pefile

pefile pefile is a multi-platform Python module to parse and work with Portable Executable PE files. Most of the information contained in the PE file headers is accessible, as well as all the sections' details and data. The structures defined in the Windows header files will be accessible as...

retdec

Warning The RetDec project is currently in a limited maintenance mode due to a lack of resources: Pull Requests are welcomed. They are reviewed with priority, if possible without delays. Issues are reacted on with delays up to one quarter. Issues are not actively solved unless they relate to a...

rizin

Rizin Rizin is a reverse engineering framework, born as a fork of the radare2, with a focus on usability, features and cleanliness. Rizin is portable and it can be used to analyze binaries, disassemble code, debug programs, as a forensic tool, as a scriptable command-line hexadecimal editor able ...

peanalyzer

peanalyzer Advanced Portable Executable File Analyzer Python 3.5.2 : Tested Working Usage python peanalyzer.py --file file.exe --show all|file-path|general|dos-header|file-header|optional-header|data-directory|section-headers|imports python peanalyzer.py --file file.exe --disassemble all...

fhex

Fhex - A Full-Featured HexEditor This project is born with the aim to develop a lightweight, but useful tool. The reason is that the existing hex editors have some different limitations e.g. too many dependencies, missing hex coloring features, etc.. This project is based on qhexedit2 , capstone...

HexWalk

HexWalk - Hex Editor/Viewer/Analyzer HexWalk is an Hex editor, viewer, analyzer. Built on qhexedit2, Capstone and Qt, with a built-in signature scanner, HexDig, inspired by binwalk. It is cross platform and has plenty of features: Advanced Find can find patterns in binary files based on...

Android-Disassembler

Android-Disassembler !ci12 CodeFactor Analyze malicious app on your phone Maintenance status Maintenance has resumed, but the project is still in a recovery and modernization phase. The baseline now expects initialized git submodules before building. Default open/import/export flows now use...

ddisasm

Datalog Disassembly DDisasm is a fast disassembler which is accurate enough for the resulting assembly code to be reassembled. DDisasm is implemented using the datalog souffle declarative logic programming language to compile disassembly rules and heuristics. The disassembler first parses ELF/PE...

IODIDE

IODIDE - The IOS Debugger and Integrated Disassembler Environment Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Andy Davis, andy dot davis at nccgroup dot com https://github.com/nccgroup/IODIDE Released under AGPL see LICENSE for more information Includes the...

ScratchABit

ScratchABit ScratchABit is an interactive incremental disassembler with data/control flow analysis capabilities. ScratchABit is dedicated to the efforts of the OpenSource reverse engineering community reverse engineering to produce OpenSource drivers/firmware for hardware not properly supported b...

Glass

Glass as in transparent and smooth A fast, native, mobile-app first interactive disassembler. Spiritual successor to IDA Pro for the Android / iOS reverse engineering workflow, built around: smali for APK / DEX / smali handling armv8-encode for AArch64 and ARMv7 A32 / Thumb — native .so, iOS Mach...

ceasta

ceasta a disassembler, decompiler and debugger in one — for windows, linux and macos, x86, x64 and arm64 ida-style listing, a decompiler, a function graph, an x64dbg-style debugger, lua plugins, and a built-in MCP server so you can point an AI at a binary — one small program, everything vendored,...

sharem

SHAREM Welcome to SHAREM! SHAREM was presented at DEFCON 31 in "Game-Changing Advances in Windows Shellcode Analysis" and Black Hat USA Arsenal. A companion Ghidra plugin was made available separately from Trellix, courtesy of Max Kersten. Thus, you can extend the power of SHAREM to Ghidra, if yo...

hyperion-disassembler

Hyperion A native multi-architecture disassembler and binary analysis tool. Supports PE, ELF, Mach-O, and .NET binaries across x86, x64, ARM, ARM64, MIPS, and PPC. Built from scratch in C++20 with ImGui. Single statically-linked executable. No installer, no runtime dependencies. Under 3MB...

regenerator2000

Regenerator 2000 Regenerator 2000 is an interactive 6502 disassembler for Commodore 8-bit machines. It is inspired by the original Regenerator. 🕹️ Manual Analysis — Use the keyboard-centric terminal interface to navigate code, define data regions, label subroutines, add comments, and refine your...

Krakatau

Krakatau provides an assembler and disassembler for Java bytecode, which allows you to convert binary classfiles to a human readable text format, make changes, and convert it back to a classfile, even for obfuscated code. You can also create your own classfiles from scratch by writing bytecode...

dsync

dsync IDAPython plugin that synchronizes decompiled and disassembled code views. Please refer to comments in source code for more details. Requires IDA Pro 7.3 N.B.: You may want to use the official synchronization feature introduced with IDA 7.3 instead...

patching

Patching - Interactive Binary Patching for IDA Pro Overview Patching assembly code to change the behavior of an existing program is not uncommon in malware analysis, software reverse engineering, and broader domains of security research. This project extends the popular IDA Pro disassembler to...

grap

grap: define and match graph patterns within binaries https://github.com/QuoSecGmbH/grap grap takes patterns and binary files, uses a Casptone-based disassembler to obtain the control flow graphs from the binaries, then matches the patterns against them. Patterns are user-defined graphs with...

sandsifter

s a n d s i f t e r : the x86 processor fuzzer Overview The sandsifter audits x86 processors for hidden instructions and hardware bugs, by systematically generating machine code to search through a processor's instruction set, and monitoring execution for anomalies. Sandsifter has uncovered secre...