Skip to content

software-reversing.md

Latest commit

 

History

History
659 lines (441 loc) · 25.5 KB

software-reversing.md

File metadata and controls

659 lines (441 loc) · 25.5 KB
Raw

Awesome Software Reverse Engineering Awesome

A curated list of awesome reverse engineering resources to make you better!

Managed by Reversing.ID for the reversing community.

Introduction

Software Reverse Engineering focus on code, related data, and architecture which build a complete software.

The goals:

  • Recover lost information, or to make documentation.
  • Detect side effects (bugs, backdoor, vulnerabilities)
  • Synthesis higher abstraction.
  • Facilitate reuse.

In most case, the target of Software Reversing is code in compiled form (native or intermediate), either executable or libraries.

Table of Contents

Books

Reversing Concept

Tools

Assembly and languages

Malware Analysis

Specific topic on Software Reverse Engineering

White Papers

Articles

Courses

Reverse Engineering Courses

Channels

Binary Analysis Channels

Practices

Practice Reverse Engineering

Crackmes and reversing challenges

Malware samples and information sharing

References

Learning Assembly

Intermediate Representation

Static Analysis

Hex Editors

Hex editor lets you view/edit the binary data of a file.

Multi/cross platform

Windows

Mac OS X

Binary Format & Inspection

File information and format identifier

Executable detector

Executable explorer

Dependency check

Format parser and modification

  • ImHex - explore, edit, and represent binary structure with C++-like pattern language.
  • Kaitai Struct - develop format parsers by declarative approach.
  • LIEF - Library to Instrument Executable Formats, easily parse, modify and abstract many file formats.
  • QuickBMS - easily extract and modify file format with support of encryption, compressions, obfuscation, and other algorithms.

Bytecode Editors

Java bytecode editor

Disassemblers & Decompilers

Native (x86 / x64 / ARM)

Android / DEX

  • JEB2 - eclipse-based integrated reverse engineering platform for analyzing various parts of Android application components.
  • jadx - DEX to Java decompiler

.NET

AutoIT

  • myAut2Exe - scan and extract the AutoIT script.
  • Exe2Aut - extract the AutoIT script by running it.

Cocos2d-x / Game Binary

  • reverse - static analysis and XXTEA key extraction tool for Cocos2d-x apps.

Dart / Flutter

  • unflutter - static analyzer for Flutter/Dart AOT snapshots, recovers function names, class layouts, and generates Ghidra/IDA metadata.

Delphi

Ethereum (EVM / Solidity)

  • evmdis - EVM disassembler by static analysis on the bytecode.
  • pyevmasm - assembler and disassembler library for EVM (Ethereum Virtual Machine).

Flash

  • JPEXS Flash Decompiler - open source SWF decompiler and editor, convert SWF to FLA, edit ActionScript, replace resources (images, sounds, texts, fonts).
  • Flare - extract all scripts from SWF.

Java

JavaScript

  • spidermonkey-dumper - decode and disassemble SpiderMonkey .jsc bytecode from Cocos2d-x games.

Lua

  • UnLuac - decompiler for Lua 5.0 - 5.4 and require debugging information (non-stripped).
  • LuaDec - decompiler based on luadec 5.0.x and LuaDec51.

Python

  • uncompyle6
  • decompile3 - reworking and refactoring of uncompyle6 which focus on Python 3.7+
  • pycdc - disassembler and decompiler written in C++.
  • dis - built-in python disassembler.
  • pyfalcon - cross-version Python disassembler written in Rust.
  • pycdas - disassembler written in C++.

WebAssembly (WASM)

Dynamic Analysis

Debuggers

Multi/cross platform

Windows

Linux

  • QIRA - timeless debugger which track all state while program is running.
  • EDB

Virtual Machine Introspection

Hypervisor debugger

  • HyperDbg - minimalistic hypervisor with hardware-assisted virtualization to debug kernel.

Python source code/bytecode debuggers

  • pdb - built-in python interactive source debugger.
  • python3-trepan - gdb-like debugger supports both source code and bytecode debugging.

GDB enrichment

OllyDbg variants

Graphic debugger

Dynamic Binary Instrumentation

Native

  • DynamoRIO - runtime code manipulation system that supports code transformation on any part of program.
  • Frida - scriptable DBI toolkit for cross-platform target.
  • Pin
  • QBDI - modular, cross-platform, and cross-architecture DBI framework backed by LLVM.

.NET

  • Hawkeye2 - view, edit, analyze, and invoke (almost) any object from .net applications.
  • UnityDoorstop - execute managed assemblies inside Unity as early as possible.

Android

  • ArtHook - self-contained, dependency-free ART method hooking for Android 8-15.

Code Emulators

Behavior Analysis

Network simulation

Packet capture

Process

Tracer

Sandbox

Misc

  • Objective-See Utilities
  • XCode Instruments - XCode Instruments for Monitoring Files and Processes User Guide
  • dtrace script for Mac - sudo dtruss = strace dtrace recipes
  • fs_usage - report system calls and page faults related to filesystem activity in real-time. File I/O: fs_usage -w -f filesystem
  • dmesg - display the system message buffer.
  • Mira - Runtime protection analysis platform for third-party Android and iOS apps, enabling AI to use host-app-side shell, Java, Native, and Frida capabilities for environment risk detection and hardening validation.

HTTP Intercept Proxy

Automation & Frameworks

Binary Analysis Framework

  • Angr - python framework for analyzing binaries, combines both static and dynamic symbolic (concolic) analysis.
  • Triton - dynamic binary analysis (DBA) framework.
  • BAP - suite of utilities and libraries that enable analysis of programs in their machine representations.
  • BitBlaze
  • PANDA - Platform for Architecture-Neutral Dynamic Analysis, built on QEMU system emulator, analyze code in runtime.
  • BARF
  • S2E - platform for in-vivo analysis of software systems.
  • miasm - analyze / modify / generate binary program with python.
  • soot - java optimization framework.

Symbolic Execution

  • KLEE - dynamic symbolic execution engine built on top of the LLVM compiler infrastructure.
  • manticore - symbolic execution tool for analysis of smart contracts and binaries.
  • Kite - conflict-driven symbolic execution tool (proof of concept).
  • jCUTE - Java Concolic Unit Testing Engine, automatically generate unit tests for Java programs.
  • ExpoSE - dynamic symbolic execution engine for JavaScript.
  • ESILSolve - python symbolic execution framework using r2 and ESIL.

Binary Lifting

  • McSema - framework for lifting x86, amd64, and aarch64 program binaries to LLVM bitcode.

Theorem Provers & Solvers

Code Protection & Anti-Analysis

Obfuscators

Native

AutoIt scripts

Deobfuscators

Native

.NET

Java

Javascript

PHP

Python

String extraction

Android

Unpackers

Reconstructors

Import reconstructor

Data-type reconstructor

Dumpers

Android DEX dumper

  • eBPFDexDumper - dump DEX from memory using eBPF hooking on Android.
  • eBPFDexDumper-rs - alternative of dumping DEX from memory using eBPF (written in Rust).

Visualization & Misc

Binary Visualization

See also Format Reverse Engineering.

Document Analysis

Office Doc and Macro

PDF

Misc

  • bingrep - grep through binaries.
  • Assembly REPL - native raw assembly, LLVM IR, C, C++, and Objective-C REPLs for macOS and Linux.

MCP Servers

MCP (Model Context Protocol) servers for integrating reversing tools with LLM workflows.

Disassemblers

Debuggers

  • LLDB - official native MCP support as of June 2025, plus community implementations.
  • GDB MCP Server - multiple implementations providing comprehensive debugging capabilities.

Dynamic Binary Instrumentation

  • frida-mcp - MCP server for Frida with process management, script injection, and real-time instrumentation.

Behavior Analysis

  • WireMCP - Wireshark MCP server with threat detection capabilities.

Tool Scripting & Plugins

IDA Pro Scripting

  • IDA Python Src - source code for IDAPython plugin, enable python script running in IDA Pro.

References

Script collection

Ghidra Scripting

Script collection