Awesome GitHub RepositoriesBinary Unpacking

de4dot is a .NET deobfuscator and unpacker designed to reverse obfuscation and restore readable code and metadata within .NET assemblies. It functions as a bytecode analyzer that simplifies control flow, strips anti-debugging protections, and extracts original payloads from packed executable wrappers. The project distinguishes itself through a modular deobfuscation pipeline and a sandbox environment used for dynamic string decryption, which executes decryption methods to replace encrypted strings with plain-text values. It can identify specific obfuscation tools through pattern-based binary a

de4dot is a .NET deobfuscator, unpacker, and assembly analysis tool. It is designed to remove obfuscation layers, restore metadata, and simplify bytecode control flow to transform protected binaries back into human-readable code. The project features specialized systems for decrypting strings and constants using both static and dynamic analysis. It identifies specific protection tools through pattern-based detection and strips anti-analysis protections, such as tamper detection and anti-debugging code. The tool provides a suite of reverse engineering capabilities, including binary wrapper un

A bytecode optimizer for Android apps

BlackDex is an Android runtime-level DEX extraction tool that recovers bytecode from protected APK files across Android versions 5 through 12 without requiring root access. It operates by hooking system APIs, reading DexFile cookies, and repairing obfuscated method bodies from memory, supporting both 32-bit and 64-bit architectures for installed and uninstalled applications. The tool distinguishes itself through a multi-method approach that combines cookie-based dumping, API hooking, and memory-based instruction repair to handle first through third generation packers. It reconstructs method b

This is a Go backend template that structures a web service into domain, usecase, controller, and repository layers with strict dependency inversion. It provides a foundation for building maintainable and testable REST APIs by separating business logic from transport and data access concerns. The project implements JWT-based authentication, issuing access and refresh tokens for user signup, login, and protected endpoint access. It uses the Gin HTTP framework to build a Docker-packaged REST API with public and private route groups, request validation, and middleware-based authentication. Depen

Universal Android Debloater Next Generation is a cross-platform desktop application for removing pre-installed system applications from Android devices. It communicates with devices through the Android Debug Bridge (ADB) protocol, supporting both wired USB connections and wireless network pairing for debloating without a physical cable. The tool manages multiple connected Android devices simultaneously and provides package state backup and restore capabilities, allowing users to save and reapply the enabled or disabled state of system packages after factory resets or OS upgrades. The applicat

Steamless هي أداة متخصصة مصممة لتجريد أغلفة إدارة الحقوق الرقمية SteamStub من ملفات الألعاب القابلة للتنفيذ. تعمل كأداة فك تشفير وفك حزم تقوم بإزالة طبقات الحماية هذه لاستعادة البيانات الثنائية الخام للتطبيق الأصلي. من خلال إزالة الغلاف الخاص بالمنصة، تستعيد الأداة نقاط الدخول الأصلية وتمكن الملفات القابلة للتنفيذ من العمل دون الحاجة إلى مثيل منصة مصادق عليه. تعد هذه العملية ثنائيات الألعاب للتعديل عن طريق إزالة الطبقات التي تمنع عادةً أدوات الطرف الثالث من الوصول إلى الكود. يستخدم المشروع فك حزم الثنائيات الثابت، والمسح الثنائي الخطي، وتحليل البايت كود القائم على الأنماط لتحديد حدود الحمولة وإعادة بناء هياكل الملفات القابلة للتنفيذ الأصلية.

pyinstxtractor is a PyInstaller executable unpacker and Python bytecode recovery tool. It functions as a helper for decompiling compiled Python binaries by extracting bundled binaries and bytecode from executables created with PyInstaller. The project includes a bytecode decryptor to remove encryption from extracted files and a header repair tool that restores corrupted headers. These capabilities ensure that extracted compiled files are compatible with bytecode decompilation software. The utility covers reverse engineering of Python applications, supporting malware analysis workflows throug

pe-sieve is a set of diagnostic tools for scanning Windows process memory to identify malicious implants, shellcode, and hooks. It functions as an in-memory implant detector, malware unpacker, and process callstack analyzer designed to locate and dump memory patches and injected code from running processes. The project identifies advanced evasion techniques, such as process hollowing and reflective injection, by verifying portable executable structures in memory. It distinguishes itself by analyzing process callstacks to detect anomalies and redirections and by reconstructing executable heade