Open-source reverse-engineering software
634 open-source libraries, tools and applications tagged reverse-engineering, ranked by how closely reverse-engineering is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
634 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| dethrace-labs/dethrace Dethrace is an open-source reverse-engineering project that rebuilds the 1997 driving/mayhem game Carmageddon to run natively on modern sys… | 83 | 1223 | active |
| jxy-s/herpaderping A proof-of-concept tool and technical write-up demonstrating Process Herpaderping, a Windows technique that maps a process image from a fil… | 32 | 1214 | active |
| amruth-sn/kong Kong is an LLM-orchestrated reverse engineering CLI that plugs AI into Ghidra's analysis engine to recover function names, types, and struc… | 57 | 1208 | active |
| hamishcoleman/thinkpad-ec A Linux command-line toolkit for extracting, examining, and patching ThinkPad xx30-series embedded controller (EC) firmware. Its main purpo… | 38 | 1203 | active |
| x64dbg/GleeBug GleeBug is a debugging framework for Windows written in C, designed to make building debuggers and debugging tools complete and easy to use… | 72 | 1201 | active |
| petoolse/petools PE Tools is a Windows GUI toolkit for researching and manipulating Portable Executable (PE) files and running processes. It bundles a PE he… | 41 | 1201 | active |
| P3GLEG/Whaler Whaler is a Go CLI tool that reverse engineers Docker images back into the Dockerfiles that created them. It also extracts files added via … | 53 | 1192 | active |
| Redress Redress is a command-line tool for analyzing stripped Go binaries, reconstructing symbols and extracting information such as compiler versi… | 95 | 1191 | active |
| OSS CAD Suite Project IceStorm documents the reverse-engineered bitstream format of Lattice iCE40 FPGAs and provides tools for analyzing and creating bit… | 66 | 1188 | active |
| yazgx97/frida-ios-hook A Python/JavaScript CLI tool that wraps Frida to make it easy to trace classes and functions, hook methods, and modify return values on iOS… | 63 | 1187 | active |
| P1sec/hermes-dec hermes-dec is a Python-based reverse engineering tool that disassembles and decompiles React Native applications compiled to the Hermes VM … | 92 | 1181 | active |
| tiltedphoques/TiltedEvolution Tilted Online (Skyrim Together) is a C++ framework that adds online multiplayer to Bethesda games, currently supporting Skyrim Special Edit… | 97 | 1177 | active |
| reversenseorg/dexcalibur Reversense (Dexcalibur 2) is a binary intelligence platform that automates reverse engineering of mobile and embedded applications. It comb… | 66 | 1175 | active |
| nccgroup/Sniffle Sniffle is an open-source sniffer for Bluetooth 5 and 4.x LE that runs on TI CC1352/CC26x2 hardware with a Python host-side tool. It captur… | 39 | 1175 | active |
| geohot/qira QIRA is a QEMU-based interactive runtime analyser that traces program execution and presents it in a web UI, acting as a competitor to stra… | 23 | 4072 | maintenance |
| luoyesiqiu/dpt-shell dpt-shell is an Android Dex protection shell that hollows out DEX method implementations and reconstructs them at runtime to protect APK/AA… | 94 | 1157 | active |
| Exeinfo PE Exeinfo Pe is a free Windows GUI tool that detects packers, protectors, compilers, .NET obfuscators, and packed binary data formats in PE e… | 91 | 1156 | active |
| GJDuck/e9patch E9Patch is a static binary rewriting tool for x86_64 Linux ELF executables and shared objects, producing patched binaries that work as drop… | 77 | 1156 | active |
| naim94a/lumen Lumen is a self-hosted, open-source replacement for Hex-Rays' Lumina server that stores and shares IDA Pro function signatures, comments, a… | 64 | 1155 | active |
| ben-sb/javascript-deobfuscator A general-purpose JavaScript deobfuscator that removes common obfuscation techniques such as array unpacking, proxy functions, expression o… | 43 | 1154 | active |
| Xeeynamo/sotn-decomp A matching decompilation project recreating the C source code of Castlevania: Symphony of the Night from its original binaries for PS1, PSP… | 68 | 1152 | active |
| ichason/CPosed CPosed is an Android hooking framework forked from LSPosed that enables Xposed-style module injection on rooted devices running Android 8.1… | 42 | 1152 | active |
| JusticeRage/Manalyze Manalyze is a static analyzer for PE (Windows executable) files written in C++. It performs primary malware assessment by parsing PE struct… | 81 | 1149 | active |
| AloneMonkey/frida-ios-dump A Python CLI script that uses Frida to dump decrypted iOS app binaries from a jailbroken device and packages them into an IPA. It connects … | 77 | 3966 | maintenance |
| david942j/seccomp-tools A Ruby-based CLI toolkit for analyzing seccomp BPF filters, supporting dumping, disassembling, assembling, emulating, and auditing seccomp … | 87 | 1142 | active |
| greatscottgadgets/luna LUNA is an Amaranth HDL (Python) framework providing FPGA gateware and software for working with USB, from passive protocol analysis to bui… | 70 | 1140 | active |
| mrphrazer/reverser_ai ReverserAI is a Binary Ninja plugin that provides automated reverse engineering assistance using locally-hosted large language models runni… | 63 | 1139 | active |
| Endermanch/XPKeygen A C++ tool that generates valid Windows XP and Windows Server 2003 VLK product keys from a raw product key, based on reverse-engineered ell… | 59 | 1135 | active |
| HZJQF/help_tool A PyQt5-based Windows GUI tool that uses inference models to identify the encryption or hashing algorithm behind a given ciphertext and att… | 14 | 1134 | active |
| moshowgame/Navicat_Keygen_Patch A collection of keygen, patch, and trial-reset tools for bypassing activation of Navicat database client versions 15-17, distributed as DLL… | 44 | 1130 | active |
| BlackObfuscator BlackObfuscator is a Java-based obfuscator for Android DEX files that applies control flow flattening to make decompiled code hard to analy… | 28 | 1130 | active |
| REhints/efiXplorer efiXplorer is an IDA Pro plugin and loader that automates static analysis of UEFI firmware. It recovers EFI service function calls, identif… | 84 | 1129 | active |
| Washi1337/AsmResolver AsmResolver is a .NET library for reading, modifying, and writing Portable Executable (PE) files, including those with .NET metadata. It pr… | 90 | 1125 | active |
| mandiant/GoReSym GoReSym is a cross-platform CLI tool that extracts symbols, function metadata, types, and program metadata from Go binaries, including stri… | 91 | 1118 | active |
| KJCracks/Clutch Clutch is a fast iOS executable decryption and dumping tool that extracts decrypted binaries and .ipa files from installed apps on jailbrok… | 23 | 3830 | maintenance |
| TheOfficialFloW/h-encore h-encore is a fully chained kernel exploit (jailbreak) for the PlayStation Vita on firmwares 3.65-3.68. It enables kernel and user modifica… | 23 | 1110 | stable |
| SteamTracking/SteamTracking A project that tracks and reverse-engineers Steam and Valve data, including protobuf definitions and changes across Steam services. It moni… | 77 | 1109 | active |
| memflow memflow is a Rust library providing a modular framework for physical memory introspection of machines, including live hardware, virtual mac… | 55 | 1100 | active |
| hyugogirubato/KeyDive KeyDive is a Python CLI tool that extracts Widevine L3 DRM keys and device credentials from rooted Android devices using Frida instrumentat… | 75 | 1099 | active |
| jwping/wxbot A Go-based WeChat hook/robot framework that injects into the Windows PC WeChat client (specific versions 3.9.8.x) to expose a bot API, runn… | 27 | 1099 | active |
| lico-n/ZygiskFrida A Zygisk (and Riru) module for rooted Android devices that injects the Frida gadget into application processes in a stealthy manner. It avo… | 46 | 1097 | active |
| QQBackup/qq-win-db-key A collection of Python and Frida scripts for extracting database encryption keys from QQ (Tencent's messenger) across Windows, Linux, macOS… | 68 | 1090 | active |
| Spade-sec/First A WeChat mini-program security debugging tool (fork/extension of WMPFDebugger) that uses Frida injection and Chrome DevTools Protocol bridg… | 68 | 1089 | active |
| Pikachu Volleyball A browser-based reimplementation of the 1997 Windows game Pikachu Volleyball, created by reverse engineering the original machine code (phy… | 76 | 1088 | active |
| wisk/medusa Medusa is an open-source, modular, interactive disassembler written in C++, organized as a library with frontends including a GUI (qMedusa)… | 53 | 1088 | active |
| bitdefender/bddisasm bddisasm is a fast, lightweight x86/x64 instruction decoder library written in C with no external dependencies, no memory allocation, and t… | 87 | 1086 | active |
| nathanlopez/Stitch Stitch is a cross-platform Python Remote Administration Tool (RAT) framework for building custom payloads for Windows, macOS, and Linux. It… | 32 | 3683 | maintenance |
| apkunpacker/MagiskDetection A curated collection of publicly available proof-of-concept Android apps that detect root, Magisk, Zygisk, and hooking frameworks like Frid… | 65 | 1072 | active |
| echo094/decode-js A Node.js CLI tool built on Babel that analyzes and reverses obfuscated JavaScript back into readable source. It supports common obfuscatio… | 77 | 1070 | active |
| ZeroMemoryEx/Chaos-Rootkit Chaos-Rootkit is an x64 Ring 0 Windows kernel rootkit written in C++ as a research project to understand kernel internals and rootkit techn… | 55 | 1069 | active |
| RuntimeBrowser RuntimeBrowser is a class browser for the Objective-C runtime on iOS and OS X that exposes all loaded classes, methods, and dynamically gen… | 75 | 3659 | maintenance |
| LuckyPray/DexKit DexKit is a high-performance dex parsing and deobfuscation library implemented in C++ with Kotlin bindings, used to locate obfuscated class… | 90 | 1065 | active |
| MatthewKuKanich/CAN_Commander CAN Commander is a tool for reverse engineering and analyzing CAN bus systems, pairing a Flipper Zero app with ESP32 firmware to interact w… | 60 | 1063 | active |
| Vuemony/vue-after-free A PlayStation 4 userland code execution exploit delivered through the PlayStation Vue app, chained with kernel exploits (Lapse, Poopsploit/… | 62 | 1062 | active |
| theapache64/stackzy Stackzy is a cross-platform desktop application built with Compose Desktop that identifies the libraries used inside an Android APK. It dec… | 82 | 1060 | active |
| paradiseduo/appdecrypt A Swift CLI tool that decrypts FairPlay-encrypted Mach-O application binaries on macOS (SIP-enabled, macOS 11.3 or below, with newer suppor… | 41 | 1055 | active |
| nygard/class-dump class-dump is a command-line utility that examines the Objective-C runtime information in Mach-O binaries and generates Objective-C header … | 23 | 3587 | maintenance |
| mitmproxy/android-unpinner A Python CLI tool that removes certificate pinning from Android APKs so traffic can be intercepted with mitmproxy, without requiring a root… | 51 | 1043 | active |
| amlweems/xzbot A research toolkit for the xz backdoor (CVE-2024-3094) containing an OpenSSH honeypot patch to detect exploit attempts, a patch script to r… | 25 | 3550 | maintenance |
| PixMob IR Reverse Engineering A reverse-engineering project and Python tooling for the PixMob infrared (and RF) protocol used by LED wristbands at large events, enabling… | 58 | 1038 | active |
| Reloaded-Project/Reloaded-II Reloaded II is a universal, C#/.NET-based mod loader and mod management framework for native games on X86 and X64. It uses DLL injection to… | 93 | 1034 | active |
| kyleavery/AceLdr AceLdr is a position-independent reflective loader (UDRL) for Cobalt Strike written in C, designed to evade memory scanners like Moneta, PE… | 23 | 1032 | active |
| gcarmix/HexWalk HexWalk is a cross-platform GUI hex editor, viewer, and binary analyzer built on qhexedit2, Capstone, and Qt. It combines hex editing with … | 89 | 1027 | active |
| RuoJi6/audit-skills A lightweight Claude/Codex skill package for AI-assisted source code security auditing, covering Java, .NET, and PHP. It provides vulnerabi… | 68 | 1027 | active |
| NoOne-hub/JSReverser-MCP JSReverser-MCP is an MCP server that standardizes JavaScript reverse-engineering workflows by exposing browser observation, script search, … | 66 | 1017 | active |
| secretsquirrel/the-backdoor-factory The Backdoor Factory (BDF) is a Python command-line tool that patches Windows PE, Linux ELF, and macOS Mach-O executables with user-supplie… | 32 | 3438 | maintenance |
| mnh-jansson/m18-protocol A research repository and Python diagnostic tool for reverse-engineering the Milwaukee M18 power tool battery communication protocol. Using… | 39 | 1012 | active |
| Indetectables Toolkit A curated Windows toolkit bundling 101 applications for reverse engineering, malware analysis, and cracking, installed via an automated Inn… | 83 | 1011 | active |
| Fadi002/de4py An open-source, AI-powered toolkit for reverse engineering Python code, combining an LLM-driven deobfuscation engine (via Ollama) with lega… | 88 | 1007 | active |
| vivisect/vivisect Vivisect is a Python framework combining a disassembler, static binary analysis, emulation, symbolic execution, and a debugger (vdb/vtrace)… | 76 | 1002 | active |
| stephenfewer/ReflectiveDLLInjection A C library implementing reflective DLL injection, a technique for loading a library from memory into a host Windows process without touchi… | 32 | 3363 | maintenance |
| nabla-c0d3/ssl-kill-switch2 SSL Kill Switch 2 is a blackbox Cydia Substrate tweak that disables SSL/TLS certificate validation, including certificate pinning, in iOS a… | 23 | 3317 | maintenance |
| morkt/GARbro GARbro is a Windows GUI application for browsing, extracting, and converting resources (archives, images, audio) from visual novel games. I… | 23 | 3298 | maintenance |
| EasyHook/EasyHook EasyHook is a Windows API hooking library that lets you intercept and extend unmanaged code APIs with managed (.NET) or native hook handler… | 23 | 3290 | maintenance |
| caj2pdf/caj2pdf A Python CLI tool that converts CNKI's proprietary CAJ document files into PDFs while preserving selectable text and outline information. I… | 32 | 3244 | maintenance |
| plasma-disassembler/plasma Plasma is an interactive disassembler for x86/x86-64, ARM, and MIPS binaries that generates indented pseudo-code with colored syntax. It su… | 32 | 3068 | maintenance |
| WindySha/Xpatch Xpatch is a Java CLI tool that repackages and re-signs Android APK files so the resulting APK can load installed Xposed modules. It enables… | 46 | 3062 | maintenance |
| NYAN-x-CAT/AsyncRAT-C-Sharp AsyncRAT is an open-source Remote Access Tool (RAT) written in C# that lets an operator remotely monitor and control Windows client machine… | 23 | 3028 | maintenance |
| ac-pm/Inspeckage Inspeckage is an Xposed module that performs dynamic analysis of Android applications by hooking Android API functions to observe runtime b… | 23 | 2986 | maintenance |
| Jermic/Android-Crack-Tool A macOS GUI application that bundles common Android APK reverse-engineering tools (Apktool, Dex2Jar, JD-GUI, SignApk, Zipalign) into one in… | 23 | 2941 | maintenance |
| ma1co/Sony-PMCA-RE A tool that interfaces with Sony digital cameras over USB to tweak settings, dump firmware, and install custom Android apps via the PlayMem… | 23 | 2939 | maintenance |
| tiagorlampert/CHAOS CHAOS is a free and open-source Remote Administration Tool written in Go that generates cross-platform binaries (Windows and Linux) for con… | 23 | 2840 | maintenance |
| lifting-bits/mcsema McSema is a framework that lifts native x86, amd64, aarch64, sparc32, and sparc64 executable binaries (ELF and PE) into LLVM bitcode. It wo… | 10 | 2792 | maintenance |
| y9nhjy/Proxifier-Keygen A Python CLI keygen that generates registration keys for Proxifier (setup, portable, and Mac variants), based on a reverse-engineering anal… | 29 | 2762 | maintenance |
| google/enjarify Enjarify is a Python 3 tool that translates Dalvik bytecode from Android APK/DEX files into equivalent Java bytecode (JAR), enabling Java a… | 10 | 2744 | maintenance |
| hanbinglengyue/FART FART is an automated Android app unpacking (dex dumping) tool for ART environments, based on active invocation, implemented on Android 6.0/… | 32 | 2742 | maintenance |
| leibnitz27/cfr CFR (Class File Reader) is a Java decompiler written entirely in Java 6 that can decompile modern Java bytecode, including features from Ja… | 57 | 2726 | maintenance |
| everdox/InfinityHook InfinityHook is a Windows kernel library that hooks system calls, context switches, page faults, and DPCs by abusing ETW trace mechanics, r… | 32 | 2679 | maintenance |
| DarthTon/Xenos Xenos is a Windows DLL injector built on the Blackbone library, supporting x86/x64 processes, manual image mapping, managed image injection… | 23 | 2679 | maintenance |
| xoreaxeaxeax/rosenbridge Rosenbridge is a security research project that documents a hardware backdoor in some VIA C3 x86 processors, allowing userland code to bypa… | 32 | 2618 | maintenance |
| seemoo-lab/openhaystack OpenHaystack is a framework and macOS application for creating custom Bluetooth tracking tags that leverage Apple's Find My (offline findin… | 63 | 13695 | experimental |
| xdmjun/wxappUnpacker wxappUnpacker is a Node.js tool that unpacks and decompiles WeChat mini-program packages (.wxapkg files), restoring WXML, WXSS, JS, and con… | 32 | 2426 | maintenance |
| dana-at-cp/backdoor-apk A shell script that automates injecting a Metasploit backdoor payload into any Android APK by decompiling, hooking smali code, and re-signi… | 32 | 2372 | maintenance |
| retroplasma/earth-reverse-engineering A reverse-engineering project documenting and implementing access to Google Earth's undocumented 3D satellite mode, including URL structure… | 10 | 2321 | maintenance |
| buginux/WeChatRedEnvelop An iOS jailbreak tweak (Cydia plugin) written in Objective-C that automatically grabs red envelopes (lucky money) in WeChat. It integrates … | 10 | 2290 | maintenance |
| ldpreload/BlackLotus An open-source UEFI bootkit targeting Windows that implements a Secure Boot bypass, kernel-level persistence, and an HTTP-based C2 loader w… | 29 | 2247 | maintenance |
| JKornev/hidden A Windows kernel driver with a usermode library and CLI that can hide processes, files, directories, and registry keys, and protect process… | 23 | 2065 | maintenance |
| weak1337/Alcatraz Alcatraz is a GUI-based x64 binary obfuscator for Windows PE files (.exe, .dll, .sys) written in C++. It applies transformations like contr… | 32 | 2000 | maintenance |
| mona mona.py is a Python plugin for debuggers (Immunity Debugger, x64dbg) that assists with exploit development tasks such as finding ROP gadget… | 10 | 1896 | maintenance |
| cobbr/SharpSploit SharpSploit is a .NET post-exploitation library written in C# that highlights the .NET attack surface for red teamers. It ports and extends… | 32 | 1888 | maintenance |