Featured: REA — Agent-oriented reverse-engineering tools, from application behavior to native binaries. By the creators of awesome-reverse-engineering.

A curated starting point for understanding binaries, applications, firmware, file formats, and protocols.

Find a tool by the work you need to do. Each entry describes its purpose; commercial tools are marked commercial. This is an initial selection, open to additions and corrections.

• Learning
  • Books
• File identification and triage
• Native analysis
• Debuggers
• Dynamic instrumentation and tracing
• Deobfuscation and anti-analysis
• Malware analysis
• Android and managed code
• iOS and macOS
• Language runtimes and packagers
• Web and protocols
• Firmware and hardware
• File formats
• Game reverse engineering
• Binary diffing and patch analysis
• Symbolic execution and formal analysis
• Instruction lifting and semantics
• AI-assisted analysis
• Practice and communities
• Related lists
• Contributing and maintenance
• License

• Azeria Labs - ARM assembly tutorials with exercises for learning registers, memory, and calling conventions.
• Compiler Explorer - Compiles code in the browser with many compilers and shows the generated assembly, for seeing how source constructs and optimization levels translate to machine code.
• Corkami - Visual references and posters explaining binary formats and file structures, including executable-format layouts.
• Corkami PoCs - Minimal and unusual executable and document samples for studying file-format edge cases and parser behavior.
• Hextree - Hands-on mobile and hardware reverse-engineering courses and interactive labs; Commercial, with some free content.
• Malware Analysis Training - Windows malware-analysis course with programming, Windows-internals, and reversing exercises; labs need a suitable Windows analysis environment.
• Malware Unicorn RE101 - Introductory Windows malware-reversing workshop covering x86 assembly, triage, and debugging; its VM-based lab instructions use older software images.
• Nightmare - Course built from annotated CTF challenges, progressing from assembly and reversing basics to binary exploitation.
• OpenSecurityTraining2 - Structured courses in assembly, architecture, debugging, and reverse engineering.
• pwn.college - Free courses with hands-on challenges in Linux, assembly, reverse engineering, and binary exploitation, run in a browser-accessible environment.
• Reverse Engineering by Kevin Thomas - Annotated assembly and reverse-engineering lessons across x86, x64, ARM, AVR, and RISC-V, with lesson-specific toolchain and hardware requirements.
• Reverse Engineering for Beginners - Free book connecting compiled C and C++ examples to assembly across several architectures.
• RPISEC Modern Binary Exploitation - Course materials and labs covering reverse engineering, memory corruption, and exploitation; no commits since December 2021, so labs may need older toolchains.

• Hacking the Xbox - Introduction to hardware reverse engineering through the original Xbox's security design; free PDF edition released by the author.
• Practical Binary Analysis - Covers ELF and PE internals, disassembly, binary instrumentation, taint analysis, and symbolic execution, with tools built in the exercises.
• Practical Malware Analysis - Hands-on introduction to static and dynamic Windows malware analysis with lab exercises; published in 2012, so some tooling chapters are dated.
• The Ghidra Book - Guide to Ghidra's disassembler, decompiler, scripting, and extension APIs; the 2026 second edition covers BSim and PyGhidra.

• capa - Identifies capabilities in executable files using rules over static or dynamic analysis results.
• checksec - Checks ELF security properties such as PIE, RELRO, stack canaries, and non-executable stacks; mitigation flags are not a vulnerability verdict.
• Detect It Easy - Identifies executable formats, compilers, packers, and other file characteristics.
• FLOSS - Recovers obfuscated strings, including strings constructed on the stack.
• hexvero - Statically triages Electron archives and JavaScript bundles for IPC channels, preload bridges, and window settings, plus ELF/Mach-O/PE imports and hardening; its CLI, MCP server, and local web UI require Node.js 22.12+, and pattern-based JavaScript analysis can miss indirect code.
• LIEF - Parses and modifies executable formats such as PE, ELF, and Mach-O from code.
• Malcat - Hex editor and disassembler for triaging unknown files, with 50+ format parsers, embedded-file extraction, YARA scanning, and Python scripting. Commercial, with a free Lite edition for non-professional use.
• PE-bear - Graphical PE viewer and editor for a quick first look at headers, sections, imports, and resources, including malformed files.
• pestudio - Flags suspicious imports, strings, resources, and other indicators in Windows executables for initial assessment. Commercial, with a free basic edition for private use.

• Binary Ninja - Interactive disassembler and decompiler with intermediate representations and scripting APIs. Commercial, with a free edition.
• Cutter - Graphical reverse-engineering interface built on Rizin.
• Decompiler Explorer - Web service that runs an uploaded binary through several decompilers and shows their output side by side.
• Ghidra - Disassembly, decompilation, scripting, and headless analysis for native binaries.
• IDA - Interactive disassembler and decompiler with processor modules and a plugin ecosystem. Commercial, with a free edition.
• radare2 - Command-line toolkit for disassembly, binary inspection, debugging, and scripting.
• REDasm - Native disassembler and analysis GUI with legacy-format support; Windows and Linux are the primary tested hosts, while other platform builds have lower support tiers.
• RetDec - Retargetable LLVM-based decompiler for ELF, PE, Mach-O, and other formats; in limited maintenance mode, with little new development.
• rev.ng - LLVM- and QEMU-based binary-analysis framework and decompiler for inspecting and transforming native code; source builds need its documented toolchain.
• Rizin - Reverse-engineering framework with command-line analysis and reusable libraries.
• Rubber Room - Browser PE workbench with x86-64 disassembly, partial Win32 API emulation and experimental C-like pseudocode that may omit program logic; alpha.

• GDB - Native debugger with scripting and remote-debugging support.
• GEF - Single-file GDB extension that adds context views, heap inspection, and commands for exploit development and binary analysis.
• LLDB - LLVM debugger for native programs, including macOS and iOS development workflows.
• pwndbg - Debugger extensions for inspecting memory, assembly, and runtime state during binary analysis.
• rr - Records and replays Linux process execution for repeatable debugging.
• WinDbg - Microsoft debugger for Windows user-mode and kernel debugging, crash dump analysis, and Time Travel Debugging; version 1.2610.1001.0 and later include the official WinDbg MCP server.
• x64dbg - Windows user-mode debugger for inspecting native executables and libraries.

• bpftrace - Linux eBPF tracing language for observing kernel and user-space functions; available probes and permissions depend on the host kernel.
• DynamoRIO - Dynamic binary instrumentation platform for building tools that observe or modify instructions at runtime, with bundled tracing and memory-checking tools.
• Frida - Injects scripts into running processes to trace calls, inspect data, and change behavior.
• Intel Pin - Dynamic binary instrumentation framework for writing analysis tools for x86 and x86-64 programs on Linux and Windows; closed source, free for any use.
• QBDI - LLVM-based dynamic binary instrumentation framework for x86, x86-64, ARM, and AArch64, with C, C++, and Python APIs and Frida integration.
• r2frida - radare2 plugin for Frida-backed process inspection and instrumentation; requires a compatible radare2 build and a working Frida session with the target.
• strace - Linux system-call tracer for inspecting process I/O, signals, syscall arguments, and return values.
• Sysinternals Suite - Microsoft utilities, including Process Monitor, Process Explorer, and Autoruns, for observing process, file, registry, and network activity on Windows.
• System Informer - Windows 10+ process and system inspector for handles, memory, services, and related kernel information; some views require elevated access.
• TinyTracer - Intel Pin tool for tracing execution and selected function or API calls; use the documented platform build and a matching Pin kit.
• uftrace - Linux function-call tracer for C/C++, Rust, and Python, with call graphs and timing data; native-code coverage depends on instrumentation or supported dynamic tracing.

• Al-Khaser - Windows proof-of-concept suite for exercising anti-debugging, anti-VM, anti-hooking, and other analysis-environment checks.
• de4dot - .NET deobfuscator and unpacker for assemblies protected by common obfuscators; archived in 2020 and no longer updated.
• HollowsHunter - Windows process scanner using PE-sieve to find and dump injected or modified code across running processes; findings require manual investigation.
• PE-sieve - Scans a running process for injected or modified code, such as hollowed modules, hooks, and shellcode, and dumps what it finds.
• Scylla - Windows x86/x64 import-table reconstruction tool for dumped PE files; upstream documents older Windows versions, so current-host compatibility needs checking.
• ScyllaHide - Windows x86/x64 user-mode anti-anti-debugging library with x64dbg, OllyDbg, and IDA integrations; debugger and plugin versions must match.

Run samples only in isolated, disposable environments, and follow your organization's handling procedures.

• CAPE Sandbox - Automated sandbox derived from Cuckoo that runs samples in virtual machines and records behavior, unpacked payloads, and malware configurations.
• Didier Stevens Suite - Python utilities for inspecting PDF, OLE, scripts, and other suspicious document inputs; dependencies and input support vary by script.
• Dumpulator - Emulates selected user-mode code from Windows minidumps for tasks such as string decryption and unpacking; dump completeness and supported execution context limit what can run.
• FakeNet-NG - Intercepts traffic and emulates network services for dynamic analysis; supports Windows and selected Linux modes, with platform-specific setup and traffic-redirection privileges.
• FLARE-VM - Installation scripts that turn a Windows virtual machine into a malware-analysis and reverse-engineering workstation.
• Malduck - Python library of cryptography, compression, and memory-model helpers with a YARA-driven framework for writing your own malware configuration extractors; it does not ship family extractors.
• MemProcFS - Exposes memory dumps and live memory as a virtual file system and Python, C, and Rust APIs, with process and forensic views for Windows targets; mounting requires Dokany, FUSE, or macFUSE.
• mwemu - Emulates x86/x64 and AArch64 code for PE, ELF, and Mach-O investigations, with Windows API models and kernel-driver memory-lifetime checks; Windows-focused, with growing Linux/macOS support and Rust 1.95+ required to build the reviewed source.
• oletools - Python tools for inspecting Office, OLE, and RTF files and extracting macros, embedded objects, and other document artifacts.
• REMnux - Linux toolkit for analyzing malicious executables, documents, scripts, and network traffic, available as a virtual machine, container, or installer.
• Speakeasy - Windows emulation framework for PE files, drivers, and shellcode that produces API reports within a modeled runtime.
• Volatility 3 - Memory forensics framework for extracting processes, modules, network connections, and other artifacts from memory images.
• YARA - Identifies and classifies files with rules over strings, byte patterns, and file properties; in maintenance mode, with YARA-X as its successor.
• YARA-X - Rust-based rule-scanning engine with CLI and language bindings; check its documented differences before migrating YARA rules.

• Androguard - Python tooling for analyzing Android applications, bytecode, and call relationships.
• Apktool - Decodes Android resources and Smali code, and rebuilds APKs after edits.
• AsmResolver - Library for reading, modifying, and rebuilding native and managed PE files, including .NET metadata and application bundles.
• CFR - Java class and JAR decompiler for inspecting managed code; requires a Java runtime, and language-feature compatibility varies by input and release.
• dnSpyEx - .NET debugger and assembly editor maintained as a continuation of dnSpy.
• ILSpy - .NET assembly browser and decompiler with GUI and command-line interfaces.
• JADX - Android DEX decompiler with code navigation and search in a graphical interface or CLI.
• JEB - Android decompiler and analysis platform with edition-dependent native analysis and official MCP capabilities that vary by version; commercial.
• Medusa - Frida-based modular mobile runtime-analysis framework; documented hosts are Linux and macOS, with limited Windows functionality and target-side instrumentation prerequisites.
• MobSF - Automated static and dynamic analysis of Android, iOS, and Windows mobile apps, with a web interface and REST API.
• OWASP MASTG - Mobile security testing guidance with Android and iOS reverse-engineering techniques.
• Recaf - Java bytecode analysis and editing environment.
• Vineflower - Java decompiler focused on modern language features and readable output; requires Java 17 or newer to run current releases.

• class-dump - Generates Objective-C headers from Mach-O binaries; unmaintained since 2019 and without Swift support, so ipsw class-dump is a maintained alternative.
• Hopper - macOS disassembler and decompiler with Objective-C and Swift support, LLDB and GDB debugging, and scripting. Commercial, with a free demo.
• ipsw - Command-line toolkit for downloading and examining iOS and macOS firmware, dyld shared caches, kernelcaches, and Mach-O binaries.
• LLDB scripts by Derek Selander - LLDB commands, aliases, and Python helpers for Apple-platform investigations; individual scripts have architecture and debugger-version limits.
• objection - Frida-based toolkit for exploring iOS and Android apps at runtime, including class inspection, method hooking, and certificate-pinning bypass.
• pymobiledevice3 - CLI and Python API for iOS device services, including logs, crash reports, packet capture, and developer tooling with version-dependent tunnel requirements.

• Blutter - Flutter AOT analysis tool for recent Android arm64 libapp.so files, producing annotated assembly, object-pool dumps, and Frida templates.
• GoReSym - Recovers function names, types, and build metadata from Go binaries, including stripped ones.
• Heimdall - EVM bytecode-analysis toolkit for disassembly, decompilation, and contract inspection; inferred source, types, and signatures require validation.
• hermes-dec - Parses, disassembles, and decompiles React Native Hermes bytecode into register-based pseudo-code with incomplete JavaScript semantics; HBC 98 and 99 load with an unsupported-version warning.
• Hermit - Interactive toolkit for inspecting, disassembling, decompiling, and structurally patching React Native Hermes bytecode; supports HBC 94, 95, and 96, with HBC 98 unsupported.
• pycdc - Disassembles and decompiles Python bytecode from .pyc files; decompilation of recent Python versions can be incomplete.
• pyinstxtractor - Extracts the contents of PyInstaller executables, including the bytecode needed for decompilation; the pyinstxtractor-ng fork uses xdis so the host Python need not match the build version and supports PyInstaller archive decryption when the embedded key can be recovered, but neither tool decompiles bytecode.
• PyLingual - Model-assisted CPython 3.6+ bytecode decompiler that recompiles its output and flags mismatched code objects for manual review; requires Python 3.12+ to run and downloads large per-version models.
• r2flutter - radare2 plugin and CLI for recovering Dart AOT snapshot metadata from Flutter binaries; requires radare2 6.2.2+, primarily targets AArch64, and depends on snapshot layout.
• Redress - Recovers compiler metadata, packages, types, and symbols from stripped Go executables; target Go-version compatibility depends on the selected release and GoRE parser.
• reFlutter - Flutter mobile-analysis framework that instruments matching engine builds and produces method or type information; Android/iOS architecture and engine-version support varies.
• WhatsABI - TypeScript library for inferring Ethereum ABI entries and resolving proxy metadata from bytecode; inferred signatures and types are not original-source recovery.

• boofuzz - Python framework for describing a protocol's message fields and sending mutated messages to a target, useful for testing a reconstructed protocol against a live service; crash detection needs a process monitor or restart callback.
• Burp Suite - Intercepting proxy and toolkit for inspecting, replaying, and modifying HTTP and WebSocket traffic. Commercial, with a free Community Edition.
• Chrome DevTools - Browser tools for stepping through JavaScript, inspecting network requests, and examining runtime state.
• HTTP Toolkit - Intercepts and inspects HTTP(S) traffic from browsers, desktop applications, Android devices, and containers with automated interception setup. Commercial, with a free open-source edition.
• mitmproxy - Intercepts, inspects, and modifies HTTP traffic with interactive tools and Python scripts.
• Netzob - Python protocol-inference library for exploring fields, messages, and state models from captures; installation needs native dependencies and the documented Python environment.
• Protobuf Decoder - Web application that decodes Protobuf messages without a schema and shows field numbers, wire types, and possible value interpretations.
• Scapy - Python packet framework for dissecting and constructing protocols, reading PCAPs, and scripting network experiments.
• WABT - WebAssembly utilities for converting, inspecting, validating, and decompiling modules.
• wasm-tools - Bytecode Alliance tools for inspecting, validating, and transforming WebAssembly modules, components, and WIT interfaces.
• webcrack - Deobfuscates JavaScript and unpacks common bundler output to make code easier to inspect.
• Wireshark - Captures and dissects network traffic for protocol investigation.

• avatar2 - Coordinates debuggers, emulators, and physical targets for embedded analysis; each endpoint needs its own compatible backend and any associated hardware.
• Binwalk - Identifies embedded files and extracts content from firmware images.
• ChipWhisperer - Hardware and Python tooling for side-channel power analysis and fault-injection experiments; live capture and glitching require compatible capture and target hardware.
• EMBA - Firmware security analyzer that extracts images, runs static and emulation-based checks, and produces reports and SBOMs.
• esptool - Serial bootloader utility for inspecting and reading or flashing Espressif devices; current source requires Python 3.10+ and a compatible device connection.
• Facedancer - Python USB device-emulation and proxy framework for compatible hardware on GNU/Linux; 3.x does not support legacy scripts and backend capabilities vary.
• FACT - Linux firmware extraction, analysis, and comparison platform; the native installer has specific distribution and Python requirements, while the separate Docker route is unmaintained.
• FirmAE - Emulates Linux-based router and IP camera firmware for dynamic analysis, using heuristics that make full-system emulation succeed more often.
• flashrom - Reads, writes, and verifies flash chips through supported programmers, for dumping or restoring firmware from hardware.
• Glasgow Interface Explorer - Programmable hardware interface explorer with applets for probing and interacting with digital buses; requires Glasgow hardware.
• HALucinator - Firmware-rehosting framework that replaces selected hardware-abstraction-layer calls with models; requires its emulation toolchain and target-specific handlers or configuration.
• OFRAK - Framework for unpacking, analyzing, modifying, and repacking binary artifacts.
• OpenOCD - Connects to hardware debug interfaces for on-chip debugging and flash access.
• Packetry - USB 2.0 protocol analyzer for Cynthion captures and offline PCAP files using the LINKTYPE_USB_2_0 format.
• Proxmark3 - RFID and NFC research client and firmware for compatible Proxmark3 hardware; client, firmware, and device variants need to match.
• QEMU - Machine emulator for running firmware and programs built for other architectures, with a GDB stub for debugging.
• Renode - Embedded-system simulator with scriptable platform and peripheral models for repeatable firmware debugging and observation.
• ripcord - Ghidra-based firmware-analysis pipeline producing queryable Parquet tables for DuckDB; requires Ghidra 11.2+ with PyGhidra and Python 3.11+, with optional simulation tooling.
• sigrok - Signal analysis tools and protocol decoders for logic analyzers and related hardware.
• UEFITool - Parses UEFI firmware structures and extracts or replaces modules.
• unblob - Extracts nested archives, compressed data, and filesystem images from firmware and other files.
• usb-rea - Infers USB protocol fields, counters, checksums, and multi-packet commands from captures of labelled actions, with frame-number evidence, and generates pyusb driver code and Wireshark Lua dissectors; requires Python 3.10+, with usbmon plus dumpcap/tshark on Linux or USBPcap on Windows for capture, and remains alpha without physical-device validation.

• 010 Editor - Hex editor with binary templates for inspecting structured files. Commercial.
• Construct - Declarative Python library for parsing and building binary formats with composable schemas and validation.
• CyberChef - Browser-based workbench for decoding, decompressing, and transforming data with exportable recipes.
• Hex Fiend - macOS hex editor for inspecting and editing large binary files, with binary templates and an embeddable framework.
• Hex Harbinger - Browser hex editor that overlays structure templates for PE, ELF, Mach-O and ZIP files and highlights the parsed fields; alpha.
• ImHex - Hex editor with a pattern language for describing and exploring binary structures.
• Kaitai Struct - Describes binary formats declaratively and generates parsers in multiple languages.
• Struct Smith - Browser editor for Spec binary-format schemas, with a live parse tree, byte highlighting and diagnostics; alpha, with a 64 MiB input limit.

• AssetRipper - Unity asset-analysis and export tool with version-dependent support and additional paid Premium features.
• Cheat Engine - Memory scanner, debugger, and disassembler for finding and changing values in running processes, mainly used for game and application modding.
• Cpp2IL - Recovers types, methods, and IL from Unity IL2CPP builds into .NET assemblies and other outputs; described by its author as work in progress.
• FModel - Windows x64 GUI for inspecting and extracting Unreal Engine game archives and assets; title-specific mappings, versions, or encryption keys may be needed.
• GDRE Tools - Recovers Godot projects from exported games, including PCK extraction, GDScript decompilation, and resource conversion.
• Il2CppDumper - Restores Unity IL2CPP type and method metadata for use in IDA, Ghidra, and other tools; no commits since July 2024, with Cpp2IL as a maintained alternative.
• ReClass.NET - Interactive process-memory structure editor for Windows and Linux; upstream documents Linux support tested on Ubuntu 18.04, rather than current-distribution validation.
• Source 2 Viewer - Parser, decompiler, exporter, and Windows viewer for Valve Source 2 resources and VPK archives; format coverage and export fidelity vary by resource type.
• UModel - Unreal Engine package viewer and asset exporter for Windows and Linux; game/version compatibility varies, and the official site leaves licensing undetermined.
• vgmstream - Library and command-line tools for decoding proprietary game-audio streams; supported formats, codec dependencies, and player integrations vary.

• BinDiff - Compares disassembled binaries to identify similar functions and changes between builds; inputs come from the BinExport exporters for IDA Pro, Ghidra, and Binary Ninja; the current IDA plugin source requires IDA Pro 9.4+, while the 2024 release documents IDA SDK 8.0+ for building that plugin.
• Binlex - Binary-feature analysis framework with CLI and language bindings for similarity and corpus investigation; build and plugin dependencies vary by interface.
• Diaphora - Binary diffing plugin for comparing functions and transferring analysis in IDA.
• ghidriff - Ghidra-based command-line binary diffing engine with JSON, Markdown, and optional HTML reports; requires compatible Ghidra, PyGhidra, and JDK versions.

• angr - Python framework for symbolic execution and program analysis; angr-management is its official GUI front end, not a separate analysis engine.
• BINSEC - Binary-analysis platform combining symbolic execution, abstract interpretation, and SMT solving; source builds require OCaml and compatible solver/backend dependencies.
• flare-emu - Archived Unicorn-based emulation helper for IDA Pro, Rizin, and radare2 scripting; analysis-host APIs and Python bindings must match the archived source.
• KLEE - LLVM-bitcode symbolic-execution engine for generating test inputs and finding assertion violations; requires a compatible compiler/runtime setup and does not imply proof from an incomplete run.
• Miasm - Python reverse-engineering framework with an intermediate representation, emulation, symbolic execution, and assemblers and disassemblers for several architectures.
• PANDA - QEMU-based whole-system record/replay and analysis framework with taint-analysis plugins; analysis depends on supported guest architectures, recordings, and matching plugins.
• Qiling - Emulates binaries with operating-system services for scripted runtime analysis.
• S2E - Selective symbolic-execution platform for analyzing programs across OS boundaries; requires a supported Linux host, the S2E toolchain, and prepared guest images.
• Triton - Dynamic binary analysis library with symbolic execution, taint analysis, and AST representations of instruction semantics, usable from C++ or Python.
• Unicorn - CPU emulation library for executing and instrumenting machine code across architectures.
• Z3 - SMT solver with command-line and language APIs for expressing and solving analysis constraints; satisfiability results depend on the model and solver outcome, including possible unknown results.

• BAP - Binary-analysis platform for lifting native code into an intermediate language and running analyses; source installation uses OCaml/opam and a compatible LLVM toolchain.
• Capstone - Multi-architecture disassembly library for building analysis tools.
• Keystone - Multi-architecture assembler library, the counterpart to Capstone, for turning assembly text into machine code when patching binaries or building test inputs; GPL-2.0 with a separate commercial license, and the latest PyPI release (0.9.2, 2020) ships wheels only for x86 and x86-64 hosts.
• Remill - Library for lifting supported machine instructions into LLVM bitcode; requires compatible LLVM and build dependencies, with Windows support documented as experimental.
• Zydis - x86/x86-64 instruction decoding and encoding library for building analysis tools; source builds use CMake or the documented Visual Studio project.

Agent integrations expose existing analysis tools or coordinate an investigation. Check the upstream documentation for required software and supported clients; confirm conclusions against the underlying code and runtime evidence.

• Binary Ninja MCP Server - Built-in Binary Ninja server that exposes functions, symbols, strings, disassembly, IL, and decompiled code to MCP clients; the headless variant requires a Commercial or Ultimate license.
• Chrome DevTools MCP - Official MCP server for inspecting Chrome network activity, runtime state, console output, and performance traces; requires Node.js LTS and Chrome.
• Gepetto - IDA plugin that asks language models to explain decompiled functions and rename their variables; requires IDA 7.6 or later and access to a supported model provider.
• Ghidra MCP Server - Connects AI clients to Ghidra analysis through MCP.
• GhidraMCP - Ghidra plugin and MCP server for decompiling, listing, and renaming functions and data; the original project from which Ghidra MCP Server was derived.
• Hex-Rays IDA MCP - Official IDA MCP server for agent access to binary analysis; requires IDA 9.4+ with idalib, Python 3.11+, and uv, with IDA licensing separate from the server.
• IDA Pro MCP - Exposes IDA analysis and scripting capabilities to MCP clients; requires a compatible IDA installation.
• JADX-AI-MCP - Connects AI clients to JADX for Android application analysis.
• OpenDeviceDB - Experimental device-support registry with an MCP server for finding upstream protocol and firmware projects by model, FCC ID, or USB vid:pid; the npm server requires Node.js 20+, imported record quality varies, and claims/findings require a local checkout and pull request for public inclusion.
• radare2 MCP - Provides an MCP interface to radare2 for agent-driven binary analysis.
• re-audit - Statically audits ELF/PE/Mach-O binaries and Android APKs for missing exploit mitigations (NX, PIE/ASLR, RELRO, stack canary), hardcoded secrets, and risky exported components; runs as a CLI or MCP server with no network access and no execution of the target. Findings are heuristic candidates for manual review, not confirmed vulnerabilities. Requires Python 3.10+.
• RES - Experimental agent skill for documenting a SaaS web app's screens, business rules, data model, API shapes, and design tokens through the browser, with sandbox and change-ledger guidance; requires a browser-driving agent and Node.js 22+.
• WinDbg MCP - Official MCP server built into WinDbg 1.2610.1001.0 and later; supported clients are VS Code with GitHub Copilot and GitHub Copilot CLI, with one active MCP client per WinDbg session.

• crackmes.one - Practice binaries organized by platform, architecture, and difficulty.
• FLARE-On - Annual reverse-engineering challenge series with previous challenges and solutions.
• Microcorruption - Browser-based embedded security CTF in which you reverse and exploit firmware for simulated MSP430 lock devices with a built-in debugger.
• OALabs - Video tutorials on malware reverse engineering, unpacking, and analysis tooling.
• picoCTF - Free CTF platform from Carnegie Mellon University with beginner-friendly reversing, forensics, and binary exploitation challenges, plus a year-round practice gym.
• r/ReverseEngineering - Subreddit for sharing reverse-engineering articles, tools, and research.
• Reverse Engineering Stack Exchange - Questions and answers about tools, assembly, executable formats, and analysis techniques.
• Root Me - Challenge platform whose categories include binary cracking, app-system exploitation, and forensics.

See the list structure and maintenance review for a dated comparison of 21 general and specialist collections. Recent activity and popularity are assessed separately there.

The 2026-10-25 catalog source review records the purpose, prerequisites, source snapshots, and evidence limits for the new specialized entries; documented resources are distinguished from executed examples.

• Awesome AI Reverse Engineering - AI integrations organized by analysis ecosystem, with English and Chinese editions.
• Awesome Cyber Security Heaven - Broad cybersecurity directory with reverse-engineering and debugging tools such as Ghidra, radare2, and GDB alongside crackme practice links; individual resources have their own licenses and free-tier restrictions.
• Awesome Embedded Security - Firmware and hardware tools, learning resources, and repository-health workflows.
• Awesome Game File Format Reversing - Game formats, engines, asset tools, and specialist references.
• Awesome REA - Independent directory of open-source reconstructions, reimplementations, compatibility projects, and REA resources, with dated source reviews, license notes, and known limits.
• Awesome REA (reacher-z) - Bilingual catalog of reverse-engineering tools, reconstruction projects, case studies, and research, with a searchable website and a separately labeled automated repository index.
• Awesome Reverse Engineering and Malware Analysis - Topic pages spanning reversing, malware analysis, and related research.
• Awesome Reverse-Engineered - Searchable, automatically collected index of open-source implementations, unofficial clients, device integrations, and protocol or file-format projects, with an agent skill and MCP server; nightly GitHub metadata checks track repository health, while relevance and technical claims require independent review.
• Awesome Reversing by Reversing.ID - Separate catalogs for software, hardware, formats, and databases.
• Awesome Web Reversing - Web investigation workflows and a machine-readable tool catalog.

Read CONTRIBUTING.md to suggest a resource or fix an entry. Prefer canonical project links and descriptions that explain when a resource is useful.

The priority-candidate source review records dated support claims, required environments, and four reproducible examples; documented support and reproduced behavior are recorded separately.

Links are checked on pull requests, pushes to the default branch, and weekly by GitHub Actions. A passing link check confirms availability, not tool quality or maintenance; review archived projects, compatibility changes, and replacements when updating entries.

CC0 1.0. Listed projects retain their own licenses.