Azeria Labs
ARM assembly tutorials with exercises for learning registers, memory, and calling conventions.
In 2 lists
ARM assembly tutorials with exercises for learning registers, memory, and calling conventions.
Awesome Reverse Engineering
Curated reverse-engineering tools and learning resources for binaries, apps, firmware, formats, and protocols.
This page lists names, links and short descriptions. The original list on GitHub is the source and belongs to its authors.
Learning
Compiler Explorer
Compiles code in the browser with many compilers and shows the generated assembly, for seeing how source constructs and optimization levels translate to machine code.
In 5 listsDetails
Corkami
Visual references and posters explaining binary formats and file structures, including executable-format layouts.
In 2 lists
Corkami PoCs
Minimal and unusual executable and document samples for studying file-format edge cases and parser behavior.
Hextree
Hands-on mobile and hardware reverse-engineering courses and interactive labs; Commercial, with some free content.
Malware Analysis Training
Windows malware-analysis course with programming, Windows-internals, and reversing exercises; labs need a suitable Windows analysis environment.
Malware Unicorn RE101
Introductory Windows malware-reversing workshop covering x86 assembly, triage, and debugging; its VM-based lab instructions use older software images.
In 2 lists
Nightmare
Course built from annotated CTF challenges, progressing from assembly and reversing basics to binary exploitation.
OpenSecurityTraining2
Structured courses in assembly, architecture, debugging, and reverse engineering.
pwn.college
Free courses with hands-on challenges in Linux, assembly, reverse engineering, and binary exploitation, run in a browser-accessible environment.
In 2 lists
Reverse Engineering by Kevin Thomas
Annotated assembly and reverse-engineering lessons across x86, x64, ARM, AVR, and RISC-V, with lesson-specific toolchain and hardware requirements.
In 4 lists
Reverse Engineering for Beginners
Free book connecting compiled C and C++ examples to assembly across several architectures.
In 3 lists
RPISEC Modern Binary Exploitation
Course materials and labs covering reverse engineering, memory corruption, and exploitation; no commits since December 2021, so labs may need older toolchains.
In 7 listsDetails
Learning >Books
Hacking the Xbox
Introduction to hardware reverse engineering through the original Xbox's security design; free PDF edition released by the author.
Practical Binary Analysis
Covers ELF and PE internals, disassembly, binary instrumentation, taint analysis, and symbolic execution, with tools built in the exercises.
In 2 lists
Practical Malware Analysis
Hands-on introduction to static and dynamic Windows malware analysis with lab exercises; published in 2012, so some tooling chapters are dated.
The Ghidra Book
Guide to Ghidra's disassembler, decompiler, scripting, and extension APIs; the 2026 second edition covers BSim and PyGhidra.
In 2 lists
File identification and triage
capa
Identifies capabilities in executable files using rules over static or dynamic analysis results.
In 5 listsDetails
checksec
Checks ELF security properties such as PIE, RELRO, stack canaries, and non-executable stacks; mitigation flags are not a vulnerability verdict.
Detect It Easy
Identifies executable formats, compilers, packers, and other file characteristics.
In 5 listsDetails
FLOSS
Recovers obfuscated strings, including strings constructed on the stack.
In 2 lists
hexvero
Statically triages Electron archives and JavaScript bundles for IPC channels, preload bridges, and window settings, plus ELF/Mach-O/PE imports and hardening; its CLI, MCP server, and local web UI require Node.js 22.12+, and pattern-based JavaScript analysis can miss indirect code.
LIEF
Parses and modifies executable formats such as PE, ELF, and Mach-O from code.
In 3 lists
Malcat
Hex editor and disassembler for triaging unknown files, with 50+ format parsers, embedded-file extraction, YARA scanning, and Python scripting. Commercial, with a free Lite edition for non-professional use.
In 3 lists
PE-bear
Graphical PE viewer and editor for a quick first look at headers, sections, imports, and resources, including malformed files.
In 3 lists
pestudio
Flags suspicious imports, strings, resources, and other indicators in Windows executables for initial assessment. Commercial, with a free basic edition for private use.
In 3 lists
Native analysis
Binary Ninja
Interactive disassembler and decompiler with intermediate representations and scripting APIs. Commercial, with a free edition.
In 5 listsDetails
Decompiler Explorer
Web service that runs an uploaded binary through several decompilers and shows their output side by side.
In 2 lists
Ghidra
Disassembly, decompilation, scripting, and headless analysis for native binaries.
In 9 listsDetails
IDA
Interactive disassembler and decompiler with processor modules and a plugin ecosystem. Commercial, with a free edition.
In 2 lists
radare2
Command-line toolkit for disassembly, binary inspection, debugging, and scripting.
In 5 listsDetails
REDasm
Native disassembler and analysis GUI with legacy-format support; Windows and Linux are the primary tested hosts, while other platform builds have lower support tiers.
RetDec
Retargetable LLVM-based decompiler for ELF, PE, Mach-O, and other formats; in limited maintenance mode, with little new development.
In 4 lists
rev.ng
LLVM- and QEMU-based binary-analysis framework and decompiler for inspecting and transforming native code; source builds need its documented toolchain.
Rizin
Reverse-engineering framework with command-line analysis and reusable libraries.
In 3 lists
Rubber Room
Browser PE workbench with x86-64 disassembly, partial Win32 API emulation and experimental C-like pseudocode that may omit program logic; alpha.
In 2 lists
Debuggers
GDB
Native debugger with scripting and remote-debugging support.
GEF
Single-file GDB extension that adds context views, heap inspection, and commands for exploit development and binary analysis.
In 4 lists
LLDB
LLVM debugger for native programs, including macOS and iOS development workflows.
In 3 lists
pwndbg
Debugger extensions for inspecting memory, assembly, and runtime state during binary analysis.
In 5 listsDetails
rr
Records and replays Linux process execution for repeatable debugging.
In 3 lists
WinDbg
Microsoft debugger for Windows user-mode and kernel debugging, crash dump analysis, and Time Travel Debugging; version 1.2610.1001.0 and later include the official WinDbg MCP server.
Dynamic instrumentation and tracing
bpftrace
Linux eBPF tracing language for observing kernel and user-space functions; available probes and permissions depend on the host kernel.
In 3 lists
DynamoRIO
Dynamic binary instrumentation platform for building tools that observe or modify instructions at runtime, with bundled tracing and memory-checking tools.
In 2 lists
Frida
Injects scripts into running processes to trace calls, inspect data, and change behavior.
In 5 listsDetails
Intel Pin
Dynamic binary instrumentation framework for writing analysis tools for x86 and x86-64 programs on Linux and Windows; closed source, free for any use.
In 2 lists
QBDI
LLVM-based dynamic binary instrumentation framework for x86, x86-64, ARM, and AArch64, with C, C++, and Python APIs and Frida integration.
r2frida
radare2 plugin for Frida-backed process inspection and instrumentation; requires a compatible radare2 build and a working Frida session with the target.
In 2 lists
strace
Linux system-call tracer for inspecting process I/O, signals, syscall arguments, and return values.
In 2 lists
Sysinternals Suite
Microsoft utilities, including Process Monitor, Process Explorer, and Autoruns, for observing process, file, registry, and network activity on Windows.
System Informer
Windows 10+ process and system inspector for handles, memory, services, and related kernel information; some views require elevated access.
In 3 lists
TinyTracer
Intel Pin tool for tracing execution and selected function or API calls; use the documented platform build and a matching Pin kit.
In 2 lists
uftrace
Linux function-call tracer for C/C++, Rust, and Python, with call graphs and timing data; native-code coverage depends on instrumentation or supported dynamic tracing.
In 2 lists
Deobfuscation and anti-analysis
Al-Khaser
Windows proof-of-concept suite for exercising anti-debugging, anti-VM, anti-hooking, and other analysis-environment checks.
In 2 lists
de4dot
.NET deobfuscator and unpacker for assemblies protected by common obfuscators; archived in 2020 and no longer updated.
HollowsHunter
Windows process scanner using PE-sieve to find and dump injected or modified code across running processes; findings require manual investigation.
In 5 listsDetails
PE-sieve
Scans a running process for injected or modified code, such as hollowed modules, hooks, and shellcode, and dumps what it finds.
In 4 lists
Scylla
Windows x86/x64 import-table reconstruction tool for dumped PE files; upstream documents older Windows versions, so current-host compatibility needs checking.
In 2 lists
ScyllaHide
Windows x86/x64 user-mode anti-anti-debugging library with x64dbg, OllyDbg, and IDA integrations; debugger and plugin versions must match.
In 4 lists
Malware analysis
CAPE Sandbox
Automated sandbox derived from Cuckoo that runs samples in virtual machines and records behavior, unpacked payloads, and malware configurations.
In 4 lists
Didier Stevens Suite
Python utilities for inspecting PDF, OLE, scripts, and other suspicious document inputs; dependencies and input support vary by script.
In 4 lists
Dumpulator
Emulates selected user-mode code from Windows minidumps for tasks such as string decryption and unpacking; dump completeness and supported execution context limit what can run.
In 2 lists
FakeNet-NG
Intercepts traffic and emulates network services for dynamic analysis; supports Windows and selected Linux modes, with platform-specific setup and traffic-redirection privileges.
In 3 lists
FLARE-VM
Installation scripts that turn a Windows virtual machine into a malware-analysis and reverse-engineering workstation.
In 4 lists
Malduck
Python library of cryptography, compression, and memory-model helpers with a YARA-driven framework for writing your own malware configuration extractors; it does not ship family extractors.
MemProcFS
Exposes memory dumps and live memory as a virtual file system and Python, C, and Rust APIs, with process and forensic views for Windows targets; mounting requires Dokany, FUSE, or macFUSE.
In 4 lists
mwemu
Emulates x86/x64 and AArch64 code for PE, ELF, and Mach-O investigations, with Windows API models and kernel-driver memory-lifetime checks; Windows-focused, with growing Linux/macOS support and Rust 1.95+ required to build the reviewed source.
oletools
Python tools for inspecting Office, OLE, and RTF files and extracting macros, embedded objects, and other document artifacts.
In 2 lists
REMnux
Linux toolkit for analyzing malicious executables, documents, scripts, and network traffic, available as a virtual machine, container, or installer.
In 7 listsDetails
Speakeasy
Windows emulation framework for PE files, drivers, and shellcode that produces API reports within a modeled runtime.
In 2 lists
Volatility 3
Memory forensics framework for extracting processes, modules, network connections, and other artifacts from memory images.
In 5 listsDetails
YARA
Identifies and classifies files with rules over strings, byte patterns, and file properties; in maintenance mode, with YARA-X as its successor.
In 5 listsDetails
YARA-X
Rust-based rule-scanning engine with CLI and language bindings; check its documented differences before migrating YARA rules.
Android and managed code
Androguard
Python tooling for analyzing Android applications, bytecode, and call relationships.
In 4 lists
AsmResolver
Library for reading, modifying, and rebuilding native and managed PE files, including .NET metadata and application bundles.
CFR
Java class and JAR decompiler for inspecting managed code; requires a Java runtime, and language-feature compatibility varies by input and release.
In 2 lists
dnSpyEx
.NET debugger and assembly editor maintained as a continuation of dnSpy.
In 2 lists
ILSpy
.NET assembly browser and decompiler with GUI and command-line interfaces.
In 4 lists
JADX
Android DEX decompiler with code navigation and search in a graphical interface or CLI.
In 10 listsDetails
JEB
Android decompiler and analysis platform with edition-dependent native analysis and official MCP capabilities that vary by version; commercial.
In 2 lists
Medusa
Frida-based modular mobile runtime-analysis framework; documented hosts are Linux and macOS, with limited Windows functionality and target-side instrumentation prerequisites.
MobSF
Automated static and dynamic analysis of Android, iOS, and Windows mobile apps, with a web interface and REST API.
In 8 listsDetails
OWASP MASTG
Mobile security testing guidance with Android and iOS reverse-engineering techniques.
Recaf
Java bytecode analysis and editing environment.
In 4 lists
Vineflower
Java decompiler focused on modern language features and readable output; requires Java 17 or newer to run current releases.
In 3 lists
iOS and macOS
class-dump
Generates Objective-C headers from Mach-O binaries; unmaintained since 2019 and without Swift support, so ipsw class-dump is a maintained alternative.
Hopper
macOS disassembler and decompiler with Objective-C and Swift support, LLDB and GDB debugging, and scripting. Commercial, with a free demo.
In 7 listsDetails
ipsw
Command-line toolkit for downloading and examining iOS and macOS firmware, dyld shared caches, kernelcaches, and Mach-O binaries.
LLDB scripts by Derek Selander
LLDB commands, aliases, and Python helpers for Apple-platform investigations; individual scripts have architecture and debugger-version limits.
objection
Frida-based toolkit for exploring iOS and Android apps at runtime, including class inspection, method hooking, and certificate-pinning bypass.
In 7 listsDetails
pymobiledevice3
CLI and Python API for iOS device services, including logs, crash reports, packet capture, and developer tooling with version-dependent tunnel requirements.
Language runtimes and packagers
Blutter
Flutter AOT analysis tool for recent Android arm64 libapp.so files, producing annotated assembly, object-pool dumps, and Frida templates.
In 2 lists
GoReSym
Recovers function names, types, and build metadata from Go binaries, including stripped ones.
In 2 lists
Heimdall
EVM bytecode-analysis toolkit for disassembly, decompilation, and contract inspection; inferred source, types, and signatures require validation.
hermes-dec
Parses, disassembles, and decompiles React Native Hermes bytecode into register-based pseudo-code with incomplete JavaScript semantics; HBC 98 and 99 load with an unsupported-version warning.
In 2 lists
Hermit
Interactive toolkit for inspecting, disassembling, decompiling, and structurally patching React Native Hermes bytecode; supports HBC 94, 95, and 96, with HBC 98 unsupported.
In 2 lists
pycdc
Disassembles and decompiles Python bytecode from .pyc files; decompilation of recent Python versions can be incomplete.
In 2 lists
pyinstxtractor
Extracts the contents of PyInstaller executables, including the bytecode needed for decompilation; the pyinstxtractor-ng fork uses xdis so the host Python need not match the build version and supports PyInstaller archive decryption when the embedded key can be recovered, but neither tool…
In 3 lists
PyLingual
Model-assisted CPython 3.6+ bytecode decompiler that recompiles its output and flags mismatched code objects for manual review; requires Python 3.12+ to run and downloads large per-version models.
r2flutter
radare2 plugin and CLI for recovering Dart AOT snapshot metadata from Flutter binaries; requires radare2 6.2.2+, primarily targets AArch64, and depends on snapshot layout.
Redress
Recovers compiler metadata, packages, types, and symbols from stripped Go executables; target Go-version compatibility depends on the selected release and GoRE parser.
In 2 lists
reFlutter
Flutter mobile-analysis framework that instruments matching engine builds and produces method or type information; Android/iOS architecture and engine-version support varies.
WhatsABI
TypeScript library for inferring Ethereum ABI entries and resolving proxy metadata from bytecode; inferred signatures and types are not original-source recovery.
Web and protocols
boofuzz
Python framework for describing a protocol's message fields and sending mutated messages to a target, useful for testing a reconstructed protocol against a live service; crash detection needs a process monitor or restart callback.
In 6 listsDetails
Burp Suite
Intercepting proxy and toolkit for inspecting, replaying, and modifying HTTP and WebSocket traffic. Commercial, with a free Community Edition.
In 11 listsLink may be dead
Chrome DevTools
Browser tools for stepping through JavaScript, inspecting network requests, and examining runtime state.
HTTP Toolkit
Intercepts and inspects HTTP(S) traffic from browsers, desktop applications, Android devices, and containers with automated interception setup. Commercial, with a free open-source edition.
In 2 lists
mitmproxy
Intercepts, inspects, and modifies HTTP traffic with interactive tools and Python scripts.
In 11 listsDetails
Netzob
Python protocol-inference library for exploring fields, messages, and state models from captures; installation needs native dependencies and the documented Python environment.
In 2 lists
Protobuf Decoder
Web application that decodes Protobuf messages without a schema and shows field numbers, wire types, and possible value interpretations.
Scapy
Python packet framework for dissecting and constructing protocols, reading PCAPs, and scripting network experiments.
In 9 listsDetails
WABT
WebAssembly utilities for converting, inspecting, validating, and decompiling modules.
In 6 listsDetails
wasm-tools
Bytecode Alliance tools for inspecting, validating, and transforming WebAssembly modules, components, and WIT interfaces.
webcrack
Deobfuscates JavaScript and unpacks common bundler output to make code easier to inspect.
Firmware and hardware
avatar2
Coordinates debuggers, emulators, and physical targets for embedded analysis; each endpoint needs its own compatible backend and any associated hardware.
In 2 lists
ChipWhisperer
Hardware and Python tooling for side-channel power analysis and fault-injection experiments; live capture and glitching require compatible capture and target hardware.
In 2 lists
EMBA
Firmware security analyzer that extracts images, runs static and emulation-based checks, and produces reports and SBOMs.
In 2 lists
esptool
Serial bootloader utility for reading or flashing Espressif devices, with offline image-info inspection of firmware headers, segments, checksums, and SHA-256 hashes; requires Python 3.10+, and 5.6.0 returns exit code 0 for checksum/hash mismatches.
In 2 lists
Facedancer
Python USB device-emulation and proxy framework for compatible hardware on GNU/Linux; 3.x does not support legacy scripts and backend capabilities vary.
FACT
Linux firmware extraction, analysis, and comparison platform; the native installer has specific distribution and Python requirements, while the separate Docker route is unmaintained.
In 2 lists
FirmAE
Emulates Linux-based router and IP camera firmware for dynamic analysis, using heuristics that make full-system emulation succeed more often.
In 3 lists
flashrom
Reads, writes, and verifies flash chips through supported programmers, for dumping or restoring firmware from hardware.
Glasgow Interface Explorer
Programmable hardware interface explorer with applets for probing and interacting with digital buses; requires Glasgow hardware.
In 2 lists
HALucinator
Firmware-rehosting framework that replaces selected hardware-abstraction-layer calls with models; requires its emulation toolchain and target-specific handlers or configuration.
OFRAK
Framework for unpacking, analyzing, modifying, and repacking binary artifacts.
OpenOCD
Connects to hardware debug interfaces for on-chip debugging and flash access.
In 2 lists
Packetry
USB 2.0 protocol analyzer for Cynthion captures and offline PCAP files using the LINKTYPE_USB_2_0 format.
In 2 lists
Proxmark3
RFID and NFC research client and firmware for compatible Proxmark3 hardware; client, firmware, and device variants need to match.
In 3 lists
QEMU
Machine emulator for running firmware and programs built for other architectures, with a GDB stub for debugging.
In 11 listsDetails
Renode
Embedded-system simulator with scriptable platform and peripheral models for repeatable firmware debugging and observation.
In 3 lists
ripcord
Ghidra-based firmware-analysis pipeline producing queryable Parquet tables for DuckDB; requires Ghidra 11.2+ with PyGhidra and Python 3.11+, with optional simulation tooling.
sigrok
Signal analysis tools and protocol decoders for logic analyzers and related hardware.
UEFITool
Parses UEFI firmware structures and extracts or replaces modules.
In 3 lists
unblob
Extracts nested archives, compressed data, and filesystem images from firmware and other files.
In 2 lists
usb-rea
Infers USB protocol fields, counters, checksums, and multi-packet commands from captures of labelled actions, with frame-number evidence, and generates pyusb driver code and Wireshark Lua dissectors; requires Python 3.10+, with usbmon plus dumpcap/tshark on Linux or USBPcap on Windows for capture,…
File formats
010 Editor
Hex editor with binary templates for inspecting structured files. Commercial.
Construct
Declarative Python library for parsing and building binary formats with composable schemas and validation.
CyberChef
Browser-based workbench for decoding, decompressing, and transforming data with exportable recipes.
In 6 listsDetails
Hex Fiend
macOS hex editor for inspecting and editing large binary files, with binary templates and an embeddable framework.
Hex Harbinger
Browser hex editor that overlays structure templates for PE, ELF, Mach-O and ZIP files and highlights the parsed fields; alpha.
ImHex
Hex editor with a pattern language for describing and exploring binary structures.
In 5 listsDetails
Kaitai Struct
Describes binary formats declaratively and generates parsers in multiple languages.
In 2 lists
Struct Smith
Browser editor for Spec binary-format schemas, with a live parse tree, byte highlighting and diagnostics; alpha, with a 64 MiB input limit.
Game reverse engineering
AssetRipper
Unity asset-analysis and export tool with version-dependent support and additional paid Premium features.
In 3 lists
Cheat Engine
Memory scanner, debugger, and disassembler for finding and changing values in running processes, mainly used for game and application modding.
In 3 lists
Cpp2IL
Recovers types, methods, and IL from Unity IL2CPP builds into .NET assemblies and other outputs; described by its author as work in progress.
In 2 lists
FModel
Windows x64 GUI for inspecting and extracting Unreal Engine game archives and assets; title-specific mappings, versions, or encryption keys may be needed.
GDRE Tools
Recovers Godot projects from exported games, including PCK extraction, GDScript decompilation, and resource conversion.
In 2 lists
Il2CppDumper
Restores Unity IL2CPP type and method metadata for use in IDA, Ghidra, and other tools; no commits since July 2024, with Cpp2IL as a maintained alternative.
In 4 lists
ReClass.NET
Interactive process-memory structure editor for Windows and Linux; upstream documents Linux support tested on Ubuntu 18.04, rather than current-distribution validation.
In 3 lists
Source 2 Viewer
Parser, decompiler, exporter, and Windows viewer for Valve Source 2 resources and VPK archives; format coverage and export fidelity vary by resource type.
UModel
Unreal Engine package viewer and asset exporter for Windows and Linux; game/version compatibility varies, and the official site leaves licensing undetermined.
vgmstream
Library and command-line tools for decoding proprietary game-audio streams; supported formats, codec dependencies, and player integrations vary.
In 2 lists
Binary diffing and patch analysis
BinDiff
Compares disassembled binaries to identify similar functions and changes between builds; inputs come from the BinExport exporters for IDA Pro, Ghidra, and Binary Ninja; the current IDA plugin source requires IDA Pro 9.4+, while the 2024 release documents IDA SDK 8.0+ for building that plugin.
Binlex
Binary-feature analysis framework with CLI and language bindings for similarity and corpus investigation; build and plugin dependencies vary by interface.
In 3 lists
Diaphora
Binary diffing plugin for comparing functions and transferring analysis in IDA.
In 3 lists
ghidriff
Ghidra-based command-line binary diffing engine with JSON, Markdown, and optional HTML reports; requires compatible Ghidra, PyGhidra, and JDK versions.
In 4 lists
Symbolic execution and formal analysis
angr
Python framework for symbolic execution and program analysis; angr-management is its official GUI front end, not a separate analysis engine.
In 7 listsDetails
BINSEC
Binary-analysis platform combining symbolic execution, abstract interpretation, and SMT solving; source builds require OCaml and compatible solver/backend dependencies.
In 2 lists
flare-emu
Archived Unicorn-based emulation helper for IDA Pro, Rizin, and radare2 scripting; analysis-host APIs and Python bindings must match the archived source.
KLEE
LLVM-bitcode symbolic-execution engine for generating test inputs and finding assertion violations; requires a compatible compiler/runtime setup and does not imply proof from an incomplete run.
Miasm
Python reverse-engineering framework with an intermediate representation, emulation, symbolic execution, and assemblers and disassemblers for several architectures.
In 3 lists
PANDA
QEMU-based whole-system record/replay and analysis framework with taint-analysis plugins; analysis depends on supported guest architectures, recordings, and matching plugins.
In 5 listsDetails
Qiling
Emulates binaries with operating-system services for scripted runtime analysis.
In 2 lists
S2E
Selective symbolic-execution platform for analyzing programs across OS boundaries; requires a supported Linux host, the S2E toolchain, and prepared guest images.
In 2 lists
Triton
Dynamic binary analysis library with symbolic execution, taint analysis, and AST representations of instruction semantics, usable from C++ or Python.
In 5 listsDetails
Unicorn
CPU emulation library for executing and instrumenting machine code across architectures.
In 3 lists
Z3
SMT solver with command-line and language APIs for expressing and solving analysis constraints; satisfiability results depend on the model and solver outcome, including possible unknown results.
In 4 lists
Instruction lifting and semantics
BAP
Binary-analysis platform for lifting native code into an intermediate language and running analyses; source installation uses OCaml/opam and a compatible LLVM toolchain.
In 4 lists
Capstone
Multi-architecture disassembly library for building analysis tools.
In 2 lists
Keystone
Multi-architecture assembler library, the counterpart to Capstone, for turning assembly text into machine code when patching binaries or building test inputs; GPL-2.0 with a separate commercial license, and the latest PyPI release (0.9.2, 2020) ships wheels only for x86 and x86-64 hosts.
Remill
Library for lifting supported machine instructions into LLVM bitcode; requires compatible LLVM and build dependencies, with Windows support documented as experimental.
Zydis
x86/x86-64 instruction decoding and encoding library for building analysis tools; source builds use CMake or the documented Visual Studio project.
In 2 lists
AI-assisted analysis
Binary Ninja MCP Server
Built-in Binary Ninja server that exposes functions, symbols, strings, disassembly, IL, and decompiled code to MCP clients; the headless variant requires a Commercial or Ultimate license.
Chrome DevTools MCP
Official MCP server for inspecting Chrome network activity, runtime state, console output, and performance traces; requires Node.js LTS and Chrome.
In 5 listsDetails
Dex Explore by Exmergo
Read-only database-exploration skill that profiles columns, infers candidate keys and row grain, and probes candidate joins; PII flags are heuristic, and execution requires uv and Python 3.11+.
In 9 listsDetails
Gepetto
IDA plugin that asks language models to explain decompiled functions and rename their variables; requires IDA 7.6 or later and access to a supported model provider.
In 4 listsDetails
Ghidra MCP Server
Connects AI clients to Ghidra analysis through MCP.
In 3 lists
GhidraMCP
Ghidra plugin and MCP server for decompiling, listing, and renaming functions and data; the original project from which Ghidra MCP Server was derived.
In 3 lists
Hex-Rays IDA MCP
Official IDA MCP server for agent access to binary analysis; requires IDA 9.4+ with idalib, Python 3.11+, and uv, with IDA licensing separate from the server.
IDA Pro MCP
Exposes IDA analysis and scripting capabilities to MCP clients; requires a compatible IDA installation.
In 4 listsDetails
JADX-AI-MCP
Connects AI clients to JADX for Android application analysis.
OpenDeviceDB
Experimental device-support registry with an MCP server for finding upstream protocol and firmware projects by model, FCC ID, or USB vid:pid; the npm server requires Node.js 20+, imported record quality varies, and claims/findings require a local checkout and pull request for public inclusion.
radare2 MCP
Provides an MCP interface to radare2 for agent-driven binary analysis.
re-audit
Statically audits ELF/PE/Mach-O binaries and Android APKs for missing exploit mitigations (NX, PIE/ASLR, RELRO, stack canary), hardcoded secrets, and risky exported components; runs as a CLI or MCP server with no network access and no execution of the target. Findings are heuristic candidates for…
RES
Experimental agent skill for documenting a SaaS web app's screens, business rules, data model, API shapes, and design tokens through the browser, with sandbox and change-ledger guidance; requires a browser-driving agent and Node.js 22+.
WinDbg MCP
Official MCP server built into WinDbg 1.2610.1001.0 and later; supported clients are VS Code with GitHub Copilot and GitHub Copilot CLI, with one active MCP client per WinDbg session.
Practice and communities
crackmes.one
Practice binaries organized by platform, architecture, and difficulty.
In 2 lists
FLARE-On
Annual reverse-engineering challenge series with previous challenges and solutions.
Microcorruption
Browser-based embedded security CTF in which you reverse and exploit firmware for simulated MSP430 lock devices with a built-in debugger.
In 4 lists
OALabs
Video tutorials on malware reverse engineering, unpacking, and analysis tooling.
picoCTF
Free CTF platform from Carnegie Mellon University with beginner-friendly reversing, forensics, and binary exploitation challenges, plus a year-round practice gym.
In 5 listsDetails
r/ReverseEngineering
Subreddit for sharing reverse-engineering articles, tools, and research.
In 2 listsLink may be dead
Reverse Engineering Stack Exchange
Questions and answers about tools, assembly, executable formats, and analysis techniques.
Related lists in Computer Science
See category100
Table of Contents
hesreallyhim/awesome-claude-code
A hand-picked collection of the finest of resources for the most awesome of agents, Claude Code, the undisputed champion of coding companions, from the unstoppable team…
100
Awesome Agent Skills
VoltAgent/awesome-agent-skills
A curated collection of 1000+ agent skills from official dev teams and the community, compatible with Claude Code, Codex, Gemini CLI, Cursor, and more.
99
Awesome Production Machine Learning
EthicalML/awesome-production-machine-learning
A curated list of awesome open source libraries to deploy, monitor, version and scale your machine learning
97
Contents
ossu/computer-science
🎓 Path to a free self-taught education in Computer Science!
96
Awesome Nano Banana Pro Prompts
YouMind-OpenLab/awesome-nano-banana-pro-prompts
🍌 World's largest Nano Banana Pro prompt library — 10,000+ curated prompts with preview images, 16 languages. Google Gemini AI image generation. Free & open source.
95
Static Analysis
analysis-tools-dev/static-analysis
⚙️ A curated list of static analysis (SAST) tools and linters for all programming languages, config files, build tools, and more. The focus is on tools which improve…