BinAbsInspector

What is BinAbsInspector? BinAbsInspector Binary Abstract Inspector is a static analyzer for automated reverse engineering and scanning vulnerabilities in binaries, which is a long-term research project incubated at Keenlab. It is based on abstract interpretation with the support from Ghidra. It...

capstone

Capstone Engine !TIP Welcome to join our community group! Capstone is a disassembly framework with the target of becoming the ultimate disasm engine for binary analysis and reversing in the security community. Created by Nguyen Anh Quynh, then developed and maintained by a small community, Capsto...

auto-re-agent

re-agent Autonomous reverse-engineering agent — source-aware reverser/checker loop, objective verifier, parity engine, and Ghidra backend. Overview Demo: YouTube re-agent automates a reverse-engineering workflow by combining a reverser/checker loop with Ghidra decompilation through...

Reverse-Engineering

A FREE comprehensive reverse engineering tutorial covering x86, x64, 32-bit/64-bit ARM, 8-bit AVR and 32-bit RISC-V architectures. FREE EMBEDDED HACKING COURSE PROMO HERE Join DC540 Discord HERE OUROBOROS BADGE HERE HOW IT WORKS HERE CLICK IMAGE BELOW TO WATCH THE PROMO VIDEO! Today's Tutorial Ju...

Ghidra_v810_v830

Ghidra processor description module for NEC/Renesas v810 and v830 families These modules were made by taking the v850 modules that come with Ghidra as a template and rewriting them to work with v810 and v830 family instructions. 1. V810 description based on User’s Manual: V810 Architecture link 2...

GhidrAssist

GhidrAssist Author: Jason Tang An advanced LLM-powered plugin for interactive reverse engineering assistance in Ghidra. Description GhidrAssist integrates Large Language Models LLMs into Ghidra to provide intelligent assistance for binary exploration and reverse engineering. It supports any OpenA...

rz-ghidra

rz-ghidra This is an integration of the Ghidra decompiler and Sleigh Disassembler for Rizin. It is solely based on the decompiler part of Ghidra, which is written entirely in C++, so Ghidra itself is not required at all and the plugin can be built self-contained. This project was presented,...

cerberus-re-skill

Cerberus RE cerberus-re is a local Apple-focused reverse-engineering workbench for building a repeatable three-headed static/dynamic/instrumentation loop around Ghidra, LLDB, and Frida. It is designed for analysts and coding agents that need durable artifacts instead of terminal-only notes: Ghidr...

OGhidra

OGhidra 3 - AI-Powered Reverse Engineering with Ghidra For the version using a Claude-inspired Orchestrator, see https://github.com/llnl/OGhidra/tree/orchestrator OGhidra bridges Large Language Models with Ghidra's reverse engineering platform, enabling AI-driven binary analysis through natural...

lst2x64dbg

lst2x64dbg This command extracts all the labels found in the LST file that is given as the single argument. An x64dbg database is created in the current directory based on the extracted labels. The LST file can be generated in IDA from the File menu: Produce file - Create LST file... Example...

replica

REPLICA TAME THE DRAGON ✨Features ⚡ Disassemble missed instructions - Define code that Ghidra's auto analysis missed ⚡ Detect and fix missed functions - Define functions that Ghidra's auto analysis missed ⚡ Fix 'undefinedN' datatypes - Enhance Disassembly and Decompilation by fixing 'undefinedN'...

polypyus

Polypyus Firmware Historian Polypyus learns to locate functions in raw binaries by extracting known functions from similar binaries. Thus, it is a firmware historian. Polypyus works without disassembling these binaries, which is an advantage for binaries that are complex to disassemble and where...

maat

About Maat is an open-source Dynamic Symbolic Execution and Binary Analysis framework. It provides various functionalities such as symbolic execution, taint analysis, constraint solving, binary loading, environment simulation, and leverages Ghidra's sleigh library for assembly lifting:...

vmprotect-research

VMP Devirtualizer - Production Release Generalized VMProtect devirtualizer supporting versions 1.x, 2.x, and 3.x. Standalone CLI tool + Ghidra plugin. Status: ✅ Production Ready | Validation: 22/22 samples 100% | Scope: VMP ≤3.6 3.7+ requires reverse engineering Features Multi-Version Support: VM...

sharem

SHAREM Welcome to SHAREM! SHAREM was presented at DEFCON 31 in "Game-Changing Advances in Windows Shellcode Analysis" and Black Hat USA Arsenal. A companion Ghidra plugin was made available separately from Trellix, courtesy of Max Kersten. Thus, you can extend the power of SHAREM to Ghidra, if yo...

radare2

Radare2: Libre Reversing Framework for Unix Geeks Current git master branch is 6.2.2, next release will be 6.2.4. Description r2 is a complete rewrite of radare. It provides a set of libraries, tools and plugins to ease reverse engineering tasks. Distributed under LGPLv3, despite each plugin can...

rikune

Rikune Rikune is an MCP server for reverse engineering Windows executables and related binary formats. It combines sample intake, static triage, Ghidra-assisted function recovery, plugin-driven specialist tooling, artifact management, and optional isolated Windows runtime execution behind a Model...

ghidra2frida

ghidra2frida ghidra2frida is a Ghidra Extension that, working as a bridge between Ghidra and Frida, lets you create powerful Ghidra scripts that take advantage of Frida's dynamic analysis engine to improve Ghidra statical analysis features. It supports all platforms supported by Frida Windows,...

ghidra-mcp

Ghidra MCP Server...

ai-reverse-engineering

Rev·Deck — AI-Assisted Reverse Engineering with Ghidra Rev·Deck is a local, single-user static-analysis workstation. It pairs an evidence-first web UI with an LLM copilot over a binary analyzed by a headless Ghidra service: browse deterministic evidence functions, strings, imports,...