Awesome Reverse Engineering Anything

A collection of tools, projects, integrations, and references for reverse engineering websites, games, apps, native binaries, and firmware.

Website · Full repository index · GitHub · 简体中文

Contents

• Website
• Game
• App
• Native Binary
• Firmware and Hardware
• Agents and MCP
• Related Collections
• References and Learning
• Full Repository Index
• Contributing

Resources

Each entry appears once under its main purpose. The collection includes independent projects as well as resources for REA; inclusion does not imply REA integration.

Website

• webcrack — Improves JavaScript readability by reversing supported obfuscation patterns and unpacking webpack/Browserify bundles. [Tool]
• WABT — WebAssembly tools for binary-to-text conversion, section inspection, validation, interpretation and C translation. [Tool · WebAssembly]
• wasm-tools — Bytecode Alliance CLI and Rust libraries for inspecting WebAssembly modules, metadata, components and WIT interfaces. [Tool · WebAssembly]
• Chrome DevTools MCP — Connect an agent to Chrome for live page inspection, network debugging, and performance traces. [Integration · Independent MCP]
• mitmproxy — Inspect and record HTTP traffic with an interactive proxy, web interface, or scriptable command-line tools. [Tool]
• Playwright MCP — Drive browser interactions through structured accessibility snapshots to investigate reproducible web behavior. [Integration · Independent MCP]

Game

• DX-Ball: reconstruct sound panning — Recover one sound-pan function from instructions and constants; upstream cites 3,205 cases and a 63-byte match. [Case study · REA]
• TH04: recover a DOS bullet-ring helper — Inspect a 16-bit PC-98 DOS helper and relate its angle calculation to a pinned reconstruction and historical compiler checks. [Case study · REA]
• RenderDoc — Inspect frame captures, draw calls, shaders, and graphics resources in your own game or graphics application. [Tool]
• AssetRipper — Analyze Unity game files, inspect asset dependencies, and convert supported assets into Unity project formats. [Tool]
• Cpp2IL — Recover managed representations from Unity IL2CPP builds using binary and metadata analysis; reconstruction remains a work in progress. [Tool]
• Il2CppDumper — Recover IL2CPP metadata and dummy assemblies, and generate helper scripts for native analysis tools; method code is not restored. [Tool]
• RenderDoc MCP — Expose existing RenderDoc captures to an agent for bounded frame, pipeline, resource, and shader inspection. [Integration · Independent MCP]

App

• Aegis: trace a login-code calculation — An official APK investigation follows TOTP methods in Aegis and publishes artifact identities and selected Evidence. [Case study · REA]
• Notion: trace the clipboard bridge — Trace a packaged Electron clipboard path using REA findings and separate source inspection; the dynamic wrapper remains a stated limit. [Case study · REA]
• JADX-AI-MCP — JADX plugin paired with a Python MCP server to inspect decompiled Android classes, resources, cross-references and debugger context. [Integration · Independent MCP]
• frida-mcp (yfe404) — Frida MCP server with persistent instrumentation sessions, runtime inspection and Android static-to-dynamic navigation. [Integration · Independent MCP]
• Super Trouper — Single-binary Frida MCP server for discovering devices, managing process sessions and loading instrumentation scripts. [Integration · Independent MCP]
• Frida — Dynamic instrumentation toolkit for observing and scripting the behavior of live native and managed processes. [Tool]
• JADX — Dex-to-Java decompiler with CLI/GUI navigation, resource decoding and cross-reference search for Android packages. [Tool · Android]
• Apktool — Decodes Android resources and smali into a project-like tree and can rebuild modified packages. [Tool · Android]
• Androguard — Python toolkit for APK/DEX metadata, bytecode and reference analysis; the v5 source branch also documents agent skills and MCP. [Tool · Android]
• ILSpy — .NET assembly browser and C# decompiler with whole-project export, metadata inspection and a scriptable command-line frontend. [Tool · .NET]
• dnSpyEx — Community continuation of dnSpy for debugging and editing .NET assemblies without the original source. [Tool · .NET]
• @electron/asar — Electron’s archive tool lists and extracts ASAR contents so packaged JavaScript and application assets can be inspected. [Tool]

Native Binary

• DownUnderCTF: masked-squares flag checker — An official educational challenge investigation connects binary checks to equations and records an original-program validation. [Case study · REA]
• Ghidra — Open-source analysis suite for disassembly, decompilation, graphs and Java/Python automation across executable formats. [Tool]
• radare2 — Scriptable command-line framework for inspecting, disassembling, debugging and modifying binaries across many architectures. [Tool]
• Cutter — Rizin-powered graphical reverse-engineering workspace with extensible views and Ghidra decompiler integration. [Tool]
• Qiling — Python emulation framework that adds OS, filesystem and API behavior around CPU emulation for instrumented binary analysis. [Tool]
• Unicorn Engine — Multi-architecture CPU emulator for executing selected instruction ranges with register, memory and hook control. [Tool · Library]
• angr — Python binary-analysis framework combining control-flow recovery, symbolic execution, data-flow analysis and decompilation. [Tool · Library]
• LIEF — Library for structured parsing and modification of executable formats including ELF, PE and Mach-O. [Tool · Library]
• Capstone — Disassembly library with architecture-neutral APIs and instruction details for custom binary-analysis pipelines. [Tool · Library]
• ImHex — Hex editor with a binary-pattern language, structured data inspection and visual tools for understanding file formats. [Tool]
• x64dbg — Windows binary debugger with disassembly, memory views and plugins for analyzing programs without source code. [Tool]
• GDB — Native and remote debugger for controlling execution and inspecting live or crashed program state. [Tool]
• rr — Records process execution and replays it under GDB, enabling repeatable inspection and reverse execution. [Tool]
• Diaphora — IDA-based binary diffing that matches functions and transfers names, comments and types between analyzed versions. [Tool]
• BinDiff — Compares disassembled binaries to find matching functions and changed code across versions. [Tool]
• Detect It Easy — Format-aware file identification and static inspection using parsers, signatures and programmable heuristics. [Tool]

Firmware and Hardware

• PicoPrint: LX-D02 printer investigation — The author describes REA-assisted Android investigation followed by separate Hermes decompilation to support a Windows BLE printer. [Case study · Mixed workflow]
• Binwalk — Identifies embedded formats and optionally extracts their contents, with entropy analysis for firmware triage. [Tool]
• unblob — Recursively extracts archives and filesystems from binary blobs while reporting chunk boundaries and unknown regions. [Tool]
• Ghidra Firmware Utilities — Ghidra loaders and helpers for PCI option ROMs, UEFI firmware volumes, Intel flash descriptors and coreboot images. [Tool]

Agents and MCP

• REA — Reverse Engineer Anything — The upstream CLI and MCP server for evidence-based investigations of shipped software and runtime behavior. [Project · REA]
• Official reverse-engineer-anything skill — Target routing, connection recovery and evidence practices for agents using REA. [Integration · REA]
• dsh-mcp-rea — A community MCP bridge presents a smaller selected tool surface and forwards explicit commands to the REA CLI. [Integration · REA]
• rea-jev — A Claude Code plugin adds Jev-based routing and evidence checks around a pinned REA MCP integration. [Integration · REA]
• rea-casebook — A Claude Code mod collects received REA Evidence, tracks unknowns and records findings that cite delivered evidence IDs. [Integration · REA]
• Hex-Rays IDA MCP — Official Hex-Rays MCP server for agent access to IDA databases, with headless operation and optional GUI integration. [Integration · Independent MCP]
• GhidraMCP — Ghidra extension and MCP bridge exposing decompilation, symbol navigation and renaming to agents, with GUI and headless modes. [Integration · Independent MCP]
• Binary Ninja MCP (official) — Binary Ninja’s own MCP interface exposes functions, symbols, disassembly, intermediate languages and decompiled text to agents. [Integration · Independent MCP]
• Binary Ninja MCP (fosdickio) — Community Binary Ninja plugin and bridge for MCP clients, including workflows that switch among multiple open binaries. [Integration · Independent MCP]
• IDA Pro MCP (mrexodia) — Community IDA integration useful for existing setups and migration context; its maintainer now recommends the official Hex-Rays MCP server. [Integration · Independent MCP]
• Radare2 MCP Server — Native radare2 MCP server offering binary-analysis tools, reusable sessions and configurable read-only access. [Integration · Independent MCP]
• r2ai — AI plugins inside radare2 for function explanations, naming suggestions and model-assisted decompilation using local or remote models. [Integration · Independent agent]
• DAILA — Decompiler-independent AI assistant for function summaries and naming across IDA, Ghidra, Binary Ninja and angr-management. [Integration · Independent agent]
• RevEng.AI Ghidra Plugin — Connects Ghidra to RevEng.AI for function similarity, recovered names, AI explanations and agent-assisted annotation. [Integration · Independent agent]
• LLDB MCP — LLDB’s official MCP interface gives agents debugger sessions and commands for breakpoints, memory inspection and stepping. [Integration · Independent MCP]
• Claude Reverse Engineering Skill — Community agent skill for triage, headless exports and evidence-based RE reports; explicitly documents workflows with REA and other MCP servers. [Integration · Independent agent]
• SpecterOps Reverse Engineering Skills — Focused Binary Ninja and Ghidra analysis skills that describe MCP tool use, analysis recipes and annotation practices. [Integration · Independent agent]

Related Collections

• Awesome Reverse Engineering — A task-oriented reverse-engineering resource list by REA’s maintainer, useful for broader tools and foundations. [Collection]
• Awesome REA Cases — A bilingual collection of REA and other AI-assisted reverse engineering cases, with source links and explicit distinctions between reported and reproduced outcomes. [Collection]

References and Learning

• Installation and client setup — Reviewed setup plans, client registration, provider prerequisites and scoped readiness checks. [Documentation · REA]
• CLI and Evidence — CLI workflows for saving Evidence and projecting smaller views from completed analysis. [Documentation · REA]
• MCP contracts and generated catalog — Canonical tool contracts, provider discovery and Evidence semantics for integration authors. [Documentation · REA]
• Native binary investigation — Locate a function, inspect instructions and pseudocode, and follow references with a selected native provider. [Documentation · REA]
• Cross-layer JavaScript application workflows — Trace features and compare authenticated JavaScript application graphs while preserving static-analysis limits. [Documentation · REA]
• Static Android APK analysis — Inspect Android package identity, classes, methods and references through REA’s JADX integration. [Documentation · REA]
• Managed-code analysis — Read PE/CLI metadata and CIL, compare managed members and inspect declared native boundaries without loading the assembly. [Documentation · REA]
• Historical web network captures — Inspect saved web captures offline; recorded URLs are not fetched and no proxy is started. [Documentation · REA]
• Firmware analysis — Inspect firmware regions with Binwalk and explicitly extract with Unblob, retaining tool and artifact identity. [Documentation · REA]
• Browser observation guide — Follow a user-triggered export request in the supplied Notes browser example and connect it to the downloaded result. [Documentation · REA]
• JavaScript and Electron: follow a CSV export — A source-owned Notes fixture teaches the renderer, preload, IPC and CSV path with linked analysis evidence. [Documentation · REA]
• rea-playbook — An Electron practice target, Evidence extractor and MCP probe; offline fixture mode is distinguished from real REA analysis. [Learning resource]
• rea-lab — A Windows REA/Ghidra lab with seeded challenges, published studies, upstream contributions and recorded limitations. [Research]
• OpenSecurityTraining2 — Free self-paced security courses with learning paths for reverse engineering, firmware and systems foundations. [Learning resource]
• pwn.college: Reverse Engineering — Hands-on reverse-engineering module covering functions, data access, static tools and dynamic tools with hosted exercises. [Learning resource]
• Reverse Engineering for Beginners — Dennis Yurichev’s free book on understanding compiled programs and assembly, available in multiple languages. [Learning resource]
• The Official Radare2 Book — Official practical reference for radare2 analysis, disassembly, scripting, debugging and related plugins. [Learning resource]

Full Repository Index

Explore the full repository index for a wider selection, searchable by project, topic, and target. This is a separate, automatically scanned discovery layer; its entries have not all been individually curated or tested.

The resource list above is curated from primary sources. Detailed requirements, original evidence, and review dates are available in the catalog data.

Contributing

New tools, projects, case studies, and collections are welcome. Suggest a resource or improve an existing entry through the contribution guide. Use a project link, a concise description, and an accurate resource type.

About

This is an independent community collection. Original descriptions and code are MIT licensed; linked projects retain their own licenses.

Supporting documentation · Repository scanning method