domain: reverse-engineering
558 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| JusticeRage/Manalyze Manalyze is a static analyzer for PE (Windows executable) files written in C++. It performs primary malware assessment by parsing PE struct… | 87 | 1145 | active |
| ExeinfoASL/ASL Exeinfo Pe is a free Windows GUI tool that detects packers, protectors, compilers, .NET obfuscators, and packed binary data formats in PE e… | 93 | 1142 | active |
| GJDuck/e9patch E9Patch is a static binary rewriting tool for x86_64 Linux ELF executables and shared objects, producing patched binaries that work as drop… | 83 | 1137 | active |
| AloneMonkey/frida-ios-dump A Python CLI script that uses Frida to dump decrypted iOS app binaries from a jailbroken device and packages them into an IPA. It connects … | 32 | 3921 | maintenance |
| mrphrazer/reverser_ai ReverserAI is a Binary Ninja plugin that provides automated reverse engineering assistance using locally-hosted large language models runni… | 68 | 1127 | active |
| REhints/efiXplorer efiXplorer is an IDA Pro plugin and loader that automates static analysis of UEFI firmware. It recovers EFI service function calls, identif… | 90 | 1125 | active |
| CodingGay/BlackObfuscator BlackObfuscator is a Java-based obfuscator for Android DEX files that applies control flow flattening to make decompiled code hard to analy… | 31 | 1123 | active |
| Endermanch/XPKeygen A C++ tool that generates valid Windows XP and Windows Server 2003 VLK product keys from a raw product key, based on reverse-engineered ell… | 62 | 1122 | active |
| Washi1337/AsmResolver AsmResolver is a .NET library for reading, modifying, and writing Portable Executable (PE) files, including those with .NET metadata. It pr… | 94 | 1117 | active |
| luoyesiqiu/dpt-shell dpt-shell is an Android Dex protection shell that hollows out DEX method implementations and reconstructs them at runtime to protect APK/AA… | 100 | 1115 | active |
| KJCracks/Clutch Clutch is a fast iOS executable decryption and dumping tool that extracts decrypted binaries and .ipa files from installed apps on jailbrok… | 23 | 3824 | maintenance |
| jwping/wxbot A Go-based WeChat hook/robot framework that injects into the Windows PC WeChat client (specific versions 3.9.8.x) to expose a bot API, runn… | 27 | 1099 | active |
| SteamTracking/SteamTracking A project that tracks and reverse-engineers Steam and Valve data, including protobuf definitions and changes across Steam services. It moni… | 77 | 1095 | active |
| wisk/medusa Medusa is an open-source, modular, interactive disassembler written in C++, organized as a library with frontends including a GUI (qMedusa)… | 57 | 1090 | active |
| amruth-sn/kong Kong is an LLM-orchestrated reverse engineering CLI that plugs AI into Ghidra's analysis engine to recover function names, types, and struc… | 63 | 1087 | active |
| memflow/memflow memflow is a Rust library providing a modular framework for physical memory introspection of machines, including live hardware, virtual mac… | 58 | 1087 | active |
| bitdefender/bddisasm bddisasm is a fast, lightweight x86/x64 instruction decoder library written in C with no external dependencies, no memory allocation, and t… | 74 | 1084 | active |
| HZJQF/help_tool A PyQt5-based Windows GUI tool that uses inference models to identify the encryption or hashing algorithm behind a given ciphertext and att… | 24 | 1083 | active |
| gorisanson/pikachu-volleyball A browser-based reimplementation of the 1997 Windows game Pikachu Volleyball, created by reverse engineering the original machine code (phy… | 71 | 1080 | active |
| mandiant/GoReSym GoReSym is a cross-platform CLI tool that extracts symbols, function metadata, types, and program metadata from Go binaries, including stri… | 91 | 1069 | active |
| RuntimeBrowser RuntimeBrowser is a class browser for the Objective-C runtime on iOS and OS X that exposes all loaded classes, methods, and dynamically gen… | 70 | 3658 | maintenance |
| QQBackup/qq-win-db-key A collection of Python and Frida scripts for extracting database encryption keys from QQ (Tencent's messenger) across Windows, Linux, macOS… | 72 | 1064 | active |
| lico-n/ZygiskFrida A Zygisk (and Riru) module for rooted Android devices that injects the Frida gadget into application processes in a stealthy manner. It avo… | 52 | 1063 | active |
| theapache64/stackzy Stackzy is a cross-platform desktop application built with Compose Desktop that identifies the libraries used inside an Android APK. It dec… | 71 | 1062 | active |
| Xeeynamo/sotn-decomp A matching decompilation project recreating the C source code of Castlevania: Symphony of the Night from its original binaries for PS1, PSP… | 68 | 1062 | active |
| MatthewKuKanich/CAN_Commander CAN Commander is a tool for reverse engineering and analyzing CAN bus systems, pairing a Flipper Zero app with ESP32 firmware to interact w… | 63 | 1059 | active |
| hyugogirubato/KeyDive KeyDive is a Python CLI tool that extracts Widevine L3 DRM keys and device credentials from rooted Android devices using Frida instrumentat… | 80 | 1058 | active |
| echo094/decode-js A Node.js CLI tool built on Babel that analyzes and reverses obfuscated JavaScript back into readable source. It supports common obfuscatio… | 77 | 1054 | active |
| nygard/class-dump class-dump is a command-line utility that examines the Objective-C runtime information in Mach-O binaries and generates Objective-C header … | 23 | 3585 | maintenance |
| apkunpacker/MagiskDetection A curated collection of publicly available proof-of-concept Android apps that detect root, Magisk, Zygisk, and hooking frameworks like Frid… | 68 | 1050 | active |
| paradiseduo/appdecrypt A Swift CLI tool that decrypts FairPlay-encrypted Mach-O application binaries on macOS (SIP-enabled, macOS 11.3 or below, with newer suppor… | 56 | 1046 | active |
| ac3ss0r/obfusheader.h Obfusheader.h is a portable, header-only C++14 library providing compile-time obfuscation via metaprogramming, including string and constan… | 27 | 1046 | active |
| Walter-Sparrow/lunar-tear Lunar Tear is a private server implementation for a discontinued mobile game, written in Go. It bundles gRPC, CDN, and auth services with a… | 70 | 1043 | active |
| hypery11/flipper-tesla-fsd An open-source Tesla CAN bus toolkit implemented as a Flipper Zero app with an ESP32 port, providing features like FSD region-gate bypass, … | 76 | 1038 | active |
| mitmproxy/android-unpinner A Python CLI tool that removes certificate pinning from Android APKs so traffic can be intercepted with mitmproxy, without requiring a root… | 54 | 1032 | active |
| Vuemony/vue-after-free A PlayStation 4 userland code execution exploit delivered through the PlayStation Vue app, chained with kernel exploits (Lapse, Poopsploit/… | 67 | 1029 | active |
| danielweidman/pixmob-ir-reverse-engineering A reverse-engineering project and Python tooling for the PixMob infrared (and RF) protocol used by LED wristbands at large events, enabling… | 62 | 1028 | active |
| toniebox-reverse-engineering/teddycloud TeddyCloud is an open-source replacement server for the Boxine Cloud that lets Toniebox owners host cloud services locally, serving their o… | 94 | 1026 | active |
| Reloaded-Project/Reloaded-II Reloaded II is a universal, C#/.NET-based mod loader and mod management framework for native games on X86 and X64. It uses DLL injection to… | 97 | 1016 | active |
| Spade-sec/First A WeChat mini-program security debugging tool (fork/extension of WMPFDebugger) that uses Frida injection and Chrome DevTools Protocol bridg… | 74 | 1015 | active |
| gcarmix/HexWalk HexWalk is a cross-platform GUI hex editor, viewer, and binary analyzer built on qhexedit2, Capstone, and Qt. It combines hex editing with … | 84 | 1011 | active |
| indetectables-net/toolkit A curated Windows toolkit bundling 101 applications for reverse engineering, malware analysis, and cracking, installed via an automated Inn… | 89 | 1009 | active |
| LuckyPray/DexKit DexKit is a high-performance dex parsing and deobfuscation library implemented in C++ with Kotlin bindings, used to locate obfuscated class… | 87 | 1008 | active |
| nabla-c0d3/ssl-kill-switch2 SSL Kill Switch 2 is a blackbox Cydia Substrate tweak that disables SSL/TLS certificate validation, including certificate pinning, in iOS a… | 23 | 3311 | maintenance |
| EasyHook/EasyHook EasyHook is a Windows API hooking library that lets you intercept and extend unmanaged code APIs with managed (.NET) or native hook handler… | 23 | 3292 | maintenance |
| morkt/GARbro GARbro is a Windows GUI application for browsing, extracting, and converting resources (archives, images, audio) from visual novel games. I… | 23 | 3263 | maintenance |
| plasma-disassembler/plasma Plasma is an interactive disassembler for x86/x86-64, ARM, and MIPS binaries that generates indented pseudo-code with colored syntax. It su… | 32 | 3072 | maintenance |
| WindySha/Xpatch Xpatch is a Java CLI tool that repackages and re-signs Android APK files so the resulting APK can load installed Xposed modules. It enables… | 50 | 3057 | maintenance |
| ac-pm/Inspeckage Inspeckage is an Xposed module that performs dynamic analysis of Android applications by hooking Android API functions to observe runtime b… | 23 | 2982 | maintenance |
| Jermic/Android-Crack-Tool A macOS GUI application that bundles common Android APK reverse-engineering tools (Apktool, Dex2Jar, JD-GUI, SignApk, Zipalign) into one in… | 23 | 2942 | maintenance |
| lifting-bits/mcsema McSema is a framework that lifts native x86, amd64, aarch64, sparc32, and sparc64 executable binaries (ELF and PE) into LLVM bitcode. It wo… | 10 | 2787 | maintenance |
| ma1co/Sony-PMCA-RE A tool that interfaces with Sony digital cameras over USB to tweak settings, dump firmware, and install custom Android apps via the PlayMem… | 23 | 2777 | maintenance |
| google/enjarify Enjarify is a Python 3 tool that translates Dalvik bytecode from Android APK/DEX files into equivalent Java bytecode (JAR), enabling Java a… | 10 | 2747 | maintenance |
| hanbinglengyue/FART FART is an automated Android app unpacking (dex dumping) tool for ART environments, based on active invocation, implemented on Android 6.0/… | 33 | 2724 | maintenance |
| leibnitz27/cfr CFR (Class File Reader) is a Java decompiler written entirely in Java 6 that can decompile modern Java bytecode, including features from Ja… | 61 | 2675 | maintenance |
| everdox/InfinityHook InfinityHook is a Windows kernel library that hooks system calls, context switches, page faults, and DPCs by abusing ETW trace mechanics, r… | 32 | 2673 | maintenance |
| y9nhjy/Proxifier-Keygen A Python CLI keygen that generates registration keys for Proxifier (setup, portable, and Mac variants), based on a reverse-engineering anal… | 28 | 2664 | maintenance |
| DarthTon/Xenos Xenos is a Windows DLL injector built on the Blackbone library, supporting x86/x64 processes, manual image mapping, managed image injection… | 23 | 2645 | maintenance |
| xoreaxeaxeax/rosenbridge Rosenbridge is a security research project that documents a hardware backdoor in some VIA C3 x86 processors, allowing userland code to bypa… | 32 | 2614 | maintenance |
| xdmjun/wxappUnpacker wxappUnpacker is a Node.js tool that unpacks and decompiles WeChat mini-program packages (.wxapkg files), restoring WXML, WXSS, JS, and con… | 32 | 2430 | maintenance |
| retroplasma/earth-reverse-engineering A reverse-engineering project documenting and implementing access to Google Earth's undocumented 3D satellite mode, including URL structure… | 10 | 2322 | maintenance |
| buginux/WeChatRedEnvelop An iOS jailbreak tweak (Cydia plugin) written in Objective-C that automatically grabs red envelopes (lucky money) in WeChat. It integrates … | 10 | 2292 | maintenance |
| ldpreload/BlackLotus An open-source UEFI bootkit targeting Windows that implements a Secure Boot bypass, kernel-level persistence, and an HTTP-based C2 loader w… | 29 | 2240 | maintenance |
| greatscottgadgets/ubertooth Ubertooth is an open source wireless development platform for Bluetooth experimentation, providing host software, firmware, and hardware de… | 56 | 2125 | maintenance |
| JKornev/hidden A Windows kernel driver with a usermode library and CLI that can hide processes, files, directories, and registry keys, and protect process… | 23 | 2051 | maintenance |
| weak1337/Alcatraz Alcatraz is a GUI-based x64 binary obfuscator for Windows PE files (.exe, .dll, .sys) written in C++. It applies transformations like contr… | 31 | 1993 | maintenance |
| corelan/mona mona.py is a Python plugin for debuggers (Immunity Debugger, x64dbg) that assists with exploit development tasks such as finding ROP gadget… | 10 | 1888 | maintenance |
| glmcdona/Process-Dump Process Dump is a Windows command-line reverse-engineering tool that dumps unpacked malware PE files and loose code chunks from process mem… | 23 | 1852 | maintenance |
| ljc545w/ComWeChatRobot A PC WeChat robot implemented in C++ that reverse-engineers the Windows WeChat client to expose contacts, messaging, group management, and … | 10 | 1816 | maintenance |
| lockedbyte/CVE-2021-40444 A proof-of-concept exploit generator for CVE-2021-40444, a Microsoft Office Word remote code execution vulnerability. It generates maliciou… | 32 | 1800 | maintenance |
| gdbinit/Gdbinit A feature-rich .gdbinit configuration script that enhances GDB with custom commands, macros, and a reverse-engineering-oriented interface f… | 32 | 1796 | maintenance |
| tandasat/HyperPlatform HyperPlatform is an Intel VT-x based hypervisor for Windows that provides a thin VM-exit filtering platform for research. It lets researche… | 10 | 1759 | maintenance |
| java-deobfuscator/deobfuscator A Java-based CLI tool that deobfuscates Java JAR files produced by commercial obfuscators such as Zelix KlassMaster, Stringer, Allatori, Da… | 23 | 1756 | maintenance |
| Paisseon/SatellaJailed Satella Jailed is an in-app purchase cracker for non-jailbroken ('jailed') iOS devices running iOS 12–16, distributed as an injectable dyli… | 32 | 1698 | maintenance |
| marin-m/pbtk pbtk (Protobuf toolkit) is a Python-based set of scripts with a unified GUI for extracting Protobuf data structures from programs (Java run… | 99 | 1679 | maintenance |
| taviso/ctftool An interactive command-line tool for exploring the CTF (Clipboard/Text Services Framework) protocol used by Windows Text Services. It suppo… | 23 | 1667 | maintenance |
| asLody/whale Whale is a cross-platform hook framework written in C++ that runs on Android, iOS, Linux, and macOS, supporting ARM/THUMB, ARM64, X86, and … | 32 | 1665 | maintenance |
| dpnishant/appmon AppMon is an automated framework for monitoring and tampering with system API calls of native macOS, iOS, and Android apps, built on Frida.… | 10 | 1630 | maintenance |
| dstmath/frida-unpack A Frida-based unpacking tool for Android apps that hooks libart.so's OpenMemory (or OpenCommon on Android 10) to dump decrypted DEX files f… | 44 | 1612 | maintenance |
| Squalr/Squalr-Sharp Squalr is a high-performance memory editor for Windows desktop games, written in C#, supporting memory scanning, pointer scanning, and x86/… | 23 | 1597 | maintenance |
| lelinhtinh/de4js de4js is a web-based JavaScript deobfuscator and unpacker that transforms obfuscated code (Eval, Array, JSFuck, JJencode, AAencode, Packer,… | 10 | 1580 | maintenance |
| unixpickle/gobfuscate A command-line tool that obfuscates Go binaries by compiling from obfuscated source code. It hashes package names, global identifiers, meth… | 32 | 1573 | maintenance |
| YimMenu/YimMenu YimMenu is a mod menu for Grand Theft Auto V that protects players against common public crashes and adds gameplay enhancements, including … | 10 | 1569 | maintenance |
| gaasedelen/tenet Tenet is an IDA Pro plugin for exploring and navigating execution traces of binaries. It provides a timeline widget and bidirectional execu… | 23 | 1545 | maintenance |
| idapython/src IDAPython is the Python scripting SDK and plugin framework for Hex-Rays' IDA Pro binary analysis suite, exposing IDA's disassembler, decomp… | 10 | 1536 | maintenance |
| AsuharietYgvar/AppleNeuralHash2ONNX A Python tool that converts Apple's NeuralHash perceptual hashing model (used in Apple's CSAM Detection system) into ONNX format. It includ… | 32 | 1534 | maintenance |
| chip-red-pill/MicrocodeDecryptor A set of Python scripts for decrypting Intel Atom CPU microcode updates, using encryption keys extracted via the Red Unlock debugging techn… | 32 | 1510 | maintenance |
| ChiChou/bagbak bagbak is a Node.js CLI tool that uses Frida to decrypt iOS App Store binaries on a jailbroken device, dumping decrypted IPAs including app… | 90 | 1494 | maintenance |
| ptrkrysik/gr-gsm A set of GNU Radio blocks and tools for receiving and decoding GSM transmissions using software-defined radios. It is based on the Airprobe… | 37 | 1494 | maintenance |
| ezshine/wxapkg-convertor A Node.js command-line tool that decompiles WeChat mini-program and mini-game .wxapkg packages back into readable source code, convertible … | 23 | 1491 | maintenance |
| CYRUS-STUDIO/ApkToolPlus ApkToolPlus is a visual, cross-platform desktop application for Android APK reverse analysis built in Java. It bundles APK decompilation/re… | 40 | 1476 | maintenance |
| ptswarm/reFlutter A Python-based framework that repacks Flutter Android and iOS apps with a patched Flutter engine library to enable dynamic analysis. It red… | 10 | 1463 | maintenance |
| programa-stic/barf-project BARF is an open-source Python framework for binary analysis and reverse engineering. It lifts instructions from x86 and ARM binaries into a… | 32 | 1452 | maintenance |
| L4ys/LazyIDA LazyIDA is an IDA Pro plugin written in Python (IDAPython) that adds convenience features like data format conversion with clipboard copy, … | 62 | 1439 | maintenance |
| 易开发 (DeveloperHelper) DeveloperHelper (易开发) is an Android developer/analysis tool app with an Xposed module that dumps DEX files from packed (hardened) APKs, plu… | 39 | 1419 | maintenance |
| NtQuery/Scylla Scylla is a Windows x86/x64 tool for reconstructing import tables (IAT) of unpacked or dumped binaries. It supports dumping processes, fixi… | 23 | 1418 | maintenance |
| 0xnobody/vmpdump VMPDump is a dynamic dumper and import fixer for binaries protected with VMProtect 3.x (x64), built on the VTIL intermediate language. It s… | 23 | 1412 | maintenance |
| ele7enxxh/Android-Inline-Hook A C library for inline hooking of native functions on 32-bit Android, supporting ARM, Thumb16, and Thumb32 instruction sets. It lets you re… | 32 | 1401 | maintenance |
| tandasat/DdiMon DdiMon is a hypervisor-based research tool that performs stealth inline hooking of Windows kernel API calls using Intel VT-x EPT memory sha… | 32 | 1398 | maintenance |
| 0xgalz/Virtuailor Virtuailor is an IDAPython plugin for IDA Pro that reconstructs C++ virtual tables (vtables) for Intel x86/x64 and AArch64 binaries. It com… | 32 | 1395 | maintenance |