Binary & Format Analysis (RE Tooling): open-source projects that exist because someone reverse engineered a closed product, sorted by GitHub stars.
Program for determining file types, compilers and packers
FLARE tool that identifies capabilities in executable files
Library to parse and modify ELF, PE and Mach-O binaries
Terminal UI to analyze ELF binaries
Extracts obfuscated, stack and tight strings from malware binaries
Scans a running process for injected or modified code and dumps it
Multiplatform PE file reversing tool
Detect It Easy engine for identifying file types, packers and compilers
Reverse-engineers' hex editor with structure annotation
Python module to read and work with PE files
Static binary analyser with value/taint analysis and type reconstruction for IDA
Automated static analysis tools for binary programs
Toolset to extract .proto definitions from apps and fuzz Protobuf-based endpoints
Ghidra-based static vulnerability scanner for binaries using abstract interpretation
Intermediate language and optimizer for devirtualizing and deobfuscating binaries
ELF file viewer and editor
Tool for reverse engineering the structure of Angular applications
Cross-platform Rust crate to parse ELF, PE, Mach-O and archive binaries
Automatic deobfuscation of VMProtect-protected functions with symbolic execution and LLVM
Ghidra-based tool that finds vulnerable patterns (CWEs) in binary executables
Graphical tool to visualize binary data
PE file viewer and editor
Binary data visualization and analysis tool
Portable executable (PE) manipulation toolkit
Static binary rewriting tool for x86-64 ELF binaries
Library for reading, editing and writing PE files and .NET modules
Tool to reverse engineer Protocol Buffers messages with unknown definitions
Recovers Go build metadata, function names, line tables and types from binaries
Hex viewer, editor and analyzer with binwalk integration
Mach-O file viewer for Windows, Linux and macOS
WPF/.NET hex editor IDE for binary analysis with .NET assembly inspection
Symbolic-execution deobfuscation of Tigress-protected binaries and its RE challenges
Deobfuscation via LLVM IR optimization of lifted assembly
Extracts type and symbol information from PDB files
Hex diff viewer using sequence alignment algorithms
Binarly vulnerability detection framework for binaries and firmware
Hardware netlist reverse engineering and analysis framework
PE file analysis toolkit
Multi-platform GUI for bit-level analysis and visualization of data
Static binary rewriting to retrofit compiler passes into binaries
Chainguard tool that detects supply-chain compromise behaviors in binaries
Python pickle decompiler and static analyzer
Google JavaScript analysis IR used for LLM-powered deobfuscation (CASCADE)
Matches and diffs source code directly against binaries
Mach-O file explorer for macOS and Windows
Assembly code clone search and analysis platform
Ghidra plugin that runs angr symbolic execution
Binary genetic traits lexer framework for function similarity
Visual reverse engineering tool that plots binary data patterns
Binary analysis framework in Rust
Linker, compiler and tool detector for binaries
ERESI reverse engineering software interface for ELF binaries
Patched unsquashfs that handles vendor-modified SquashFS images
Colourful visualization tool for binary files
Static-analysis framework to find fuzzable targets in binaries
Miasm-based function divination to identify known functions in binaries
pip install k2l | Mach-O + Obj-C analysis TUI / CLI kit and library. Zero compiled deps, runs anywhere with a python...
Translator and tools for REIL, the Reverse Engineering Intermediate Language
Python framework for static symbolic binary analysis
Shellcode analysis framework that emulates Windows APIs and syscalls
Rust parser for Microsoft PDB (Program Database) debug information
GUI and CLI tool that removes bloat padding from executables for analysis
Binary Ninja script that removes OLLVM control-flow flattening
Cross-platform hex editor with disassembler and assembler support
IDA plugin that decompiles VMProtect-virtualized code
Library identification tool for statically linked stripped binaries
Unstrips Rust and Go binaries (ELF and PE)
Go package to parse and analyze PE files
Library function identification for stripped binaries
Compare symbols, types and syscalls across Windows builds
Intermediate representation for binary analysis and rewriting
Terminal-first Rust RE toolkit for PE/ELF/Mach-O analysis via CLI, TUI and MCP
Browser and decompiler for Unreal Engine packages and UnrealScript classes
Browse and extract C/C++ type declarations from PDB files
GUI hex editor focused on binary file exploration and pattern recognition
Mixed Boolean-Arithmetic expression deobfuscation via coefficient reconstruction
Reverse engineered NVIDIA SASS instruction dictionary and kernel audit patterns across GPU architectures
PEiD detector for packers, cryptors and compilers in PE files
Rust TUI binary patcher and hex editor with disassembly for ELF, PE and Mach-O
Enigma Virtual Box unpacker
Reverse engineering tool that restores Cocos Creator game builds to projects
DynamoRIO-based tool for automatic structure recovery
.NET patcher library built on dnlib
IDA Pro plugin that deobfuscates code at decompilation time
Browser IDE for writing and testing Kaitai Struct format specs
Ghidra plugin that locates cryptographic constants
Interactive tool to reconstruct structures and generate C headers while reverse engineering
Ghidra extension integrating BinDiff function matching
Modular TUI hex editor with binary diffing
Visual binary analysis and reverse engineering tool
Deobfuscator for Obfuscator-LLVM control-flow flattening
Swift library for parsing Mach-O files
Tools for reverse engineering Flash SWF files
Recovers Windows API imports from arbitrary memory dumps
Open source binary analysis and symbolic execution tools
Dynamic visual debugging and data reverse engineering tool suite
Simplifier for general mixed Boolean-arithmetic (MBA) obfuscated expressions
Binary diffing framework
Fast and accurate binary exporter from IDA
Custom ELF linker/loader that installs ET_REL binary patches at runtime
Research on devirtualizing .NET code virtualization protectors
Vim-inspired terminal hex editor
Fully featured GUI hex control for Windows (MFC)
Efficient deobfuscation of linear mixed Boolean-arithmetic expressions
Jump-aware transformer for binary code similarity detection
Colour hexdump tool for inspecting binary files
Deobfuscator for JavaScript produced by obfuscator.io
Binary analysis framework written in Rust
PE32/PE32+ binary analysis tool and resource viewer
Open source software for chip reverse engineering from die images
Hex/file format viewer for reverse engineering
Checksum reverse engineering toolbox that finds checksum parameters from samples
Control-flow-flattening and string deobfuscator
Library and tool for reading IDA Pro databases
Python library for reading IDA Pro databases
Classic Mac OS resource fork decoder and 68K/PPC disassembler with format-specific RE tools
Open binary diffing framework
Static binary instrumentation for coverage analysis
Python framework for analyzing Unity applications
IDA plugin that pinpoints obfuscated code
Portable reverse engineering framework
Multiplayer CMOS standard cell chip reverse engineering tool
Decompiles MSVC PDB files into C++ source declarations
Efficient general mixed Boolean-arithmetic (MBA) simplifier
Removes BR-register control flow obfuscation from Android native code using unidbg
AST-based JavaScript deobfuscator source code from the ReverseJS blog
Plugins for the Il2CppInspector Unity IL2CPP analysis tool
Browser for Mach-O disassembly dumps generated by otx and otool
Protobuf payload decoder and analyzer without schema
macOS binary analysis tool: Mach-O parsing, ARM64 disassembly and code signatures
PowerShell and JavaScript deobfuscator based on tree-sitter
CRC reverse engineering tool in Python
Symbol recovery tool for Nuitka-compiled Python binaries
Rust symbol recovery tool
Unreal Engine address scanner and test suite for game binaries
Binary patching framework built with MLIR and Ghidra
Reverse engineering toolkit including ARM emulator and spec-derived disassembler
IDA plugin that parses Qt meta-object data
Disassembles serialized protobuf descriptors back to .proto
Modules and scripts for analyzing Nim binaries
Experimental tools for analyzing minified or obfuscated JavaScript
Derives Protobuf schemas from compiled protoc output in binaries
Scripts to reverse engineer old programmable logic devices (PAL/GAL)
Tool to untangle wires for chip die reverse engineering
Pointer Sequence Reverser for Windows C++ application structures
Recovers compile units from stripped binaries
Protobuf decompiler recovering .proto from binaries
Binary diffing plugin for Binary Ninja
libil2cpp symbol parser for IDA
Extracts embedded files from application virtualizers
Deobfuscator for JavaScript samples obfuscated by obfuscator.io
Integrated circuit reverse engineering software
Network message syntax reverse engineering by analysis of message value structure
Exports type tree information from the Unity editor
Library and model framework for reverse engineering binary file formats
Python library of checksums, compression and encryption helpers for game file reverse engineering
Deobfuscator for JavaScript protected by JSDefender
Binary-analysis-based protocol reverse engineering with improved field inference
Parser and debugger for Garmin Connect IQ compiled PRG binaries
Semantic field inference for reverse engineering binary message formats (research code)
Rust framework for analyzing and reverse engineering .NET PE executables
Utility for adding sections to and modifying original Xbox executables
Python module that parses PowerBuilder PBD files and analyzes the code
Determines the Unreal Engine 4/5 version a game was built with
Bun CLI/TUI for reverse engineering frontend bundles, WASM and service workers
Lifts network protocol implementations to precise message format specifications
Protocol reverse engineering workbench
Reimplementation of the FieldHunter protocol reverse engineering approach
MachO's Other Tooling
Generates IDC scripts from Unity IL2CPP metadata
Godot RE toolkit that turns a Godot game (PCK/EXE) into an openable project
Static triage of Electron archives, JS bundles and ELF/Mach-O/PE binaries, with CLI and MCP
Ghidra deobfuscation framework: OLLVM/Tigress deflattening and MBA simplification
Decoder for compiled iOS/macOS NIB interface archives into object trees and connections
Suite of binary reverse engineering tools written in Zig