Open Source Reverse Engineering Tools
Sort By:
Reverse Engineering Tools
View 6278 business solutionsBrowse free open source Reverse Engineering tools and projects below. Use the toggles on the left to filter open source Reverse Engineering tools by OS, license, language, programming language, and project status.
-
$300 Free Credits to Build on Google CloudPut your $300 in credit toward real workloads, then keep building with free monthly usage for 20+ products. No commitment and no charge until you upgrade.
-
Veeam Data Platform v13.1 - Get Your Free TrialTry Veeam Data Platform today. Experience the unified platform that's secure by design, portable by default, and proven to recover clean, fast, and anywhere.
-
1
Ghidra
Ghidra is a software reverse engineering (SRE) framework
Ghidra is a free and open-source reverse engineering framework developed by the NSA for analyzing compiled software. It supports a wide array of instruction sets and executable formats, offering features such as decompilation, disassembly, scripting, and interactive graphing. Designed for security researchers and analysts, Ghidra provides a robust environment for understanding malware, auditing code, and performing software forensics. It includes both GUI-based and headless analysis modes. -
2
GenP
This repository preserves source materials and related documentation
GenP is an archival repository that preserves source materials, scripts, and documentation related to a tool historically associated with modifying proprietary software behavior. The project itself does not function as an actively maintained application but instead serves as a research-oriented collection intended for reverse engineering study and educational analysis. It explicitly positions itself as a reference resource, emphasizing that no support or guarantees are provided for compatibility with modern systems. The repository includes materials written in scripting languages such as AutoIt and PowerShell, reflecting its origins in automation and system-level interaction. It also highlights legal and ethical considerations, stating clearly that modifying proprietary software may violate license agreements and that the materials are provided strictly for informational purposes. -
3
Il2CppDumper
Unity il2cpp reverse engineer
Il2CppDumper is a Unity IL2CPP reverse engineering tool for analyzing supported Unity applications and game binaries. It can restore DLL metadata structures without restoring original code, which helps researchers inspect classes, methods, fields, MonoBehaviour data, and MonoScript information. The tool supports executable formats such as ELF, ELF64, Mach-O, PE, NSO, and WASM. It supports Unity versions from 5.3 through 2022.2, according to the repository documentation. Il2CppDumper can generate helper scripts for IDA, Ghidra, and Binary Ninja, along with structure headers and JSON outputs. It is best suited for authorized reverse engineering, interoperability research, security analysis, modding research, and educational binary analysis. -
4
frida
Dynamic instrumentation toolkit for developers
Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers. Inject your own scripts into black box processes. Hook any function, spy on crypto APIs or trace private application code, no source code needed. Edit, hit save, and instantly see the results. All without compilation steps or program restarts. Works on Windows, macOS, GNU/Linux, iOS, Android, and QNX. Install the Node.js bindings from npm, grab a Python package from PyPI, or use Frida through its Swift bindings, .NET bindings, Qt/Qml bindings, or C API. Frida is and will always be free software (free as in freedom). We want to empower the next generation of developer tools, and help other free software developers achieve interoperability through reverse engineering. We are proud that NowSecure is using Frida to do fast, deep analysis of mobile apps at scale. Frida has a comprehensive test-suite and has gone through years of rigorous testing across a broad range of use-cases. -
Paessler: Easy to Use With Enterprise Power. Free TrialYou shouldn't have to choose between a monitoring tool that's easy to use and one that's powerful enough for a complex environment. PRTG's low-code interface lets any admin build dashboards, set alerts and monitor devices without scripting, while custom sensors and full API access are there when your team needs deeper control. One platform, no compromise. Download a free 30-day trial now.
-
5
Radare2
UNIX-like reverse engineering framework and command-line toolset
A free/libre toolchain for easing several low-level tasks like forensics, software reverse engineering, exploiting, and debugging. It is composed by a bunch of libraries (which are extended with plugins) and programs that can be automated with almost any programming language. It is recommended to install it from git, alternatively, you can pick the last release (every 6 weeks) from Github. Batch, Commandline, visual, and panels interactive modes. Embedded webserver with js scripting and WebUI. Assemble and disassemble a large list of CPUs. Runs on Windows and any other UNIX flavor out there. Analyze and emulate code with ESIL. Native debugger and GDB, WINDBG, QNX, and FRIDA. Navigate ASCII-art control flow graphs. Ability to patch binaries, and modify code or data. Search for patterns, magic headers, and function signatures. Easy to extend and modify. Commandline, C API, script with r2pipe in any language. -
6
Apktool
A tool for reverse engineering Android apk files
A tool for reverse engineering 3rd party, closed, binary Android apps. It can decode resources to nearly original form and rebuild them after making some modifications. It also makes working with an app easier because of the project like file structure and automation of some repetitive tasks like building apk, etc. It is NOT intended for piracy and other non-legal uses. It could be used for localizing, adding some features or support for custom platforms, analyzing applications and much more. The decode option on Apktool can be invoked either from d or decode. In order to run a rebuilt application. You must resign the application. Android documentation can help with this. As you probably know, Android apps utilize code and resources that are found on the Android OS itself. These are known as framework resources and Apktool relies on these to properly decode and build apks. -
7
REA: Reverse Engineer Anything
Reverse engineer anything with agents, from app behavior
REA (Reverse Engineer Anything) is an open-source, AI-powered reverse engineering toolkit that enables developers and AI agents to analyze software applications, native binaries, and runtime behavior. The platform uses the Model Context Protocol (MCP) to connect AI coding assistants with tools for inspecting compiled code, application structures, and software functionality. It supports reverse engineering of native executables, JavaScript and Electron applications, .NET assemblies, Android APKs, WebAssembly modules, firmware, and websites. REA integrates with reverse engineering tools such as Ghidra, Hopper, and IDA to examine assembly instructions, decompiled pseudocode, symbols, functions, and code references. Developers can use the platform to investigate how software features work, trace application behavior, identify implementation details, and reconstruct functionality in their own projects. REA supports AI coding assistants including Claude Code, Codex, Cursor, Gemini CLI, etc. -
8
ImHex
A Hex Editor for Reverse Engineers, Programmers
ImHex is a free, open-source hex editor designed for reverse engineers, software developers, cybersecurity professionals, and digital forensics analysts. The software provides advanced tools for inspecting, editing, and analyzing binary files through a modern, customizable interface. ImHex features a powerful Pattern Language that allows users to define custom data structures, parse complex file formats, and visualize binary information. Its integrated disassembler, data inspector, entropy analyzer, and YARA scanning capabilities make it suitable for malware analysis, vulnerability research, and reverse engineering. The platform supports large files, process memory inspection, remote file access, and advanced searching across multiple data formats and encodings. Available for Windows, macOS, Linux, and FreeBSD, ImHex combines powerful binary analysis capabilities with a user-friendly interface, extensive customization options, and an expandable ecosystem of plugins and patterns. -
9
Bytecode Viewer
A reverse engineering suite (decompiler, editor, debugger and more)
Some of Bytecode Viewer features are that it provides Java Decompiling with Six different decompilers (DJ-GUI/Core, Procyon, CFR, Fernflower, Krakatau, and JADX-Core). Bytecode Decompiling with CFIDE. Android APK integrated with Dex2Jar. Securely launch Java applications and insert hooks via EZ-Injection. Scan for malicious code with the Malicious Code Scanner plugin. Export as DEX, Jar, Class, Zip or Java Source File. Open Android APKs, Android DEX, Java Class Files and Java Jars. (WAR & JSP Support!). Extensively configurable, over 100+ settings! Works seamlessly with all Operating Systems. Integrates BCV into Windows by installing it, it'll associate all .class, .dex and .apk to open with BCV. You can view Jar & APK Resources with ease by APKTool.jar integration. It is 100% free and open sourced under GPL v3 CopyLeft. -
Build Agents and Models on One PlatformGemini Enterprise Agent Platform is Google Cloud's comprehensive platform for developers to build, scale, govern, and optimize agents and models. Choose from Google's most advanced models and third-party models like Anthropic's Claude Model Family.
-
10
APK Studio
Open-source, cross platform Qt based IDE for reverse-engineering
Open-source, cross-platform Qt based IDE for reverse-engineering Android application packages. It features a friendly IDE-like layout including code editor with syntax highlighting support for *.smali code files. If you are just willing to quickly decompile an Android app, you can make use of DeAPK - Online APK Decompiler which lets you decompile an Android app using apktool and jadx. -
11
FernFlower
Decompiler from Java bytecode to Java, used in IntelliJ IDEA
Fernflower is an open-source Java decompiler originally developed by JetBrains that takes compiled Java bytecode and reconstructs readable source code, helping developers understand, debug, and recover lost Java code from .class files. It works by analyzing the structure of bytecode and inferring higher-level constructs like loops, conditionals, generics, and exception handling to produce Java source that is as close as possible to what a human would have written, making it useful for both reverse engineering and educational purposes. Fernflower is integrated into popular Java IDEs and tools where decompilation is needed, and its robust analysis handles a wide range of language features introduced across multiple Java versions. Because it outputs clean, structured, and often compilable code, developers use it for auditing binaries, exploring third-party libraries without source, and recovering parts of legacy systems where source was lost or unavailable. -
12
Hackingtool
ALL IN ONE Hacking Tool For Hackers
HackingTool by Z4nzu is a large collection (“all-in-one”) of tools and scripts for penetration testing / hacking / OSINT etc. It bundles many utilities (port scanners, payload injectors, web attack tools, phishing tools, wireless attack tools, reverse engineering, etc.) into a menu interface. Includes many individual tools, often wrappers or aggregations of existing well-known tools (e.g. port scanners, web attack tools, steganography, hash cracking etc.). A menu interface offering categories: reconnaissance, payload creation, wireless attacks, reverse engineering, exploit frameworks, etc. Users can pick which tool to run. It is intended more for “ethical / lab / educational” hacking contexts rather than production or stealth scenarios. It depends a lot on external tools, grants, and root privileges in many cases. -
13
Zydis
Fast and lightweight x86/x86-64 disassembler and code generation lib
Zydis is a fast and lightweight disassembler library designed for decoding x86 and x86-64 machine code into human-readable assembly instructions. It focuses on performance and accuracy, making it suitable for applications such as reverse engineering, debugging, and binary analysis. The library provides detailed information about decoded instructions, including operands, prefixes, and instruction lengths, enabling deep inspection of executable code. It is designed to be easy to integrate, with a clean and minimal API that reduces complexity for developers. Zydis also emphasizes portability, allowing it to run across multiple platforms and environments. Its efficiency makes it particularly useful in scenarios where large volumes of code need to be analyzed quickly. Overall, zydis serves as a reliable and high-performance tool for understanding and working with machine-level instructions. -
14
pwndbg
Exploit Development and Reverse Engineering with GDB Made Easy
Pwndbg is a fast, simple and lightweight tool for modern debugging. It improves debugging experience with the strength of GDB for low-level software developers, hardware hackers, reverse engineers, and exploit developers. It provides features crucial for efficient debugging in the world of low-level programming. Vanilla GDB is terrible to use for reverse engineering and exploit development. Typing x/g30x $esp is not fun, and does not confer much information. The year is 2024 and GDB still lacks a real hexdump command! GDB's syntax is arcane and difficult to approach. Windbg users are completely lost when they occasionally need to bump into GDB. -
15
OWASP MASTG
Manual for mobile app security testing and reverse engineering
OWASP Mobile Application Security Testing Guide (MASTG) is a free, open-source resource that provides comprehensive guidance for testing and evaluating the security of mobile applications. Developed by the Open Worldwide Application Security Project (OWASP), the guide offers practical methodologies, technical instructions, and testing procedures for identifying security vulnerabilities in Android and iOS applications. MASTG covers a wide range of mobile security topics, including data storage, cryptography, authentication, network communication, platform interactions, and reverse engineering. The guide aligns with the OWASP Mobile Application Security Verification Standard (MASVS) and Mobile Application Security Weakness Enumeration (MASWE), helping organizations evaluate applications against established security requirements. Security professionals can use its detailed testing techniques, tool recommendations, practical examples, and hands-on exercises. -
16
LAMDA
Android reverse engineering & automation framework
Android reverse engineering & automation framework. The most powerful Android capture/reverse/HOOK & cloud phone/remote desktop/automation framework in history, your work has never been so easy and fast. LAMDA is an auxiliary framework for reverse engineering and automation. It is designed to reduce the time and trivial problems of security analysts and application testers. It replaces a large number of manual operations with a programmed interface. It is not a single-function framework. To give you a general idea of its usefulness: Do you install various agents, plug-ins, or point-and-click settings on your phone to complete your work? Do you want to operate a mobile phone thousands of miles away in a different place? Do you have the need to programmatically control your phone? Are you still paying for expensive IP switching , remote ADB debugging , RPA automation and even logcat logs from some cloud mobile phone manufacturers? If so, then yes, just one LAMDA can solve all this. -
17
Capstone
Capstone disassembly/disassembler framework
Capstone is a disassembly framework with the target of becoming the ultimate disasm engine for binary analysis and reversing in the security community. Created by Nguyen Anh Quynh, then developed and maintained by a small community, Capstone offers some unparalleled features. Support multiple hardware architectures: ARM, ARM64 (ARMv8), Ethereum VM, M68K, Mips, MOS65XX, PPC, Sparc, SystemZ, TMS320C64X, M680X, XCore and X86 (including X86_64). Having clean/simple/lightweight/intuitive architecture-neutral API. Provide details on disassembled instruction (called “decomposer” by others). Provide semantics of the disassembled instruction, such as list of implicit registers read & written. Implemented in pure C language, with lightweight bindings for D, Clojure, F#, Common Lisp, Visual Basic, PHP, PowerShell, Emacs, Haskell, Perl, Python, Ruby, C#, NodeJS, Java, GO, C++, OCaml, Lua, Rust, Delphi, Free Pascal & Vala (ready either in main code, or provided externally by the community). -
18
MobileHackersWeapons
Collection of cool tools used by Mobile hackers
MobileHackersWeapons is a curated collection of tools for Android and iOS security analysis, testing, and reverse engineering. The catalog groups projects by purpose rather than bundling them into a single executable toolkit. Categories include application analysis, penetration testing, proxies, reverse engineering, scanners, monitoring, device utilities, NFC, Bluetooth, jailbreak research, and certificate-unpinning tools. Listed projects span many languages and include both desktop utilities and tools that run directly on mobile devices. Android resources cover APK analysis, decompilation, network monitoring, instrumentation, and device interaction. iOS resources include runtime exploration, binary analysis, device automation, and research tooling. The repository is intended as a discovery reference for authorized mobile-security testing and research. -
19
reverse-skill
Reverse Engineering and Authorized Penetration Testing
reverse-skill is a cybersecurity skill router for AI coding agents working on authorized reverse engineering, penetration testing, CTF, and security research tasks. It analyzes the target type and directs the agent to an appropriate methodology instead of relying on improvised commands. Its playbooks cover Android and iOS applications, native binaries, .NET, JavaScript, firmware, malware, APIs, supply chains, and other specialized scenarios. The package checks locally available tools and can bootstrap supporting scripts, MCP servers, and utilities when needed. Scope gates, case initialization, timelines, evidence chains, reports, and field journals encourage repeatable and auditable work. It supports clients such as Claude Code, Codex CLI, Cursor, and Cline across Windows, Linux, macOS, and Kali Linux. The repository also preserves reusable lessons so later investigations can avoid previously documented mistakes. -
20
iced
Blazing fast and correct x86/x64 disassembler, assembler, decoder, etc
iced is a powerful and feature-rich disassembly and assembly library for x86 and x64 architectures, designed to provide accurate decoding, encoding, and formatting of machine instructions. It supports multiple programming languages, including C#, Rust, and Python, making it accessible to a wide range of developers. The library offers both disassembly and assembly capabilities, allowing users to convert between machine code and human-readable instructions in both directions. It includes advanced features such as instruction formatting, symbol resolution, and customizable output, enabling precise control over how code is represented. iced is optimized for performance and correctness, ensuring reliable results even in complex scenarios. It is commonly used in tools for debugging, reverse engineering, and binary analysis. Overall, iced provides a comprehensive solution for working with low-level machine code in modern software systems. -
21
The Bitdefender disassembler
bddisasm is a fast, lightweight, x86/x64 instruction decoder
The Bitdefender disassembler is a highly optimized, lightweight x86/x64 instruction decoder designed for security, reverse engineering, and low-level systems analysis. It focuses on decoding machine instructions with high precision while providing detailed metadata about each instruction, including operands, access modes, CPU flags, and feature requirements. Unlike many disassemblers, bddisasm is built with zero dynamic memory allocation and no external dependencies, making it extremely portable and suitable for constrained environments such as kernels, hypervisors, and embedded systems. The project also includes a companion component called bdshemu, which provides a minimal instruction emulator capable of analyzing shellcode-like behavior in a controlled environment. Its performance is a key strength, achieving millions of decoded instructions per second while maintaining thread safety and deterministic behavior. -
22
FISSURE
The RF and reverse engineering framework for everyone
FISSURE is an open-source radio frequency analysis and signal intelligence framework built to support software-defined radio research, wireless security experimentation, and protocol reverse engineering. The project brings together tools for capturing, inspecting, decoding, replaying, and analyzing RF signals across a wide range of wireless technologies. It is designed as a practical environment for researchers and operators who need to move from raw spectrum observation to structured investigation without stitching together too many separate utilities by hand. The platform supports workflows related to signal discovery, demodulation, packet inspection, fuzzing, and attack simulation, making it useful for both defensive research and controlled lab testing. Its architecture is oriented toward extensibility, so users can integrate additional hardware, signal-processing components, and protocol-specific modules depending on their needs. -
23
WebHackersWeapons
A collection of cool tools used by Web hackers
WebHackersWeapons is a community-maintained catalog of tools used for web application security research and testing. Rather than providing one scanner, it indexes a broad ecosystem of specialized open-source security utilities. The collection spans analysis, penetration testing, proxies, scanners, reconnaissance, reverse engineering, fuzzing, automation, and supporting utilities. Individual entries link to their original projects so researchers can evaluate tools according to a particular assessment task. The repository is organized into categorized data that can be maintained and expanded through community contributions. It also belongs to a wider family of curated security-tool collections maintained by the same author. The catalog is primarily intended for bug bounty, authorized testing, and defensive security research. -
24
apk-reverse
Suitable for Android APK reverse engineering analysis
apk-reverse is an Agent Skill for structured Android application reverse-engineering work in authorized research environments. It is designed for Claude Code, Codex, and other systems that support the Agent Skills format rather than as a conventional end-user application. Its scope includes APK analysis, debloating, controlled Dex modifications, repacking, runtime investigation, and client-versus-server diagnosis. A gated workflow forces agents to verify assumptions, environment state, and control builds before making changes. Detailed references catalog common failure modes involving signing, packaging, native code, protected applications, and runtime behavior. Parameterized scripts, environment checks, tests, and evidence records help agents perform repeatable analysis while the project explicitly restricts its intended use to owned, authorized, or sandboxed targets. -
25
sperm
Collection of reverse engineering articles curated for learning
sperm is a curated repository that gathers a collection of notable articles related to reverse engineering and software analysis. It primarily acts as a knowledge archive where previously published technical posts are compiled and organized for easier access and long-term reference. These articles originate from multiple technical communities and platforms and are exported into Markdown format to maintain a consistent and readable structure. sperm focuses on educational material that explores reverse engineering techniques, mobile analysis, and related technical discussions. Its goal is to preserve useful learning resources and make them easier for researchers, students, and security enthusiasts to browse in a single location. sperm emphasizes that the materials are intended strictly for study and technical exchange rather than misuse. By maintaining these articles in a version-controlled repository, the content remains accessible and easier to navigate.
