Awesome GitHub RepositoriesBinary Instruction Patching

pwndbg is a GDB plugin and binary analysis framework designed for reverse engineering, exploit development, and low-level program analysis. It extends the core functionality of the debugger to provide advanced memory inspection and automation tools. The project distinguishes itself with specialized capabilities for heap analysis across glibc, jemalloc, and musl, as well as a comprehensive kernel debugging toolkit for inspecting Linux kernel tasks and slab allocators. It includes an integrated ROP gadget searcher for constructing exploit chains and an LLM-powered debugging assistant that provi

DuckStation is a high-performance PlayStation 1 emulator that simulates the original console's hardware logic and CPU and GPU on modern computer systems. It functions as a console hardware emulator, disc image loader, and game state manager to execute original games and preserve retro software. The project differentiates itself through a game graphics upscaler that improves visual clarity using texture filtering, geometry precision corrections, and custom shader chains. It also features advanced memory manipulation tools for layered patch injection and the application of community cheat codes

Open-Shell-Menu is a Windows shell extension and UI restorer designed to replace modern system interfaces with traditional styles. It functions as a start menu replacement and a customization tool for the Windows file manager and other system applications. The project restores legacy hierarchical navigation to the start menu and reinstates classic visual elements, such as traditional title bars and copy dialogs. It specifically targets the restoration of legacy toolbars and status bars within the file manager and introduces traditional interface elements to web browser windows.

GEF is a Python-based extension for GDB that serves as a framework for binary analysis, exploit development, and low-level debugging. It functions as a dynamic analysis extension designed to assist in reverse engineering workflows and malware analysis by enhancing the debugger's ability to inspect process state and memory. The project is distinguished by its specialized heap analysis tools, which allow for the inspection of glibc heap arenas, bins, and chunks to detect memory corruption. It also provides a dedicated toolkit for exploit development, including cyclic pattern generation for offs

N64Recomp is a static recompiler and binary-to-C translator designed to convert Nintendo 64 machine code and MIPS architecture binaries into C source code. This system functions as a game console decompiler that enables the native execution of legacy binaries on modern platforms by eliminating the need for runtime interpreters. The project distinguishes itself by translating specialized RSP microcode into executable source code to replace traditional microcode emulation. It employs a system of relocation macros and lookup tables to resolve relocatable memory overlays and dynamic program secti

Zelda64Recomp is a native game recompilation project that translates legacy binary machine code into modern machine code. It functions as a native hardware port and a static recompiled binary, executing original game logic directly on modern CPUs and GPUs to run without an emulator. The project serves as a moddable game engine, providing a framework to apply community texture packs and code patches to the recompiled title. It includes native hardware porting capabilities that remove emulator overhead to improve stability and frame rate control. The software covers retro game modernization th

This project is an Xcode runtime code injector and developer productivity tool. It enables the injection of Swift and Objective-C code changes into a running application without requiring a process restart, functioning as a hot module replacement tool for iOS development. The tool provides a dynamic UI debugger for reloading storyboards and tuning visual parameters in real time. It allows for the recompilation of individual classes and the binding of new implementations into a live process, avoiding full project rebuilds. The system covers runtime injection capabilities, including automated

Luma3DS is a custom firmware for the Nintendo 3DS that removes factory restrictions to enable the execution of unsigned homebrew and game modifications. It functions as a kernel-level system extension that hooks system calls to bypass hardware limitations and introduce new operating system capabilities. The project serves as a homebrew payload loader, using boot-time mechanisms to launch third-party software and custom firmware versions. It also provides a game modding framework capable of patching executable code and intercepting file requests to load custom assets and modified data. The en

Detours is a library for intercepting Win32 API calls and redirecting function calls at runtime on Windows, enabling binary-level instrumentation without requiring access to the original source code. It functions as an API hooking library and binary instrumentation toolkit, allowing developers to monitor or modify the behavior of compiled Windows binaries by hooking into their function execution paths. The project achieves this through detour-based function interception, where the first few instructions of a target function are replaced with a jump to a user-supplied detour function, while pr

A True Instrumentable Binary Emulation Framework

Elder driver Xposed Framework.

Dobby est un framework de hooking de fonction dynamique et un outil d'instrumentation binaire conçu pour intercepter et rediriger les appels de fonction dans des binaires compilés. Il sert de bibliothèque multiplateforme et multi-architecture qui fournit une interface unifiée pour modifier le flux d'exécution des programmes à travers différents systèmes d'exploitation et architectures CPU. La bibliothèque permet l'instrumentation binaire de bas niveau et l'instrumentation d'application au moment de l'exécution en injectant des gestionnaires personnalisés dans des processus vivants. Elle est utilisée pour l'ingénierie inverse logicielle afin d'observer le flux de données en temps réel et la logique en hookant des fonctions internes. Le framework couvre le patch binaire, la résolution de symboles au moment de l'exécution et la génération de trampolines dynamiques. Il gère les protections mémoire spécifiques à la plateforme et mappe les requêtes de hook génériques en opcodes spécifiques à l'architecture pour rediriger l'exécution via un hooking basé sur les instructions.

LoadLibrary is a binary instrumentation framework that loads and executes Windows PE/COFF DLLs natively within Linux processes. It provides a cross-platform binary execution layer that maps Windows portable executable files into Linux memory, resolving imports and relocations so that exported functions can be called as if they were native Linux library routines. The framework enables runtime interception and modification of Windows DLL function behavior, including redirecting API calls to Linux-native implementations through a binary patching hook engine. It includes a code coverage auditor t

WAuxiliary_Public is a dynamic code instrumentation framework and application plugin framework designed to intercept and alter the execution flow of compiled applications. It functions as a process injection toolkit and software reverse engineering tool, enabling the injection of custom logic into active application memory spaces to extend functionality without requiring original source code. The framework specifically provides capabilities for extending the WeChat desktop client. It achieves this through runtime process injection and software reverse engineering to modify internal operations

This project provides configuration data structures containing build-specific memory offsets and patch codes required to activate remote desktop services. It serves as a registry of parameters and patch sets used to bypass remote desktop restrictions across various operating system builds. The repository specifically focuses on updating configuration files for the RDP Wrapper library. This ensures compatibility with new operating system builds, enabling remote desktop connectivity on editions that do not natively support the feature. The project covers system-level configuration for remote d

OffensiveNim is a red teaming framework and post-exploitation toolkit developed in Nim. It provides a collection of low-level primitives and a Windows API wrapper designed for offensive security operations, including malware development and shellcode loading. The project focuses on evasion and obfuscation through techniques such as API unhooking, direct system calls, and anti-debugging mechanisms. It features diverse payload delivery methods, including reflective binary loading, the execution of .NET assemblies via CLR hosting, and various shellcode injection techniques using fibers, COM obje

Nexmon is a suite of operational tools designed for firmware patching, ROM extraction, frame injection, and enabling monitor mode on wireless hardware. It provides utilities to modify wireless chip firmware to unlock low-level hardware capabilities not supported by official drivers. The project enables the activation of monitor mode for capturing raw network packets with radiotap headers and allows for the transmission of custom-crafted wireless frames. It includes tools for dumping the read-only memory of wireless chips to facilitate reverse engineering and analysis of hardware behavior. Th

PS2Recomp is a static recompiler for PlayStation 2 that translates machine instructions from executable binaries into source code to enable execution on modern hardware. It functions as a binary-to-source translator and a binary analysis tool designed to facilitate the preservation of legacy software. The project distinguishes itself through a hardware emulation runtime that manages memory models and register contexts, combined with a static binary patcher for replacing raw instructions and overriding function bindings. It utilizes a specialized vector unit instruction execution system that m

Geode is a game modification SDK and mod loader for Geometry Dash. It functions as a hooking engine and UI framework that allows for the injection of dynamic libraries to alter game behavior and add new features. The toolkit distinguishes itself through a centralized mod compatibility manager and hook registry that tracks active modifications to prevent logic conflicts and application crashes. It utilizes a trampoline-based hooking engine to redirect game function calls while preserving native call stacks, alongside a dedicated UI framework for rendering custom popups and interface components

HDiffPatch is a cross-platform library and command-line utility designed for generating and applying binary differential updates. It enables the creation of compact patch files by calculating the differences between binary files or entire directory structures, facilitating efficient data synchronization and software distribution. The project distinguishes itself through a low-memory patching engine specifically engineered for hardware with restricted resources. By utilizing streaming buffer techniques and suffix-sorting algorithms, it maintains a constant memory footprint during operations, m