Awesome GitHub RepositoriesBinary File Reconstructions

PyPDF2 is a pure Python library for reading, writing, and manipulating PDF files. It functions as a document manipulator, text extractor, and encryption tool, allowing users to process PDF files without relying on external C libraries or native binaries. The library provides specialized tools for modifying document structures, such as merging multiple files into one, splitting documents into separate files, and transforming page layouts through cropping. It also includes capabilities for securing documents via passwords and encryption. Additional capabilities include the extraction of writte

Il2CppDumper is a reverse engineering tool that recovers original .NET assembly structure from Unity games compiled with il2cpp. It parses il2cpp binaries across multiple executable formats including ELF, Mach-O, PE, NSO, and WASM, and reconstructs the original DLL structure from embedded metadata tables, enabling decompilation and analysis of game code. The tool generates disassembler scripts for IDA, Ghidra, and Binary Ninja that apply recovered type definitions and structure layouts to the binary analysis. It also strips protection layers from memory-dumped libil2cpp.so files and simple PE

RetDec is a reverse engineering framework and static binary analysis tool. Its primary purpose is to function as an LLVM-based machine code decompiler that translates binary machine code from multiple architectures into high-level C source code. The system employs a multi-stage lifting pipeline to recover program logic, using an intermediate representation to apply optimizations before emitting source code. It distinguishes itself through the ability to identify compilers and packers, perform executable unpacking, and reconstruct class hierarchies and original program structures. The framewo

Retdec is an LLVM-based machine code decompiler and static binary analysis tool designed for binary reverse engineering. It translates binary executable code into high-level representations to facilitate the reconstruction of program logic from compiled machine code. The system utilizes a retargetable frontend architecture and a multi-stage lifting pipeline to convert raw bytes into a common intermediate language. It differentiates custom program logic from known library code through signature-based identification and provides utilities for binary symbol demangling to restore human-readable n

GhidraMCP is a Model Context Protocol server that exposes Ghidra binary analysis and decompilation functions to external intelligence models. It acts as a bridge that connects the Ghidra reverse engineering suite to external tools through a standardized communication protocol, facilitating automated reverse engineering and software auditing. The project enables the extraction of decompiled code and program structural data to populate the context windows of language models. It features a binary symbol management tool capable of dynamic symbol resolution, allowing method and data names to be up

Reflections is a Java classpath scanning library and metadata indexer designed to locate classes, methods, and resources at runtime. It functions as a tool for annotation discovery and type hierarchy analysis, allowing the system to identify elements marked with specific annotations or to resolve super-types and subtypes within the Java virtual machine. The project distinguishes itself through metadata serialization, providing mechanisms to save the scanned index to persistent files or source code. This capability reduces application startup overhead by eliminating the need for repeated, expe

这是一个针对 iOS 应用程序逆向工程的综合技术指南和课程。它作为一本手册，用于通过反汇编和调试工具剖析移动二进制文件，以分析内部应用程序逻辑和行为。 该材料作为 ARM 汇编和 Objective-C 理论的参考，提供了将底层机器代码转换为人类可读逻辑的必要框架。它将理论研究与实践练习相结合，以验证逆向工程工具在现实世界二进制文件上的使用。 范围涵盖静态二进制分析、动态运行时调试以及 iOS 系统架构的研究。这包括映射文件系统层级和数据组织，以定位应用程序资源和配置文件。

uds 是一个二进制转文本的存储工具和云文档存储管理器。它将二进制文件转换为编码后的文本块，以便在云文档平台中进行存储和检索，主要用于绕过 Google Drive 等服务的存储配额限制。 该系统利用 Base64 编码和分块技术，将大型二进制文件拆分为适合云文档字符限制的小段，并通过顺序块重组来还原原始文件。 该项目涵盖了云文件管理功能，包括列出、搜索和删除已存储文件。它还提供了批量处理功能，支持使用模式和通配符上传或下载多个文件，并包含用于格式化人类可读文件大小的实用工具。

MemProcFS 是一个易失性内存分析工具和跨平台内存获取系统。它作为一个内存取证虚拟文件系统，将物理内存和内核对象映射到虚拟目录结构中，允许用户使用标准文件系统工具分析系统工件。 该项目通过提供用于内存取证的虚拟文件系统脱颖而出，能够将物理内存作为只读文件和文件夹进行浏览和查询。它还结合了基于 Yara 的内存扫描器，以识别物理内存中的恶意软件签名和注入代码。 该引擎涵盖了广泛的取证功能，包括进程和线程检查、网络连接列表和 Windows 注册表分析。它支持从实时系统、崩溃转储和虚拟机中摄取数据，同时提供符号解析以将原始内存地址转换为有意义的名称。 集成通过多语言程序化接口和针对 C 和 Java 的原生库包装器，以及用于自动化工作流的无头 Python 脚本提供支持。