Awesome Reverse Engineering

Featured: REA — Agent-oriented reverse-engineering tools, from application behavior to native binaries. By the creators of awesome-reverse-engineering.

A curated starting point for understanding binaries, applications, firmware, file formats, and protocols.

Find a tool by the work you need to do. Each entry describes its purpose; commercial tools are marked commercial. This is an initial selection, open to additions and corrections.

Start here

Contents

• Learning
  • Books
• File identification and triage
• Native analysis
• Debuggers
• Dynamic instrumentation and tracing
• Malware analysis
• Android and managed code
• iOS and macOS
• Language runtimes and packagers
• Web and protocols
• Firmware and hardware
• File formats
• Diffing and analysis frameworks
• AI-assisted analysis
• Practice and communities
• Related lists
• Contributing and maintenance
• License

Learning

• Azeria Labs - ARM assembly tutorials with exercises for learning registers, memory, and calling conventions.
• Compiler Explorer - Compiles code in the browser with many compilers and shows the generated assembly, for seeing how source constructs and optimization levels translate to machine code.
• Nightmare - Course built from annotated CTF challenges, progressing from assembly and reversing basics to binary exploitation.
• OpenSecurityTraining2 - Structured courses in assembly, architecture, debugging, and reverse engineering.
• pwn.college - Free courses with hands-on challenges in Linux, assembly, reverse engineering, and binary exploitation, run in a browser-accessible environment.
• Reverse Engineering for Beginners - Free book connecting compiled C and C++ examples to assembly across several architectures.
• RPISEC Modern Binary Exploitation - Course materials and labs covering reverse engineering, memory corruption, and exploitation; no commits since December 2021, so labs may need older toolchains.

Books

• Hacking the Xbox - Introduction to hardware reverse engineering through the original Xbox's security design; free PDF edition released by the author.
• Practical Binary Analysis - Covers ELF and PE internals, disassembly, binary instrumentation, taint analysis, and symbolic execution, with tools built in the exercises.
• Practical Malware Analysis - Hands-on introduction to static and dynamic Windows malware analysis with lab exercises; published in 2012, so some tooling chapters are dated.
• The Ghidra Book - Guide to Ghidra's disassembler, decompiler, scripting, and extension APIs; the 2026 second edition covers BSim and PyGhidra.

File identification and triage

• capa - Identifies capabilities in executable files using rules over static or dynamic analysis results.
• Detect It Easy - Identifies executable formats, compilers, packers, and other file characteristics.
• FLOSS - Recovers obfuscated strings, including strings constructed on the stack.
• LIEF - Parses and modifies executable formats such as PE, ELF, and Mach-O from code.
• Malcat - Hex editor and disassembler for triaging unknown files, with 50+ format parsers, embedded-file extraction, YARA scanning, and Python scripting. Commercial, with a free Lite edition for non-professional use.
• PE-bear - Graphical PE viewer and editor for a quick first look at headers, sections, imports, and resources, including malformed files.
• pestudio - Flags suspicious imports, strings, resources, and other indicators in Windows executables for initial assessment. Commercial, with a free basic edition for private use.

Native analysis

• Binary Ninja - Interactive disassembler and decompiler with intermediate representations and scripting APIs. Commercial, with a free edition.
• Cutter - Graphical reverse-engineering interface built on Rizin.
• Decompiler Explorer - Web service that runs an uploaded binary through several decompilers and shows their output side by side.
• Ghidra - Disassembly, decompilation, scripting, and headless analysis for native binaries.
• IDA - Interactive disassembler and decompiler with processor modules and a plugin ecosystem. Commercial, with a free edition.
• radare2 - Command-line toolkit for disassembly, binary inspection, debugging, and scripting.
• RetDec - Retargetable LLVM-based decompiler for ELF, PE, Mach-O, and other formats; in limited maintenance mode, with little new development.
• Rizin - Reverse-engineering framework with command-line analysis and reusable libraries.

Debuggers

• Cheat Engine - Memory scanner, debugger, and disassembler for finding and changing values in running processes, mainly used for game and application modding.
• GDB - Native debugger with scripting and remote-debugging support.
• GEF - Single-file GDB extension that adds context views, heap inspection, and commands for exploit development and binary analysis.
• LLDB - LLVM debugger for native programs, including macOS and iOS development workflows.
• pwndbg - Debugger extensions for inspecting memory, assembly, and runtime state during binary analysis.
• rr - Records and replays Linux process execution for repeatable debugging.
• WinDbg - Microsoft debugger for Windows user-mode and kernel debugging, crash dump analysis, and Time Travel Debugging.
• x64dbg - Windows user-mode debugger for inspecting native executables and libraries.

Dynamic instrumentation and tracing

• DynamoRIO - Dynamic binary instrumentation platform for building tools that observe or modify instructions at runtime, with bundled tracing and memory-checking tools.
• Frida - Injects scripts into running processes to trace calls, inspect data, and change behavior.
• Intel Pin - Dynamic binary instrumentation framework for writing analysis tools for x86 and x86-64 pr