Projects sharing features with Bloaty

Linker/Compiler/Tool detector for Windows, Linux and MacOS.

A binary static analysis tool that provides security and correctness results for Windows Portable Executable and *nix ELF binary formats

Jazzy is a source code documentation tool and API generator designed for Swift and Objective-C. It analyzes project roots and compiled modules to produce searchable HTML websites or offline docsets. The system functions as a multi-module API documenter, aggregating documentation from separate source modules into a single site with cross-module linking. It serves as a markdown-based documentation engine that integrates technical guides and LaTeX mathematical equations to complement generated API references. The tool covers a broad capability surface including multi-language API generation for

Diaphora is a binary diffing tool and similarity engine designed to compare compiled binaries and identify changed or matching code sections. It functions as a reverse engineering plugin that maps relationships between functions and detects compilation units using assembler analysis and graph theory. The project specializes in vulnerability patch analysis, allowing users to detect security fixes by comparing different versions of a binary. It synchronizes analysis metadata, such as symbol names and comments, between binaries and generates patches by comparing decompiled pseudo-code. The engi

AndFix is a binary patching framework and update system for Android applications. It provides tools for generating binary diffs and applying runtime method replacements to fix bugs without requiring a full application update. The system utilizes a binary diff generator to isolate minimal code changes between package versions. It supports the consolidation of multiple incremental patches into a single update file and employs native hooks to replace specific method implementations in memory during the application initialization phase. The framework covers capabilities for binary patch generati

backward-cpp is a C++ stack trace library and debugging utility designed to capture, resolve, and print detailed execution traces and crash reports. It functions as a crash reporter and call stack printer that translates raw memory addresses into human-readable function names, filenames, and line numbers. The project provides automated crash reporting by registering system handlers for fatal errors, such as segmentation faults, to automatically generate execution traces upon program failure. It distinguishes itself by extracting source file fragments from disk to display specific lines of cod

Parca is an always-on continuous profiling platform that captures CPU and memory usage from running applications without any code modifications. It uses eBPF kernel-level tracing to automatically discover and sample stack traces across infrastructure, and provides a web-based flame graph dashboard for interactive performance analysis. Its label-based query engine lets users slice and aggregate profiling data across dimensions such as service, container, or region, using a Prometheus-style selector syntax. Unlike basic profilers, Parca stores profile samples in a columnar format using Apache A

The diagnostics project provides a cross-platform diagnostic infrastructure and command-line toolkit for monitoring runtime performance, analyzing memory dumps, and troubleshooting applications. It features a custom inter-process communication protocol for command and telemetry exchange across platforms, a low-overhead event pipe mechanism for streaming real-time diagnostic events and performance counters from running processes, and automated remote symbol resolution for stack trace analysis. The platform includes native debugger extensions that integrate with standard debuggers to inspect ma

capa is a static analysis tool that scans executable files to identify what a program can do, detecting capabilities such as API calls, byte sequences, and structural patterns without executing the code. It supports multiple file formats including PE, ELF, .NET, and shellcode, and can also process runtime behavior traces from sandbox reports generated by CAPE, DRAKVUF, or VMRay. The tool integrates directly with reverse engineering environments through plugins for IDA Pro and Ghidra, allowing analysts to view capability matches and author detection rules within their disassembler of choice. C

Blink is a JIT-based instruction emulator and x86-64 Linux emulator designed to run Linux binaries and ELF files across different host operating systems and architectures. It functions as a binary execution sandbox and system call simulator, providing a controlled environment for running programs. The project distinguishes itself with a terminal user interface for monitoring execution, managing breakpoints, and visualizing JIT compilation paths. It supports self-modifying code through a cache-invalidating memory model and provides execution environment isolation using restricted directory ove

PE-bear is a graphical portable executable analysis tool designed for inspecting, disassembling, and modifying the structure of Windows PE binary files. It functions as a static analysis framework used to identify malicious patterns and reverse engineer program logic. The project provides a binary diffing tool to identify structural and content differences between two executable files. It also includes a section editor for modifying binary layouts by adding or altering sections and imports. The tool covers a range of binary analysis capabilities, including machine code disassembly, file layo

MemProcFS is a volatile memory analysis tool and cross-platform memory acquisition system. It functions as a memory forensic virtual file system, mapping physical memory and kernel objects into a virtual directory structure that allows users to analyze system artifacts using standard file system tools. The project distinguishes itself by providing a virtual file system for memory forensics, enabling the browsing and querying of physical memory as read-only files and folders. It also incorporates a Yara-based memory scanner to identify malware signatures and injected code within physical memor

Samply is a cross-platform CPU sampling profiler and performance analysis utility. It consists of a command-line tool for recording process stack traces at regular intervals and a visual interface for analyzing the resulting execution data. The system includes a debug symbol resolver that maps raw memory addresses to human-readable function names using local or remote symbol information. It transforms recorded execution data into flame graphs and timelines to pinpoint function-level hotspots. The tool provides capabilities for CPU execution recording, stack unwinding, and symbol resolution a

A True Instrumentable Binary Emulation Framework

Il2CppDumper is a reverse engineering tool that recovers original .NET assembly structure from Unity games compiled with il2cpp. It parses il2cpp binaries across multiple executable formats including ELF, Mach-O, PE, NSO, and WASM, and reconstructs the original DLL structure from embedded metadata tables, enabling decompilation and analysis of game code. The tool generates disassembler scripts for IDA, Ghidra, and Binary Ninja that apply recovered type definitions and structure layouts to the binary analysis. It also strips protection layers from memory-dumped libil2cpp.so files and simple PE

TinyGo is a specialized compiler and development toolkit designed to bring the Go programming language to resource-constrained microcontrollers and WebAssembly environments. It provides a bare-metal runtime environment that enables high-level code execution without the need for a traditional operating system, utilizing an LLVM-based backend to generate efficient machine instructions. The project distinguishes itself through aggressive optimization techniques tailored for small hardware, including a static memory allocation strategy and whole-program dead code elimination that significantly re

radare2 is a reverse engineering framework and binary analysis toolset. It functions as a multi-architecture disassembler, low-level binary debugger, and hexadecimal editor for inspecting executable structures and interpreting machine code when original source files are unavailable. The framework provides capabilities for decompiling machine instructions, performing symbolic analysis, and diffing binary files to identify structural changes across versions. It also includes a digital forensic analyzer and disk analyzer for browsing filesystem formats in userland. The toolset supports binary p

Manticore is a symbolic execution engine designed for the analysis of binary executables and smart contracts. It functions as an automated vulnerability scanner and verification platform that systematically traverses program execution paths to identify security flaws, validate business invariants, and ensure software properties hold true under all possible input conditions. The engine distinguishes itself through a unified instruction set abstraction that enables consistent analysis across diverse architectures and contract formats. It provides a programmatic interface for deep customization,

HyperDbg is a hardware-assisted kernel-mode debugging platform that leverages virtualization to monitor and control system execution. By utilizing hypervisor-level primitives, it enables deep system analysis and instrumentation without relying on standard operating system debugging interfaces. The framework provides a comprehensive environment for inspecting both kernel and user-mode processes, allowing for granular control over execution flow and system state. The project distinguishes itself through a transparent debugging layer designed to remain invisible to the target environment. It emp

KSCrash is a C++ crash reporting library and remote reporting framework designed to capture application crashes and signals. It functions as an async-safe crash reporter that traps exceptions and deadlocks to ensure reports are generated during critical failures. The system includes a memory diagnostics tool for tracking memory pressure and identifying zombie objects to diagnose memory-related terminations. It also features a symbol demangling tool that converts mangled C++ and Swift function names into human-readable strings for stack trace analysis. The project provides comprehensive monit

PerfView is a set of integrated profiling and tracing tools built on Windows Event Tracing for Windows (ETW), designed to diagnose CPU, memory, and ETW-based performance issues in .NET applications. It captures ETW events to analyze runtime behavior, CPU usage, and memory allocations, serving as a .NET performance profiler that measures both CPU time and garbage collection events. The tool distinguishes itself with a diff comparison engine that compares two performance traces side-by-side to highlight changes in method costs and event rates. It renders profiled call stacks as flame graphs whe

AFL is a coverage-guided fuzzer and security vulnerability scanner used to identify software bugs and memory corruption by feeding programs mutated data. It functions as a binary instrumentation tool and a test case minimizer to locate crashes and isolate the smallest set of bytes causing a fault. The project distinguishes itself through its ability to operate as a parallel fuzzing orchestrator, distributing workloads across multiple CPU cores or networked machines. It utilizes dictionary-based mutation for complex file formats and performs input sensitivity analysis to identify critical sect

ipsw is a specialized toolkit for iOS firmware analysis, binary reverse engineering, and hardware interaction. It provides a suite of tools for downloading, extracting, and analyzing firmware images and kernel caches, alongside a MachO binary analysis tool for disassembling and patching executables. The project distinguishes itself through integrated language-model-powered code reconstruction to translate machine code into high-level source code. It also features an automation client for the App Store Connect API to manage certificates and application settings. The framework covers a broad r

The Mobile Application Security Testing Guide is a comprehensive manual and compliance framework for verifying the security of mobile applications. It provides a standardized reference for identifying and validating common software security weaknesses and performing reverse engineering based on industry standards. The project provides a structured set of technical processes and checklists used to audit applications against established security weakness enumerations. It encompasses guidance for analyzing application binaries and runtime behavior to identify hidden functionality and security ga

Retdec is an LLVM-based machine code decompiler and static binary analysis tool designed for binary reverse engineering. It translates binary executable code into high-level representations to facilitate the reconstruction of program logic from compiled machine code. The system utilizes a retargetable frontend architecture and a multi-stage lifting pipeline to convert raw bytes into a common intermediate language. It differentiates custom program logic from known library code through signature-based identification and provides utilities for binary symbol demangling to restore human-readable n

RetDec is a reverse engineering framework and static binary analysis tool. Its primary purpose is to function as an LLVM-based machine code decompiler that translates binary machine code from multiple architectures into high-level C source code. The system employs a multi-stage lifting pipeline to recover program logic, using an intermediate representation to apply optimizations before emitting source code. It distinguishes itself through the ability to identify compilers and packers, perform executable unpacking, and reconstruct class hierarchies and original program structures. The framewo