Open-source alternatives to LIEF

Capstone is a multi-architecture disassembly framework and binary analysis engine. It translates raw machine code from various CPU architectures, such as x86, ARM, and RISC-V, into human-readable assembly instructions. The engine distinguishes itself by providing instruction semantic decomposition, which lists implicit registers read and written, and the ability to customize instruction mnemonics to meet specific technical analysis standards. It also features resilient stream disassembly, allowing the process to resynchronize and continue after encountering invalid instructions or embedded da

Radare2 is a comprehensive framework for reverse engineering and analyzing compiled software. It provides a command-line environment designed for disassembling, debugging, and patching binary executables across a wide range of processor architectures and operating systems. The system distinguishes itself through a modular, plugin-based architecture that supports cross-platform analysis and automated workflows. It utilizes memory-mapped file access to enable efficient structural inspection and modification of binaries without requiring full file loads. By lifting machine instructions into a un

Binsider is a collection of specialized toolsets for hexadecimal editing, ELF structural analysis, system call tracing, and execution performance profiling. It provides a suite of utilities designed for binary reverse engineering, encompassing both static structural analysis and dynamic runtime monitoring of compiled binaries. The project distinguishes itself by combining low-level binary manipulation, such as a hex editor for raw byte modification, with an ELF binary analysis tool for inspecting file structures and metadata. It also includes a Linux system call tracer for observing dynamic b

radare2 is a reverse engineering framework and binary analysis toolset. It functions as a multi-architecture disassembler, low-level binary debugger, and hexadecimal editor for inspecting executable structures and interpreting machine code when original source files are unavailable. The framework provides capabilities for decompiling machine instructions, performing symbolic analysis, and diffing binary files to identify structural changes across versions. It also includes a digital forensic analyzer and disk analyzer for browsing filesystem formats in userland. The toolset supports binary p

ipsw is a specialized toolkit for iOS firmware analysis, binary reverse engineering, and hardware interaction. It provides a suite of tools for downloading, extracting, and analyzing firmware images and kernel caches, alongside a MachO binary analysis tool for disassembling and patching executables. The project distinguishes itself through integrated language-model-powered code reconstruction to translate machine code into high-level source code. It also features an automation client for the App Store Connect API to manage certificates and application settings. The framework covers a broad r

This project is a graphical Windows debugger designed for the analysis and manipulation of compiled binary applications. It functions as a comprehensive binary analysis suite, providing a real-time environment for inspecting CPU registers, monitoring memory states, and tracing instruction execution to investigate system-level software behavior. The tool distinguishes itself through an event-driven debugging loop that allows for precise process control and state modification during runtime. It supports advanced analysis techniques, including hardware-breakpoint injection for monitoring memory

Pwntools is a Python-based framework designed for rapid prototyping and automation in binary exploitation, reverse engineering, and security research. It serves as a comprehensive toolkit for interacting with local and remote processes, providing the primitives necessary to manage complex exploit workflows and streamline security analysis tasks. The framework distinguishes itself through its specialized capabilities for binary manipulation and automated exploit construction. It includes dedicated utilities for parsing executable file formats, assembling and disassembling machine code, and gen

Angr is a binary analysis framework and static analysis tool used for reverse engineering compiled binaries. It serves as a binary decompiler and a lifting platform that translates machine code into a common intermediate representation to enable cross-architecture analysis. The framework integrates a symbolic execution engine and constraint solvers to determine the inputs required to reach specific program states. It also employs untrusted code sandboxing to isolate guest code from the host environment during analysis. Its capabilities cover control flow and data flow analysis, including the

Android Classyshark is a binary analysis toolset designed to extract structural data from Android executable files. It functions as a bytecode viewer and binary XML parser to analyze compiled Java and Android binaries. The project converts binary XML files into readable formats for the inspection of application manifests, layouts, and resource files. It also provides the ability to analyze class interfaces, members, and dependency counts without requiring access to the original source code. The toolset supports static analysis and the export of binary information into plain text formats for

lensm is a binary analysis tool and Go disassembler interface designed for navigating disassembled machine code, tracking function calls, and inspecting executable metadata. It specifically functions as a Go assembly viewer that visualizes compiled binary instructions alongside their original source code. The project implements the Model Context Protocol to expose internal functions and source code as tools for external AI systems. This protocol-based analysis server enables the streaming of binary data and the management of server lifecycles to allow external tools to analyze logic. The sys

ROPgadget is a binary analysis tool and multi-architecture disassembler designed to locate instructional sequences used for return-oriented programming. It functions as an exploit development framework that identifies gadgets within binaries to facilitate the creation of memory corruption exploits. The tool supports cross-architecture binary auditing, processing machine code from x86, ARM, MIPS, and RISC-V. It provides a unified interface for analyzing diverse executable file formats, including ELF, PE, and Mach-O. Its capabilities cover binary vulnerability analysis and exploit payload deve

Zydis is an x86 and x86-64 binary analysis library that provides a framework for decoding machine code and inspecting the technical attributes of processor instructions. It functions as an instruction disassembler that translates binary data into structured instruction metadata and human-readable assembly. The project includes a machine code encoder for converting assembly instructions and operands back into their binary representations. It also provides an assembly syntax formatter to transform decoded instruction structures into assembly text strings using configurable syntax styles. The l

dnSpy is a specialized toolset for the reverse engineering, analysis, and modification of compiled .NET binaries. It functions as a decompiler that converts assemblies back into readable high-level source code, an assembly editor for modifying bytecode and metadata, and a debugger for inspecting compiled binaries. The project integrates a hex editor specifically for inspecting and modifying raw bytes and Common Intermediate Language structures. It allows for the direct modification of binary contents to change application behavior without requiring the original project source files. The tool

Peda is a security tool suite and exploit development framework designed for binary analysis, debugger automation, and memory inspection. It functions as a set of Python scripts that extend a debugger to automate the analysis of compiled files and the inspection of process memory. The project provides specialized utilities for memory corruption research, including a payload generation utility for creating cyclic patterns to discover buffer overflows and a gadget finder to locate return-oriented programming sequences within binaries. It differentiates itself by offering a visualization tool th

YARA is a pattern matching engine and binary analysis tool used to identify and classify malware samples. It functions as a malware research framework that allows for the definition of file descriptions and detection rules to find indicators of compromise within binaries. The system enables the creation of custom detection rules using strings, wildcards, and regular expressions. These rules use boolean logic to match textual or binary patterns, allowing for the classification of files into specific malware families and the automation of threat intelligence. The engine utilizes Aho-Corasick s

Detect-It-Easy is a binary file identifier and analysis toolkit designed to determine file formats, compilers, and packers. It functions as a binary file identifier that utilizes signature matching and heuristic analysis to identify executable and archive formats. The project includes a custom file signature engine and a scriptable rule system for defining and applying detection logic to identify specific binary patterns. It features specialized detectors for Android packages, such as APK and DEX files, and a malware packer detector to identify protections, obfuscators, and virus families. T

XenonRecomp is a static binary translator and Xbox 360 game recompiler. It functions as a binary analysis tool and native code generator that converts machine instructions from Xbox 360 game executables into C++ source code for recompilation on different hardware platforms. The tool features specialized capabilities for translating compiled binaries, including the conversion of assembly jump tables into native switch cases and the detection of function boundaries using stack space data and branch link instructions. It optimizes translated code by converting non-volatile and non-argument regis

dnSpy is a desktop application designed for the analysis, debugging, and modification of compiled .NET assemblies. It functions as an assembly analysis suite and decompiler, translating binary instruction streams back into readable source code to facilitate reverse engineering when original source files are unavailable. The tool distinguishes itself through an integrated binary patching engine and metadata editor, which allow for the direct modification of executable logic and internal metadata tables. It supports in-process debugging instrumentation, enabling users to inject runtime hooks, s

Jadx is a comprehensive Java decompilation suite designed to transform compiled binary application files into readable source code. It functions as a static analysis workbench, providing a graphical interface for navigating, searching, and inspecting the internal logic of complex software packages. By utilizing a bytecode-to-Java pipeline, the project reconstructs high-level logical structures from low-level binary instructions, making it a primary tool for Android application reverse engineering. The project distinguishes itself through a sophisticated control flow reconstruction engine and

UEFITool is a firmware analysis tool and image editor designed for parsing, visualizing, and modifying UEFI firmware images. It functions as a specification parser that converts binary firmware data into structured formats based on standard platform interface specifications. The tool provides a visual interface to analyze the tree structure and internal data elements of UEFI platform images. It allows for the modification of firmware images to adjust system boot environments and includes capabilities to search for specific data patterns within binary images. The software covers a range of fi

UABE is a specialized toolset for extracting, modifying, and converting assets stored within Unity engine bundle files. It functions as an asset bundle extractor and a game modding utility designed to alter 3D meshes, textures, and audio within Unity games. The project includes an asset format converter that transforms internal Unity data into common file formats for external editing. It also features a mod installer generator to create standalone installation packages from modified asset bundle files. The software provides capabilities for game resource extraction and asset conversion, allo

NBTExplorer is a viewer and editor for Named Binary Tag data. It functions as a processor for the hierarchical binary tag files used within Minecraft save files and game configuration. The tool enables the exploration and modification of game world settings, player data, and entity states. It supports reading and updating structured binary data across standard, uncompressed, and region-based file formats. The project provides capabilities for binary tag deserialization and in-place modification. It handles data through buffered stream reading, zlib-based decompression, and region-file indexi

xHook is a low-level instrumenter and hooking library for Android ELF binaries. It functions as a framework for intercepting native symbols and redirecting function calls by modifying the procedure linkage table. The tool utilizes regular expressions to filter specific binary files and symbols for interception. It enables the redirection of native calls toward custom function implementations without altering the original binary files. The framework covers dynamic symbol resolution, ELF table modification, and security analysis of native libraries. It also includes stability mechanisms that u

This project is a technical reference and documentation suite focused on the internal architecture and operational principles of the Java Virtual Machine. It provides comprehensive guides and analysis on how the virtual machine manages class loading, memory organization, and bytecode execution. The documentation distinguishes itself by providing deep dives into specific runtime mechanisms, such as the binary decoding of class files, the hierarchical delegation model for class loaders, and the precise sequence of the loading, linking, and initialization lifecycle. It also details memory reclam

gocode is a language server backend and autocompletion daemon for the Go language. It functions as a static code analyzer and symbol indexer that provides real-time identifier and symbol suggestions to text editors. The project utilizes a client-server daemon architecture to maintain a persistent background process, avoiding the overhead of reloading package metadata for every request. It employs a two-tier metadata caching system and parses compiled package binaries to enable fast symbol lookups and declaration retrieval. The system covers broad capability areas including context-sensitive

mcaselector is a Minecraft save file editor, world chunk selector, and region manager. It allows for the modification of the structure and size of world files by removing unwanted chunks or managing regional data. The tool provides a visual interface for selecting specific world chunks to be exported or deleted from a save file. It enables the extraction of selected chunks and regions into separate files for backups or transfers. The software performs low-level binary processing, including NBT parsing and coordinate-to-region mapping, to identify and modify specific world entity and tile str

PE-bear is a graphical portable executable analysis tool designed for inspecting, disassembling, and modifying the structure of Windows PE binary files. It functions as a static analysis framework used to identify malicious patterns and reverse engineer program logic. The project provides a binary diffing tool to identify structural and content differences between two executable files. It also includes a section editor for modifying binary layouts by adding or altering sections and imports. The tool covers a range of binary analysis capabilities, including machine code disassembly, file layo