Open-source reverse-engineering software
562 open-source libraries, tools and applications tagged reverse-engineering, ranked by how closely reverse-engineering is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
562 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| ben-sb/javascript-deobfuscator A general-purpose JavaScript deobfuscator that removes common obfuscation techniques such as array unpacking, proxy functions, expression o… | 43 | 1154 | active |
| Xeeynamo/sotn-decomp A matching decompilation project recreating the C source code of Castlevania: Symphony of the Night from its original binaries for PS1, PSP… | 68 | 1152 | active |
| ichason/CPosed CPosed is an Android hooking framework forked from LSPosed that enables Xposed-style module injection on rooted devices running Android 8.1… | 42 | 1152 | active |
| JusticeRage/Manalyze Manalyze is a static analyzer for PE (Windows executable) files written in C++. It performs primary malware assessment by parsing PE struct… | 81 | 1149 | active |
| AloneMonkey/frida-ios-dump A Python CLI script that uses Frida to dump decrypted iOS app binaries from a jailbroken device and packages them into an IPA. It connects … | 77 | 3966 | maintenance |
| hypery11/flipper-tesla-fsd An open-source Tesla CAN bus toolkit implemented as a Flipper Zero app with an ESP32 port, providing features like FSD region-gate bypass, … | 82 | 1141 | active |
| mrphrazer/reverser_ai ReverserAI is a Binary Ninja plugin that provides automated reverse engineering assistance using locally-hosted large language models runni… | 63 | 1139 | active |
| Endermanch/XPKeygen A C++ tool that generates valid Windows XP and Windows Server 2003 VLK product keys from a raw product key, based on reverse-engineered ell… | 59 | 1135 | active |
| HZJQF/help_tool A PyQt5-based Windows GUI tool that uses inference models to identify the encryption or hashing algorithm behind a given ciphertext and att… | 14 | 1134 | active |
| BlackObfuscator BlackObfuscator is a Java-based obfuscator for Android DEX files that applies control flow flattening to make decompiled code hard to analy… | 28 | 1130 | active |
| REhints/efiXplorer efiXplorer is an IDA Pro plugin and loader that automates static analysis of UEFI firmware. It recovers EFI service function calls, identif… | 84 | 1129 | active |
| Washi1337/AsmResolver AsmResolver is a .NET library for reading, modifying, and writing Portable Executable (PE) files, including those with .NET metadata. It pr… | 90 | 1125 | active |
| mandiant/GoReSym GoReSym is a cross-platform CLI tool that extracts symbols, function metadata, types, and program metadata from Go binaries, including stri… | 91 | 1118 | active |
| KJCracks/Clutch Clutch is a fast iOS executable decryption and dumping tool that extracts decrypted binaries and .ipa files from installed apps on jailbrok… | 23 | 3830 | maintenance |
| SteamTracking/SteamTracking A project that tracks and reverse-engineers Steam and Valve data, including protobuf definitions and changes across Steam services. It moni… | 77 | 1109 | active |
| memflow memflow is a Rust library providing a modular framework for physical memory introspection of machines, including live hardware, virtual mac… | 55 | 1100 | active |
| hyugogirubato/KeyDive KeyDive is a Python CLI tool that extracts Widevine L3 DRM keys and device credentials from rooted Android devices using Frida instrumentat… | 75 | 1099 | active |
| jwping/wxbot A Go-based WeChat hook/robot framework that injects into the Windows PC WeChat client (specific versions 3.9.8.x) to expose a bot API, runn… | 27 | 1099 | active |
| lico-n/ZygiskFrida A Zygisk (and Riru) module for rooted Android devices that injects the Frida gadget into application processes in a stealthy manner. It avo… | 46 | 1097 | active |
| QQBackup/qq-win-db-key A collection of Python and Frida scripts for extracting database encryption keys from QQ (Tencent's messenger) across Windows, Linux, macOS… | 68 | 1090 | active |
| Spade-sec/First A WeChat mini-program security debugging tool (fork/extension of WMPFDebugger) that uses Frida injection and Chrome DevTools Protocol bridg… | 68 | 1089 | active |
| Pikachu Volleyball A browser-based reimplementation of the 1997 Windows game Pikachu Volleyball, created by reverse engineering the original machine code (phy… | 76 | 1088 | active |
| wisk/medusa Medusa is an open-source, modular, interactive disassembler written in C++, organized as a library with frontends including a GUI (qMedusa)… | 53 | 1088 | active |
| bitdefender/bddisasm bddisasm is a fast, lightweight x86/x64 instruction decoder library written in C with no external dependencies, no memory allocation, and t… | 87 | 1086 | active |
| apkunpacker/MagiskDetection A curated collection of publicly available proof-of-concept Android apps that detect root, Magisk, Zygisk, and hooking frameworks like Frid… | 65 | 1072 | active |
| echo094/decode-js A Node.js CLI tool built on Babel that analyzes and reverses obfuscated JavaScript back into readable source. It supports common obfuscatio… | 77 | 1070 | active |
| Walter-Sparrow/lunar-tear Lunar Tear is a private server implementation for a discontinued mobile game, written in Go. It bundles gRPC, CDN, and auth services with a… | 64 | 1070 | active |
| RuntimeBrowser RuntimeBrowser is a class browser for the Objective-C runtime on iOS and OS X that exposes all loaded classes, methods, and dynamically gen… | 75 | 3659 | maintenance |
| LuckyPray/DexKit DexKit is a high-performance dex parsing and deobfuscation library implemented in C++ with Kotlin bindings, used to locate obfuscated class… | 90 | 1065 | active |
| MatthewKuKanich/CAN_Commander CAN Commander is a tool for reverse engineering and analyzing CAN bus systems, pairing a Flipper Zero app with ESP32 firmware to interact w… | 60 | 1063 | active |
| Vuemony/vue-after-free A PlayStation 4 userland code execution exploit delivered through the PlayStation Vue app, chained with kernel exploits (Lapse, Poopsploit/… | 62 | 1062 | active |
| theapache64/stackzy Stackzy is a cross-platform desktop application built with Compose Desktop that identifies the libraries used inside an Android APK. It dec… | 82 | 1060 | active |
| paradiseduo/appdecrypt A Swift CLI tool that decrypts FairPlay-encrypted Mach-O application binaries on macOS (SIP-enabled, macOS 11.3 or below, with newer suppor… | 41 | 1055 | active |
| toniebox-reverse-engineering/teddycloud TeddyCloud is an open-source replacement server for the Boxine Cloud that lets Toniebox owners host cloud services locally, serving their o… | 91 | 1053 | active |
| ac3ss0r/obfusheader.h Obfusheader.h is a portable, header-only C++14 library providing compile-time obfuscation via metaprogramming, including string and constan… | 72 | 1053 | active |
| nygard/class-dump class-dump is a command-line utility that examines the Objective-C runtime information in Mach-O binaries and generates Objective-C header … | 23 | 3587 | maintenance |
| mitmproxy/android-unpinner A Python CLI tool that removes certificate pinning from Android APKs so traffic can be intercepted with mitmproxy, without requiring a root… | 51 | 1043 | active |
| PixMob IR Reverse Engineering A reverse-engineering project and Python tooling for the PixMob infrared (and RF) protocol used by LED wristbands at large events, enabling… | 58 | 1038 | active |
| Reloaded-Project/Reloaded-II Reloaded II is a universal, C#/.NET-based mod loader and mod management framework for native games on X86 and X64. It uses DLL injection to… | 93 | 1034 | active |
| gcarmix/HexWalk HexWalk is a cross-platform GUI hex editor, viewer, and binary analyzer built on qhexedit2, Capstone, and Qt. It combines hex editing with … | 89 | 1027 | active |
| NoOne-hub/JSReverser-MCP JSReverser-MCP is an MCP server that standardizes JavaScript reverse-engineering workflows by exposing browser observation, script search, … | 66 | 1017 | active |
| mnh-jansson/m18-protocol A research repository and Python diagnostic tool for reverse-engineering the Milwaukee M18 power tool battery communication protocol. Using… | 39 | 1012 | active |
| Indetectables Toolkit A curated Windows toolkit bundling 101 applications for reverse engineering, malware analysis, and cracking, installed via an automated Inn… | 83 | 1011 | active |
| Fadi002/de4py An open-source, AI-powered toolkit for reverse engineering Python code, combining an LLM-driven deobfuscation engine (via Ollama) with lega… | 88 | 1007 | active |
| vivisect/vivisect Vivisect is a Python framework combining a disassembler, static binary analysis, emulation, symbolic execution, and a debugger (vdb/vtrace)… | 76 | 1002 | active |
| nabla-c0d3/ssl-kill-switch2 SSL Kill Switch 2 is a blackbox Cydia Substrate tweak that disables SSL/TLS certificate validation, including certificate pinning, in iOS a… | 23 | 3317 | maintenance |
| morkt/GARbro GARbro is a Windows GUI application for browsing, extracting, and converting resources (archives, images, audio) from visual novel games. I… | 23 | 3298 | maintenance |
| EasyHook/EasyHook EasyHook is a Windows API hooking library that lets you intercept and extend unmanaged code APIs with managed (.NET) or native hook handler… | 23 | 3290 | maintenance |
| plasma-disassembler/plasma Plasma is an interactive disassembler for x86/x86-64, ARM, and MIPS binaries that generates indented pseudo-code with colored syntax. It su… | 32 | 3068 | maintenance |
| WindySha/Xpatch Xpatch is a Java CLI tool that repackages and re-signs Android APK files so the resulting APK can load installed Xposed modules. It enables… | 46 | 3062 | maintenance |
| ac-pm/Inspeckage Inspeckage is an Xposed module that performs dynamic analysis of Android applications by hooking Android API functions to observe runtime b… | 23 | 2986 | maintenance |
| Jermic/Android-Crack-Tool A macOS GUI application that bundles common Android APK reverse-engineering tools (Apktool, Dex2Jar, JD-GUI, SignApk, Zipalign) into one in… | 23 | 2941 | maintenance |
| ma1co/Sony-PMCA-RE A tool that interfaces with Sony digital cameras over USB to tweak settings, dump firmware, and install custom Android apps via the PlayMem… | 23 | 2939 | maintenance |
| lifting-bits/mcsema McSema is a framework that lifts native x86, amd64, aarch64, sparc32, and sparc64 executable binaries (ELF and PE) into LLVM bitcode. It wo… | 10 | 2792 | maintenance |
| y9nhjy/Proxifier-Keygen A Python CLI keygen that generates registration keys for Proxifier (setup, portable, and Mac variants), based on a reverse-engineering anal… | 29 | 2762 | maintenance |
| google/enjarify Enjarify is a Python 3 tool that translates Dalvik bytecode from Android APK/DEX files into equivalent Java bytecode (JAR), enabling Java a… | 10 | 2744 | maintenance |
| hanbinglengyue/FART FART is an automated Android app unpacking (dex dumping) tool for ART environments, based on active invocation, implemented on Android 6.0/… | 32 | 2742 | maintenance |
| leibnitz27/cfr CFR (Class File Reader) is a Java decompiler written entirely in Java 6 that can decompile modern Java bytecode, including features from Ja… | 57 | 2726 | maintenance |
| everdox/InfinityHook InfinityHook is a Windows kernel library that hooks system calls, context switches, page faults, and DPCs by abusing ETW trace mechanics, r… | 32 | 2679 | maintenance |
| DarthTon/Xenos Xenos is a Windows DLL injector built on the Blackbone library, supporting x86/x64 processes, manual image mapping, managed image injection… | 23 | 2679 | maintenance |
| xoreaxeaxeax/rosenbridge Rosenbridge is a security research project that documents a hardware backdoor in some VIA C3 x86 processors, allowing userland code to bypa… | 32 | 2618 | maintenance |
| xdmjun/wxappUnpacker wxappUnpacker is a Node.js tool that unpacks and decompiles WeChat mini-program packages (.wxapkg files), restoring WXML, WXSS, JS, and con… | 32 | 2426 | maintenance |
| retroplasma/earth-reverse-engineering A reverse-engineering project documenting and implementing access to Google Earth's undocumented 3D satellite mode, including URL structure… | 10 | 2321 | maintenance |
| buginux/WeChatRedEnvelop An iOS jailbreak tweak (Cydia plugin) written in Objective-C that automatically grabs red envelopes (lucky money) in WeChat. It integrates … | 10 | 2290 | maintenance |
| ldpreload/BlackLotus An open-source UEFI bootkit targeting Windows that implements a Secure Boot bypass, kernel-level persistence, and an HTTP-based C2 loader w… | 29 | 2247 | maintenance |
| greatscottgadgets/ubertooth Ubertooth is an open source wireless development platform for Bluetooth experimentation, providing host software, firmware, and hardware de… | 52 | 2148 | maintenance |
| JKornev/hidden A Windows kernel driver with a usermode library and CLI that can hide processes, files, directories, and registry keys, and protect process… | 23 | 2065 | maintenance |
| weak1337/Alcatraz Alcatraz is a GUI-based x64 binary obfuscator for Windows PE files (.exe, .dll, .sys) written in C++. It applies transformations like contr… | 32 | 2000 | maintenance |
| mona mona.py is a Python plugin for debuggers (Immunity Debugger, x64dbg) that assists with exploit development tasks such as finding ROP gadget… | 10 | 1896 | maintenance |
| strings2 Process Dump is a Windows command-line reverse-engineering tool that dumps unpacked malware PE files and loose code chunks from process mem… | 87 | 1861 | maintenance |
| lockedbyte/CVE-2021-40444 A proof-of-concept exploit generator for CVE-2021-40444, a Microsoft Office Word remote code execution vulnerability. It generates maliciou… | 32 | 1847 | maintenance |
| ljc545w/ComWeChatRobot A PC WeChat robot implemented in C++ that reverse-engineers the Windows WeChat client to expose contacts, messaging, group management, and … | 10 | 1813 | maintenance |
| gdbinit A feature-rich .gdbinit configuration script that enhances GDB with custom commands, macros, and a reverse-engineering-oriented interface f… | 32 | 1798 | maintenance |
| Java Deobfuscator A Java-based CLI tool that deobfuscates Java JAR files produced by commercial obfuscators such as Zelix KlassMaster, Stringer, Allatori, Da… | 23 | 1765 | maintenance |
| tandasat/HyperPlatform HyperPlatform is an Intel VT-x based hypervisor for Windows that provides a thin VM-exit filtering platform for research. It lets researche… | 10 | 1760 | maintenance |
| Satella Satella Jailed is an in-app purchase cracker for non-jailbroken ('jailed') iOS devices running iOS 12–16, distributed as an injectable dyli… | 32 | 1712 | maintenance |
| marin-m/pbtk pbtk (Protobuf toolkit) is a Python-based set of scripts with a unified GUI for extracting Protobuf data structures from programs (Java run… | 94 | 1683 | maintenance |
| taviso/ctftool An interactive command-line tool for exploring the CTF (Clipboard/Text Services Framework) protocol used by Windows Text Services. It suppo… | 23 | 1668 | maintenance |
| asLody/whale Whale is a cross-platform hook framework written in C++ that runs on Android, iOS, Linux, and macOS, supporting ARM/THUMB, ARM64, X86, and … | 32 | 1665 | maintenance |
| dpnishant/appmon AppMon is an automated framework for monitoring and tampering with system API calls of native macOS, iOS, and Android apps, built on Frida.… | 10 | 1633 | maintenance |
| dstmath/frida-unpack A Frida-based unpacking tool for Android apps that hooks libart.so's OpenMemory (or OpenCommon on Android 10) to dump decrypted DEX files f… | 40 | 1615 | maintenance |
| Squalr/Squalr-Sharp Squalr is a high-performance memory editor for Windows desktop games, written in C#, supporting memory scanning, pointer scanning, and x86/… | 23 | 1595 | maintenance |
| lelinhtinh/de4js de4js is a web-based JavaScript deobfuscator and unpacker that transforms obfuscated code (Eval, Array, JSFuck, JJencode, AAencode, Packer,… | 10 | 1579 | maintenance |
| unixpickle/gobfuscate A command-line tool that obfuscates Go binaries by compiling from obfuscated source code. It hashes package names, global identifiers, meth… | 32 | 1573 | maintenance |
| YimMenu/YimMenu YimMenu is a mod menu for Grand Theft Auto V that protects players against common public crashes and adds gameplay enhancements, including … | 10 | 1566 | maintenance |
| gaasedelen/tenet Tenet is an IDA Pro plugin for exploring and navigating execution traces of binaries. It provides a timeline widget and bidirectional execu… | 23 | 1546 | maintenance |
| IDAPython IDAPython is the Python scripting SDK and plugin framework for Hex-Rays' IDA Pro binary analysis suite, exposing IDA's disassembler, decomp… | 10 | 1535 | maintenance |
| AsuharietYgvar/AppleNeuralHash2ONNX A Python tool that converts Apple's NeuralHash perceptual hashing model (used in Apple's CSAM Detection system) into ONNX format. It includ… | 32 | 1532 | maintenance |
| chip-red-pill/MicrocodeDecryptor A set of Python scripts for decrypting Intel Atom CPU microcode updates, using encryption keys extracted via the Red Unlock debugging techn… | 32 | 1509 | maintenance |
| ChiChou/bagbak bagbak is a Node.js CLI tool that uses Frida to decrypt iOS App Store binaries on a jailbroken device, dumping decrypted IPAs including app… | 89 | 1507 | maintenance |
| ezshine/wxapkg-convertor A Node.js command-line tool that decompiles WeChat mini-program and mini-game .wxapkg packages back into readable source code, convertible … | 23 | 1501 | maintenance |
| ptrkrysik/gr-gsm A set of GNU Radio blocks and tools for receiving and decoding GSM transmissions using software-defined radios. It is based on the Airprobe… | 33 | 1500 | maintenance |
| CYRUS-STUDIO/ApkToolPlus ApkToolPlus is a visual, cross-platform desktop application for Android APK reverse analysis built in Java. It bundles APK decompilation/re… | 37 | 1488 | maintenance |
| ptswarm/reFlutter A Python-based framework that repacks Flutter Android and iOS apps with a patched Flutter engine library to enable dynamic analysis. It red… | 10 | 1462 | maintenance |
| programa-stic/barf-project BARF is an open-source Python framework for binary analysis and reverse engineering. It lifts instructions from x86 and ARM binaries into a… | 32 | 1453 | maintenance |
| L4ys/LazyIDA LazyIDA is an IDA Pro plugin written in Python (IDAPython) that adds convenience features like data format conversion with clipboard copy, … | 55 | 1446 | maintenance |
| 0xnobody/vmpdump VMPDump is a dynamic dumper and import fixer for binaries protected with VMProtect 3.x (x64), built on the VTIL intermediate language. It s… | 23 | 1436 | maintenance |
| NtQuery/Scylla Scylla is a Windows x86/x64 tool for reconstructing import tables (IAT) of unpacked or dumped binaries. It supports dumping processes, fixi… | 23 | 1436 | maintenance |
| ma1co/OpenMemories-Tweak An Android app that runs on Sony cameras supporting PlayMemories Camera Apps to unlock hidden settings such as the 30-minute video recordin… | 23 | 1425 | maintenance |
| 易开发 (DeveloperHelper) DeveloperHelper (易开发) is an Android developer/analysis tool app with an Xposed module that dumps DEX files from packed (hardened) APKs, plu… | 35 | 1421 | maintenance |