Awesome Reverse Engineering Anything

An independent collection of tools, case studies and research for websites, games, apps, native binaries, firmware and communication protocols.

English · 简体中文

Search & filter · Browse cases · Research papers · HTML survey · Suggest a resource · Contributing

Source review does not imply runtime verification. Review method

Contents

For agents: Repository instructions · How to contribute and submit a PR · Contribution forms

766 curated resources (293 cases) · 182 papers · 3,309 indexed repositories · latest source review 2026-11-01. Section counts add up to 763 because 3 of these appear only under Papers.

• Find by task
• Resources (763)
  • Website (40)
  • Game (252)
  • App (116)
  • Native Binary (132)
  • Firmware and Hardware (47)
  • Protocol (44)
  • Agents and MCP (57)
  • Related Collections (24)
  • References and Learning (51)
• Papers (182)
  • Reverse-engineering agent evaluation (13)
  • Decompilation and symbol recovery (82)
  • Website reconstruction (28)
  • Game reconstruction and reverse engineering (11)
  • App reconstruction and analysis (15)
  • Firmware analysis and rehosting (16)
  • Protocol inference and analysis (17)
• Full Repository Index (3,309)
• Contributors
• About

Also on this page: Contributing

Find by task

Task	Relevant sections
Inspect a website or app interface	Websites · Apps
Rebuild a game or check matching code	Games · Game cases
Analyze compiled code or recover symbols	Native binaries · Agents and MCP
Investigate firmware or device protocols	Firmware · Protocols
Compare methods and evaluation evidence	Papers · Survey comparisons

Resources

Names link to original sources. Each line gives the opening sentence of the description, then the type and relationship; “Full entry” opens the complete description, prerequisites, limitations and review sources.

Each resource appears once under its main purpose. Cases reuse these entries; papers are listed separately. Browse the resource directory.

REA labels refer to the separate upstream CLI and MCP project. Listing does not imply REA integration. About this independent collection.

Tags: Official REA: published by the REA project · Community REA: third-party REA work · REA maintainer: an REA maintainer's list · Independent MCP, Independent agent, Independent reconstruction: no established REA connection · Mixed workflow: REA plus other tools, per the author · Android, .NET, JVM, WebAssembly: platform · Library: code library · type only: foundation tool or learning resource.

Website

↑ Contents

Case studies

• Dinosaur runner: recovering one acceleration rule - REA’s documented teaching case inspects the HTTP t-rex-runner edition and reconstructs its speed-update rule. _{Case study · Official REA · Also: Game · Full entry}
• rauchg.com: rebuilding an RSC blog from captured Flight output - Documents a website-rebuild-skill case that decodes browser-delivered React Server Component Flight streams, reconstructs a buildable Next project and compares its output with a captured site. _{Case study · Independent reconstruction · Full entry}
• BaoCut Slides: adapting an interactive web editor - Documents BaoCut’s interactive slide editor, whose author says the implementation draws on Claude Slides. _{Case study · Independent reconstruction · Also: App · Full entry}
• REA in Claude Code: an isolated static-analysis A/B trial - A Japanese field report connects REA 6.4.0 to Claude Code in a separate project directory, denies 43 of its 170 tools and common shell launch forms, and compares REA-enabled and REA-disabled runs on two real tasks: an Electron terminal’s packaged files and a saved HAR capture. _{Case study · Mixed workflow · Also: App · Full entry}
• Dinosaur runner: an REA-inspected speed rule rebuilt with Codex - The author uses REA’s MCP browser tools to passively capture the JavaScript loaded by wayou’s open-source T-Rex Runner page, then has Codex rebuild its acceleration rule in one self-contained HTML5 Canvas game. _{Case study · Mixed workflow · Also: Game · Full entry}
• Terminal: a Rust terminal informed by TradingView chart research - An independent Rust market interface uses REA browser-scenario research on public logged-out TradingView chart interactions. _{Case study · Mixed workflow · Also: App · Full entry}
• BaoCut Design: porting reconstructed canvas and design-system editors - Documents BaoCut’s design-canvas and design-system editors, which the project says it ported 1:1 from TypeScript reconstructions of Claude Design’s editors and hosts in agent sessions with annotation and export. _{Case study · Independent reconstruction · Also: App · Full entry}
• whatsapp-web-reveng: documenting the legacy WhatsApp Web protocol - Documents and reimplements the WebSocket protocol WhatsApp Web used while browser sessions mirrored a paired phone: QR pairing, Curve25519/HKDF key setup, AES/HMAC-protected binary messages, the token-based node encoding and end-to-end media encryption. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• Ruffle: a Rust reimplementation of Adobe Flash Player - Reimplements Adobe Flash Player in Rust so that SWF content, from ActionScript 1/2 (AVM1) to ActionScript 3 (AVM2), runs in a native desktop player or in browsers through WebAssembly, as a self-hosted script or a browser extension. _{Case study · Independent reconstruction · Also: Game · Full entry}
• Littlebird.ai static home-page rebuild - Rebuilds the Littlebird.ai home page in plain HTML/CSS/JavaScript from captured markup and assets, with source-wired mobile navigation, FAQ toggles, scroll reveals and OS-dependent call-to-action presentation. _{Case study · Independent reconstruction · Full entry}

Tools, projects and integrations

• webcrack - Improves JavaScript readability by reversing supported obfuscation patterns and unpacking webpack/Browserify bundles. _{Tool · Also: App · Full entry}
• humanify - Rename identifiers in minified JavaScript with LLM-suggested names, applied through scope-aware AST rewriting so the program structure stays unchanged. _{Tool · Full entry}
• WABT - WebAssembly tools for binary-to-text conversion, section inspection, validation, interpretation and C translation. _{Tool · WebAssembly · Also: Binary · Full entry}
• wasm-tools - Bytecode Alliance CLI and Rust libraries for inspecting WebAssembly modules, metadata, components and WIT interfaces. _{Tool · WebAssembly · Also: Binary · Full entry}
• Chrome DevTools MCP - Connect an agent to Chrome for live page inspection, network debugging, and performance traces. _{Integration · Independent MCP · Full entry}
• mitmproxy - Inspect and record HTTP traffic with an interactive proxy, web interface, or scriptable command-line tools. _{Tool · Also: App, Protocol · Full entry}
• Playwright MCP - Drive browser interactions through structured accessibility snapshots to investigate reproducible web behavior. _{Integration · Independent MCP · Full entry}
• Burp Suite MCP Server - PortSwigger's Burp Suite extension serves an MCP endpoint, plus a packaged stdio proxy, so agents can query proxy HTTP and WebSocket history, send HTTP/1.1 or HTTP/2 requests, and open Repeater or Intruder tabs. _{Integration · Independent MCP · Also: App · Full entry}
• Wakaru - Recover readable modules from shipped JavaScript bundles by reversing recognized minifier and transpiler patterns. _{Tool · Full entry}
• Spectral - Analyze captured application HTTP traffic with an LLM to generate MCP tools, OpenAPI 3.1 specifications, or GraphQL schemas. _{Integration · Independent agent · Also: App, Protocol · Full entry}
• jsdeob-workbench - Inspect JavaScript ASTs and variable scopes while building visual chains of Babel transforms. _{Tool · Full entry}
• Browser Reverse Engineering Toolkit - Capture browser-session evidence, crawl websites in a persistent Chromium session, and generate offline architecture/API reports plus OpenAPI, SDK and mock-server drafts from saved captures. _{Tool · Full entry}
• screenshot-to-code - Generate HTML/CSS, Tailwind, React, Vue, Bootstrap or Ionic front-end code from screenshots, mockups, Figma designs or screen recordings with multimodal models; an optional headless-browser preview lets the model check its rendered output. _{Tool · Full entry}
• Dembrandt - Node.js CLI that renders a website in Playwright-driven Chromium or Firefox and reads computed styles from the DOM to extract its design system: logo, color roles with the evidence behind each pick, typography, spacing, borders, shadows, motion, breakpoints and component styles such as buttons and inputs. _{Tool · Full entry}
• shuji - Command-line tool that writes the original JavaScript and CSS sources embedded in source maps back out as files. _{Tool · Full entry}
• Obfuscator.io Deobfuscator - Deobfuscator dedicated to JavaScript produced by Obfuscator.io (javascript-obfuscator), which its README says also handles most forks. _{Tool · Full entry}
• javascript-deobfuscator - General-purpose JavaScript deobfuscator for common obfuscation patterns, published on npm as js-deobfuscator and usable as a library or CLI. _{Tool · Full entry}
• mitmproxy2swagger - Command-line tool that reverse-engineers undocumented REST APIs from captured traffic. _{Tool · Also: Protocol · Full entry}
• JPEXS Free Flash Decompiler (FFDec) - Java desktop decompiler and editor for Adobe Flash SWF files. _{Tool · Also: Game · Full entry}
• WasmLens: exploratory WebAssembly inspection - Python CLI with static paths for inspecting WebAssembly sections and function signatures, producing WAT-style instruction listings, and reconstructing limited C-like pseudocode. _{Tool · WebAssembly · Also: Binary · Full entry}
• synchrony - JavaScript cleaner and deobfuscator aimed mainly at output from javascript-obfuscator (obfuscator.io). _{Tool · Full entry}
• sourcemapper - Go command-line tool that recreates a web front end's original JavaScript source tree from a source map generated by webpack or a similar bundler, writing each embedded source file under the path the map records. _{Tool · Full entry}
• ngrev - Electron desktop application that statically analyzes an Angular project's TypeScript sources and draws interactive graphs of its NgModules, components, directives, pipes and providers and how they depend on each other, without running the application. _{Tool · Full entry}
• jsluice - Bishop Fox's Go library and command-line tool that parses JavaScript with tree-sitter to recover the endpoints a script calls, judging values by how the code uses them rather than by regular expressions alone. _{Tool · Full entry}
• REstringer - HUMAN Security's Node.js JavaScript deobfuscator. _{Tool · Full entry}
• Chrome extension source viewer (CRX Viewer) - Browser extension and web page by Rob Wu for inspecting packaged browser extensions without installing them. _{Tool · Full entry}
• har-to-openapi - TypeScript library and CLI that infers OpenAPI 3.0 or 3.1 documents from HAR captures of HTTP traffic, loosely based on har2openapi. _{Tool · Full entry}
• decode-js - Babel-based AST processor that turns obfuscated JavaScript back into readable source, with one target selected per run: javascript-obfuscator (obfuscator.io), JS-Confuser 2.x up to its high preset, sojson and its v7 variant for jsjiami.com.v7, sojson's jjencode variant, and a generic pass for unreachable code, nested blocks and constant expressions. _{Tool · Full entry}
• javascript-deobfuscator (LostMyCode) - Browser-based Vue app that restores the strings Obfuscator.io hides behind string-array lookups in JavaScript. _{Tool · Full entry}
• minusone - Airbus CERT's Rust deobfuscation engine for scripts: it parses PowerShell or JavaScript with tree-sitter, applies rules that infer the values of syntax-tree nodes and prints a simplified script. _{Tool · Full entry}

Game

↑ Contents

Case studies

• DX-Ball: reconstruct sound panning - Recover one sound-pan function from instructions and constants; upstream cites 3,205 cases and a 63-byte match. _{Case study · Official REA · Also: Binary · Full entry}
• TH04: recover a DOS bullet-ring helper - Inspect a 16-bit PC-98 DOS helper and relate its angle calculation to a pinned reconstruction and historical compiler checks. _{Case study · Official REA · Also: Binary · Full entry}
• Super Mario 64 DS: matching decompilation with relocation checks - Reconstructs Super Mario 64 DS functions as C/C++ and permitted assembly primitives, comparing compiled output with a user-supplied cartridge dump. _{Case study · Independent reconstruction · Full entry}
• GoldenEye 007: an agent-assisted native port from a decompilation - Builds a native PC port on the existing GoldenEye 007 decompilation, with a host platform layer and assets extracted from the user’s ROM. _{Case study · Independent reconstruction · Full entry}
• ssbu-recomp: static recompilation with explicit mode limits - Translates Super Smash Bros. Ultimate 13.0.4 AArch64 code ahead of time and supplies a Windows runtime with Vulkan/OpenGL rendering. _{Case study · Independent reconstruction · Full entry}
• KartPad: platform integration for a Mario Kart Wii recompilation - Builds Apple and Android integration around WiiCompiled’s ahead-of-time translation of Mario Kart Wii, with native graphics, input and optional Retro Rewind support. _{Case study · Independent reconstruction · Full entry}
• BattleShip: an AI-assisted Super Smash Bros. native port - Ports the existing Super Smash Bros. N64 decompilation using libultraship and Torch. _{Case study · Independent reconstruction · Full entry}
• Agent decompilation: a byte-matching retrospective - Maurice Heumann describes replacing plausible-looking agent output with compiler-based checks of reconstructed functions, relocations, data and types. _{Case study · Independent reconstruction · Full entry}
• Snowboard Kids 2: an LLM-assisted N64 matching decompilation - A public matching decompilation of the N64 game Snowboard Kids 2, begun in 2024 with community decompilation tools. _{Case study · Independent reconstruction · Full entry}
• IsaacRecomp: translating Flash game bytecode to native C++ - Translates The Binding of Isaac’s Flash AVM1 bytecode into C++ functions and supplies a native rendering/input runtime. _{Case study · Independent reconstruction · Full entry}
• Nanolathe: a documented Total Annihilation engine reimplementation - Reimplements a Total Annihilation-compatible strategy-game engine in Go, with public file-format research and separate gameplay profiles. _{Case study · Independent reconstruction · Full entry}
• TH08: exact-source reconstruction and separately tested ports - Reconstructs the original Japanese Touhou 8 version 1.00d against its binary and original compiler, then adapts the recovered code for other platforms. _{Case study · Independent reconstruction · Full entry}
• Zelda 64: Recompiled — a native Majora’s Mask port without a full source decompilation - Uses N64Recomp to translate Majora’s Mask into a native application and RT64 for rendering. _{Case study · Independent reconstruction · Full entry}
• OpenGOAL: recovering GOAL code and rebuilding the Jak games - Reconstructs readable GOAL code from the original Jak binaries and compiles it with a new GOAL compiler for modern PCs. _{Case study · Independent reconstruction · Full entry}
• LEGO Island: source reconstruction with separately reported exact rebuilds - Reconstructs the English LEGO Island 1.1 source for its original 32-bit Windows target. _{Case study · Independent reconstruction · Full entry}
• Snowball War: a bounded REA-assisted minigame reconstruction - The author uses REA’s Ghidra workflow to investigate the DOS Ski or Die binary, document Snowball War rules and rebuild that one minigame in Rust with SDL2. _{Case study · Mixed workflow · Full entry}
• SpaceCadetPinball: decompiled game logic adapted to SDL2 - Converts the reverse-engineered Space Cadet pinball game into compilable C++ for desktop platforms. _{Case study · Independent reconstruction · Full entry}
• Super Mario 64: ROM reconstruction with explicit comparison gates - Reconstructs Super Mario 64 source for Japanese, North American, European, Shindou and iQue releases. _{Case study · Independent reconstruction · Full entry}
• Unleashed Recompiled: translating Xbox 360 game code and shaders - Builds an unofficial Sonic Unleashed PC port by statically recompiling Xbox 360 PowerPC code with XenonRecomp and Xenos shaders with XenosRecomp. _{Case study · Independent reconstruction · Full entry}
• OpenMW: replacing Morrowind’s engine while reusing original content - Provides an independent engine for playing Morrowind and an alternative editor, OpenMW-CS. _{Case study · Independent reconstruction · Full entry}
• REDRIVER2: reconstructing Driver 2 through a PlayStation compatibility layer - Translates reverse-engineered Driver 2 MIPS routines into C/C++ and uses Psy-X/Psy-Cross to adapt PlayStation interfaces for desktop systems. _{Case study · Independent reconstruction · Full entry}
• DevilutionX: porting Diablo’s reconstructed engine - Builds a modern Diablo and Hellfire port on the Devilution reconstruction, with platform support, bug fixes and optional quality-of-life features. _{Case study · Independent reconstruction · Full entry}
• Touhou reconstructions: an agent-driven method across three games - An essay published on REA’s site, with pinned evidence notes, describes one author’s agent-driven reconstructions of TH08, TH095 and TH04. _{Case study · Official REA · Also: Binary · Full entry}
• TicTacToe-AI: a bounded REA-fork reconstruction of one game method - The author’s REA fork, posted as rea-engine and since renamed RE-Agent, decompiles the shipped .NET executable of the GPL-licensed TicTacToe-AI game, recompiles the recovered C# and resources, and repairs one decompiler error against the original IL. _{Case study · Mixed workflow · Full entry}
• UltraSunnyMoon: a partial, REA-led Pokémon Ultra Sun reconstruction - The author uses a pinned REA build with Ghidra to analyze a user-supplied Pokémon Ultra Sun base executable, rebuild it byte for byte from split objects, and swap in two small compiled C runtime routines. _{Case study · Mixed workflow · Full entry}
• DX-Ball: an REA-guided function-level reconstruction with Codex - The author has Codex use REA’s Ghidra tools to inspect the English DX-Ball 1.07 executable and recover it as typed C/C++, then compiles each function with the original-era Visual C++ 4.0 and compares it byte for byte with the original after mapping relocations. _{Case study · Mixed workflow · Also: Binary · Full entry}
• re2ds: a native Nintendo DS engine for Resident Evil 2 - Reimplements Resident Evil 2’s PS1 game rules in a native Nintendo DS engine, with converters that turn data from the user’s own disc into DS formats. _{Case study · Mixed workflow · Full entry}
• Horizon: a Rust rewrite of Minecraft: Java Edition 26.3 with REA bytecode queries - Rewrites Minecraft: Java Edition 26.3 as a native Rust client, dedicated server and launcher that prepare their resources from the user’s own copy of the game. _{Case study · Mixed workflow · Full entry}
• Untangle: a browser rebuild from REA and Ghidra evidence - An author-documented REA/Ghidra investigation of the shipped Untangle Windows binary produces a single-page playable rebuild and a claim-by-claim grading receipt. _{Case study · Mixed workflow · Also: Binary · Full entry}
• OpenBattlefield2: an unfinished Refractor 2 engine reimplementation - A C++20 reimplementation of Battlefield 2’s Refractor 2 engine reads original game data and documents menu rendering, level loading and server interoperability. _{Case study · Mixed workflow · Also: Binary · Full entry}
• keen-clone: a Commander Keen 1 C/SDL2 port - A native Linux and browser port of Commander Keen Episode One is documented as a function-by-function REA/Ghidra reconstruction of KEEN1.EXE. _{Case study · Mixed workflow · Also: Binary · Full entry}
• samp-client-re: a partial SA-MP client reconstruction - A documented REA/Ghidra investigation maps SA-MP 0.3.DL-R1 client subsystems to a new C++ DLL, loader and smoke-test executable. _{Case study · Mixed workflow · Also: Binary · Full entry}
• Desktop Games Nostalgia: a macOS and browser port - A Swift/macOS and JavaScript/browser port recreates the Desktop Games screen-smashing toy from a captured image. _{Case study · Mixed workflow · Also: Binary · Full entry}
• GunZRs: a Rust reimplementation of GunZ: The Duel - A Rust/Bevy port reads GunZ: The Duel files from the user's installation and provides native releases, browser build tooling, screenshots and a documented REA/Ghidra investigation framework. _{Case study · Mixed workflow · Full entry}
• Does reverse engineering need a bigger model? General and specialist models in Touhou reconstruction - An essay on REA’s site by N0zoM1z0 (13 October 2026) uses dated Touhou reconstruction commits to ask whether exact function matching needs a larger general model, a compiler-specialist model or better retrieval. _{Case study · Official REA · Also: Binary · Full entry}
• LASRecomp: Link’s Awakening static recompilation - A native desktop reconstruction of the 2019 Switch version of Link’s Awakening using static recompilation. _{Case study · Independent reconstruction · Full entry}
• ArkWeb: a two-game movement and collision experiment - Runs Spider-Man Remastered and Arkham Knight together, streaming Gotham collision into Spider-Man’s physics world and compositing his rendered frame into Arkham. _{Case study · Independent reconstruction · Full entry}
• Perfect Dark: matching Nintendo 64 decompilation - Reconstructs Perfect Dark’s Nintendo 64 code with a documented matching-ROM build. _{Case study · Independent reconstruction · Full entry}
• Super Mario Sunshine: a native PC port from an AI-assisted decompilation - Builds a native PC port of Super Mario Sunshine’s North American release from a pinned matching-decompilation fork, adding a host platform layer for graphics, disc, audio, input and OS services. _{Case study · Independent reconstruction · Full entry}
• Majora’s Mask: matching US N64 decompilation - Recreates a C source base for The Legend of Zelda: Majora’s Mask from information in the game and static or dynamic analysis, then rebuilds the US Nintendo 64 ROM. _{Case study · Independent reconstruction · Full entry}
• DLSSNR-AMD: reimplementing DLSS 5 neural rendering for RDNA4 - Reimplements the neural-rendering network of NVIDIA’s DLSS 5 library as Vulkan compute shaders for AMD RX 9000 (RDNA4) cards and supplies it to games through an NGX-compatible core and ReShade or Vulkan-layer routes. _{Case study · Independent reconstruction · Also: Binary · Full entry}
• Breath of the Wild: per-function matching decompilation of the Switch executable - Reimplements part of Breath of the Wild’s Switch v1.5.0 main executable in C++ and checks each function against the original machine code. _{Case study · Independent reconstruction · Full entry}
• Skyward Sword: Wii decompilation with hash-checked relinking - Reconstructs C++ source for The Legend of Zelda: Skyward Sword’s Wii main.dol and REL modules, starting from the user’s NTSC-U 1.0 (SOUE01) disc files. _{Case study · Independent reconstruction · Full entry}
• 2 Ship 2 Harkinian: a native Majora’s Mask port built on the decompilation - Builds native Windows, Linux and macOS versions of The Legend of Zelda: Majora’s Mask from an adapted copy of the zeldaret/mm decompilation, with libultraship reimplementing N64 SDK functions. _{Case study · Independent reconstruction · Full entry}
• Ship of Harkinian: a native Ocarina of Time port built on the decompilation - Builds Ocarina of Time as a native PC application from the OoT decompilation’s source, with libultraship standing in for the N64 libultra SDK and DirectX 11, OpenGL or Metal rendering. _{Case study · Independent reconstruction · Full entry}
• The Minish Cap: a GBA decompilation targeting five ROMs - Recreates a C source base for The Legend of Zelda: The Minish Cap from information in the game and static or dynamic analysis, building five Game Boy Advance ROMs: USA, EU, JP and two demos. _{Case study · Independent reconstruction · Full entry}
• Ocarina of Time: decompilation with MD5-checked ROM builds for 16 versions - Recreates a C source base for Ocarina of Time that rebuilds 16 Nintendo 64, GameCube and iQue Player ROM versions, using information from the game and static and dynamic analysis. _{Case study · Independent reconstruction · Full entry}
• Project Arwing: Star Fox recompiled from a matching disassembly - Disassembles Star Fox’s 65816 and SuperFX code from runtime coverage and recursive descent, reassembles it into the original ROM, then translates it statically to C on a from-scratch SNES runtime for Windows, macOS and Linux. _{Case study · Independent reconstruction · Full entry}
• Project Arwing (2): Star Fox 2 recompiled from a matching disassembly - Rebuilds Star Fox 2 from a coverage-seeded 65816 and SuperFX disassembly that reassembles to the original ROM, then translates it statically to C for native Windows, macOS and Linux builds. _{Case study · Independent reconstruction · Full entry}
• Little Planet: Sonic CD recompiled from a matching disassembly - Disassembles every executable file on the Sonic CD disc from runtime coverage and recursive descent, reassembles them byte-identically, and translates the code statically to C on a from-scratch Mega-CD runtime that replaces the BIOS with a high-level implementation. _{Case study · Independent reconstruction · Full entry}
• vf2-decomp: differentially validated Virtua Fighter 2 recovery - Recovers Virtua Fighter 2 Version 2.1’s Sega Model 2A i960 program into portable, non-matching C17, accepting each recovered path only when it matches a reference i960 executor at controlled boundaries. _{Case study · Independent reconstruction · Full entry}
• z2rs: an incremental Rust reconstruction of Zelda II checked against an emulator - Rebuilds Zelda II: The Adventure of Link (NES) in Rust for desktop, browser and Android by replacing the game’s 6502 routines one at a time. _{Case study · Independent reconstruction · Full entry}
• sm64ex: an enhanced Super Mario 64 PC port from the decompilation - Builds native Super Mario 64 executables from decompiled source, extending the sm64-port fork of the n64decomp reconstruction with renderer, input, camera, save-format and external-data options. _{Case study · Independent reconstruction · Full entry}
• Ghostship: a libultraship native port of Super Mario 64 - Builds Super Mario 64 as a native PC, Switch and Android program by compiling decompilation-style game source against the libultraship platform library. _{Case study · Independent reconstruction · Full entry}
• Super Mario Sunshine: an in-progress matching GameCube decompilation - Reconstructs Super Mario Sunshine’s C++ source so that the original Metrowerks compiler reproduces byte-identical object files for four GameCube releases and the Switch 3D All-Stars build. _{Case study · Independent reconstruction · Full entry}
• Dusklight: a native Twilight Princess port built on the decompilation - Reimplements Twilight Princess as a native application for desktop and mobile platforms, building on the zeldaret/tp decompilation and the Aurora GameCube/Wii compatibility layer. _{Case study · Independent reconstruction · Full entry}
• Metaforce: a Metroid Prime engine reimplementation rebuilt on the decompilation - Started in 2015 as a reverse-engineered reimplementation of the Metroid Prime engine, Metaforce has been rewritten on top of the PrimeDecomp matching decompilation. _{Case study · Independent reconstruction · Full entry}
• Super Mario Sunshine (USA): an AI-assisted matching decompilation fork - Extends the doldecomp Super Mario Sunshine decompilation to the North American GMSE01 release. _{Case study · Independent reconstruction · Full entry}
• Donkey Kong 64: Recompiled — an N64Recomp native port - Uses N64Recomp to statically recompile the US Nintendo 64 release of Donkey Kong 64 into a native port, with RT64 as the renderer. _{Case study · Independent reconstruction · Full entry}
• Twilight Princess: a decompilation with fully matching GameCube code - Reconstructs Twilight Princess source that compiles back to binaries identical to the originals, building GameCube, Wii and Nvidia Shield releases from one codebase through conditional compilation. _{Case study · Independent reconstruction · Full entry}
• Castlevania: Symphony of the Night: matching decompilation across PlayStation, PSP and Saturn builds - Recreates C source for Castlevania: Symphony of the Night from its PlayStation, PSP and Saturn binaries, aiming for code that compiles byte for byte to the original game files. _{Case study · Independent reconstruction · Full entry}
• LEGO Island, portable: a multi-platform port of the decompiled source - Adapts the LEGO Island decompilation into a portable build for desktop, mobile, console, DOS and Web targets. _{Case study · Independent reconstruction · Full entry}
• c1: a C port of PlayStation Crash Bandicoot - Ports the original PlayStation Crash Bandicoot game code to C function by function; its coding standard labels functions with the addresses of their original implementations. _{Case study · Independent reconstruction · Full entry}
• Metroid Prime Port: an AI-assisted native port of the PrimeDecomp decompilation - Compiles the PrimeDecomp decompilation of Metroid Prime’s game and engine code as native C++20 for Linux, Windows and Android, with an experimental macOS build. _{Case study · Independent reconstruction · Full entry}
• The Wind Waker: a GameCube decompilation with hash-checked relinking - Reconstructs source for The Wind Waker’s GameCube executable and REL modules across the USA/Korea, PAL and Japanese releases and a Japanese kiosk demo. _{Case study · Independent reconstruction · Full entry}
• Sonic Mania: a game-code decompilation for the RSDKv5 engine - Reconstructs Sonic Mania’s game code in C and builds it with the separately decompiled RSDKv5 or RSDKv5U engine for Windows, Linux, Switch and Android. _{Case study · Independent reconstruction · Full entry}
• MediEvil Recomp: a PlayStation static recompilation to C# - Statically recompiles the North American PlayStation release of MediEvil into C# with the RecompOne recompiler and runtime. _{Case study · Independent reconstruction · Full entry}
• Crash Bandicoot 2 Recompiled: a PSXRecomp native build - A Windows launcher that uses the PSXRecomp recompiler and runtime to translate the user’s Crash Bandicoot 2: Cortex Strikes Back disc to C and compile it locally, so the game runs as native code with an emulated PlayStation hardware layer. _{Case study · Independent reconstruction · Full entry}
• Petari: a matching Super Mario Galaxy decompilation - Reconstructs Super Mario Galaxy’s Wii code as C++ that rebuilds, object by object, against main.dol files extracted from the user’s own Japanese, North American, PAL or Korean disc. _{Case study · Independent reconstruction · Full entry}
• Wind Waker HD Recomp: a native port by static recompilation of the Wii U game - Statically recompiles The Wind Waker HD’s Wii U PowerPC code to C ahead of time, reimplements the Cafe OS libraries the game uses and implements GX2 graphics on Metal or Vulkan, producing native macOS, Linux, Windows and Android builds without a Cemu runtime. _{Case study · Independent reconstruction · Full entry}
• Castlevania 64: Recompiled — a beta static-recompilation port - Uses N64Recomp to statically recompile the US 1.0 Nintendo 64 release of Castlevania into a native PC port rendered with RT64. _{Case study · Independent reconstruction · Full entry}
• RSDKv5 Decompilation: reconstructing Retro Engine v5 and v5U - Reconstructs the Retro Engine (RSDK) v5 and v5 Ultimate runtime, the engine that runs Sonic Mania’s game code, and builds it for Windows, Linux, Switch and Android. _{Case study · Independent reconstruction · Full entry}
• C2C: hybrid recompilation and hand decompilation of Crash Bandicoot 2 - An early reverse-engineering effort on PlayStation Crash Bandicoot 2 that converts the engine’s MIPS machine code directly into a very large C file and runs it against a modified PCSX-R emulator library for hardware I/O. _{Case study · Independent reconstruction · Full entry}
• MediEvil decompilation: an early checksum-gated PlayStation project - Decompiles the US PlayStation release of MediEvil toward C source that rebuilds its main executable, game executable and 26 overlays. _{Case study · Independent reconstruction · Full entry}
• Conker's Bad Fur Day: Recompiled — an N64Recomp native port - Statically recompiles the US Nintendo 64 release of Conker’s Bad Fur Day with N64Recomp into a native Windows, Linux and macOS port on N64ModernRuntime and RT64. _{Case study · Independent reconstruction · Full entry}
• ProjectCane: a native PC port of Sly Cooper and the Thievius Raccoonus - Rebuilds the NTSC PlayStation 2 release of Sly Cooper and the Thievius Raccoonus as a native C++ game for Windows and Linux, running on data extracted from the player's own disc image. _{Case study · Independent reconstruction · Full entry}
• Firefighter: a decompiled DOS game ported to Rust - Eric S. Raymond’s terminal port of Firefighter, Eben Sprinsock’s 1985 DOS shareware game. _{Case study · Independent reconstruction · Full entry}
• Kingdom Hearts 358/2 Days: native PC port built on a matching decompilation - Compiles the C of the khdays-decomp matching decompilation for Windows x64 and supplies a native platform layer for the Nintendo DS hardware, SDK services and sound driver. _{Case study · Independent reconstruction · Full entry}
• ico-pc: a native ICO port compiled from the PS2 decompilation - Compiles the decompiled C of the PlayStation 2 game ICO natively for Windows, Linux, Android, iPhone and Apple-silicon Macs, with host code standing in for the PS2 hardware and Sony libraries. _{Case study · Independent reconstruction · Full entry}
• Sly Cooper and the Thievius Raccoonus: matching PlayStation 2 decompilation - Reconstructs source code for SCUS_971.98, the NTSC-U PlayStation 2 executable of Sly Cooper and the Thievius Raccoonus, as a work-in-progress matching decompilation. _{Case study · Independent reconstruction · Full entry}
• Pokémon Emerald: a matching Game Boy Advance decompilation - Reconstructs Pokémon Emerald for the Game Boy Advance as buildable C source, with game scripts and data kept as assembler directives. _{Case study · Independent reconstruction · Full entry}
• Paper Mario: matching Nintendo 64 decompilation for four releases - Reconstructs Paper Mario’s Nintendo 64 code as C source that rebuilds the US, Japanese, PAL and iQue ROMs. _{Case study · Independent reconstruction · Full entry}
• Budokai Tenkaichi 3: a native PC port built on a matching decompilation - Compiles the decompiled code of Dragon Ball Z: Budokai Tenkaichi 3 (PS2, USA release SLUS-21678) for PC on a new renderer, sound, input and platform layer rather than an emulator. _{Case study · Independent reconstruction · Full entry}
• D2R Mobile: rehosting Diablo II: Resurrected’s Switch program on Apple devices - Runs the Nintendo Switch release’s own aarch64 program natively on iPhone, iPad and Apple silicon Macs, rewriting only instructions that depend on the Horizon kernel and supplying its system services and the NVN graphics API on Metal. _{Case study · Independent reconstruction · Full entry}
• Ratchet & Clank: a matching PS2 decompilation with a documented agent workflow - Reconstructs C source for SCES_509.16, the PAL v2.00 PlayStation 2 executable of Ratchet & Clank (2002), with every function linked at its retail address. _{Case study · Independent reconstruction · Full entry}
• Banjo: Recompiled — an N64Recomp Banjo-Kazooie native port - Uses N64Recomp to statically recompile the US 1.0 Nintendo 64 release of Banjo-Kazooie into a native port on N64ModernRuntime, rendered by RT64 and extended with mod support. _{Case study · Independent reconstruction · Full entry}
• Pokémon FireRed and LeafGreen: a matching Game Boy Advance decompilation - Reconstructs the English Game Boy Advance releases of Pokémon FireRed and LeafGreen as buildable C source, with game scripts and data kept as assembler directives. _{Case study · Independent reconstruction · Full entry}
• PaperBoat: a native Paper Mario port built on the decompilation - Compiles Paper Mario decompilation sources, credited to the pmret and Paper Mario DX projects, into a native US-version application on libultraship. _{Case study · Independent reconstruction · Full entry}
• Halo 2: an agent-assisted matching decompilation of an LTCG Xbox build - A work-in-progress matching decompilation of Halo 2 for the original Xbox: contributors write C and C++ that the period compiler, building the whole program with link-time code generation, must turn back into the retail executable's bytes function by function. _{Case study · Independent reconstruction · Full entry}
• DiabloWeb: a WebAssembly browser port built on Devilution - Runs Diablo in web browsers by compiling a stripped-down fork of Devilution, the community reconstruction of the game’s original source, to WebAssembly behind a React front end. _{Case study · Independent reconstruction · Full entry}
• pokered: a matching Pokémon Red and Blue disassembly - Reconstructs the Game Boy games Pokémon Red and Blue as RGBDS assembly, with graphics and data kept as editable source files. _{Case study · Independent reconstruction · Full entry}
• Lighthouse: a Banjo-Kazooie PC port built on the decompilation - A native Windows, Linux and macOS port of Banjo-Kazooie that compiles game C sources, many tagged with their Banjo-Kazooie decompilation file paths, against libultraship, a reimplementation of the N64 SDK. _{Case study · Independent reconstruction · Full entry}
• Lost Odyssey Recomp: statically recompiling an Xbox 360 RPG into native ports - Translates Lost Odyssey’s Xbox 360 PowerPC executable with patched XenonRecomp tooling and runs the generated code on a native runtime that renders through Direct3D 12, Vulkan or Metal. _{Case study · Independent reconstruction · Full entry}
• Super Smash Bros. Melee: a matching GameCube decompilation with a shiftable build - A matching decompilation of Super Smash Bros. Melee's US 1.02 release (GALE01) that rebuilds main.dol from C with the original Metrowerks compilers and checks it against the retail SHA-1. _{Case study · Independent reconstruction · Full entry}
• pokecrystal: a matching Pokémon Crystal disassembly - Reconstructs the Game Boy Color game Pokémon Crystal as RGBDS assembly, with graphics, maps and data stored as editable sources. _{Case study · Independent reconstruction · Full entry}
• Pokémon HeartGold and SoulSilver: a work-in-progress, checksum-matched DS disassembly - Rebuilds the US Nintendo DS releases of Pokémon HeartGold and SoulSilver from a work-in-progress disassembly in which part of the code has been decompiled to C. _{Case study · Independent reconstruction · Full entry}
• FFTARecomp: static recompilation of Final Fantasy Tactics Advance - Recompiles the user’s Final Fantasy Tactics Advance (USA) Game Boy Advance ROM ahead of time into native code for Windows, Linux and Steam Deck, building on JRickey’s gba-recomp toolkit. _{Case study · Independent reconstruction · Full entry}
• SymphonyRecomp: a RecompOne static recompilation of Symphony of the Night - Statically recompiles the North American PlayStation release of Castlevania: Symphony of the Night into C# with BlackLabelHQ’s RecompOne, whose runtime simulates the BIOS, memory-mapped I/O, GPU and CD-ROM so the game runs natively without a console BIOS. _{Case study · Independent reconstruction · Full entry}
• The Two Towers Recompiled: an original Xbox static-recompilation port - Statically recompiles the x86 code of The Lord of the Rings: The Two Towers (Xbox, USA, 2002) into C with the bundled xboxrecomp toolkit, producing native Windows, Linux and experimental macOS builds. _{Case study · Independent reconstruction · Full entry}
• Melee Unlocked: a Windows source port and static recompilation of Melee - A beta Windows build of Super Smash Bros. Melee (NTSC 1.02) with two engines: a source port that compiles the doldecomp decompilation as a native library, and a static recompilation that translates the retail DOL's PowerPC code and Slippi's Gecko codes into C++. _{Case study · Independent reconstruction · Full entry}
• pokeruby: a matching Pokémon Ruby and Sapphire decompilation - Reconstructs the Game Boy Advance games Pokémon Ruby and Sapphire as C source built with pret's agbcc compiler, alongside assembly data scripts and editable graphics. _{Case study · Independent reconstruction · Full entry}
• Vandal Hearts: native PC port built on matching decompilations - Builds on shao113’s matching decompilation of PlayStation Vandal Hearts, adds a Japanese matching tree, and carries both through to a native Windows and Linux port. _{Case study · Independent reconstruction · Full entry}
• Pokémon Platinum: a checksum-matched Nintendo DS decompilation - Reconstructs the US Nintendo DS release of Pokémon Platinum as C source that rebuilds revision 1 by default and revision 0 on request. _{Case study · Independent reconstruction · Full entry}
• Saints Reborn: a ReXGlue static recompilation of Saints Row - An unofficial native Windows port of Saints Row (Xbox 360, 2006) that statically recompiles the game's PowerPC executable to C++ for x86-64 with the ReXGlue SDK, which also reimplements the console's kernel, GPU (on Direct3D 12), audio and input. _{Case study · Independent reconstruction · Full entry}
• Pokémon Platinum PC Port: a native port built on the pret decompilation - Builds native 64-bit Windows and Linux executables of Pokémon Platinum from a fork of pret’s decompilation, replacing NitroSDK with the author’s libntr libraries; the same tree keeps the DS ROM build and an experimental Switch target. _{Case study · Independent reconstruction · Full entry}
• MikuPan: a native Fatal Frame PC port built on the Himuro decompilation - Ports the PS2 game Fatal Frame to native PC builds without emulation; its repository description names the Himuro decompilation as its basis. _{Case study · Independent reconstruction · Full entry}
• Starfox 64: Recompiled — an N64Recomp static-recompilation port - Uses N64: Recompiled to statically recompile the US 1.1 (Rev A) Nintendo 64 release of Star Fox 64 into a native port for Windows, Linux and macOS, rendered with RT64. _{Case study · Independent reconstruction · Full entry}
• Syphon Filter: The Omega Strain — matching PS2 executable decompilation - Reconstructs much of the NTSC-U PlayStation 2 executable of Syphon Filter: The Omega Strain as C; with the remaining functions kept as split assembly, the build reproduces the retail SCUS_972.64 byte for byte. _{Case study · Independent reconstruction · Full entry}
• Animal Crossing: a native PC port of the GameCube decompilation - Runs Animal Crossing’s decompiled GameCube C code natively on 32-bit x86, replacing the GX graphics API with an OpenGL 3.3 translation layer and console services with SDL2-based platform code. _{Case study · Independent reconstruction · Full entry}
• GoldenEye 007: matching Nintendo 64 decompilation for three releases - Reconstructs GoldenEye 007’s Nintendo 64 code as C source that rebuilds the US, Japanese and PAL ROMs. _{Case study · Independent reconstruction · Full entry}
• Starship: a Star Fox 64 PC port built from the decompilation - A native PC port of Star Fox 64 that compiles the game's decompiled C code against libultraship, an N64 porting library that reimplements libultra and renders through Fast3D. _{Case study · Independent reconstruction · Full entry}
• CTR Turbocharged: a PC sourceport built on the Crash Team Racing decompilation - Extends the Crash Team Racing: High Octane sourceport, which derives from the CTR Native port of the CTR-ModSDK PlayStation decompilation, into Windows and Linux builds with a native 3D renderer, selectable aspect ratios and frame rates up to 240 FPS. _{Case study · Independent reconstruction · Full entry}
• The Darkness Recomp: an Xbox 360 static recompilation with a native D3D11 renderer - Builds a native Windows x64 port of The Darkness by translating its Xbox 360 executable to C++ ahead of time with a patched XenonRecomp. _{Case study · Independent reconstruction · Full entry}
• MarioKart 64: Recompiled — a native port through N64Recomp static recompilation - Statically recompiles the US Nintendo 64 release of Mario Kart 64 into a native Windows, Linux and macOS application with N64Recomp, rendering through RT64. _{Case study · Independent reconstruction · Full entry}
• Animal Crossing: matching GameCube decompilation - Reconstructs Animal Crossing’s GameCube code as C and C++ source that rebuilds the USA release’s main executable and its foresta.rel module. _{Case study · Independent reconstruction · Full entry}
• Kingdom Hearts 358/2 Days: a matching Nintendo DS decompilation - Reconstructs the ARM9 program and overlays of the EU Nintendo DS release of Kingdom Hearts 358/2 Days as C that recompiles byte for byte with CodeWarrior. _{Case study · Independent reconstruction · Full entry}
• TonyWasAProSkater: a THPS1 native port forked from a matching decompilation - Ports Tony Hawk’s Pro Skater (PlayStation, USA) to native Windows and Linux builds from a fork of an in-progress matching decompilation of the retail executable. _{Case study · Independent reconstruction · Full entry}
• P.T. for PC: a behavior-based engine reimplementation that reads the PS4 data - Reimplements P.T.’s game logic in C++ on a new Vulkan engine that reads levels, models, textures, sounds, scripts and cutscenes from the user’s own PS4 copy at run time. _{Case study · Independent reconstruction · Full entry}
• SpaghettiKart: a native Mario Kart 64 port built on decompiled source - Builds a native Mario Kart 64 port for Windows, Linux, macOS and Switch from source that keeps the Mario Kart 64 decompilation’s file layout, running on libultraship’s reimplemented N64 SDK. _{Case study · Independent reconstruction · Full entry}
• Animal Crossing: Wild World: matching Korean DS decompilation with differential runtime checks - Reconstructs the ARM9 game code of Animal Crossing: Wild World’s Korean DS release as one C or C++ source per function, checked against the user’s ROM with the original Metrowerks compiler and linker. _{Case study · Independent reconstruction · Full entry}
• King Kong Recompiled: an AI-developed Xbox 360 static recompilation - Translates the Xbox 360 release of Peter Jackson's King Kong into native Windows code with the ReXGlue static-recompilation SDK, adding a launcher and display, control and graphics options. _{Case study · Independent reconstruction · Full entry}
• Mario Party 4: matching GameCube decompilation of the USA releases - Reconstructs Mario Party 4’s GameCube main executable and REL modules as C source that rebuilds both USA releases. _{Case study · Independent reconstruction · Full entry}
• SpeedBreaker: statically recompiling Need for Speed: Most Wanted for Xbox 360 - Translates the Xbox 360 executable of Need for Speed: Most Wanted (2005) into native C++ with a patched XenonRecomp and runs it on a project runtime that stands in for the console’s kernel, Xenos GPU, XMA audio and controllers. _{Case study · Independent reconstruction · Full entry}
• The Sims: Bustin' Out: an AI-driven partial GBA matching decompilation - Rebuilds the USA/Europe Game Boy Advance release of The Sims: Bustin' Out byte for byte while gradually replacing ROM regions with matching C compiled by agbcc. _{Case study · Independent reconstruction · Full entry}
• Destiny 2 build 86657: Sunrise/Dawn reconstruction research report - A dated research report on the Sunrise/Dawn reconstruction of the archived Destiny 2 build 86657 client, which emulates platform sign-on and the examined Bungie service contracts locally and adds reconstructed mission host policy. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• SVR2011-Recomp: a ReXGlue recompilation of WWE SmackDown vs. Raw 2011 - Translates the Xbox 360 executable of WWE SmackDown vs. Raw 2011 to C++ ahead of time with ReXGlue and builds it as a Windows program on a Vulkan runtime derived from Xenia. _{Case study · Independent reconstruction · Full entry}
• Snap64 Recomp: a static-recompilation port of Pokémon Snap - Uses N64Recomp to statically recompile the US Nintendo 64 release of Pokémon Snap into a native Windows, Linux, Steam Deck and macOS port rendered with RT64. _{Case study · Independent reconstruction · Full entry}
• Dead Rising 2: Case Zero — an Xbox 360 XBLA static recompilation port - Builds a native Windows, Linux, Steam Deck and Apple Silicon port of the XBLA game Dead Rising 2: Case Zero by statically recompiling its Xbox 360 code with patched XenonRecomp and translating its shaders with patched XenosRecomp. _{Case study · Independent reconstruction · Full entry}
• OpenRA: an engine reimplementation reimagining early Westwood RTS games - Provides a C# engine for early Westwood real-time strategy games, with mods that reimagine Command & Conquer: Red Alert, Tiberian Dawn and Dune 2000. _{Case study · Independent reconstruction · Full entry}
• Dead Rising 2: Case West — a sibling Xbox 360 XBLA static recompilation port - Builds a native Windows, Linux, Steam Deck and Apple Silicon port of the XBLA epilogue Dead Rising 2: Case West by statically recompiling its Xbox 360 code with patched XenonRecomp and translating its shaders with patched XenosRecomp. _{Case study · Independent reconstruction · Full entry}
• The Simpsons Wrestling Recompiled: a psxrecomp PlayStation static recompilation - Translates the PlayStation game’s MIPS code to C with a pinned psxrecomp fork and builds Windows and Linux programs on its hardware-modelling runtime, with a launcher and a game-specific plugin. _{Case study · Independent reconstruction · Full entry}
• OpenRCT2: an open re-implementation of RollerCoaster Tycoon 2 - Re-implements RollerCoaster Tycoon 2, originally written in x86 assembly, as a C++ engine that runs on the original game’s data. _{Case study · Independent reconstruction · Full entry}
• Touhou 6: reconstructing Embodiment of Scarlet Devil 1.02h source - Reconstructs C++ source for the Windows executable of Touhou 6: Embodiment of Scarlet Devil version 1.02h, aiming at an exact rebuild with the original Visual Studio .NET 2002 and DirectX 8 toolchain. _{Case study · Independent reconstruction · Full entry}
• Driver Recompiled: a psxrecomp setup host that builds the game locally - Packages a psxrecomp static-recompilation project for Driver (PlayStation, USA) as a setup host: releases carry the recompiler, runtime and a recomp-ui launcher, and the player’s machine generates and compiles the game from the user’s own disc image. _{Case study · Independent reconstruction · Full entry}
• Himuro: a matching Fatal Frame PS2 decompilation - Reconstructs Fatal Frame’s PS2 executable as C for the US, EU and Japanese releases, built with the original EE-GCC 2.9 toolchain and checked by SHA-1 against the user’s own executables. _{Case study · Independent reconstruction · Full entry}
• DOAXVB Native PC Port: statically recompiling Dead or Alive Xtreme Beach Volleyball - Lifts the original Xbox executable of Dead or Alive Xtreme Beach Volleyball to C with a fork of xboxrecomp and links it with a hand-written runtime that replaces kernel imports, audio and key Direct3D 8 and DirectSound APIs. _{Case study · Independent reconstruction · Full entry}
• TH08 Web: a WebAssembly port built from reconstructed source - Compiles the reconstructed C++ source of the Japanese Touhou 8 1.00d release to WebAssembly with Emscripten, adding WebGL 2 rendering, Web Audio, browser input and IndexedDB saves behind the game’s D3D8-, DirectSound- and DirectInput-shaped interfaces. _{Case study · Independent reconstruction · Full entry}
• OpenXcom: an open-source clone of X-COM: UFO Defense and Terror from the Deep - Reimplements MicroProse’s UFO: Enemy Unknown (X-COM: UFO Defense) and X-COM: Terror from the Deep as a C++/SDL engine that runs on the user’s original game resources. _{Case study · Independent reconstruction · Full entry}
• Skate 3 Recomp: a native Xbox 360 recompilation through ReXGlue - Recompiles the Xbox 360 version of Skate 3 into native Windows, Linux and macOS builds with a Skate-specific fork of the ReXGlue SDK. _{Case study · Independent reconstruction · Full entry}
• Uncharted: The Nathan Drake Collection native Windows port - Runs the PS4 Uncharted: The Nathan Drake Collection’s own x86-64 executables natively on Windows: a runtime supplies the PS4 system libraries and a shadPS4-derived Vulkan renderer executes the GPU work. _{Case study · Independent reconstruction · Full entry}
• TH095: function-level reconstruction of Shoot the Bullet 1.02a - Reconstructs source for the original Japanese Touhou 9.5: Shoot the Bullet 1.02a executable, accepting function exactness only through reproducible byte comparison of pinned Visual C++ .NET 2003 builds against one hash-attested target. _{Case study · Independent reconstruction · Full entry}
• CorsixTH: an open reimplementation of Theme Hospital - Reimplements the engine of Bullfrog’s 1997 Theme Hospital, with game logic in Lua and C++ for graphics, sound, movies and pathfinding, on top of the original game’s data files. _{Case study · Independent reconstruction · Full entry}
• OpenRiseOfNations: a native macOS engine reimplementation - Reimplements the Rise of Nations: Extended Edition engine as a native macOS app with a Metal renderer, a deterministic simulation, a computer opponent and a compatible BigHugeScript compiler and virtual machine, loading art, maps, rules and scripts from the user’s own Windows installation. _{Case study · Independent reconstruction · Full entry}
• TH04: rebuilding Lotus Land Story’s four PC-98 programs from source - Reconstructs source for the Japanese PC-98 Touhou 4: Lotus Land Story and rebuilds all four DOS programs, MAIN.EXE, OP.EXE, MAINE.EXE and ZUN.COM, with a pinned Borland toolchain under Wine. _{Case study · Independent reconstruction · Full entry}
• inFAMOUS Second Son native PC port - Runs the PS4 inFAMOUS Second Son’s own x86-64 code natively on Windows and Linux: a runtime reimplements the PS4 system libraries the game uses, and a shadPS4-derived core translates its GPU commands and shaders to Vulkan. _{Case study · Independent reconstruction · Full entry}
• xoreos: an open reimplementation of BioWare’s Aurora engine family - Reimplements BioWare’s Aurora engine and its later derivatives as a portable C++ engine that runs on the user’s installed game data, targeting nine games from Neverwinter Nights to Dragon Age II. _{Case study · Independent reconstruction · Full entry}
• librw: a re-implementation of the RenderWare Graphics engine - Re-implements a large part of the RenderWare Graphics middleware API as a portable C++ library that reads and writes its DFF model and TXD texture files for PS2, D3D8, D3D9 and Xbox and is meant to convert them between platforms. _{Case study · Independent reconstruction · Full entry}
• Super Mario Odyssey: per-function matching decompilation of the Switch executable - Reconstructs C++ source for Super Mario Odyssey’s Switch 1.0 main executable and checks each function against the original AArch64 machine code with the shared nx-decomp-tools checker. _{Case study · Independent reconstruction · Full entry}
• Star Fox 64: a complete matching Nintendo 64 decompilation - Reconstructs C source for the US 1.1 (Rev A) Nintendo 64 release of Star Fox 64 that, compiled with the IDO compiler through a static recompilation, rebuilds a ROM with the published MD5; the README badge counts all 2,951 functions as matching. _{Case study · Independent reconstruction · Full entry}
• Metroid Prime: the PrimeDecomp matching GameCube decompilation - Reconstructs C++ source for Metroid Prime’s GameCube executable and its NES-emulator module so that CodeWarrior builds match the originals, across the USA, Korean, PAL and Japanese releases, with early configurations for demo discs and three Wii releases. _{Case study · Independent reconstruction · Full entry}
• Batla 3D server emulator (2015 client) - C# server emulator for the 2015 Steam client of Batla 3D, covering HTTP account, shop and room services and Lidgren UDP gameplay. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• RSDKv4 Decompilation: Retro Engine v4 and the Sonic 1 & 2 (2013) menus - Decompiles Retro Engine (RSDK) v4, the engine behind Sonic the Hedgehog and Sonic the Hedgehog 2 (2013), together with the games’ natively coded menus, and builds it for Windows, Linux and Android. _{Case study · Independent reconstruction · Full entry}
• OpenRW: an open re-implementation of the Grand Theft Auto III engine - Re-implements Rockstar Games’ Grand Theft Auto III (2001) as a cross-platform C++ engine that runs on the data of a legitimate PC copy. _{Case study · Independent reconstruction · Full entry}
• CoD4 Rewrite: Rust/Bevy reconstruction - A Rust/Bevy reconstruction of Call of Duty 4 multiplayer systems, using assets from a local game installation. _{Case study · Independent reconstruction · Also: Binary · Full entry}
• libd2: Diablo II 1.14d engine-core libraries - Zig libraries reconstructing Diablo II 1.14d seeded maps, item generation, saves, simulation rules and network formats. _{Case study · Independent reconstruction · Also: Binary, Protocol · Full entry}
• Underworld Exhumed: reconstructing Ultima Underworld I and II - Pairs reconstructed DOS sources with native ports of Ultima Underworld I and II. _{Case study · Independent reconstruction · Also: Binary · Full entry}
• LineWars II: a portable SDL3 reconstruction - Provides an SDL3 backend for a portable-C reconstruction of the 1994 DOS game. _{Case study · Independent reconstruction · Also: Binary · Full entry}
• BFM-decomp: Brave Fencer Musashi matching decompilation - Documents an agent-assisted reconstruction of the USA PlayStation game with a pinned compiler and whole-binary SHA-1 gates. _{Case study · Independent reconstruction · Also: Binary · Full entry}
• Snowboard Kids: an agent-assisted N64 matching decompilation - A matching decompilation of the original Nintendo 64 Snowboard Kids that rebuilds SHA1-identical North American and Japanese ROMs from a user-supplied ROM. _{Case study · Independent reconstruction · Full entry}
• Sonic Advance 3: an AI-assisted match of one enemy module - Macabeus’s dated study describes prompting Claude Sonnet 3.5 and DeepSeek R1 with assembly, similar decompiled functions and structs to write matching C for Marun, one enemy module of the community Sonic Advance 3 GBA decompilation. _{Case study · Independent reconstruction · Full entry}
• pw: a matching decompilation of the Pokéwalker firmware - Reconstructs as C the firmware of the Pokéwalker, the pedometer accessory for Pokémon HeartGold and SoulSilver, for its Renesas H8/38606 microcontroller. _{Case study · Independent reconstruction · Also: Firmware · Full entry}
• wii-ipl: a decompilation of the Wii Menu (System Menu 4.3) - A work-in-progress decompilation of the Wii Menu, the console’s System Menu (IPL), targeting version 4.3 in its USA, European, Japanese and Korean builds. _{Case study · Independent reconstruction · Also: Firmware · Full entry}
• sead: a decompilation of Nintendo’s first-party C++ standard library - Decompiles sead, the C++ standard library that Nintendo statically links into its first-party games, covering containers, heaps, strings, math, file devices, threads, the game framework and graphics. _{Case study · Independent reconstruction · Full entry}
• Animal Forest: an in-progress matching N64 decompilation - Rebuilds the Japanese Nintendo 64 release of Animal Forest (Dōbutsu no Mori) from C code reverse-engineered from the ROM, combined with assets and assembly extracted from a user-supplied ROM. _{Case study · Independent reconstruction · Full entry}
• Phantom Hourglass: an early-stage matching Nintendo DS decompilation - Recreates C++ source for The Legend of Zelda: Phantom Hourglass by hand-decompiling its European and US Nintendo DS releases, using the dsd toolkit to delink code from a user-supplied ROM and rebuild the ROM. _{Case study · Independent reconstruction · Full entry}
• Kinoko: reimplementing Mario Kart Wii’s physics engine for exact ghost replay - Re-implements Mario Kart Wii’s physics engine in C++ as a command-line simulator, continuing stblr/Hanachan’s goal of perfectly accurate time-trial ghost replay. _{Case study · Independent reconstruction · Full entry}
• Mario Kart: Double Dash!!: a matching GameCube decompilation of the debug build - A work-in-progress 1:1 decompilation of Mario Kart: Double Dash!! _{Case study · Independent reconstruction · Full entry}
• 3S Decomp: a byte-compared PS2 decompilation of Street Fighter III: 3rd Strike - Decompiles the PlayStation 2 executable of Street Fighter III: 3rd Strike from Street Fighter Anniversary Collection into C that period Metrowerks and EE GCC compilers rebuild, then compares the rebuilt executable word by word with the user’s original. _{Case study · Independent reconstruction · Full entry}
• Halo: Combat Evolved: an incremental re-implementation patched into the original Xbox executable - A research project re-implementing the original Xbox Halo: Combat Evolved in C, one function at a time. _{Case study · Independent reconstruction · Full entry}
• Paper Mario: The Thousand-Year Door: an early matching GameCube decompilation - A work-in-progress matching decompilation of Paper Mario: The Thousand-Year Door that targets the Japanese Rev 0 GameCube release (G8MJ01), rebuilding MarioSt.dol and 31 REL modules with the original Metrowerks compilers and checking each against a stored SHA-1. _{Case study · Independent reconstruction · Full entry}
• 3SX: a native Street Fighter III: 3rd Strike port continuing the PS2 decompilation - Builds Street Fighter III: 3rd Strike as native C for Windows, macOS and Linux, continuing the 3s-decomp PS2 decompilation, with SDL3 for video, input and audio and GekkoNet for rollback netplay. _{Case study · Independent reconstruction · Full entry}
• re4: a byte-identical decompilation of the Resident Evil 4 GameCube debug build - Reconstructs C and C++ source for the two-disc Resident Evil 4 GameCube debug prototype (G4BE08) and rebuilds main.dol and all 114 REL overlays with the compilers the README names, checking every output against a SHA-1 list. _{Case study · Independent reconstruction · Full entry}
• Super Smash Bros. Brawl: an early matching Wii decompilation - A work-in-progress matching decompilation of Super Smash Bros. Brawl that targets the USA Rev 2 Wii release (RSBE01_02), splitting main.dol and 126 REL modules from a user-supplied disc image and checking the rebuilt binaries against stored SHA-1 values. _{Case study · Independent reconstruction · Full entry}
• re-plants-vs-zombies: decompiling and modernizing Plants vs. Zombies GOTY - Reconstructs C++ source for Plants vs. Zombies on PopCap’s open-source SexyAppFramework, starting from an earlier community decompilation of version 0.9.9 and adding functionality reversed from the Game of the Year edition, with functions annotated by GOTY addresses. _{Case study · Independent reconstruction · Full entry}
• Sonic Advance 1 & 2: a matching GBA decompilation with widescreen ports - Reconstructs Sonic Advance and Sonic Advance 2 for the Game Boy Advance as C that rebuilds six hash-listed ROMs with SAT-R’s agbcc fork, and compiles the same code into widescreen SDL ports for Linux, macOS and Windows plus PSP and PS2 builds. _{Case study · Independent reconstruction · Full entry}
• Paleblood: a functional decompilation of Bloodborne with its own runtime - Rewrites code from Bloodborne’s PS4 executable (CUSA03173 with update 1.09) as readable C++, one function at a time, aiming at a native PC source port on a clean-room runtime of its own. _{Case study · Independent reconstruction · Full entry}
• Pikmin 2: a fully matched GameCube decompilation across five releases - A fan decompilation of Pikmin 2 that rebuilds main.dol for five GameCube releases (USA retail, two USA demos, PAL and Japan) with the original Metrowerks compilers, checking each against a stored SHA-1. _{Case study · Independent reconstruction · Full entry}
• Gran Turismo 4: an agent-assisted PS2 engine matching decompilation - Decompiles Gran Turismo 4’s PS2 engine executable (CORE.GT4, NTSC-U v1.01) into one C or C++ source per function for Sony’s ee-gcc 2.96, matching public libraries such as newlib and Expat from their own source. _{Case study · Independent reconstruction · Full entry}
• Mario Kart Wii: an in-progress matching decompilation of the PAL release - A work-in-progress matching decompilation of Mario Kart Wii that targets the PAL release (RMCP01), rebuilding main.dol and the StaticR.rel module from C and C++ with Metrowerks compilers and checking both against stored SHA-1 values. _{Case study · Independent reconstruction · Full entry}
• Pinyon Shift: a ShiftGlue static recompilation of Forza Horizon for PC - Builds a native port of the Xbox 360 release of Forza Horizon by translating its PowerPC executable ahead of time into C++ with ShiftGlue, the author’s fork of ReXGlue, and compiling it on the player’s machine from their own disc. _{Case study · Independent reconstruction · Full entry}
• Touhou 7: reconstructing Perfect Cherry Blossom 1.00b source - Reconstructs C++ source for the Windows executable of Touhou 7: Perfect Cherry Blossom 1.00b and its custom.exe configuration tool, built with the original Visual Studio .NET 2002 and DirectX 8 toolchain and compared function by function with the user’s originals through reccmp. _{Case study · Independent reconstruction · Full entry}
• DKC1Recomp: static recompilation of Donkey Kong Country - Statically recompiles the North American v1.0 SNES release of Donkey Kong Country into native Windows, macOS and iOS applications with a pinned fork of snesrecomp, which translates 65816 code to C and links it against a modelled SNES hardware runtime. _{Case study · Independent reconstruction · Full entry}
• San Andreas Unity: a GTA San Andreas engine reimplementation in Unity - Reimplements the Grand Theft Auto: San Andreas engine in Unity (C#), loading the archives, RenderWare models and textures, collision, animations, audio, text and item definitions from the user’s own PC installation. _{Case study · Independent reconstruction · Full entry}
• MinecraftLCE: an early-stage Minecraft: Nintendo Switch Edition decompilation - Decompiles Minecraft: Nintendo Switch Edition v1.0.17, a Legacy Console Edition release, into C++ that is compared function by function with the original executable using a patched Clang 4.0.1 and the open-ead Switch decompilation tools. _{Case study · Independent reconstruction · Full entry}
• Final Fantasy VII: a matching PlayStation decompilation - Reconstructs C source for the US PlayStation release of Final Fantasy VII, aiming for code that compiles back to the original main executable and its game overlays. _{Case study · Independent reconstruction · Full entry}
• Mega Man X Recompiled: a snesrecomp static recompilation - Statically translates the 65816 CPU code of the SNES Mega Man X (USA Rev 1) to C with the snesrecomp framework; the PPU, audio, DMA and other hardware run in the framework’s runtime, and a LakeSnes-derived interpreter executes whatever the static pass cannot prove. _{Case study · Independent reconstruction · Full entry}
• OpenSC4: an early open-source reimplementation of SimCity 4 - Reimplements SimCity 4 as a Godot project in GDScript that reads DBPF archives, region folders and city saves from the user’s own SimCity 4 installation. _{Case study · Independent reconstruction · Full entry}
• R.E.L.I.V.E.: an Oddworld Abe’s Oddysee and Abe’s Exoddus engine reimplementation - Reimplements the engine of Oddworld: Abe’s Oddysee and Abe’s Exoddus as an open-source replacement executable that runs from the user’s own game folder. _{Case study · Independent reconstruction · Full entry}
• Age of Empires Free Software Remake: a re-implementation on the original data - Re-implements Microsoft’s Age of Empires and its Rise of Rome expansion as a cross-platform C++17 engine on SDL2 and OpenGL that loads the original game’s DRS archives and language.dll resources. _{Case study · Independent reconstruction · Full entry}
• God of War PS2 static recompilation: a native Windows port via PS2Recomp - Statically recompiles the MIPS R5900 code of the NTSC-U PlayStation 2 God of War executable (SCUS-97399) to C++ with PS2Recomp and builds it as a native Windows program. _{Case study · Independent reconstruction · Full entry}
• RaceWave46: an AI-assisted Wave Race 64 recompilation for Windows - Recompiles the USA Rev 1 Nintendo 64 release of Wave Race 64 into a native Windows application with N64Recomp and RSPRecomp, on modified copies of the N64ModernRuntime, RecompFrontend and RT64 stacks. _{Case study · Independent reconstruction · Full entry}
• Jazz² Resurrection: a native C++ reimplementation of Jazz Jackrabbit 2 - Reimplements Jazz Jackrabbit 2 (1998) as a native C++ game on an extensively modified nCine engine, converting the user’s original game files into its own cache on first start. _{Case study · Independent reconstruction · Full entry}
• LBA2 Remake: a Little Big Adventure 1 and 2 reimplementation in TypeScript and Three.js - Reimplements the engine of Little Big Adventure 2, and now also Little Big Adventure 1, in TypeScript, Three.js and React so that it runs in a browser on resources imported from the user’s copy of the game. _{Case study · Independent reconstruction · Full entry}
• OpenAWE: an open reimplementation of Remedy’s Alan Wake engine - Reimplements Remedy Entertainment’s Alan Wake engine, later known as Northlight, in C++ and OpenGL, aiming to run Alan Wake and Alan Wake’s American Nightmare portably from the user’s game data, with Quantum Break and possibly Control as later goals. _{Case study · Independent reconstruction · Full entry}
• CPS-2 Recomp: static recompilation of Capcom CPS-2 and CPS-1 arcade games - Translates the 68000 game programs and Z80 sound programs of Capcom arcade boards ahead of time into C++ and runs them on a machine model written for the project, with an interpreter for code that has not been translated. _{Case study · Independent reconstruction · Full entry}
• impacto: a reimplementation of the MAGES. visual-novel engine - Reimplements the MAGES. visual-novel engine, used by the Science Adventure and Memories Off series, in C++ with OpenGL, running supported titles from the user’s original data files through per-game Lua profiles in one binary. _{Case study · Independent reconstruction · Full entry}
• Wind Waker HD decompilation: functions verified against the recompiled Wii U game - Decompiles the USA Wii U release of The Wind Waker HD function by function into readable C++ in zeldaret/tww’s style, and verifies each function by running it beside the original, statically recompiled from the user’s own copy, comparing return values, memory writes and calls on generated and recorded inputs, with coverage and mutation checks. _{Case study · Independent reconstruction · Full entry}
• SiegeFX: a Dungeon Siege engine reimplementation in alpha - A C#/.NET 10 engine loads Dungeon Siege's original archives, scripts and models, with published alpha builds and an audit/parity ledger. _{Case study · Independent reconstruction · Full entry}
• Legend of Legaia: a Rust port with disc-local browser tooling - A from-scratch Rust port of the North American PlayStation Legend of Legaia includes native/browser play, asset extraction and disc patching. _{Case study · Independent reconstruction · Full entry}
• RSDKv3 Decompilation: Sonic CD (2011) on a reconstructed Retro Engine v3 - Reconstructs Retro Engine v3, the engine behind the 2011 Sonic CD remaster, as a native C++ source port for Windows, Linux, macOS and Android. _{Case study · Independent reconstruction · Full entry}
• ICO decompilation: byte-identical PAL and Japanese PlayStation 2 boot ELFs - Rebuilds the boot ELFs of ICO’s PAL (SCES-50760) and Japanese (SCPS-11003) PlayStation 2 discs from one source tree with the game’s original compiler versions, and checks that every loaded byte and the whole ELF file match the disc’s SHA-1. _{Case study · Independent reconstruction · Full entry}
• game-and-watch-patch: Nintendo Game & Watch custom firmware - Custom firmware for the Mario and Zelda Game & Watch consoles that patches new C code into the user's own stock firmware backups, so the original firmware runs alongside the retro-go emulator. _{Case study · Independent reconstruction · Also: Firmware · Full entry}
• IW4L: a Rust runtime that plays Modern Warfare 2 from the user’s installed game - Implements a standalone runtime for Call of Duty: Modern Warfare 2 (2009) in Rust on Bevy and wgpu, loading maps, models, textures and weapons from the user’s installed game through native FastFile readers and translating its Direct3D 9 shaders to WGSL. _{Case study · Independent reconstruction · Full entry}
• Skate 3 Rust Engine: a Bevy rewrite built on Skate 3 reverse-engineering research - Reimplements Skate 3’s skating, tricks, grinds and offboard movement in a new Rust and Bevy engine that runs on assets converted from the user’s own Xbox 360 copy, adding difficulty settings and a .skate custom-map format. _{Case study · Independent reconstruction · Full entry}
• Bravo: a reverse-engineered Minecraft server - Reimplements the server side of Minecraft’s Alpha- and Beta-era multiplayer in Python on Twisted; its documentation calls it a reverse-engineered implementation written from scratch, credits network traffic dumps and says general Minecraft data went to a community wiki. _{Case study · Independent reconstruction · Also: Protocol · Full entry}

Tools, projects and integrations

• RenderDoc - Inspect frame captures, draw calls, shaders, and graphics resources in your own game or graphics application. _{Tool · Also: App · Full entry}
• AssetRipper - Analyze Unity game files, inspect asset dependencies, and convert supported assets into Unity project formats. _{Tool · Full entry}
• Cpp2IL - Recover managed representations from Unity IL2CPP builds using binary and metadata analysis; reconstruction remains a work in progress. _{Tool · Also: App, Binary · Full entry}
• Il2CppDumper - Recover IL2CPP metadata and dummy assemblies, and generate helper scripts for native analysis tools; method code is not restored. _{Tool · Also: App, Binary · Full entry}
• RenderDoc MCP - Expose existing RenderDoc captures to an agent for bounded frame, pipeline, resource, and shader inspection. _{Integration · Independent MCP · Also: App · Full entry}
• UndertaleModTool - Browse and modify supported GameMaker data files, extract assets, and decompile or compile GML VM code. _{Tool · Full entry}
• frida-il2cpp-bridge - Inspect IL2CPP classes, methods, and fields in a live process, and trace or intercept method calls without supplying global-metadata.dat. _{Tool · Also: App · Full entry}
• objdiff - Compare functions and data in reference and rebuilt object files to guide matching decompilation. _{Tool · Also: Binary · Full entry}
• decomp-permuter - Randomly or systematically permutes one C function, recompiling each variant and scoring it against a target object file to search for matching compiler output. _{Tool · Also: Binary · Full entry}
• asm-differ - Diffs original and rebuilt assembly for one function or ROM address to guide matching decompilation; its watch mode can rerun make when sources change. _{Tool · Also: Binary · Full entry}
• UE Explorer - Explore Unreal packages through class, property, and dependency trees; decompile and export UnrealScript classes, inspect bytecode, and examine structured binary data. _{Tool · Also: Binary · Full entry}
• GARbro - Browse recognized visual-novel resource archives as folders, preview their contents, and extract images or audio with conversion to common formats. _{Tool · Full entry}
• Godot RE Tools - Recover supported Godot project files, GDScript and imported resources from exported games. _{Tool · Full entry}
• UE4SS - Inspect Unreal Engine games at runtime through live UObject property views, reflected C++ header dumps, property mappings and actor dumps. _{Tool · Full entry}
• FModel - Explore Unreal Engine game archives with CUE4Parse-backed package and property inspection, asset previews and export. _{Tool · Full entry}
• PSP Web Recomp - Translate PSP MIPS executables into C++ and WebAssembly, backed by a PSP high-level emulation runtime and WebGL2 renderer. _{Project · Also: Website · Full entry}
• N64: Recompiled - Statically recompiles N64 MIPS binaries into C functions from symbol metadata, emitting function lookups and relocation macros so a runtime can handle statically linked and relocatable overlays. _{Tool · Also: Binary · Full entry}
• XenonRecomp - Converts Xbox 360 PowerPC executables into C++ that can be compiled for other platforms, with the XenonAnalyse companion detecting jump tables and function boundaries. _{Tool · Also: Binary · Full entry}
• decomp.me - Collaborative decompilation website for matching work: its compile service builds candidate source with a selected platform compiler, assembles the target assembly and diffs the two objects with asm-differ. _{Tool · Also: Binary · Full entry}
• splat - Binary splitter for decompilation and modding projects: a YAML config says where and how to cut an N64 ROM or PSX, PS2 or PSP binary into code, data and asset segments. _{Tool · Also: Binary · Full entry}
• m2c - Decompiler for matching projects that turns GNU as-format 32-bit MIPS, ARM, PowerPC and SuperH assembly into draft C, with partial C++ support. _{Tool · Also: Binary · Full entry}
• decomp-toolkit - GameCube/Wii matching-decompilation toolkit that analyzes DOL and REL executables and, from a project configuration, splits them into relocatable objects plus an ldscript.lcf for CodeWarrior's linker, so decompiled objects can replace original ones while the relinked binary is checked against the original. _{Tool · Also: Binary · Full entry}
• Cheat Engine MCP Bridge - Connects MCP clients to Cheat Engine through a Lua bridge script and a Python MCP server, so an agent can inspect a process the user runs under Cheat Engine: memory reads and value scans, pointer-chain resolution, structure dissection, RTTI class names, disassembly, cross-references and hardware or DBVM breakpoints. _{Integration · Independent MCP · Also: Binary · Full entry}
• ido-static-recomp - Statically recompiles the IRIX MIPS programs of SGI's IDO 5.3 and 7.1 C toolchain, such as cc, cfe, uopt, ugen and as1, into native Linux, macOS and Windows executables, so matching decompilation projects can build with the original compiler code on modern hosts. _{Tool · Also: Binary · Full entry}
• PS2Recomp - Experimental static recompiler that translates MIPS R5900 code from PlayStation 2 ELF executables into C++ and links it with a bundled runtime. _{Tool · Also: Binary · Full entry}
• Xenosaga I Decomp Compatibility Kit - Checks a PS2 matching decompilation from outside its own build: the C is recompiled with a stock, unpatched ee-gcc 2.96 and assembler, then each function is byte-compared against the original and every difference is classified by its likely toolchain cause. _{Tool · Also: Binary · Full entry}
• GB Recompiled - Static recompiler that turns Game Boy and Game Boy Color ROMs into portable C projects: it decodes and analyzes banked LR35902 code, emits C with machine-readable metadata, and links it with a shared SDL2 runtime for video, audio, input, saves and hardware timing. _{Tool · Also: Binary · Full entry}
• dtk-template - Project template for starting GameCube and Wii matching-decompilation repositories around decomp-toolkit. _{Tool · Full entry}
• N64ModernRuntime - Runtime for N64Recomp static recompilations and traditional source ports of N64 games, made of two libraries. _{Tool · Full entry}
• REDscript - Compiler and decompiler toolkit for REDscript, a statically typed, object-oriented language for writing scripts for REDengine, CD Projekt's engine used in Cyberpunk 2077. _{Tool · Full entry}
• Spice86 - PC emulator for executing, reverse engineering and rewriting real-mode DOS programs whose source code is unavailable. _{Tool · Also: Binary · Full entry}
• PS2 Web Recomp - Statically recompiles PlayStation 2 games for the browser: eerecomp translates the Emotion Engine code of a game's boot executable into C++ that is compiled to WebAssembly, and a runtime emulates the rest of the console, including a high-level EE kernel, an interpreted I/O processor running the disc's IRX modules, the vector units, SPU2 sound and the Graphics Synthesizer on WebGPU compute shaders. _{Tool · Also: Binary · Full entry}
• xboxrecomp - Static-recompilation toolkit for original Xbox games: a Python pipeline parses a retail XBE, disassembles it, classifies library functions, recovers calling conventions and lifts every x86 function to C. _{Tool · Also: Binary · Full entry}
• PCSX-Redux - PlayStation 1 emulator forked from PCSX and built around development and reverse engineering, with an interpreter and dynamic recompiler, software and OpenGL renderers, a MIPS debugger, VRAM viewer, SPU and GPU debugging tools, and a built-in GDB server that its documentation connects to gdb, IDA Pro and Ghidra's debugger. _{Tool · Also: Binary · Full entry}
• Il2CppInspector - Static analysis tool for Unity IL2CPP applications that reads an IL2CPP binary with its global-metadata.dat and outputs the application's type structure and method addresses as C# stub code, .NET assembly shim DLLs for decompilers such as ILSpy and dnSpy, IDA and Ghidra Python scripts that apply symbols and types, C++ type scaffolding and JSON address maps. _{Tool · Also: App, Binary · Full entry}
• MelonLoader - Mod loader for Unity games on both the Mono and IL2CPP runtimes, which loads plugins and mods from folders in a locally installed game; on Windows a proxy DLL, version.dll by default, starts it with the game. _{Tool · Full entry}
• BepInEx - Plugin and patching framework for Unity Mono, Unity IL2CPP and .NET Framework games such as XNA, FNA and MonoGame titles, which loads mods and analysis plugins into a locally installed game. _{Tool · Full entry}
• ReXGlue SDK - Experimental SDK for statically recompiling Xbox 360 executables into portable C++23 that runs natively on Windows, Linux and macOS. _{Tool · Also: Binary · Full entry}
• ps3recomp - Toolkit and runtime for statically recompiling PlayStation 3 games into native executables. _{Tool · Also: Binary · Full entry}
• Nebula (NebulaFD) - Work-in-progress decompiler for games made with Clickteam Fusion 2.5, with fixes for older Multimedia Fusion 1.5 files. _{Tool · Full entry}
• swe1r-assets-unity: Racer model-block editor sample - Work-in-progress Unity editor sample for importing and modifying Star Wars Episode I: Racer model blocks, then serializing them back through swe1r-assets. _{Tool · Full entry}
• LuaJIT Decompiler v2 - Decompiles LuaJIT bytecode files back into Lua source, written as a replacement for the older Python LuaJIT decompiler. _{Tool · Also: Binary · Full entry}
• NTRGhidra - Ghidra loader and plugin for Nintendo DS programs. _{Tool · Full entry}
• mgbdis - Python disassembler that turns a Game Boy or Game Boy Color ROM, including multi-bank ROMs, into RGBDS-compatible assembly plus a Makefile that reassembles it, so the rebuilt ROM can be compared with the input. _{Tool · Also: Binary · Full entry}
• ghidra-allegrex - Ghidra processor module for the Allegrex CPU of the PlayStation Portable, derived from Ghidra's MIPS module. _{Tool · Also: Binary, Firmware · Full entry}
• GM8Decompiler - Command-line tool that turns games built with GameMaker 8.0 or 8.1 back into editable .gmk or .gm81 project files. _{Tool · Full entry}
• UELib (Unreal-Library) - C# library that reads Unreal Engine 1, 2 and 3 package files such as .u, .upk and .udk, auto-detects a matching game build and deserializes their exports, imports and properties. _{Tool · Full entry}

App

↑ Contents

Case studies

• Aegis: trace a login-code calculation - An official APK investigation follows TOTP methods in Aegis and publishes artifact identities and selected Evidence. _{Case study · Official REA · Full entry}
• Notion: trace the clipboard bridge - Trace a packaged Electron clipboard path using REA findings and separate source inspection; the dynamic wrapper remains a stated limit. _{Case study · Official REA · Full entry}
• PicoPrint: LX-D02 printer investigation - The author describes REA-assisted Android investigation followed by separate Hermes decompilation to support a Windows BLE printer. _{Case study · Mixed workflow · Also: Protocol · Full entry}
• ReaCut: video-editor reconstruction - An independent video editor whose authors document REA-assisted investigation of Jianying/CapCut behavior and project formats. _{Case study · Mixed workflow · Full entry}
• CF632BLE: a local client from scale-protocol research - Reimplements the CF632BLE scale’s BLE protocol and body-composition calculations from research on the vendor’s Unique Health Android app. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• zee-rp: reconstructing supported Axure RP 11 document operations - Reads and rewrites supported native Axure RP 11 documents through a binary-record codec, reference-aware cloning and constrained interaction writers. _{Case study · Independent reconstruction · Full entry}
• Virtual Desktop Streamer: rehosting the platform layer on Linux - An author-reported Claude Code and REA workflow replaces the macOS streamer’s capture, encoding, audio and input layer with Linux implementations while reusing vendor protocol libraries. _{Case study · Mixed workflow · Full entry}
• Open Claude UI: REA-informed interface reference components - Publishes React components, motion helpers and design-system notes derived from the author’s reported REA investigation of Claude Desktop. _{Case study · Mixed workflow · Full entry}
• PlxNative: reconstructing a native webOS media-client interface - An unofficial Plex client built after the author investigated LG webOS native media interfaces with Ghidra and coding agents. _{Case study · Independent reconstruction · Full entry}
• Windows Calculator: reconstructing percentage rules - REA’s case traces the installed Windows Calculator model DLL to explain different percentage behavior for multiplication/division and other operations. _{Case study · Official REA · Also: Binary · Full entry}
• Feishu: an author-reported isolated second app instance - The author reports using Codex and REA analysis to adapt a separate macOS Feishu copy with its own application identity, data directory and single-instance lock. _{Case study · Mixed workflow · Full entry}
• PhotoCraft: editor workflow reconstruction and PSD round-trip boundaries - The authors describe this Rust image editor as a clean-room reimplementation of Photoshop-style workflows. _{Case study · Independent reconstruction · Full entry}
• WordCraft: document workflow reconstruction and bounded DOCX compatibility - The authors describe WordCraft as a clean-room Rust implementation of familiar Microsoft Word workflows. _{Case study · Independent reconstruction · Full entry}
• GridCraft: spreadsheet workflow reconstruction and XLSX round-trip limits - The authors describe GridCraft as a clean-room Rust implementation of Excel-style spreadsheet workflows. _{Case study · Independent reconstruction · Full entry}
• DeckCraft: presentation workflow reconstruction and bounded PPTX interchange - The authors describe DeckCraft as a clean-room Rust implementation of PowerPoint-style presentation workflows. _{Case study · Independent reconstruction · Full entry}
• Ledger Reborn: an independent accounting app informed by QuickBooks study - The maintainer reports using REA and Ghidra to study selected QuickBooks Desktop for Mac behavior, then independently implements a local accounting application. _{Case study · Mixed workflow · Full entry}
• Pocket Tasks: reconstructing task state and persistence - A teaching case with disclosed prior source access carries a REA-assisted investigation of a small command-line app into a separate Node implementation. _{Case study · Mixed workflow · Full entry}
• Open Scrantic: reconstructing the Johnny Castaway screensaver engine - Reconstructs the Johnny Castaway screensaver engine in Rust, with author-disclosed REA and Claude Code use. _{Case study · Mixed workflow · Full entry}
• Screen Studio: an author-reported REA study of auto-zoom rules - The author reports using REA to map Screen Studio’s Electron package, reading six auto-zoom and cursor rules from its obfuscated code with Claude Code’s help, and having Claude Code write an independent recorder and renderer from those rules. _{Case study · Mixed workflow · Full entry}
• Claude Code background lab: an REA-informed reimplementation of a desktop animation - Reimplements the glyph-wind background of the Claude desktop app’s Claude Code New session view as an offline WebGL2 page with a 38-slider control panel. _{Case study · Mixed workflow · Full entry}
• Notes CSV export: an author-reported REA check of reconstruction oracles - A Chinese article breaks three versions of a Python CSV exporter that reproduces the Notes teaching app shipped with REA. _{Case study · Mixed workflow · Full entry}
• Sofa TV Browser: a remote-friendly BrowseHere alternative - An Android TV browser follows BrowseHere's remote-control interaction design with its own implementation. _{Case study · Mixed workflow · Full entry}
• FastView-REA: a Rust reconstruction of Fast View 5 - A Rust desktop reconstruction of Mekhanotronika Fast View 5 uses REA and Ghidra research to reproduce oscillogram analysis and relay-characteristic views. _{Case study · Mixed workflow · Full entry}
• DiskLens: a WinDirStat-derived disk usage analyzer - A Rust/Tauri disk analyzer combines REA/Ghidra investigation of WinDirStat 2.5.0 with source-code ports of its treemap and color handling. _{Case study · Mixed workflow · Also: Binary · Full entry}
• SoundConnect Desktop: a Windows client reusing a reviewed headset engine - A Windows Sony-headphone client adopts existing libmdr/libmdr-bt engine DLLs after a documented REA-assisted binary inventory and source review. _{Case study · Mixed workflow · Also: Binary · Full entry}
• rec-rs: an OBS-informed Rust recorder for macOS - A macOS recorder is informed by OBS architecture research using REA package inspection, platform tools and public source references. _{Case study · Mixed workflow · Full entry}
• Sketch: a Paper-shell-informed native Rust canvas - A Rust canvas models Paper-like editing behavior after REA investigation of the Paper Desktop shell. _{Case study · Mixed workflow · Full entry}
• LSX II Volume Fixer: reconstructing volume behavior - Uses measured USB-volume behavior and a macOS audio proxy to map volume keys to a KEF LSX II’s LAN control. _{Case study · Independent reconstruction · Full entry}
• UU Remote on Linux: an unofficial protocol implementation - Implements an unofficial native Linux host for NetEase UU Remote, using protocol behavior the maintainer says was recovered from official-client traffic and shipped programs. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• TCLimate: reconstructing selected TCL Home cloud controls - Implements selected TCL Home air-conditioner controls and electricity reporting in a native macOS menu-bar app. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• Browserbase plugin: re-hosting Claude in Chrome’s browser bridge - Stands in for the Claude in Chrome extension side of Claude Code’s local browser bridge and runs the requested actions in Browserbase cloud browsers. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• Visor: an independent Ray-Ban Meta glasses client - Implements an Android replacement for the Meta AI companion app that speaks the Ray-Ban Meta glasses’ own Bluetooth and Wi-Fi Direct protocol, imports media, exposes settings and answers “Hey Meta” with a model the user chooses. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• wine-uwp: running packaged Windows Store apps on a patched Wine - Extends Wine 11.17 so that signed MSIX Store apps, with Shapr3D as the main target, install and run on Linux without their source or symbols. _{Case study · Independent reconstruction · Full entry}
• RKD Telemetry Extractor: decoding Race-Keeper track-day recordings - Documents the proprietary .rkd telemetry format written by Race-Keeper “Instant Video” recorders, whose bundled player runs only on Windows, and implements matching Python and Go parsers that export GPS and IMU channels as Telemetry Overlay CSV and GPX. _{Case study · Independent reconstruction · Full entry}
• Elgato HDR: a userspace capture path for the Elgato 4K X’s 10-bit mode - A native macOS app that reaches the Elgato 4K X capture card’s 10-bit P010 video mode, which the project says Apple’s built-in webcam driver does not expose to apps. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• LGwebOS-menubar: a native macOS remote for LG webOS TVs - A native macOS menu-bar app that pairs with an LG webOS TV over its local encrypted WebSocket interface to launch apps, switch inputs, adjust volume and picture settings, send pointer input and cast selected media. _{Case study · Independent reconstruction · Full entry}
• Galaxy Buds Client: an unofficial manager built on Samsung’s earbud protocol - Reimplements control of Samsung Galaxy Buds over their proprietary RFCOMM serial protocol in a cross-platform desktop and Android manager. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• Wino Mail: recreating Windows Mail and Calendar - Native Windows client that aims to preserve the familiar Windows Mail and Calendar experience while rebuilding its functionality. _{Case study · Independent reconstruction · Full entry}
• ScooterLink: reconstructing Honda RoadSync’s handlebar-button protocol - Replaces Honda RoadSync’s Apple Music-only media control with an iOS app that pairs with a Honda PCX 2025 TFT dash over Bluetooth Low Energy and turns handlebar presses into system-wide commands for any player. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• iX500 Scan: a macOS client for the reverse-engineered ScanSnap Wi-Fi protocol - Replaces ScanSnap Home for a Fujitsu/PFU ScanSnap iX500 on macOS with a SwiftUI app and Python service that scan over Wi-Fi through the community-reverse-engineered VENS protocol, or over USB through SANE, and produce searchable PDFs. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• WristBeam: reconstructing Garmin’s watch protocol for a Mac companion - Implements a Garmin watch companion as a native macOS menu-bar app that pairs over Bluetooth, receives live health notifications and original FIT files, and can upload them to Garmin Connect. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• usque: an open reimplementation of Cloudflare WARP’s MASQUE mode - Reimplements the MASQUE mode of Cloudflare’s WARP client in Go, tunnelling IP traffic over QUIC/HTTP/3 with Connect-IP (RFC 9484) and exposing it as a native TUN device, SOCKS5 or HTTP proxies, TCP-only L4 proxies or port forwarding. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• Webamp: a browser reimplementation of Winamp 2 - Reimplements Winamp 2's main, equalizer and playlist windows in HTML5 and JavaScript, with Web Audio playback, volume, balance and equalizer, and renders original classic .wsz skins, which its documentation says match Winamp 2.9 pixel for pixel; Milkdrop presets run through the Butterchurn WebGL port. _{Case study · Independent reconstruction · Full entry}
• NOOP: an offline WHOOP strap client built from Bluetooth protocol research - Replaces the WHOOP companion app with offline macOS, Android and iOS clients that pair with WHOOP 4.0 and 5.0/MG straps over Bluetooth, decode their vendor GATT frames, offload the strap’s history into local SQLite and compute recovery, strain, HRV and sleep on the device. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• NiimBlue: an independent web client for NIIMBOT label printers - Replaces NIIMBOT's own label app with a browser client that designs labels and prints them over Web Bluetooth or Web Serial, with Android (Capacitor) and Windows (Tauri) builds of the same interface. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• open_oura: a cloud-free Oura Ring client built on its reverse-engineered BLE protocol - Reimplements the Bluetooth Low Energy protocol of the Oura Ring Gen 3/4/5 in Rust crates and an oura command-line client that pairs with, authenticates to and syncs a ring directly, with no Oura account or cloud service. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• Sony Headphones Client: a desktop client for Sony’s headset control protocol - Recreates part of Sony’s mobile-only Headphones app as a Windows, Linux and macOS desktop client that changes noise-cancelling, ambient-sound and virtual-sound settings over a Bluetooth RFCOMM connection to a paired headset. _{Case study · Independent reconstruction · Also: Protocol · Full entry}

Tools, projects and integrations

• JADX-AI-MCP - JADX plugin paired with a Python MCP server to inspect decompiled Android classes, resources, cross-references and debugger context. _{Integration · Independent MCP · Full entry}
• apktool-mcp-server - Python MCP server that drives a local Apktool install so agents can decode APKs; list, read, search and edit smali and resource files; read AndroidManifest.xml and apktool.yml; and rebuild the project. _{Integration · Independent MCP · Full entry}
• frida-mcp (yfe404) - Frida MCP server with persistent instrumentation sessions, runtime inspection and Android static-to-dynamic navigation. _{Integration · Independent MCP · Also: Game · Full entry}
• Super Trouper - Single-binary Frida MCP server for discovering devices, managing process sessions and loading instrumentation scripts. _{Integration · Independent MCP · Also: Game · Full entry}
• Frida - Dynamic instrumentation toolkit for observing and scripting the behavior of live native and managed processes. _{Tool · Also: Game · Full entry}
• JADX - Dex-to-Java decompiler with CLI/GUI navigation, resource decoding and cross-reference search for Android packages. _{Tool · Android · Full entry}
• Apktool - Decodes Android resources and smali into a project-like tree and can rebuild modified packages. _{Tool · Android · Full entry}
• Androguard - Python toolkit for APK/DEX metadata, bytecode and reference analysis; the v5 source branch also documents agent skills and MCP. _{Tool · Android · Full entry}
• ILSpy - .NET assembly browser and C# decompiler with whole-project export, metadata inspection and a scriptable command-line frontend. _{Tool · .NET · Full entry}
• dnSpyEx - Community continuation of dnSpy for debugging and editing .NET assemblies without the original source. _{Tool · .NET · Full entry}
• @electron/asar - Electron's archive tool lists and extracts ASAR contents so packaged JavaScript and application assets can be inspected. _{Tool · Also: Website · Full entry}
• Mobile Security Framework (MobSF) - Inspect mobile application packages with static analysis and supported-device dynamic testing, including runtime behavior and network traffic, through a web interface and APIs. _{Tool · Android · Full entry}
• objection - Explore running Android and iOS apps with a Frida-backed command interface for inspecting app storage, memory, runtime objects, and instrumented behavior. _{Tool · Android · Full entry}
• Grapefruit - Inspect and hook running iOS and Android apps from a Frida-based web interface, with method and crypto-API hooks, filesystem and SQLite browsers, iOS keychain and UI-hierarchy views, and HTTP capture from common networking libraries. _{Tool · Full entry}
• Blutter - Analyze Flutter Android ARM64 AOT binaries using the matching Dart runtime. _{Tool · Android · Also: Binary · Full entry}
• hermes-dec - Parse, disassemble and partially decompile React Native Hermes bytecode bundles. _{Tool · Android · Full entry}
• Recaf - Inspect and modify compiled JVM applications with integrated decompilers, bytecode assembly, reference search, mappings and deobfuscation tools. _{Tool · JVM · Also: Binary · Full entry}
• nibkit - Decode compiled iOS/macOS interface archives into object trees, Outlet/Action connections, custom classes and navigation relationships. _{Tool · Full entry}
• AOTopsy - Statically inspect Flutter/Dart AOT libapp.so files to recover available metadata, class structures, call edges and pseudocode without embedding a Dart VM or compiling a matching SDK. _{Tool · Android · Also: Binary · Full entry}
• hbctool - Disassemble and reassemble supported React Native Hermes bytecode bundles through HASM files, enabling bytecode inspection and editing for the explicitly supported legacy HBC versions. _{Tool · Android · Full entry}
• Vineflower - Fernflower-derived decompiler for Java and other JVM languages that continues the ForgeFlower, Fabric and Quiltflower forks, focused on output quality and modern Java, including records, sealed classes, switch expressions and pattern matching through Java 21+. _{Tool · JVM · Full entry}
• Droid ASC - Python Android decompiler that answers queries directly against an APK instead of first unpacking and indexing it. _{Tool · Android · Full entry}
• APKEditor - Command-line APK editor built on ARSCLib that decodes an APK's binary resources and DEX into editable JSON, XML or smali and rebuilds a package from them, independent of aapt and aapt2. _{Tool · Android · Full entry}
• jnitrace - Frida-based dynamic-analysis tool that traces an Android app's use of the JNI API, similar to frida-trace or strace but for the Java Native Interface. _{Tool · Android · Full entry}
• AsmResolver - C# library for reading, modifying and rebuilding Portable Executable files, covering both native Windows images and images with .NET metadata. _{Tool · .NET · Also: Binary · Full entry}
• CodemerxDecompile - Cross-platform desktop .NET decompiler maintained by the original JustDecompile creators as a continuation of their JustDecompile Engine, built with Mono.Cecil and an Avalonia UI. _{Tool · .NET · Full entry}
• wxapkg - Desktop GUI for Windows and macOS, built with Wails, that unpacks WeChat mini-program .wxapkg packages for study. _{Tool · Full entry}
• React Native Decompiler - Alpha-stage Node.js CLI that splits a React Native JavaScript bundle (index.android.bundle or main.jsbundle), an unbundled js-modules folder, or Webpack entrypoint and chunk bundles into one readable file per module. _{Tool · Full entry}
• hermes-decomp - Rust decompiler and analysis toolkit for Hermes bytecode (.hbc), the compiled form React Native apps ship for the Hermes engine; the README lists HBC versions 40 to 99. _{Tool · Android · Full entry}
• MEDUSA - Modular Frida-based framework for runtime analysis of Android and iOS apps the analyst is authorized to test. _{Tool · Android · Full entry}
• Android Unpinner - Tool from the mitmproxy project that removes certificate pinning from an Android APK you own or are authorized to test, without a rooted device. _{Tool · Android · Also: Protocol · Full entry}
• apk-mitm - Command-line tool that prepares an Android APK you own or are authorized to test for HTTPS traffic inspection. _{Tool · Android · Also: Protocol · Full entry}
• Frida Mobile Interception Scripts - A set of Frida scripts from HTTP Toolkit for inspecting a mobile app's HTTPS traffic while analysing apps you own or are authorized to test. _{Tool · Android · Also: Protocol · Full entry}
• reFlutter - Flutter reverse-engineering framework for apps the analyst is authorized to inspect. _{Tool · Android · Also: Protocol · Full entry}
• ddc - Rust decompiler that turns Android DEX bytecode, versions 035 to 041, from APKs, multi-dex apps and XAPK/APKS/APKM containers into Java, folding lambdas and string concatenation back into Java syntax and giving locals jadx-style names. _{Tool · Android · Full entry}
• Simplify - Generic Android deobfuscator built on smalivm, a sandboxed Dalvik virtual machine that executes each method and records every possible register and class value along all execution paths, taking both branches when a value such as file or network input is unknown. _{Tool · Android · Full entry}
• GDA (GJoy Dex Analyzer) - Windows-native Dalvik decompiler and Android analysis workbench written in C++ that opens APK, DEX, ODEX, OAT, JAR, AAR and class files without installation. _{Tool · Android · Full entry}
• APKLab - VS Code extension that turns the editor into an Android reverse-engineering workbench around Apktool, Jadx, smali-lsp and uber-apk-signer. _{Tool · Android · Full entry}
• Fernflower - JetBrains' analytical decompiler that turns Java class files back into Java source; IntelliJ IDEA bundles it to show code when debugging or browsing class files. _{Tool · JVM · Full entry}
• Bytecode Viewer - Desktop suite for inspecting compiled Java and Android programs: drop in a class, JAR, WAR, APK, DEX, XAPK or APKM file to browse its classes and resources, with up to three decompiler or disassembler views side by side. _{Tool · JVM · Full entry}
• Logic-Lens - Experimental JavaScript source-analysis toolkit that classifies AST-token sequences into configured formula families after local training, and produces heuristic structure, call-graph and intent reports. _{Tool · Full entry}
• Android Security Toolkit - Local Python APK triage tool that drives apktool and strings, checks manifest settings and source/native-library strings, and produces TXT/JSON findings for manual review. _{Tool · Android · Full entry}
• ilspy-cli: targeted .NET decompilation for agents - Rust CLI that hosts an ILSpy C# bridge in-process for assembly, type and named-method decompilation, source search and structured JSON output. _{Tool · .NET · Full entry}
• React-Decode - Static-analysis CLI for compiled React JavaScript that produces readable bundle output and inferred API-request, route and application-constant reports. _{Tool · Also: Website · Full entry}
• abc-decompiler - Decompiler for HarmonyOS Ark bytecode (.abc), the format HarmonyOS app packages carry in modules.abc, built by adapting the jadx decompiler and reading files through a patched copy of the abcde library. _{Tool · Android · Full entry}
• slicer - Browser-based Java reverse-engineering tool that loads class files and JAR/ZIP archives and disassembles or decompiles them with Vineflower (the default), CFR, Procyon or JASM, compiled to run in the browser, next to its own bytecode disassembler. _{Tool · JVM · Full entry}
• APK Studio - Qt6 desktop front end that drives Apktool, JADX, uber-apk-signer and ADB from an IDE-style workspace for Android packages. _{Tool · Android · Full entry}
• APKiD - PEiD-style identifier for Android packages from RedNaga. _{Tool · Android · Full entry}
• dex2jar - Java toolkit that converts Android DEX bytecode, including DEX inside APKs, into JVM .class files packed as a jar for Java decompilers and bytecode tools. _{Tool · Android · Full entry}
• apk.sh - Bash script that automates repetitive Android app analysis chores around apktool: pulling an installed package from a device or emulator, decoding resources and disassembling dex code, and rebuilding the decoded directory into an APK. _{Tool · Android · Full entry}
• FIRERPA (lamda) - Client/server Android automation and dynamic-analysis platform for devices the analyst is authorized to test. _{Tool · Android · Full entry}
• Binder Trace - Frida-based terminal tool, described by its authors as "Wireshark for Binder", that intercepts the Binder IPC transactions an Android process sends and parses each message and its reply. _{Tool · Android · Also: Protocol · Full entry}
• Quark-Engine - Rule-based engine for analysing suspicious Android apps: it loads an APK's Dalvik bytecode and checks JSON behaviour rules, each naming permissions and a pair of framework API calls, through five confidence stages, from the permission being requested and either API being called up to both calls appearing in order in one method and passing the same register. _{Tool · Android · Full entry}
• Dexcalibur (Reversense) - Android reverse-engineering platform that combines static analysis with Frida-based dynamic instrumentation; the master branch is Reversense (Dexcalibur 2.0), a rewrite that runs as a Node.js web server for collaborative projects. _{Tool · Android · Full entry}
• vdexExtractor - Command-line C tool that extracts the Dex bytecode held in the Vdex containers that ART's dex2oat compiler writes beside Oat files since Android 8.0 (API 26), and by default reverts ART's dex-to-dex quickening so the output is ordinary Dex again. _{Tool · Android · Full entry}
• Garlic - Java and Android decompiler written in C that recovers Java source from class, JAR, WAR, DEX and APK files on multiple threads; it also prints javap- or dexdump-style class listings, converts APK and DEX files to smali, searches their strings with regular expressions and generates call graphs for DEX and APK files. _{Tool · Android · Full entry}
• Android-Disassembler - On-device disassembler and binary viewer for Android, built on Capstone, that opens ELF shared libraries and executables, object files, Windows PE files, .NET assemblies, dex files and APKs chosen from storage or from installed apps. _{Tool · Android · Also: Binary · Full entry}
• XAPKDetector - APK and DEX detector from hors, the author of Detect-It-Easy, that reports the build tools, libraries and protections it identifies in Android packages, using scan engines and signature databases from the Detect-It-Easy family. _{Tool · Android · Full entry}
• Jsxer - C++ decompiler for JSXBIN, the binary format of Adobe's legacy ExtendScript, the ECMAScript 3 dialect used to script applications such as Photoshop, InDesign and After Effects. _{Tool · Full entry}
• jni_helper - Static helper by evilpan for reverse engineering Android JNI code. _{Tool · Android · Also: Binary · Full entry}
• ReArk - Desktop reverse-engineering and AI-assisted analysis workbench for HarmonyOS NEXT packages (.hap, .app and .abc), whose binary releases add Android .apk/.aab, iOS .ipa and standalone PE, ELF and Mach-O analysis. _{Tool · Android · Also: Binary · Full entry}
• ARSCLib - Java library, modeled on AOSP's androidfw ResourceTypes.h and meant to replace aapt/aapt2, that reads, writes, modifies and creates Android resource tables (resources.arsc) and binary XML files such as AndroidManifest.xml. _{Tool · Android · Full entry}
• Pithus (bazaar) - Self-hostable Django platform behind the Pithus Android analysis service, which its README describes as built for activists, journalists, NGOs and researchers. _{Tool · Android · Full entry}
• House - NCC Group’s Python and Flask web interface for Frida-based runtime analysis of Android apps, intended to make writing Frida scripts simpler. _{Tool · Android · Full entry}
• ABCDE - Kotlin toolkit for OpenHarmony reverse engineering that parses Ark bytecode (.abc) files, the format HarmonyOS app packages carry in modules.abc, along with HAP packages and resource index (.index) files. _{Tool · Android · Full entry}
• de4js - Browser-based JavaScript deobfuscator and unpacker, built as a Jekyll site that also works offline as a progressive web app. _{Tool · Also: Website · Full entry}
• DexKit - C++ DEX parsing library with Kotlin and Java APIs that loads an APK, DEX bytes or an app’s class loader and finds classes, methods and fields by their characteristics rather than their obfuscated names. _{Tool · Android · Full entry}
• bun-demincer - Node.js pipeline that recovers readable JavaScript from Bun-compiled standalone executables. _{Tool · Also: Binary · Full entry}
• dex-oracle - Pattern-based Dalvik deobfuscator that takes an APK, a DEX file or a Smali directory, disassembles it with baksmali and runs plugins that look for obfuscation patterns in the Smali code. _{Tool · Android · Full entry}

Native Binary

↑ Contents

Case studies

• DownUnderCTF: masked-squares flag checker - An official educational challenge investigation connects binary checks to equations and records an original-program validation. _{Case study · Official REA · Full entry}
• Show Your Work: a measured dissection of REA's evidence architecture - An unofficial field study that reads REA's source and then drives the running server through 1,012 recorded calls across 27 artifact classes, measuring its content-addressed Evidence records, revision-chained unknown ledger, typed refusals, cold starts and response limits. _{Case study · Mixed workflow · Full entry}
• Windows loader: static malware analysis with REA and Codex - Fedele Mantuano reports using Codex with REA in an offline Docker lab to statically analyze a public Windows malware sample without executing it. _{Case study · Mixed workflow · Full entry}
• OpenBSD netcat: static REA and Ghidra investigation - A REA/Ghidra report studies the Ubuntu netcat-openbsd 1.234-1 ELF binary and publishes evidence envelopes, decompiled functions and a function inventory. _{Case study · Mixed workflow · Full entry}

Tools, projects and integrations

• Ghidra - Open-source analysis suite for disassembly, decompilation, graphs and Java/Python automation across executable formats. _{Tool · Also: Game, Firmware · Full entry}
• radare2 - Scriptable command-line framework for inspecting, disassembling, debugging and modifying binaries across many architectures. _{Tool · Also: Game · Full entry}
• Cutter - Rizin-powered graphical reverse-engineering workspace with extensible views and Ghidra decompiler integration. _{Tool · Also: Game · Full entry}
• Qiling - Python emulation framework that adds OS, filesystem and API behavior around CPU emulation for instrumented binary analysis. _{Tool · Also: Firmware · Full entry}
• Unicorn Engine - Multi-architecture CPU emulator for executing selected instruction ranges with register, memory and hook control. _{Tool · Library · Also: Game, Firmware · Full entry}
• angr - Python binary-analysis framework combining control-flow recovery, symbolic execution, data-flow analysis and decompilation. _{Tool · Library · Full entry}
• LIEF - Library for structured parsing and modification of executable formats including ELF, PE and Mach-O. _{Tool · Library · Full entry}
• Capstone - Disassembly library with architecture-neutral APIs and instruction details for custom binary-analysis pipelines. _{Tool · Library · Full entry}
• ImHex - Hex editor with a binary-pattern language, structured data inspection and visual tools for understanding file formats. _{Tool · Also: Game, Firmware · Full entry}
• x64dbg - Windows binary debugger with disassembly, memory views and plugins for analyzing programs without source code. _{Tool · Full entry}
• GDB - Native and remote debugger for controlling execution and inspecting live or crashed program state. _{Tool · Full entry}
• rr - Records process execution and replays it under GDB, enabling repeatable inspection and reverse execution. _{Tool · Full entry}
• Diaphora - IDA-based binary diffing that matches functions and transfers names, comments and types between analyzed versions. _{Tool · Also: Game · Full entry}
• BinDiff - Compares disassembled binaries to find matching functions and changed code across versions. _{Tool · Also: Game · Full entry}
• Detect It Easy - Format-aware file identification and static inspection using parsers, signatures and programmable heuristics. _{Tool · Also: Game · Full entry}
• r2frida - Use radare2 commands and Frida instrumentation together to inspect local or remote process memory, symbols, classes, and runtime calls on desktop and mobile targets. _{Tool · Also: App · Full entry}
• Kaitai Struct - Turn documented binary layouts into reusable parsers for files and network packets. _{Tool · Library · Also: Firmware, Protocol · Full entry}
• GoReSym - Recover Go build metadata, function names and address ranges, source file and line tables, embedded types and strings from Go binaries, including stripped and some malformed unpacked samples. _{Tool · Full entry}
• rev.ng - Open-source decompilation pipeline that lifts x86-64, AArch64, i386, ARM and MIPS code with QEMU, runs LLVM-based analyses and emits C designed to be valid and recompilable. _{Tool · Full entry}
• Rizin - Command-line reverse-engineering framework that began as a fork of radare2. _{Tool · Also: Game · Full entry}
• Decompiler Explorer - Web service at dogbolt.org that runs one small uploaded executable through many decompilers and shows their C-like output side by side, described as Compiler Explorer in reverse. _{Tool · Full entry}
• pwndbg - Python plug-in that loads into GDB, or runs as a REPL around LLDB, to make live program state easier to inspect. _{Tool · Full entry}
• DynamoRIO - Runtime code manipulation system for building dynamic tools that observe or transform any part of an unmodified program while it runs. _{Tool · Full entry}
• Decompyle++ (pycdc) - C++ disassembler and decompiler for compiled Python bytecode that aims to support bytecode from any Python version. _{Tool · Also: App · Full entry}
• cwe_checker - Static analyzer from Fraunhofer FKIE that searches binary executables, mainly Linux and Unix ELF files, for code paths matching Common Weakness Enumeration bug classes such as buffer overflows, use-after-free and double free, NULL pointer dereferences, format strings and integer overflows. _{Tool · Also: Firmware · Full entry}
• FLARE-VM - Mandiant FLARE installer that sets up and maintains a Windows virtual machine for reverse engineering and malware analysis. _{Tool · Full entry}
• B2R2 - Binary analysis framework written in F# for .NET by KAIST's SoftSec Lab. _{Tool · Library · Full entry}
• rz-ghidra - Rizin plugin that embeds Ghidra's C++ decompiler and Sleigh disassembler, so no Java Ghidra installation is needed. _{Tool · Full entry}
• dewolf - Research decompiler from Fraunhofer FKIE, developed with Singapore's DSO National Laboratories between 2019 and 2021, that runs as a Binary Ninja plugin and starts from Binary Ninja's Medium Level IL. _{Tool · Full entry}
• decomp2dbg - Decompiler-to-debugger bridge that serves function names, global variables, stack and register variable names and decompiled code from IDA Pro, Binary Ninja, Ghidra or angr-management to GDB over an XML-RPC connection. _{Tool · Full entry}
• E9Patch - Static binary rewriter for x86-64 Linux ELF executables and shared objects that inserts instrumentation without control-flow recovery and writes a drop-in replacement binary, following the PLDI 2020 paper Binary Rewriting without Control Flow Recovery. _{Tool · Full entry}
• Rellic - Trail of Bits implementation of the pattern-independent structuring algorithm from the No More Gotos paper, turning LLVM bitcode into goto-free C as a small, hackable decompiler back end that interoperates with LLVM and Remill. _{Tool · Library · Full entry}
• ghidra-delinker-extension - Ghidra extension that delinks a selected part of a program back into a relocatable object file. _{Tool · Also: Game · Full entry}
• BinExport - The exporter component of BinDiff: plugins for IDA Pro and Binary Ninja and an extension for Ghidra that write an analyzed disassembly to the Protocol Buffer format BinDiff requires. _{Tool · Full entry}
• Karta - Source-code-assisted IDA Python plugin from Check Point Research that finds and matches open-source libraries compiled into large binaries and firmware. _{Tool · Also: Firmware · Full entry}
• VTIL-Core - C++20 core of the VTIL (Virtual-machine Translation Intermediate Language) project, an intermediate language and optimizing compiler that the README describes as built for binary de-obfuscation and de-virtualization. _{Tool · Library · Full entry}
• Frida Workbench for VSCode - Unofficial Visual Studio Code extension for Frida work. _{Tool · Also: App · Full entry}
• ghidriff - Command-line binary diffing engine that drives Ghidra headlessly through pyghidra: it imports and analyzes an old and a new binary, then reports added, deleted and modified functions, with patch diffing as its main use. _{Tool · Also: Firmware · Full entry}
• Ddisasm - GrammaTech's Datalog disassembler, which turns ELF and PE binaries for x86-32, x86-64, ARM32, ARM64 and MIPS32 into the GTIRB intermediate representation. _{Tool · Full entry}
• PINCE - Linux front end for the GNU Debugger (GDB), focused on games but usable for other reverse engineering; the name stands for “PINCE is not Cheat Engine”. _{Tool · Also: Game · Full entry}
• uncompyle6 - Cross-version decompiler that translates Python bytecode back into equivalent Python source, accepting bytecode from Python 1.0 through 3.8 as well as some PyPy bytecode and Dropbox's Python 2.5. _{Tool · Also: App · Full entry}
• ret-sync - Reverse-Engineering Tools SYNChronization: plugins that keep IDA, Ghidra or Binary Ninja graph and decompiler views following a live WinDbg, GDB, LLDB, OllyDbg 1.10/2 or x64dbg session, rebasing addresses on the fly so ASLR does not break the mapping. _{Tool · Full entry}
• PyInstaller Extractor (pyinstxtractor) - Single-file Python script that extracts the contents of executables built with PyInstaller, including Linux ELF builds without other tools. _{Tool · Also: App · Full entry}
• Binary Analysis Platform (BAP) - OCaml binary analysis platform from Carnegie Mellon University. _{Tool · Library · Full entry}
• Reko - General-purpose decompiler that loads executables or raw images, scans their machine code into a machine-independent register transfer language, groups it into procedures and decompiles them into high-level C code. _{Tool · Also: Firmware · Full entry}
• Dyninst - Binary instrumentation, analysis and modification libraries from the Paradyn project. _{Tool · Full entry}
• goblin - Rust crate for zero-copy, endian-aware parsing of ELF32/64, 32/64-bit Mach-O and multi-architecture fat containers, PE32/PE32+, COFF objects, Terse Executable (TE) images and Unix/BSD archives; Object::parse picks the format from its magic bytes. _{Tool · Library · Full entry}
• FLOSS (FLARE Obfuscated String Solver) - Mandiant FLARE string extractor for malware analysis that is used like strings.exe but also recovers obfuscated strings. _{Tool · Full entry}
• Zydis - Lightweight C11 x86/x86-64 disassembler and code-generation library. _{Tool · Library · Full entry}
• QBDI - Quarkslab's modular dynamic binary instrumentation (DBI) framework, which JIT-recompiles a program's basic blocks inside its own process so that an instrumentation tool can register callbacks before or after instructions, on memory reads and writes, and on VM events. _{Tool · Also: App · Full entry}
• binsider - Terminal user interface for inspecting ELF binaries. _{Tool · Full entry}
• iced - x86 instruction library for 16-, 32- and 64-bit code that decodes, formats, assembles and encodes instructions, with masm, nasm, GNU AT&T and Intel XED output syntaxes. _{Tool · Library · Full entry}
• hrtng - IDA plugin published by Kaspersky that extends the Hex-Rays decompiler with tools its author collected for reverse-engineering work, including malware analysis. _{Tool · Full entry}
• BinCAT - Static binary code analysis toolkit designed for reverse engineers. _{Tool · Full entry}
• GEF (GDB Enhanced Features) - Single-file Python extension, gef.py, that adds dynamic-analysis commands to GDB. _{Tool · Full entry}
• Triton - C++ library with Python bindings for dynamic binary analysis of x86, x86-64, ARM32, AArch64 and RISC-V 32/64 code. _{Tool · Library · Full entry}
• PyLingual - Research decompiler for CPython bytecode from Python 3.6 onward that pairs per-version transformer models with control-flow reconstruction. _{Tool · Also: App · Full entry}
• Miasm - Python reverse-engineering framework for analyzing, modifying and generating binary programs. _{Tool · Library · Full entry}
• HyperDbg - Hypervisor-assisted Windows debugger that virtualizes the running system with Intel VT-x and Extended Page Tables to debug kernel and user mode, either locally as a tracing and introspection tool or from a host attached over a serial connection to a guest virtual machine. _{Tool · Full entry}
• Kuna - Agent-first decompiler written in Rust that began as a port of Ghidra’s C++ decompiler and SLEIGH compiler, and has since diverged with option-gated features, some ported from angr. _{Tool · Full entry}
• Binary Ninja API - Vector 35’s public C++, Python and Rust APIs for Binary Ninja, with their documentation, examples and the open-source plugins built on them. _{Tool · Also: Firmware · Full entry}
• capa - Mandiant FLARE tool that reports what an executable can do by matching a YAML rule set against features extracted from PE, ELF and .NET files or 32/64-bit shellcode, such as API calls, imports, strings and constants. _{Tool · Full entry}
• RetDec - Avast's retargetable machine-code decompiler built on LLVM. _{Tool · Full entry}
• REDasm - Cross-platform interactive disassembler whose version 4 is a plain-C rewrite: a C17 engine library, the Qt6 GUI kept in this repository, and loader, processor and analyzer plugins loaded as shared libraries. _{Tool · Also: Game · Full entry}
• Lighthouse - Code-coverage explorer plugin for IDA Pro and Binary Ninja that loads execution traces of native programs and paints the executed code across the disassembler's views, without needing symbols or source. _{Tool · Full entry}
• BinAbsInspector - Static vulnerability scanner from Tencent Keen Lab that runs as a Ghidra extension or headless script and applies abstract interpretation to Ghidra's P-code rather than to assembly, covering x86, x64, ARMv7 and AArch64 binaries. _{Tool · Full entry}
• VulHunt Community Edition - Open-source Community Edition of Binarly REsearch's VulHunt engine for hunting vulnerabilities in POSIX binaries and UEFI firmware on x86 and ARM. _{Tool · Also: Firmware · Full entry}
• BinSync - Decompiler plugin for collaborative reverse engineering that records each analyst's work in a shared Git repository, one branch per user, so teammates can pull, push or auto-push changes across IDA Pro, Binary Ninja, Ghidra and angr-management. _{Tool · Full entry}
• class-dump - Command-line utility that reads the Objective-C runtime metadata in Mach-O executables, frameworks and bundles and prints it as ordinary Objective-C declarations for the classes, categories and protocols it finds, the same information otool -ov shows in a more compact form. _{Tool · Also: App · Full entry}
• Lucid - IDA Pro plugin by Markus Gaasedelen for studying how the Hex-Rays decompiler transforms its microcode intermediate language. _{Tool · Full entry}
• r2dec - Decompiler plugin for radare2 that turns the disassembly of an analyzed function into pseudo-C through the pdd command. _{Tool · Full entry}
• Runtime Mobile Security (RMS) - Frida-based web interface for observing Android and iOS apps at run time on a test device. _{Tool · Also: App · Full entry}
• Pharos - Carnegie Mellon SEI's framework of automated static analysis tools for binary programs, built on LLNL's ROSE compiler infrastructure for disassembly, control-flow analysis and instruction semantics. _{Tool · Full entry}
• heimdall-rs - Rust toolkit by Jonathan Becker for analyzing EVM smart-contract bytecode, particularly of contracts without verified source. _{Tool · Full entry}
• PE-bear - Qt GUI to view and edit Windows Portable Executable files, meant as a fast first look for malware analysts and robust against malformed PE32 and PE64 files. _{Tool · Full entry}
• PE-sieve - Windows process scanner by hasherezade that finds and dumps implants in one running process: replaced or injected PE modules, shellcode, inline and IAT hooks and other in-memory patches, with the README naming Process Hollowing, Process Doppelgänging and reflective DLL injection among the techniques it detects. _{Tool · Full entry}
• oletools - Python package by Philippe Lagadec for analyzing Microsoft OLE2 (Compound File Binary) files such as Office 97–2003 documents, MSI files and Outlook messages, as well as RTF and OpenXML documents, mainly for malware analysis, forensics and debugging. _{Tool · Full entry}
• MonkeyDev - Based on iOSOpenDev, MonkeyDev adds a MonkeyApp project template to Xcode for instrumenting iOS apps the developer is authorized to analyze. _{Tool · Also: App · Full entry}
• Hollows Hunter - Windows command-line memory scanner by hasherezade that runs the PE-sieve engine across many processes, or the whole system, instead of a single PID. _{Tool · Full entry}
• restore-symbol - macOS command-line tool that writes a stripped iOS app's Mach-O executable back out with a rebuilt symbol table, so a debugger such as lldb can break on and display Objective-C method names. _{Tool · Also: App · Full entry}
• FakeNet-NG - Mandiant FLARE's dynamic network analysis tool for malware analysts, a successor to the original Fakenet. _{Tool · Also: Protocol · Full entry}
• Joern - Static code analysis platform that parses source code, JVM bytecode and executables into code property graphs held in a graph database and queried with a Scala-based language from an interactive shell or server mode. _{Tool · Also: App · Full entry}
• Speakeasy - Mandiant's Windows malware emulation framework, which runs PE executables, DLLs, kernel drivers and raw x86/amd64 shellcode on the Unicorn CPU emulator inside a modeled Windows runtime instead of a full VM. _{Tool · Full entry}
• LazyIDA - Single-file IDA plugin of convenience actions first written for CTF work. _{Tool · Full entry}
• Tiny Tracer - Intel Pin tool by hasherezade that traces a 32- or 64-bit program while it runs on Windows or Linux, logging API calls (with arguments and return values for watched functions), chosen local and statically linked functions, inline system calls, RDTSC, CPUID and INT instructions, and transitions between sections of the traced module, which helps find the original entry point of a packed module. _{Tool · Full entry}
• Ponce - IDA Pro plugin, described by its repository as the winner of the 2016 IDA plugin contest, that brings the Triton framework's taint analysis and symbolic execution into IDA's debugger for x86 and x64 programs. _{Tool · Full entry}
• DRAKVUF Sandbox - CERT Polska’s automated black-box malware analysis system built on the DRAKVUF engine, which observes a Windows guest from the Xen hypervisor through virtual machine introspection rather than an agent installed in the guest. _{Tool · Full entry}
• HexRaysPyTools - IDAPython plugin for IDA Pro's Hex-Rays decompiler that helps rebuild structures and classes from pseudocode. _{Tool · Full entry}
• CAPE Sandbox (CAPEv2) - Malware sandbox derived from Cuckoo v1 that runs samples in isolated Windows guests and records API-hook behavior, created and modified files, network traffic as PCAP, screenshots and memory dumps. _{Tool · Full entry}
• LuaDec - Lua bytecode decompiler that turns compiled chunks back into Lua source, with a disassembly mode, selection of single nested functions by number and a guesser for local variable declarations that can be overridden by hand. _{Tool · Also: Game · Full entry}
• xpcspy - Frida-powered command-line tool that observes XPC messages exchanged between processes on iOS and macOS in both directions, for understanding how Apple-platform apps and services talk over XPC. _{Tool · Also: App, Protocol · Full entry}
• de4py - Python deobfuscation and analysis toolkit with a PySide6 GUI and a CLI mode, aimed at analysts examining obfuscated or packed Python programs. _{Tool · Also: App · Full entry}
• Dwarf - PyQt5 debugger built on Frida that attaches to or spawns processes on Android and iOS devices, the local machine or a remote Frida server. _{Tool · Also: App · Full entry}
• bddisasm - Bitdefender’s dependency-free C decoder for x86/x64 instructions, reporting explicit and implicit operands with their access modes, CPUID feature flags, flag accesses and valid modes, and printing Intel/MASM-style text. _{Tool · Library · Full entry}
• decompyle3 - Reworking of uncompyle6 by the same author that translates Python 3.7 and 3.8 bytecode, including some PyPy 3.7 and 3.8 bytecode, back into equivalent Python source; older bytecode stays with uncompyle6. _{Tool · Also: App · Full entry}
• DRAKVUF - Tamas K Lengyel's virtualization-based, agentless black-box binary analysis system: running on the Xen hypervisor through LibVMI, it traces execution in Windows and Linux guests, from kernel functions to user-mode code, without installing software inside the analyzed virtual machine. _{Tool · Full entry}
• ViperMonkey - VBA parser and emulation engine, created by Philippe Lagadec and developed since 2017 mainly by Kirk Sayre and other contributors, for analyzing and deobfuscating malicious macros in Microsoft Office files such as Word, Excel, PowerPoint and Publisher documents, as well as VBScript files and HTA files carrying VBScript. _{Tool · Full entry}
• BREAD - Injectable real-mode x86 debugger for legacy BIOS code, boot code and DOS programs on real hardware or in a virtual machine. _{Tool · Also: Firmware · Full entry}
• Mergen - Function-level lifter that symbolically lifts one x86-64 function from a Windows PE binary into LLVM IR, then iterates LLVM and custom passes to a fixpoint so obfuscated or virtualized code reduces to simpler control flow and semantics for analysis. _{Tool · Full entry}
• readpe (formerly pev) - Command-line toolkit, formerly named pev, for analyzing 32- and 64-bit Windows PE files. _{Tool · Full entry}
• malware-jail - Node.js sandbox for semi-automatic analysis of JavaScript malware: it runs a sample in Node's vm module against emulated Windows Script Host and ActiveX objects such as WScript.Shell, MSXML2.XMLHTTP, ADODB.Stream, Scripting.FileSystemObject and WMI, plus a partial browser context with selectable browser profiles. _{Tool · Also: Website · Full entry}
• gxpc - macOS command-line XPC sniffer, inspired by xpcspy, that injects a Frida agent into an attached or newly spawned process and logs the XPC messages it sends and receives, labelled with the libxpc function, connection name, peer PID and process name. _{Tool · Also: App, Protocol · Full entry}
• Manticore - Trail of Bits' now-archived symbolic execution tool for Linux ELF binaries on x86, x86-64, AArch64 and ARMv7, Ethereum smart contracts as EVM bytecode, and WebAssembly modules. _{Tool · Library · Full entry}
• Ghidra Ninja ghidra_scripts - Thomas Roth's (Ghidra Ninja) collection of Ghidra Python scripts, which appear under a Ghidra Ninja category in the Script Manager. _{Tool · Full entry}
• FindCrypt - Ghidra Edition - Ghidra script that ports Ilfak Guilfanov's FindCrypt plugin for IDA, searching a program's memory or the current selection for constants of cryptographic and compression algorithms. _{Tool · Full entry}
• Binary Refinery - Large collection of composable Python command-line units for transforming binary data: encodings, compression, encryption, archive and executable-format extraction, carving and pattern search. _{Tool · Full entry}
• AngryGhidra - Ghidra extension that runs angr symbolic execution from a CodeBrowser panel. _{Tool · Full entry}
• fpicker - Frida-based fuzzing suite for closed-source programs, listed here for its in-process instrumentation and coverage layer. _{Tool · Also: App · Full entry}
• RetroWrite - HexHive's static binary rewriter for x64 and aarch64 Linux ELF binaries, which turns a binary into symbolized, reassemblable assembly so instrumentation can be inserted without source code and without heuristics. _{Tool · Full entry}
• Interruptor - Frida library, taken from the Dexcalibur project, that uses Frida’s Stalker to trace a process’s system calls and print strace-like lines with the calling thread, module and offset, decoded flag values and file paths resolved from descriptors. _{Tool · Also: App · Full entry}
• dyld_cache_extract - macOS application and command-line tool that reads a dyld_shared_cache file from macOS or iOS, shows its header, mappings and image list, and copies one library or every library out to a directory. _{Tool · Also: App · Full entry}
• FLARE IDA Pro utilities - Archived collection of IDAPython plugins and scripts from Mandiant's FLARE team for malware and native-code analysis in IDA Pro. _{Tool · Full entry}
• Binlex - Binary trait-lexer framework that extracts instructions, basic blocks and functions from executables and emits searchable JSON traits for similarity, hunting and signature work. _{Tool · Library · Full entry}
• Driver Buddy Reloaded - IDA Pro Python plugin for triaging Windows kernel drivers, building on NCC Group's original DriverBuddy. _{Tool · Full entry}
• FA (Firmware Analysis) - Python framework, mainly used as an IDA plugin, that turns the manual steps of locating symbols, such as finding a string, following its cross-reference and taking the function start, into reusable signatures. _{Tool · Also: Firmware · Full entry}
• pyinstxtractor-ng (PyInstaller Extractor Next Generation) - Fork of PyInstaller Extractor (pyinstxtractor) by the same author that extracts the bundled CArchive files and PYZ modules from Linux ELF and Windows PE executables built with PyInstaller, writing .pyc files with repaired headers for a separate bytecode decompiler. _{Tool · Also: App · Full entry}
• CoBRA (Coefficient-Based Reconstruction of Arithmetic) - Trail of Bits' C++23 simplifier for Mixed Boolean-Arithmetic (MBA) expressions, an obfuscation technique that rewrites simple computations as interleaved arithmetic, bitwise and shift operations. _{Tool · Library · Full entry}
• ollvm-unflattener - Python command-line deobfuscator for the control-flow flattening applied by Obfuscator-LLVM (OLLVM). _{Tool · Full entry}
• GolangAnalyzerExtension - Ghidra extension whose Golang Analyzer reads the runtime header and module data in Go binaries built with go1.6 through go1.27 to identify the Go version, rename functions, correct their arguments, comment source files and line numbers, add Go types to the Data Type Manager and label Go strings. _{Tool · Full entry}
• IDA iOS Helper - IDA Pro plugin that cleans up Hex-Rays pseudocode and adds navigation helpers for iOS user-mode binaries and the kernelcache, enabling its components according to the loaded file. _{Tool · Also: App · Full entry}
• MAMBO - Dynamic binary modification framework from the University of Manchester that runs unmodified Linux user-space programs on 32-bit Arm (A32/T32), AArch64 and RV64GC RISC-V, translating their code into a code cache as it executes. _{Tool · Full entry}
• Class Informer - IDA Pro plugin that scans Microsoft Visual C++ binaries for virtual function tables (vftables) through their C++ run-time type information (RTTI), names, labels and comments the vftables it finds, defines the RTTI data structures and identifies single, multiple and virtual inheritance in each class hierarchy. _{Tool · Full entry}
• Kam1n0 - Server platform from McGill University's Data Mining and Security Lab that indexes collections of disassembled binaries into shared repositories and searches them for cloned assembly functions. _{Tool · Full entry}
• iblessing - Toolkit for analyzing iOS apps and arm64 Mach-O binaries, built on Capstone, Unicorn and Keystone. _{Tool · Also: App · Full entry}
• SiMBA - Research tool from Denuvo that simplifies linear mixed Boolean-arithmetic (MBA) expressions, which combine bitwise and integer operations and are used in code obfuscation. _{Tool · Full entry}
• GTIRB - GrammaTech's intermediate representation for passing disassembly, analysis and rewriting results between binary tools, modeled on the role LLVM-IR plays for compilers. _{Tool · Library · Full entry}
• Quokka - Quarkslab’s binary exporter, inspired by BinExport, saves a disassembler’s analysis to a protobuf .quokka file so functions, basic blocks, data, cross-references, segments and optionally decompiled code can be used later without the disassembler. _{Tool · Full entry}
• knife - Static reverse-engineering toolkit in Rust, installed as the knife command, that parses PE, ELF, Mach-O and WebAssembly files without running them. _{Tool · Full entry}

Firmware and Hardware

↑ Contents

Case studies

• ThinkPad IMX471: recovering camera tuning for Linux - Recovers selected camera-tuning structures from an Intel Windows driver package and uses them to repair Linux image capture on one ThinkPad model. _{Case study · Independent reconstruction · Full entry}
• MXQ PRO RK3229: an Android firmware investigation and Linux repurposing - An owner documents identifying an RK3229 TV box, investigating its stock Android ROM and repurposing it with a userspace gamepad driver and Armbian. _{Case study · Mixed workflow · Full entry}
• iCSee LocalMod: a stock-firmware camera control extension - An owner-authorized XM530V200 camera case uses REA/Ghidra to investigate native Sofia command handlers, then adds local control and Home Assistant integration while preserving stock drivers and recording. _{Case study · Mixed workflow · Also: Binary, Protocol · Full entry}
• flipper-telink: replacement firmware for Tuya Zigbee remotes - A Flipper Zero app that bit-bangs Telink’s SWire debug interface to dump and reflash TLSR825x Zigbee devices, with static-analysis notes on the dumps and freshly written firmware for two of them. _{Case study · Independent reconstruction · Full entry}
• Supermodel: initial Real3D Pro-1000 image-generator emulation - Adds emulation of Real3D’s Pro-1000, the SCSI-attached image generator from which Sega’s Model 3 graphics hardware derives, to the Supermodel arcade emulator. _{Case study · Independent reconstruction · Full entry}
• OpenDMCUFirm: a reimplemented Wii U DMCU display firmware - Reimplements in C the firmware of the Wii U’s DMCU, the M68HC11-compatible display microcontroller in its AMD graphics controller, which in Wii mode reads the Video Interface state and configures display output, deinterlacing, scaling and overscan. _{Case study · Independent reconstruction · Full entry}
• reflecticon-224: running Lexicon 224 reverb firmware on emulated hardware - Emulates the Lexicon 224, 224X and 224XL digital reverbs so that their own firmware runs in a browser page or a JUCE plugin. _{Case study · Independent reconstruction · Full entry}
• TeddyCloud: a self-hosted replacement for the Toniebox cloud - Reimplements the Boxine cloud services a Toniebox talks to as a self-hosted C server, so the box can fetch audio, settings and over-the-air content locally while the owner controls what reaches the manufacturer. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
• Valetudo: local replacement for robot-vacuum vendor clouds - Replaces the vendor cloud of supported robot vacuums with a local service that runs on the rooted robot beside the vendor firmware and emulates the cloud endpoints that firmware expects, including a miio dummycloud and a counterpart for Midea's MSmart protocol. _{Case study · Independent reconstruction · Also: Protocol · Full entry}

Tools, projects and integrations

• Binwalk - Identifies embedded formats and optionally extracts their contents, with entropy analysis for firmware triage. _{Tool · Full entry}
• unblob - Recursively extracts archives and filesystems from binary blobs while reporting chunk boundaries and unknown regions. _{Tool · Full entry}
• Ghidra Firmware Utilities - Ghidra loaders and helpers for PCI option ROMs, UEFI firmware volumes, Intel flash descriptors and coreboot images. _{Tool · Full entry}
• EMBA - Extract firmware, combine static checks with emulation-based analysis, inventory software components, and generate web reports and SBOMs for further investigation. _{Tool · Full entry}
• Firmware Analysis and Comparison Tool (FACT) - Unpack and analyze firmware through an extensible platform whose web interface and HTTP API make component contents and analysis results searchable and comparable across samples. _{Tool · Full entry}
• OFRAK - Recursively identify, unpack, analyze, modify, and repack firmware and binary formats using a resource-tree GUI and Python API, with optional disassembler backends. _{Tool · Also: Binary · Full entry}
• FirmAE - Emulate router and IP-camera firmware to inspect network services and runtime behavior, with automated emulation checks and separate analysis, run, and debugging modes. _{Tool · Full entry}
• PulseView - Examine captured logic and analog waveforms with sigrok's graphical frontend. _{Tool · Also: Protocol · Full entry}
• UEFITool - Parse UEFI firmware images into an inspectable tree and check their structure. _{Tool · Full entry}
• Glasgow Interface Explorer - Use FPGA-based open hardware and Python applets to read and write SPI flash, I2C EEPROM and parallel memory chips, determine JTAG pinouts, debug supported processors and analyze UART, SPI and QSPI transactions on physical devices. _{Tool · Also: Protocol · Full entry}
• Penguin - Rehost embedded Linux firmware from an extracted root filesystem using a generated, editable configuration of emulation transformations, then refine it through a guest root shell, forwarded network services and recorded dynamic-analysis output. _{Tool · Full entry}
• ipsw - Command-line toolkit for Apple firmware research and reverse engineering. _{Tool · Also: App, Binary · Full entry}
• avatar² - Python framework from EURECOM's S3 group that orchestrates emulators, debuggers and physical devices for dynamic analysis of embedded firmware. _{Tool · Full entry}
• efiXplorer - IDA Pro plugin and loader that automate static analysis of UEFI firmware. _{Tool · Full entry}
• vmlinux-to-elf - Rebuild an analyzable ELF with function and variable symbols from a Linux kernel image, whether a raw or compressed vmlinux, vmlinuz, zImage or bzImage blob, certain Android boot.img files or a stripped kernel ELF, by locating and decoding the embedded kallsyms symbol table. _{Tool · Also: Binary · Full entry}
• Sony-PMCA-RE - USB tool built from reverse engineering Sony digital cameras. _{Tool · Also: Protocol · Full entry}
• cpu_rec - Statistically recognize the CPU instruction set in an arbitrary binary file, such as an unknown firmware image, by comparing Markov-chain byte statistics with a default corpus covering dozens of architectures, from 6502 and 8051 to ARM, MIPS, PowerPC, RISC-V, x86-64 and WebAssembly. _{Tool · Also: Binary · Full entry}
• ME Analyzer - Parse Intel Management Engine (CS)ME, TXE and SPS firmware, Graphics System Controller firmware and their independent PMC, PCHC, PHY and option-ROM images to report family, version, release, SKU, platform, size and health status. _{Tool · Full entry}
• CHIPSEC - Platform security assessment framework, with Intel Corporation copyright notices, for analyzing PC hardware configuration, BIOS/UEFI system firmware and platform components from Windows, Linux or the UEFI shell. _{Tool · Full entry}
• binbloom - Quarkslab command-line tool that infers basic properties of a headerless raw firmware image from simple statistics on its content, which is why the README says it works with any architecture. _{Tool · Full entry}
• m1n1 - Asahi Linux's bootloader and hardware-research environment for Apple Silicon Macs. _{Tool · Full entry}
• SVD-Loader for Ghidra - Ghidra script from leveldown security that reads a CMSIS-SVD file, the XML format describing a microcontroller's memory-mapped peripherals and their registers, and applies it to firmware already loaded in Ghidra. _{Tool · Full entry}
• UEFI Firmware Parser - Python library and uefi-firmware-parser command for identifying, parsing and extracting PC firmware images: UEFI firmware volumes, capsules, firmware file systems, files and sections, Intel PCH flash descriptors, Intel ME modules and Dell PFS update packages. _{Tool · Full entry}
• ESP32 Bit Pirate - Open-source firmware that turns ESP32-S3 boards into a Bus Pirate-inspired multi-protocol hardware tool, operated from a USB serial terminal, a Wi-Fi web CLI or the M5 Cardputer's own keyboard and screen. _{Tool · Also: Protocol · Full entry}
• Firmware Analysis Toolkit (FAT) - Attify's firmware security toolkit, rewritten for version 2 as a Rust command-line tool built around per-image projects. _{Tool · Also: Binary · Full entry}
• FujiHack - Research codebase for reverse engineering Fujifilm cameras so that custom code can run on them under a patched firmware. _{Tool · Full entry}
• efiSeek - Ghidra analyzer extension from Digital Security for individual UEFI modules, enabled by default during auto-analysis of x86 and x64 PE images with an EFI subsystem. _{Tool · Full entry}
• FwAnalyzer - Rule-based checker for filesystem images taken from firmware: it reads ext2/3/4, FAT/VFAT, SquashFS and UBIFS images, cpio archives or a directory, and writes a JSON report of every file that breaks the rules in a TOML configuration. _{Tool · Full entry}
• FwHunt Community Scanner (fwhunt-scan) - Binarly's Python scanner that checks UEFI firmware modules against FwHunt rules, the YAML detection format for known UEFI firmware vulnerabilities whose rules are kept in the separate fwhunt repository. _{Tool · Full entry}
• sniffROM - Python tool that reconstructs serial flash contents from passive bus captures: it parses SPI or I²C analyzer exports from Saleae Logic, recorded while a device reads and writes its own flash chip, and writes the observed data into a binary image at the original memory addresses. _{Tool · Also: Protocol · Full entry}
• Pawn - Linux command-line tool from Google that reads the BIOS/UEFI firmware image out of the SPI flash of Intel-based workstations and laptops. _{Tool · Full entry}
• EMBArk - Web-based enterprise interface for the EMBA firmware security scanner, which it installs and runs as its scanning backend. _{Tool · Full entry}
• IDAPython Embedded Toolkit - Maddie Stone's IDAPython scripts for triaging and annotating embedded-device firmware images in IDA Pro, presented at RECON Montreal and DerbyCon in 2017. _{Tool · Also: App · Full entry}
• fiano - LinuxBoot's Go tools and libraries for parsing and modifying UEFI firmware images. _{Tool · Full entry}
• Pyrrha - Quarkslab's firmware cartography tool, which indexes an extracted firmware filesystem into a database browsed with NumbatUI, Quarkslab's fork of the Sourcetrail code explorer. _{Tool · Also: Binary · Full entry}
• RETracker - Python reverse-engineering framework for the Polyend Tracker music device that patches the vendor's stock firmware, replacing an unused USB RAWHID handler with its own command handler. _{Tool · Full entry}
• Titan M tools (Quarkslab) - Tools Quarkslab published from its research on Google's Titan M security chip in Pixel phones: a Ghidra loader for Titan M (Citadel) firmware files, nosclient for tracing and sending the chip's protobuf-based commands from Android with a black-box fuzzer built on libprotobuf-mutator, a parser for sigrok SPI captures, and scripts that convert firmware images to the rec files of the chip's SPI rescue feature. _{Tool · Also: Protocol · Full entry}
• uefi_retool - Python command-line tool and IDA Pro plugin for UEFI firmware reverse engineering. _{Tool · Full entry}

Protocol

↑ Contents

Case studies

• open-appleremote: Siri Remote protocol reconstruction - Reconstructs first-generation Siri Remote Bluetooth reports for Linux, decoding buttons, touch and tvOS-style gestures. _{Case study · Independent reconstruction · Full entry}
• GAMEKB-K17: reconstructing a macropad configuration protocol - Implements the vendor HID configuration protocol for the GAMEKB-K17/HCY-K017 macropad. _{Case study · Independent reconstruction · Full entry}
• cooler-lcd: a Thermalright display protocol implementation - Implements a USB picture-transfer driver for Thermalright Vision cooler displays, with a Rust dashboard replacing the vendor display application. _{Case study · Independent reconstruction · Full entry}
• NJFE: a Soulear camera protocol bridge for desktop inspection - Reuses otoscope's reverse-engineered i4season/Soulear protocol in an ESP32-C3 bridge and Python desktop viewer. _{Case study · Independent reconstruction · Full entry}
• hw-harness: scanner USB protocol investigation - Documents an author-reported scanner investigation comparing vendor-driver USB control transfers with Linux-driver traces to infer initialization, timing and resolution parameters. _{Case study · Independent reconstruction · Full entry}
• Roborock Local Server: a self-hosted stand-in for Roborock’s vacuum cloud - Runs a local HTTPS and MQTT stack in place of Roborock’s cloud, so supported vacuums keep live maps and controls on an isolated network without rooting or hardware changes. _{Case study · Independent reconstruction · Full entry}
• pypush: a Python client for Apple’s push protocol - Reimplements the client side of Apple’s private Apple Push Notification service (APNs) protocol in platform-independent Python: it activates as an Apple device, connects to the APNs courier, mints app-scoped tokens and receives push notifications. _{Case study · Independent reconstruction · Full entry}
• PixMob IR reverse engineering: controlling event wristbands at home - Recovers enough of the infrared protocol used by PixMob event wristbands to light them at home, starting from Flipper Zero recordings made at concerts and games and replaying them to bracelets. _{Case study · Independent reconstruction · Full entry}
• OpenDrop: an open reimplementation of Apple AirDrop - Python command-line reimplementation of Apple's AirDrop protocol from SEEMOO Lab's reverse-engineering research. _{Case study · Independent reconstruction · Full entry}
• bluefluff: reverse engineering Furby Connect's Bluetooth LE protocol - Documents the Bluetooth Low Energy interface of Hasbro's Furby Connect toy, worked out, according to its notes, from the companion app's native library, sniffed BLE traffic and trial and error. _{Case study · Independent reconstruction · Full entry}
• pyatv: a reverse-engineered client for Apple TV and AirPlay protocols - Asyncio Python library and command-line tools that act as an independent client for Apple TV and AirPlay devices by reimplementing the DMAP/DACP, Media Remote Protocol, Companion Link, AirPlay and RAOP protocols, which its protocol documentation describes as reverse engineered. _{Case study · Independent reconstruction · Full entry}
• BudsPro-Headtracking: streaming Galaxy Buds Pro head tracking over Samsung’s serial protocol - Reimplements the Samsung Galaxy Buds Pro’s proprietary spatial-audio messages in a small Python script so that a PC can stream the earbuds’ head-tracking data in real time. _{Case study · Independent reconstruction · Full entry}
• Even G2 protocol: reverse-engineering Even Realities G2 smart-glasses BLE traffic - Documents the Bluetooth Low Energy protocol between the Even app and Even Realities G2 smart glasses, worked out from captured traffic: GATT characteristic UUIDs, an 8-byte transport header with sequence, multi-packet and two-byte service-ID fields, a CRC-16/CCITT over the payload, and protobuf payloads with draft .proto definitions. _{Case study · Independent reconstruction · Full entry}
• fuji-cam-wifi-tool: reconstructing Fujifilm X-series Wi-Fi remote control - Reimplements the Wi-Fi remote-control protocol of Fujifilm X-series cameras as a C++ library and an interactive command-line client that joins the camera's access point. _{Case study · Independent reconstruction · Full entry}
• Gymnasticon: bridging proprietary exercise-bike data to standard cycling sensors - Node.js bridge that reads power and cadence from exercise bikes whose own apps or services are gone or closed, and re-broadcasts them as standard Bluetooth LE Cycling Power and Cycling Speed and Cadence sensors and as an ANT+ bike power profile, so that Zwift, TrainerRoad, bike computers and watches can use the bike. _{Case study · Independent reconstruction · Full entry}
• garmin-ble: a Python client for Garmin's GFDI watch protocol - Python library that talks to Garmin watches over their proprietary GFDI V2 Bluetooth LE protocol, with no Garmin Connect, phone or cloud service. _{Case study · Independent reconstruction · Full entry}
• bosectl: reconstructing Bose’s BMAP headphone protocol - Controls Bose headphones from Linux and macOS without the Bose app, account or cloud, through Python, Rust and C++ libraries and command-line tools that implement Bose’s BMAP protocol over Bluetooth RFCOMM. _{Case study · Independent reconstruction · Full entry}
• lib-osmo-ble: DJI Osmo Pocket 3 Bluetooth LE protocol library - Reconstructs the DUML-over-BLE protocol that DJI's Mimo app uses with the Osmo Pocket 3 camera as a Node.js library and CLI for scanning, pairing, gimbal commands and roughly 20 Hz position telemetry without the vendor app. _{Case study · Independent reconstruction · Full entry}

Tools, projects and integrations

• Wireshark - Inspect captured application and device traffic as decoded protocol fields, with filtering and shared GUI/TShark dissection. _{Tool · Also: App, Firmware · Full entry}
• Netzob - Model communication protocols and infer message layouts from traces, with configured active learning for protocol state machines. _{Tool · Full entry}
• Scapy - Script packet dissection, construction, request/reply matching and capture-file analysis in Python. _{Tool · Full entry}
• Universal Radio Hacker (URH) - Demodulate and decode signals captured with software-defined radios, with automatic modulation-parameter detection and customizable decodings. _{Tool · Full entry}
• SavvyCAN - Capture or load CAN bus traffic and investigate frames with sniffer, graphing, file-comparison and ISO-TP/UDS decoding views; loaded or analyst-edited DBC files map raw bytes to named signals. _{Tool · Full entry}
• AALpy - General-purpose Python automata-learning library that infers deterministic, non-deterministic, stochastic and pushdown models of black-box systems from active queries or passive traces. _{Tool · Full entry}
• rtl_433 - Receives and decodes transmissions from ISM-band devices such as weather sensors, remote controls, doorbells and alarm sensors, using RTL-SDR or SoapySDR receivers or recorded I/Q files, and emits decoded fields as JSON, CSV, MQTT and other outputs. _{Tool · Full entry}
• Blackbox Protobuf - NCC Group's tools for decoding and re-encoding Protocol Buffers messages without the matching .proto definition. _{Tool · Also: App · Full entry}
• furiousMAC Continuity - Reverse-engineering notes and a Wireshark dissector for Apple's proprietary Continuity Bluetooth LE advertisements, continuing the authors' PETS 2019 privacy study. _{Tool · Full entry}
• opendbc - comma.ai's repository of DBC files describing the CAN messages and signals of many car makes, with a Python library that parses and builds CAN messages from those definitions; its porting guide has contributors reverse engineer new messages from recorded drives in the cabana tool. _{Tool · Full entry}
• FISSURE - GNU Radio-based RF framework that carries a signal from survey and detection through IQ capture, inspection, conditioning, feature extraction and classification into a protocol discovery workflow. _{Tool · Full entry}
• friTap - Frida-based tool that hooks TLS libraries such as OpenSSL, BoringSSL, NSS and GnuTLS inside a running process and writes NSS key logs and decrypted payloads as PCAP, so analysts can inspect an application's encrypted traffic in Wireshark. _{Tool · Also: App · Full entry}
• pbtk - Recover Protobuf message definitions from compiled programs as readable .proto files. _{Tool · Also: App · Full entry}
• SteamKit - .NET library that implements the client side of Valve’s Steam network protocol: connection-manager sessions, authentication, friends, unified service and Game Coordinator messages, Web API calls and CDN depot downloads. _{Tool · Also: Game · Full entry}
• protobuf-inspector - Parses Protocol Buffers blobs (proto2 or proto3) without their .proto definition and prints a colored view of the fields in wire order, trying each length-delimited chunk as a nested message, then a packed array, a string and finally a hexdump. _{Tool · Full entry}
• libimobiledevice - C library and command-line tools that speak iOS devices' native service protocols without Apple's proprietary libraries or a jailbreak. _{Tool · Also: App · Full entry}
• Sniffle - NCC Group's sniffer for Bluetooth 5 and 4.x Low Energy, made of firmware for TI CC1352/CC26x2 radio boards and Python host tools. _{Tool · Full entry}
• Packetry - Great Scott Gadgets' USB 2.0 protocol analysis application for live capture with the Cynthion analyzer or for exploring previously captured traffic, working from physical-layer packet data at High, Full and Low Speed. _{Tool · Full entry}
• Caring Caribou - Python automotive security exploration tool, begun in the HEAVENS research project, that the README describes as a zero-knowledge tool to drop onto a CAN network and collect information about the services present. _{Tool · Full entry}
• protodump - Go command-line utility that recovers Protocol Buffers schemas from a compiled binary or any other file: it scans the raw bytes for serialized FileDescriptorProto records embedded by generated code, locating them through their .proto file names, and writes each one back out as a .proto source file under its original descriptor path. _{Tool · Also: Binary · Full entry}
• CAN Commander - A Flipper Zero app and earlier Arduino sketches for reverse engineering CAN bus traffic, chiefly in vehicles. _{Tool · Full entry}
• Automated CAN Payload Reverse Engineering - Research Python and R scripts that automate reverse engineering of Controller Area Network (CAN) payloads recorded from passenger vehicles, implementing the pipeline from Brent Stone's AFIT dissertation. _{Tool · Full entry}
• Deluder - Frida-based interceptor for the traffic of proxy-unaware applications. _{Tool · Also: App · Full entry}
• PiCCANTE - Raspberry Pi Pico firmware and hardware designs for a low-cost CAN bus interface aimed at exploring and reverse engineering vehicle networks. _{Tool · Full entry}
• VanBus - Arduino library for ESP8266/ESP8285 and ESP32 boards that receives and transmits packets on the VAN (Vehicle Area Network) comfort bus that PSA fitted to Peugeot and Citroën models until about 2009. _{Tool · Full entry}
• Apple Continuity Reverse Engineering Toolkit - Three macOS helpers from SEEMOO Lab that the Open Wireless Link project used to study Apple wireless services such as AirDrop, Wi-Fi Password Sharing, Handoff and Offline Finding from the host side. _{Tool · Full entry}

Agents and MCP

↑ Contents

Also in target sections: Website: Chrome DevTools MCP, Playwright MCP, Burp Suite MCP Server, Spectral · Game: RenderDoc MCP, Cheat Engine MCP Bridge · App: JADX-AI-MCP, apktool-mcp-server, frida-mcp (yfe404), Super Trouper

• REA — Reverse Engineer Anything - The upstream CLI and MCP server for evidence-based investigations of shipped software and runtime behavior. _{Project · Official REA · Targets: Website, Game, App, Binary, Firmware, Protocol · Full entry}
• Official reverse-engineer-anything skill - Target routing, connection recovery and evidence practices for agents using REA. _{Integration · Official REA · Targets: Website, Game, App, Binary, Firmware, Protocol · Full entry}
• dsh-mcp-rea - A community MCP bridge presents a smaller selected tool surface and forwards explicit commands to the REA CLI. _{Integration · Community REA · Targets: Website, Game, App, Binary, Firmware · Full entry}
• rea-jev - A Claude Code plugin adds Jev-based routing and evidence checks around a pinned REA MCP integration. _{Integration · Community REA · Targets: Website, App · Full entry}
• rea-casebook - A Claude Code mod collects received REA Evidence, tracks unknowns and records findings that cite delivered evidence IDs. _{Integration · Community REA · Targets: Binary · Full entry}
• Eleven - An agent-first desktop reverse-engineering app that opens Mach-O, ELF and PE binaries, Android packages and GPU kernels, and lets any Agent Client Protocol agent read code, rename functions, add notes and propose patches in a shared window. _{Integration · Community REA · Targets: App, Binary · Full entry}
• REA plugin for Hermes Agent - Nous Research’s Hermes Agent plugin package for REA. _{Integration · Community REA · Targets: Website, App, Binary, Firmware · Full entry}
• crashlens - A crash-triage tool that turns Linux core dumps, runtime panics, exception traces and sanitizer reports into Markdown bug reports naming the crash type, the first frame in the user’s code and a stable signature. _{Integration · Community REA · Targets: Binary · Full entry}
• REA Workspace Template - A clone-first Chinese workspace template for analyzing one target per workspace with REA from Claude Code or Codex. _{Integration · Community REA · Targets: Website, App, Binary · Full entry}
• REA Reconstruction Companion - A third-party Agent Skill that works alongside REA’s own skill to turn reverse-engineering evidence into scoped requirements, design, staged implementation and validation, from one feature or format to a whole app. _{Integration · Community REA · Targets: App, Binary · Full entry}
• App X-Ray - Builds evidence-linked HTML/JSON reports, summary cards and diffs from REA analysis of app packages, native build metadata and model files. _{Integration · Community REA · Targets: App, Binary · Full entry}
• Hex-Rays IDA MCP - Official Hex-Rays MCP server for agent access to IDA databases, with headless operation and optional GUI integration. _{Integration · Independent MCP · Targets: Binary · Full entry}
• GhidraMCP - Ghidra extension and MCP bridge exposing decompilation, symbol navigation and renaming to agents, with GUI and headless modes. _{Integration · Independent MCP · Targets: Binary · Full entry}
• Binary Ninja MCP (official) - Binary Ninja's own MCP interface exposes functions, symbols, disassembly, intermediate languages and decompiled text to agents. _{Integration · Independent MCP · Targets: Binary · Full entry}
• Binary Ninja MCP (fosdickio) - Community Binary Ninja plugin and bridge for MCP clients, including workflows that switch among multiple open binaries. _{Integration · Independent MCP · Targets: Binary · Full entry}
• IDA Pro MCP (mrexodia) - Community IDA integration useful for existing setups and migration context; its maintainer now recommends the official Hex-Rays MCP server. _{Integration · Independent MCP · Targets: Binary · Full entry}
• Radare2 MCP Server - Native radare2 MCP server offering binary-analysis tools, reusable sessions and configurable read-only access. _{Integration · Independent MCP · Targets: Binary · Full entry}
• r2ai - AI plugins inside radare2 for function explanations, naming suggestions and model-assisted decompilation using local or remote models. _{Integration · Independent agent · Targets: Binary · Full entry}
• DAILA - Decompiler-independent AI assistant for function summaries and naming across IDA, Ghidra, Binary Ninja and angr-management. _{Integration · Independent agent · Targets: Binary · Full entry}
• RevEng.AI Ghidra Plugin - Connects Ghidra to RevEng.AI for function similarity, recovered names, AI explanations and agent-assisted annotation. _{Integration · Independent agent · Targets: Binary · Full entry}
• LLDB MCP - LLDB's official MCP interface gives agents debugger sessions and commands for breakpoints, memory inspection and stepping. _{Integration · Independent MCP · Targets: App, Binary · Full entry}
• Claude Reverse Engineering Skill - Community agent skill for triage, headless exports and evidence-based RE reports; explicitly documents workflows with REA and other MCP servers. _{Integration · Independent agent · Targets: App, Binary · Full entry}
• SpecterOps Reverse Engineering Skills - Focused Binary Ninja and Ghidra analysis skills that describe MCP tool use, analysis recipes and annotation practices. _{Integration · Independent agent · Targets: Binary · Full entry}
• pyghidra-mcp - PyGhidra-based MCP server that analyzes every binary in a Ghidra project and exposes decompilation, cross-references, call graphs, symbol and string search, indexed semantic code search, and renaming, typing and comment edits. _{Integration · Independent MCP · Targets: Binary · Full entry}
• LeanREA - An independent agent skill that routes application and binary investigations through ordinary command-line tools. _{Integration · Independent agent · Targets: App, Binary · Full entry}
• Universal Modder - Packages agent skills, three role briefs, a Python CLI and preconfigured fal MCP settings for modding PC games the user owns. _{Integration · Independent agent · Targets: Game · Full entry}
• ReVa (Reverse Engineering Assistant) - Ghidra extension that runs an MCP server inside Ghidra, giving agents decompilation with namespace and cross-reference context, symbol, string, data-type, structure and call-graph tools, program diffing, renaming and PyGhidra scripting. _{Integration · Independent MCP · Targets: Binary · Full entry}
• x64dbg-MCP Server - Native x64dbg plugin, written in Zig for both x32dbg and x64dbg, that serves an MCP endpoint over streamable HTTP and SSE from inside the debugger. _{Integration · Independent MCP · Targets: Binary · Full entry}
• mcp-windbg - Independent, community-built MCP server that runs Microsoft's cdb.exe and kd.exe headless, so agents can open and triage user-mode and kernel crash dumps, attach to cdb remote debug servers and KD kernel targets, and run arbitrary debugger commands in separately addressed sessions. _{Integration · Independent MCP · Targets: Binary · Full entry}
• Wireshark MCP - MCP server that wraps tshark, and optionally other Wireshark command-line tools, so agents can query saved captures through Wireshark's dissectors: packet lists and details, stream following, arbitrary field extraction, protocol hierarchies and conversations, decode-as rules for non-standard ports, protocol preferences, TLS and WPA decryption with user-supplied keys, and one tool that applies preset fields and filters for 25 protocols such as Modbus, S7comm, MQTT, Zigbee and BLE. _{Integration · Independent MCP · Targets: Protocol · Full entry}
• BINNY - An open-source terminal agent harness from OpenBin that runs a user-chosen hosted or local model over binary-analysis data. _{Integration · Independent agent · Targets: App, Binary, Firmware · Full entry}
• decomp.wtf - A discontinued local app and MCP server that hands AI coding agents one function of a user-owned console game at a time, compiles each C attempt with the game’s period compiler and accepts it only when the linked result matches the original bytes. _{Integration · Independent agent · Targets: Game · Full entry}
• Claude Intercept - A local man-in-the-middle proxy and dashboard that captures HTTP/S traffic from the user’s own computer and devices, stores it in SQLite and hands it to Claude Code through an /intercept skill and CLI. _{Integration · Independent agent · Targets: App, Protocol · Full entry}
• Ghidra MCP Server (bethington) - A Ghidra GUI plugin, standalone headless server and Python MCP bridge exposing a 209-tool catalog: decompilation, cross-references, renaming, typing, structures, comments and batch edits, plus P-code emulation, live debugging through Ghidra’s TraceRmi framework, shared Ghidra Server repository and version-control operations, and hash-based transfer of function documentation between binary versions. _{Integration · Independent MCP · Targets: Binary · Full entry}
• DecompilerServer - Stdio MCP server built on the ICSharpCode.Decompiler engine that lets agents load managed .NET assemblies, including a Unity game's Assembly-CSharp.dll located from its game directory, then search symbols, string literals and attributes, read decompiled C# or IL, and trace callers, callees, usages and inheritance. _{Integration · Independent MCP · Targets: Game, App · Full entry}
• Gepetto - IDA Pro plugin that sends Hex-Rays pseudocode to a hosted or local language model the user selects, to explain a function, comment it or propose new variable and function names, which the user picks from before they are applied. _{Integration · Independent agent · Targets: Binary · Full entry}
• GhidrAssistMCP - Ghidra extension that runs an MCP server inside Ghidra over streamable HTTP and legacy SSE, with 100 explicitly named tools (93 enabled by default) for pseudocode, disassembly, P-code, control-flow and call graphs, cross-references, strings, imports and exports, plus renaming, retyping, comments and structure inference. _{Integration · Independent MCP · Targets: Binary · Full entry}
• Android Reverse Engineering Skill - Claude Code plugin and agent skill that drives jadx and Fernflower/Vineflower to decompile Android APK, XAPK, JAR and AAR files and document their HTTP APIs. _{Integration · Independent agent · Targets: App · Full entry}
• Reverify - Python CLI and stdio MCP server that checks a model’s structured claims about a binary, such as bytes or typed values at an offset, strings, imports and exports, instruction mnemonics, emulation results and tested or Z3-proved equivalence, and returns VERIFIED, REFUTED or INCONCLUSIVE with the evidence the tools observed. _{Integration · Independent agent · Targets: Binary · Full entry}
• DecompAI - Gradio chat application whose LangGraph ReAct agent analyses an uploaded x86 Linux ELF binary: it lists and disassembles functions, decompiles them with Ghidra, drives radare2 and gdb, and runs shell commands and Python scripts in a privileged Kali Linux runner container. _{Integration · Independent agent · Targets: Binary · Full entry}
• Kong - Command-line pipeline that runs Ghidra in-process through PyGhidra and asks Claude, OpenAI or OpenAI-compatible models to name the functions, types and parameters of a stripped binary, working bottom-up through the call graph so callers see already-named callees. _{Integration · Independent agent · Targets: Binary · Full entry}
• Co-op Anything - Agent playbook, skill set and stdio MCP server for adding online or split-screen co-op to single-player games the players already have installed. _{Integration · Community REA · Targets: Game · Full entry}
• DeepExtract (DeepExtractIDA) - IDA Pro 9.x plugin and PowerShell batch extractor that turn Windows PE files into material AI coding agents can read: a per-binary SQLite database of PE metadata, signatures, disassembly, Hex-Rays pseudocode, cross-references, strings, stack frames, loops and dangerous API calls, plus optional grouped C++ and assembly files with per-function caller, callee and string headers and JSON indexes. _{Integration · Independent agent · Targets: Binary · Full entry}
• Mizuchi - Plugin pipeline for matching decompilation that loops over functions in an existing decomp project: m2c drafts C, decomp-permuter mutates it, Claude rewrites it through a compile-and-diff tool, and objdiff accepts a result only when the compiled object matches the target assembly. _{Integration · Independent agent · Targets: Game, Binary · Full entry}
• ReAgent - An open-source Python agent, published on PyPI as auto-re-agent, that drafts C/C++ implementations of functions in a compiled program from Ghidra evidence and has a separately configurable checker model review each draft in a bounded fix loop. _{Integration · Independent agent · Targets: Game, Binary · Full entry}
• lisa.py - LLDB extension that adds an MCP bridge to a debugging session, adapted from ida-pro-mcp: the plugin's mcp start command serves 18 debugger functions over local JSON-RPC, and a FastMCP stdio server generated from those functions exposes them to MCP clients such as Claude Desktop. _{Integration · Independent MCP · Targets: Binary · Full entry}
• WireMCP - Node.js MCP server that runs Wireshark's tshark for LLM clients, aimed in its README at threat hunting, network diagnostics and anomaly detection. _{Integration · Independent MCP · Targets: Protocol · Full entry}
• ReverserAI - Binary Ninja plugin that suggests function names from HLIL decompiler output with a language model run locally through llama.cpp; the README says it operates entirely offline once the model is downloaded. _{Integration · Independent agent · Targets: Binary · Full entry}
• WPeGPT - IDA plugin, formerly WPeChatGPT and inspired by Gepetto, that sends the Hex-Rays pseudocode of a function to an OpenAI-compatible model (OpenAI, DeepSeek or another compatible endpoint) and writes the model's analysis back into IDA as comments. _{Integration · Independent agent · Targets: Binary · Full entry}
• IDAssist - IDA Pro plugin by Jason Tang, who also wrote GhidrAssist, that adds a dockable PySide6 panel for LLM-assisted analysis of the open database. _{Integration · Independent agent · Targets: Binary · Full entry}
• GhidraGPT - Ghidra extension that sends one function’s decompiled C to a hosted or local language model the user selects and streams the answer into a GhidraGPT console. _{Integration · Independent agent · Targets: Binary · Full entry}
• GhidrAssist - Ghidra extension by Jason Tang, who also wrote GhidrAssistMCP, that adds a tabbed GhidrAssist window to CodeBrowser for LLM-assisted analysis of the open program. _{Integration · Independent agent · Targets: Binary · Full entry}
• Rikugan - IDA Pro and Binary Ninja plugin that runs its own agent loop inside the disassembler: a model the user chooses streams its answers and calls more than 60 in-process tools for navigation, decompilation, disassembly, cross-references, strings, types, annotations, scripting and host IL or microcode edits. _{Integration · Independent agent · Targets: Binary · Full entry}
• bn - Agent-oriented command-line interface for the Binary Ninja database already open in the GUI, reached through a companion plugin that listens on a local Unix-domain socket. _{Integration · Independent agent · Targets: Binary · Full entry}
• IDA Pro MCP Server (fdrechsler) - An IDA Pro plugin and a TypeScript MCP server by Florian Drechsler: the plugin starts an HTTP server inside IDA on 127.0.0.1:9045, and the stdio MCP server forwards agent requests to it. _{Integration · Independent MCP · Targets: Binary · Full entry}
• Ghidra Headless MCP - Headless-only MCP server that drives Ghidra through PyGhidra and is meant to share a container with the agent rather than attach to a Ghidra GUI. _{Integration · Independent MCP · Targets: Binary · Full entry}
• Binary Ninja Headless MCP - A third-party, headless-only MCP server by Ruben Marks (mrphrazer) that gives agents a large Binary Ninja tool surface the project counts as 181 tools across 36 feature groups, including disassembly, intermediate languages, cross-references, types, search, patching with undo/redo transactions, and arbitrary scripting through binja.eval and binja.call. _{Integration · Independent MCP · Targets: Binary · Full entry}

Related Collections

↑ Contents

• Awesome Reverse Engineering - A task-oriented reverse-engineering resource list by REA's maintainer, useful for broader tools and foundations. _{Collection · REA maintainer · Targets: Website, Game, App, Binary, Firmware, Protocol · Full entry}
• Awesome REA Cases - A bilingual collection of REA and other AI-assisted reverse engineering cases, with source links and explicit distinctions between reported and reproduced outcomes. _{Collection · Community REA · Targets: Website, Game, App, Binary, Firmware, Protocol · Full entry}
• awesome-rea (yibie): verification-focused projects and practice reports - Organizes AI-assisted game decompilation, native ports, static recompilation and tooling around stated acceptance checks, alongside a separate track of practitioner write-ups and discussions. _{Collection · Community REA · Targets: Game, Binary · Full entry}
• Awesome REA/Decompiled Games - Groups game decompilations, source reconstructions, recompilations, native ports and demos by original game, with comparison rows linking related projects. _{Collection · Community REA · Targets: Game · Full entry}
• Reversed with AI - A moderated website directory of AI-assisted reverse-engineering projects across games, firmware, file formats, APIs and protocols, apps and legacy software. _{Collection · Community REA · Targets: Game, App, Binary, Firmware, Protocol · Full entry}
• Awesome Malware Analysis - A long-running single-README list of malware analysis tools and resources, grouped into 17 top-level sections covering open-source threat intelligence, detection and classification, online scanners and sandboxes, document and shellcode analysis, deobfuscation, debugging and reverse engineering, network, memory forensics, Windows artifacts, plus books and other references. _{Collection · Targets: Binary · Full entry}
• Awesome Connected Things Security - A single-README list of security-research references for IoT, embedded, industrial and automotive systems, organized into sections on hardware attacks, wireless protocols (BLE, Zigbee/Z-Wave, LoRa, Matter/Thread, cellular, NFC/RFID, Wi-Fi, USB), firmware security including extraction, static and dynamic analysis and secure boot, network and web protocols, cloud backends, mobile apps, and industrial and automotive topics. _{Collection · Targets: Firmware, Protocol · Full entry}
• Awesome CAN Bus - A single-README list of CAN bus tools, hardware and resources for automotive and embedded work, grouped into sections for reverse-engineering tools, test equipment and simulators, higher-layer protocols (OBD-II, UDS, ISO-TP, J1939, J2534), general and Linux utilities, CAN database formats (DBC, KCD) with converters, and hardware for ARM, Arduino, ESP32, single-board computers and FPGA cores. _{Collection · Targets: Firmware, Protocol · Full entry}
• Awesome CAN ID - A single-README list that gathers links to CAN message identifier and payload decodings in one place, grouped by vehicle make and model under about 30 car brands and brand groups plus BMW, Ducati and KTM motorcycles. _{Collection · Targets: Protocol · Full entry}
• awesome-game-decompilations - A single-README list of about 480 game decompilation, recompilation and disassembly projects, grouped by console from the NES and Game Boy to the Xbox 360, PC and mobile, with a large uncategorised section. _{Collection · Targets: Game · Full entry}
• Awesome Decomp Games - A generated, rated index of public game reconstruction projects: decompilations, disassemblies, static recompilations, source ports, engine remakes and browser ports. _{Collection · Targets: Game · Full entry}
• awesome-unofficial-pc-ports - A single-README guide to unofficial PC ports of console games built from decompilations or recompilations and chosen for easy installation by players. _{Collection · Targets: Game · Full entry}
• awesome-decompilation - A short, link-only reading list on decompiling machine code, last updated in 2023. _{Collection · Targets: Binary · Full entry}
• Remade - The source repository of remade.wiki, a community-curated directory of open-source reimplementations of closed-source software, mostly creative, productivity and engineering applications. _{Collection · Targets: App · Full entry}
• Reverse Engineering resources (wtsxDev) - A single-README awesome list, started in January 2017 and maintained under the KaliTut name, of 139 reverse-engineering links in 16 sections: books, courses, practice targets, hex editors, binary-format tools, disassemblers, binary analysis, bytecode analysis, import reconstruction, dynamic analysis, debugging, Mac decryption, document analysis, scripting, Android and YARA. _{Collection · Targets: App, Binary · Full entry}
• Awesome Android Reverse Engineering - An awesome list of Android reverse-engineering training, tools and resources started in 2023 by James Stevenson, with 92 one-line entries, 16 of them starred as great and up to date. _{Collection · Targets: App · Full entry}
• Awesome Frida - An awesome list of libraries, scripts, tools, talks and articles built on or about Frida, the dynamic instrumentation toolkit, started by David Weinstein in May 2016. _{Collection · Targets: App, Binary · Full entry}
• Awesome Ghidra - An awesome list of Ghidra scripts, plugins, extensions, learning materials and related services, kept by the Allsafe GitHub organization since December 2019. _{Collection · Targets: Binary · Full entry}
• PRE-list - A table-based reading list of 71 research papers on automatic protocol reverse engineering for network protocols, from the Protocol Informatics project (2004) to NetPlier (2021). _{Collection · Targets: Protocol · Full entry}
• awesome-reverse-engineering (alphaSeclab) - Large reverse-engineering link list, auto-exported in 2019 in English and Chinese, with abridged and full README versions. _{Collection · Targets: App, Binary · Full entry}
• awesome-mobile-security - A single-README list of Android and iOS application security resources, about 245 links in all, divided by platform into blogs, papers and how-tos, books, courses, tools, deliberately vulnerable lab apps, talks and miscellany. _{Collection · Targets: App · Full entry}
• Awesome Executable Packing - A single-README list of resources on executable packing, meaning the bundling, compression, encryption, mutation, protection or virtualization of PE, ELF and other executables, including Android apps, and on detecting and unpacking packed files. _{Collection · Targets: App, Binary · Full entry}
• Awesome AI Reverse Engineering - A single-README, Chinese-language list of AI-assisted reverse-engineering projects, grouped into JavaScript reversing, binary and native analysis, Android and iOS security, and browser automation and traffic analysis. _{Collection · Targets: Website, App, Binary · Full entry}
• Interactive IDA Plugin List - A sortable, filterable list of 618 plugins, loaders, processor modules and scripts for Hex-Rays' IDA Pro, published as a GitHub Pages table with a static copy generated into the README. _{Collection · Targets: Binary · Full entry}

References and Learning

↑ Contents

• Installation and client setup - Reviewed setup plans, client registration, provider prerequisites and scoped readiness checks. _{Documentation · Official REA · Targets: Website, Game, App, Binary, Firmware · Full entry}
• CLI and Evidence - CLI workflows for saving Evidence and projecting smaller views from completed analysis. _{Documentation · Official REA · Targets: Website, Game, App, Binary, Firmware · Full entry}
• MCP contracts and generated catalog - Canonical tool contracts, provider discovery and Evidence semantics for integration authors. _{Documentation · Official REA · Targets: Website, Game, App, Binary, Firmware · Full entry}
• Native binary investigation - Locate a function, inspect instructions and pseudocode, and follow references with a selected native provider. _{Documentation · Official REA · Targets: Game, Binary · Full entry}
• Cross-layer JavaScript application workflows - Trace features and compare authenticated JavaScript application graphs while preserving static-analysis limits. _{Documentation · Official REA · Targets: Website, App · Full entry}
• Static Android APK analysis - Inspect Android package identity, classes, methods and references through REA's JADX integration. _{Documentation · Official REA · Targets: App · Full entry}
• Managed-code analysis - Read PE/CLI metadata and CIL, compare managed members and inspect declared native boundaries without loading the assembly. _{Documentation · Official REA · Targets: App · Full entry}
• Historical web network captures - Inspect saved web captures offline; recorded URLs are not fetched and no proxy is started. _{Documentation · Official REA · Targets: Website, App, Protocol · Full entry}
• Firmware analysis - Inspect firmware regions with Binwalk and explicitly extract with Unblob, retaining tool and artifact identity. _{Documentation · Official REA · Targets: Firmware · Full entry}
• Recorded packet capture inspection - Select TShark fields, display filters and decode-as rules over an existing network, USB or Bluetooth capture, and look up installed field names. _{Documentation · Official REA · Targets: Protocol · Full entry}
• Packet capture summaries - Summarize a saved pcap or pcapng file’s endpoints, DNS questions and addresses, TLS SNI, protocol stacks and HTTP URIs into paged Evidence views. _{Documentation · Official REA · Targets: Protocol · Full entry}
• Recorded signal decoding - Run caller-chosen sigrok protocol decoders, such as UART or I2C, over an existing logic-signal recording and keep annotation text with sample ranges. _{Documentation · Official REA · Targets: Firmware, Protocol · Full entry}
• Browser observation guide - Follow a user-triggered export request in the supplied Notes browser example and connect it to the downloaded result. _{Documentation · Official REA · Targets: Website · Full entry}
• JavaScript and Electron: follow a CSV export - A source-owned Notes fixture teaches the renderer, preload, IPC and CSV path with linked analysis evidence. _{Documentation · Official REA · Targets: App · Full entry}
• rea-playbook - An Electron practice target, Evidence extractor and MCP probe; offline fixture mode is distinguished from real REA analysis. _{Learning resource · Community REA · Targets: App · Full entry}
• rea-lab - A Windows REA/Ghidra lab with seeded challenges, published studies, upstream contributions and recorded limitations. _{Research · Community REA · Targets: Binary · Full entry}
• Flutter build identification - Identifies a Flutter APK’s Dart snapshot hash, per-ABI library digests and engine build provenance, then inspects one ABI’s AOT snapshot sections, through REA’s pure-parsing CLI and MCP tools. _{Documentation · Official REA · Targets: App · Full entry}
• Static HarmonyOS package inventory - Inventories HarmonyOS HAP, HSP and App Pack files through REA’s hardened ZIP reader and projects an execution-free application graph: component paths, IDs and hashes, Stage/FA packaging hints, runtime-family hints and path-based native-bridge hypotheses. _{Documentation · Official REA · Targets: App · Full entry}
• MIPS ELF analysis through Ghidra - Documents REA’s Ghidra lane for MIPS ELF executables, relocatable objects and MIPS16 shared images, including a pinned 32-bit language for recordless legacy firmware executables that Ghidra would otherwise import as 64-bit. _{Documentation · Official REA · Targets: Binary, Firmware · Full entry}
• PSP static ELF analysis through Ghidra - Documents REA’s bounded Ghidra profile for static PSP ELF executables, which leaves Allegrex instructions, PSP loading and calling conventions to a caller-installed ghidra-allegrex extension while reusing REA’s CLI, MCP, Evidence and snapshot workflows. _{Documentation · Official REA · Targets: Game, Binary · Full entry}
• NativeAOT metadata recovery with Ghidra - Recovers .NET 8 NativeAOT metadata from x64 PE executables during REA’s Ghidra analysis: MethodTable relationships, virtual slots and frozen strings from RTR 9.1 data, through a built-in read-only parser or an optional headless adapter that annotates the Ghidra database. _{Documentation · Official REA · Targets: Binary · Full entry}
• OpenSecurityTraining2 - Free self-paced security courses with learning paths for reverse engineering, firmware and systems foundations. _{Learning resource · Targets: Binary · Full entry}
• pwn.college: Reverse Engineering - Hands-on reverse-engineering module covering functions, data access, static tools and dynamic tools with hosted exercises. _{Learning resource · Targets: Binary · Full entry}
• Reverse Engineering for Beginners - Dennis Yurichev's free book on understanding compiled programs and assembly, available in multiple languages. _{Learning resource · Targets: Binary · Full entry}
• The Official Radare2 Book - Official practical reference for radare2 analysis, disassembly, scripting, debugging and related plugins. _{Learning resource · Targets: Binary · Full entry}
• Finding Jingle Town: Debugging an N64 Game without Symbols - A walkthrough from the Snowboard Kids 2 decompilation project on attaching gdb-multiarch to the Ares emulator while the matching build still cannot carry debug information. _{Learning resource · Targets: Game · Full entry}
• JPCERT/CC: APK analysis and API probing on attack servers - JPCERT/CC’s 15 October 2026 blog post on the infrastructure behind a series of unauthorized-access incidents in Japan. _{Learning resource · Targets: App · Full entry}
• Reverse Engineering (mytechnotalent) - A free, English lesson index by mytechnotalent that grows almost daily: 490 numbered lessons, most of which have learners write small programs and then debug and patch ("hack") them, across x86, x64, 32/64-bit ARM, RISC-V and AVR. _{Learning resource · Targets: Binary, Firmware · Full entry}
• Z0FCourse Reverse Engineering - A free English course by Z0F on reverse engineering 64-bit Windows programs, which its README pitches as taking learners from beginner to intermediate. _{Learning resource · Targets: Binary · Full entry}
• OWASP Mobile Application Security Testing Guide (MASTG) - OWASP’s open manual for Android and iOS app security testing and reverse engineering, published at mas.owasp.org. _{Learning resource · Targets: App · Full entry}
• The Decompilation Wiki - Community wiki explaining how decompilers work, from disassembly, lifting and control-flow recovery to type recovery, control-flow structuring, quality evaluation and neural decompilation, citing the research behind each technique. _{Learning resource · Targets: Game, Binary · Full entry}
• Frontkick vs Rikugan: a CREBench agent comparison - Matthieu Breuil’s Synacktiv article explains tool-calling and code-executing agent designs and describes Frontkick, a CodeAct agent that runs generated Python inside Binary Ninja. _{Learning resource · Targets: Binary · Full entry}
• FLARE Learning Hub - Free English reverse-engineering and malware-analysis modules from Mandiant's FLARE team, published as Google Docs, with lab binaries, IDA databases and scripts kept in this repository. _{Learning resource · Targets: Binary · Full entry}
• Nintendo Switch Reverse Engineering - Notes begun by dekuNukem in 2017 and extended by contributors on how the Joy-Con, Pro Controller and parts of the Switch console and dock work, worked out from teardowns, logic-analyzer captures and packet logs. _{Learning resource · Targets: Firmware, Protocol · Full entry}
• Android App Reverse Engineering 101 - Maddie Stone's free English workshop introducing static reverse engineering of Android apps, published as GitHub Pages. _{Learning resource · Targets: App, Binary · Full entry}
• Reverse Engineering iOS Applications - Ivan Rodriguez's free English course (version 1.1) on reverse engineering iOS applications, aimed at beginners in iOS app security. _{Learning resource · Targets: App, Binary · Full entry}
• tiny-dec - Zhuo Zhang's small educational decompiler for 32-bit RISC-V (RV32I) ELF files, written in Python to teach how decompilation works rather than to compete with production decompilers. _{Learning resource · Targets: Binary · Full entry}
• Reverse Engineering Reading List - A short reading list, compiled by One Thawt mostly in 2015–2016, of about 58 links to reverse-engineering tools, books, papers, talks and blog posts, kept in a README and a separate malware-analysis page. _{Learning resource · Targets: Binary · Full entry}
• Decomp Academy - A free, English, in-browser course in matching decompilation maintained by Jack Price-Burns: learners read a function's target assembly, write C, and the original console compiler grades the result byte for byte. _{Learning resource · Targets: Game, Binary · Full entry}
• OWASP Firmware Security Testing Methodology (FSTM) - A free English methodology, maintained by Aaron Guzman and published on GitBook, for security testing and reverse engineering embedded-device firmware. _{Learning resource · Targets: Firmware · Full entry}
• Emproof workshop: Firmware Reverse Engineering - Slides and 14 self-contained exercises from Emproof's firmware reverse-engineering workshop at ScapyCon Automotive 2025, designed by Tim Blazytko for a technical audience with little security experience. _{Learning resource · Targets: Binary, Firmware · Full entry}
• iOS App Reverse Engineering - Freely published 2015 book by snakeninny and hangcom on reverse engineering iOS apps, distributed in its repository as a 442-page English PDF. _{Learning resource · Targets: App · Full entry}
• Frida Snippets - A single large README that collects hand-written Frida instrumentation examples, grouped into Native, Android and iOS sections, for observing how a running app behaves. _{Learning resource · Targets: App · Full entry}
• iOSRE: iOS Reverse Engineering reference - A community-maintained reference on iOS reverse engineering started by kpwn, built from a wiki, a curated index of public technical papers and talks, and a few environment-setup scripts. _{Learning resource · Targets: App, Binary, Firmware · Full entry}
• linux-re-101 - Michal Malik’s single-README reading list for Linux reverse engineering, with about 230 links and book titles that run from quick references on system calls, ELF and processor ABIs through 101 and 201 tiers on program start-up, linking and relocations. _{Learning resource · Targets: Binary · Full entry}
• Frida Labs - Eleven Android challenge apps with step-by-step write-ups for learning Frida instrumentation, progressing from setting up frida-server and hooking a Java method through calling static methods, changing fields, creating instances and hooking constructors to hooking, calling and patching native functions. _{Learning resource · Targets: App · Full entry}
• osx & ios re 101 - A single-README reading list for macOS (OS X) and iOS reverse engineering, kept by Michal Malik from 2015 to 2019 and labelled a work in progress. _{Learning resource · Targets: App, Binary · Full entry}
• AndroidReverse101 - A Chinese-language Android reverse-engineering course by Evil0ctal, planned as 100 daily lessons. _{Learning resource · Targets: App · Full entry}
• Ghidra Snippets - A single-page collection of 30 commented Python examples for scripting Ghidra, grouped by task: projects, programs, functions and cross-references, basic blocks, instructions, stack variables, decompiler output, comments, P-code emulation and dumps, call graphs and program slices. _{Learning resource · Targets: Binary · Full entry}
• Frida Boot: a beginner binary instrumentation workshop - A beginner workshop by leonjza on binary instrumentation with Frida, served as offline pages from a Docker container that has gdb with GEF and frida-tools preinstalled. _{Learning resource · Targets: Binary · Full entry}
• Embedded Hacking (mytechnotalent) - A free English course by mytechnotalent on developing, debugging and reverse engineering firmware for the Raspberry Pi Pico 2 (RP2350, Arm Cortex-M33). _{Learning resource · Targets: Firmware · Full entry}

Papers

182 papers, grouped by topic and ordered newest first. Each line shows the study’s opening sentence, venue, publication status and first author.

Browse the paper directory · Complete bibliography JSON · Suggest a paper

By topic: Agent evaluation (13) · Decompilation (82) · Websites (28) · Games (11) · Apps (15) · Firmware (16) · Protocols (17)

Each paper’s “Full entry” holds its complete summary, scope and limitations, all authors and citation. Some papers also appear among curated resources; counts are not additive.

Reverse-engineering agent evaluation

↑ Paper topics · Contents

• Humans vs. Machines: A Comparison With AI Agents in Software Reverse Engineering - Compares human and LLM-agent understanding and navigation on the same static reverse-engineering challenges, then studies how binary representations consume context windows. _{arXiv 2026 · Preprint · Samuele Doria et al. · PDF · Full entry}
• Training Language Model Agents to Find Vulnerabilities with CTF-Dojo - CTF-Dojo is an execution environment for training LLM agents on capture-the-flag tasks: 658 challenges from 50 competitions held between 2011 and 2025, taken from pwn.college's CTF Archive and containerized with Docker. _{ICML 2026 · Conference paper · Terry Yue Zhuo et al. · PDF · Code · Full entry}
• The Next Challenge for Agentic Cybersecurity: A Realistic, Contamination-Free Reverse Engineering Benchmark - Introduces SRE-Bench, with privately authored programs and protected binary variants, to study agent recovery of program semantics while reducing training-data contamination. _{arXiv 2026 · Preprint · Jeremy Spence et al. · PDF · Full entry}
• Automatically Attacking Software Reverse Engineering AI Agents - A proof of concept for indirect prompt injection against Cline/GhidraMCP binary-analysis agents. _{ECCWS 2026 · Conference paper · Brian Crawford et al. · PDF · Full entry}
• CrackMeBench: Binary Reverse Engineering for Agents - Evaluates agents on executable-checked CrackMe tasks: infer validation logic from binaries and submit an accepted input or artifact, while recording tool use, time, and scoring attempts. _{arXiv 2026 · Preprint · Isaac David et al. · PDF · Full entry}
• Towards LLM-Resistant Software Protection: Agent Failure Patterns in CTF Reverse Engineering - Runs Claude Code, Codex CLI and ChatGPT-5.2 Pro on 24 crackme-style challenges selected from 15 international CTF events held in 2025, and attributes their failures to stages of an Observe–Comprehend–Plan loop and to three protection effects: concealment, complication and misdirection. _{Workshop on Binary Analysis Research (BAR) 2026 · Conference paper · Ryutaro Nishizaka et al. · PDF · Full entry}
• ProgramBench: Can Language Models Rebuild Programs From Scratch? - Evaluates black-box program reconstruction across 200 tasks: agents query an executable and read its documentation, then independently implement a codebase whose behavior is checked by generated tests. _{NeurIPS 2026 · Conference accepted · John Yang et al. · PDF · Code · Full entry}
• Decompiling the Synergy: An Empirical Study of Human–LLM Teaming in Software Reverse Engineering - Studies how human analysts work with LLM assistance during static software reverse engineering. _{NDSS 2026 · Conference paper · Zion Leonahenahe Basque et al. · PDF · Code · Full entry}
• Cyber-Zero: Training Cybersecurity Agents without Runtime - Cyber-Zero synthesizes training trajectories for capture-the-flag (CTF) agents from public writeups instead of running the challenges. _{ICLR 2026 · Conference paper · Terry Yue Zhuo et al. · PDF · Code · Full entry}
• CREBench: Evaluating Large Language Models in Cryptographic Binary Reverse Engineering - Benchmarks cryptographic binary reverse engineering across algorithm recognition, key or IV extraction, wrapper reconstruction, and flag recovery using 432 controlled challenges. _{COLM 2026 · Conference paper · Baicheng Chen et al. · PDF · Code · Full entry}
• EnIGMA: Interactive Tools Substantially Assist LM Agents in Finding Security Vulnerabilities - EnIGMA extends SWE-agent for capture-the-flag challenges with interactive agent tools that keep a gdb debugging session or a pwntools server connection open across turns, alongside decompile and disassemble commands, an LM summarizer for long outputs, and category-specific demonstrations and guidelines. _{ICML 2025 · Conference paper · Talor Abramovich et al. · PDF · Code · Full entry}
• Cybench: A Framework for Evaluating Cybersecurity Capabilities and Risks of Language Models - Cybench turns 40 professional-level capture-the-flag tasks from four competitions (HackTheBox Cyber Apocalypse 2024, SekaiCTF 2022–23, GlacierCTF and HKCert) into runnable agent tasks. _{ICLR 2025 · Conference paper · Andy K. Zhang et al. · PDF · Code · Full entry}
• NYU CTF Bench: A Scalable Open-Source Benchmark Dataset for Evaluating LLMs in Offensive Security - NYU CTF Bench packages 200 manually validated challenges from CSAW CTF qualifying and final rounds held between 2017 and 2023, spanning cryptography, forensics, pwn, reverse engineering, web and miscellaneous tasks, with challenge.json metadata and Docker images for server-side challenges. _{NeurIPS 2024 Datasets and Benchmarks · Conference paper · Minghao Shao et al. · PDF · Code · Full entry}

Decompilation and symbol recovery

↑ Paper topics · Contents

• Locate, Then Reason: End-to-End Patch Presence Testing in Stripped Binaries - Locates patch-relevant code in stripped binaries using instruction-aligned retrieval and caller/callee context, then uses an LLM to screen candidate matches and compare patch-specific behavior with vulnerable and patched references. _{arXiv 2026 · Preprint · Huaijin Wang et al. · PDF · Full entry}
• Recall-Oriented Precise Binary-to-Source Function Matching - BScout matches decompiled functions to a source corpus using chunked embeddings and inlining-aware training. _{arXiv 2026 · Preprint · Junlin Li et al. · PDF · Full entry}
• Decoding What iOS Location Services Send to Apple: An LLM Is an Unreliable Analyst but a Useful Toolmaker - Compares direct LLM recovery of Apple PBCodable schemas with an AI-written Extractor checked against compiled synthetic fixtures, published descriptors and captured traffic. _{arXiv 2026 · Preprint · Douglas Leith · PDF · Code · Full entry}
• SoK: Are LLMs Reliable at Source Code Recovery? A Taxonomy and Empirical Evaluation - This SoK organizes LLM-assisted source-recovery designs and separates compilation, readability, structural and behavioral metrics. _{arXiv 2026 · Preprint · Varun Kohli et al. · PDF · Code · Full entry}
• The CodeInverter Suite: Structure- and Data-Aware Binary Decompilation with Efficient LLMs - CodeInverter studies function-level LLM decompilation using control-flow graphs and memory-to-data mappings extracted with IDA/objdump. _{ASE 2026 · Conference paper · Peipei Liu et al. · PDF · Code · Full entry}
• Beyond Text Matching: Towards Reference-Free Evaluation for Human-Oriented Binary Reverse Engineering - BinJudgeBench collects expert judgments for function naming, binary-code summaries and decompilation refinement. _{ASE 2026 · Conference paper · Xiuwei Shang et al. · PDF · Full entry}
• Decompiling Quantum Assembly into Structured Programs - Quelle recovers library calls, loops, functions and symbolic parameters from compiled OpenQASM. _{arXiv 2026 · Preprint · Pingchuan Ma et al. · PDF · Full entry}
• ASAP: Assembly-Source Aligned Pseudocode Refinement For Binary Decompilation - ASAP aligns assembly and source representations during training, compresses assembly features into tokens, and supplies them alongside decompiler pseudocode to an LLM refiner. _{arXiv 2026 · Preprint · Yujian Zhuang et al. · PDF · Full entry}
• Faultless: A Program Equivalence Technique for Validating and Evaluating Neural Decompilers - Compares neural-decompiler C output with deterministic decompilation or reference functions using symbolic execution and a specialized memory model. _{arXiv 2026 · Preprint · Luke Dramko et al. · PDF · Code · Full entry}
• Between the Commits: Process, Error, and Claim Reliability in a Wholly AI-Authored Codebase - Studies development of the Extractor reverse-engineering tool through commits, available session logs and code-provenance tracing. _{arXiv 2026 · Preprint · Douglas Leith · PDF · Full entry}
• Echo: Learning-based Matching Decompilation using Trusted Back Translation - Echo iteratively generates source and compiler configurations, recompiles candidates, and uses assembly differences to guide configuration search and code refinement. _{arXiv 2026 · Preprint · Jun Bi et al. · PDF · Full entry}
• A Memorization Floor for LLM Refinement of Decompiled Code - Studies whether LLM refinement of decompiled C recovers identifiers from input evidence or prior knowledge. _{arXiv 2026 · Preprint · Muhammad Asjad · PDF · Full entry}
• When LLM Decompilers Recompile More and Preserve Less - Decompile-Diverge builds function-level behavioral comparisons from source-derived drivers and fuzzed reference inputs. _{arXiv 2026 · Preprint · Chang Liu et al. · PDF · Full entry}
• Reveree: Diagnosing LLM Reverse-Engineering Agents - Evaluates reverse-engineering agent traces through flag recovery, eight analysis milestones and action profiles. _{arXiv 2026 · Preprint · Hadjer Benkraouda et al. · PDF · Full entry}
• Decoupling is a Necessity: Transformation-Agnostic Decompiled Code Recovery under Optimization and Obfuscation - ReSource refines decompiled functions affected by compiler optimization and obfuscation. _{arXiv 2026 · Preprint · Zhiping Zhou et al. · PDF · Full entry}
• STILL: Recovering Lowered STL Semantics for LLM-assisted C++ Decompilation - STILL predicts function-level STL container presence from stripped control-flow graphs and turns those predictions into compact hints for LLM refinement of Ghidra output. _{arXiv 2026 · Preprint · Xiaohan Wang et al. · PDF · Full entry}
• The Evolution of Binary Decompilation in the Modern Era: A Taxonomy, Literature Review, and Future Perspectives - This survey maps traditional, dynamic, matching and neural decompilation approaches, then organizes type recovery, control-flow restructuring, naming and refinement tasks alongside evaluation metrics and benchmark choices. _{arXiv 2026 · Preprint · Omar Abusabha et al. · PDF · Full entry}
• Lifting Optimized Binaries to Canonical Compiler IR via Structure-Aware Retrieval and Iterative Verification - BRIDGE lifts stripped, optimized x86-64 and ARM64 functions, given as llvm-objdump disassembly, to LLVM IR. _{ACL 2026 · Conference paper · Xiaoao Zhu et al. · PDF · Code · Full entry}
• Fool Me If You Can: On the Robustness of Binary Code Similarity Detection Models against Semantics-Preserving Transformations - The paper builds asmFooler to test whether learned binary code similarity detection (BCSD) models keep matching functions after semantics-preserving changes. _{Proceedings of the ACM on Software Engineering (FSE 2026) · Journal article · Jiyong Uhm et al. · PDF · Full entry}
• MirrorCode: AI can rebuild entire programs from behavior alone - Tests reimplementation of 25 command-line programs using execute-only reference access, documentation and visible examples. _{arXiv 2026 · Preprint · Tom Adamczewski et al. · PDF · Code · Full entry}
• SoK: AI-Augmented Binary Reversing - A systematization-of-knowledge survey of machine-learning, LLM and agentic approaches to binary reversing. _{arXiv 2026 · Preprint · Yujeong Kwon et al. · PDF · Full entry}
• Binary Decompilation LLM with Feedback-Driven Multi-Turn Refinement - AutoDecompiler trains function-level decompilation models to revise assembly- or pseudocode-derived outputs using compilation, execution and I/O feedback. _{arXiv 2026 · Preprint · Peipei Liu et al. · PDF · Code · Full entry}
• LLM Agent-Assisted Reverse Engineering with Quantitative Readability Metrics - Uses a composite Quantitative Readability Score (QRS) to guide agents refining decompiled C. _{arXiv 2026 · Preprint · Neil Archibald et al. · PDF · Full entry}
• SCDBench: A Benchmark for LLM-Based Smart Contract Decompilers - Benchmarks LLM-based EVM decompilation on 600 source-verified Ethereum Solidity contracts, sampled in easy, medium and hard thirds from 772,736 unique bytecode–source pairs after near-duplicate filtering. _{arXiv 2026 · Preprint · Kaihua Qin et al. · PDF · Full entry}
• Semantic Validation of Packer Identification Tools: Characterization, Repair, and Downstream Impact - Uses unpacking outcomes as reference evidence to assess packer labels, normalizes heterogeneous tool results, and evaluates complementary signature/heuristic pools with static predicates derived from unpacker implementations. _{arXiv 2026 · Preprint · Fangtian Zhong et al. · PDF · Full entry}
• Decaf: Improving Neural Decompilation with Automatic Feedback and Search - Decaf samples multiple candidate decompilations, recompiles them and ranks them using compiler-derived byte distance or a learned reranker. _{arXiv 2026 · Preprint · Alexander Shypula et al. · PDF · Code · Full entry}
• NotDec: WebAssembly Decompilation With Inter-Procedural Type Recovery - NotDec lifts WebAssembly into SSA-based IR, uses Retypd-derived type constraints and pointer/value distinctions to recover structures, and emits C. _{ICSE 2026 · Conference paper · Jikai Wang et al. · PDF · Code · Full entry}
• The Deception Delta: Adversarial Evaluation of LLM-Based Smart Contract Bytecode Forensics - Evaluates how language models interpret raw EVM bytecode from purpose-built deceptive and control contracts. _{ACM CCS 2026 · Conference accepted · Timo Schefold · PDF · Full entry}
• SK2Decompile: LLM-based Two-Phase Binary Decompilation from Skeleton to Skin - Splits LLM decompilation into two phases: a Structure Recovery model turns decompiler pseudocode into an identifier-free IR that keeps control flow and data structures, trained with compiler-based RL rewards, and an Identifier Naming model then restores names under a semantic-similarity reward. _{ICLR 2026 · Conference paper · Hanzhuo Tan et al. · PDF · Code · Full entry}
• ShieldedCode: Learning Robust Representations for Virtual Machine Protected Code - ShieldedCode studies software protection from the defender's side: it trains code language models on pairs of C source functions and their virtualization-protected (VMP) x86-64 code so that the models can generate, compare and rank protected variants. _{ICLR 2026 · Conference paper · Mingqiao Mo et al. · PDF · Full entry}
• Idioms: A Simple and Effective Framework for Turbo-Charging Local Neural Decompilation with Well-Defined Types - Idioms fine-tunes code language models to turn Hex-Rays output for one target function into predicted original C together with definitions of the user-defined structs, unions and typedefs it uses. _{NDSS 2026 · Conference paper · Luke Dramko et al. · PDF · Code · Full entry}
• FidelityGPT: Correcting Decompilation Distortions with Retrieval Augmented Generation - FidelityGPT post-processes existing decompiler output: an LLM labels lines with six distortion types, such as non-conventional dereferencing, redundant variables and confusing control flow, and then rewrites the labeled lines. _{NDSS 2026 · Conference paper · Zhiping Zhou et al. · PDF · Code · Full entry}
• CHISEL-ing Back Source Code with AI-enabled Iterative Recovery - CHISEL refines Ghidra pseudocode using compiler diagnostics and type-aware differential fuzzing against the original function. _{SURE @ ACM CCS 2026 · Conference accepted · Varun Kohli et al. · PDF · Code · Full entry}
• Is This the Same Code? A Comprehensive Study of Decompilation Techniques for WebAssembly Binaries - Measures how well existing WebAssembly decompilers recover C, with native-binary decompilers as the baseline. _{SecureComm 2024 2025 · Conference paper · Wei-Cheng Wu et al. · PDF · Full entry}
• BinMetric: A Comprehensive Binary Code Analysis Benchmark for Large Language Models - BinMetric poses 1,000 questions across six binary-analysis tasks: call-site reconstruction, decompilation, signature recovery, binary code summarization, algorithm classification and assembly instruction generation. _{IJCAI 2025 · Conference paper · Xiuwei Shang et al. · PDF · Full entry}
• Exploring the Potential of LLMs for Code Deobfuscation - Studies LLMs as source-to-source deobfuscators for C functions protected with the Tigress obfuscator. _{DIMVA 2025 · Conference paper · David Beste et al. · PDF · Code · Full entry}
• DecompileBench: A Comprehensive Benchmark for Evaluating Decompilers in Real-World Scenarios - Evaluates traditional and LLM-based decompilers using functions from real programs, runtime behavioral checks, and an LLM-assisted assessment of analyst-facing code understandability. _{Findings of ACL 2025 · Conference paper · Zeyu Gao et al. · PDF · Code · Full entry}
• Decompiling Smart Contracts with a Large Language Model - Converts Ethereum Virtual Machine bytecode into Solidity in two stages. _{arXiv 2025 · Preprint · Isaac David et al. · PDF · Full entry}
• DecLLM: LLM-Augmented Recompilable Decompilation for Enabling Programmatic Use of Decompiled Code - DecLLM repairs decompiler pseudocode that does not recompile into C that compiles and runs, so source-level tools such as CodeQL can be applied to binaries. _{Proceedings of the ACM on Software Engineering (ISSTA 2025) · Journal article · Wai Kin Wong et al. · PDF · Full entry}
• DiSCo: Towards Decompiling EVM Bytecode to Source Code using Large Language Models - DiSCo lifts Ethereum contract creation bytecode to Solidity source by prompting a frozen LLM, instead of emitting decompiler pseudocode. _{Proceedings of the ACM on Software Engineering (FSE 2025) · Journal article · Xing Su et al. · PDF · Full entry}
• Unleashing the Power of Generative Model in Recovering Variable Names from Stripped Binary - GenNm suggests names for placeholder variables in decompiled code of stripped binaries by fine-tuning generative code models (CodeGemma-2B by default; CodeLlama-7B and a LoRA-tuned CodeLlama-34B are also tested). _{NDSS 2025 · Conference paper · Xiangzhe Xu et al. · PDF · Code · Full entry}
• TypeForge: Synthesizing and Selecting Best-Fit Composite Data Types for Stripped Binaries - TypeForge recovers composite data types, including struct layouts, unions and pointer or nesting relationships, from stripped binaries. _{IEEE S&P 2025 · Conference paper · Yanzhong Wang et al. · PDF · Code · Full entry}
• Nova: Generative Language Models for Assembly Code with Hierarchical Attention and Contrastive Learning - Nova is a generative LLM for x86-64 assembly, trained from DeepSeek-Coder checkpoints on stripped, normalized gcc -O0 to -O3 assembly built from AnghaBench and The Stack. _{ICLR 2025 · Conference paper · Nan Jiang et al. · PDF · Code · Full entry}
• Malsight: Exploring Malicious Source Code and Benign Pseudocode for Iterative Binary Malware Summarization - MALSIGHT writes natural-language summaries of stripped binary malware one function at a time. _{IEEE Transactions on Information Forensics and Security 2025 · Journal article · Haolang Lu et al. · PDF · Full entry}
• Lares: LLM-driven Code Slice Semantic Search for Patch Presence Testing - Lares tests whether a known 1-day vulnerability fix is present in a target binary function without recompiling the project. _{ASE 2025 · Conference paper · Siyuan Li et al. · PDF · Code · Full entry}
• Decompile-Bench: Million-Scale Binary-Source Function Pairs for Real-World Binary Decompilation - Introduces two million C/C++ binary-source function pairs using a Compile-Trace-Filter pipeline, with an evaluation suite spanning translated HumanEval/MBPP tasks and recent GitHub functions. _{NeurIPS 2025 Datasets and Benchmarks · Conference paper · Hanzhuo Tan et al. · PDF · Code · Full entry}
• Beyond Classification: Inferring Function Names in Stripped Binaries via Domain Adapted LLMs - SymGen infers function names for stripped binaries by generating them with a LoRA-fine-tuned Code Llama model instead of classifying over a fixed name vocabulary. _{NDSS 2025 · Conference paper · Linxi Jiang et al. · PDF · Code · Full entry}
• ReSym: Harnessing LLMs to Recover Variable and Data Structure Symbols from Stripped Binaries - Combines two fine-tuned language models with Prolog-based cross-function reasoning to infer local-variable symbols and user-defined data structures from stripped-binary decompilation. _{ACM CCS 2024 · Conference paper · Danning Xie et al. · PDF · Code · Full entry}
• Self-Constructed Context Decompilation with Fined-grained Alignment Enhancement - Adds two techniques to LLM decompilation of function-level x86-64 GCC assembly into C. _{Findings of EMNLP 2024 · Conference paper · Yunlong Feng et al. · PDF · Code · Full entry}
• LLM4Decompile: Decompiling Binary Code with Large Language Models - Trains language models for assembly-to-C decompilation and for refining Ghidra pseudocode, evaluating whether recovered functions can be recompiled and executed correctly. _{EMNLP 2024 · Conference paper · Hanzhuo Tan et al. · PDF · Code · Full entry}
• WaDec: Decompiling WebAssembly Using Large Language Model - WaDec decompiles WebAssembly text (wat) into C by fine-tuning CodeLlama-7b with LoRA on loop-level wat–C snippet pairs. _{ASE 2024 · Conference paper · Xinyu She et al. · PDF · Code · Full entry}
• CLAP: Learning Transferable Binary Code Representations with Natural Language Supervision - CLAP (Contrastive Language-Assembly Pre-training) learns assembly-function embeddings aligned with natural-language explanations. _{ACM ISSTA 2024 · Conference paper · Hao Wang et al. · PDF · Code · Full entry}
• TYGR: Type Inference on Stripped Binaries using Graph Neural Networks - TYGR infers the types of stack and heap variables in stripped binaries by running an architecture-agnostic, intra-procedural data-flow analysis on angr's VEX IR and classifying each variable's data-flow graph with a graph neural network. _{USENIX Security 2024 · Conference paper · Chang Zhu et al. · PDF · Code · Full entry}
• Code is not Natural Language: Unlock the Power of Semantics-Oriented Graph Representation for Binary Code Similarity Detection - HermesSim detects binary code similarity by lifting each function to Ghidra P-code and building a semantics-oriented graph that exposes operand structure inside instructions, def-use, control-flow and effect-order relations, while dropping semantics-independent details such as which register temporarily holds a value. _{USENIX Security 2024 · Conference paper · Haojie He et al. · PDF · Code · Full entry}
• CodeArt: Better Code Models by Attention Regularization When Symbols Are Lacking - CodeArt pre-trains a BERT-sized encoder from scratch on 26 million stripped x86-64 functions built from jTrans's BinaryCorp. _{Proceedings of the ACM on Software Engineering (FSE 2024) · Journal article · Zian Su et al. · PDF · Code · Full entry}
• StackSight: Unveiling WebAssembly through Large Language Models and Neurosymbolic Chain-of-Thought Decompilation - StackSight decompiles WebAssembly text-format functions into C++ with LLM prompting. _{ICML 2024 · Conference paper · Weike Fang et al. · PDF · Full entry}
• STRIDE: Simple Type Recognition In Decompiled Executables - STRIDE predicts the names and types of variables in decompiler output without a neural model. _{arXiv 2024 · Preprint · Harrison Green et al. · PDF · Code · Full entry}
• BinaryAI: Binary Software Composition Analysis via Intelligent Binary Source Code Matching - BinaryAI identifies which open-source C/C++ libraries a stripped binary reuses by matching its functions to source code. _{ICSE 2024 · Conference paper · Ling Jiang et al. · PDF · Full entry}
• SLaDe: A Portable Small Language Model Decompiler for Optimized Assembly - SLaDe translates function-level assembly into C with a 200M-parameter encoder–decoder model, code-specific tokenization and PsycheC type completion. _{IEEE/ACM CGO 2024 · Conference paper · Jordi Armengol-Estapé et al. · PDF · Code · Full entry}
• “Len or index or count, anything but v1”: Predicting Variable Names in Decompilation Output with Transfer Learning - VarBERT suggests variable names for IDA Hex-Rays and Ghidra decompiler output with a BERT-style model pre-trained on 5.2M human-written C functions from Debian and fine-tuned on decompiled code; it also predicts whether each variable came from the developer or was introduced by the decompiler. _{IEEE S&P 2024 · Conference paper · Kuntal Kumar Pal et al. · PDF · Code · Full entry}
• DeGPT: Optimizing Decompiler Output with LLM - Refines existing C-like decompiler output through three coordinated roles that select, propose and check changes. _{NDSS 2024 · Conference paper · Peiwei Hu et al. · PDF · Code · Full entry}
• Binary Code Summarization: Benchmarking ChatGPT/GPT-4 and Other Large Language Models - BinSum benchmarks LLMs on summarizing binary functions in natural language. _{arXiv 2023 · Preprint · Xin Jin et al. · PDF · Full entry}
• Decompiling x86 Deep Neural Network Executables - BTD (Bin to DNN) decompiles stripped 64-bit x86 executables emitted by deep-learning compilers into model specifications: operator types, network topology, dimensions and parameters. _{USENIX Security 2023 · Conference paper · Zhibo Liu et al. · PDF · Code · Full entry}
• XFL: Naming Functions in Binaries with Extreme Multi-label Learning - XFL treats function naming in stripped binaries as extreme multi-label classification: names are split into tokens, and PfastreXML ranks which tokens from a vocabulary of frequent labels fit each function. _{IEEE S&P 2023 · Conference paper · James Patrick-Evans et al. · PDF · Code · Full entry}
• Revisiting Binary Code Similarity Analysis Using Interpretable Feature Engineering and Lessons Learned - Builds BinKit, a reproducible cross-compilation benchmark of 243,128 binaries and 36,256,322 functions from 51 GNU packages, covering 1,352 combinations of eight architectures, nine GCC and Clang versions, five optimization levels, and PIE, LTO, no-inline and Obfuscator-LLVM options. _{IEEE Transactions on Software Engineering 2023 · Journal article · Dongkwan Kim et al. · PDF · Code · Full entry}
• SymLM: Predicting Function Names in Stripped Binaries via Context-Sensitive Execution-Aware Code Embeddings - SymLM predicts function names for stripped binaries as sets of name words. _{ACM CCS 2022 · Conference paper · Xin Jin et al. · PDF · Code · Full entry}
• Augmenting Decompiler Output with Learned Variable Names and Types - Introduces DIRTY, a Transformer model that recommends variable names and types from decompiled code and layout information, together with the DIRT corpus for training and evaluation. _{USENIX Security 2022 · Conference paper · Qibin Chen et al. · PDF · Code · Full entry}
• jTrans: Jump-Aware Transformer for Binary Code Similarity Detection - jTrans embeds binary functions for similarity search with a BERT-style Transformer. _{ACM ISSTA 2022 · Conference paper · Hao Wang et al. · PDF · Code · Full entry}
• ExeBench: an ML-scale dataset of executable C functions - ExeBench is a dataset, not a decompiler. _{ACM SIGPLAN MAPS 2022 · Conference paper · Jordi Armengol-Estapé et al. · PDF · Code · Full entry}
• Beyond the C: Retargetable Decompilation using Neural Machine Translation - BTC (Beyond The C) treats decompilation as plain-text translation from compiler-emitted x86-64 assembly to source code. _{Workshop on Binary Analysis Research (BAR) 2022 · Conference paper · Iman Hosseini et al. · PDF · Code · Full entry}
• Neural reverse engineering of stripped binaries using augmented control flow graphs - Nero predicts names for procedures in stripped x86-64 Linux executables; it does not produce decompiled code. _{Proceedings of the ACM on Programming Languages (OOPSLA 2020) · Journal article · Yaniv David et al. · PDF · Code · Full entry}
• How far we have come: testing decompilation correctness of C decompilers - Tests whether C decompilers preserve program behavior. _{ACM ISSTA 2020 · Conference paper · Zhibo Liu et al. · PDF · Code · Full entry}
• Binary Rewriting without Control Flow Recovery - E9Patch statically rewrites x86-64 binaries by inserting jumps to trampolines without moving any other instruction, so the original set of jump targets is preserved and control-flow recovery, symbolization and debug information are not needed. _{PLDI 2020 · Conference paper · Gregory J. Duck et al. · PDF · Code · Full entry}
• RetroWrite: Statically Instrumenting COTS Binaries for Fuzzing and Sanitization - RetroWrite statically rewrites 64-bit position-independent Linux binaries by generating reassembleable assembly, so instrumentation can be inserted as if at compile time. _{IEEE S&P 2020 · Conference paper · Sushant Dinesh et al. · PDF · Code · Full entry}
• BinRec: Dynamic Binary Lifting and Recompilation - BinRec lifts an executable to LLVM IR from dynamic traces instead of static disassembly, then lowers the IR back to a recovered binary, so compiler passes can optimize, harden or otherwise transform it. _{EuroSys 2020 · Conference paper · Anil Altinay et al. · PDF · Code · Full entry}
• Egalito: Layout-Agnostic Binary Recompilation - Egalito statically recompiles stripped x86-64 and ARM64 binaries, using the metadata that position-independent executables and libraries carry to recover a complete disassembly in which every code and data cross-reference becomes an explicit link. _{ASPLOS 2020 · Conference paper · David Williams-King et al. · PDF · Code · Full entry}
• DIRE: A Neural Approach to Decompiled Identifier Naming - Combines lexical and structural information from decompiler output to predict meaningful variable names, with a training and evaluation corpus derived from compiled C projects. _{ASE 2019 · Conference paper · Jeremy Lacomis et al. · PDF · Code · Full entry}
• Coda: An End-to-End Neural Program Decompiler - Coda decompiles the assembly of short functions into C in two phases. _{NeurIPS 2019 · Conference paper · Cheng Fu et al. · PDF · Full entry}
• Debin: Predicting Debug Information in Stripped Binaries - Debin predicts debug information for stripped ELF binaries on x86, x64 and ARM. _{ACM CCS 2018 · Conference paper · Jingxuan He et al. · PDF · Code · Full entry}
• rev.ng: A Unified Binary Analysis Framework to Recover CFGs and Function Boundaries - rev.ng lifts binaries to LLVM IR through QEMU's tiny code generator, so one front end covers every architecture QEMU supports and the output is compilable IR. _{CC 2017 · Conference paper · Alessandro Di Federico et al. · PDF · Code · Full entry}
• Ramblr: Making Reassembly Great Again - Ramblr produces reassembleable disassembly: assembly recovered from a stripped binary that can be edited and assembled again with an off-the-shelf assembler. _{NDSS 2017 · Conference paper · Ruoyu Wang et al. · PDF · Full entry}
• No More Gotos: Decompilation Using Pattern-Independent Control-Flow Structuring and Semantics-Preserving Transformations - DREAM is a decompiler whose control-flow structuring recovers loops, conditionals and switch statements from a recovered control-flow graph without matching predefined region patterns. _{NDSS 2015 · Conference paper · Khaled Yakdan et al. · PDF · Full entry}

Website reconstruction

↑ Paper topics · Contents

• PrismaCoder: Pushing the Boundaries of Open Multimodal Code Intelligence through Decomposed Rubric Synthesis - Trains visual-code models using separate code and rendered-output rubrics for data filtering and reinforcement learning. _{arXiv 2026 · Preprint · Qiushi Sun et al. · PDF · Full entry}
• State-Aware Generation of Deployable Websites from Visual Prototypes and Requirements - VisStateCoder links visual prototype elements, project files, interaction requirements and render evidence in a project state graph, then uses those links to generate websites and limit subsequent repairs to selected files. _{arXiv 2026 · Preprint · Ruwei Pan et al. · PDF · Full entry}
• TaoD2C-Bench: Benchmarking MLLMs for Industrial UI Code Generation Beyond Visual Fidelity - TaoD2C-Bench reconstructs interfaces from design images, layer metadata and component-library documentation. _{arXiv 2026 · Preprint · Chengwei Shi et al. · PDF · Full entry}
• Vision2Web: A Hierarchical Benchmark for Visual Website Development with Agent Verification - Benchmarks website development from visual prototypes and written requirements across 100 static-page, 66 interactive-frontend and 27 full-stack tasks, combining workflow-based functional checks with model-judged visual comparison. _{ICML 2026 · Conference paper · Zehai He et al. · PDF · Code · Full entry}
• IChart2Code: Benchmarking Multimodal Large Language Models for Interactive Chart Code Generation - Benchmarks reconstruction of interactive charts from a reference screenshot, local data and specified actions. _{arXiv 2026 · Preprint · Xu Zhang et al. · PDF · Full entry}
• Stage-Supervised Latent Reasoning for Single-Shot JavaScript Deobfuscation - Uses intermediate Webcrack rewrites to supervise Coconut-style latent reasoning for JavaScript deobfuscation. _{arXiv 2026 · Preprint · Rong Feng et al. · PDF · Full entry}
• ProgramDistill: From Interactive Web Apps to Verifiable Reference-Guided SWE Tasks - Evaluates recovery of web-app behavior from a live reference with hidden source. _{arXiv 2026 · Preprint · Jeonghye Kim et al. · PDF · Code · Full entry}
• WebWorld: The Browser as a World Model for Self-Improving Web Code - Uses typed browser interaction contracts to check progress and preserve previously verified capabilities while improving generated web code. _{arXiv 2026 · Preprint · Jiajun Wu et al. · PDF · Full entry}
• Does It Render Everywhere? A Study of Cross-Environment Compatibility in MLLM-Generated Webpages - WebCompat evaluates screenshot-reconstructed webpages across browsers and devices. _{arXiv 2026 · Preprint · Ziyun Guo et al. · PDF · Code · Full entry}
• UI2App: Benchmarking Visual Interaction Inference in Executable Web Application Generation - UI2App evaluates runnable React/TypeScript applications generated from 600 screenshots across 95 web applications. _{arXiv 2026 · Preprint · Grace Man Chen et al. · PDF · Code · Full entry}
• Dashboard2Code: Evaluating Multimodal Models on Reconstructing Interactive Dashboards - Evaluates agents that actively explore a running dashboard and reconstruct its appearance and interaction logic. _{ACL 2026 · Conference paper · Tianhao Niu et al. · PDF · Code · Full entry}
• UniCoder: Unified Visual-to-Code Generation via Symbolic Rewards and Reference-Guided Code Optimization - UniCoder trains a visual-to-code model for charts, SVGs and webpages. _{arXiv 2026 · Preprint · Yaozhi Zheng et al. · PDF · Code · Full entry}
• CASCADE: LLM-powered JavaScript Deobfuscator at Google - Uses Gemini to locate the prelude functions that Obfuscator.IO inserts for string obfuscation, then applies constant-propagation and inlining passes in the JSIR compiler IR to restore string literals and API names deterministically. _{ICSE-SEIP 2026 · Conference paper · Shan Jiang et al. · PDF · Code · Full entry}
• ScreenCoder: Advancing Visual-to-Code Generation for Front-End Automation via Modular Multimodal Agents - Splits screenshot-to-code generation among grounding, planning and generation agents that label UI regions, build a hierarchical layout tree and write HTML/CSS. _{EMNLP 2026 · Conference accepted · Yilei Jiang et al. · PDF · Code · Full entry}
• IWR-Bench: Can LVLMs reconstruct interactive webpage from a user interaction video? - Tests reconstruction of interactive webpages from user-interaction videos and supplied static assets. _{ICLR 2026 · Conference paper · Yang Chen et al. · PDF · Code · Full entry}
• From Obfuscated to Obvious: A Comprehensive JavaScript Deobfuscation Tool for Security Analysis - JSimplifier recovers readable JavaScript from obfuscated scripts in three stages. _{NDSS 2026 · Conference paper · Dongchao Zhou et al. · PDF · Code · Full entry}
• JsDeObsBench: Measuring and Benchmarking LLMs for JavaScript Deobfuscation - Builds an execution-verifiable JavaScript deobfuscation benchmark by applying seven JavaScript-Obfuscator transformations to Project CodeNet programs with test cases, then scores LLM and tool outputs for syntax, execution, code simplification and similarity to the original code. _{ACM CCS 2025 · Conference paper · Guoqiang Chen et al. · PDF · Code · Full entry}
• Interaction2Code: Benchmarking MLLM-based Interactive Webpage Code Generation from Interactive Prototyping - Benchmarks reconstruction of interactive webpages from screenshots before and after an interaction. _{ASE 2025 · Conference paper · Jingyu Xiao et al. · PDF · Code · Full entry}
• LaTCoder: Converting Webpage Design to Code with Layout-as-Thought - LaTCoder converts webpage design images to HTML/CSS by making layout an explicit intermediate step. _{KDD 2025 · Conference paper · Yi Gui et al. · PDF · Code · Full entry}
• WebUIBench: A Comprehensive Benchmark for Evaluating Multimodal Large Language Models in WebUI-to-Code - Diagnoses webpage-to-code capability through visual perception, HTML programming, image-to-HTML understanding, and screenshot reconstruction tasks. _{Findings of ACL 2025 · Conference paper · Zhiyu Lin et al. · PDF · Full entry}
• Divide-and-Conquer: Generating UI Code from Screenshots - Recursively divides a webpage screenshot along visual separation lines, has a multimodal model generate HTML/CSS for each leaf segment, and assembles child code upward into the full page; evaluated with GPT-4o, Gemini and Claude models and a small developer study. _{Proceedings of the ACM on Software Engineering (FSE 2025) · Journal article · Yuxuan Wan et al. · PDF · Code · Full entry}
• StructEval: Benchmarking LLMs' Capabilities to Generate Structural Outputs - Evaluates generation and conversion of structured outputs, including HTML, React and SVG, with separate checks for format adherence and structural correctness. _{arXiv 2025 · Preprint · Jialin Yang et al. · PDF · Code · Full entry}
• WebCode2M: A Real-World Dataset for Code Generation from Webpage Designs - WebCode2M pairs about 2.56 million real-world webpage screenshots with purified HTML/CSS code and element bounding-box layout trees. _{WWW 2025 · Conference paper · Yi Gui et al. · PDF · Code · Full entry}
• Design2Code: Benchmarking Multimodal Code Generation for Automated Front-End Engineering - Evaluates reconstruction of frontend code from webpage screenshots using real-world reference pages, visual-element and layout metrics, and human assessment. _{NAACL 2025 · Conference paper · Chenglei Si et al. · PDF · Code · Full entry}
• Large Language Models for Code Analysis: Do LLMs Really Do Their Job? - Evaluates GPT-3.5-turbo, GPT-4, LLaMA-2-13B, Code-LLaMA-2-13B-Instruct and StarChat-Beta on explaining what de-commented JavaScript, Python and C code does, then repeats the task on JavaScript obfuscated with JavaScript Obfuscator (identifier renaming, dead-code injection, control-flow flattening and string splitting) and with Wobfuscator’s WebAssembly transformation. _{USENIX Security 2024 · Conference paper · Chongzhou Fang et al. · PDF · Full entry}
• Web2Code: A Large-scale Webpage-to-Code Dataset and Evaluation Framework for Multimodal LLMs - Studies screenshot-to-HTML reconstruction through instruction tuning and two evaluation benchmarks. _{NeurIPS 2024 Datasets and Benchmarks · Conference paper · Sukmin Yun et al. · PDF · Code · Full entry}
• Understanding JavaScript Event-Based Interactions - Clematis helps developers understand a JavaScript web application's runtime behavior from a recorded user session. _{ICSE 2014 · Conference paper · Saba Alimadadi et al. · PDF · Code · Full entry}
• Crawling Ajax-Based Web Applications through Dynamic Analysis of User Interface State Changes - Crawljax infers a state-flow graph of an Ajax web application by driving it in a real browser. _{ACM Transactions on the Web 2012 · Journal article · Ali Mesbah et al. · PDF · Code · Full entry}

Game reconstruction and reverse engineering

↑ Paper topics · Contents

• Schema: Discovering Unknown Environments via Agentic Program Induction - Infers executable models of game state and transition rules from interaction. _{arXiv 2026 · Preprint · Guanning Zeng et al. · PDF · Code · Full entry}
• SWE-Game: Can Coding Agents Build the Games We Want? - Evaluates construction, completion, repair and Godot-to-Unity porting against executable reference games. _{arXiv 2026 · Preprint · Xiaoyu Chen et al. · PDF · Full entry}
• GameReplica: A Benchmark for Black-Box Visual Game Replication by Vision-Language Agents - Evaluates whether vision-language agents can infer hidden game rules through screenshots and active interaction, then build runnable single-file HTML replicas across 125 tasks from 25 web games, each with five difficulty levels. _{arXiv 2026 · Preprint · Boyu Qiao et al. · PDF · Full entry}
• Tycho: Active Abstraction with Programmatic World Models for ARC-AGI-3 - Tycho constructs editable Python models of game state, transitions, rendering and outcomes from action/observation histories in unfamiliar ARC-AGI-3 games. _{arXiv 2026 · Preprint · Jens Lehmann et al. · PDF · Code · Full entry}
• RevengeBench: Reverse Engineering Code-Space Policies from Behavioral Experiments - Tests whether agents can recover executable decision policies from behavioral traces and self-designed opponent probes, using 75 synthetic policies across five game arenas and measuring held-out action agreement and downstream competitive value. _{arXiv 2026 · Preprint · Babak Rahmani et al. · PDF · Code · Full entry}
• SPRITE: From Static Mockups to Engine-Ready Game UI - Transforms game-interface screenshots into editable engine assets through hierarchical YAML, visual grounding, asset extraction, and Unity UXML/USS synthesis, with evaluation on a curated game-UI benchmark and review by three senior UI/UX designers. _{CHI EA 2026 (poster/extended abstract) · Conference paper · Yunshu Bai et al. · PDF · Full entry}
• WorldCoder, a Model-Based LLM Agent: Building World Models by Writing Code and Interacting with the Environment - WorldCoder learns executable Python transition and reward models from environment interactions and natural-language goals. _{NeurIPS 2024 · Conference paper · Hao Tang et al. · PDF · Code · Full entry}
• Generating Code World Models with Large Language Models Guided by Monte Carlo Tree Search - GIF-MCTS generates executable Python transition and reward models from natural-language environment descriptions and offline state-transition trajectories, using prediction feedback to generate, improve and repair code. _{NeurIPS 2024 · Conference paper · Nicola Dainese et al. · PDF · Code · Full entry}
• Combining Functional and Automata Synthesis to Discover Causal Reactive Programs - AutumnSynth synthesizes a program in Autumn, a functional reactive language for Atari-style grid worlds, from a trace of observed frames and user actions such as clicks and arrow keys. _{Proceedings of the ACM on Programming Languages (POPL 2023) · Journal article · Ria Das et al. · PDF · Full entry}
• Learning to Simulate Dynamic Environments with GameGAN - GameGAN learns an action-conditioned neural simulator of a game from recorded frames and the actions taken, without access to the game’s logic or engine. _{CVPR 2020 · Conference paper · Seung Wook Kim et al. · PDF · Code · Full entry}
• Game Engine Learning from Video - Learns a rule-based forward simulator of a 2D game from gameplay video. _{IJCAI 2017 · Conference paper · Matthew Guzdial et al. · PDF · Full entry}

App reconstruction and analysis

↑ Paper topics · Contents

• From Dead Code and Static Requirements to Working Engines: Software Revival with Coding Agents - ReviveBench evaluates repair of nonrunning software and source-unavailable implementation of bounded computational and transactional engines from open specifications, using hidden reference-based checks. _{arXiv 2026 · Preprint · Tianyu Liu et al. · PDF · Full entry}
• From Code to Requirements: Agentic Reverse Engineering of Business Rules at Enterprise Scale - Uses seven agents and human review to recover business requirements from source, tests, configuration and documentation. _{arXiv 2026 · Preprint · Garima Agrawal et al. · PDF · Full entry}
• On the Viability of Requirements Generation from Code: An Experience Report - Studies a RAG-based, human-supervised pipeline for recovering requirements and code traces from two projects. _{IEEE REW 2026 / AIRE · Conference paper · Alexander Korn et al. · PDF · Full entry}
• From Visual Widgets to UI Code: Efficient Tool-Grounded Generation - WidgetGen reconstructs widget screenshots as React JSX. _{MUCG @ ECCV 2026 · Conference accepted · Houston H. Zhang et al. · PDF · Full entry}
• Agentic Reverse Engineering: From I/O to Code with Discovery Agent - Synthesizes executable programs from input/output observations using LLM-guided evolutionary search, progressively revealed examples, simple-to-complex mutations and execution-error feedback. _{NeurIPS 2026 · Conference accepted · Yihong Dong et al. · PDF · Code · Full entry}
• UIOrchestra: Generating High-Fidelity Code from UI Designs with a Multi-agent System - UIOrchestra converts static mobile UI designs into React/CSS through layout-description, code-generation and rendered-image comparison agents. _{Findings of EMNLP 2025 · Conference paper · Chuhuai Yue et al. · PDF · Full entry}
• DeclarUI: Bridging Design and Development with Automated Declarative UI Code Generation - Combines visual component extraction, multimodal models, page-transition graphs and iterative checks to reconstruct multi-page mobile UI code from designs or screenshots, evaluated with React Native, Flutter and ArkUI. _{Proceedings of the ACM on Software Engineering (FSE 2025) · Journal article · Ting Zhou et al. · PDF · Code · Full entry}
• On Benchmarking Code LLMs for Android Malware Analysis - CAMA is a framework for benchmarking how code LLMs read decompiled Android malware. _{ISSTA Companion 2025 (LLMSC Workshop) · Conference paper · Yiling He et al. · PDF · Full entry}
• Machine Learning-Based Prototyping of Graphical User Interfaces for Mobile Apps - ReDraw turns screenshots or design mock-ups into native Android GUI prototypes by detecting components, classifying widget types with a CNN, and assembling a plausible view hierarchy with a data-driven nearest-neighbor method. _{IEEE Transactions on Software Engineering 2020 · Journal article · Kevin Moran et al. · PDF · Full entry}
• pix2code: Generating Code from a Graphical User Interface Screenshot - Learns screenshot-to-DSL generation for native Android XML, iOS Storyboards and web HTML/CSS interfaces, then compiles the DSL into platform UI code. _{EICS 2018 · Conference paper · Tony Beltramelli · PDF · Code · Full entry}
• From UI Design Image to GUI Skeleton: A Neural Machine Translator to Bootstrap Mobile GUI Implementation - UI2code translates a mobile UI image into an Android component hierarchy and layout skeleton using a neural encoder-decoder. _{ICSE 2018 · Conference paper · Chunyang Chen et al. · PDF · Code · Full entry}
• Rico: A Mobile App Dataset for Building Data-Driven Design Applications - Rico is a dataset of Android app designs and a runtime mining system that needs no access to or modification of app source code. _{UIST 2017 · Conference paper · Biplab Deka et al. · PDF · Full entry}
• Statistical Deobfuscation of Android Applications - DeGuard reverses layout obfuscation in Android APKs, predicting original names for the fields, methods, classes and packages that ProGuard renames. _{ACM CCS 2016 · Conference paper · Benjamin Bichsel et al. · PDF · Full entry}
• Reverse Engineering Mobile Application User Interfaces with REMAUI (T) - Reconstructs native Android UI code from screenshots or design bitmaps using OCR, computer vision, and layout heuristics; evaluates visual similarity and view hierarchies on 488 screenshots from over 100 Android and iOS applications. _{ASE 2015 · Conference paper · Tuan Anh Nguyen et al. · PDF · Code · Full entry}
• GUI ripping: reverse engineering of graphical user interfaces for testing - GUI ripping reverse engineers a test model from a running desktop application rather than from its source code or specifications. _{WCRE 2003 · Conference paper · Atif Memon et al. · PDF · Full entry}

Firmware analysis and rehosting

↑ Paper topics · Contents

• SoK: A Large-Scale Empirical Study of Emulation-Based Dynamic Analysis Research for ARM Cortex-M Firmware (Extended Version) - Organizes 24 MCU analysis tools into configuration recovery, emulation, fuzzing and diagnosis stages, then evaluates the runnable, pipeline-compatible subset on 4,571 filtered Cortex-M firmware images. _{arXiv (extended version) 2026 · Preprint · Hongyuan Li et al. · PDF · Code · Full entry}
• POZZER: A Power Side Channel-guided Fuzzer for Black-Box Embedded Systems - Builds a noise-tolerant pseudo execution-flow graph from one power trace per test input, using newly observed behavior as LibAFL feedback. _{arXiv 2026 · Preprint · Pouya Narimani et al. · PDF · Full entry}
• Reactive Peripheral Modeling for Faithful Firmware Rehosting - Bluezz models peripherals as stateful event-condition-action systems, coordinating interrupts, MMIO and DMA rather than treating accesses independently. _{arXiv 2026 · Preprint · Qinying Wang et al. · PDF · Full entry}
• Khost: KVM-based Near Native MCU Firmware Rehosting - Extends KVM with MCU instruction handling, memory mapping and interrupt modeling to rehost firmware on ARMv8-A hosts. _{USENIX Security '26 2026 · Conference paper · Chunlin Wang et al. · PDF · Code · Full entry}
• FirmPilot: Evidence-Guided Multi-Agent Environment Recovery for IoT Firmware Rehosting - FirmPilot reconstructs QEMU execution environments through coordinated retrieval, planning, filesystem, persistent-state and network recovery. _{arXiv 2026 · Preprint · Yanbing Shen et al. · PDF · Full entry}
• FirmCure:Towards Autonomous and Adaptive Rehosting of Linux-Based Firmware - FirmCure combines static dependency analysis, iterative boot-configuration repair and runtime fault diagnosis to rehost Linux firmware in QEMU. _{arXiv 2026 · Preprint · Chuan Hong et al. · PDF · Full entry}
• SatBleed: Security of Commoditized Communication Modules in Satellites - Studies satellite communication modules through hardware inspection, firmware reverse engineering, protocol analysis, partial rehosting and targeted testing. _{IEEE S&P 2026 · Conference paper · Ulysse Planta et al. · PDF · Code · Full entry}
• User-Space Dependency-Aware Rehosting for Linux-Based Firmware Binaries - FIRMWELL reconstructs the execution environment of Linux firmware services by running their initialization processes, locating blocking dependencies and repairing missing system-level behavior. _{NDSS 2026 · Conference paper · Chuan Qin et al. · PDF · Code · Full entry}
• Target-Centric Firmware Rehosting with Penguin - Penguin rehosts embedded Linux firmware from an extracted filesystem by deriving an editable configuration of emulation transformations, such as file changes, pseudofiles, NVRAM values and network interfaces, from static analysis. _{Workshop on Binary Analysis Research (BAR) 2025 · Conference paper · Andrew Fasano et al. · PDF · Code · Full entry}
• Fuzzware: Using Precise MMIO Modeling for Effective Firmware Fuzzing - Rehosts monolithic ARM Cortex-M firmware for fuzzing, using locally scoped symbolic execution to model memory-mapped I/O accesses and focus input mutations on values relevant to firmware logic. _{USENIX Security 2022 · Conference paper · Tobias Scharnowski et al. · PDF · Code · Full entry}
• Jetset: Targeted Firmware Rehosting for Embedded Systems - Jetset rehosts firmware only as far as an analyst-chosen goal address, such as the point where a fuzzer can inject input. _{USENIX Security 2021 · Conference paper · Evan Johnson et al. · PDF · Code · Full entry}
• SoK: Enabling Security Analyses of Embedded Systems via Rehosting - Systematizes rehosting: moving embedded firmware from its physical hardware into a virtual environment that models enough hardware behavior for dynamic analysis such as fuzzing and symbolic execution. _{ACM ASIA CCS 2021 · Conference paper · Andrew Fasano et al. · PDF · Code · Full entry}
• FirmAE: Towards Large-Scale Emulation of IoT Firmware for Dynamic Analysis - Extends Firmadyne with empirically derived interventions for boot, networking, NVRAM, kernel behavior, and other runtime failures, enabling Linux router and IP-camera firmware web services to run for dynamic analysis. _{ACSAC 2020 · Conference paper · Mingeun Kim et al. · PDF · Code · Full entry}
• HALucinator: Firmware Re-hosting Through Abstraction Layer Emulation - HALucinator rehosts monolithic ARM Cortex-M firmware by identifying hardware-abstraction-library functions and replacing them with authored Python handlers and peripheral models. _{USENIX Security 2020 · Conference paper · Abraham A Clements et al. · PDF · Code · Full entry}
• Towards Automated Dynamic Analysis for Linux-based Embedded Firmware - Firmadyne crawls, extracts and emulates Linux-based firmware for network-connected commercial devices such as routers and IP cameras. _{NDSS 2016 · Conference paper · Daming D. Chen et al. · PDF · Code · Full entry}
• Avatar: A Framework to Support Dynamic Security Analysis of Embedded Systems’ Firmwares - Avatar runs embedded firmware in an instrumented emulator, S²E on QEMU, while forwarding memory-mapped I/O to the real device and injecting the device's interrupts back into the emulator, so firmware that depends on undocumented peripherals can still be analyzed dynamically. _{NDSS 2014 · Conference paper · Jonas Zaddach et al. · PDF · Code · Full entry}

Protocol inference and analysis

↑ Paper topics · Contents

• Protocol Reverse Engineering via Deep Transfer Learning - Transfers field-boundary patterns from standardized protocol traces labeled by Tshark to poorly documented target protocols. _{Proceedings of the ACM on Software Engineering / FSE 2026 · Journal article · Yanyang Zhao et al. · PDF · Full entry}
• RFCLLM: Evaluating LLMs' Reasoning Ability of Network Protocol State Machines - Tests reasoning over protocol state machines using 1,482 questions across 16 protocols. _{Findings of EMNLP 2026 · Conference accepted · Anqi Chen et al. · PDF · Code · Full entry}
• Recovering Process Variables from Industrial Network Traffic via Search-Based Optimization - PVParser recovers process-variable layouts from industrial traffic and historian records. _{CCS 2026 · Conference accepted · Chuan Sheng et al. · PDF · Full entry}
• ICEPRE: ICS Protocol Reverse Engineering via Data-Driven Concolic Execution - Infers message-field boundaries by following concrete message-guided paths through binary protocol parsers, then symbolically replaying them to extract byte-level data flow. _{Proceedings of the ACM on Software Engineering (ISSTA 2025) · Journal article · Yibo Qu et al. · PDF · Code · Full entry}
• BinPRE: Enhancing Field Inference in Binary Analysis Based Protocol Reverse Engineering - Infers protocol-message field boundaries and semantics from instrumented server binaries and input messages. _{ACM CCS 2024 · Conference paper · Jiayi Jiang et al. · PDF · Code · Full entry}
• DynPRE: Protocol Reverse Engineering via Dynamic Inference - DynPRE starts from captured client–server traces and then interacts with a live protocol server to infer message formats and types. _{NDSS 2024 · Conference paper · Zhengxiong Luo et al. · PDF · Full entry}
• Lifting Network Protocol Implementation to Precise Format Specification with Security Applications - NetLifter statically lifts source-available C protocol parsers into BNF-style message grammars and first-order constraints between packet fields. _{ACM CCS 2023 · Conference paper · Qingkai Shi et al. · PDF · Code · Full entry}
• BinaryInferno: A Semantic-Driven Approach to Field Inference for Binary Message Formats - Infers partial binary-message formats from static message samples without instrumenting an executable. _{NDSS 2023 · Conference paper · Jared Chandler et al. · PDF · Code · Full entry}
• The Closer You Look, The More You Learn: A Grey-box Approach to Protocol State Machine Learning - StateInspector learns protocol Mealy machines by combining active message queries with snapshots of runtime memory, without requiring the target’s source code. _{ACM CCS 2022 · Conference paper · Chris McMahon Stone et al. · PDF · Code · Full entry}
• Fingerprinting and analysis of Bluetooth devices with automata learning - Learns Mealy-machine models of Bluetooth Low Energy implementations on physical peripherals by active automata learning. _{Formal Methods in System Design 2022 · Journal article · Andrea Pferscher et al. · PDF · Code · Full entry}
• NetPlier: Probabilistic Network Protocol Reverse Engineering from Message Traces - Uses multiple sequence alignment and probabilistic keyword-field inference to cluster network messages by type, evaluated across ten protocols with downstream format and state-machine analysis. _{NDSS 2021 · Conference paper · Yapeng Ye et al. · PDF · Code · Full entry}
• Automatic Wireless Protocol Reverse Engineering - Infers message formats of proprietary wireless protocols from demodulated physical-layer captures: it aligns messages by preamble and sync word, then uses RSSI and dedicated engines to label length, address, sequence-number and checksum fields, optionally using known addresses or field positions. _{13th USENIX Workshop on Offensive Technologies (WOOT 19) 2019 · Conference paper · Johannes Pohl et al. · PDF · Code · Full entry}
• NEMESYS: Network Message Syntax Reverse Engineering by Analysis of the Intrinsic Structure of Individual Messages - Infers approximate field boundaries within individual binary-protocol messages from changes in bit congruence, and introduces Format Match Score to compare inferred segmentation with known protocol dissectors. _{12th USENIX Workshop on Offensive Technologies (WOOT 18) 2018 · Conference paper · Stephan Kleber et al. · PDF · Code · Full entry}
• Towards Automated Protocol Reverse Engineering Using Semantic Information - Infers the vocabulary of an undocumented protocol, its message types and formats, from communication traces. _{ACM ASIA CCS 2014 · Conference paper · Georges Bossert et al. · PDF · Code · Full entry}
• Prospex: Protocol Specification Extraction - Prospex infers message formats and a protocol state machine from execution traces of a Linux server handling client sessions. _{IEEE S&P 2009 · Conference paper · Paolo Milani Comparetti et al. · PDF · Full entry}
• Tupni: Automatic Reverse Engineering of Input Formats - Tupni infers an input format from an execution trace of an x86 program parsing one input, using byte-level dynamic taint tracking. _{ACM CCS 2008 · Conference paper · Weidong Cui et al. · PDF · Full entry}
• Polyglot: Automatic Extraction of Protocol Message Format using Dynamic Binary Analysis - Polyglot infers the format of a message that a program receives by monitoring how the program binary processes it, an approach the authors call shadowing. _{ACM CCS 2007 · Conference paper · Juan Caballero et al. · PDF · Full entry}

Full Repository Index

This published selection contains 3,500 captured repository records and 3,309 browsable entries. 187 scope-excluded entries and 4 whose upstream repository is no longer available remain in the published JSON. Original capture totals remain separate in the source evidence. Automatically discovered entries are not individually curated or execution-tested recommendations.

Browse by category on GitHub · Search website · Full bilingual index JSON · Curated catalog JSON

The resource list above is curated from primary sources. Detailed requirements, original evidence, and review dates are available in the catalog data.

Contributing

Help improve an entry or share a useful source. Start with the contribution guide, then suggest a resource, recommend a paper, correct a translation or report an outdated entry.

Contributors

Yuxuan Zhang — Lead.

Haozhe Wang — Game reconstruction resource collection: awesome-rea-games.

About

REA (Reverse Engineer Anything) is a separate upstream CLI and MCP project. This collection's name echoes it, but it is not the REA repository; “REA” in entry tags and labels such as “Official REA documentation” refers to that project.

This is an independent community collection. Original descriptions and code are MIT licensed; linked projects retain their own licenses.

To cite the collection itself, use its citation metadata. Cite listed papers, tools and other works from their own primary sources, and give the commit or snapshot date with any scan-derived counts.

For AI-built software and agent training or evaluation resources, explore AI Can What? across games, websites and applications.

---

Catalog format · Scan methodology · Build status · Back to top