Open-source alternatives to Triton

Unicorn is a multi-architecture CPU emulation framework and library that utilizes just-in-time compilation to execute instructions across various processor architectures, including ARM, x86, and RISC-V. It functions as both a JIT compilation engine and an instrumentation tool, allowing for the execution of machine code without the need for physical hardware. The framework is distinguished by its hook-based execution instrumentation, which enables the interception of specific instructions and memory accesses to trigger custom callback functions. It provides a language-agnostic binding layer an

Miasm is a Python reverse engineering framework designed for binary analysis, disassembly, and modification. It functions as a binary analysis framework that lifts machine code into an intermediate representation to enable platform-independent security research. The system operates as a binary emulation engine and modification toolkit, allowing for the execution of binary code in a virtual environment to track state changes without native hardware. It provides tools for binary patching to update and modify raw binary files across multiple CPU architectures and executable formats. The framewo

Manticore is a symbolic execution engine designed for the analysis of binary executables and smart contracts. It functions as an automated vulnerability scanner and verification platform that systematically traverses program execution paths to identify security flaws, validate business invariants, and ensure software properties hold true under all possible input conditions. The engine distinguishes itself through a unified instruction set abstraction that enables consistent analysis across diverse architectures and contract formats. It provides a programmatic interface for deep customization,

Zydis is an x86 and x86-64 binary analysis library that provides a framework for decoding machine code and inspecting the technical attributes of processor instructions. It functions as an instruction disassembler that translates binary data into structured instruction metadata and human-readable assembly. The project includes a machine code encoder for converting assembly instructions and operands back into their binary representations. It also provides an assembly syntax formatter to transform decoded instruction structures into assembly text strings using configurable syntax styles. The l

GEF is a Python-based extension for GDB that serves as a framework for binary analysis, exploit development, and low-level debugging. It functions as a dynamic analysis extension designed to assist in reverse engineering workflows and malware analysis by enhancing the debugger's ability to inspect process state and memory. The project is distinguished by its specialized heap analysis tools, which allow for the inspection of glibc heap arenas, bins, and chunks to detect memory corruption. It also provides a dedicated toolkit for exploit development, including cyclic pattern generation for offs

dnSpy is a specialized toolset for the reverse engineering, analysis, and modification of compiled .NET binaries. It functions as a decompiler that converts assemblies back into readable high-level source code, an assembly editor for modifying bytecode and metadata, and a debugger for inspecting compiled binaries. The project integrates a hex editor specifically for inspecting and modifying raw bytes and Common Intermediate Language structures. It allows for the direct modification of binary contents to change application behavior without requiring the original project source files. The tool

Z3 is an automated theorem prover and satisfiability modulo theories solver designed to determine the validity of complex logical formulas. It functions as a formal verification framework, enabling the systematic checking of hardware and software system specifications against defined logical constraints to identify inconsistencies or design flaws. The engine distinguishes itself through a combination of theory-specific decision procedures and symbolic execution capabilities. It employs conflict-driven clause learning and backtracking search algorithms to prune search spaces, while maintaining

radare2 is a reverse engineering framework and binary analysis toolset. It functions as a multi-architecture disassembler, low-level binary debugger, and hexadecimal editor for inspecting executable structures and interpreting machine code when original source files are unavailable. The framework provides capabilities for decompiling machine instructions, performing symbolic analysis, and diffing binary files to identify structural changes across versions. It also includes a digital forensic analyzer and disk analyzer for browsing filesystem formats in userland. The toolset supports binary p

Radare2 is a comprehensive framework for reverse engineering and analyzing compiled software. It provides a command-line environment designed for disassembling, debugging, and patching binary executables across a wide range of processor architectures and operating systems. The system distinguishes itself through a modular, plugin-based architecture that supports cross-platform analysis and automated workflows. It utilizes memory-mapped file access to enable efficient structural inspection and modification of binaries without requiring full file loads. By lifting machine instructions into a un

pwndbg is a GDB plugin and binary analysis framework designed for reverse engineering, exploit development, and low-level program analysis. It extends the core functionality of the debugger to provide advanced memory inspection and automation tools. The project distinguishes itself with specialized capabilities for heap analysis across glibc, jemalloc, and musl, as well as a comprehensive kernel debugging toolkit for inspecting Linux kernel tasks and slab allocators. It includes an integrated ROP gadget searcher for constructing exploit chains and an LLM-powered debugging assistant that provi

Binary Analysis Platform

Qira is a runtime analysis tool and interactive binary debugger designed for the QEMU emulator. It functions as a binary execution tracer that records a full timeline of instruction invocations and provides a system for monitoring memory operations within guest processes. The project enables the analysis of compiled binaries by tracing instruction-level execution and mapping raw memory addresses to user-defined annotations. It includes capabilities for state-snapshotting to manage execution forks, allowing the navigation of divergent logic paths and the inspection of CPU register states and s

dnSpy is a specialized suite of tools for the reverse engineering of .NET assemblies, functioning as a decompiler, assembly editor, and debugger. It translates compiled intermediate language back into high-level source code and provides an execution environment for stepping through compiled binaries to inspect runtime state without the original source files. The project includes a BAML decompiler that converts binary application markup language into a disassembled format and translates it into extensible markup language for user interface analysis. It also functions as a binary analysis tool

LLM4Decompile is a toolset and framework for binary-to-source code translation. It uses large language models to transform machine code into readable source code and recover the original logic of compiled executables. The project includes a specialized pipeline for generating synthetic training datasets by converting source code into assembly pairs. It provides a fine-tuning framework to optimize deep learning models on these binary-to-source datasets, increasing the accuracy of code recovery. The system also features capabilities for refining decompiled pseudo-code. This process focuses on

RetDec is a reverse engineering framework and static binary analysis tool. Its primary purpose is to function as an LLVM-based machine code decompiler that translates binary machine code from multiple architectures into high-level C source code. The system employs a multi-stage lifting pipeline to recover program logic, using an intermediate representation to apply optimizations before emitting source code. It distinguishes itself through the ability to identify compilers and packers, perform executable unpacking, and reconstruct class hierarchies and original program structures. The framewo

Bosque is an experimental programming language and development platform designed for machine-assisted software construction. It combines functional programming semantics with imperative syntax to enforce logic correctness and runtime safety, providing a type-safe environment that utilizes structured data models to maintain information integrity throughout the application lifecycle. The platform distinguishes itself through deep integration with formal verification tools, including automated theorem provers and symbolic execution engines. By transforming source code into a regularized intermed

OR-Tools is a software suite for combinatorial optimization, constraint programming, and mathematical modeling. It provides a framework for defining complex problems involving variables and logical constraints, enabling the systematic search for feasible or optimal solutions. The project features a high-performance core engine written in C++ that utilizes branch and bound search and local search metaheuristics to navigate large solution spaces. A language-agnostic wrapper layer allows these optimization capabilities to be accessed through idiomatic interfaces in multiple high-level programmin

Detect-It-Easy is a binary file identifier and analysis toolkit designed to determine file formats, compilers, and packers. It functions as a binary file identifier that utilizes signature matching and heuristic analysis to identify executable and archive formats. The project includes a custom file signature engine and a scriptable rule system for defining and applying detection logic to identify specific binary patterns. It features specialized detectors for Android packages, such as APK and DEX files, and a malware packer detector to identify protections, obfuscators, and virus families. T

This project is a profiling utility written in Rust that captures, transforms, and visualizes function call stacks to identify system performance bottlenecks. It functions as a sampling profiler wrapper that converts raw profiling data into interactive flamegraphs, which are hierarchical maps of resource consumption. The tool provides specialized integration with the Rust build system to profile binaries and performance benchmarks. It also allows for custom profiling configurations, enabling users to override default system profiling tools or recording flags to control how data is collected.

Goboy is a GameBoy emulator written in Go that allows original handheld game ROMs to run on modern computer hardware. It supports both monochromatic and color display modes. The project includes specialized tools for retro game debugging and graphics inspection. These capabilities allow for the analysis of game logic by stepping through opcodes, profiling processor execution in real time, and inspecting background palettes, sprite data, and map layouts. The emulator provides game state preservation by writing cartridge RAM to local files. It also implements pixel-buffer rasterization for ren

FEX is an emulator that executes 32-bit and 64-bit x86 binaries on ARM64 hardware. It functions as a binary translation framework that converts guest machine code into host instructions using a JIT compilation engine and a persistent code cache. The project features a Vulkan graphics wrapper that translates OpenGL and Vulkan API calls to native host drivers, enabling cross-architecture graphics rendering. It includes a dedicated root filesystem manager for downloading, mounting, and switching between compressed filesystem images required for guest application environments. The system provide

This project is a structured course and instructional guide focused on x64 Windows reverse engineering. It provides a curriculum for analyzing and decompiling Windows binaries through the study of assembly language and operating system internals. The material covers Windows binary analysis and malware analysis, with a specific focus on interpreting x64 machine code to recover original program logic. It guides the user through the process of tracing program behavior and logging function calls to understand how binaries operate. The technical scope includes assembly-level decompilation, debugg

img is a collection of toolsets for building, managing, and manipulating OCI compliant container images. It functions as an image build tool and registry client, providing the capabilities to create images from configuration files, push and pull images to remote registries, and extract image layers into root filesystems or archives. The project distinguishes itself through support for multi-platform builds using hardware emulators and the ability to perform unprivileged container builds via namespace-based process isolation and user ID mapping. It also includes a cross-platform binary compile

Ibis is a portable Python dataframe library and multi-backend query engine that provides a unified interface for executing data transformations across diverse compute engines. It functions as a Python SQL expression compiler and dialect transpiler, allowing users to define data logic once and execute it across cloud warehouses, embedded databases, and distributed clusters without rewriting code. The project distinguishes itself through a database backend abstraction that decouples transformation logic from the underlying execution engine. It enables polyglot data workflows by mixing raw SQL s

Infer is a static analysis toolset for Java, C, C++, and Objective-C designed to detect memory leaks, null dereferences, and resource bugs. It functions as a multi-language bug finder that identifies race conditions, deadlocks, and memory safety issues by translating source code into a common intermediate representation for analysis. The project distinguishes itself through an inter-procedural data flow analyzer that tracks movement between sources and sinks to detect tainted flows and generate data flow graphs. It also includes a framework for verifying temporal properties and reachability u

This project is a cross-language quantitative trading framework designed to implement and execute trading strategies consistently across Python, JavaScript, C++, and PineScript. It functions as a polyglot trading strategy translator and a multi-language algorithmic trading engine that maps high-level scripting and block-based logic to executable binaries. The system features a financial domain-specific language parser that translates specialized trading syntax and visual programming blocks into a standardized internal representation. It includes a technical analysis pattern library providing

go-ast-book is a collection of educational and technical resources focused on abstract syntax tree analysis, compiler development, and static code verification. It provides guides and manuals for parsing, traversing, and analyzing Go source code to extract semantic meaning. The project serves as a reference for building compiler frontends, covering the translation of high-level code into intermediate representations and single static assignment forms. It also provides instructions for using these techniques to develop language tooling and perform static code analysis. The resources cover a b