access_updated

Singular Access Updated fork ofbtbd/access with Zydis-based dynamic pattern finding for Windows 10/11 compatibility A kernel-mode syscall wrapper that enables privileged process operations without requiring handles. Uses xKdEnumerateDebuggingDevices pointer hooking for kernel-usermode...

fhex

Fhex - A Full-Featured HexEditor This project is born with the aim to develop a lightweight, but useful tool. The reason is that the existing hex editors have some different limitations e.g. too many dependencies, missing hex coloring features, etc.. This project is based on qhexedit2 , capstone...

ceasta

ceasta a disassembler, decompiler and debugger in one — for windows, linux and macos, x86, x64 and arm64 ida-style listing, a decompiler, a function graph, an x64dbg-style debugger, lua plugins, and a built-in MCP server so you can point an AI at a binary — one small program, everything vendored,...

dsync

dsync IDAPython plugin that synchronizes decompiled and disassembled code views. Please refer to comments in source code for more details. Requires IDA Pro 7.3 N.B.: You may want to use the official synchronization feature introduced with IDA 7.3 instead...

IODIDE

IODIDE - The IOS Debugger and Integrated Disassembler Environment Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Andy Davis, andy dot davis at nccgroup dot com https://github.com/nccgroup/IODIDE Released under AGPL see LICENSE for more information Includes the...

retdec

Warning The RetDec project is currently in a limited maintenance mode due to a lack of resources: Pull Requests are welcomed. They are reviewed with priority, if possible without delays. Issues are reacted on with delays up to one quarter. Issues are not actively solved unless they relate to a...

grap

grap: define and match graph patterns within binaries https://github.com/QuoSecGmbH/grap grap takes patterns and binary files, uses a Casptone-based disassembler to obtain the control flow graphs from the binaries, then matches the patterns against them. Patterns are user-defined graphs with...

sharem

SHAREM Welcome to SHAREM! SHAREM was presented at DEFCON 31 in "Game-Changing Advances in Windows Shellcode Analysis" and Black Hat USA Arsenal. A companion Ghidra plugin was made available separately from Trellix, courtesy of Max Kersten. Thus, you can extend the power of SHAREM to Ghidra, if yo...

Android-Disassembler

Android-Disassembler !ci12 CodeFactor Analyze malicious app on your phone Maintenance status Maintenance has resumed, but the project is still in a recovery and modernization phase. The baseline now expects initialized git submodules before building. Default open/import/export flows now use...

Krakatau

Krakatau provides an assembler and disassembler for Java bytecode, which allows you to convert binary classfiles to a human readable text format, make changes, and convert it back to a classfile, even for obfuscated code. You can also create your own classfiles from scratch by writing bytecode...

rizin

Rizin Rizin is a reverse engineering framework, born as a fork of the radare2, with a focus on usability, features and cleanliness. Rizin is portable and it can be used to analyze binaries, disassemble code, debug programs, as a forensic tool, as a scriptable command-line hexadecimal editor able ...

ScratchABit

ScratchABit ScratchABit is an interactive incremental disassembler with data/control flow analysis capabilities. ScratchABit is dedicated to the efforts of the OpenSource reverse engineering community reverse engineering to produce OpenSource drivers/firmware for hardware not properly supported b...

sandsifter

s a n d s i f t e r : the x86 processor fuzzer Overview The sandsifter audits x86 processors for hidden instructions and hardware bugs, by systematically generating machine code to search through a processor's instruction set, and monitoring execution for anomalies. Sandsifter has uncovered secre...

HexWalk

HexWalk - Hex Editor/Viewer/Analyzer HexWalk is an Hex editor, viewer, analyzer. Built on qhexedit2, Capstone and Qt, with a built-in signature scanner, HexDig, inspired by binwalk. It is cross platform and has plenty of features: Advanced Find can find patterns in binary files based on...

ddisasm

Datalog Disassembly DDisasm is a fast disassembler which is accurate enough for the resulting assembly code to be reassembled. DDisasm is implemented using the datalog souffle declarative logic programming language to compile disassembly rules and heuristics. The disassembler first parses ELF/PE...

pefile

pefile pefile is a multi-platform Python module to parse and work with Portable Executable PE files. Most of the information contained in the PE file headers is accessible, as well as all the sections' details and data. The structures defined in the Windows header files will be accessible as...

plasma

PLASMA The old project name was Reverse. PLASMA is an interactive disassembler. It can generate a more readable assembly pseudo code with colored syntax. You can write scripts with the available Python api see an example below. The project is still in big development. wiki : TODO list and some...

patching

Patching - Interactive Binary Patching for IDA Pro Overview Patching assembly code to change the behavior of an existing program is not uncommon in malware analysis, software reverse engineering, and broader domains of security research. This project extends the popular IDA Pro disassembler to...

hyperion-disassembler

Hyperion A native multi-architecture disassembler and binary analysis tool. Supports PE, ELF, Mach-O, and .NET binaries across x86, x64, ARM, ARM64, MIPS, and PPC. Built from scratch in C++20 with ImGui. Single statically-linked executable. No installer, no runtime dependencies. Under 3MB...

detaped

Detaped Introduction Detaped is a Python disassembler and decompiler for Duktape GitHub. The intended use is for source code review and analysis in situations where you only have the compiled Duktape bytecode binary, such as in a black-box assessment. Features Parses JSE file format Disassemble J...