Dynamic Instrumentation (RE Tooling): open-source projects that exist because someone reverse engineered a closed product, sorted by GitHub stars.
Dynamic instrumentation toolkit for native apps
Record and replay debugger for Linux
Lightweight multi-architecture CPU emulator framework
GDB extension that adds dynamic-analysis commands and context views
Dynamic binary analysis library with symbolic execution
Hypervisor-based native debugger for reverse engineering
Timeless debugger that records and lets you browse full program execution
Windows and Linux userspace emulator for analysis
Dynamic binary instrumentation tool platform
GDB front-end and memory scanner for reverse engineering games on Linux
Cross-platform x86/x86-64 GUI debugger
Platform for architecture-neutral dynamic analysis built on QEMU
Text hooker that extracts text from running games and visual novels on Windows
Rootless Xposed framework based on LSPosed, recreated from LSPatch
Code coverage explorer plugin for IDA and Binary Ninja
Hand-crafted Frida examples
Windows kernel and user-mode emulation framework for PE files and shellcode
LLVM-based dynamic binary instrumentation framework
Intel Pin tool for tracing API calls
Python-scriptable RE sandbox built on QEMU for VM instrumentation and inspection
Frida instrumentation scripts for reverse engineering mobile apps
Execution trace explorer plugin for IDA Pro
Radare2 and Frida integration
Lightweight dynamic instrumentation library for Windows, macOS, Linux
Multi-arch debugger built on PyQt5 and Frida
Frida-based tool to trace and modify iOS app methods
Library for emulating code from Windows memory dumps
x64 VT-x hypervisor for Windows and Linux with sandbox and introspection engine
Tool for hooking and reverse engineering macOS / OS X processes
Binary instrumentation, analysis and modification libraries
Windows endpoint behavior monitor (open procmon) for system activity analysis
Hyper-V based hypervisor for memory introspection and reverse engineering
x64 dynamic reverse engineering toolkit with import, syscall and hook views
IDA Pro plugin with friendlier register and stack views while debugging
LLDB MCP integration and helper commands for reverse engineering
Tool that reveals anti-debugging and anti-VM checks in Windows binaries
yet another tweak injector / tweak hooking library for darwin systems
PC emulator built for reverse engineering and rewriting real-mode DOS programs
Frida scripts that parse libil2cpp.so at runtime in Unity games
Frida-based execution tracer for Android, iOS, Linux and Windows
JavaScript port of the Unicorn CPU emulator framework
Self-optimizing code tracer based on dynamic recompilation
Time Travel Debugging trace plugin for IDA
Intel Pin tools for dynamic binary analysis
Unofficial Frida extension for VS Code
A free runtime modification library.
Binary emulation environment for Windows PE files
Platform for multi-path program analysis with selective symbolic execution
CDP-based runtime instrumentation platform for browsers
Python reverse engineering framework (debugger, stalker, IDA integration)
Uses Intel PIN instruction counting to solve CTF reversing challenges
LLDB plugin making it more useful for reverse engineering
Bidirectional XPC message interception on macOS/iOS, powered by Frida
GDB debug server for the Unicorn emulator
Binary emulation and instrumentation platform
DynamoRIO-based library call tracer for Windows and Linux
Windows x64 user-mode application emulator using Hyper-V
Live memory browser for iOS and macOS apps in Xcode
Statically compiled GDB and gdbserver binaries for many architectures
GDB TUI dashboard for remote debugging of embedded targets
Web-based Frida toolkit for Android and iOS
JavaScript hook toolkit for web reverse engineering
DTrace on Windows reimplementation for syscall tracing
Instruction trace visualisation tool for dynamic analysis
System call tracing and hooking library based on Frida's Stalker
Frida-based text hooker for games and visual novels on emulators
Open-source debugger plugin for Binary Ninja
Java dynamic reverse engineering and debugging tool via injected DLL
BIOS reverse engineering and debugging over serial with GDB support
Tool for viewing and analyzing execution traces
Visual bridge between a GDB session and Ghidra
x86/x64 and AArch64 emulator for PE, ELF and Mach-O investigation with Windows API models
Python library to script debugging of Linux binary executables
Native P-code emulator plugin for Ghidra
Scriptable x86/x64 sandbox emulator for shellcode and PE binaries (Unicorn)
Xposed plugin that exposes Android app functions over HTTP
Syser ring-3 debugger for x86/x64 Windows with source-level debugging
Debugger built on top of Frida
.NET runtime inspector that dumps objects and assemblies from running processes
Native x86/x64 function hooking library for C#
Packages Frida scripts into standalone executables
Dynamic injection tool for Linux and Android
WinDbg-like Windows kernel debugger that runs from Linux and macOS
Runtime profiler from the REA author that gives agents traces and hotspot evidence
Windows emulator and debugger for reverse engineering executables
Unicorn-based ARM64 dynamic tracing tool with IDA integration
Android native tracing and reverse engineering tool for function wrapping and instruction tracing
Browser-based GUI for the LLDB debugger
Reverse engineering software using a full-system Simics simulator
GDB-like debugger for the Unicorn emulator
Android Frida GUI manager
Frida tooling to read variables and hook functions in Xamarin/Mono apps
Hooking framework for commercial Android emulators (LDPlayer, NOX, BlueStacks)
Sniffs macOS/iOS XPC communication using Frida and Go
Write dynamic binary analysis tools in Python
Frida toolkit for Android reverse engineering
strace alternative for 64-bit iOS devices using Frida
Augments IDA static analysis with Pin-based dynamic instrumentation
Plugins that synchronize Ghidra and x64dbg
Stealth runtime instrumentation and CDP for web reverse engineering
Vue web UI that runs Android Frida hooks and pretty-prints results
Debugger-based code injection on Android via ADB and JDWP
Helper library for inspecting Unity IL2CPP games with Frida
ARM trace taint tracking and search tool with MCP support
Sniffs XPC messages on iOS devices
Injects JavaScript or TypeScript agents into processes with Frida, bundled on the fly
Proxy DLL dumping JVM classes at the JNI level on Windows
Debugger for Windows ARM64 aimed at reverse engineers
Better stacks and backtraces in Frida
Pure-JS bindings to control Frida from Node.js and browsers
XPC message sniffer for macOS using LLDB
PlayStation 2 vector unit tracing debugger
GDB-compatible debugger for the PS Vita
Reverse-engineered API for Microsoft's Time Travel Debugger
Remote debugger for Nintendo DS games running in emulators
Frida MCP server with persistent instrumentation sessions for runtime inspection of apps
Dumps protobuf-net messages from IL2CPP Unity games into .proto files with Frida
Plugin that generates Frida snippets from IDA Pro, Binary Ninja and Ghidra
Finds which files a Nintendo DS game reads at runtime
XNU I/O tracer based on xnuspy for tracing Apple device drivers