Open-source reverse-engineering software
562 open-source libraries, tools and applications tagged reverse-engineering, ranked by how closely reverse-engineering is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
562 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| tandasat/DdiMon DdiMon is a hypervisor-based research tool that performs stealth inline hooking of Windows kernel API calls using Intel VT-x EPT memory sha… | 32 | 1403 | maintenance |
| 0xgalz/Virtuailor Virtuailor is an IDAPython plugin for IDA Pro that reconstructs C++ virtual tables (vtables) for Intel x86/x64 and AArch64 binaries. It com… | 32 | 1402 | maintenance |
| ele7enxxh/Android-Inline-Hook A C library for inline hooking of native functions on 32-bit Android, supporting ARM, Thumb16, and Thumb32 instruction sets. It lets you re… | 32 | 1401 | maintenance |
| grayhatacademy/ida A collection of IDA Python plugins, scripts, and modules for the IDA Pro disassembler. It provides reusable tooling for binary analysis and… | 32 | 1374 | maintenance |
| wbenny/hvpp hvpp is a lightweight Intel VT-x hypervisor written in modern C++ that virtualizes an already-running operating system, primarily targeting… | 32 | 1355 | maintenance |
| GoSSIP-SJTU/Armariris Armariris is an LLVM-based code obfuscation framework maintained by Shanghai Jiao Tong University's cryptography and computer security lab.… | 32 | 1346 | maintenance |
| blackberry/pe_tree PE Tree is a Python module and standalone GUI application for viewing Portable Executable (PE) files in a tree-view, built on pefile and Py… | 10 | 1343 | maintenance |
| Cherrison/CrackMinApp A Windows GUI tool (built with C# and Node.js) that one-click decompiles WeChat mini-program .wxapkg packages back into readable source cod… | 32 | 1341 | maintenance |
| gdabah/distorm diStorm3 is a lightweight, fast disassembler library for x86/AMD64 machine code, licensed under BSD. It acts as a decomposer, returning bin… | 23 | 1341 | maintenance |
| Cur10s1tyByt3/GenP An archival repository preserving the source materials and documentation of GenP, an AutoIt-based patcher tool targeting Adobe software on … | 54 | 1340 | maintenance |
| tobefuturer/restore-symbol A command-line reverse engineering tool that restores stripped Objective-C symbol tables in iOS Mach-O binaries. It injects OC method and b… | 32 | 1338 | maintenance |
| RUB-SysSec/DroneSecurity A proof-of-concept receiver and decoder for DJI's Drone-ID protocol broadcast over OcuSync 2.0, developed for an NDSS 2023 paper. It decode… | 32 | 1321 | maintenance |
| wbenny/injdrv A proof-of-concept Windows kernel driver that injects DLLs into user-mode processes using Asynchronous Procedure Calls (APC). It hooks into… | 32 | 1296 | maintenance |
| alexzielenski/optool A command line tool for modifying Mach-O binaries on macOS and iOS. It can insert or remove load commands, strip or repair code signatures,… | 23 | 1288 | maintenance |
| rocky/python-decompile3 decompyle3 is a native Python decompiler that translates Python bytecode (versions 3.7 and 3.8) back into equivalent Python source code. It… | 62 | 1273 | maintenance |
| darkr4y/geacon Geacon is a Go implementation of CobaltStrike's Beacon implant, built to study the C2 protocol through reverse engineering. It supports com… | 32 | 1265 | maintenance |
| 0xjiayu/go_parser An IDA Pro plugin written in Python that parses Golang binaries, recovering function names, source file paths, strings, types, and interfac… | 23 | 1254 | maintenance |
| codilime/veles Veles is a cross-platform desktop tool for binary data analysis that uses statistical visualizations to reveal patterns in large binary fil… | 10 | 1238 | maintenance |
| DerekSelander/dsdump dsdump is a command-line tool that inspects Mach-O binaries, dumping symbol tables plus Objective-C classes and Swift type descriptors, act… | 10 | 1224 | maintenance |
| softScheck/tplink-smartplug A Python command-line client for the proprietary TP-Link Smart Home protocol that controls HS100, HS110, and KP115 WiFi smart plugs over TC… | 32 | 1200 | maintenance |
| SciresM/hactool hactool is a C command-line tool for inspecting, decrypting, and extracting common Nintendo Switch file formats such as NCA, XCI, PFS0, Rom… | 23 | 1188 | maintenance |
| strazzere/android-unpacker A collection of Android unpacking tools presented at Defcon 22, including gdb-based scripts and a native unpacker for packers like APKProte… | 23 | 1180 | maintenance |
| ghidraninja/ghidra_scripts A collection of scripts for the Ghidra software reverse engineering suite, adding features like crypto constant detection via YARA, binwalk… | 32 | 1177 | maintenance |
| sh4hin/Androl4b AndroL4b is an Ubuntu MATE-based virtual machine preloaded with Android security, reverse engineering, and malware analysis tools such as R… | 32 | 1172 | maintenance |
| crypto2011/IDR IDR (Interactive Delphi Reconstructor) is a Windows decompiler for EXE and DLL files compiled with Delphi 2 through Delphi XE4. It performs… | 23 | 1166 | maintenance |
| OkHttp Logger Frida Suite A Frida script that hooks OkHttp's RealCall class in Android apps to intercept and log HTTP requests and responses, including headers and b… | 32 | 1164 | maintenance |
| anestisb/vdexExtractor A command-line tool written in C that decompiles and extracts Android Dex bytecode from Vdex files produced by the ART runtime's dex2oat co… | 32 | 1140 | maintenance |
| Sentinel-One/CobaltStrikeParser A Python parser that extracts Cobalt Strike Beacon configuration from stageless PE files, memory dumps, or C2 URLs. It heuristically finds … | 10 | 1136 | maintenance |
| mildsunrise/protobuf-inspector A Python CLI tool that parses Google Protobuf encoded blobs (wire format 2 or 3) without knowing their schema definition, printing a colore… | 32 | 1129 | maintenance |
| kevthehermit/RATDecoders A Python library and CLI tool (malconf) that statically analyzes malware samples from common Remote Access Trojan (RAT) families and extrac… | 32 | 1121 | maintenance |
| CTCaer/jc_toolkit A Windows desktop application for managing, inspecting, and customizing Nintendo Switch Joy-Con controllers over Bluetooth HID. It provides… | 23 | 1109 | maintenance |
| sibears/IDAGolangHelper A set of IDA Pro Python scripts that parse Go type information embedded in compiled Go binaries and register the recovered types inside IDA… | 32 | 1094 | maintenance |
| mmozeiko/aes-finder A small C++ command-line utility that scans the memory of running processes to locate AES encryption and decryption keys (128, 192, and 256… | 32 | 1087 | maintenance |
| xdmjun/mp-unpack A tool for unpacking WeChat mini-program packages (wxapkg files) to recover readable source code. It appears to be a reverse-engineering ut… | 32 | 1078 | maintenance |
| silverf0x/RpcView RpcView is a free, open-source Windows GUI tool for exploring and decompiling Microsoft RPC (Remote Procedure Call) interfaces present on a… | 23 | 1067 | maintenance |
| itenfay/WeChat_tweak An iOS tweak (plugin) for WeChat written in Objective-C that adds features like auto-grabbing red envelopes, blocking messages, preventing … | 67 | 1064 | maintenance |
| sickcodes/Docker-eyeOS A Docker container that boots the iPhone's iOS xnu kernel (arm64) under QEMU with KVM acceleration, exposing SSH and GDB ports for kernel d… | 32 | 1064 | maintenance |
| btbd/access A Windows kernel driver plus DLL wrapper that lets a usermode process perform privileged operations on protected processes without creating… | 32 | 1062 | maintenance |
| wwh1004/ExtremeDumper A Windows GUI tool for dumping .NET assemblies from running processes, including bypassing anti-dump protections. It can also inject .NET a… | 23 | 1061 | maintenance |
| DavidBuchanan314/ambiguous-png-packer A Python tool that crafts PNG files rendering differently in Apple software versus other viewers, exploiting a parsing ambiguity in Apple's… | 32 | 1060 | maintenance |
| thomasxm/BOAZ_beta BOAZ is a multilayered AV/EDR evasion framework written in C++/C with Python linking, designed to generate polymorphic payloads that bypass… | 54 | 1054 | maintenance |
| sonyxperiadev/ApkAnalyser ApkAnalyser is a stand-alone Java (J2SE) GUI tool for static and virtual analysis of Android APK files. It supports disassembling and modif… | 10 | 1048 | maintenance |
| 9176324/Shark Shark is a Windows kernel driver project written in C that disables Kernel Patch Protection (PatchGuard) in real time on Windows 7 (7600) a… | 23 | 1046 | maintenance |
| KULeuven-COSIC/Starlink-FI A research project from KU Leuven COSIC providing the design of a custom modchip that performs voltage fault injection to bypass signature … | 32 | 1044 | maintenance |
| fangshufeng/MachOView MachOView is a macOS GUI application for browsing and analyzing Mach-O binary files, a maintained fork of the original gdbinit/MachOView th… | 23 | 1044 | maintenance |
| anhkgg/SuperDllHijack SuperDllHijack is a C++ library implementing a general DLL hijacking technique for Windows that forwards calls to the original DLL without … | 32 | 1039 | maintenance |
| x0tools/WeChatOpenDevTools A Windows tool that patches WeChat to enable the built-in DevTools (F12) for debugging WeChat Official Accounts and Mini Programs. It suppo… | 28 | 1034 | maintenance |
| d35ha/CallObfuscator CallObfuscator is a C++ library and CLI tool that hides Windows PE imports by rewriting the Import Address Table so sensitive APIs appear a… | 23 | 1025 | maintenance |
| F8LEFT/SoFixer SoFixer is a command-line tool that repairs ELF shared object (.so) files dumped from process memory, fixing section headers, program heade… | 10 | 1023 | maintenance |
| Inori/FuckGalEngine A collection of C tools for unpacking, repacking, and hooking visual novel (galgame) engines to enable fan translation and modifications. I… | 32 | 1018 | maintenance |
| WithSecureLabs/python-exe-unpacker A Python CLI script that unpacks and decompiles Windows EXEs compiled from Python code, supporting executables built with py2exe and PyInst… | 32 | 1017 | maintenance |
| rwfpl/rewolf-wow64ext A C++ helper library enabling 32-bit (x86) applications running under the WOW64 layer on 64-bit Windows to interact with native x64 process… | 23 | 1017 | maintenance |
| can1357/ThePerfectInjector A Windows DLL injection library that abuses Windows address sanitation and copy-on-write semantics for stealthy injection. Written in C and… | 32 | 1005 | maintenance |
| rampageX/firmware-mod-kit A collection of scripts and utilities for extracting, modifying, and rebuilding Linux-based firmware images for embedded devices like route… | 59 | 1003 | maintenance |
| JJTech0130/pypush A Python library for interacting with Apple's private APIs, originally a proof-of-concept iMessage reverse-engineering project. It currentl… | 59 | 3785 | experimental |
| b-nnett/grok-bot-0.18-reconstructed An unofficial, source-oriented reconstruction of the Grok Bot 0.18.0 macOS Electron app, with readable TypeScript implementations of its ru… | 10 | 3521 | experimental |
| ran-j/PS2Recomp A PlayStation 2 static recompiler that translates PS2 ELF binaries (MIPS R5900 instructions) into C++ code, plus a runtime to execute the g… | 72 | 3286 | experimental |
| SamboyCoding/Cpp2IL Cpp2IL is a work-in-progress tool that reverses Unity's IL2CPP build process, recovering managed DLLs from IL2CPP-compiled games. It parses… | 74 | 2638 | experimental |
| can1357/NoVmp NoVmp is a static devirtualizer that translates VMProtect x64 3.x-virtualized binaries into optimized VTIL intermediate code, optionally re… | 23 | 2206 | experimental |
| JSREI/ast-hook-for-js-RE A browser memory roaming tool for JavaScript reverse engineering that hooks variable assignments via AST-transformed proxy responses. It le… | 23 | 1911 | experimental |
| zeldaret/mm A work-in-progress from-scratch decompilation of The Legend of Zelda: Majora's Mask (N64 US 1.0), recreating readable C source code that bu… | 77 | 1754 | experimental |
| rexdex/recompiler A C++ tool that converts Xbox 360 PowerPC executables into native Windows x86 executables, handling CPU translation, endianness, and GPU em… | 32 | 1742 | experimental |
| VTIL VTIL-Core is the core library of the Virtual-machine Translation Intermediate Language project, an optimizing compiler infrastructure built… | 71 | 1597 | experimental |
| xodus-gaming/xodus Xodus is a Rust project aiming to bring XBOX PC (Game Pass) games to Linux and possibly macOS by implementing XBOX authentication, MSIXVC p… | 61 | 1593 | experimental |
| JonathanSalwan/VMProtect-devirtualization An experimental research project demonstrating a dynamic approach to devirtualize pure functions protected by VMProtect 3.x using symbolic … | 32 | 1537 | experimental |
| whitequark/unfork unfork(2) is a proof-of-concept Linux technique and library that joins two process address spaces into one, the inverse of fork(2), by comb… | 32 | 1485 | experimental |
| iOS on QEMU A fork of QEMU that emulates an iPhone (iPhone 6s Plus) well enough to boot a fully functional iOS 12.1 system, including launchd, bash, SS… | 32 | 1460 | experimental |
| iPower/KasperskyHook A Windows research project that hooks system calls by loading Kaspersky's hypervisor driver (klhk.sys) and a custom kernel driver that subv… | 62 | 1324 | experimental |
| xoreos xoreos is an open-source (GPLv3+) reimplementation of BioWare's Aurora engine and its derivatives, targeting games from Neverwinter Nights … | 65 | 1176 | experimental |
| JuliaPoo/Artfuscator Artfuscator is a novelty C compiler built on ELVM that compiles C programs into a binary whose entire control flow graph renders as a chose… | 32 | 1105 | experimental |
| medusalix/FreeMDU FreeMDU is an open hardware and software project for communicating with Miele appliances through their proprietary optical infrared diagnos… | 54 | 1066 | experimental |
| CodeTips/BaiduNetdiskPlugin-macOS A macOS plugin that patches the Baidu Netdisk client binary via dylib injection to fake SVIP status and remove local download speed limits.… | 10 | 8880 | abandoned |
| acheong08/EdgeGPT A Python library that reverse engineers Microsoft's Bing Chat (EdgeGPT) API, providing unofficial programmatic access to Bing AI conversati… | 10 | 7836 | abandoned |
| cuckoosandbox/cuckoo Cuckoo Sandbox is an open-source automated dynamic malware analysis system that executes suspicious files in an isolated environment and re… | 10 | 5959 | abandoned |
| qwerty472123/wxappUnpacker wxappUnpacker is a tool for unpacking and decompiling packaged WeChat mini-program (wxapkg) files back into readable source files such as w… | 10 | 4507 | abandoned |
| Manticore Manticore is a symbolic execution tool for analyzing Ethereum smart contracts, Linux ELF binaries, and WASM modules. It explores program st… | 10 | 3857 | abandoned |
| Il2CppInspector Il2CppInspector is an automated tool for reverse engineering Unity IL2CPP binaries, extracting type definitions, metadata and method pointe… | 23 | 3053 | abandoned |
| stefanesser/dumpdecrypted A dylib that, when injected via DYLD_INSERT_LIBRARIES into an encrypted iPhone application on a jailbroken device, dumps the decrypted Mach… | 32 | 3036 | abandoned |
| google/binnavi BinNavi is a binary analysis IDE for inspecting, navigating, editing, and annotating control-flow and call graphs of disassembled code, wit… | 10 | 2886 | abandoned |
| tostercx/GTAO_Booster_PoC A proof-of-concept DLL injection that patches two bugs in GTA Online to drastically reduce load times on CPU-bound systems. It was official… | 10 | 2868 | abandoned |
| DrizzleRisk/drizzleDumper drizzleDumper is a memory-search-based Android unpacking tool that dumps DEX files from packed/protected Android apps. It runs as a command… | 32 | 2415 | abandoned |
| Dustcloud A research project for reverse engineering and rooting Xiaomi Smart Home devices, including robot vacuums, providing methods to root device… | 23 | 2283 | abandoned |
| 8enet/Charles-Crack A repository that provided a crack/patch to bypass licensing of Charles Proxy, an HTTP debugging proxy tool. The repository content was rem… | 32 | 2149 | abandoned |
| Hikari Obfuscator Hikari is an LLVM-based code obfuscator that transforms compiled binaries with techniques like string encryption, indirect branching, funct… | 10 | 2103 | abandoned |
| TKkk-iOSer/WeChatPlugin-iOS A jailbreak tweak (dylib) for the WeChat iOS app, built with Theos in Objective-C. It patches WeChat's runtime behavior to add unofficial f… | 32 | 1862 | abandoned |
| Direct Memory Access — CS2 DMA A C++ framework demonstrating Direct Memory Access (DMA) interaction with Counter-Strike 2, covering memory reading, entity-state parsing, … | 62 | 1852 | abandoned |
| Neo23x0/yarGen yarGen is a Python CLI tool that generates YARA rules from strings found in malware samples, filtering out strings that appear in a large i… | 47 | 1813 | abandoned |
| Xposed-Modules-Repo/com.bug.hookvip An Xposed module for Android that hooks into apps to unlock certain VIP/membership features and extend functionality. The repository has be… | 10 | 1760 | abandoned |
| tdryer/hangups hangups is the first third-party instant messaging client for Google Hangouts, implemented by reverse-engineering Hangouts' proprietary pro… | 32 | 1744 | abandoned |
| Gh0u1L5/WechatSpellbook An open-source WeChat plugin framework written in Kotlin that sits on top of hooking frameworks like Xposed or VirtualXposed. It exposes a … | 32 | 1732 | abandoned |
| Cisco-Talos/pyrebox PyREBox is a Python-scriptable reverse engineering sandbox built on QEMU that provides whole-system dynamic analysis and debugging of runni… | 10 | 1685 | abandoned |
| chaitin/passionfruit Passionfruit is a web-based GUI tool for blackbox assessment of iOS apps, built on the Frida instrumentation framework and Vue.js. It lets … | 10 | 1668 | abandoned |
| Viper Viper is a Python-based binary analysis and management framework for organizing collections of malware and exploit samples along with analy… | 10 | 1561 | abandoned |
| sailro/Reflexil Reflexil is a .NET assembly editor that runs as a plugin for Reflector, ILSpy, and JustDecompile. Built on Mono.Cecil, it can manipulate IL… | 10 | 1529 | abandoned |
| hteso/iaito Iaitō is a Qt and C++ graphical user interface for the radare2 reverse engineering framework, aimed at users who find radare2's CLI too dif… | 32 | 1461 | abandoned |
| kennytm/iphone-private-frameworks A collection of C headers for private frameworks and undocumented interfaces of iPhoneOS 3.x and earlier, used for jailbroken iOS tweak dev… | 10 | 1460 | abandoned |
| das-labor/panopticon Panopticon is a libre, cross-platform disassembler written in Rust for reverse engineering binaries. It supports AMD64, x86, AVR, and MOS 6… | 10 | 1447 | abandoned |
| xmoezzz/KrkrExtract KrkrExtract is a Windows tool for extracting and repacking XP3 archive files used by the Kirikiri (krkr2/krkrz) visual novel game engine, s… | 10 | 1427 | abandoned |
| RaduMC/AssetStudio AssetStudio is a standalone Windows GUI tool for exploring, previewing, and extracting assets from Unity game files and bundles. It can exp… | 23 | 1422 | abandoned |
| zyq8709/DexHunter DexHunter is an automatic unpacking tool for Android Dex files protected by app-hardening services. It works by replacing the ART and DVM r… | 32 | 1358 | abandoned |