Awesome GitHub RepositoriesBinary Disassembly

Ghidra is a software reverse engineering suite designed to analyze compiled binaries and reconstruct program logic without access to original source code. It provides an interactive environment for disassembly and decompilation, utilizing a platform-independent intermediate representation to maintain consistency across diverse hardware architectures. The framework supports automated binary analysis through programmatic routines, enabling the investigation of complex code patterns and security indicators. The platform distinguishes itself through a modular architecture that allows for extensiv

Geth is a comprehensive execution client for the Ethereum network, serving as a foundational node implementation that processes transactions, maintains the distributed ledger state, and participates in peer-to-peer consensus. It provides a robust infrastructure for synchronizing, validating, and serving blockchain data, utilizing a persistent Merkle Patricia Trie database to ensure the cryptographic integrity of historical records. As a sandboxed smart contract runtime, it executes bytecode according to deterministic protocol rules, enabling the deployment and interaction of decentralized appl

This project is a graphical Windows debugger designed for the analysis and manipulation of compiled binary applications. It functions as a comprehensive binary analysis suite, providing a real-time environment for inspecting CPU registers, monitoring memory states, and tracing instruction execution to investigate system-level software behavior. The tool distinguishes itself through an event-driven debugging loop that allows for precise process control and state modification during runtime. It supports advanced analysis techniques, including hardware-breakpoint injection for monitoring memory

This is a Unix-based dotfiles repository providing a version-controlled collection of configuration files, environment variables, and shell aliases. Its primary purpose is to optimize macOS for software development by applying a curated set of system defaults and Zsh shell workflow enhancements. The project distinguishes itself through a comprehensive collection of macOS system defaults and specific configurations for the Zsh shell. It includes specialized Git workflow configurations and whitespace settings designed to standardize and accelerate version control operations across different env

Apktool is an Android APK reverse engineering tool designed to decode application packages into human-readable form and rebuild them after modification. It functions as a Dalvik bytecode disassembler and a resource decoder, transforming binary Android XML and DEX files into editable text and Smali representation. The project serves as an application rebuilder, packing modified resources and Smali code back into a functional Android application package. This capability enables the modification of application logic and resources for testing and deployment. The tool covers a broad surface of an

radare2 is a reverse engineering framework and binary analysis toolset. It functions as a multi-architecture disassembler, low-level binary debugger, and hexadecimal editor for inspecting executable structures and interpreting machine code when original source files are unavailable. The framework provides capabilities for decompiling machine instructions, performing symbolic analysis, and diffing binary files to identify structural changes across versions. It also includes a digital forensic analyzer and disk analyzer for browsing filesystem formats in userland. The toolset supports binary p

Radare2 is a comprehensive framework for reverse engineering and analyzing compiled software. It provides a command-line environment designed for disassembling, debugging, and patching binary executables across a wide range of processor architectures and operating systems. The system distinguishes itself through a modular, plugin-based architecture that supports cross-platform analysis and automated workflows. It utilizes memory-mapped file access to enable efficient structural inspection and modification of binaries without requiring full file loads. By lifting machine instructions into a un

Pwntools is a Python-based framework designed for rapid prototyping and automation in binary exploitation, reverse engineering, and security research. It serves as a comprehensive toolkit for interacting with local and remote processes, providing the primitives necessary to manage complex exploit workflows and streamline security analysis tasks. The framework distinguishes itself through its specialized capabilities for binary manipulation and automated exploit construction. It includes dedicated utilities for parsing executable file formats, assembling and disassembling machine code, and gen

Mono is an open source implementation of the .NET Framework that provides a managed execution environment, base class libraries, and a cross-platform virtual machine. It serves as a compliant implementation of the ECMA Common Language Infrastructure standard, enabling the execution of intermediate language binaries across different operating systems. The project includes a complete toolset for C# development, featuring a command line compiler and CLI to transform source code into executable assemblies. It distinguishes itself with a flexible managed memory system that supports multiple automa

MAME is a vintage hardware emulation platform designed to recreate the circuitry of arcade games, computers, and consoles to run original software on modern devices. It functions as a retro gaming preservation framework for managing, verifying, and archiving ROM sets and disk images to ensure long-term software accessibility. The project features a system debugging tool for inspecting emulated memory, CPU registers, and execution flow via breakpoints and disassembly. It also includes a Lua-based automation layer that exposes core system state and hardware controls for custom behavior and anal

Il2CppDumper is a reverse engineering tool that recovers original .NET assembly structure from Unity games compiled with il2cpp. It parses il2cpp binaries across multiple executable formats including ELF, Mach-O, PE, NSO, and WASM, and reconstructs the original DLL structure from embedded metadata tables, enabling decompilation and analysis of game code. The tool generates disassembler scripts for IDA, Ghidra, and Binary Ninja that apply recovered type definitions and structure layouts to the binary analysis. It also strips protection layers from memory-dumped libil2cpp.so files and simple PE

Capstone is a multi-architecture disassembly framework and binary analysis engine. It translates raw machine code from various CPU architectures, such as x86, ARM, and RISC-V, into human-readable assembly instructions. The engine distinguishes itself by providing instruction semantic decomposition, which lists implicit registers read and written, and the ability to customize instruction mnemonics to meet specific technical analysis standards. It also features resilient stream disassembly, allowing the process to resynchronize and continue after encountering invalid instructions or embedded da

Capstone is a multi-architecture disassembly framework and binary translation system. It converts binary machine code into human-readable assembly instructions for a wide variety of hardware instruction set architectures and virtual machines. The framework supports a diverse range of targets, including x86, ARM, RISC-V, and MIPS, as well as virtual machine environments like WebAssembly and the Ethereum Virtual Machine. It functions as an instruction analysis tool capable of extracting granular decomposition data and semantic information from disassembled code. The engine is designed for low-

Binaryen is a WebAssembly compiler toolchain and optimizer designed to transform, validate, and shrink binary modules. It provides a comprehensive intermediate representation framework that converts binary code into a single-assignment form to enable advanced program analysis and code transformation. The project includes a specialized transformation engine that applies iterative optimization passes to increase execution speed and reduce binary size. Additionally, it functions as a transpiler that translates WebAssembly binary modules into executable JavaScript for environments that lack nativ

WebAssembly Binary Toolkit este o suită de instrumente pentru inspectarea, validarea și transformarea modulelor WebAssembly între reprezentări binare și lizibile pentru oameni. Include un interpretor bazat pe stivă pentru executarea modulelor și un transpilator care convertește fișierele binare în cod sursă C și headere. Toolkit-ul oferă utilitare pentru asamblarea textului lizibil în module binare și dezasamblarea fișierelor binare înapoi în text. Dispune de un formator de text pentru normalizarea definițiilor într-o reprezentare canonică plată și suportă conversia binarelor în formate S-expression. Proiectul acoperă domenii largi de capabilități, inclusiv manipularea binară, cum ar fi eliminarea secțiunilor de metadate, și inspectarea modulelor pentru a extrage statistici structurale și simboluri de debug. Oferă, de asemenea, instrumente de validare pentru a verifica corectitudinea binară conform specificațiilor tehnice și un mediu de runtime pentru executarea logicii conforme cu WASI.

This project is an Android RPA framework designed for automating user interfaces and system tasks on rooted Android devices using Python and ADB. It provides a suite of tools for rooted device management, allowing for programmatic control of system settings, application lifecycles, and shell command execution via a remote API. The framework distinguishes itself through a combination of dynamic instrumentation and AI integration. It can inject scripts into running processes to hook Java interfaces and modifies application behavior in real time. Additionally, it supports large language model in

seL4 is a formally verified microkernel whose C implementation is backed by machine-checked mathematical proofs of correctness, confidentiality, integrity, and availability. It enforces strict isolation between processes through hardware-enforced address space separation and a capability-based access control system, where each process holds explicit rights only to the resources it has been granted. The kernel exposes hardware resources through a minimal API of system calls that manage threads, address spaces, and inter-process communication, with synchronous IPC supporting sender-identifying b

LIEF este un framework pentru parsarea, modificarea și analizarea formatelor de binare executabile și a cache-urilor partajate de sistem pe platforme multiple. Servește ca o bibliotecă cross-platform pentru manipularea programatică a fișierelor binare ELF, PE și MachO. Proiectul oferă instrumente pentru alterarea structurii interne și a secțiunilor fișierelor executabile pentru a schimba comportamentul programului. Include, de asemenea, un parser dedicat pentru recuperarea bibliotecilor dinamice individuale din cache-urile partajate de sistem combinate. Setul de instrumente acoperă analiza executabilelor binare, dezasamblarea codului mașină și extragerea metadatelor de debug și a informațiilor despre simboluri. Suportă, de asemenea, traducerea bidirecțională a codului mașină și a assembly-ului pe diverse arhitecturi de procesor.

Miasm este un framework Python de reverse engineering conceput pentru analiză binară, dezasamblare și modificare. Funcționează ca un framework de analiză binară care ridică codul mașină într-o reprezentare intermediară pentru a permite cercetarea de securitate independentă de platformă. Sistemul operează ca un motor de emulare binară și toolkit de modificare, permițând execuția codului binar într-un mediu virtual pentru a urmări schimbările de stare fără hardware nativ. Oferă instrumente pentru patching binar, pentru a actualiza și modifica fișiere binare brute pe mai multe arhitecturi CPU și formate executabile. Framework-ul acoperă capabilități pentru dezasamblare, ridicarea reprezentării intermediare și simplificarea semantică pentru a elimina ofuscarea binară. Include suport pentru parsarea formatelor binare și maparea memoriei pentru a urmări referințele și layout-ul în timpul analizei programelor compilate.