domain: reverse-engineering
558 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| collin80/SavvyCAN SavvyCAN is a Qt-based cross-platform CAN bus analysis tool for capturing, visualizing, saving, and loading CAN frames. It supports many lo… | 60 | 1782 | active |
| m4b/bingrep bingrep is a cross-platform command-line binary parser and colorizer written in Rust, supporting ELF, Mach-O, PE, and Unix/BSD archives. It… | 59 | 1777 | active |
| JesusFreke/smali smali/baksmali is an assembler and disassembler for the dex bytecode format used by Android's Dalvik VM. It converts dex files to human-rea… | 10 | 6628 | maintenance |
| xaitax/Chrome-App-Bound-Encryption-Decryption A Windows post-exploitation research tool that bypasses Chromium's App-Bound Encryption using direct syscall-based reflective process hollo… | 63 | 1762 | active |
| githubXiaowangzi/NP-Manager NP-Manager is an Android application for APK, DEX, JAR, Smali, PDF, and media file manipulation. It provides reverse-engineering features s… | 76 | 1758 | active |
| sigalor/whatsapp-web-reveng A reverse-engineered description and Node.js re-implementation of the WhatsApp Web API, communicating over WebSockets with the same encrypt… | 32 | 6491 | maintenance |
| polymorf/findcrypt-yara An IDA Pro plugin that uses YARA rules to scan binaries for known cryptographic constants and other recognizable byte patterns. It helps re… | 32 | 1735 | active |
| revng/revng rev.ng is an open-source binary analysis framework and decompiler built on LLVM and QEMU, supporting over 20 CPU architectures. It automati… | 77 | 1728 | active |
| CodingGay/BlackDex BlackDex is an Android app that unpacks DEX files from installed or uninstalled APKs on Android 5.0-12 without requiring root, Xposed, Frid… | 23 | 6439 | maintenance |
| vfsfitvnm/frida-il2cpp-bridge A Frida module written in TypeScript for dumping, tracing, and hijacking IL2CPP (Unity) applications at runtime without needing the global-… | 93 | 1726 | active |
| cmu-sei/pharos Pharos is a static binary analysis framework from Carnegie Mellon's Software Engineering Institute built on the ROSE compiler infrastructur… | 75 | 1723 | active |
| ev-flow/quark-engine Quark Engine is an Android malware scoring and analysis system that inspects APKs using rule-based behavioral detection on Dalvik bytecode.… | 98 | 1713 | active |
| lasting-yang/frida_hook_libart A collection of Frida hook scripts for intercepting Android ART JNI functions, most notably RegisterNatives. It reveals native method regis… | 54 | 1713 | active |
| hasherezade/tiny_tracer A Pin Tool built on Intel Pin for dynamic binary instrumentation that traces API calls, syscalls, selected instructions, and section transi… | 80 | 1692 | active |
| KeenSecurityLab/BinAbsInspector BinAbsInspector is a static analyzer for automated reverse engineering and vulnerability scanning in binaries, built on abstract interpreta… | 23 | 1672 | active |
| tabby-sec/tabby Tabby is a Java static code analysis tool built on the Soot framework that converts JAR/WAR/CLASS files into a code property graph stored i… | 51 | 1659 | active |
| 0xdea/frida-scripts A collection of Frida instrumentation scripts for reverse engineering mobile apps and native binaries, including tracers and enumerators fo… | 80 | 1653 | active |
| klezVirus/SysWhispers3 SysWhispers3 is a Python command-line tool that generates header and assembly (ASM) file pairs for direct system calls to the Windows kerne… | 32 | 1653 | active |
| Air14/HyperHide HyperHide is a hypervisor-based anti-anti-debug plugin for x64dbg/x32dbg that hides debuggers from detection. It uses Intel EPT to hook sys… | 23 | 1652 | active |
| zardus/preeny Preeny is a collection of LD_PRELOAD libraries written in C that help with binary exploitation and CTF-style challenges. It disables functi… | 54 | 1650 | active |
| kefir500/apk-editor-studio APK Editor Studio is a free, open-source, cross-platform GUI tool for reverse-engineering Android APK files, built in C++/Qt. It lets users… | 24 | 1647 | active |
| illera88/Ponce Ponce is an IDA Pro plugin that adds one-click symbolic execution and taint analysis over binaries, built on the Triton engine and written … | 34 | 1627 | active |
| Jon-Becker/heimdall-rs Heimdall is a Rust-based EVM smart contract toolkit for bytecode analysis, decompilation, disassembly, control flow graph generation, stora… | 89 | 1602 | active |
| pmret/papermario A work-in-progress matching decompilation of Paper Mario for the Nintendo 64, written in C. It rebuilds byte-identical ROMs for the US, JP,… | 77 | 1601 | active |
| horsicq/XELFViewer XELFViewer is a GUI application for viewing and editing ELF (Executable and Linkable Format) binary files on Windows, Linux and macOS. It i… | 67 | 1584 | active |
| attify/firmware-analysis-toolkit Firmware Analysis Toolkit (FAT) is a Python-based automation wrapper around Firmadyne that emulates IoT and embedded device firmware images… | 23 | 1582 | active |
| pret/pokefirered A complete decompilation of Pokémon FireRed and LeafGreen that rebuilds byte-identical GBA ROM images from C source code. It is part of the… | 75 | 1574 | active |
| littledivy/mimic mimic is a Python tool that captures traffic from mobile or web apps via mitmproxy, extracts authentication material, and uses AI to genera… | 55 | 1550 | active |
| AeonLucid/AndroidNativeEmu A Python library that partially emulates Android native (.so) libraries on a host machine using the Unicorn CPU emulator. It emulates the J… | 26 | 1549 | active |
| Hexeption/MCP-Reborn MCP-Reborn is a Mod Coder Pack for Minecraft that decompiles and maps the game's source code so developers can create modded clients and st… | 84 | 1546 | active |
| m4b/goblin Goblin is a Rust library for parsing and loading binary executable formats including ELF, Mach-O, PE, and Unix/BSD archives. It offers zero… | 71 | 1541 | stable |
| igogo-x86/HexRaysPyTools An IDA Pro plugin that enhances the Hex-Rays decompiler workflow. It assists in reconstructing structures and classes, detecting virtual ta… | 32 | 1533 | active |
| canyie/pine Pine is a dynamic Java method hooking framework for the Android ART runtime, allowing interception and modification of almost any Java meth… | 55 | 1528 | active |
| deathmemory/FridaContainer FridaContainer is a modular collection of popular and custom Frida scripts written in TypeScript to speed up reverse engineering work on An… | 56 | 1512 | active |
| DarthTon/Blackbone Blackbone is a C++ library for Windows memory hacking, providing APIs for process memory manipulation, DLL injection, manual PE image mappi… | 32 | 5479 | maintenance |
| facebook/fishhook fishhook is a small C library from Facebook that dynamically rebinds symbols in Mach-O binaries running on iOS, similar to DYLD_INTERPOSE o… | 32 | 5425 | maintenance |
| dekuNukem/bob_cassette_rewinder An open-source hardware/firmware project that defeats the DRM on Bob dishwasher detergent cassettes, allowing users to reset and refill the… | 32 | 1493 | active |
| fkie-cad/FACT_core FACT (Firmware Analysis and Comparison Tool) is a self-hosted Python application that automates firmware security analysis for devices like… | 92 | 1460 | active |
| duty1g/x64dbg-mcp-server A native MCP (Model Context Protocol) plugin for x64dbg written in Zig that exposes the debugger's full functionality over HTTP with Stream… | 57 | 1460 | active |
| ViRb3/magisk-frida A Magisk/KernelSU/APatch module that automatically installs and runs frida-server on boot on rooted Android devices. It stays up to date by… | 93 | 1450 | active |
| ergrelet/unlicense A Python 3 command-line tool that dynamically unpacks executables protected with Themida/WinLicense 2.x and 3.x. It automatically recovers … | 23 | 1450 | active |
| SeeFlowerX/stackplz stackplz is an eBPF-based stack tracing tool for Android (arm64). It supports syscall tracing, uprobe hooking of 64-bit userspace libraries… | 64 | 1447 | active |
| zodiacon/AllTools A collection of Pavel Yosifovich's reasonably stable Windows system tools, including process/driver monitors, kernel object viewers, PE fil… | 71 | 1440 | active |
| nowsecure/r2frida r2frida is a radare2 plugin that integrates the Frida dynamic instrumentation toolkit, letting users inspect and manipulate local or remote… | 94 | 1434 | active |
| WPeace-HcH/WPeGPT WPeGPT is an IDA Pro plugin that integrates LLM models (OpenAI, DeepSeek, or any OpenAI-compatible API) into binary analysis workflows. It … | 75 | 1418 | active |
| Dryxio/auto-re-agent auto-re-agent is an open-source AI reverse-engineering agent that combines Ghidra binary analysis with LLMs (Claude, Codex, OpenAI-compatib… | 78 | 1410 | active |
| hasherezade/libpeconv libPeConv is a C++ library for loading, manipulating, and dumping Windows PE (Portable Executable) files. It provides a 'swiss army knife' … | 67 | 1385 | active |
| Spuckwaffel/UEDumper UEDumper is a C++ tool that dumps Unreal Engine games (UE 4.19 through 5.3) and generates SDKs, with a live ImGui-based editor for viewing … | 55 | 1380 | active |
| ChiChou/grapefruit Grapefruit is an open-source mobile security testing suite for iOS and Android that provides a browser-based GUI over Frida for runtime ins… | 91 | 1379 | active |
| guidedhacking/GuidedHacking-Injector A C++ DLL injection library supporting x86, WOW64, and x64 injection with five injection methods and six shellcode execution techniques. It… | 32 | 1377 | active |
| ClownQq/YDArk YDArk is a free x64 Windows kernel inspection tool similar to PCHunter, providing GUI views of processes, threads, handles, drivers, kernel… | 32 | 1375 | active |
| hasherezade/exe_to_dll A command-line tool that converts a Windows EXE into a DLL that can be loaded like a library, exporting the original entry point as a 'Star… | 55 | 1373 | stable |
| syssec-utd/pylingual PyLingual is a CPython bytecode decompiler that recovers Python source code from .pyc files for all Python versions since 3.6. It can be ru… | 63 | 1365 | active |
| Cracked5pider/Stardust Stardust is a modern 32/64-bit position independent shellcode (implant) template written in C++20. It provides compile-time FNV-1a hashing … | 70 | 1364 | active |
| LSPosed/LSPlant LSPlant is a C++ library for hooking Java methods in the Android Runtime (ART), supporting hook/unhook and inline deoptimization. It is par… | 77 | 1359 | active |
| xihan123/SignHook SignHook is an Xposed/LSPosed module for Android that spoofs app signature checks by returning a user-configured fake signature when a host… | 83 | 1354 | active |
| fkie-cad/cwe_checker cwe_checker is a Rust-based suite of checks that detects common bug classes (CWEs) such as null pointer dereferences and buffer overflows i… | 67 | 1352 | active |
| moyuwa/ApkCheckPack A Go-based CLI tool that detects APK hardening/packing features from 40+ vendors, plus third-party SDKs, anti-environment checks (ROOT, emu… | 82 | 1347 | active |
| littleWhiteDuck/SimpleHook SimpleHook is an Xposed/LSPosed module for Android app debugging and research, offering configurable Java/Smali hooking of methods, fields,… | 93 | 1337 | active |
| CERT-Polska/drakvuf-sandbox DRAKVUF Sandbox is an automated, agentless malware analysis system that runs suspicious files inside a hypervisor-level sandbox powered by … | 87 | 1334 | active |
| OpenDriver2/REDRIVER2 A complete open-source C reimplementation of the PlayStation game Driver 2, produced by disassembling and translating the original MIPS cod… | 81 | 1331 | active |
| cfig/Android_boot_image_editor A Gradle-based Java tool for unpacking, editing, and repacking Android boot images such as boot.img, vendor_boot.img, recovery.img, vbmeta.… | 66 | 1322 | active |
| iGio90/Dwarf Dwarf is a full-featured multi-architecture, multi-OS debugger built on PyQt5 and Frida, aimed at reverse engineers, security analysts, and… | 32 | 1317 | active |
| sharkdp/binocle Binocle is a graphical tool that visualizes binary data by colorizing bytes according to configurable rules and rendering them as pixels in… | 24 | 1317 | stable |
| miscusi-peek/cheatengine-mcp-bridge A bridge that connects AI coding assistants (Claude, Cursor, Copilot) to Cheat Engine via the Model Context Protocol, letting agents read/w… | 60 | 1313 | active |
| apk-editor/APK-Explorer-Editor APK Explorer & Editor (AEE) is an open-source Android application for exploring the contents of installed APK files and APKs picked from st… | 85 | 1312 | active |
| CalebFenton/simplify Simplify is a generic Android deobfuscator that virtually executes Dalvik methods in a sandbox (smalivm) and applies optimizations like con… | 23 | 4657 | maintenance |
| Vector35/binaryninja-api The public API, examples, and documentation for Binary Ninja, a commercial reverse engineering platform. It provides C++, Python, and Rust … | 95 | 1303 | active |
| Rurik/Noriben Noriben is a Python script that wraps Sysinternals Procmon to automatically collect, analyze, and report runtime indicators of malware, pro… | 56 | 1297 | stable |
| n64decomp/mk64 A complete C decompilation of Mario Kart 64 that rebuilds byte-matching ROMs for USA and European revisions from extracted game assets. It … | 76 | 1292 | active |
| Bixilon/Minosoft Minosoft is an open-source Minecraft client reimplementation written from scratch in Kotlin, using OpenGL for rendering. It is a free-softw… | 72 | 1283 | active |
| gaasedelen/patching An interactive binary patching plugin for IDA Pro that adds a robust in-disassembler workflow for editing assembly instructions. It support… | 23 | 1279 | active |
| tklengyel/drakvuf DRAKVUF is a virtualization-based, agentless black-box binary analysis system that traces execution of arbitrary binaries, kernels, and fir… | 66 | 1268 | active |
| SychicBoy/NETReactorSlayer NETReactorSlayer is an open-source (GPLv3) deobfuscator and unpacker targeting assemblies protected with Eziriz .NET Reactor. It is availab… | 23 | 1255 | active |
| relative/synchrony Synchrony is a JavaScript deobfuscator and cleaner focused on undoing obfuscation from javascript-obfuscator/obfuscator.io. It works as a C… | 82 | 1250 | active |
| JetBrains/fernflower Fernflower is an analytical decompiler that converts Java bytecode (class, jar, zip files) back into readable Java source code. It is bundl… | 77 | 4371 | maintenance |
| rdbo/libmem A cross-platform game hacking library for C, C++, Rust, and Python providing process and memory manipulation, function hooking/detouring, c… | 74 | 1236 | active |
| alexhude/uEmu uEmu is an IDA Pro plugin built on the Unicorn engine that lets you emulate code directly inside the IDA disassembler. It supports x86, x64… | 76 | 1235 | active |
| CensoredUsername/unrpyc Unrpyc is a decompiler that converts compiled Ren'Py .rpyc script files back into readable Ren'Py script source. It can be run as a command… | 72 | 1235 | active |
| horsicq/XPEViewer XPEViewer is a cross-platform GUI application for viewing and editing PE (Portable Executable) files, the executable format used on Windows… | 76 | 1230 | active |
| ThunderCls/xAnalyzer xAnalyzer is a plugin for the x64dbg debugger that performs extended static code analysis on debugged applications. It detects API function… | 51 | 1227 | active |
| cv-cat/XianYuApis A reverse-engineered unofficial API library for Xianyu (Goofish, Alibaba's second-hand marketplace) that wraps its HTTP endpoints and WebSo… | 79 | 1206 | active |
| x64dbg/GleeBug GleeBug is a debugging framework for Windows written in C, designed to make building debuggers and debugging tools complete and easy to use… | 76 | 1201 | active |
| petoolse/petools PE Tools is a Windows GUI toolkit for researching and manipulating Portable Executable (PE) files and running processes. It bundles a PE he… | 44 | 1197 | active |
| P3GLEG/Whaler Whaler is a Go CLI tool that reverse engineers Docker images back into the Dockerfiles that created them. It also extracts files added via … | 57 | 1192 | active |
| WolvenKit/WolvenKit WolvenKit is an open-source desktop mod editor and creator for CD Projekt's REDengine games, primarily Cyberpunk 2077. It can read and writ… | 94 | 1188 | active |
| goretk/redress Redress is a command-line tool for analyzing stripped Go binaries, reconstructing symbols and extracting information such as compiler versi… | 94 | 1186 | active |
| yazgx97/frida-ios-hook A Python/JavaScript CLI tool that wraps Frida to make it easy to trace classes and functions, hook methods, and modify return values on iOS… | 69 | 1183 | active |
| YosysHQ/icestorm Project IceStorm documents the reverse-engineered bitstream format of Lattice iCE40 FPGAs and provides tools for analyzing and creating bit… | 57 | 1182 | active |
| dethrace-labs/dethrace Dethrace is an open-source reverse-engineering project that rebuilds the 1997 driving/mayhem game Carmageddon to run natively on modern sys… | 81 | 1181 | active |
| kuizuo/js-deobfuscator An automated JavaScript deobfuscation tool built on Babel AST transforms, offering a CLI, a TypeScript API, and an online playground. It re… | 89 | 1171 | active |
| aappleby/metroboy A collection of gate-level simulators for the original Game Boy (DMG-01), including GateBoy, which was reverse-engineered from die shots of… | 26 | 1170 | active |
| geohot/qira QIRA is a QEMU-based interactive runtime analyser that traces program execution and presents it in a web UI, acting as a competitor to stra… | 23 | 4070 | maintenance |
| reversenseorg/dexcalibur Reversense (Dexcalibur 2) is a binary intelligence platform that automates reverse engineering of mobile and embedded applications. It comb… | 68 | 1168 | active |
| nccgroup/Sniffle Sniffle is an open-source sniffer for Bluetooth 5 and 4.x LE that runs on TI CC1352/CC26x2 hardware with a Python host-side tool. It captur… | 42 | 1164 | active |
| P1sec/hermes-dec hermes-dec is a Python-based reverse engineering tool that disassembles and decompiles React Native applications compiled to the Hermes VM … | 98 | 1156 | active |
| WhiteNightShadow/hello_js_reverse_skill An AI-powered 'Skill' package for JavaScript reverse engineering that plugs into AI coding tools like Claude Code, Cursor, and Codex. It pr… | 78 | 1156 | active |
| naim94a/lumen Lumen is a self-hosted, open-source replacement for Hex-Rays' Lumina server that stores and shares IDA Pro function signatures, comments, a… | 67 | 1151 | active |
| ben-sb/javascript-deobfuscator A general-purpose JavaScript deobfuscator that removes common obfuscation techniques such as array unpacking, proxy functions, expression o… | 46 | 1149 | active |
| ichason/CPosed CPosed is an Android hooking framework forked from LSPosed that enables Xposed-style module injection on rooted devices running Android 8.1… | 47 | 1148 | active |