Projects sharing features with Unicorn

FEX is an emulator that executes 32-bit and 64-bit x86 binaries on ARM64 hardware. It functions as a binary translation framework that converts guest machine code into host instructions using a JIT compilation engine and a persistent code cache. The project features a Vulkan graphics wrapper that translates OpenGL and Vulkan API calls to native host drivers, enabling cross-architecture graphics rendering. It includes a dedicated root filesystem manager for downloading, mounting, and switching between compressed filesystem images required for guest application environments. The system provide

Wasmtime is a WebAssembly runtime and sandboxed bytecode executor designed to run WebAssembly bytecode on a host system. It functions as an embeddable engine that integrates into applications through native APIs and language-specific bindings, as well as a standalone execution environment accessible via a command line interface. It is a WASI compatible runtime, implementing the WebAssembly System Interface to provide portable access to system resources. The engine utilizes a JIT compilation model to translate intermediate representation into optimized machine code for various CPU architecture

A combined disassembler/static analysis/symbolic execution/debugger framework.

CoreCLR is a runtime environment that manages the execution, memory, and basic types for applications built on the .NET platform. It serves as a managed execution environment that handles low-level system interactions and provides primitive data types for high-level application code. The project functions as a JIT compilation engine and a garbage collected runtime. It translates intermediate language into machine code at runtime for execution on specific hardware and automatically reclaims unused memory to prevent leaks. The system covers broad capability areas including managed code executi

Ish is a Linux shell emulator for iOS that provides a local terminal environment for running shell commands and managing files. It functions as an instruction-level emulator that enables the execution of Linux binaries on mobile devices by simulating an Alpine Linux environment. The project distinguishes itself by combining user-mode Linux emulation with a virtual root filesystem. This allows the software to map Linux kernel system calls to host functions and execute scripts and toolsets directly on an iPhone or iPad. The emulator also provides low-level program debugging capabilities, inclu

This project is a binary static analysis tool designed to recover hidden and non-standard encoded strings from compiled binaries. It functions as a malware analysis utility and string decryptor, extracting obfuscated text to reveal concealed program behavior without executing the code. The tool automates the recovery of embedded strings through a combination of emulated instruction execution and abstract syntax tree evaluation. It utilizes pattern-based heuristic detection to identify obfuscation routines and employs cross-platform binary parsing to process multiple executable formats. The s

HyperDbg is a hardware-assisted kernel-mode debugging platform that leverages virtualization to monitor and control system execution. By utilizing hypervisor-level primitives, it enables deep system analysis and instrumentation without relying on standard operating system debugging interfaces. The framework provides a comprehensive environment for inspecting both kernel and user-mode processes, allowing for granular control over execution flow and system state. The project distinguishes itself through a transparent debugging layer designed to remain invisible to the target environment. It emp

Seer is a graphical frontend for GDB that provides a visual interface for inspecting variables, managing breakpoints, and stepping through code. It functions as a low-level debugger visualizer with specialized tools for call stack inspection and register visualization. The project distinguishes itself by integrating low-level program analysis directly into the visual experience, featuring a synchronized assembly overlay that maps CPU registers and assembly instructions to source code lines. It also includes memory bug detection capabilities by randomizing the program starting address during t

A True Instrumentable Binary Emulation Framework

Angr is a binary analysis framework and static analysis tool used for reverse engineering compiled binaries. It serves as a binary decompiler and a lifting platform that translates machine code into a common intermediate representation to enable cross-architecture analysis. The framework integrates a symbolic execution engine and constraint solvers to determine the inputs required to reach specific program states. It also employs untrusted code sandboxing to isolate guest code from the host environment during analysis. Its capabilities cover control flow and data flow analysis, including the

Capstone is a multi-architecture disassembly framework and binary translation system. It converts binary machine code into human-readable assembly instructions for a wide variety of hardware instruction set architectures and virtual machines. The framework supports a diverse range of targets, including x86, ARM, RISC-V, and MIPS, as well as virtual machine environments like WebAssembly and the Ethereum Virtual Machine. It functions as an instruction analysis tool capable of extracting granular decomposition data and semantic information from disassembled code. The engine is designed for low-

This project is a cross-platform machine learning inference engine designed to execute pre-trained models across diverse operating systems and hardware environments. It functions as a standardized execution framework that manages the entire lifecycle of model inference, from loading and graph optimization to hardware-accelerated execution and generative sequence management. The runtime distinguishes itself through a highly modular architecture that decouples model logic from hardware-specific kernels. By utilizing an execution provider abstraction, it enables developers to offload computation

LuaJIT is a high-performance Lua language implementation and just-in-time compiler. It functions as an embedded scripting engine and dynamic binary translator that converts portable bytecode into native machine code during execution. The project focuses on high-performance scripting by translating bytecode into architecture-specific instructions to achieve execution speeds close to compiled C code. It utilizes a lightweight runtime environment designed for minimal memory overhead. The system supports binary data processing via bitwise operations and enables asynchronous task management throu

AsmJit is a runtime machine code generator and JIT compiler backend that translates high-level definitions into executable processor instructions. It provides a unified instruction emission API and an executable memory manager to allocate and protect virtual memory pages across multiple CPU architectures. The library functions as an assembly engine for x86 and ARM, supporting cross-platform assembly generation through a unified backend. It enables the creation of optimized machine code for different CPUs while maintaining a single codebase. The project covers low-level system abstractions in

Goboy is a GameBoy emulator written in Go that allows original handheld game ROMs to run on modern computer hardware. It supports both monochromatic and color display modes. The project includes specialized tools for retro game debugging and graphics inspection. These capabilities allow for the analysis of game logic by stepping through opcodes, profiling processor execution in real time, and inspecting background palettes, sprite data, and map layouts. The emulator provides game state preservation by writing cartridge RAM to local files. It also implements pixel-buffer rasterization for ren

LLVM is a modular compiler infrastructure and framework consisting of a collection of reusable libraries used to build language front-ends and optimization tools. It functions as a low-level virtual machine that provides an intermediate representation and optimization pipeline to enable language-agnostic code generation. The project provides a toolkit for just-in-time compilation, translating intermediate representations into machine code at runtime for immediate execution. Its modular design allows developers to create custom language front-ends and high-performance runtime environments acro

V8 is a high-performance JavaScript and WebAssembly engine designed to compile and execute code within host applications. It functions as an embeddable scripting engine and just-in-time compiler, providing a portable library for integrating dynamic script execution into native software environments. The engine incorporates a WebAssembly runtime to execute compiled binary code for a stack-based virtual machine at near-native speeds. It enables native application scripting by allowing a JavaScript execution environment to be embedded directly into a native program to handle dynamic logic. The

Miasm is a Python reverse engineering framework designed for binary analysis, disassembly, and modification. It functions as a binary analysis framework that lifts machine code into an intermediate representation to enable platform-independent security research. The system operates as a binary emulation engine and modification toolkit, allowing for the execution of binary code in a virtual environment to track state changes without native hardware. It provides tools for binary patching to update and modify raw binary files across multiple CPU architectures and executable formats. The framewo

ChakraCore is an embeddable JavaScript engine and high-performance scripting runtime. It provides a just-in-time compiler that converts JavaScript source code into optimized machine code during runtime to increase execution speed and throughput. The engine utilizes a multi-tiered compilation pipeline and tiered machine code generation to balance startup time with execution speed. Memory is managed via a concurrent garbage collector that reclaims unreachable objects on background threads to minimize application pauses. The project provides capabilities for embedded JavaScript execution and au

Cling is an interactive C++ interpreter and read-eval-print loop that allows for the execution of C++ code in real time. It provides an interactive environment where statements can be evaluated immediately, bypassing the manual compilation and linking cycles typically required for the language. The system functions as a Jupyter C++ kernel, enabling cell-based development and visualization within notebook interfaces. It also supports the loading and execution of external source files within an active session. The environment includes capabilities for just-in-time debugging and profiling by em

This project is an Android security analysis toolkit and mobile app runtime manipulator designed for reverse engineering and auditing mobile applications. It provides a system for modifying Java classes and method behavior in active mobile processes to bypass security controls. The toolkit includes a web-based interface for controlling the instrumentation engine and a specialized utility for disabling certificate validation to intercept and inspect encrypted network traffic via SSL pinning bypass. It also features an Android file explorer for browsing and managing files within private data di

Accelerate is a framework for high-performance array computing that provides a domain-specific language for expressing complex mathematical and parallel computations. By utilizing a declarative programming interface, it allows users to define high-level array transformations that are automatically translated into optimized machine code for diverse hardware architectures. The system distinguishes itself through a modular architecture that decouples high-level array operations from hardware-specific instructions. It employs just-in-time compilation and kernel fusion to transform programs into e

Detect-It-Easy is a binary file identifier and analysis toolkit designed to determine file formats, compilers, and packers. It functions as a binary file identifier that utilizes signature matching and heuristic analysis to identify executable and archive formats. The project includes a custom file signature engine and a scriptable rule system for defining and applying detection logic to identify specific binary patterns. It features specialized detectors for Android packages, such as APK and DEX files, and a malware packer detector to identify protections, obfuscators, and virus families. T

Radare2 is a comprehensive framework for reverse engineering and analyzing compiled software. It provides a command-line environment designed for disassembling, debugging, and patching binary executables across a wide range of processor architectures and operating systems. The system distinguishes itself through a modular, plugin-based architecture that supports cross-platform analysis and automated workflows. It utilizes memory-mapped file access to enable efficient structural inspection and modification of binaries without requiring full file loads. By lifting machine instructions into a un

BCC is an eBPF development toolkit and tracing framework used for monitoring and analyzing the Linux kernel. It functions as a performance analysis tool and debugging utility to capture system events, measure kernel latency, and provide network observability. The project distinguishes itself by providing a build system that integrates with LLVM to compile C-like code into BPF bytecode at runtime. It utilizes BPF Type Format data for relocations to maintain cross-kernel compatibility and extracts kernel headers to ensure the generated programs match the specific kernel version. The toolkit co

CppGuide is a curated collection of educational resources and practical guides focused on C++ server development, Linux kernel internals, concurrent programming, network protocols, and security exploitation. It provides structured learning paths for backend developers, covering everything from interview preparation to building high-performance network servers and understanding operating system fundamentals. The guide distinguishes itself by offering in-depth, hands-on tutorials that walk through real-world implementations, including building a Redis-like server from scratch, designing custom

rpi4-osdev is a project for bare metal operating system development targeting the Raspberry Pi 4. It focuses on creating a custom operating system that runs directly on the hardware without an underlying kernel or abstraction layer. The project provides a codebase and instructional guide for developing a low-level system from scratch. This process involves transitioning from early boot code to kernel execution on the ARM64 architecture. The technical scope covers embedded system bootstrapping and low-level hardware interfacing. This includes managing memory-mapped I/O, physical address mappi