Open-source alternatives to Recaf

SpotBugs is a static analysis tool and bytecode analyzer for Java applications. It scans compiled class files to identify bugs, security vulnerabilities, and performance issues without executing the code. The system functions as both a bug detector and a static application security testing tool to locate logical errors and API misuse. The project distinguishes itself through a plugin-based detector architecture that allows the integration of external libraries to add custom detection rules. It provides specialized security auditing for vulnerabilities such as SQL injection, cross-site scripti

Simplify is an Android virtual machine sandbox, bytecode execution tracer, and static analysis framework. It serves as a Dalvik bytecode deobfuscator designed to recover readable code from binaries by simulating program behavior without a physical device. The project distinguishes itself by using execution graph analysis to resolve reflection calls and simplify obfuscated code through constant propagation and dead code removal. It employs multi-path execution simulation to track all possible conditional branch outcomes and maps instruction flow to identify constant values. The system covers

Fernflower is a Java bytecode decompiler and reverse engineering tool. It transforms compiled Java class files back into human-readable Java source code to reconstruct original program logic and variable names. The tool functions as a command line bytecode processor capable of batch processing Java archives and class files. It specifically handles obfuscated code analysis by renaming ambiguous identifiers and resolving naming conflicts to make the resulting source code easier to follow. The system employs static analysis to convert bytecode to source, utilizing debug information extraction t

JPEX Software is a comprehensive reverse engineering suite for SWF binary files, serving as an ActionScript decompiler and editor. It provides a toolkit for decompiling, analyzing, and modifying the internal structure of compiled Flash content, including the extraction of scripts and media assets. The project is distinguished by its ability to perform direct binary modification, allowing users to edit bytecode and replace embedded resources without reverting to high-level source code. It includes a runtime ActionScript bytecode debugger for variable inspection and call stack analysis, as well

de4dot is a .NET deobfuscator, unpacker, and assembly analysis tool. It is designed to remove obfuscation layers, restore metadata, and simplify bytecode control flow to transform protected binaries back into human-readable code. The project features specialized systems for decrypting strings and constants using both static and dynamic analysis. It identifies specific protection tools through pattern-based detection and strips anti-analysis protections, such as tamper detection and anti-debugging code. The tool provides a suite of reverse engineering capabilities, including binary wrapper un

This project is a desktop application designed for the reverse engineering and inspection of compiled Java code. It functions as a graphical interface that translates Java bytecode back into readable source code, allowing users to examine the internal logic of class files and archives when original source files are unavailable. The tool provides a structured environment for navigating complex file hierarchies, including nested archives like JAR and WAR files. By maintaining an in-memory representation of loaded classes, it enables rapid searching and cross-referencing of code elements. The ap

Deobfuscator is a static analysis and manipulation framework designed to inspect and modify compiled Java class files and bytecode instructions. It functions as a deobfuscator that simplifies and reverses obfuscated Java applications, alongside operating as a security runtime environment that isolates and executes untrusted or potentially malicious Java bytecode safely. The project processes class files through a sequence of custom transformation passes using visitor-based instruction parsing and a static class analysis engine that maps out class hierarchies and cross-references without dynam

Fernflower is a Java bytecode decompiler designed to convert compiled Java class files back into human-readable source code. It functions as a bytecode analysis tool that recovers original program logic and structure from compiled binaries. The project includes capabilities for obfuscated identifier resolution to rename ambiguous member elements, ensuring clear identifiers in the resulting source. These features support the analysis of obfuscated code, legacy code recovery, and Java malware analysis for security auditing. The system utilizes a structural analysis pipeline that includes contr

pycdc is a reverse engineering toolset that decompiles and disassembles compiled Python bytecode files back into readable source code. It parses .pyc file headers, reconstructs abstract syntax trees from bytecode instructions, and handles version-specific opcodes across Python versions 1.0 through 3.13 with endian-aware binary parsing. The tool recovers numeric constants, string literals, and marshalled Python objects from compiled bytecode, supporting both file-based and in-memory bytecode loading. It provides a human-readable disassembly listing of bytecode instructions alongside full sourc

Sodium is a Minecraft performance optimization project that replaces the default rendering engine to increase frame rates and reduce stutter. It functions as a game rendering modification that applies runtime patches to the engine to change how graphics are displayed. The project provides a customizable settings registry, allowing for the addition of new configuration options to the video menu so other extensions can integrate their own visual settings. The rendering system implements chunk-based culling logic and buffer-based geometry caching to minimize draw calls and reduce CPU overhead.

btrace is a Java dynamic tracing tool and instrumentation framework designed for real-time diagnostics. It enables the injection of monitoring code into running Java virtual machines to analyze behavior and diagnose processes without requiring an application restart. The platform features a dynamic probe engine for executing single-line debugging commands to print data and trace call stacks. It provides an extensible tracing framework that supports custom functionality and external integrations through isolated implementation modules. The system covers runtime performance monitoring, method

Objection is a dynamic instrumentation framework and runtime exploration toolkit for mobile application security analysis. It provides a command-line interface to interact with the memory and state of iOS and Android applications during active execution, serving as a toolkit for runtime analysis and security testing. The project distinguishes itself by providing specialized capabilities to bypass common mobile security controls, including SSL pinning, biometric authentication, and root or jailbreak detection. It enables the extraction of sensitive credentials and data from secure storage syst

Pinpoint is a distributed application performance management tool designed to trace requests and monitor metrics across large-scale distributed architectures. It functions as a request tracer, topology mapper, and JVM application monitor, providing a backend capable of collecting and visualizing trace data from OpenTelemetry compatible sources. The system distinguishes itself through a combination of bytecode-based instrumentation via a Java agent and topology-based visualization that renders live maps of service interconnections. It captures execution flow across asynchronous boundaries, suc

Byte Buddy is a runtime code generation and bytecode manipulation library for Java. It provides a fluent API for creating and modifying Java classes during execution, enabling developers to define class structures, methods, and fields programmatically without requiring a compiler or direct bytecode assembly. The library supports agent-based class transformation, allowing loaded classes to be modified during JVM startup or runtime through a Java agent that intercepts class loading. It offers bytecode-level method interception for fine-grained control over method behavior, annotation-based code

tModLoader is a modding framework and toolset designed for expanding game content and extending core game logic. It provides a polymorphic content API that allows for the creation of new items, NPCs, projectiles, and world assets through object-oriented inheritance. The project is distinguished by its advanced code modification capabilities, utilizing intermediate language bytecode patching and reflection-based private access to alter internal game behavior. It features a hot-reloading assembly runtime that enables developers to recompile and apply source code changes in real-time without res

Capstone is a multi-architecture disassembly framework and binary translation system. It converts binary machine code into human-readable assembly instructions for a wide variety of hardware instruction set architectures and virtual machines. The framework supports a diverse range of targets, including x86, ARM, RISC-V, and MIPS, as well as virtual machine environments like WebAssembly and the Ethereum Virtual Machine. It functions as an instruction analysis tool capable of extracting granular decomposition data and semantic information from disassembled code. The engine is designed for low-

Arthas is a Java diagnostic tool and runtime debugger designed for real-time troubleshooting of applications. It functions as a remote diagnostics agent that allows users to inspect the runtime state of a Java process, including its heap objects and classloader hierarchies, without requiring a process restart. The project distinguishes itself through advanced bytecode manipulation capabilities, enabling live class hotswapping and the modification of bytecode in running processes. It supports in-memory source compilation and runtime bytecode decompilation to verify and update logic instantly w

Detect-It-Easy is a binary file identifier and analysis toolkit designed to determine file formats, compilers, and packers. It functions as a binary file identifier that utilizes signature matching and heuristic analysis to identify executable and archive formats. The project includes a custom file signature engine and a scriptable rule system for defining and applying detection logic to identify specific binary patterns. It features specialized detectors for Android packages, such as APK and DEX files, and a malware packer detector to identify protections, obfuscators, and virus families. T

jvm-sandbox is a bytecode instrumentation framework and plugin container for the Java Virtual Machine. It acts as a runtime application modifier that enables the injection and modification of bytecode in a running process without requiring an application restart or changes to the original source code. The system provides a non-invasive aspect-oriented programming framework to intercept method execution and alter behavior in live processes. It functions as an isolated environment for functional modules, employing a custom class loader hierarchy to prevent dependency conflicts between plugins a

Pinpoint is a distributed application performance monitoring and tracing system. It functions as an application performance monitor and topology visualizer designed to analyze the execution behavior of large-scale distributed applications. The system uses bytecode instrumentation to monitor applications without requiring changes to the original source code. It captures call stacks and request flows across interconnected services to visualize system dependencies and generate real-time architectural maps of communication patterns. The platform covers a broad range of observability capabilities

btrace is a JVM dynamic tracing tool and performance profiler used for injecting safe instrumentation scripts into a running Java Virtual Machine without requiring a process restart. It functions as a Java agent framework and a Model Context Protocol server, exposing JVM diagnostic operations and tracing tools to large language models and AI assistants. The project distinguishes itself by enabling real-time code injection and bytecode-level instrumentation via a secure binary protocol. It ensures production stability through a static safety analysis engine that blocks unstable code patterns,

This project is a toolkit for reverse engineering, modifying, and re-signing Android application packages. It provides a suite of utilities designed to decompile compiled binary files into readable source code and translate low-level bytecode into formats suitable for human analysis. The tool facilitates security auditing and research by allowing users to extract and interpret manifest metadata, decode Unicode sequences, and inspect internal application logic. Beyond analysis, it supports the modification of application packages, enabling users to rebuild and re-align files to optimize perfor

This project is a suite of runtime diagnostic tools designed to detect memory leaks, concurrency races, and language-specification violations during software execution. It provides a collection of dynamic analysis tools that identify addressability issues, uninitialized memory usage, and memory safety bugs in applications. The toolset includes a thread safety analyzer to identify data races and deadlocks in concurrent code, as well as an undefined behavior sanitizer to detect operations that violate language specifications. The system covers broad capabilities in memory safety monitoring and

JaCoCo is a Java code coverage tool and bytecode instrumenter that measures which parts of source code are executed during tests. It functions as a runtime agent to monitor application execution on the fly or as a library for offline bytecode instrumentation, allowing it to capture execution data in environments where runtime agents are restricted. The project distinguishes itself by providing both dynamic and static instrumentation paths to track execution. It includes a runtime agent for on-the-fly monitoring and the ability to modify compiled class files before execution. It further enable

Reverse engineering and pentesting for Android applications

gdsdecomp is a project recovery suite and game engine reverse engineering toolset. It functions as a bytecode decompiler, binary resource converter, and asset extraction tool designed to reconstruct original directory hierarchies and scripts from compiled binary game assets. The toolset specializes in GDScript bytecode decompilation and compilation, translating compiled bytecode back into human-readable source code or converting source code into executable bytecode for specific engine versions and commit hashes. It includes a game archive patcher to modify project archives by replacing intern

NeoForge is a development framework and programming interface designed for modifying the Minecraft Java Edition game engine. It provides a standardized environment that allows developers to inject custom logic, extend core gameplay mechanics, and introduce new content into the game. The platform distinguishes itself by utilizing a system of hooks and registry patterns that manage how modifications interact with the game engine. It maintains stability across different versions by separating client and server execution environments and automating the discovery and loading of mod packages. The