Open-source reverse-engineering software
634 open-source libraries, tools and applications tagged reverse-engineering, ranked by how closely reverse-engineering is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
634 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| OpenGOAL OpenGOAL is a project that decompiles the Jak & Daxter PS2 games and recompiles them into native x86-64 ports, including a from-scratch imp… | 100 | 3574 | active |
| CAPEv2 CAPEv2 is a malware sandbox derived from Cuckoo that executes malicious files in isolated environments while instrumenting their behavior a… | 77 | 3573 | active |
| gtworek/PSBits A collection of relatively simple C and PowerShell snippets for digging deeper into Windows internals, security, and forensics. Each folder… | 72 | 3518 | active |
| pret/pokeemerald A complete decompilation of Pokémon Emerald into C source code that rebuilds the exact original Game Boy Advance ROM. It serves as a base f… | 74 | 3494 | active |
| LEGO Island (decompilation) A functionally complete reverse-engineered decompilation of the 1997 game LEGO Island, reconstructing C++ source code that matches the orig… | 90 | 3491 | active |
| openpilot opendbc is a Python API for controlling and reading state from cars over CAN bus, including steering, gas, and brake actuation via ADAS int… | 90 | 3487 | active |
| JusticeRage/Gepetto Gepetto is an IDA Pro plugin that queries large language models (OpenAI, Anthropic, Gemini, Ollama, and others) to explain decompiled funct… | 73 | 3487 | active |
| SteamAutoCracks/Steam-auto-crack A C# tool that automatically cracks Steam games by unpacking SteamStub-protected executables and applying the Goldberg Steam emulator. It a… | 97 | 3360 | active |
| QiuChenly/CoreInject CoreInject (successor to InjectLib) is a macOS application injection and binary-patching tool by QiuChenly, distributed alongside a communi… | 81 | 3264 | active |
| biggerstar/wedecode Wedecode is a fully automated tool that decompiles WeChat mini-program and mini-game wxapkg packages back into readable source code (JS, WX… | 66 | 3239 | active |
| LaurieWired/Malimite Malimite is a Java-based decompiler for iOS and macOS binaries, built on Ghidra, that analyzes IPA files and Application Bundles with direc… | 34 | 3222 | active |
| BinDiff BinDiff is an open-source comparison tool for binary files that finds differences and similarities in disassembled code using graph-theoret… | 62 | 3206 | active |
| DynamoRIO/dynamorio DynamoRIO is a runtime code manipulation system that supports arbitrary code transformations on executing programs, with a powerful instruc… | 95 | 3181 | active |
| pxb1988/dex2jar dex2jar is a set of Java-based command-line tools for working with Android .dex and Java .class files. It converts Dalvik executables (e.g.… | 23 | 13148 | maintenance |
| korcankaraokcu/PINCE PINCE is a GDB front-end and reverse engineering tool for Linux, focused on game hacking but usable for general reverse engineering. It pro… | 96 | 3130 | active |
| m0bilesecurity/RMS-Runtime-Mobile-Security Runtime Mobile Security (RMS) is a NodeJS-powered web interface built on FRIDA for manipulating Android and iOS apps at runtime. It lets us… | 83 | 3130 | active |
| eteran/edb-debugger edb is a cross-platform AArch32/x86/x86-64 debugger inspired by OllyDbg, built with Qt and Capstone. It provides a graphical interface for … | 67 | 2974 | active |
| TheOfficialFloW/PPPwn PPPwn is a proof-of-concept kernel remote code execution exploit for PlayStation 4 consoles up to firmware 11.00, exploiting CVE-2006-4304 … | 25 | 2965 | active |
| j4k0xb/webcrack webcrack is a JavaScript reverse-engineering tool that deobfuscates code obfuscated with obfuscator.io, unminifies minified code, and unpac… | 73 | 2962 | active |
| zinja-coder/jadx-ai-mcp A JADX plugin that bundles an MCP server, allowing LLM clients like Claude to interact with the JADX decompiler for Android APK analysis. I… | 88 | 2915 | active |
| zhizhuodemao/js-reverse-mcp An MCP server that gives AI coding agents (Claude, Cursor, Copilot) tools for JavaScript reverse engineering in a headed Chrome browser, in… | 79 | 2881 | active |
| mrexodia/TitanHide TitanHide is a Windows kernel driver that hides debuggers from selected processes by hooking Nt* kernel functions via SSDT hooks and alteri… | 68 | 2872 | active |
| gdbinit/MachOView A macOS GUI application for viewing and exploring Mach-O binary files, revived as a maintained fork with a universal x86_64/arm64 build. It… | 32 | 2869 | active |
| evi0s/WMPFDebugger A debugger tweak for WeChat's Mini-Program Framework (WMPF) that exploits the remote debug feature of WeChat devtools to enable full Chrome… | 64 | 2832 | active |
| hasherezade/pe_to_shellcode A C++ command-line tool that converts Windows PE executables into shellcode-compatible form, adding a reflective loading stub post-compilat… | 37 | 2797 | active |
| panda-re/panda PANDA is an open-source Platform for Architecture-Neutral Dynamic Analysis built on the QEMU whole-system emulator, supporting record and r… | 91 | 2782 | active |
| Impact-I/reFlutter reFlutter is a Python CLI framework for reverse engineering Flutter mobile apps by repacking APK/IPA files with a specially patched, precom… | 99 | 2776 | active |
| hfiref0x/KDU KDU (Kernel Driver Utility) is a Windows command-line tool that abuses known vulnerable drivers to load unsigned kernel drivers, bypass Dri… | 93 | 2770 | active |
| securing/IOSSecuritySuite iOS Security Suite is a Swift library for iOS platform security and anti-tampering checks. It detects jailbroken devices, attached debugger… | 80 | 2733 | active |
| AxtMueller/Windows-Kernel-Explorer Windows Kernel Explorer (WKE) is a free Windows kernel research and inspection tool supporting Windows XP through Windows 11. It loads a ke… | 54 | 2724 | active |
| decompiler-explorer/decompiler-explorer A web service (like Compiler Explorer in reverse) that lets users upload small binaries and compare the decompiled C-like output from many … | 77 | 2711 | active |
| worawit/blutter Blutter is a reverse engineering tool for Flutter mobile applications that compiles the Dart AOT runtime to extract symbols and objects fro… | 69 | 2711 | active |
| Artikash/Textractor Textractor is an open-source x86/x64 text hooker for Windows that extracts text from video games and visual novels by injecting into text o… | 23 | 2699 | active |
| bug-bit/fckvip An Android module (likely Magisk/LSPosed-based) that unlocks paid VIP memberships and enhances extended features in certain apps. It requir… | 79 | 2654 | active |
| Keystone Assembler Engine Keystone is a lightweight multi-platform, multi-architecture assembler framework implemented in C/C++ with bindings for many languages. It … | 67 | 2649 | active |
| REhints/HexRaysCodeXplorer HexRaysCodeXplorer is a Hex-Rays Decompiler plugin written in C++ that improves code navigation during reverse engineering. It automates re… | 44 | 2641 | active |
| qidian55/bilibilitv1.6.6-repair A repair project that patches the classic Bilibili TV app version 1.6.6 (written in Smali) so it keeps working despite server-side changes.… | 62 | 2640 | active |
| EDL (Qualcomm Sahara/Firehose Tools) A Python CLI tool for communicating with Qualcomm devices in EDL (Emergency Download) mode via the Sahara, Firehose, Streaming, and Diag pr… | 66 | 2611 | active |
| gaasedelen/lighthouse Lighthouse is a code coverage explorer plugin for IDA Pro and Binary Ninja that lets reverse engineers interactively visualize execution co… | 49 | 2609 | stable |
| uxmal/reko Reko is a general-purpose binary decompiler that translates machine code executables back into high-level language source. It supports mult… | 89 | 2607 | active |
| bytedance/bhook ByteHook is a production-grade Android PLT hook library written in C, supporting armeabi-v7a, arm64-v8a, x86, and x86_64. It lets native co… | 73 | 2597 | active |
| rednaga/APKiD APKiD is a command-line tool that identifies how an Android APK was built, detecting compilers, packers, obfuscators, and app-shielding/RAS… | 75 | 2577 | active |
| DidierStevens/DidierStevensSuite A bundled collection of Didier Stevens' security research tools, distributed as a ZIP and GitHub repository of Python scripts and utilities… | 75 | 2546 | active |
| Mattiwatti/EfiGuard EfiGuard is a portable x64 UEFI bootkit that patches the Windows boot manager, boot loader, and kernel at boot time to disable PatchGuard a… | 58 | 2535 | active |
| Nidhogg Nidhogg is an open-source Windows x64 kernel rootkit written in C++ that demonstrates a wide range of rootkit techniques such as process, t… | 84 | 2534 | active |
| ValveResourceFormat/ValveResourceFormat Source 2 Viewer (VRF) is an open-source tool for browsing VPK archives and viewing, extracting, and decompiling Source 2 game assets such a… | 95 | 2520 | active |
| solemnwarning/rehex Rehex is a cross-platform hex editor designed for reverse engineering binary files, with features like large file support, inline disassemb… | 79 | 2481 | active |
| duty1g/x64dbg-mcp-server A native MCP (Model Context Protocol) plugin for x64dbg written in Zig that exposes the debugger's full functionality over HTTP with Stream… | 80 | 2473 | active |
| mandiant/flare-ida A collection of IDA Pro plugins and IDAPython scripts from Mandiant's FLARE team for reverse engineering and malware analysis. It includes … | 10 | 2450 | active |
| msojocs/fiddler-everywhere-enhance An auto-patch tool that modifies the Fiddler Everywhere web debugging proxy (an Electron app) on Windows and Linux, replacing DLLs and patc… | 85 | 2437 | active |
| Yuyz0112/claude-code-reverse A tool that reverse engineers Claude Code by capturing and visualizing its LLM API interactions. It monkey-patches Claude Code's request co… | 34 | 2432 | active |
| hasherezade/hollows_hunter Hollows Hunter is a Windows command-line tool built on the PE-sieve passive memory scanner that scans running processes for malicious impla… | 65 | 2419 | active |
| bitcookies/winrar-keygen An open-source tool and educational write-up explaining the principle behind WinRAR's 'rarreg.key' license file generation, with implementa… | 90 | 2407 | active |
| a2x/cs2-dumper An external offset/interface dumper for Counter-Strike 2 that reads the game process memory via memflow and generates offset files in forma… | 70 | 2398 | active |
| bootleg/ret-sync ret-sync is a set of plugins that synchronize a debugging session (WinDbg, GDB, LLDB, OllyDbg, x64dbg) with disassemblers (IDA, Ghidra, Bin… | 49 | 2395 | active |
| hzqst/VmwareHardenedLoader A Windows kernel driver that mitigates VMware VM detection by filtering VMware-related firmware strings and blocking VMware PnP registry en… | 94 | 2392 | active |
| Vineflower/vineflower Vineflower is a modern Java and JVM bytecode decompiler forked from Fernflower, focused on producing accurate, readable output with support… | 78 | 2380 | active |
| NFCGate NFCGate is an Android application for capturing, analyzing, modifying, relaying, replaying, and cloning NFC traffic. It is a security resea… | 77 | 2378 | active |
| david942j/one_gadget A Ruby command-line tool that finds one-gadget RCE candidates (execve('/bin/sh',...) call sites) in libc binaries for CTF pwn challenges. I… | 97 | 2359 | active |
| UMSKT/UMSKT UMSKT (Universal MS Key Toolkit) is an open-source C++ CLI toolkit for researching and experimenting with Microsoft's pre-Vista (pre-2012) … | 75 | 2357 | active |
| MEDUSA MEDUSA is a modular automation framework and script repository for runtime testing and investigating Android and iOS apps, built on FRIDA. … | 79 | 2352 | active |
| googleprojectzero/sandbox-attacksurface-analysis-tools A suite of PowerShell tools and .NET libraries from Google Project Zero for analyzing Windows sandbox attack surfaces. It includes NtCoreLi… | 42 | 2341 | active |
| REAndroid/APKEditor APKEditor is a Java command-line tool for editing Android APK resources without depending on aapt/aapt2. It can decode binary resources to … | 84 | 2335 | active |
| Encryqed/Dumper-7 Dumper-7 is a C++ DLL that, when injected into an Unreal Engine game, generates a full C++ SDK (headers for engine classes, functions, and … | 95 | 2318 | active |
| httptoolkit/frida-interception-and-unpinning A collection of Frida scripts that rewrite mobile applications at runtime to bypass certificate pinning and route all HTTPS traffic through… | 77 | 2315 | active |
| DanOps-1/Gpt-Agreement-Payment A Python toolkit that reverse-engineers and replays the end-to-end ChatGPT Plus/Team/Pro subscription payment flow (Stripe Checkout, PayPal… | 50 | 2288 | active |
| OpenSteam001/OpenSteamTool OpenSteamTool is an open-source Windows-only Steam unlocker written in C++ that unlocks unowned games and DLCs via Lua configuration, manif… | 68 | 2276 | active |
| BAP (Binary Analysis Platform) CMU Binary Analysis Platform (BAP) is a suite of OCaml libraries and a plugin-extensible CLI tool for analyzing binary programs. It lifts b… | 56 | 2262 | active |
| Storyyeller/Krakatau Krakatau is a Rust-based CLI tool for assembling, disassembling, and decompiling Java bytecode. It is specifically designed to handle obfus… | 75 | 2257 | active |
| e0e1-wx A Windows GUI tool (PySide6, Python 3.10+) for analyzing and penetration-testing WeChat mini-programs locally. It automates mini-program pa… | 74 | 2243 | active |
| grimdoomer/Xbox360BadUpdate A non-persistent, software-only hypervisor exploit for the Xbox 360 that runs unsigned code on the latest dashboard (17559) using a support… | 10 | 2239 | active |
| Ylarod/Florida Florida is an automatically patched, anti-detection build of frida-server for Android, tracking the upstream FRIDA project. It rebuilds fri… | 91 | 2236 | active |
| o-gs/dji-firmware-tools A collection of C command-line tools for extracting, modifying, and repacking firmware of DJI drones such as Phantom, Mavic, Inspire, and S… | 70 | 2221 | active |
| RetDec RetDec is a retargetable machine-code decompiler based on LLVM that converts native binaries back into readable C or Python-like source cod… | 57 | 8640 | maintenance |
| ReClass.NET ReClass.NET is a .NET-based memory inspection and class structure reconstruction tool for analyzing remote processes, a modernized port of … | 23 | 2212 | active |
| AntiDebug_Breaker A Chrome browser extension built on the Hook_JS library that assists with JavaScript reverse engineering and penetration testing reconnaiss… | 83 | 2203 | active |
| bytecode77/r77-rootkit r77 is a fileless ring 3 (userland) rootkit for Windows that hides files, processes, registry keys, services, and network connections using… | 71 | 2199 | active |
| 0vercl0k/rp rp++ is a fast C++ command-line tool that finds ROP (Return-Oriented Programming) gadgets in PE, ELF, and Mach-O binaries for x86, x64, ARM… | 38 | 2193 | active |
| tbnobody/OpenDTU OpenDTU is ESP32 firmware that replaces the proprietary Hoymiles DTU cloud gateway for solar micro-inverters, communicating directly over t… | 93 | 2192 | active |
| Jar Analyzer A free, open-source GUI tool for analyzing Java JAR files, offering method call relationship search, DFS call chain analysis, taint analysi… | 90 | 2179 | active |
| Ropper Ropper is a Python CLI tool that displays information about binary files (ELF, PE, Mach-O, RAW) and finds ROP/JOP gadgets to build exploit … | 73 | 2152 | active |
| aixed/WeChat-Hook A Windows x64 DLL (loaded as a version.dll proxy into WeChat PC) that hooks WeChat 3.9.10.16 / 4.1.10.27 and exposes a local HTTP API for s… | 94 | 2129 | active |
| tyilo/insert_dylib A command line utility written in C that inserts a dylib load command (LC_LOAD_DYLIB or LC_LOAD_WEAK_DYLIB) into Mach-O binaries, including… | 34 | 2098 | active |
| mandiant/speakeasy Speakeasy is a Windows user-mode and kernel-mode emulation framework that runs binaries, drivers, and shellcode inside a modeled Windows ru… | 79 | 2081 | active |
| lasting-yang/frida_dump A collection of Frida scripts for dumping DEX files and native shared libraries (.so) from running Android processes. It includes SoFixer-b… | 45 | 2081 | active |
| redballoonsecurity/ofrak OFRAK is a binary analysis and modification platform that identifies, unpacks, analyzes, modifies, and repacks binaries, with first-class s… | 63 | 2070 | active |
| Undertale Mod Tool A GUI and CLI tool for modding, decompiling, and unpacking Undertale, Deltarune, and other GameMaker Studio games. It provides editors for … | 90 | 2068 | active |
| CYB3RMX/Qu1cksc0pe Qu1cksc0pe is an all-in-one malware analysis tool that statically and dynamically analyzes many file types, including Windows/Linux/macOS e… | 75 | 2067 | active |
| ainfosec/FISSURE FISSURE is an open-source RF and reverse engineering framework built around software-defined radios, supporting signal detection, classific… | 86 | 2063 | active |
| ReAgent auto-re-agent is an open-source AI reverse-engineering agent that combines Ghidra binary analysis with LLMs (Claude, Codex, OpenAI-compatib… | 79 | 2063 | active |
| vmoranv/jshookmcp An MCP server exposing 600+ tools across 34 domains for JavaScript reverse engineering and security research, including browser automation,… | 72 | 2056 | active |
| IDA-NO-MCP A collection of reverse engineering skills (prompt/plugin packages) for AI coding assistants like Claude Code, designed to work with IDA-NO… | 55 | 2026 | active |
| dqzg12300/fridaUiTools fridaUiTools is a PyQt5 desktop workbench that wraps Frida into a unified GUI for attaching to processes, managing hook script templates, v… | 80 | 2018 | active |
| endrazine/wcc The Witchcraft Compiler Collection (WCC) is a set of compilation tools for performing binary manipulation on ELF executables across POSIX p… | 84 | 2014 | active |
| gpt4free-ts A TypeScript replication of gpt4free that provides free access to GPT-4 and other LLM models by reverse-engineering various websites offeri… | 21 | 7666 | maintenance |
| Producdevity/gamehub-lite GameHub Lite is a community-maintained patched version of the GameHub Android app that strips telemetry, bloat, and account requirements wh… | 71 | 2000 | active |
| filiksyos/gitreverse GitReverse is a web application that turns any public GitHub repository into a single synthetic prompt that could have been used to vibe-co… | 60 | 1984 | active |
| google/android-classyshark ClassyShark is a standalone binary inspection tool for Android developers that browses Android executables and shows class interfaces, memb… | 10 | 7552 | maintenance |
| ipwndfu ipwndfu is an open-source Python tool that exploits iOS device bootroms, most notably via the checkm8 exploit, to put devices into pwned DF… | 32 | 7430 | maintenance |
| de4dot/de4dot de4dot is an open-source .NET deobfuscator and unpacker written in C# that restores packed and obfuscated .NET assemblies to near-original … | 10 | 7429 | maintenance |