Open-source reverse-engineering software
562 open-source libraries, tools and applications tagged reverse-engineering, ranked by how closely reverse-engineering is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
562 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| REDasm REDasm is an open-source disassembler and binary analysis tool with a native Qt6 GUI, supporting many CPU architectures and executable form… | 92 | 1814 | active |
| xaitax/Chrome-App-Bound-Encryption-Decryption A Windows post-exploitation research tool that bypasses Chromium's App-Bound Encryption using direct syscall-based reflective process hollo… | 58 | 1813 | active |
| AloneMonkey/MonkeyDev MonkeyDev is an Xcode-integrated framework (an upgraded fork of iOSOpenDev) for developing iOS tweaks and command-line tools using CaptainH… | 77 | 6805 | maintenance |
| wtf wtf (what the fuzz) is a distributed, code-coverage guided, snapshot-based fuzzer for attacking user- and kernel-mode targets on Windows an… | 82 | 1800 | active |
| m4b/bingrep bingrep is a cross-platform command-line binary parser and colorizer written in Rust, supporting ELF, Mach-O, PE, and Unix/BSD archives. It… | 56 | 1785 | active |
| JesusFreke/smali smali/baksmali is an assembler and disassembler for the dex bytecode format used by Android's Dalvik VM. It converts dex files to human-rea… | 10 | 6625 | maintenance |
| vfsfitvnm/frida-il2cpp-bridge A Frida module written in TypeScript for dumping, tracing, and hijacking IL2CPP (Unity) applications at runtime without needing the global-… | 90 | 1753 | active |
| sigalor/whatsapp-web-reveng A reverse-engineered description and Node.js re-implementation of the WhatsApp Web API, communicating over WebSockets with the same encrypt… | 32 | 6496 | maintenance |
| revng rev.ng is an open-source binary analysis framework and decompiler built on LLVM and QEMU, supporting over 20 CPU architectures. It automati… | 75 | 1739 | active |
| cmu-sei/pharos Pharos is a static binary analysis framework from Carnegie Mellon's Software Engineering Institute built on the ROSE compiler infrastructur… | 75 | 1738 | active |
| polymorf/findcrypt-yara An IDA Pro plugin that uses YARA rules to scan binaries for known cryptographic constants and other recognizable byte patterns. It helps re… | 32 | 1737 | active |
| ev-flow/quark-engine Quark Engine is an Android malware scoring and analysis system that inspects APKs using rule-based behavioral detection on Dalvik bytecode.… | 99 | 1733 | active |
| CodingGay/BlackDex BlackDex is an Android app that unpacks DEX files from installed or uninstalled APKs on Android 5.0-12 without requiring root, Xposed, Frid… | 23 | 6459 | maintenance |
| lasting-yang/frida_hook_libart A collection of Frida hook scripts for intercepting Android ART JNI functions, most notably RegisterNatives. It reveals native method regis… | 50 | 1716 | active |
| hasherezade/tiny_tracer A Pin Tool built on Intel Pin for dynamic binary instrumentation that traces API calls, syscalls, selected instructions, and section transi… | 74 | 1709 | active |
| KeenSecurityLab/BinAbsInspector BinAbsInspector is a static analyzer for automated reverse engineering and vulnerability scanning in binaries, built on abstract interpreta… | 23 | 1682 | active |
| kefir500/apk-editor-studio APK Editor Studio is a free, open-source, cross-platform GUI tool for reverse-engineering Android APK files, built in C++/Qt. It lets users… | 23 | 1677 | active |
| klezVirus/SysWhispers3 SysWhispers3 is a Python command-line tool that generates header and assembly (ASM) file pairs for direct system calls to the Windows kerne… | 32 | 1667 | active |
| 0xdea/frida-scripts A collection of Frida instrumentation scripts for reverse engineering mobile apps and native binaries, including tracers and enumerators fo… | 74 | 1666 | active |
| Air14/HyperHide HyperHide is a hypervisor-based anti-anti-debug plugin for x64dbg/x32dbg that hides debuggers from detection. It uses Intel EPT to hook sys… | 23 | 1664 | active |
| tabby-sec/tabby Tabby is a Java static code analysis tool built on the Soot framework that converts JAR/WAR/CLASS files into a code property graph stored i… | 47 | 1661 | active |
| zardus/preeny Preeny is a collection of LD_PRELOAD libraries written in C that help with binary exploitation and CTF-style challenges. It disables functi… | 64 | 1649 | active |
| illera88/Ponce Ponce is an IDA Pro plugin that adds one-click symbolic execution and taint analysis over binaries, built on the Triton engine and written … | 31 | 1634 | active |
| Heimdall Heimdall is a Rust-based EVM smart contract toolkit for bytecode analysis, decompilation, disassembly, control flow graph generation, stora… | 87 | 1627 | active |
| pret/pokefirered A complete decompilation of Pokémon FireRed and LeafGreen that rebuilds byte-identical GBA ROM images from C source code. It is part of the… | 71 | 1619 | active |
| attify/firmware-analysis-toolkit Firmware Analysis Toolkit (FAT) is a Python-based automation wrapper around Firmadyne that emulates IoT and embedded device firmware images… | 99 | 1615 | active |
| pmret/papermario A work-in-progress matching decompilation of Paper Mario for the Nintendo 64, written in C. It rebuilds byte-identical ROMs for the US, JP,… | 75 | 1614 | active |
| horsicq/XELFViewer XELFViewer is a GUI application for viewing and editing ELF (Executable and Linkable Format) binary files on Windows, Linux and macOS. It i… | 68 | 1586 | active |
| Hexeption/MCP-Reborn MCP-Reborn is a Mod Coder Pack for Minecraft that decompiles and maps the game's source code so developers can create modded clients and st… | 78 | 1563 | active |
| m4b/goblin Goblin is a Rust library for parsing and loading binary executable formats including ELF, Mach-O, PE, and Unix/BSD archives. It offers zero… | 74 | 1556 | stable |
| AeonLucid/AndroidNativeEmu A Python library that partially emulates Android native (.so) libraries on a host machine using the Unicorn CPU emulator. It emulates the J… | 23 | 1555 | active |
| Dreamland Pine is a dynamic Java method hooking framework for the Android ART runtime, allowing interception and modification of almost any Java meth… | 52 | 1541 | active |
| igogo-x86/HexRaysPyTools An IDA Pro plugin that enhances the Hex-Rays decompiler workflow. It assists in reconstructing structures and classes, detecting virtual ta… | 32 | 1541 | active |
| cv-cat/XianYuApis A reverse-engineered unofficial API library for Xianyu (Goofish, Alibaba's second-hand marketplace) that wraps its HTTP endpoints and WebSo… | 74 | 1528 | active |
| deathmemory/FridaContainer FridaContainer is a modular collection of popular and custom Frida scripts written in TypeScript to speed up reverse engineering work on An… | 52 | 1517 | active |
| DarthTon/Blackbone Blackbone is a C++ library for Windows memory hacking, providing APIs for process memory manipulation, DLL injection, manual PE image mappi… | 32 | 5499 | maintenance |
| miscusi-peek/cheatengine-mcp-bridge A bridge that connects AI coding assistants (Claude, Cursor, Copilot) to Cheat Engine via the Model Context Protocol, letting agents read/w… | 57 | 1499 | active |
| facebook/fishhook fishhook is a small C library from Facebook that dynamically rebinds symbols in Mach-O binaries running on iOS, similar to DYLD_INTERPOSE o… | 32 | 5432 | maintenance |
| ergrelet/unlicense A Python 3 command-line tool that dynamically unpacks executables protected with Themida/WinLicense 2.x and 3.x. It automatically recovers … | 23 | 1495 | active |
| dekuNukem/bob_cassette_rewinder An open-source hardware/firmware project that defeats the DRM on Bob dishwasher detergent cassettes, allowing users to reset and refill the… | 29 | 1492 | active |
| FACT (Firmware Analysis and Comparison Tool) FACT (Firmware Analysis and Comparison Tool) is a self-hosted Python application that automates firmware security analysis for devices like… | 94 | 1468 | active |
| ViRb3/magisk-frida A Magisk/KernelSU/APatch module that automatically installs and runs frida-server on boot on rooted Android devices. It stays up to date by… | 94 | 1462 | active |
| SeeFlowerX/stackplz stackplz is an eBPF-based stack tracing tool for Android (arm64). It supports syscall tracing, uprobe hooking of 64-bit userspace libraries… | 60 | 1450 | active |
| zodiacon/AllTools A collection of Pavel Yosifovich's reasonably stable Windows system tools, including process/driver monitors, kernel object viewers, PE fil… | 83 | 1443 | active |
| nowsecure/r2frida r2frida is a radare2 plugin that integrates the Frida dynamic instrumentation toolkit, letting users inspect and manipulate local or remote… | 92 | 1440 | active |
| WPeGPT WPeGPT is an IDA Pro plugin that integrates LLM models (OpenAI, DeepSeek, or any OpenAI-compatible API) into binary analysis workflows. It … | 69 | 1423 | active |
| Spuckwaffel/UEDumper UEDumper is a C++ tool that dumps Unreal Engine games (UE 4.19 through 5.3) and generates SDKs, with a live ImGui-based editor for viewing … | 52 | 1408 | active |
| LSPosed/LSPlant LSPlant is a C++ library for hooking Java methods in the Android Runtime (ART), supporting hook/unhook and inline deoptimization. It is par… | 76 | 1406 | active |
| syssec-utd/pylingual PyLingual is a CPython bytecode decompiler that recovers Python source code from .pyc files for all Python versions since 3.6. It can be ru… | 74 | 1405 | active |
| Guided Hacking DLL Injector A C++ DLL injection library supporting x86, WOW64, and x64 injection with five injection methods and six shellcode execution techniques. It… | 29 | 1398 | active |
| hasherezade/libpeconv libPeConv is a C++ library for loading, manipulating, and dumping Windows PE (Portable Executable) files. It provides a 'swiss army knife' … | 63 | 1393 | active |
| ChiChou/grapefruit Grapefruit is an open-source mobile security testing suite for iOS and Android that provides a browser-based GUI over Frida for runtime ins… | 88 | 1392 | active |
| xihan123/SignHook SignHook is an Xposed/LSPosed module for Android that spoofs app signature checks by returning a user-configured fake signature when a host… | 78 | 1383 | active |
| hasherezade/exe_to_dll A command-line tool that converts a Windows EXE into a DLL that can be loaded like a library, exporting the original entry point as a 'Star… | 49 | 1382 | stable |
| ClownQq/YDArk YDArk is a free x64 Windows kernel inspection tool similar to PCHunter, providing GUI views of processes, threads, handles, drivers, kernel… | 32 | 1375 | active |
| moyuwa/ApkCheckPack A Go-based CLI tool that detects APK hardening/packing features from 40+ vendors, plus third-party SDKs, anti-environment checks (ROOT, emu… | 76 | 1374 | active |
| Cracked5pider/Stardust Stardust is a modern 32/64-bit position independent shellcode (implant) template written in C++20. It provides compile-time FNV-1a hashing … | 67 | 1373 | active |
| APK Explorer & Editor APK Explorer & Editor (AEE) is an open-source Android application for exploring the contents of installed APK files and APKs picked from st… | 90 | 1366 | active |
| littleWhiteDuck/SimpleHook SimpleHook is an Xposed/LSPosed module for Android app debugging and research, offering configurable Java/Smali hooking of methods, fields,… | 87 | 1366 | active |
| fkie-cad/cwe_checker cwe_checker is a Rust-based suite of checks that detects common bug classes (CWEs) such as null pointer dereferences and buffer overflows i… | 66 | 1361 | active |
| REDRIVER2 A complete open-source C reimplementation of the PlayStation game Driver 2, produced by disassembling and translating the original MIPS cod… | 81 | 1358 | active |
| CERT-Polska/drakvuf-sandbox DRAKVUF Sandbox is an automated, agentless malware analysis system that runs suspicious files inside a hypervisor-level sandbox powered by … | 85 | 1352 | active |
| cfig/Android_boot_image_editor A Gradle-based Java tool for unpacking, editing, and repacking Android boot images such as boot.img, vendor_boot.img, recovery.img, vbmeta.… | 62 | 1332 | active |
| sharkdp/binocle Binocle is a graphical tool that visualizes binary data by colorizing bytes according to configurable rules and rendering them as pixels in… | 23 | 1324 | stable |
| Vector35/binaryninja-api The public API, examples, and documentation for Binary Ninja, a commercial reverse engineering platform. It provides C++, Python, and Rust … | 93 | 1323 | active |
| iGio90/Dwarf Dwarf is a full-featured multi-architecture, multi-OS debugger built on PyQt5 and Frida, aimed at reverse engineers, security analysts, and… | 32 | 1321 | active |
| CalebFenton/simplify Simplify is a generic Android deobfuscator that virtually executes Dalvik methods in a sandbox (smalivm) and applies optimizations like con… | 23 | 4668 | maintenance |
| camoufox-reverse-mcp An AI-powered 'Skill' package for JavaScript reverse engineering that plugs into AI coding tools like Claude Code, Cursor, and Codex. It pr… | 78 | 1308 | active |
| Bixilon/Minosoft Minosoft is an open-source Minecraft client reimplementation written from scratch in Kotlin, using OpenGL for rendering. It is a free-softw… | 74 | 1307 | active |
| Rurik/Noriben Noriben is a Python script that wraps Sysinternals Procmon to automatically collect, analyze, and report runtime indicators of malware, pro… | 66 | 1304 | stable |
| n64decomp/mk64 A complete C decompilation of Mario Kart 64 that rebuilds byte-matching ROMs for USA and European revisions from extracted game assets. It … | 72 | 1298 | active |
| gaasedelen/patching An interactive binary patching plugin for IDA Pro that adds a robust in-disassembler workflow for editing assembly instructions. It support… | 23 | 1291 | active |
| tklengyel/drakvuf DRAKVUF is a virtualization-based, agentless black-box binary analysis system that traces execution of arbitrary binaries, kernels, and fir… | 66 | 1279 | active |
| SychicBoy/NETReactorSlayer NETReactorSlayer is an open-source (GPLv3) deobfuscator and unpacker targeting assemblies protected with Eziriz .NET Reactor. It is availab… | 65 | 1266 | active |
| CensoredUsername/unrpyc Unrpyc is a decompiler that converts compiled Ren'Py .rpyc script files back into readable Ren'Py script source. It can be run as a command… | 66 | 1265 | active |
| rdbo/libmem A cross-platform game hacking library for C, C++, Rust, and Python providing process and memory manipulation, function hooking/detouring, c… | 82 | 1256 | active |
| JetBrains/fernflower Fernflower is an analytical decompiler that converts Java bytecode (class, jar, zip files) back into readable Java source code. It is bundl… | 77 | 4423 | maintenance |
| relative/synchrony Synchrony is a JavaScript deobfuscator and cleaner focused on undoing obfuscation from javascript-obfuscator/obfuscator.io. It works as a C… | 76 | 1252 | active |
| horsicq/XPEViewer XPEViewer is a cross-platform GUI application for viewing and editing PE (Portable Executable) files, the executable format used on Windows… | 73 | 1241 | active |
| alexhude/uEmu uEmu is an IDA Pro plugin built on the Unicorn engine that lets you emulate code directly inside the IDA disassembler. It supports x86, x64… | 73 | 1239 | active |
| ThunderCls/xAnalyzer xAnalyzer is a plugin for the x64dbg debugger that performs extended static code analysis on debugged applications. It detects API function… | 47 | 1234 | active |
| dethrace-labs/dethrace Dethrace is an open-source reverse-engineering project that rebuilds the 1997 driving/mayhem game Carmageddon to run natively on modern sys… | 83 | 1223 | active |
| amruth-sn/kong Kong is an LLM-orchestrated reverse engineering CLI that plugs AI into Ghidra's analysis engine to recover function names, types, and struc… | 57 | 1208 | active |
| WolvenKit WolvenKit is an open-source desktop mod editor and creator for CD Projekt's REDengine games, primarily Cyberpunk 2077. It can read and writ… | 92 | 1206 | active |
| x64dbg/GleeBug GleeBug is a debugging framework for Windows written in C, designed to make building debuggers and debugging tools complete and easy to use… | 72 | 1201 | active |
| petoolse/petools PE Tools is a Windows GUI toolkit for researching and manipulating Portable Executable (PE) files and running processes. It bundles a PE he… | 41 | 1201 | active |
| P3GLEG/Whaler Whaler is a Go CLI tool that reverse engineers Docker images back into the Dockerfiles that created them. It also extracts files added via … | 53 | 1192 | active |
| Redress Redress is a command-line tool for analyzing stripped Go binaries, reconstructing symbols and extracting information such as compiler versi… | 95 | 1191 | active |
| OSS CAD Suite Project IceStorm documents the reverse-engineered bitstream format of Lattice iCE40 FPGAs and provides tools for analyzing and creating bit… | 66 | 1188 | active |
| yazgx97/frida-ios-hook A Python/JavaScript CLI tool that wraps Frida to make it easy to trace classes and functions, hook methods, and modify return values on iOS… | 63 | 1187 | active |
| kuizuo/js-deobfuscator An automated JavaScript deobfuscation tool built on Babel AST transforms, offering a CLI, a TypeScript API, and an online playground. It re… | 83 | 1186 | active |
| P1sec/hermes-dec hermes-dec is a Python-based reverse engineering tool that disassembles and decompiles React Native applications compiled to the Hermes VM … | 92 | 1181 | active |
| reversenseorg/dexcalibur Reversense (Dexcalibur 2) is a binary intelligence platform that automates reverse engineering of mobile and embedded applications. It comb… | 66 | 1175 | active |
| nccgroup/Sniffle Sniffle is an open-source sniffer for Bluetooth 5 and 4.x LE that runs on TI CC1352/CC26x2 hardware with a Python host-side tool. It captur… | 39 | 1175 | active |
| aappleby/metroboy A collection of gate-level simulators for the original Game Boy (DMG-01), including GateBoy, which was reverse-engineered from die shots of… | 23 | 1172 | active |
| geohot/qira QIRA is a QEMU-based interactive runtime analyser that traces program execution and presents it in a web UI, acting as a competitor to stra… | 23 | 4072 | maintenance |
| luoyesiqiu/dpt-shell dpt-shell is an Android Dex protection shell that hollows out DEX method implementations and reconstructs them at runtime to protect APK/AA… | 94 | 1157 | active |
| Exeinfo PE Exeinfo Pe is a free Windows GUI tool that detects packers, protectors, compilers, .NET obfuscators, and packed binary data formats in PE e… | 91 | 1156 | active |
| GJDuck/e9patch E9Patch is a static binary rewriting tool for x86_64 Linux ELF executables and shared objects, producing patched binaries that work as drop… | 77 | 1156 | active |
| naim94a/lumen Lumen is a self-hosted, open-source replacement for Hex-Rays' Lumina server that stores and shares IDA Pro function signatures, comments, a… | 64 | 1155 | active |