Open-source alternatives to DnSpy

This project is a desktop application designed for the reverse engineering and inspection of compiled Java code. It functions as a graphical interface that translates Java bytecode back into readable source code, allowing users to examine the internal logic of class files and archives when original source files are unavailable. The tool provides a structured environment for navigating complex file hierarchies, including nested archives like JAR and WAR files. By maintaining an in-memory representation of loaded classes, it enables rapid searching and cross-referencing of code elements. The ap

Pry is a programmable Ruby shell, REPL console, and runtime developer environment. It serves as a debugging toolkit for inspecting object state, navigating bindings, and evaluating code within a running Ruby program. The project differentiates itself through advanced introspection and live iteration capabilities. It allows users to inject an interactive console into a running program at specific points to inspect local state and navigate different object scopes. It further enables live code iteration by integrating with external system editors to modify and reload method definitions without r

Radare2 is a comprehensive framework for reverse engineering and analyzing compiled software. It provides a command-line environment designed for disassembling, debugging, and patching binary executables across a wide range of processor architectures and operating systems. The system distinguishes itself through a modular, plugin-based architecture that supports cross-platform analysis and automated workflows. It utilizes memory-mapped file access to enable efficient structural inspection and modification of binaries without requiring full file loads. By lifting machine instructions into a un

RetDec is a reverse engineering framework and static binary analysis tool. Its primary purpose is to function as an LLVM-based machine code decompiler that translates binary machine code from multiple architectures into high-level C source code. The system employs a multi-stage lifting pipeline to recover program logic, using an intermediate representation to apply optimizations before emitting source code. It distinguishes itself through the ability to identify compilers and packers, perform executable unpacking, and reconstruct class hierarchies and original program structures. The framewo

ImHex is a professional-grade hex editor and binary data analysis platform designed for inspecting, modifying, and reverse engineering raw file contents. It functions as a schema-driven engine that interprets complex binary structures by applying custom definitions to map and visualize byte-level data. The platform distinguishes itself through a dedicated domain-specific language that allows users to define structural schemas for automated file parsing. This capability is supported by a dynamic plugin architecture and an event-driven registry, which enable the integration of external modules

radare2 is a reverse engineering framework and binary analysis toolset. It functions as a multi-architecture disassembler, low-level binary debugger, and hexadecimal editor for inspecting executable structures and interpreting machine code when original source files are unavailable. The framework provides capabilities for decompiling machine instructions, performing symbolic analysis, and diffing binary files to identify structural changes across versions. It also includes a digital forensic analyzer and disk analyzer for browsing filesystem formats in userland. The toolset supports binary p

dnSpy is a desktop application designed for the analysis, debugging, and modification of compiled .NET assemblies. It functions as an assembly analysis suite and decompiler, translating binary instruction streams back into readable source code to facilitate reverse engineering when original source files are unavailable. The tool distinguishes itself through an integrated binary patching engine and metadata editor, which allow for the direct modification of executable logic and internal metadata tables. It supports in-process debugging instrumentation, enabling users to inject runtime hooks, s

Kilocode is an autonomous engineering platform designed to orchestrate AI agents for complex software development tasks. It functions as a comprehensive system for automating coding, testing, and repository management by integrating directly with your codebase and terminal. The platform provides a unified gateway for model orchestration, allowing for the management of agentic workflows, event-driven automation, and persistent session state across distributed development environments. The platform distinguishes itself through its federated task management and policy-based access control, which

gdsdecomp is a project recovery suite and game engine reverse engineering toolset. It functions as a bytecode decompiler, binary resource converter, and asset extraction tool designed to reconstruct original directory hierarchies and scripts from compiled binary game assets. The toolset specializes in GDScript bytecode decompilation and compilation, translating compiled bytecode back into human-readable source code or converting source code into executable bytecode for specific engine versions and commit hashes. It includes a game archive patcher to modify project archives by replacing intern

Webhook.site is a web-based tool that captures, inspects, and debugs incoming HTTP requests and emails sent to a unique URL, without requiring any server setup. It also functions as an API mocking and response modification tool, capable of generating mock APIs from OpenAPI specifications and altering HTTP responses, headers, and status codes for testing purposes. Beyond inspection, it serves as a platform for webhook automation and workflow orchestration, triggering multi-step automations—including database queries, SSH commands, and HTTP calls—when a webhook is received. The service distingu

Miasm is a Python reverse engineering framework designed for binary analysis, disassembly, and modification. It functions as a binary analysis framework that lifts machine code into an intermediate representation to enable platform-independent security research. The system operates as a binary emulation engine and modification toolkit, allowing for the execution of binary code in a virtual environment to track state changes without native hardware. It provides tools for binary patching to update and modify raw binary files across multiple CPU architectures and executable formats. The framewo

Laravel Debugbar is a web-based debugging toolbar and application profiler for Laravel. It provides a visual interface to inspect database queries, logs, and performance metrics in real time to identify and resolve bugs during development. The tool features a database query monitor to capture SQL statements and timings, as well as a request inspector for analyzing route metadata, loaded views, and HTTP request data. It includes a profiler for measuring execution time and memory usage to identify bottlenecks in the request lifecycle. Its observability capabilities cover exception capture, app

Arthas is a Java diagnostic tool and runtime debugger designed for real-time troubleshooting of applications. It functions as a remote diagnostics agent that allows users to inspect the runtime state of a Java process, including its heap objects and classloader hierarchies, without requiring a process restart. The project distinguishes itself through advanced bytecode manipulation capabilities, enabling live class hotswapping and the modification of bytecode in running processes. It supports in-memory source compilation and runtime bytecode decompilation to verify and update logic instantly w

Triton is a dynamic binary analysis framework designed to automate reverse engineering. It functions as a multi-architecture CPU emulator, an SMT-based symbolic execution engine, and a dynamic taint analysis tool. The framework translates raw machine instructions into abstract syntax trees, allowing it to represent binary program logic as a structured intermediate representation. This allows the system to map multiple hardware instruction sets to a single analysis framework and translate machine instructions into mathematical formulas for solving constraints. Its capabilities cover the simul

Proxypin is a cross-platform HTTP and HTTPS proxy debugger designed to capture, inspect, and modify network traffic. It functions as a man-in-the-middle interceptor, allowing developers to analyze application data flows and validate network communication during development and testing. The tool distinguishes itself through its focus on mobile and remote device integration, utilizing QR-code-based configuration synchronization to simplify the setup of proxy settings and security certificates. It includes an event-driven scripting engine that enables programmatic manipulation of requests and re

FLEX is a diagnostic framework designed for the inspection and modification of mobile applications during active execution. It provides a suite of tools that allow developers to explore the internal state of a running process, including its memory, class definitions, and object properties, without requiring a recompilation of the source code. The tool distinguishes itself by enabling real-time interaction with the application environment. It facilitates dynamic user interface prototyping by allowing for the traversal and modification of visual hierarchies, as well as the direct manipulation o

This project is a command-line utility and development framework designed to modify, extend, and customize the Spotify desktop client. It functions as a binary patching engine that injects custom scripts, stylesheets, and interface components directly into the host application, enabling users to alter visual themes and add new functionality. The tool distinguishes itself by providing a comprehensive development environment for building modular extensions and custom applications. It includes a hot-reloading pipeline for rapid iteration, a declarative library for constructing interactive UI pan

This project is a request testing service and diagnostic utility designed to help developers inspect HTTP interactions and verify client-side network logic. It functions as a stateless server that echoes request metadata, including headers, parameters, and body content, back to the calling client to ensure data is transmitted as intended. The service distinguishes itself by providing a platform for mocking REST API endpoints and simulating various server behaviors. Developers can use these endpoints to trigger specific HTTP status codes, test content negotiation, validate form data encoding,

Cheat Engine is a software reverse engineering suite and memory editor designed for the Windows environment. It functions as a comprehensive platform for inspecting, analyzing, and modifying the internal logic and data structures of running applications. The tool provides capabilities for real-time memory scanning and manipulation, allowing users to locate and alter specific values within a process's address space. It distinguishes itself through advanced debugging features, including hardware-assisted debugging, kernel-mode driver injection for bypassing memory protections, and dynamic binar

Wuzz is an interactive command line HTTP client and request inspector designed for capturing, reviewing, and analyzing outgoing network calls and their payloads. It functions as a terminal-based tool for debugging API issues and testing web endpoints. The tool provides specialized filtering for response bodies, using regular expressions and format-specific query syntaxes tailored for JSON and HTML data. It allows for the persistence of captured requests and responses to disk to facilitate the reproduction of network issues and offline analysis. User settings and default request behaviors are

CloakBrowser is a modified Chromium browser and anti-detect profile manager designed to bypass bot detection and automation signals. It serves as a replacement for standard browser engines in automation frameworks, using source-level binary patching to remove automation flags and spoof internal hardware signals. The project focuses on identity masking through the generation and maintenance of unique hardware and software fingerprints, including canvas noise and screen dimensions. It synchronizes browser timezones and locales with network proxy exit points and replaces programmatic input with

Qira is a runtime analysis tool and interactive binary debugger designed for the QEMU emulator. It functions as a binary execution tracer that records a full timeline of instruction invocations and provides a system for monitoring memory operations within guest processes. The project enables the analysis of compiled binaries by tracing instruction-level execution and mapping raw memory addresses to user-defined annotations. It includes capabilities for state-snapshotting to manage execution forks, allowing the navigation of divergent logic paths and the inspection of CPU register states and s

PsySH is an interactive read-eval-print loop and shell environment for PHP. It functions as a runtime debugger and application inspector, allowing for the execution of PHP code in real-time to experiment with snippets and inspect live application state. The project is distinguished by its ability to be embedded directly into running PHP applications for live troubleshooting. It provides specialized tools for state manipulation, including the ability to bypass visibility restrictions to inspect private or protected object members and the capacity to reload code without restarting the session.

LLM4Decompile is a toolset and framework for binary-to-source code translation. It uses large language models to transform machine code into readable source code and recover the original logic of compiled executables. The project includes a specialized pipeline for generating synthetic training datasets by converting source code into assembly pairs. It provides a fine-tuning framework to optimize deep learning models on these binary-to-source datasets, increasing the accuracy of code recovery. The system also features capabilities for refining decompiled pseudo-code. This process focuses on

Psychson is a toolset for modifying USB firmware binaries and flashing custom images to specific hardware controller architectures. It provides utilities for dumping, patching, and flashing custom firmware specifically for Phison 2251-03 USB controllers. The software includes a payload injector for embedding HID keystroke scripts into USB firmware to automate inputs on a target machine. It also features a controller flasher for writing modified burner images directly to Phison-based USB hardware. The suite covers firmware management and hardware forensic analysis, including capabilities for

Freeline is a mobile application update framework and bytecode hot-swap engine designed to deliver incremental binary updates to devices. It functions as a binary diff patching tool and a mobile over-the-air patching framework that allows for the delivery of small update packages to fix bugs and replace resources without requiring a full application reinstall. The system distinguishes itself through its ability to perform dynamic code swapping and native library updating. It replaces shared object binaries and code segments in a running process via socket servers, enabling logic updates and h

GEF is a Python-based extension for GDB that serves as a framework for binary analysis, exploit development, and low-level debugging. It functions as a dynamic analysis extension designed to assist in reverse engineering workflows and malware analysis by enhancing the debugger's ability to inspect process state and memory. The project is distinguished by its specialized heap analysis tools, which allow for the inspection of glibc heap arenas, bins, and chunks to detect memory corruption. It also provides a dedicated toolkit for exploit development, including cyclic pattern generation for offs