Awesome GitHub RepositoriesBinary Analysis Platforms

Unicorn is a multi-architecture CPU emulation framework and library that utilizes just-in-time compilation to execute instructions across various processor architectures, including ARM, x86, and RISC-V. It functions as both a JIT compilation engine and an instrumentation tool, allowing for the execution of machine code without the need for physical hardware. The framework is distinguished by its hook-based execution instrumentation, which enables the interception of specific instructions and memory accesses to trigger custom callback functions. It provides a language-agnostic binding layer an

Angr is a binary analysis framework and static analysis tool used for reverse engineering compiled binaries. It serves as a binary decompiler and a lifting platform that translates machine code into a common intermediate representation to enable cross-architecture analysis. The framework integrates a symbolic execution engine and constraint solvers to determine the inputs required to reach specific program states. It also employs untrusted code sandboxing to isolate guest code from the host environment during analysis. Its capabilities cover control flow and data flow analysis, including the

Capstone is a multi-architecture disassembly framework and binary translation system. It converts binary machine code into human-readable assembly instructions for a wide variety of hardware instruction set architectures and virtual machines. The framework supports a diverse range of targets, including x86, ARM, RISC-V, and MIPS, as well as virtual machine environments like WebAssembly and the Ethereum Virtual Machine. It functions as an instruction analysis tool capable of extracting granular decomposition data and semantic information from disassembled code. The engine is designed for low-

LIEF هو إطار عمل لتحليل وتعديل وتحليل تنسيقات الملفات الثنائية القابلة للتنفيذ وذاكرات التخزين المؤقت المشتركة للنظام عبر منصات متعددة. يعمل كمكتبة عبر المنصات للتلاعب البرمجي بملفات ELF وPE وMachO الثنائية. يوفر المشروع أدوات لتغيير البنية الداخلية وأقسام الملفات القابلة للتنفيذ لتغيير سلوك البرنامج. كما يتضمن محللاً مخصصاً لاستعادة المكتبات الديناميكية الفردية من ذاكرات التخزين المؤقت المشتركة للنظام المدمجة. تغطي مجموعة الأدوات تحليل الملفات القابلة للتنفيذ، وتفكيك كود الآلة، واستخراج بيانات التصحيح الوصفية ومعلومات الرموز. كما تدعم الترجمة ثنائية الاتجاه لكود الآلة والتجميع عبر بنيات معالجات مختلفة.

Plasma is an interactive disassembler for x86/ARM/MIPS. It can generates indented pseudo-code with colored syntax.