Awesome GitHub RepositoriesReverse Engineering

This project provides a desktop-based interface for remote control and screen mirroring of Android devices. It functions by establishing a persistent, multiplexed communication channel over the Android Debug Bridge, allowing for the transmission of raw binary data streams between a host computer and a connected mobile device. The tool distinguishes itself by injecting a lightweight binary into the mobile runtime to access system-level APIs for direct screen buffer capture and input event injection. By translating desktop mouse and keyboard signals into native Linux kernel events, it enables r

Ghidra is a software reverse engineering suite designed to analyze compiled binaries and reconstruct program logic without access to original source code. It provides an interactive environment for disassembly and decompilation, utilizing a platform-independent intermediate representation to maintain consistency across diverse hardware architectures. The framework supports automated binary analysis through programmatic routines, enabling the investigation of complex code patterns and security indicators. The platform distinguishes itself through a modular architecture that allows for extensiv

Jadx is a comprehensive Java decompilation suite designed to transform compiled binary application files into readable source code. It functions as a static analysis workbench, providing a graphical interface for navigating, searching, and inspecting the internal logic of complex software packages. By utilizing a bytecode-to-Java pipeline, the project reconstructs high-level logical structures from low-level binary instructions, making it a primary tool for Android application reverse engineering. The project distinguishes itself through a sophisticated control flow reconstruction engine and

This project is a graphical Windows debugger designed for the analysis and manipulation of compiled binary applications. It functions as a comprehensive binary analysis suite, providing a real-time environment for inspecting CPU registers, monitoring memory states, and tracing instruction execution to investigate system-level software behavior. The tool distinguishes itself through an event-driven debugging loop that allows for precise process control and state modification during runtime. It supports advanced analysis techniques, including hardware-breakpoint injection for monitoring memory

dnSpy is a specialized toolset for the reverse engineering, analysis, and modification of compiled .NET binaries. It functions as a decompiler that converts assemblies back into readable high-level source code, an assembly editor for modifying bytecode and metadata, and a debugger for inspecting compiled binaries. The project integrates a hex editor specifically for inspecting and modifying raw bytes and Common Intermediate Language structures. It allows for the direct modification of binary contents to change application behavior without requiring the original project source files. The tool

dnSpy is a desktop application designed for the analysis, debugging, and modification of compiled .NET assemblies. It functions as an assembly analysis suite and decompiler, translating binary instruction streams back into readable source code to facilitate reverse engineering when original source files are unavailable. The tool distinguishes itself through an integrated binary patching engine and metadata editor, which allow for the direct modification of executable logic and internal metadata tables. It supports in-process debugging instrumentation, enabling users to inject runtime hooks, s

ILSpy is a .NET decompiler and binary analyzer designed to convert compiled .NET assemblies back into readable C# source code. It functions as a metadata explorer and a common intermediate language viewer, enabling the analysis of compiled code and the execution of reverse engineering workflows. The project distinguishes itself through specialized translation capabilities, such as converting compiled binary XML (BAML) back into human-readable XAML for user interface analysis. It also provides tools for inspecting native machine code and extracting metadata from program database (PDB) files.

radare2 is a reverse engineering framework and binary analysis toolset. It functions as a multi-architecture disassembler, low-level binary debugger, and hexadecimal editor for inspecting executable structures and interpreting machine code when original source files are unavailable. The framework provides capabilities for decompiling machine instructions, performing symbolic analysis, and diffing binary files to identify structural changes across versions. It also includes a digital forensic analyzer and disk analyzer for browsing filesystem formats in userland. The toolset supports binary p

This project is a curated archive and cybersecurity research dataset of raw source code from various malware families. It serves as a malware analysis library designed to help researchers study the inner workings of different threats and identify attack patterns across multiple platforms and programming languages. The repository supports security research by providing raw text distribution of original source code. This allows for the study of platform vulnerabilities, threat intelligence gathering, and the development of security products and detection signatures. The collection is organized

UPX is a command-line utility designed to reduce the file size of compiled programs and shared libraries. It functions as an executable binary compressor that maintains the ability for files to run natively without requiring additional runtime dependencies or external decompression software. The tool operates by parsing executable headers and applying entropy-based compression to code segments. It achieves this by injecting a self-extracting stub into the binary, which facilitates in-place memory decompression during the initial execution phase. This process includes platform-specific binary

AssetStudio is a desktop application designed for browsing, inspecting, and extracting assets from proprietary game engine archive files. It provides a comprehensive interface for navigating complex file structures to identify, preview, and export individual media components such as textures, audio, and 3D meshes. The software distinguishes itself through its ability to parse and reconstruct serialized object hierarchies and script data. By resolving assembly dependencies and traversing internal metadata trees, it translates proprietary game data into standard industry formats, including supp

This project is a desktop application designed for the reverse engineering and inspection of compiled Java code. It functions as a graphical interface that translates Java bytecode back into readable source code, allowing users to examine the internal logic of class files and archives when original source files are unavailable. The tool provides a structured environment for navigating complex file hierarchies, including nested archives like JAR and WAR files. By maintaining an in-memory representation of loaded classes, it enables rapid searching and cross-referencing of code elements. The ap

PyInstaller is a cross-platform binary packager and application freezer that bundles Python scripts and their dependencies into standalone executables. It allows programs to be distributed and run on target operating systems without requiring a local installation of the Python interpreter. The tool functions as a standalone executable bundler, packaging the application with all necessary modules and libraries into a single file or folder. It includes integration for digital binary signing to satisfy operating system security requirements for distributed software. The system utilizes static a

Detect-It-Easy is a binary file identifier and analysis toolkit designed to determine file formats, compilers, and packers. It functions as a binary file identifier that utilizes signature matching and heuristic analysis to identify executable and archive formats. The project includes a custom file signature engine and a scriptable rule system for defining and applying detection logic to identify specific binary patterns. It features specialized detectors for Android packages, such as APK and DEX files, and a malware packer detector to identify protections, obfuscators, and virus families. T

Il2CppDumper is a reverse engineering tool that recovers original .NET assembly structure from Unity games compiled with il2cpp. It parses il2cpp binaries across multiple executable formats including ELF, Mach-O, PE, NSO, and WASM, and reconstructs the original DLL structure from embedded metadata tables, enabling decompilation and analysis of game code. The tool generates disassembler scripts for IDA, Ghidra, and Binary Ninja that apply recovered type definitions and structure layouts to the binary analysis. It also strips protection layers from memory-dumped libil2cpp.so files and simple PE

Angr is a binary analysis framework and static analysis tool used for reverse engineering compiled binaries. It serves as a binary decompiler and a lifting platform that translates machine code into a common intermediate representation to enable cross-architecture analysis. The framework integrates a symbolic execution engine and constraint solvers to determine the inputs required to reach specific program states. It also employs untrusted code sandboxing to isolate guest code from the host environment during analysis. Its capabilities cover control flow and data flow analysis, including the

Flare-VM एक Windows मैलवेयर एनालिसिस वातावरण है जिसमें इंस्टॉलेशन स्क्रिप्ट्स शामिल हैं जो वर्चुअल मशीन के प्रोविज़निंग को स्वचालित करती हैं। यह सुरक्षा अनुसंधान के लिए आवश्यक सिस्टम कॉन्फ़िगरेशन और वातावरण वेरिएबल्स के साथ-साथ डीकंपाइलर्स और डिबगर्स सहित रिवर्स इंजीनियरिंग टूल्स का एक व्यापक सूट प्रदान करती है। यह प्रोजेक्ट एक वर्चुअल मशीन इमेज ऑर्केस्ट्रेटर के रूप में कार्य करता है, जो विशेष एनालिसिस एप्लायंसेज के स्वचालित निर्माण, प्रबंधन और एक्सपोर्ट की अनुमति देता है। इसमें कॉन्फ़िगरेशन-ड्रिवन टूल चयन और कस्टम रजिस्ट्री संशोधनों व सिस्टम लेआउट परिभाषाओं के माध्यम से इंस्टॉलेशन लॉजिक को विस्तारित करने की क्षमता है। इस सिस्टम में होस्ट-ओनली मोड के माध्यम से बाहरी संचार को रोकने के लिए आइसोलेटेड नेटवर्क कॉन्फ़िगरेशन की क्षमताएं शामिल हैं। यह स्नैपशॉट-आधारित स्टेट मैनेजमेंट के माध्यम से एनालिसिस स्टेट्स के पूर्ण लाइफसाइकिल को भी प्रबंधित करता है, जिसमें स्नैपशॉट को सत्यापित एप्लायंस फ़ाइलों के रूप में साफ़ करने या एक्सपोर्ट करने की क्षमता शामिल है।

Android Classyshark is a binary analysis toolset designed to extract structural data from Android executable files. It functions as a bytecode viewer and binary XML parser to analyze compiled Java and Android binaries. The project converts binary XML files into readable formats for the inspection of application manifests, layouts, and resource files. It also provides the ability to analyze class interfaces, members, and dependency counts without requiring access to the original source code. The toolset supports static analysis and the export of binary information into plain text formats for

MBE is a security research educational resource providing binary exploitation courseware and a deployable CTF wargame environment. It functions as a structured curriculum of labs and materials designed for learning reverse engineering and memory corruption. The project provides containerized lab infrastructure and a binary analysis toolchain to ensure a controlled setting for vulnerability research. It utilizes isolated environments to deploy binary exploitation tasks, preventing interference and system instability. The system covers the provisioning of vulnerable environments through virtua