function: reverse-engineering
630 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| gtworek/PSBits A collection of relatively simple C and PowerShell snippets for digging deeper into Windows internals, security, and forensics. Each folder… | 76 | 3519 | active |
| bethington/ghidra-mcp A Model Context Protocol (MCP) server and Ghidra plugin exposing 250+ tools that let AI agents drive Ghidra's reverse engineering capabilit… | 83 | 3508 | active |
| open-goal/jak-project OpenGOAL is a project that decompiles the Jak & Daxter PS2 games and recompiles them into native x86-64 ports, including a from-scratch imp… | 99 | 3489 | active |
| LEGO Island (decompilation) A functionally complete reverse-engineered decompilation of the 1997 game LEGO Island, reconstructing C++ source code that matches the orig… | 95 | 3461 | active |
| JusticeRage/Gepetto Gepetto is an IDA Pro plugin that queries large language models (OpenAI, Anthropic, Gemini, Ollama, and others) to explain decompiled funct… | 79 | 3461 | active |
| kevoreilly/CAPEv2 CAPEv2 is a malware sandbox derived from Cuckoo that executes malicious files in isolated environments while instrumenting their behavior a… | 77 | 3451 | active |
| pret/pokeemerald A complete decompilation of Pokémon Emerald into C source code that rebuilds the exact original Game Boy Advance ROM. It serves as a base f… | 77 | 3406 | active |
| bryanthaboi/gen1recomp A native LÖVE2D recreation of Pokémon Red, Blue, Gold, Silver, and Crystal, with the engine and map behavior hand-written in Lua. Game data… | 76 | 3402 | active |
| commaai/opendbc opendbc is a Python API for controlling and reading state from cars over CAN bus, including steering, gas, and brake actuation via ADAS int… | 93 | 3363 | active |
| SteamAutoCracks/Steam-auto-crack A C# tool that automatically cracks Steam games by unpacking SteamStub-protected executables and applying the Goldberg Steam emulator. It a… | 99 | 3243 | active |
| LaurieWired/Malimite Malimite is a Java-based decompiler for iOS and macOS binaries, built on Ghidra, that analyzes IPA files and Application Bundles with direc… | 38 | 3174 | active |
| pxb1988/dex2jar dex2jar is a set of Java-based command-line tools for working with Android .dex and Java .class files. It converts Dalvik executables (e.g.… | 23 | 13135 | maintenance |
| QiuChenly/CoreInject CoreInject (successor to InjectLib) is a macOS application injection and binary-patching tool by QiuChenly, distributed alongside a communi… | 84 | 3157 | active |
| BinDiff BinDiff is an open-source comparison tool for binary files that finds differences and similarities in disassembled code using graph-theoret… | 62 | 3155 | active |
| DynamoRIO/dynamorio DynamoRIO is a runtime code manipulation system that supports arbitrary code transformations on executing programs, with a powerful instruc… | 95 | 3146 | active |
| biggerstar/wedecode Wedecode is a fully automated tool that decompiles WeChat mini-program and mini-game wxapkg packages back into readable source code (JS, WX… | 60 | 3091 | active |
| m0bilesecurity/RMS-Runtime-Mobile-Security Runtime Mobile Security (RMS) is a NodeJS-powered web interface built on FRIDA for manipulating Android and iOS apps at runtime. It lets us… | 83 | 3075 | active |
| korcankaraokcu/PINCE PINCE is a GDB front-end and reverse engineering tool for Linux, focused on game hacking but usable for general reverse engineering. It pro… | 98 | 3069 | active |
| TheOfficialFloW/PPPwn PPPwn is a proof-of-concept kernel remote code execution exploit for PlayStation 4 consoles up to firmware 11.00, exploiting CVE-2006-4304 … | 24 | 2960 | active |
| eteran/edb-debugger edb is a cross-platform AArch32/x86/x86-64 debugger inspired by OllyDbg, built with Qt and Capstone. It provides a graphical interface for … | 66 | 2952 | active |
| j4k0xb/webcrack webcrack is a JavaScript reverse-engineering tool that deobfuscates code obfuscated with obfuscator.io, unminifies minified code, and unpac… | 78 | 2876 | active |
| gdbinit/MachOView A macOS GUI application for viewing and exploring Mach-O binary files, revived as a maintained fork with a universal x86_64/arm64 build. It… | 32 | 2868 | active |
| mrexodia/TitanHide TitanHide is a Windows kernel driver that hides debuggers from selected processes by hooking Nt* kernel functions via SSDT hooks and alteri… | 72 | 2840 | active |
| hasherezade/pe_to_shellcode A C++ command-line tool that converts Windows PE executables into shellcode-compatible form, adding a reflective loading stub post-compilat… | 40 | 2793 | active |
| panda-re/panda PANDA is an open-source Platform for Architecture-Neutral Dynamic Analysis built on the QEMU whole-system emulator, supporting record and r… | 93 | 2778 | active |
| Impact-I/reFlutter reFlutter is a Python CLI framework for reverse engineering Flutter mobile apps by repacking APK/IPA files with a specially patched, precom… | 95 | 2738 | active |
| AxtMueller/Windows-Kernel-Explorer Windows Kernel Explorer (WKE) is a free Windows kernel research and inspection tool supporting Windows XP through Windows 11. It loads a ke… | 58 | 2717 | active |
| securing/IOSSecuritySuite iOS Security Suite is a Swift library for iOS platform security and anti-tampering checks. It detects jailbroken devices, attached debugger… | 86 | 2712 | active |
| zinja-coder/jadx-ai-mcp A JADX plugin that bundles an MCP server, allowing LLM clients like Claude to interact with the JADX decompiler for Android APK analysis. I… | 84 | 2711 | active |
| hfiref0x/KDU KDU (Kernel Driver Utility) is a Windows command-line tool that abuses known vulnerable drivers to load unsigned kernel drivers, bypass Dri… | 91 | 2704 | active |
| Artikash/Textractor Textractor is an open-source x86/x64 text hooker for Windows that extracts text from video games and visual novels by injecting into text o… | 23 | 2680 | active |
| decompiler-explorer/decompiler-explorer A web service (like Compiler Explorer in reverse) that lets users upload small binaries and compare the decompiled C-like output from many … | 77 | 2639 | active |
| REhints/HexRaysCodeXplorer HexRaysCodeXplorer is a Hex-Rays Decompiler plugin written in C++ that improves code navigation during reverse engineering. It automates re… | 47 | 2637 | active |
| worawit/blutter Blutter is a reverse engineering tool for Flutter mobile applications that compiles the Dart AOT runtime to extract symbols and objects fro… | 72 | 2627 | active |
| qidian55/bilibilitv1.6.6-repair A repair project that patches the classic Bilibili TV app version 1.6.6 (written in Smali) so it keeps working despite server-side changes.… | 59 | 2626 | active |
| Keystone Assembler Engine Keystone is a lightweight multi-platform, multi-architecture assembler framework implemented in C/C++ with bindings for many languages. It … | 65 | 2625 | active |
| zhizhuodemao/js-reverse-mcp An MCP server that gives AI coding agents (Claude, Cursor, Copilot) tools for JavaScript reverse engineering in a headed Chrome browser, in… | 83 | 2608 | active |
| uxmal/reko Reko is a general-purpose binary decompiler that translates machine code executables back into high-level language source. It supports mult… | 89 | 2600 | active |
| gaasedelen/lighthouse Lighthouse is a code coverage explorer plugin for IDA Pro and Binary Ninja that lets reverse engineers interactively visualize execution co… | 53 | 2577 | stable |
| bytedance/bhook ByteHook is a production-grade Android PLT hook library written in C, supporting armeabi-v7a, arm64-v8a, x86, and x86_64. It lets native co… | 79 | 2570 | active |
| rednaga/APKiD APKiD is a command-line tool that identifies how an Android APK was built, detecting compilers, packers, obfuscators, and app-shielding/RAS… | 78 | 2565 | active |
| bkerler/edl A Python CLI tool for communicating with Qualcomm devices in EDL (Emergency Download) mode via the Sahara, Firehose, Streaming, and Diag pr… | 66 | 2547 | active |
| evi0s/WMPFDebugger A debugger tweak for WeChat's Mini-Program Framework (WMPF) that exploits the remote debug feature of WeChat devtools to enable full Chrome… | 65 | 2542 | active |
| DidierStevens/DidierStevensSuite A bundled collection of Didier Stevens' security research tools, distributed as a ZIP and GitHub repository of Python scripts and utilities… | 75 | 2525 | active |
| Mattiwatti/EfiGuard EfiGuard is a portable x64 UEFI bootkit that patches the Windows boot manager, boot loader, and kernel at boot time to disable PatchGuard a… | 62 | 2523 | active |
| bug-bit/fckvip An Android module (likely Magisk/LSPosed-based) that unlocks paid VIP memberships and enhances extended features in certain apps. It requir… | 74 | 2500 | active |
| solemnwarning/rehex Rehex is a cross-platform hex editor designed for reverse engineering binary files, with features like large file support, inline disassemb… | 85 | 2476 | active |
| Idov31/Nidhogg Nidhogg is an open-source Windows x64 kernel rootkit written in C++ that demonstrates a wide range of rootkit techniques such as process, t… | 83 | 2463 | active |
| mandiant/flare-ida A collection of IDA Pro plugins and IDAPython scripts from Mandiant's FLARE team for reverse engineering and malware analysis. It includes … | 10 | 2453 | active |
| Yuyz0112/claude-code-reverse A tool that reverse engineers Claude Code by capturing and visualizing its LLM API interactions. It monkey-patches Claude Code's request co… | 37 | 2428 | active |
| msojocs/fiddler-everywhere-enhance An auto-patch tool that modifies the Fiddler Everywhere web debugging proxy (an Electron app) on Windows and Linux, replacing DLLs and patc… | 88 | 2403 | active |
| hasherezade/hollows_hunter Hollows Hunter is a Windows command-line tool built on the PE-sieve passive memory scanner that scans running processes for malicious impla… | 71 | 2401 | active |
| ValveResourceFormat/ValveResourceFormat Source 2 Viewer (VRF) is an open-source tool for browsing VPK archives and viewing, extracting, and decompiling Source 2 game assets such a… | 95 | 2391 | active |
| bootleg/ret-sync ret-sync is a set of plugins that synchronize a debugging session (WinDbg, GDB, LLDB, OllyDbg, x64dbg) with disassemblers (IDA, Ghidra, Bin… | 53 | 2378 | active |
| david942j/one_gadget A Ruby command-line tool that finds one-gadget RCE candidates (execve('/bin/sh',...) call sites) in libc binaries for CTF pwn challenges. I… | 67 | 2346 | active |
| hzqst/VmwareHardenedLoader A Windows kernel driver that mitigates VMware VM detection by filtering VMware-related firmware strings and blocking VMware PnP registry en… | 87 | 2334 | active |
| nfcgate/nfcgate NFCGate is an Android application for capturing, analyzing, modifying, relaying, replaying, and cloning NFC traffic. It is a security resea… | 84 | 2333 | active |
| Ch0pin/medusa MEDUSA is a modular automation framework and script repository for runtime testing and investigating Android and iOS apps, built on FRIDA. … | 84 | 2332 | active |
| googleprojectzero/sandbox-attacksurface-analysis-tools A suite of PowerShell tools and .NET libraries from Google Project Zero for analyzing Windows sandbox attack surfaces. It includes NtCoreLi… | 56 | 2332 | active |
| Vineflower/vineflower Vineflower is a modern Java and JVM bytecode decompiler forked from Fernflower, focused on producing accurate, readable output with support… | 84 | 2327 | active |
| UMSKT/UMSKT UMSKT (Universal MS Key Toolkit) is an open-source C++ CLI toolkit for researching and experimenting with Microsoft's pre-Vista (pre-2012) … | 78 | 2318 | active |
| REAndroid/APKEditor APKEditor is a Java command-line tool for editing Android APK resources without depending on aapt/aapt2. It can decode binary resources to … | 89 | 2291 | active |
| bitcookies/winrar-keygen An open-source tool and educational write-up explaining the principle behind WinRAR's 'rarreg.key' license file generation, with implementa… | 96 | 2277 | active |
| a2x/cs2-dumper An external offset/interface dumper for Counter-Strike 2 that reads the game process memory via memflow and generates offset files in forma… | 72 | 2275 | active |
| httptoolkit/frida-interception-and-unpinning A collection of Frida scripts that rewrite mobile applications at runtime to bypass certificate pinning and route all HTTPS traffic through… | 76 | 2266 | active |
| BinaryAnalysisPlatform/bap CMU Binary Analysis Platform (BAP) is a suite of OCaml libraries and a plugin-extensible CLI tool for analyzing binary programs. It lifts b… | 59 | 2253 | active |
| Storyyeller/Krakatau Krakatau is a Rust-based CLI tool for assembling, disassembling, and decompiling Java bytecode. It is specifically designed to handle obfus… | 66 | 2244 | active |
| DanOps-1/Gpt-Agreement-Payment A Python toolkit that reverse-engineers and replays the end-to-end ChatGPT Plus/Team/Pro subscription payment flow (Stripe Checkout, PayPal… | 53 | 2225 | active |
| grimdoomer/Xbox360BadUpdate A non-persistent, software-only hypervisor exploit for the Xbox 360 that runs unsigned code on the latest dashboard (17559) using a support… | 10 | 2221 | active |
| eeeeeeeeee-code/e0e1-wx A Windows GUI tool (PySide6, Python 3.10+) for analyzing and penetration-testing WeChat mini-programs locally. It automates mini-program pa… | 80 | 2214 | active |
| avast/retdec RetDec is a retargetable machine-code decompiler based on LLVM that converts native binaries back into readable C or Python-like source cod… | 61 | 8612 | maintenance |
| Encryqed/Dumper-7 Dumper-7 is a C++ DLL that, when injected into an Unreal Engine game, generates a full C++ SDK (headers for engine classes, functions, and … | 96 | 2211 | active |
| TheMythologist/GenP GenP is an open-source AutoIt patcher that applies binary hex patches to Adobe Creative Cloud applications on Windows to modify their licen… | 78 | 2196 | active |
| bytecode77/r77-rootkit r77 is a fileless ring 3 (userland) rootkit for Windows that hides files, processes, registry keys, services, and network connections using… | 75 | 2191 | active |
| ReClassNET/ReClass.NET ReClass.NET is a .NET-based memory inspection and class structure reconstruction tool for analyzing remote processes, a modernized port of … | 23 | 2187 | active |
| o-gs/dji-firmware-tools A collection of C command-line tools for extracting, modifying, and repacking firmware of DJI drones such as Phantom, Mavic, Inspire, and S… | 74 | 2186 | active |
| 0vercl0k/rp rp++ is a fast C++ command-line tool that finds ROP (Return-Oriented Programming) gadgets in PE, ELF, and Mach-O binaries for x86, x64, ARM… | 44 | 2180 | active |
| tbnobody/OpenDTU OpenDTU is ESP32 firmware that replaces the proprietary Hoymiles DTU cloud gateway for solar micro-inverters, communicating directly over t… | 92 | 2176 | active |
| Ylarod/Florida Florida is an automatically patched, anti-detection build of frida-server for Android, tracking the upstream FRIDA project. It rebuilds fri… | 89 | 2175 | active |
| jar-analyzer/jar-analyzer A free, open-source GUI tool for analyzing Java JAR files, offering method call relationship search, DFS call chain analysis, taint analysi… | 94 | 2158 | active |
| sashs/Ropper Ropper is a Python CLI tool that displays information about binary files (ELF, PE, Mach-O, RAW) and finds ROP/JOP gadgets to build exploit … | 77 | 2144 | active |
| 0xsdeo/AntiDebug_Breaker A Chrome browser extension built on the Hook_JS library that assists with JavaScript reverse engineering and penetration testing reconnaiss… | 76 | 2122 | active |
| tyilo/insert_dylib A command line utility written in C that inserts a dylib load command (LC_LOAD_DYLIB or LC_LOAD_WEAK_DYLIB) into Mach-O binaries, including… | 38 | 2092 | active |
| redballoonsecurity/ofrak OFRAK is a binary analysis and modification platform that identifies, unpacks, analyzes, modifies, and repacks binaries, with first-class s… | 67 | 2067 | active |
| lasting-yang/frida_dump A collection of Frida scripts for dumping DEX files and native shared libraries (.so) from running Android processes. It includes SoFixer-b… | 49 | 2067 | active |
| CYB3RMX/Qu1cksc0pe Qu1cksc0pe is an all-in-one malware analysis tool that statically and dynamically analyzes many file types, including Windows/Linux/macOS e… | 77 | 2049 | active |
| mandiant/speakeasy Speakeasy is a Windows user-mode and kernel-mode emulation framework that runs binaries, drivers, and shellcode inside a modeled Windows ru… | 91 | 2036 | active |
| aixed/WeChat-Hook A Windows x64 DLL (loaded as a version.dll proxy into WeChat PC) that hooks WeChat 3.9.10.16 / 4.1.10.27 and exposes a local HTTP API for s… | 96 | 2033 | active |
| ainfosec/FISSURE FISSURE is an open-source RF and reverse engineering framework built around software-defined radios, supporting signal detection, classific… | 76 | 2033 | active |
| OpenSteam001/OpenSteamTool OpenSteamTool is an open-source Windows-only Steam unlocker written in C++ that unlocks unowned games and DLCs via Lua configuration, manif… | 74 | 2021 | active |
| UnderminersTeam/UndertaleModTool A GUI and CLI tool for modding, decompiling, and unpacking Undertale, Deltarune, and other GameMaker Studio games. It provides editors for … | 95 | 2012 | active |
| endrazine/wcc The Witchcraft Compiler Collection (WCC) is a set of compilation tools for performing binary manipulation on ELF executables across POSIX p… | 90 | 2010 | active |
| dqzg12300/fridaUiTools fridaUiTools is a PyQt5 desktop workbench that wraps Frida into a unified GUI for attaching to processes, managing hook script templates, v… | 86 | 2010 | active |
| xiangsx/gpt4free-ts A TypeScript replication of gpt4free that provides free access to GPT-4 and other LLM models by reverse-engineering various websites offeri… | 20 | 7681 | maintenance |
| google/android-classyshark ClassyShark is a standalone binary inspection tool for Android developers that browses Android executables and shows class interfaces, memb… | 10 | 7558 | maintenance |
| vmoranv/jshookmcp An MCP server exposing 600+ tools across 34 domains for JavaScript reverse engineering and security research, including browser automation,… | 59 | 1954 | active |
| de4dot/de4dot de4dot is an open-source .NET deobfuscator and unpacker written in C# that restores packed and obfuscated .NET assemblies to near-original … | 10 | 7437 | maintenance |
| IDA-NO-MCP A collection of reverse engineering skills (prompt/plugin packages) for AI coding assistants like Claude Code, designed to work with IDA-NO… | 58 | 1946 | active |
| axi0mX/ipwndfu ipwndfu is an open-source Python tool that exploits iOS device bootroms, most notably via the checkm8 exploit, to put devices into pwned DF… | 32 | 7397 | maintenance |
| Producdevity/gamehub-lite GameHub Lite is a community-maintained patched version of the GameHub Android app that strips telemetry, bloat, and account requirements wh… | 77 | 1944 | active |