Tools and learning resources for understanding software you did not write: native binaries, Android and .NET apps, language runtimes, web apps, firmware and smart contracts. Every entry is reviewed for execution and disclosure risk, and maintenance status refreshes weekly from GitHub.
135 entries · 19 categories · reviewed 2026-10-10 · GitHub data 2026-10-26 · Browse and search the website
- 🧭 How to Choose
- 🚦 Flags
- 🔐 Safety First
- ⚡ Triage by Runtime
- 🔎 Identify & Triage
- 🧾 Binary Formats & Hex Editors
- 🧠 Disassemblers & Decompilers
- 🐞 Debuggers
- 🪝 Instrumentation & Emulation
- 🩻 Memory & Process Analysis
- 🧮 Analysis Frameworks & Libraries
- 🔀 Binary Diffing
- 📱 Android & Java
- 🟪 .NET
- 🍎 iOS & macOS
- 📦 Language Runtimes & Packagers
- 🌐 Web, JS & Protocols
- 📟 Firmware & Embedded
- 💎 Smart Contracts & EVM
- 🦾 AI-Assisted RE & MCP Servers
- 🧪 Lab & Isolation
- 📚 Learn
- 🎯 Practice Targets
- 📅 A 12-Week Path
- 💡 Craft
- 🧰 Recipes
- 📈 About This List
- 🔗 Related Awesome Lists
| I need to... | Start here |
|---|---|
| Learn reversing from zero | Learn, then Practice Targets |
| Identify an unknown file and what it can do | Identify & Triage |
| Read a file format or patch bytes | Binary Formats & Hex Editors |
| Read native code | Disassemblers & Decompilers |
| Watch a program run | Debuggers, Instrumentation & Emulation |
| Handle Go, Flutter, Unity, React Native, Python, Electron or wasm | Language Runtimes & Packagers |
| Look inside an APK or a .NET assembly | Android & Java, .NET |
| Find what changed between two versions | Binary Diffing |
| Extract and audit device firmware | Firmware & Embedded |
| Check a contract or token before using it | Smart Contracts & EVM |
| Let an AI agent drive the decompiler | AI-Assisted RE & MCP Servers |
| Set up a safe place to do all this | Safety First, Lab & Isolation |
| Flag | Meaning |
|---|---|
| Executes or emulates target code, or loads third-party plugins and scripts. Use inside an isolated VM. | |
| ☁️ | Sends your binary or code to a third party when used as documented (hosted service or remote model). |
| 🎭 | Lookalike download sites or trojanised builds have been reported. Use the linked official source only. |
| Archived, no push in over a year, or the maintainers declare limited maintenance. | |
| (none) | Reviewed on 2026-10-10; none of the above known. Any parser of hostile input can have bugs, so the VM rule still applies. |
The tools in this list parse hostile input, and analysts are targeted directly.
- Analyse in a full VM. No network or a host-only network with no route out, no shared folders, clipboard or drag and drop, no keys, tokens or wallets, and a clean snapshot you revert after every session. WSL2 runs Linux in a lightweight VM that all your WSL distros share and that is wired into Windows (mounted drives, interop), so it is not a separate lab. Plain containers share the host kernel.
- Download from the official source only. Documented cases: a trojanised cracked IDA Pro 7.5 (ESET, 2021), fake dnSpy repositories (2022), and 100+ lookalike sites for Ghidra, dnSpy and ILSpy pushing a wallet-stealing payload (Check Point, 2026). Known fakes:
ghidralite.com,dnspy.org,dnspy.net,ilspy.org. - Treat project files and proof-of-concept repos as code. Researchers were compromised by shared Visual Studio projects (Google TAG, 2021), a crafted IDA database could run code until IDA 9.3sp2 (Calif, 2026), and fake CVE PoCs pulled a malicious PyPI dependency (ChocoPoC, 2026).
- Look up hashes; do not upload. Public scanners share uploaded files with paying customers. Hash locally and search by hash.
- Agents read hostile text. Strings inside a binary can carry instructions aimed at an AI analyst (Check Point, 2025). Keep approval prompts on, run MCP servers inside the VM, and verify every model claim against the disassembly.
Only analyse what you own, open-source code, CTF and crackme binaries released for analysis, or targets under written authorisation. Decompilation law varies by country; see the EU Software Directive Art. 6, US 17 USC 1201(f) and your local copyright and computer-crime laws.
The language runtime decides the toolchain. Check this before opening a disassembler.
If file, strings or Detect It Easy show... |
It is probably | Reach for |
|---|---|---|
Go build ID, runtime.gopanic |
Go | GoReSym, then Ghidra or IDA |
libapp.so + libflutter.so |
Flutter (Dart AOT) | blutter |
global-metadata.dat, GameAssembly |
Unity IL2CPP | Il2CppDumper, Cpp2IL |
index.android.bundle with Hermes magic |
React Native Hermes | hermes-dec |
PYZ, _MEIPASS |
PyInstaller | pyinstxtractor, pycdc |
resources/app.asar |
Electron | @electron/asar extract, then read JS |
magic \0asm |
WebAssembly | WABT |
CLR header, mscorlib |
.NET | ILSpy |
classes.dex |
Android | JADX |
.pck, Godot strings |
Godot | GDRE Tools |
.js.map next to a bundle |
Shipped source maps | Read the original source in DevTools |
Rust panic strings, core::fmt |
Rust | Ghidra or IDA with Rust demangling |
| None of the above | Native C or C++ | Disassemblers & Decompilers |
First fifteen minutes on any file: what is it, what built it, is it packed, what can it do.
| Tool | Last push · Stars | Cost | Flags | Use it when |
|---|---|---|---|---|
| Detect It Easy | 2026-10 · ★ 12k | Free | Identifies compiler, linker, packer and protector for PE, ELF and Mach-O files. | |
| capa | 2026-10 · ★ 6.3k | Free | Names what a binary can do (encrypt, network, persist) from rules; points you to the functions that do it. | |
| FLOSS | 2026-10 · ★ 4.2k | Free | Extracts obfuscated and stack-built strings that plain strings misses. |
|
| YARA-X | 2026-10 · ★ 1.3k | Free | Rust successor to YARA for pattern-matching rules; turn findings into reusable detections. | |
| PE-bear | 2026-10 · ★ 3.9k | Free | Fast PE header and section viewer for first looks at Windows binaries. | |
| XELFViewer | 2026-10 · ★ 1.6k | Free | ELF header, section and segment viewer. | |
| checksec | 2026-10 · ★ 2.4k | Free | Reports RELRO, canaries, NX, PIE and FORTIFY; now written in Go (checksec file <bin>). |
|
| pestudio | website | Free · Paid | Static Windows executable triage: imports, strings, indicators. |
Read and describe file structures by hand or with a grammar.
| Tool | Last push · Stars | Cost | Flags | Use it when |
|---|---|---|---|---|
| ImHex | 2026-10 · ★ 56k | Free | Hex editor with a pattern language, data inspector and diffing for reverse engineering file formats. | |
| 010 Editor | website | Paid | Commercial hex editor whose binary templates parse hundreds of formats. | |
| Kaitai Struct | 2026-10 · ★ 4.7k | Free | Declarative format descriptions that compile to parsers in many languages, plus a web IDE. | |
| Malcat | website | Free · Paid | Hex editor, disassembler and analyser in one for fast file triage. |
The engines everything else plugs into.
| Tool | Last push · Stars | Cost | Flags | Use it when |
|---|---|---|---|---|
| Ghidra | 2026-10 · ★ 94k | Free | 🎭 |
NSA's decompiler with scripting, BSim similarity search and a team server. Many 2026 advisories: stay on the latest release. |
| IDA Pro | website | Paid · Free tier | ☁️ 🎭 |
Industry standard. Free, Home and Pro Essential decompile in the cloud; never use cracked builds. |
| Binary Ninja | website | Paid · Free tier | Layered intermediate languages that suit scripting; the free edition includes a local MCP server and debugger. | |
| radare2 | 2026-10 · ★ 25k | Free | Scriptable command-line framework for quick triage and automation. | |
| Rizin | 2026-10 · ★ 4k | Free | radare2 fork focused on usability and a stable API. | |
| Cutter | 2026-09 · ★ 20k | Free | Rizin GUI with the Ghidra decompiler built in. | |
| Hopper | website | Paid | Affordable disassembler for macOS and Linux with strong Mach-O and Objective-C support. | |
| RetDec | 2026-05 · ★ 8.7k | Free | LLVM-based retargetable decompiler. |
|
| Decompiler Explorer | 2026-10 · ★ 2.7k | Free | ☁️ | Runs one small binary through many decompilers side by side (dogbolt.org). Uploads are kept and shared with tool authors. |
Answer one question at a time by watching the program run, inside a VM.
| Tool | Last push · Stars | Cost | Flags | Use it when |
|---|---|---|---|---|
| x64dbg | 2026-10 · ★ 50k | Free | Open-source Windows user-mode debugger; plugins are native DLLs. | |
| WinDbg | website | Free | Microsoft's debugger with Time Travel Debugging: record once, step backwards. | |
| GDB | website | Free | The GNU debugger; the base pwndbg and GEF build on. | |
| LLDB | website | Free | LLVM debugger, default on macOS and for Swift and Rust. | |
| pwndbg | 2026-10 · ★ 11k | Free | GDB and LLDB plugin with heap, memory and context views; keep GDB auto-load safe-path at its default. | |
| GEF | 2026-08 · ★ 8.4k | Free | Single-file GDB enhancement, handy for remote and embedded targets. | |
| rr | 2026-10 · ★ 11k | Free | Record and replay for Linux: debug the same execution as many times as you need. | |
| Pernosco | website | Paid | ☁️ | Omniscient debugging built on rr recordings; query any value at any point in time. |
| edb | 2026-10 · ★ 3k | Free | x64dbg-style GUI debugger for Linux. |
Hook, trace or emulate code without a full debugger session.
| Tool | Last push · Stars | Cost | Flags | Use it when |
|---|---|---|---|---|
| Frida | 2026-10 · ★ 22k | Free | Inject JavaScript into running processes on every major platform. frida-server listens on the device: test devices only. | |
| Unicorn | 2026-10 · ★ 9.5k | Free | CPU emulator for running a snippet (a decode loop) without running the program. | |
| Qiling | 2026-10 · ★ 6.2k | Free | Whole-binary emulation with OS-level hooks; PyPI lags GitHub releases. | |
| DynamoRIO | 2026-10 · ★ 3.2k | Free | Dynamic binary instrumentation for tracing and coverage. | |
| QBDI | 2026-09 · ★ 1.8k | Free | Dynamic binary instrumentation framework for x86, x86-64, ARM and AArch64. | |
| QEMU | 2026-10 · ★ 14k | Free | Full-system and user-mode emulation; user mode forwards syscalls to the host kernel, so only inside a VM. |
Inspect a live process or an offline memory image.
| Tool | Last push · Stars | Cost | Flags | Use it when |
|---|---|---|---|---|
| Sysinternals | website | Free | Process Explorer, Process Monitor and friends for watching what a Windows program does. | |
| Volatility 3 | 2026-10 · ★ 4.5k | Free | Offline memory image analysis: processes, modules, handles, network. | |
| PE-sieve | 2026-06 · ★ 3.9k | Free | Scans a running process for implants, hooks and in-memory patches and dumps them. |
Build your own analysis: parsing, disassembly, symbolic execution.
| Tool | Last push · Stars | Cost | Flags | Use it when |
|---|---|---|---|---|
| angr | 2026-10 · ★ 9.2k | Free | Symbolic execution and CFG recovery in Python; the standard for solving crackmes programmatically. | |
| angr management | 2026-10 · ★ 1.2k | Free | GUI for angr. | |
| Triton | 2026-10 · ★ 4.3k | Free | Dynamic symbolic execution and taint analysis library. | |
| Miasm | 2026-09 · ★ 4k | Free | Reverse engineering framework with IR, emulation and deobfuscation helpers. | |
| LIEF | 2026-10 · ★ 5.6k | Free | Parse and modify ELF, PE, Mach-O, DEX and OAT from Python, C++ or Rust. | |
| Capstone | 2026-10 · ★ 9.1k | Free | Multi-architecture disassembly library; prefer the stable 5.x line. | |
| Keystone | 2026-10 · ★ 2.7k | Free | Multi-architecture assembler library, Capstone's counterpart. |
Compare two builds to find a feature or a fix fast.
| Tool | Last push · Stars | Cost | Flags | Use it when |
|---|---|---|---|---|
| BinDiff | 2026-09 · ★ 3.2k | Free | Google's open-source binary diffing for IDA, Binary Ninja and Ghidra. | |
| BinExport | 2026-10 · ★ 1.2k | Free | Exports disassembly for BinDiff from IDA, Binary Ninja and Ghidra. | |
| Diaphora | 2026-10 · ★ 4.4k | Free | Advanced diffing inside IDA, including decompiler-level comparison. |
APK, DEX and JVM bytecode.
| Tool | Last push · Stars | Cost | Flags | Use it when |
|---|---|---|---|---|
| JADX | 2026-10 · ★ 51k | Free | DEX to Java decompiler with GUI; static analysis of APKs. | |
| Apktool | 2026-10 · ★ 27k | Free | Decode and rebuild APK resources and smali; install rebuilt APKs only on an emulator. | |
| JEB | website | Paid | Commercial decompiler aimed at obfuscated Android and Dalvik code. | |
| Bytecode Viewer | 2026-07 · ★ 16k | Free | Java and Android bytecode viewer with several decompilers side by side. | |
| objection | 2026-09 · ★ 9.5k | Free | Frida-powered runtime exploration for mobile apps you are authorised to test. | |
| MobSF | 2026-10 · ★ 22k | Free | Automated static and dynamic mobile app audit; run the Docker image bound to localhost. | |
| Androguard | 2026-10 · ★ 6.4k | Free | Python library for scripting APK, DEX and manifest analysis. | |
| Recaf | 2026-10 · ★ 7.4k | Free | Modern Java bytecode editor and decompiler front end. |
Managed code decompiles close to source.
| Tool | Last push · Stars | Cost | Flags | Use it when |
|---|---|---|---|---|
| ILSpy | 2026-10 · ★ 27k | Free | 🎭 | Static .NET decompiler for reading managed code without running it. ilspy.org is not official. |
| dnSpyEx | 2026-10 · ★ 11k | Free | Maintained dnSpy continuation with a debugger. dnspy.org and dnspy.net have served malware: GitHub releases only. |
Mach-O, IPSW and Apple firmware.
| Tool | Last push · Stars | Cost | Flags | Use it when |
|---|---|---|---|---|
| ipsw | 2026-10 · ★ 3.8k | Free | Swiss-army tool for IPSW, kernelcache, dyld_shared_cache and Mach-O analysis. | |
| Corellium | website | Paid | ☁️ | Virtual Arm iOS and Android devices for research; owned by Cellebrite since Dec 2025. |
The runtime decides the tool. Check this table before opening a disassembler.
| Tool | Last push · Stars | Cost | Flags | Use it when |
|---|---|---|---|---|
| GoReSym | 2026-09 · ★ 1.1k | Free | Go: recovers function names, types and build info from stripped binaries. | |
| blutter | 2026-08 · ★ 2.8k | Free | Flutter: analyses Dart AOT snapshots in libapp.so. | |
| Il2CppDumper | 2024-08 · ★ 9.6k | Free | Unity IL2CPP: restores class and method metadata. | |
| hermes-dec | 2026-10 · ★ 1.2k | Free | React Native Hermes bytecode disassembler and decompiler. | |
| pyinstxtractor | 2026-07 · ★ 4.5k | Free | PyInstaller: extracts the bundled .pyc files. | |
| pycdc | 2026-04 · ★ 4.7k | Free | Python bytecode decompiler. | |
| GDRE Tools | 2026-10 · ★ 4.4k | Free | Godot: recovers projects and decompiles GDScript. | |
| @electron/asar | 2026-10 · ★ 2.9k | Free | Electron: extract app.asar to read the app's JavaScript; pin the version. | |
| WABT | 2026-10 · ★ 8.2k | Free | WebAssembly: wasm2wat, wasm-objdump and wasm-decompile to C-like pseudocode. | |
| Cpp2IL | 2026-09 · ★ 3.1k | Free | Unity IL2CPP to IL recovery; work in progress, check supported Unity versions, use on your own builds. |
Bundles, source maps, traffic and undocumented APIs of services you use.
| Tool | Last push · Stars | Cost | Flags | Use it when |
|---|---|---|---|---|
| webcrack | 2026-07 · ★ 3k | Free | Deobfuscates obfuscator.io output and unpacks webpack and browserify bundles. | |
| mitmproxy | 2026-10 · ★ 46k | Free | Intercepting HTTPS proxy for your own apps' traffic; keep its CA on test devices only. | |
| mitmproxy2swagger | 2026-10 · ★ 9.7k | Free | Turns captures into an OpenAPI spec; sanitize tokens first. | |
| Wireshark | website | Free | Packet analysis; never run the GUI as root. | |
| Chrome DevTools | website | Free | Sources with source maps, network panel and HAR export; use a separate browser profile with no wallet. | |
| Burp Suite | website | Free · Paid | Intercepting proxy for testing web apps you are authorised to test. | |
| HTTP Toolkit | 2026-10 · ★ 738 | Free · Paid | One-click interception for browsers, Android, Node and Docker. |
Extraction, emulation and audit of device images you own.
| Tool | Last push · Stars | Cost | Flags | Use it when |
|---|---|---|---|---|
| unblob | 2026-10 · ★ 2.6k | Free | Recursive extraction of 78+ formats; runs as a normal user with traversal guards and a Landlock sandbox. | |
| binwalk | 2026-08 · ★ 15k | Free | Signature scanning and entropy analysis (v3 is a Rust rewrite); never extract as root. | |
| EMBA | 2026-10 · ★ 3.7k | Free | Full firmware audit with emulation, SBOM and CVE report; uses sudo, dedicated VM only. | |
| FACT | 2026-10 · ★ 1.5k | Free | Fraunhofer's firmware analysis and comparison platform. | |
| FirmAE | 2026-06 · ★ 955 | Free | Emulates router and IoT firmware for dynamic analysis. | |
| dji-firmware-tools | 2026-10 · ★ 2.3k | Free | Parses DJI firmware packages; do not flash modified images to aircraft you fly. | |
| UEFITool | 2026-10 · ★ 5.8k | Free | Parses and extracts UEFI firmware images. | |
| OFRAK | 2026-10 · ★ 2.1k | Free · Paid | Unpack, analyse, modify and repack firmware in one framework. | |
| OpenOCD | 2026-10 · ★ 2.4k | Free | On-chip debugging over JTAG and SWD for hardware you own. | |
| sigrok | website | Free | Logic analyser software and protocol decoders for UART, SPI, I2C and more. |
Read unverified bytecode before you interact with it. Read-only, no wallet needed.
| Tool | Last push · Stars | Cost | Flags | Use it when |
|---|---|---|---|---|
| heimdall-rs | 2026-10 · ★ 1.6k | Free | Decompile, disassemble and decode unverified contracts. Use release binaries; the default installer is curl to bash over HTTP. | |
| EVMole | 2026-10 · ★ 473 | Free | Selectors, arguments, mutability and storage layout from bytecode; has an MCP server (pin its version). | |
| WhatsABI | 2026-10 · ★ 1.2k | Free | Recovers ABIs and follows proxies to implementations. | |
| Panoramix | 2024-08 · ★ 957 | Free | Python EVM decompiler; a second opinion. | |
| Dedaub | website | Free tier · Paid | ☁️ | Hosted decompiler with Solidity-like output; keep unreleased contracts out. |
| Foundry cast | 2026-10 · ★ 11k | Free | cast code, cast storage on ERC-1967 slots and cast 4byte for read-only checks. |
|
| evm.codes | website | Free | Interactive opcode reference and playground. |
Agents and plugins driving the engines above, grouped by engine. Treat every model claim as a hypothesis, keep approvals on, and run servers inside the lab VM.
| Tool | Last push · Stars | Cost | Flags | Use it when |
|---|---|---|---|---|
| REA | 2026-10 · ★ 388k | Free | One MCP server over twelve target types (Ghidra, IDA, Hopper, JADX, Binwalk, browser, processes). Runtime capture runs targets as you with no sandbox; pin the version. | |
| IDA MCP (official) | 2026-10 · ★ 1.4k | Needs IDA Pro | Hex-Rays' own server over stdio or Streamable HTTP; needs IDA 9.4+ with idalib and Python 3.11+. | |
| IDA Pro MCP | 2026-09 · ★ 13k | Needs IDA Pro | Popular community server; py_eval, patch and debugger tools are high impact, leave them off. | |
| ida-mcp-rs | 2026-10 · ★ 880 | Needs IDA Pro | Headless IDA MCP server in Rust. | |
| Ghidra MCP Server | 2026-10 · ★ 5.9k | Free | Actively maintained Ghidra server with 200+ tools including debugging. | |
| GhidraMCP | 2026-10 · ★ 12k | Free | The original Ghidra MCP bridge; unauthenticated localhost HTTP. | |
| ReVa | 2026-10 · ★ 880 | Free | Ghidra MCP server with small, context-efficient tools; PyGhidra scripting is on by default. | |
| Binary Ninja MCP | website | Free tier · Paid | Built into Binary Ninja; the GUI server works in every edition, headless needs Commercial or Ultimate. | |
| JADX AI MCP | 2026-10 · ★ 2.9k | Free | JADX plugin exposing Android analysis to MCP clients. | |
| radare2 MCP | 2026-10 · ★ 332 | Free | stdio MCP server for radare2. | |
| r2ai | 2026-10 · ★ 491 | Free | ☁️ | LLM-assisted decompilation (decai) and agent mode inside radare2. |
| Gepetto | 2026-08 · ★ 3.5k | Free | ☁️ | IDA plugin that explains functions and renames variables; sends code to the chosen provider unless you configure a local model. |
| GhidrAssist | 2026-10 · ★ 770 | Free | ☁️ | LLM chat, RAG and agent mode inside Ghidra; hosted or local models. |
| LLM4Decompile | 2026-02 · ★ 7.2k | Free | Open decompilation models that run locally; 27 to 65% of functions re-execute correctly on its benchmark. |
MCP servers at a glance (from each project's README, 2026-10-10)
| Server | Engine | Transport | High-impact capabilities |
|---|---|---|---|
| REA | Ghidra, IDA, Hopper, JADX, Binwalk, browser, processes | Local MCP | Runtime capture runs targets with your permissions; no sandbox documented |
| IDA MCP (official) | IDA 9.4+ with idalib | stdio or Streamable HTTP | Agent-written idalib scripts ("code mode") |
| IDA Pro MCP | IDA Pro 8.3+ | stdio or loopback HTTP/SSE | py_eval, patching, debugger tools (opt-in) |
| GhidraMCP | Ghidra | Unauthenticated HTTP on localhost:8080, stdio or SSE bridge | Renaming |
| ReVa | Ghidra 12.0+ | Streamable HTTP on 8080, optional API key | PyGhidra scripting on by default |
| Binary Ninja MCP | Binary Ninja | Built in | Headless use needs Commercial or Ultimate |
| radare2 MCP | radare2 | stdio | radare2 commands |
Where all of the above should run.
| Tool | Last push · Stars | Cost | Flags | Use it when |
|---|---|---|---|---|
| FLARE-VM | 2026-10 · ★ 9.2k | Free | Windows analysis VM build scripts; install only in a VM and switch to host-only after setup. | |
| REMnux | website | Free | Ubuntu-based analysis distro and appliance; check the published SHA-256. | |
| VMware Workstation Pro | website | Free | Free for all users since Nov 2024; patch it and the guest tools. |
Courses, books and references, in roughly the order to use them.
| Tool | Last push · Stars | Cost | Flags | Use it when |
|---|---|---|---|---|
| Compiler Explorer | 2026-10 · ★ 19k | Free | ☁️ | See C and C++ become assembly across compilers and -O levels; the hosted site keeps shared links, so self-host for private code. |
| pwn.college | website | Free | ASU's hands-on dojos from Computing 101 to a full reversing course. | |
| OpenSecurityTraining2 | website | Free | Arch1001 x86-64, Dbg1012 GDB, Dbg1102 Ghidra, RE3011 C++ binaries. | |
| Dive Into Systems | website | Free | C, gdb, optimisation and assembly for x86-64 and ARM64 in one free book. | |
| Azeria Labs | website | Free | ARM assembly tutorials; 32-bit ARM only, pair with an AArch64 text. | |
| Reverse-Engineering tutorial | 2026-10 · ★ 15k | Free | Free tutorial covering x86, x64, ARM and AVR with worked examples. | |
| Nightmare | 2026-02 · ★ 3.3k | Free | Course built from annotated past CTF binaries using Ghidra, GEF and angr. | |
| OWASP MASTG | 2026-10 · ★ 13k | Free | The mobile app security testing guide, including Android and iOS reverse engineering. | |
| Practical Binary Analysis | website | Paid | Formats, disassembly, instrumentation, taint and symbolic execution; concepts current, bundled VM dated (2018). | |
| The Ghidra Book, 2nd ed | website | Paid | March 2026 edition with BSim, PyGhidra and the debugger. | |
| The Art of ARM Assembly, Vol 1 | website | Paid | Deep 64-bit ARM programming text (2025). | |
| Reverse Engineering for Beginners | website | About $1 (Patreon) | Large catalogue of compiled C patterns; leans on 32-bit x86 and older compilers. | |
| RPISEC MBE | 2021-12 · ★ 6.1k | Free | Modern Binary Exploitation course; labs need older toolchains. | |
| Reverse Engineering Stack Exchange | website | Free | Q&A for specific technical questions. |
Legal targets, ordered from browser-only exercises to downloaded binaries that need a Windows VM.
| Tool | Last push · Stars | Cost | Flags | Use it when |
|---|---|---|---|---|
| picoGym | website | Free | CMU's year-round challenges with a gentle reversing category; many run in the browser, some need a download (use the VM). | |
| Microcorruption | website | Free | MSP430 lock puzzles in a browser emulator. | |
| OverTheWire | website | Free | Bandit, then Leviathan for reversing, over SSH. | |
| crackmes.one | website | Free | Large reviewed crackme library with no-malware rules; VM only. | |
| challenges.re | website | Free | Short multi-architecture exercises; no public write-ups. | |
| Root-Me Cracking | website | Free · Premium | About 70 challenges across ELF, PE, .NET, APK, wasm and game engines. | |
| Ethernaut | 2026-10 · ★ 2.3k | Free | EVM wargame including storage and bytecode levels; testnet-only key. | |
| Damn Vulnerable DeFi | 2025-03 · ★ 1.4k | Free | 18 local DeFi challenges on Foundry; run locally. | |
| Flare-On | website | Free | Annual Windows reversing contest with official solutions back to 2014; Windows VM. |
| Weeks | Goal | Do |
|---|---|---|
| 1-2 | Lab built; C to assembly | Build an isolated VM. Compile your own small C programs at -O0 and -O2 and read them in Compiler Explorer and Ghidra. pwn.college Computing 101. |
| 3-4 | x86-64, the ABI, ELF and PE | OST2 Arch1001 and Dbg1102. The SysV and Microsoft x64 calling conventions. Practical Binary Analysis chapters 2-3. |
| 5-6 | First challenges | OverTheWire Leviathan, picoGym reversing, Microcorruption, then crackmes.one level 1 in the VM. |
| 7-8 | A domain you care about | EVM bytecode with heimdall and EVMole, Android with JADX, or firmware with unblob. |
| 9-10 | Audit your own software | Unpack your own APK, Electron app or firmware the way an outsider would, then fix what leaks. |
| 11-12 | AI-assisted, verified | Re-solve earlier challenges with an MCP server inside the VM and check every claim against disassembly and a debugger run. |
Rookie mistakes: treating decompiler output as truth; reading from main line by line; hand-reversing statically linked libraries (label them with Function ID, FLIRT or BSim); default names everywhere; no notes; missing the easy way in (source maps, symbols, plain JS in an asar); wrong firmware load address; running targets on the host; believing AI summaries unchecked.
Pro moves: fifteen minutes of triage by runtime; start from an anchor (string, import, constant) and walk cross-references backwards; use the debugger to answer one question; diff two builds; fix types and structs first; identify crypto by constants with capa; compile your own code to learn compiler idioms; script early; capture traffic first; recompile your reconstruction and test it against the original.
Look up a file by hash without uploading it
hash=$(sha256sum sample.bin | cut -d' ' -f1)
curl -s -H "x-apikey: $VT_API_KEY" "https://www.virustotal.com/api/v3/files/$hash"Partially redact a HAR before sharing it
jq '(.log.entries[] | .request.headers, .response.headers) |= map(select(.name | test("^(cookie|set-cookie|authorization|proxy-authorization|x-api-key|x-auth-token)$"; "i") | not)) | (.log.entries[] | .request.cookies, .response.cookies) |= []' in.har > redacted.harThis removes cookies and common auth headers only. URLs, query strings and request and response bodies can still hold tokens and personal data: search redacted.har for them before sharing, or share only the entries you need.
Find a proxy's implementation from raw storage (ERC-1967, read-only)
cast storage "$ADDR" 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc --rpc-url "$RPC"Build your own first targets
gcc -O0 -g -o prog-O0 prog.c && gcc -O2 -o prog-O2 prog.c && strip prog-O2Reverse the stripped -O2 build, then check your answer against the source.
- Maintenance data. Last push, stars and archive status refresh weekly from the GitHub API. A refresh that fails for more than a fifth of repositories fails CI and keeps the previous data, so the date shown is the last successful refresh.
- Editorial review. Flags, costs and descriptions were last reviewed on 2026-10-10. 51 entries carry a safety flag; 5 carry a maintenance warning. Changes are logged in CHANGELOG.md.
- Graveyard. Archived and replaced tools live in GRAVEYARD.md.
- Machine-readable.
data.jsonis the source;llms.txtandreport.jsoncarry the same entries with flags and maintenance state.
| List | Description |
|---|---|
| awesome-malware-analysis | Malware analysis tools and resources. |
| awesome-mobile-security | Android and iOS security testing. |
| awesome-embedded-and-iot-security | Embedded and IoT security research. |
| OWASP MASTG | The mobile app security testing guide. |
| awesome-OSINT | Open-source intelligence, including threat intel. |
Contributions welcome. Read CONTRIBUTING.md first. Add entries to data.json, not the README; node scripts/build.mjs --offline regenerates it and --check validates it (CI runs the check on every PR).
- One sentence per entry, ending with a period, saying when the tool is the right choice.
- Link the official repository or site, never a mirror.
- Set the safety flags honestly:
runs,cloud,impersonated. - No tools whose main purpose is cracking licences, bypassing DRM or cheating in online games.
Listed projects keep their own licences. This list is released under CC0 1.0.