Awesome GitHub RepositoriesReverse Engineering

Ghidra is a software reverse engineering suite designed to analyze compiled binaries and reconstruct program logic without access to original source code. It provides an interactive environment for disassembly and decompilation, utilizing a platform-independent intermediate representation to maintain consistency across diverse hardware architectures. The framework supports automated binary analysis through programmatic routines, enabling the investigation of complex code patterns and security indicators. The platform distinguishes itself through a modular architecture that allows for extensiv

Jadx is a comprehensive Java decompilation suite designed to transform compiled binary application files into readable source code. It functions as a static analysis workbench, providing a graphical interface for navigating, searching, and inspecting the internal logic of complex software packages. By utilizing a bytecode-to-Java pipeline, the project reconstructs high-level logical structures from low-level binary instructions, making it a primary tool for Android application reverse engineering. The project distinguishes itself through a sophisticated control flow reconstruction engine and

dnSpy is a specialized toolset for the reverse engineering, analysis, and modification of compiled .NET binaries. It functions as a decompiler that converts assemblies back into readable high-level source code, an assembly editor for modifying bytecode and metadata, and a debugger for inspecting compiled binaries. The project integrates a hex editor specifically for inspecting and modifying raw bytes and Common Intermediate Language structures. It allows for the direct modification of binary contents to change application behavior without requiring the original project source files. The tool

radare2 is a reverse engineering framework and binary analysis toolset. It functions as a multi-architecture disassembler, low-level binary debugger, and hexadecimal editor for inspecting executable structures and interpreting machine code when original source files are unavailable. The framework provides capabilities for decompiling machine instructions, performing symbolic analysis, and diffing binary files to identify structural changes across versions. It also includes a digital forensic analyzer and disk analyzer for browsing filesystem formats in userland. The toolset supports binary p

Radare2 is a comprehensive framework for reverse engineering and analyzing compiled software. It provides a command-line environment designed for disassembling, debugging, and patching binary executables across a wide range of processor architectures and operating systems. The system distinguishes itself through a modular, plugin-based architecture that supports cross-platform analysis and automated workflows. It utilizes memory-mapped file access to enable efficient structural inspection and modification of binaries without requiring full file loads. By lifting machine instructions into a un

Cutter is a binary analysis platform and graphical user interface for the Rizin reverse engineering framework. It provides an environment for analyzing the internal logic and data structures of compiled binaries through integrated disassembly and visualization. The platform supports a containerized deployment model to provide isolated environments for binary analysis, which is used to examine suspicious binaries without risking the host system. It is an extensible security tool that allows for the addition of custom analysis capabilities and visualizers via native plugins and scripts. The to

Binwalk is a firmware analysis tool and binary data carver used to identify and extract embedded files and data segments from binary images. It functions as an embedded file extractor and data entropy analyzer to retrieve fragments from binary blobs when original file system structures are missing. The tool employs signature-based pattern matching and linear byte-stream scanning to detect known byte sequences and isolate hidden files. It uses sliding-window entropy analysis to locate regions of a file that are compressed or encrypted. The system supports recursive file carving, utilizing heu

Z3 is an automated theorem prover and satisfiability modulo theories solver designed to determine the validity of complex logical formulas. It functions as a formal verification framework, enabling the systematic checking of hardware and software system specifications against defined logical constraints to identify inconsistencies or design flaws. The engine distinguishes itself through a combination of theory-specific decision procedures and symbolic execution capabilities. It employs conflict-driven clause learning and backtracking search algorithms to prune search spaces, while maintaining

pwndbg is a GDB plugin and binary analysis framework designed for reverse engineering, exploit development, and low-level program analysis. It extends the core functionality of the debugger to provide advanced memory inspection and automation tools. The project distinguishes itself with specialized capabilities for heap analysis across glibc, jemalloc, and musl, as well as a comprehensive kernel debugging toolkit for inspecting Linux kernel tasks and slab allocators. It includes an integrated ROP gadget searcher for constructing exploit chains and an LLM-powered debugging assistant that provi

Angr is a binary analysis framework and static analysis tool used for reverse engineering compiled binaries. It serves as a binary decompiler and a lifting platform that translates machine code into a common intermediate representation to enable cross-architecture analysis. The framework integrates a symbolic execution engine and constraint solvers to determine the inputs required to reach specific program states. It also employs untrusted code sandboxing to isolate guest code from the host environment during analysis. Its capabilities cover control flow and data flow analysis, including the

Objection is a dynamic instrumentation framework and runtime exploration toolkit for mobile application security analysis. It provides a command-line interface to interact with the memory and state of iOS and Android applications during active execution, serving as a toolkit for runtime analysis and security testing. The project distinguishes itself by providing specialized capabilities to bypass common mobile security controls, including SSL pinning, biometric authentication, and root or jailbreak detection. It enables the extraction of sensitive credentials and data from secure storage syst

Capstone is a multi-architecture disassembly framework and binary translation system. It converts binary machine code into human-readable assembly instructions for a wide variety of hardware instruction set architectures and virtual machines. The framework supports a diverse range of targets, including x86, ARM, RISC-V, and MIPS, as well as virtual machine environments like WebAssembly and the Ethereum Virtual Machine. It functions as an instruction analysis tool capable of extracting granular decomposition data and semantic information from disassembled code. The engine is designed for low-

GEF is a Python-based extension for GDB that serves as a framework for binary analysis, exploit development, and low-level debugging. It functions as a dynamic analysis extension designed to assist in reverse engineering workflows and malware analysis by enhancing the debugger's ability to inspect process state and memory. The project is distinguished by its specialized heap analysis tools, which allow for the inspection of glibc heap arenas, bins, and chunks to detect memory corruption. It also provides a dedicated toolkit for exploit development, including cyclic pattern generation for offs

Peda est une suite d'outils de sécurité et un framework de développement d'exploits conçus pour l'analyse binaire, l'automatisation de débogueur et l'inspection de la mémoire. Il fonctionne comme un ensemble de scripts Python qui étendent un débogueur pour automatiser l'analyse des fichiers compilés et l'inspection de la mémoire des processus. Le projet fournit des utilitaires spécialisés pour la recherche sur la corruption de mémoire, y compris un utilitaire de génération de payload pour créer des motifs cycliques afin de découvrir les dépassements de tampon (buffer overflows) et un chercheur de gadgets pour localiser les séquences de programmation orientée retour (ROP) au sein des binaires. Il se distingue en offrant un outil de visualisation qui transforme les données brutes des registres, du désassemblage et de la mémoire en texte codé par couleur pour simplifier l'analyse des états du CPU. Le framework couvre un large éventail de capacités, notamment l'analyse de sécurité binaire pour détecter les protections, le scan de mémoire par expression régulière et la capacité de mapper les environnements de processus directement depuis le noyau système. Il inclut également des outils pour modifier les adresses mémoire et générer des templates de shellcode.

Reverse engineering and pentesting for Android applications

Triton is a dynamic binary analysis framework designed to automate reverse engineering. It functions as a multi-architecture CPU emulator, an SMT-based symbolic execution engine, and a dynamic taint analysis tool. The framework translates raw machine instructions into abstract syntax trees, allowing it to represent binary program logic as a structured intermediate representation. This allows the system to map multiple hardware instruction sets to a single analysis framework and translate machine instructions into mathematical formulas for solving constraints. Its capabilities cover the simul

ScyllaHide est un plugin de contournement d'anti-débogage et un outil de rétro-ingénierie conçu pour masquer un débogueur à une application cible. Il fonctionne comme une bibliothèque de hooking d'API en mode utilisateur et un framework d'injection de DLL qui empêche les programmes de se détecter et de se fermer lorsqu'ils sont analysés. Le projet permet l'analyse de logiciels malveillants et l'étude de logiciels protégés en neutralisant les défenses de sécurité. Il y parvient en interceptant et en modifiant les réponses des bibliothèques système pour tromper les applications sur leur environnement d'exécution. L'utilitaire emploie plusieurs méthodes techniques pour maintenir la furtivité, notamment le hooking d'API inline, le proxying d'appels système et le patching du bloc d'environnement de processus (PEB). Il gère également les traps en mode utilisateur et utilise la redirection de bibliothèques dynamiques pour filtrer les réponses d'API sensibles.

Plasma is an interactive disassembler for x86/ARM/MIPS. It can generates indented pseudo-code with colored syntax.

Plasma is an interactive disassembler for x86/ARM/MIPS. It can generates indented pseudo-code with colored syntax.

edb is a cross-platform AArch32/x86/x86-64 debugger.