Open-source reverse-engineering software
634 open-source libraries, tools and applications tagged reverse-engineering, ranked by how closely reverse-engineering is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
634 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| adi0x90/attifyos Attify OS is a Linux distribution based on Ubuntu 18.04 pre-configured with tools for security assessment and penetration testing of IoT de… | 32 | 1035 | maintenance |
| x0tools/WeChatOpenDevTools A Windows tool that patches WeChat to enable the built-in DevTools (F12) for debugging WeChat Official Accounts and Mini Programs. It suppo… | 28 | 1034 | maintenance |
| d35ha/CallObfuscator CallObfuscator is a C++ library and CLI tool that hides Windows PE imports by rewriting the Import Address Table so sensitive APIs appear a… | 23 | 1025 | maintenance |
| F8LEFT/SoFixer SoFixer is a command-line tool that repairs ELF shared object (.so) files dumped from process memory, fixing section headers, program heade… | 10 | 1023 | maintenance |
| c0ny1/java-memshell-scanner A JSP-based scanner that detects and helps remove Java web memory shells (memshells) such as Filter, Servlet, and Listener types in middlew… | 32 | 1018 | maintenance |
| Inori/FuckGalEngine A collection of C tools for unpacking, repacking, and hooking visual novel (galgame) engines to enable fan translation and modifications. I… | 32 | 1018 | maintenance |
| WithSecureLabs/python-exe-unpacker A Python CLI script that unpacks and decompiles Windows EXEs compiled from Python code, supporting executables built with py2exe and PyInst… | 32 | 1017 | maintenance |
| rwfpl/rewolf-wow64ext A C++ helper library enabling 32-bit (x86) applications running under the WOW64 layer on 64-bit Windows to interact with native x64 process… | 23 | 1017 | maintenance |
| lethal-guitar/RigelEngine A modern C++ re-implementation of the classic 1993 DOS game Duke Nukem II, acting as a drop-in replacement for the original executable by r… | 66 | 1010 | maintenance |
| feihong-cs/Java-Rce-Echo A collection of Java test code for achieving command output echo after remote code execution (RCE) across common application servers and pl… | 32 | 1007 | maintenance |
| can1357/ThePerfectInjector A Windows DLL injection library that abuses Windows address sanitation and copy-on-write semantics for stealthy injection. Written in C and… | 32 | 1005 | maintenance |
| rampageX/firmware-mod-kit A collection of scripts and utilities for extracting, modifying, and rebuilding Linux-based firmware images for embedded devices like route… | 59 | 1003 | maintenance |
| JJTech0130/pypush A Python library for interacting with Apple's private APIs, originally a proof-of-concept iMessage reverse-engineering project. It currentl… | 59 | 3785 | experimental |
| ran-j/PS2Recomp A PlayStation 2 static recompiler that translates PS2 ELF binaries (MIPS R5900 instructions) into C++ code, plus a runtime to execute the g… | 72 | 3286 | experimental |
| SamboyCoding/Cpp2IL Cpp2IL is a work-in-progress tool that reverses Unity's IL2CPP build process, recovering managed DLLs from IL2CPP-compiled games. It parses… | 74 | 2638 | experimental |
| can1357/NoVmp NoVmp is a static devirtualizer that translates VMProtect x64 3.x-virtualized binaries into optimized VTIL intermediate code, optionally re… | 23 | 2206 | experimental |
| xoreaxeaxeax/skitter-creek-bath-salts A security research tool written in C that reprograms AMD Family 16h DRAM controller address translation registers to scramble physical mem… | 53 | 2066 | experimental |
| JSREI/ast-hook-for-js-RE A browser memory roaming tool for JavaScript reverse engineering that hooks variable assignments via AST-transformed proxy responses. It le… | 23 | 1911 | experimental |
| nmikhailov/Validity90 A reverse-engineering project for Validity/Synaptics fingerprint readers (USB IDs 138a:0090, 138a:0094, 138a:0097, 06cb:0081, 06cb:009a), p… | 32 | 1878 | experimental |
| codykociemba/NoLongerEvil-Thermostat No Longer Evil is a right-to-repair firmware and cloud replacement for bricked or sunset Nest Gen 1 and Gen 2 thermostats. It flashes modif… | 62 | 1869 | experimental |
| YimMenu/YimMenuV2 YimMenuV2 is an experimental mod menu (injected DLL) for GTA 5: Enhanced written in C++. It provides an in-game overlay menu for modifying … | 81 | 1762 | experimental |
| zeldaret/mm A work-in-progress from-scratch decompilation of The Legend of Zelda: Majora's Mask (N64 US 1.0), recreating readable C source code that bu… | 77 | 1754 | experimental |
| rexdex/recompiler A C++ tool that converts Xbox 360 PowerPC executables into native Windows x86 executables, handling CPU translation, endianness, and GPU em… | 32 | 1742 | experimental |
| JonathanSalwan/VMProtect-devirtualization An experimental research project demonstrating a dynamic approach to devirtualize pure functions protected by VMProtect 3.x using symbolic … | 32 | 1537 | experimental |
| opa334/darksword-kexploit A reimplementation of the DarkSword kernel exploit in Objective-C, targeting iOS 15.0 through 26.0.1. It is a security research artifact ba… | 45 | 1517 | experimental |
| patjak/facetimehd A reverse-engineered Linux kernel driver for the Facetime HD (Broadcom 1570) PCIe webcam found in newer MacBooks. It is written in C and li… | 90 | 1507 | experimental |
| whitequark/unfork unfork(2) is a proof-of-concept Linux technique and library that joins two process address spaces into one, the inverse of fork(2), by comb… | 32 | 1485 | experimental |
| iOS on QEMU A fork of QEMU that emulates an iPhone (iPhone 6s Plus) well enough to boot a fully functional iOS 12.1 system, including launchd, bash, SS… | 32 | 1460 | experimental |
| iPower/KasperskyHook A Windows research project that hooks system calls by loading Kaspersky's hypervisor driver (klhk.sys) and a custom kernel driver that subv… | 62 | 1324 | experimental |
| amimo/dcc DCC (Dex-to-C Compiler) is a method-based ahead-of-time compiler that translates Android DEX bytecode into C code compiled via the NDK. It … | 32 | 1317 | experimental |
| JuliaPoo/Artfuscator Artfuscator is a novelty C compiler built on ELVM that compiles C programs into a binary whose entire control flow graph renders as a chose… | 32 | 1105 | experimental |
| ZeroMemoryEx/Terminator Terminator is a C++ proof-of-concept tool that terminates EDR/XDR/antivirus processes on Windows by abusing the vulnerable, signed zam64.sy… | 20 | 1061 | experimental |
| apprenticeharper/DeDRM_tools A collection of Python scripts packaged as calibre plugins (DeDRM and Obok) that remove DRM from ebooks, covering Amazon, Adobe Digital Edi… | 23 | 15368 | abandoned |
| PowerShellMafia/PowerSploit PowerSploit is a collection of PowerShell modules for post-exploitation tasks during penetration tests, covering code execution, persistenc… | 10 | 13078 | abandoned |
| CodeTips/BaiduNetdiskPlugin-macOS A macOS plugin that patches the Baidu Netdisk client binary via dylib injection to fake SVIP status and remove local download speed limits.… | 10 | 8880 | abandoned |
| acheong08/EdgeGPT A Python library that reverse engineers Microsoft's Bing Chat (EdgeGPT) API, providing unofficial programmatic access to Bing AI conversati… | 10 | 7836 | abandoned |
| R3nzTheCodeGOD/R3nzSkin R3nzSkin is an internal skin changer for League of Legends that lets players change champion, ward, minion, and monster skins in-game via a… | 10 | 4862 | abandoned |
| qwerty472123/wxappUnpacker wxappUnpacker is a tool for unpacking and decompiling packaged WeChat mini-program (wxapkg) files back into readable source files such as w… | 10 | 4507 | abandoned |
| Proxmark3 The official (now archived) client software, FPGA logic, and design documentation for the Proxmark3, a general-purpose RFID tool that can s… | 46 | 3553 | abandoned |
| Il2CppInspector Il2CppInspector is an automated tool for reverse engineering Unity IL2CPP binaries, extracting type definitions, metadata and method pointe… | 23 | 3053 | abandoned |
| stefanesser/dumpdecrypted A dylib that, when injected via DYLD_INSERT_LIBRARIES into an encrypted iPhone application on a jailbroken device, dumps the decrypted Mach… | 32 | 3036 | abandoned |
| google/binnavi BinNavi is a binary analysis IDE for inspecting, navigating, editing, and annotating control-flow and call graphs of disassembled code, wit… | 10 | 2886 | abandoned |
| tostercx/GTAO_Booster_PoC A proof-of-concept DLL injection that patches two bugs in GTA Online to drastically reduce load times on CPU-bound systems. It was official… | 10 | 2868 | abandoned |
| rockbruno/swiftshield SwiftShield is a Swift obfuscator that renames types and methods in iOS projects using SourceKit to protect apps against reverse engineerin… | 23 | 2549 | abandoned |
| whoeevee/EeveeSpotifyReborn EeveeSpotifyReborn is a Swift-based tweak (successor to the DMCA-taken-down EeveeSpotify) that patches the Spotify iOS app to behave as if … | 10 | 2421 | abandoned |
| DrizzleRisk/drizzleDumper drizzleDumper is a memory-search-based Android unpacking tool that dumps DEX files from packed/protected Android apps. It runs as a command… | 32 | 2415 | abandoned |
| grishka/Houseclub An unofficial, barebones Android client for the Clubhouse social audio app, built in Java as a proof of concept using a reverse-engineered … | 23 | 2311 | abandoned |
| Dustcloud A research project for reverse engineering and rooting Xiaomi Smart Home devices, including robot vacuums, providing methods to root device… | 23 | 2283 | abandoned |
| 8enet/Charles-Crack A repository that provided a crack/patch to bypass licensing of Charles Proxy, an HTTP debugging proxy tool. The repository content was rem… | 32 | 2149 | abandoned |
| Hikari Obfuscator Hikari is an LLVM-based code obfuscator that transforms compiled binaries with techniques like string encryption, indirect branching, funct… | 10 | 2103 | abandoned |
| google/rekall Rekall is a Python-based memory forensic framework for extracting and analyzing digital artifacts from physical memory images of Windows, L… | 10 | 2006 | abandoned |
| XcodeGhostSource/XcodeGhost The published source code of XcodeGhost, the infamous 2015 malware that spread through a compromised Xcode build configuration and infected… | 32 | 1923 | abandoned |
| JuncoJet/unlimited-landeng-for-win A Windows patcher/injector for the Lantern proxy client that modifies its PE structure or loads it via an injector to unlock paid/pro limit… | 32 | 1907 | abandoned |
| Gh0u1L5/WechatMagician WechatMagician is an open-source Xposed module written in Kotlin that hooks into the WeChat app to give users full control over chat messag… | 23 | 1894 | abandoned |
| TKkk-iOSer/WeChatPlugin-iOS A jailbreak tweak (dylib) for the WeChat iOS app, built with Theos in Objective-C. It patches WeChat's runtime behavior to add unofficial f… | 32 | 1862 | abandoned |
| Direct Memory Access — CS2 DMA A C++ framework demonstrating Direct Memory Access (DMA) interaction with Counter-Strike 2, covering memory reading, entity-state parsing, … | 63 | 1852 | abandoned |
| kpwn/yalu102 Yalu102 is an incomplete, work-in-progress jailbreak for 64-bit iOS devices running iOS 10.0 through 10.2, created by qwertyoruiopz and mar… | 32 | 1763 | abandoned |
| Xposed-Modules-Repo/com.bug.hookvip An Xposed module for Android that hooks into apps to unlock certain VIP/membership features and extend functionality. The repository has be… | 10 | 1760 | abandoned |
| Gh0u1L5/WechatSpellbook An open-source WeChat plugin framework written in Kotlin that sits on top of hooking frameworks like Xposed or VirtualXposed. It exposes a … | 32 | 1732 | abandoned |
| Cisco-Talos/pyrebox PyREBox is a Python-scriptable reverse engineering sandbox built on QEMU that provides whole-system dynamic analysis and debugging of runni… | 10 | 1685 | abandoned |
| chaitin/passionfruit Passionfruit is a web-based GUI tool for blackbox assessment of iOS apps, built on the Frida instrumentation framework and Vue.js. It lets … | 10 | 1668 | abandoned |
| asLody/legend Legend is a Java method hooking framework for Android that works without root access, supporting both Dalvik and ART runtimes. It lets deve… | 32 | 1606 | abandoned |
| Viper Viper is a Python-based binary analysis and management framework for organizing collections of malware and exploit samples along with analy… | 10 | 1561 | abandoned |
| sailro/Reflexil Reflexil is a .NET assembly editor that runs as a plugin for Reflector, ILSpy, and JustDecompile. Built on Mono.Cecil, it can manipulate IL… | 10 | 1529 | abandoned |
| hteso/iaito Iaitō is a Qt and C++ graphical user interface for the radare2 reverse engineering framework, aimed at users who find radare2's CLI too dif… | 32 | 1461 | abandoned |
| kennytm/iphone-private-frameworks A collection of C headers for private frameworks and undocumented interfaces of iPhoneOS 3.x and earlier, used for jailbroken iOS tweak dev… | 10 | 1460 | abandoned |
| das-labor/panopticon Panopticon is a libre, cross-platform disassembler written in Rust for reverse engineering binaries. It supports AMD64, x86, AVR, and MOS 6… | 10 | 1447 | abandoned |
| xmoezzz/KrkrExtract KrkrExtract is a Windows tool for extracting and repacking XP3 archive files used by the Kirikiri (krkr2/krkrz) visual novel game engine, s… | 10 | 1427 | abandoned |
| RaduMC/AssetStudio AssetStudio is a standalone Windows GUI tool for exploring, previewing, and extracting assets from Unity game files and bundles. It can exp… | 23 | 1422 | abandoned |
| Plutoberth/SonyHeadphonesClient A cross-platform desktop client that replicates the mobile-only Sony Headphones app, allowing control of Sony noise-cancelling headphones (… | 10 | 1365 | abandoned |
| zyq8709/DexHunter DexHunter is an automatic unpacking tool for Android Dex files protected by app-hardening services. It works by replacing the ART and DVM r… | 32 | 1358 | abandoned |
| szdc/tiktok-api An unofficial, reverse-engineered TypeScript API wrapper for TikTok (formerly Musical.ly), published as the npm package tiktok-api. It lets… | 10 | 1292 | abandoned |
| crmulliner/adbi ADBI is a dynamic binary instrumentation toolkit for Android ARM and Thumb binaries, based on library injection and inline hooking of funct… | 32 | 1267 | abandoned |
| samyk/usbdriveby USBdriveby is an Arduino/Teensy microcontroller project that emulates a USB HID keyboard and mouse to covertly install a backdoor, evade fi… | 32 | 1265 | abandoned |
| tomer8007/widevine-l3-decryptor A Chrome extension that demonstrated bypassing Widevine L3 DRM by hijacking Encrypted Media Extensions calls to extract content decryption … | 10 | 1246 | abandoned |
| optiv/Mangle Mangle is a Go-based CLI tool that manipulates compiled Windows executables (.exe and DLL) to evade EDR detection. It strips known indicato… | 10 | 1233 | abandoned |
| hfiref0x/TDL TDL is a Windows x64 driver loader that bypasses Driver Signature Enforcement by exploiting a VirtualBox kernel vulnerability to map specia… | 10 | 1231 | abandoned |
| wibus-wee/InjectGUI InjectGUI is a macOS graphical application that wraps the QiuChenly InjectLib framework for injecting dylibs into macOS applications, handl… | 10 | 1219 | abandoned |
| jacopotediosi/GAppsMod GAppsMod is a root-required Android application that tweaks Google apps (like Phone and Messages) by modifying the Phenotype DB flags manag… | 10 | 1212 | abandoned |
| transitive-bullshit/bing-chat A Node.js/TypeScript client library wrapping Bing Chat's unofficial, reverse-engineered API, supporting conversations, streaming responses,… | 10 | 1203 | abandoned |
| leo9960/wechat-app-unpack A JavaScript tool and write-up for unpacking WeChat Mini Program .wxapkg packages, restoring source files like app-config., app-service.js,… | 32 | 1166 | abandoned |
| riverar/mach2 Mach2 is a Windows command-line multi-tool for managing the Windows Feature Store, allowing users to discover, enable, disable, and revert … | 10 | 1118 | abandoned |
| yulingtianxia/FishChat FishChat is an Objective-C hooking project that injects a dylib into a decrypted WeChat.app binary to modify its behavior on non-jailbroken… | 10 | 1102 | abandoned |
| okcar-os/android OkcarOS is an open-source Android 13-based ROM (built on LineageOS) that lets an Android smartphone act as a CarPlay device, streaming audi… | 66 | 1079 | abandoned |
| EquiFox/KsDumper KsDumper is a Windows tool that dumps process memory (including protected processes with stripped handles) using a kernel driver, rebuildin… | 23 | 1061 | abandoned |
| AsahiLinux/gpu Research repository for reverse-engineering the Apple M1 GPU to build an open-source 3D graphics stack, including a Metal API interception … | 10 | 1050 | abandoned |
| denandz/KeeFarce KeeFarce is a security tool that extracts passwords and other cleartext data from a running KeePass 2.x process by injecting a DLL into its… | 32 | 1030 | abandoned |
| halfkiss/ZjDroid ZjDroid is an Xposed framework module for dynamic reverse engineering of Android apps. It supports memory dumping of DEX files, BackSmali d… | 32 | 1021 | abandoned |
| ba0gu0/520apkhook A Java-based tool that attaches an Android remote-access APK payload to a legitimate app, producing a trojanized APK where the original app… | 32 | 1014 | abandoned |
| qwqdanchun/DcRat DcRat is an open-source remote administration tool (RAT) written in C# for Windows, providing remote desktop, file management, and remote c… | 10 | 1011 | abandoned |
| imengyu/JiYuTrainer A portable Windows desktop utility that counters the JiYu (极域) Electronic Classroom management software used in Chinese school computer lab… | 10 | 1011 | abandoned |
| lucasg/Dependencies A modern open-source rewrite of the legacy Dependency Walker (depends.exe) tool, written in C#, for analyzing Windows DLL load dependencies… | 23 | 11909 | stable |
| majd/ipatool A command-line tool written in Go that lets users search the iOS App Store and download app packages (ipa files) using their Apple ID. It s… | 100 | 11795 | active |
| firerpa/lamda FIRERPA (lamda) is an all-in-one Android device control platform whose server runs directly on the device (root or non-root) and exposes 16… | 98 | 8593 | active |
| AidLux (AidLearning) AidLux (originally AidLearning) is an AIoT development platform that runs a native Ubuntu Linux environment with GUI, deep learning tooling… | 63 | 5812 | active |
| Kaitai Struct Kaitai Struct is a declarative language for describing binary data structures (file formats, network packet layouts) in .ksy files. A compi… | 77 | 4715 | active |
| Mouseww/anything-analyzer An Electron-based all-in-one protocol analysis toolkit that captures HTTP(S) traffic from browsers, desktop apps, terminals, scripts, and m… | 77 | 3734 | active |
| HanaokaYuzu/Gemini-API A reverse-engineered asynchronous Python client library for Google's Gemini web app (formerly Bard), published as gemini-webapi on PyPI. It… | 90 | 3597 | active |
| jehna/humanify A Rust CLI tool that unminifies and deobfuscates JavaScript by using LLMs (OpenAI, Anthropic, Gemini, OpenRouter, or local Ollama) to sugge… | 83 | 3288 | active |
| ttttupup/wxhelper wxhelper is a C++ DLL that hooks the Windows PC WeChat client, exposing its internal functions through a local HTTP server (default port 19… | 58 | 3164 | active |