Open-source alternatives to Detours

Angr is a binary analysis framework and static analysis tool used for reverse engineering compiled binaries. It serves as a binary decompiler and a lifting platform that translates machine code into a common intermediate representation to enable cross-architecture analysis. The framework integrates a symbolic execution engine and constraint solvers to determine the inputs required to reach specific program states. It also employs untrusted code sandboxing to isolate guest code from the host environment during analysis. Its capabilities cover control flow and data flow analysis, including the

WAuxiliary_Public is a dynamic code instrumentation framework and application plugin framework designed to intercept and alter the execution flow of compiled applications. It functions as a process injection toolkit and software reverse engineering tool, enabling the injection of custom logic into active application memory spaces to extend functionality without requiring original source code. The framework specifically provides capabilities for extending the WeChat desktop client. It achieves this through runtime process injection and software reverse engineering to modify internal operations

XposedBridge is an Android Java hooking framework and bytecode instrumentation engine. It functions as a runtime system for intercepting and modifying Java method calls within the Android operating system and installed applications. The project provides a mechanism for zygote process injection, ensuring that all spawned applications inherit the instrumentation logic. It enables the modification of internal Android system behaviors through method proxying and Java reflection to access private internal system members. The framework supports dynamic Android instrumentation and runtime analysis,

A True Instrumentable Binary Emulation Framework

Camoufox is a Firefox-based stealth automation browser designed to evade detection during automated browsing. It combines a fingerprint randomization engine that generates thousands of unique device attributes per session, native-level API interception to spoof WebRTC, WebGL, media, and other fingerprintable properties, and human behavior simulation that moves the cursor along natural, distance-aware trajectories. The browser is compiled from source with build-time stealth patches and runs headlessly via a lightweight virtual display buffer, making it suitable for web scraping, automated testi

WeChatOpenDevTools-Python is a set of software utilities designed to bypass environment restrictions to enable debugging and element inspection for web and mini program applications. It functions as a developer tool unlocker and web inspector activator to force the activation of integrated inspection tools. The project provides specialized capabilities for debugging and reverse engineering WeChat mini programs. This includes the ability to access hidden developer consoles to analyze the structure, network requests, and behavior of active mini programs and web content. These utilities utilize

This project is a suite of runtime diagnostic tools designed to detect memory leaks, concurrency races, and language-specification violations during software execution. It provides a collection of dynamic analysis tools that identify addressability issues, uninitialized memory usage, and memory safety bugs in applications. The toolset includes a thread safety analyzer to identify data races and deadlocks in concurrent code, as well as an undefined behavior sanitizer to detect operations that violate language specifications. The system covers broad capabilities in memory safety monitoring and

Objection is a dynamic instrumentation framework and runtime exploration toolkit for mobile application security analysis. It provides a command-line interface to interact with the memory and state of iOS and Android applications during active execution, serving as a toolkit for runtime analysis and security testing. The project distinguishes itself by providing specialized capabilities to bypass common mobile security controls, including SSL pinning, biometric authentication, and root or jailbreak detection. It enables the extraction of sensitive credentials and data from secure storage syst

Windhawk is a Windows OS modding framework and user-mode code injector designed to customize the behavior of Windows applications and system components. It functions as a process customization tool and API hooking engine that allows for the insertion of custom logic into running programs. The framework enables software behavior modification and user interface tweaking without requiring access to the original source code. This is achieved by intercepting function calls and altering how software interacts with the operating system to implement patches or feature enhancements. The system covers

r0capture is a tool for intercepting network traffic from Android applications. It serves as a traffic interceptor, packet sniffer, and client certificate exporter used to analyze application-layer communication on Android devices. The project provides mechanisms to bypass SSL pinning and certificate validation, allowing the decryption of encrypted traffic without modifying device trust stores. It also enables the extraction of client-side certificates from application memory for saving to local device storage. Captured network data is serialized into PCAP files to support offline protocol a

Xposed is a native Android runtime hooking framework and instrumentation tool. It provides a modified version of the Android app process binary to intercept and modify the behavior of system and application processes at the binary level. The framework enables Android operating system customization by altering internal function calls and runtime execution flow. It achieves this through native process instrumentation, allowing for the modification of functionality without altering original application files. The tool covers several low-level capabilities, including native library injection and

Dobby is a dynamic function hooking framework and binary instrumentation tool designed to intercept and redirect function calls in compiled binaries. It serves as a cross-platform and cross-architecture library that provides a unified interface for modifying program execution flow across different operating systems and CPU architectures. The library enables low-level binary instrumentation and runtime application instrumentation by injecting custom handlers into live processes. It is used for software reverse engineering to observe real-time data flow and logic by hooking internal functions.

Extism is a cross-language WebAssembly plugin framework that lets applications written in any programming language load and execute plugins written in any other language. It provides a universal plugin system where host applications use idiomatic SDKs to load WebAssembly modules, call exported functions, and pass data back and forth, while plugin authors use development kits that handle memory management and host interaction so they can focus on business logic. The framework distinguishes itself through its comprehensive approach to cross-language integration, offering schema-driven binding g

APKLab is an integrated security analysis platform and reverse engineering IDE for Android applications. It provides a unified environment for decompiling binaries into source code, repackaging modified applications into signed installers, and performing comprehensive security analysis. The platform distinguishes itself by combining static and dynamic analysis workflows. It enables the injection of runtime hooks and gadget libraries to monitor application behavior, while providing specialized patching capabilities to intercept and decrypt encrypted network traffic via a proxy. The toolkit co

Fishhook is a binary instrumentation library for iOS and iOS simulators. It functions as a Mach-O symbol rebinder and instrumenter, allowing for the replacement of system library implementations with custom logic at runtime. The project redirects function calls by updating lazy and non-lazy symbol pointers within Mach-O binary data segments. This approach enables the interception and modification of existing function behavior without altering the original binary on disk. The toolset covers binary instrumentation and dynamic hooking for iOS applications, facilitating the monitoring and altera

AFL is a coverage-guided fuzzer and security vulnerability scanner used to identify software bugs and memory corruption by feeding programs mutated data. It functions as a binary instrumentation tool and a test case minimizer to locate crashes and isolate the smallest set of bytes causing a fault. The project distinguishes itself through its ability to operate as a parallel fuzzing orchestrator, distributing workloads across multiple CPU cores or networked machines. It utilizes dictionary-based mutation for complex file formats and performs input sensitivity analysis to identify critical sect

This project is a comprehensive software fuzzing knowledge base and technical guide designed for discovering software bugs and vulnerabilities. It serves as a resource for implementing coverage-guided, structure-aware, and hybrid fuzzing across various targets, including compiled binaries and hardware kernels. The resource provides specialized guidance on using grammars and defined data formats to generate syntactically valid inputs for complex APIs. It also details methods for combining grey-box fuzzing with symbolic execution to reach deep execution paths and utilizes binary instrumentation

Dexposed is a set of runtime tools and engines designed for dynamic patching, framework interception, and code instrumentation on Android devices. It functions as a hooking framework and instrumentation tool used to load custom code into running processes to alter logic without modifying the original bytecode. The project enables the interception and modification of method behavior within both Android applications and the system framework. It specifically provides capabilities for bypassing operating system limitations by overriding framework calls and applying hot patches to live processes w

go-fuzz is a coverage-guided randomized testing tool for identifying crashes and logic bugs in Go code. It consists of a fuzzer that evolves random inputs based on code execution paths, an instrumentation tool that produces binaries for tracking coverage, and a seed corpus manager. The tool utilizes compile-time binary instrumentation to monitor branch coverage and employs a feedback-driven mutation loop to prioritize inputs that reach new sections of the codebase. It includes capabilities for comparative differential testing to identify logic errors by executing different implementations of

WeChatFerry is a platform-specific automation tool designed for programmatic account and conversation management. It enables the creation of bots and the integration of large language models to provide automated replies within a messaging interface. The project functions by using native API interception and memory-based hooking to capture incoming communication and send messages without an official API. It includes capabilities for binary data decryption to transform protected media files and database records into readable formats. The system covers a broad range of functional areas, includi

Hooker is a toolkit for the dynamic instrumentation, memory analysis, and deobfuscation of Android applications. It functions as a reverse engineering framework that uses Frida to inject scripts into running processes, monitor native calls, and extract executable DEX files. The project provides specialized utilities for bypassing security controls, including tools to disable SSL certificate validation and BoringSSL pinning to enable HTTPS traffic interception. It includes capabilities for detecting application packing, extracting cryptographic keys by hooking encryption algorithms, and circum

ExplorerBlurMica is a system utility designed to apply transparency, blur, and material design effects to standard Windows desktop interface elements. It functions as a window effect injector and visual modifier specifically for the Windows File Explorer and other shell windows. The tool provides customization of background visual effects, including the addition of acrylic and mica transparency. It allows for the definition of specific blend colors for backgrounds and includes an adaptation system that synchronizes visual styles with the current operating system theme settings.

BaiduNetdiskPlugin-macOS is a suite of macOS system extensions and tools designed to remove download speed limits and unlock premium features for the Baidu Netdisk client. It functions as a download speed unblocker and premium feature unlocker to enable maximum data transfer rates and activate SVIP status. The project includes a software update blocker that prevents the client from performing automatic updates to preserve the applied modifications. It achieves these results by removing local data transfer rate restrictions and eliminating trial duration limits.

MacType is a system-level utility that replaces the default Windows font rasterization engine. It functions as a background service that intercepts and modifies font rendering calls to provide custom anti-aliasing, weight, and contrast adjustments for desktop applications. The software operates by injecting custom libraries into running processes to override standard text layout and graphics routines. It utilizes a shared memory space to apply configuration updates across multiple processes instantly, allowing for granular control over visual parameters such as gamma, hinting, and font substi

AsmJit is a runtime machine code generator and JIT compiler backend that translates high-level definitions into executable processor instructions. It provides a unified instruction emission API and an executable memory manager to allocate and protect virtual memory pages across multiple CPU architectures. The library functions as an assembly engine for x86 and ARM, supporting cross-platform assembly generation through a unified backend. It enables the creation of optimized machine code for different CPUs while maintaining a single codebase. The project covers low-level system abstractions in

Harmony is a library for modifying, replacing, and decorating compiled .NET and Mono methods during execution without altering binary files on disk. It functions as a runtime method patching tool, a CIL instruction manipulator, and a reflection extension for C#. The project provides mechanisms to intercept method execution, allowing custom code to run before or after original methods while maintaining the existing program flow. It enables the analysis and rewriting of Common Intermediate Language instructions to change the internal logic of compiled methods. The toolkit also includes utiliti

JustTrustMe is an Android security auditing tool and mobile application penetration testing utility. Its primary purpose is to bypass hardcoded certificate requirements and disable SSL pinning in mobile applications to allow the inspection of encrypted API requests and responses. The project functions as a dynamic method hooking module that integrates with the Xposed framework. It uses system-level instrumentation to intercept Java runtime function calls and override security checks within third-party Android applications. The tool covers a range of capabilities including the disabling of SS