC32/64) into LLVM bitcode. It is des… | 78 | 1866 | active |
| jnitrace jnitrace is a Frida-based command-line tool that dynamically traces JNI API calls made by native libraries in Android apps. It works like f… | 23 | 1865 | stable |
| HoShiMin/Kernel-Bridge Kernel-Bridge is a C++20 Windows kernel driver template, development framework, and kernel-mode API with wrappers, including a hypervisor s… | 23 | 1827 | active |
| QBDI/QBDI QBDI (QuarkslaB Dynamic binary Instrumentation) is a modular, cross-platform, cross-architecture DBI framework built on LLVM, supporting x8… | 77 | 1820 | active |
| marin-m/vmlinux-to-elf A Python CLI (with optional GUI) that recovers a fully analyzable ELF file from raw or stripped Linux kernel images (vmlinux, vmlinuz, bzIm… | 82 | 1819 | stable |
| githubXiaowangzi/NP-Manager NP-Manager is an Android application for APK, DEX, JAR, Smali, PDF, and media file manipulation. It provides reverse-engineering features s… | 75 | 1818 | active |