Awesome GitHub RepositoriesDecompilers

Jadx is a comprehensive Java decompilation suite designed to transform compiled binary application files into readable source code. It functions as a static analysis workbench, providing a graphical interface for navigating, searching, and inspecting the internal logic of complex software packages. By utilizing a bytecode-to-Java pipeline, the project reconstructs high-level logical structures from low-level binary instructions, making it a primary tool for Android application reverse engineering. The project distinguishes itself through a sophisticated control flow reconstruction engine and

dnSpy is a specialized toolset for the reverse engineering, analysis, and modification of compiled .NET binaries. It functions as a decompiler that converts assemblies back into readable high-level source code, an assembly editor for modifying bytecode and metadata, and a debugger for inspecting compiled binaries. The project integrates a hex editor specifically for inspecting and modifying raw bytes and Common Intermediate Language structures. It allows for the direct modification of binary contents to change application behavior without requiring the original project source files. The tool

dnSpy is a desktop application designed for the analysis, debugging, and modification of compiled .NET assemblies. It functions as an assembly analysis suite and decompiler, translating binary instruction streams back into readable source code to facilitate reverse engineering when original source files are unavailable. The tool distinguishes itself through an integrated binary patching engine and metadata editor, which allow for the direct modification of executable logic and internal metadata tables. It supports in-process debugging instrumentation, enabling users to inject runtime hooks, s

ILSpy is a .NET decompiler and binary analyzer designed to convert compiled .NET assemblies back into readable C# source code. It functions as a metadata explorer and a common intermediate language viewer, enabling the analysis of compiled code and the execution of reverse engineering workflows. The project distinguishes itself through specialized translation capabilities, such as converting compiled binary XML (BAML) back into human-readable XAML for user interface analysis. It also provides tools for inspecting native machine code and extracting metadata from program database (PDB) files.

radare2 is a reverse engineering framework and binary analysis toolset. It functions as a multi-architecture disassembler, low-level binary debugger, and hexadecimal editor for inspecting executable structures and interpreting machine code when original source files are unavailable. The framework provides capabilities for decompiling machine instructions, performing symbolic analysis, and diffing binary files to identify structural changes across versions. It also includes a digital forensic analyzer and disk analyzer for browsing filesystem formats in userland. The toolset supports binary p

This project is a Java bytecode reverse engineering suite that functions as a disassembler, decompiler, and editor for Java class files and Android APK binaries. It provides tools to transform compiled bytecode into assembly instructions or readable source code. The toolset supports Android APK analysis and Java binary patching, allowing for the modification of source code or bytecode and subsequent recompilation into functional binaries. It includes capabilities for removing Java obfuscation and performing malware analysis through the detection of malicious code patterns. The system incorpo

This project is a desktop application designed for the reverse engineering and inspection of compiled Java code. It functions as a graphical interface that translates Java bytecode back into readable source code, allowing users to examine the internal logic of class files and archives when original source files are unavailable. The tool provides a structured environment for navigating complex file hierarchies, including nested archives like JAR and WAR files. By maintaining an in-memory representation of loaded classes, it enables rapid searching and cross-referencing of code elements. The ap

Matrix is a suite of mobile application performance management and analysis tools. It provides a plugin-based monitoring system for capturing crashes, lags, and memory leaks, alongside a static binary auditor for reducing installation package size and a bytecode instrumentation tool for performance tracking. The project distinguishes itself through native memory debugging and a SQLite query linter that identifies inefficient database patterns. It employs native interception techniques to detect memory leaks and heap corruption without requiring source code recompilation, and uses a custom run

Clair is a container image vulnerability scanner and security analyzer. It performs static analysis of container images by matching package contents against vulnerability databases to identify security risks across different package formats and architectures. The project functions as both an image indexer and a vulnerability database manager. It processes container layers into intermediate representations to enable fast security lookups and synchronizes security metadata from multiple external sources to maintain a local registry. Capability areas include continuous security monitoring, whic

Sn1per is a vulnerability management platform and penetration testing orchestrator designed to automate reconnaissance, vulnerability scanning, and exploit verification. It functions as a dockerized security toolkit that coordinates multiple tools into a unified automated pipeline to identify security flaws across network and web assets. The platform features an attack surface manager for discovering internet-facing assets through OSINT, DNS enumeration, and certificate transparency. It distinguishes itself with an AI-powered security analyzer that uses large language models to summarize scan

pwndbg is a GDB plugin and binary analysis framework designed for reverse engineering, exploit development, and low-level program analysis. It extends the core functionality of the debugger to provide advanced memory inspection and automation tools. The project distinguishes itself with specialized capabilities for heap analysis across glibc, jemalloc, and musl, as well as a comprehensive kernel debugging toolkit for inspecting Linux kernel tasks and slab allocators. It includes an integrated ROP gadget searcher for constructing exploit chains and an LLM-powered debugging assistant that provi

dnSpy is a specialized suite of tools for the reverse engineering of .NET assemblies, functioning as a decompiler, assembly editor, and debugger. It translates compiled intermediate language back into high-level source code and provides an execution environment for stepping through compiled binaries to inspect runtime state without the original source files. The project includes a BAML decompiler that converts binary application markup language into a disassembled format and translates it into extensible markup language for user interface analysis. It also functions as a binary analysis tool

Angr is a binary analysis framework and static analysis tool used for reverse engineering compiled binaries. It serves as a binary decompiler and a lifting platform that translates machine code into a common intermediate representation to enable cross-architecture analysis. The framework integrates a symbolic execution engine and constraint solvers to determine the inputs required to reach specific program states. It also employs untrusted code sandboxing to isolate guest code from the host environment during analysis. Its capabilities cover control flow and data flow analysis, including the

RetDec is a reverse engineering framework and static binary analysis tool. Its primary purpose is to function as an LLVM-based machine code decompiler that translates binary machine code from multiple architectures into high-level C source code. The system employs a multi-stage lifting pipeline to recover program logic, using an intermediate representation to apply optimizations before emitting source code. It distinguishes itself through the ability to identify compilers and packers, perform executable unpacking, and reconstruct class hierarchies and original program structures. The framewo

Retdec is an LLVM-based machine code decompiler and static binary analysis tool designed for binary reverse engineering. It translates binary executable code into high-level representations to facilitate the reconstruction of program logic from compiled machine code. The system utilizes a retargetable frontend architecture and a multi-stage lifting pipeline to convert raw bytes into a common intermediate language. It differentiates custom program logic from known library code through signature-based identification and provides utilities for binary symbol demangling to restore human-readable n

Binaryen is a WebAssembly compiler toolchain and optimizer designed to transform, validate, and shrink binary modules. It provides a comprehensive intermediate representation framework that converts binary code into a single-assignment form to enable advanced program analysis and code transformation. The project includes a specialized transformation engine that applies iterative optimization passes to increase execution speed and reduce binary size. Additionally, it functions as a transpiler that translates WebAssembly binary modules into executable JavaScript for environments that lack nativ

This project is a version-controlled Git archive and software archaeology dataset containing the continuous evolution of Unix source code from 1970 to the present. It serves as a chronological record of system history, synthesizing a versioned code timeline from disparate historical snapshots. The archive enables longitudinal software analysis by reconstructing a sequence of commits and merges from fragmented releases. This allows for the tracking of system evolution and the attribution of specific lines of code to original authors through synthesized version control metadata. The dataset co

Ce projet est un projet de décompilation de jeu consistant en une base de code source C reconstruite et les systèmes utilisés pour la reconstruction binaire. Il fournit une version lisible par l'homme d'un titre de jeu commercial créé par analyse statique et dynamique pour faciliter l'étude technique et la modification. Le projet utilise un environnement de build conteneurisé pour assurer une compilation reproductible et des versions de toolchain cohérentes à travers différents systèmes d'exploitation hôtes. Il inclut un reconstructeur de binaire de jeu qui traduit le code machine original en code source et un système pour compiler la base de code en plusieurs binaires régionaux et spécifiques à la plateforme. La toolchain couvre des pipelines de compilation croisée et la gestion des variantes de build, utilisant une toolchain GCC spécifique pour cibler des architectures matérielles différentes de l'hôte. Des capacités supplémentaires incluent la génération de documentation technique pilotée par métadonnées et des shells de conteneurs interactifs pour l'analyse manuelle et le débogage.

android-common is a collection of shared utility components and framework libraries for Android development. It provides specialized toolkits for reverse engineering, system utility management, data caching, and high-performance user interface components. The project includes a reverse engineering toolkit for inspecting application internals through package decompilation and manifest data extraction. It also features a system utility toolkit for managing file operations and executing shell commands within the Android operating system. The library covers several capability areas, including da

Sbt est un outil de construction JVM et un système de gestion de dépendances conçu pour Scala et Java. Il fonctionne comme un orchestrateur de construction multi-projets qui gère la compilation du code source, résout les bibliothèques externes à partir de dépôts distants et emballe les binaires pour la distribution. Le projet se distingue par son système de construction interactif, qui fournit une boucle de lecture-évaluation-impression (REPL) pour l'inspection de l'état en temps réel et l'exécution des tâches. Il utilise un modèle d'exécution basé sur un graphe de dépendances pour traiter les tâches et maintient un magasin clé-valeur typé pour la configuration dynamique de la construction. Ses capacités couvrent l'automatisation de la construction JVM avec recompilation incrémentale, l'organisation modulaire des projets et l'exécution automatisée des tests. Le système prend également en charge la compilation multi-versions, la publication d'artefacts vers le stockage cloud et un modèle de plugin extensible pour ajouter une logique de construction personnalisée.