Open-source alternatives to Binary Parsing

Capstone is a multi-architecture disassembly framework and binary translation system. It converts binary machine code into human-readable assembly instructions for a wide variety of hardware instruction set architectures and virtual machines. The framework supports a diverse range of targets, including x86, ARM, RISC-V, and MIPS, as well as virtual machine environments like WebAssembly and the Ethereum Virtual Machine. It functions as an instruction analysis tool capable of extracting granular decomposition data and semantic information from disassembled code. The engine is designed for low-

RetDec plugin for IDA (Interactive Disassembler).

Binary Analysis Platform

ipsw is a specialized toolkit for iOS firmware analysis, binary reverse engineering, and hardware interaction. It provides a suite of tools for downloading, extracting, and analyzing firmware images and kernel caches, alongside a MachO binary analysis tool for disassembling and patching executables. The project distinguishes itself through integrated language-model-powered code reconstruction to translate machine code into high-level source code. It also features an automation client for the App Store Connect API to manage certificates and application settings. The framework covers a broad r

FunctionInliner is an IDA plugin that can be used to ease the reversing of binaries that have been space-optimized with function outlining (e.g. clang --moutline).

PacXplorer is an IDA plugin that adds XREFs between virtual functions and their call sites. This is accomplished by leveraging PAC codes in ARM64e binaries. 1. install ida-nentode somewhere IDA can import it 2. clone the repository and symlink ~/.idapro/plugins/pacxplorer.py to pacxplorer.py in…

GhIDA is an IDA Pro plugin that integrates the Ghidra decompiler in IDA.

Corelan Repository for mona.py

capstone based disassembler for extracting to binnavi

Author: cynder (kat)

MachO/ObjC Analysis Editing toolkit.

` git clone https://github.com/dubuqingfeng/ollydbg-script.git `

Binary Ninja Loader for iBoot & SecureROM

We evaluated two packer type estimation/detection tools (pypeid and Detect It Easy (DIE)) to fix this issue.

This project is a binary static analysis tool designed to recover hidden and non-standard encoded strings from compiled binaries. It functions as a malware analysis utility and string decryptor, extracting obfuscated text to reveal concealed program behavior without executing the code. The tool automates the recovery of embedded strings through a combination of emulated instruction execution and abstract syntax tree evaluation. It utilizes pattern-based heuristic detection to identify obfuscation routines and employs cross-platform binary parsing to process multiple executable formats. The s

MachOView fork

Qira is a runtime analysis tool and interactive binary debugger designed for the QEMU emulator. It functions as a binary execution tracer that records a full timeline of instruction invocations and provides a system for monitoring memory operations within guest processes. The project enables the analysis of compiled binaries by tracing instruction-level execution and mapping raw memory addresses to user-defined annotations. It includes capabilities for state-snapshotting to manage execution forks, allowing the navigation of divergent logic paths and the inspection of CPU register states and s

BinNavi is a binary analysis IDE that allows to inspect, navigate, edit and annotate control flow graphs and call graphs of disassembled code.

32/64 bit SecureROM/iBoot loader for IDA Pro. Supports IDA Pro 7.0+ on all platforms.

mootool is an attempt at an open source replacement to the legandary jtool2 allowing it to continue to progress with the Apple research community. Ruby was selected as Homebrew maintains a good Mach-O parser that is pure (meaning it needs no dependencies other then a Ruby runtime).