Awesome GitHub RepositoriesBinary Instruction Patching

pwndbg is a GDB plugin and binary analysis framework designed for reverse engineering, exploit development, and low-level program analysis. It extends the core functionality of the debugger to provide advanced memory inspection and automation tools. The project distinguishes itself with specialized capabilities for heap analysis across glibc, jemalloc, and musl, as well as a comprehensive kernel debugging toolkit for inspecting Linux kernel tasks and slab allocators. It includes an integrated ROP gadget searcher for constructing exploit chains and an LLM-powered debugging assistant that provi

DuckStation is a high-performance PlayStation 1 emulator that simulates the original console's hardware logic and CPU and GPU on modern computer systems. It functions as a console hardware emulator, disc image loader, and game state manager to execute original games and preserve retro software. The project differentiates itself through a game graphics upscaler that improves visual clarity using texture filtering, geometry precision corrections, and custom shader chains. It also features advanced memory manipulation tools for layered patch injection and the application of community cheat codes

Open-Shell-Menu is a Windows shell extension and UI restorer designed to replace modern system interfaces with traditional styles. It functions as a start menu replacement and a customization tool for the Windows file manager and other system applications. The project restores legacy hierarchical navigation to the start menu and reinstates classic visual elements, such as traditional title bars and copy dialogs. It specifically targets the restoration of legacy toolbars and status bars within the file manager and introduces traditional interface elements to web browser windows.

GEF is a Python-based extension for GDB that serves as a framework for binary analysis, exploit development, and low-level debugging. It functions as a dynamic analysis extension designed to assist in reverse engineering workflows and malware analysis by enhancing the debugger's ability to inspect process state and memory. The project is distinguished by its specialized heap analysis tools, which allow for the inspection of glibc heap arenas, bins, and chunks to detect memory corruption. It also provides a dedicated toolkit for exploit development, including cyclic pattern generation for offs

N64Recomp is a static recompiler and binary-to-C translator designed to convert Nintendo 64 machine code and MIPS architecture binaries into C source code. This system functions as a game console decompiler that enables the native execution of legacy binaries on modern platforms by eliminating the need for runtime interpreters. The project distinguishes itself by translating specialized RSP microcode into executable source code to replace traditional microcode emulation. It employs a system of relocation macros and lookup tables to resolve relocatable memory overlays and dynamic program secti

Zelda64Recomp is a native game recompilation project that translates legacy binary machine code into modern machine code. It functions as a native hardware port and a static recompiled binary, executing original game logic directly on modern CPUs and GPUs to run without an emulator. The project serves as a moddable game engine, providing a framework to apply community texture packs and code patches to the recompiled title. It includes native hardware porting capabilities that remove emulator overhead to improve stability and frame rate control. The software covers retro game modernization th

This project is an Xcode runtime code injector and developer productivity tool. It enables the injection of Swift and Objective-C code changes into a running application without requiring a process restart, functioning as a hot module replacement tool for iOS development. The tool provides a dynamic UI debugger for reloading storyboards and tuning visual parameters in real time. It allows for the recompilation of individual classes and the binding of new implementations into a live process, avoiding full project rebuilds. The system covers runtime injection capabilities, including automated

Luma3DS is a custom firmware for the Nintendo 3DS that removes factory restrictions to enable the execution of unsigned homebrew and game modifications. It functions as a kernel-level system extension that hooks system calls to bypass hardware limitations and introduce new operating system capabilities. The project serves as a homebrew payload loader, using boot-time mechanisms to launch third-party software and custom firmware versions. It also provides a game modding framework capable of patching executable code and intercepting file requests to load custom assets and modified data. The en

Detours is a library for intercepting Win32 API calls and redirecting function calls at runtime on Windows, enabling binary-level instrumentation without requiring access to the original source code. It functions as an API hooking library and binary instrumentation toolkit, allowing developers to monitor or modify the behavior of compiled Windows binaries by hooking into their function execution paths. The project achieves this through detour-based function interception, where the first few instructions of a target function are replaced with a jump to a user-supplied detour function, while pr

A True Instrumentable Binary Emulation Framework

Elder driver Xposed Framework.

Dobby एक डायनामिक फंक्शन हुकिंग फ्रेमवर्क और बाइनरी इंस्ट्रूमेंटेशन टूल है, जिसे कंपाइल की गई बाइनरी में फंक्शन कॉल्स को इंटरसेप्ट और रीडायरेक्ट करने के लिए डिज़ाइन किया गया है। यह एक क्रॉस-प्लेटफ़ॉर्म और क्रॉस-आर्किटेक्चर लाइब्रेरी है जो विभिन्न ऑपरेटिंग सिस्टम और CPU आर्किटेक्चर पर प्रोग्राम के निष्पादन प्रवाह (execution flow) को संशोधित करने के लिए एक एकीकृत इंटरफ़ेस प्रदान करती है। यह लाइब्रेरी लाइव प्रोसेस में कस्टम हैंडलर इंजेक्ट करके लो-लेवल बाइनरी इंस्ट्रूमेंटेशन और रनटाइम एप्लिकेशन इंस्ट्रूमेंटेशन को सक्षम बनाती है। इसका उपयोग सॉफ्टवेयर रिवर्स इंजीनियरिंग में इंटरनल फंक्शन्स को हुक करके रियल-टाइम डेटा फ्लो और लॉजिक को ऑब्जर्व करने के लिए किया जाता है। यह फ्रेमवर्क बाइनरी पैचिंग, रनटाइम सिंबल रिज़ॉल्यूशन और डायनामिक ट्रैम्पोलिन जनरेशन को कवर करता है। यह प्लेटफ़ॉर्म-विशिष्ट मेमोरी प्रोटेक्शन को मैनेज करता है और इंस्ट्रक्शन-आधारित हुकिंग के माध्यम से निष्पादन को रीडायरेक्ट करने के लिए सामान्य हुक अनुरोधों को आर्किटेक्चर-विशिष्ट ऑपकोड (opcodes) में मैप करता है।

LoadLibrary is a binary instrumentation framework that loads and executes Windows PE/COFF DLLs natively within Linux processes. It provides a cross-platform binary execution layer that maps Windows portable executable files into Linux memory, resolving imports and relocations so that exported functions can be called as if they were native Linux library routines. The framework enables runtime interception and modification of Windows DLL function behavior, including redirecting API calls to Linux-native implementations through a binary patching hook engine. It includes a code coverage auditor t

WAuxiliary_Public is a dynamic code instrumentation framework and application plugin framework designed to intercept and alter the execution flow of compiled applications. It functions as a process injection toolkit and software reverse engineering tool, enabling the injection of custom logic into active application memory spaces to extend functionality without requiring original source code. The framework specifically provides capabilities for extending the WeChat desktop client. It achieves this through runtime process injection and software reverse engineering to modify internal operations

This project provides configuration data structures containing build-specific memory offsets and patch codes required to activate remote desktop services. It serves as a registry of parameters and patch sets used to bypass remote desktop restrictions across various operating system builds. The repository specifically focuses on updating configuration files for the RDP Wrapper library. This ensures compatibility with new operating system builds, enabling remote desktop connectivity on editions that do not natively support the feature. The project covers system-level configuration for remote d

OffensiveNim is a red teaming framework and post-exploitation toolkit developed in Nim. It provides a collection of low-level primitives and a Windows API wrapper designed for offensive security operations, including malware development and shellcode loading. The project focuses on evasion and obfuscation through techniques such as API unhooking, direct system calls, and anti-debugging mechanisms. It features diverse payload delivery methods, including reflective binary loading, the execution of .NET assemblies via CLR hosting, and various shellcode injection techniques using fibers, COM obje

Nexmon is a suite of operational tools designed for firmware patching, ROM extraction, frame injection, and enabling monitor mode on wireless hardware. It provides utilities to modify wireless chip firmware to unlock low-level hardware capabilities not supported by official drivers. The project enables the activation of monitor mode for capturing raw network packets with radiotap headers and allows for the transmission of custom-crafted wireless frames. It includes tools for dumping the read-only memory of wireless chips to facilitate reverse engineering and analysis of hardware behavior. Th

PS2Recomp is a static recompiler for PlayStation 2 that translates machine instructions from executable binaries into source code to enable execution on modern hardware. It functions as a binary-to-source translator and a binary analysis tool designed to facilitate the preservation of legacy software. The project distinguishes itself through a hardware emulation runtime that manages memory models and register contexts, combined with a static binary patcher for replacing raw instructions and overriding function bindings. It utilizes a specialized vector unit instruction execution system that m

Geode is a game modification SDK and mod loader for Geometry Dash. It functions as a hooking engine and UI framework that allows for the injection of dynamic libraries to alter game behavior and add new features. The toolkit distinguishes itself through a centralized mod compatibility manager and hook registry that tracks active modifications to prevent logic conflicts and application crashes. It utilizes a trampoline-based hooking engine to redirect game function calls while preserving native call stacks, alongside a dedicated UI framework for rendering custom popups and interface components