Reverse Engineering

dnSpy

C#

.NET debugger, decompiler, and assembly editor. Inspect and modify .NET and Unity assemblies without source code.

ILSpy

C#

Open-source .NET decompiler and assembly browser. Produces clean C# from compiled binaries with cross-platform support.

x64dbg

C++

Open-source x64/x32 debugger for Windows. Full-featured binary debugger with plugin ecosystem for malware analysis and reverse engineering.

Detect It Easy

C++/Qt

Binary packer and compiler detection. Identifies compilers, linkers, packers, and protectors used to build PE, ELF, and Mach-O files.

angr

Python

Binary analysis framework. Symbolic execution, CFG recovery, and vulnerability discovery for compiled binaries in Python.

RetDec

C++

Retargetable decompiler by Avast. Converts machine code back to C from x86, ARM, MIPS, and PowerPC binaries.

Rizin

C

Reverse engineering framework forked from radare2. Modernized API, improved UX, with Cutter as its official GUI.

Unicorn Engine

C

Lightweight CPU emulator framework. Emulate x86, ARM, MIPS, and more for binary analysis, fuzzing, and instrumentation.

Capstone

C

Multi-architecture disassembly framework. The engine behind Ghidra, radare2, and dozens of security tools.

ImHex

C++

Feature-rich hex editor with pattern language, data analysis, disassembly, and entropy visualization.

pwndbg

Python

GDB plugin for exploit developers and reverse engineers with context display, heap analysis, and PEDA-like commands.

EMBA

Shell

Firmware security analyzer for IoT and embedded devices performing static and dynamic analysis via emulation.

GEF

Python

GDB Enhanced Features plugin for exploit developers and reverse engineers.

Triton

C++

Dynamic binary analysis framework with symbolic execution and taint analysis.

Z3

C++

High-performance SMT solver from Microsoft Research used in RE and verification.

xortool

Python

Analyze and break multi-byte XOR cipher encrypted data with key guessing.

cwe_checker

Rust

Detect common bug classes (CWEs) in compiled binaries using Ghidra backend.

Bytecode Viewer

Java

Java/Android reverse engineering suite with multiple decompilers, disassemblers, and an integrated hex editor.

JD-GUI

Java

Standalone graphical Java decompiler. Displays Java source code from CLASS files and JAR archives.

dex2jar

Java

Converts Android DEX bytecode to Java CLASS files, enabling analysis with standard Java decompilers.

pyinstxtractor

Python

Extracts the contents of PyInstaller-generated executables, recovering the original Python scripts and resources.

Kaitai Struct

Scala

Declarative binary format parser generator. Define a format once in YAML, generate parsers for 12+ programming languages.

al-khaser

C++

Malware evasion technique reference implementation. Demonstrates VM detection, sandbox evasion, and anti-debugging tricks.

FLARE FLOSS

Python

Mandiant's obfuscated string extraction tool for malware analysis. Recovers strings hidden by encoding, encryption, and stacking.

FakeNet-NG

Python

Mandiant's dynamic network analysis tool. Simulates internet services to capture malware C2 communications locally.

PCILeech

C

Direct Memory Access attack toolkit. Reads and writes target system memory via PCIe/Thunderbolt/USB hardware interfaces.

PEDA

Python

Python Exploit Development Assistance for GDB. Enhanced debugging display with exploit development features.

Voltron

Python

Debugger UI toolkit providing split-pane views for LLDB, GDB, VDB, and WinDbg with customizable layouts.