Open Source Linux Reverse Engineering Tools
Sort By:
Reverse Engineering Tools for Linux
View 1345 business solutionsBrowse free open source Reverse Engineering tools and projects for Linux below. Use the toggles on the left to filter open source Reverse Engineering tools by OS, license, language, programming language, and project status.
-
Build Securely on Azure with Proven FrameworksMoving to the cloud brings new challenges. How can you manage a larger attack surface while ensuring great network performance? Turn to Fortinet’s Tested Reference Architectures, blueprints for designing and securing cloud environments built by cybersecurity experts. Learn more and explore use cases in this white paper.
-
Go from Code to Production URL in SecondsSkip the Kubernetes configs. Cloud Run handles HTTPS, scaling, and infrastructure automatically. Two million requests free per month.
-
1
Ghidra
Ghidra is a software reverse engineering (SRE) framework
Ghidra is a free and open-source reverse engineering framework developed by the NSA for analyzing compiled software. It supports a wide array of instruction sets and executable formats, offering features such as decompilation, disassembly, scripting, and interactive graphing. Designed for security researchers and analysts, Ghidra provides a robust environment for understanding malware, auditing code, and performing software forensics. It includes both GUI-based and headless analysis modes. -
2
Il2CppDumper
Unity il2cpp reverse engineer
Il2CppDumper is a Unity IL2CPP reverse engineering tool for analyzing supported Unity applications and game binaries. It can restore DLL metadata structures without restoring original code, which helps researchers inspect classes, methods, fields, MonoBehaviour data, and MonoScript information. The tool supports executable formats such as ELF, ELF64, Mach-O, PE, NSO, and WASM. It supports Unity versions from 5.3 through 2022.2, according to the repository documentation. Il2CppDumper can generate helper scripts for IDA, Ghidra, and Binary Ninja, along with structure headers and JSON outputs. It is best suited for authorized reverse engineering, interoperability research, security analysis, modding research, and educational binary analysis. -
3
frida
Dynamic instrumentation toolkit for developers
Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers. Inject your own scripts into black box processes. Hook any function, spy on crypto APIs or trace private application code, no source code needed. Edit, hit save, and instantly see the results. All without compilation steps or program restarts. Works on Windows, macOS, GNU/Linux, iOS, Android, and QNX. Install the Node.js bindings from npm, grab a Python package from PyPI, or use Frida through its Swift bindings, .NET bindings, Qt/Qml bindings, or C API. Frida is and will always be free software (free as in freedom). We want to empower the next generation of developer tools, and help other free software developers achieve interoperability through reverse engineering. We are proud that NowSecure is using Frida to do fast, deep analysis of mobile apps at scale. Frida has a comprehensive test-suite and has gone through years of rigorous testing across a broad range of use-cases. -
4
Radare2
UNIX-like reverse engineering framework and command-line toolset
A free/libre toolchain for easing several low-level tasks like forensics, software reverse engineering, exploiting, and debugging. It is composed by a bunch of libraries (which are extended with plugins) and programs that can be automated with almost any programming language. It is recommended to install it from git, alternatively, you can pick the last release (every 6 weeks) from Github. Batch, Commandline, visual, and panels interactive modes. Embedded webserver with js scripting and WebUI. Assemble and disassemble a large list of CPUs. Runs on Windows and any other UNIX flavor out there. Analyze and emulate code with ESIL. Native debugger and GDB, WINDBG, QNX, and FRIDA. Navigate ASCII-art control flow graphs. Ability to patch binaries, and modify code or data. Search for patterns, magic headers, and function signatures. Easy to extend and modify. Commandline, C API, script with r2pipe in any language. -
Fully Managed MySQL, PostgreSQL, and SQL ServerCloud SQL handles your database ops end to end, so you can focus on your app.
-
5
REA: Reverse Engineer Anything
Reverse engineer anything with agents, from app behavior
REA (Reverse Engineer Anything) is an open-source, AI-powered reverse engineering toolkit that enables developers and AI agents to analyze software applications, native binaries, and runtime behavior. The platform uses the Model Context Protocol (MCP) to connect AI coding assistants with tools for inspecting compiled code, application structures, and software functionality. It supports reverse engineering of native executables, JavaScript and Electron applications, .NET assemblies, Android APKs, WebAssembly modules, firmware, and websites. REA integrates with reverse engineering tools such as Ghidra, Hopper, and IDA to examine assembly instructions, decompiled pseudocode, symbols, functions, and code references. Developers can use the platform to investigate how software features work, trace application behavior, identify implementation details, and reconstruct functionality in their own projects. REA supports AI coding assistants including Claude Code, Codex, Cursor, Gemini CLI, etc. -
6
APK Studio
Open-source, cross platform Qt based IDE for reverse-engineering
Open-source, cross-platform Qt based IDE for reverse-engineering Android application packages. It features a friendly IDE-like layout including code editor with syntax highlighting support for *.smali code files. If you are just willing to quickly decompile an Android app, you can make use of DeAPK - Online APK Decompiler which lets you decompile an Android app using apktool and jadx. -
7
Hackingtool
ALL IN ONE Hacking Tool For Hackers
HackingTool by Z4nzu is a large collection (“all-in-one”) of tools and scripts for penetration testing / hacking / OSINT etc. It bundles many utilities (port scanners, payload injectors, web attack tools, phishing tools, wireless attack tools, reverse engineering, etc.) into a menu interface. Includes many individual tools, often wrappers or aggregations of existing well-known tools (e.g. port scanners, web attack tools, steganography, hash cracking etc.). A menu interface offering categories: reconnaissance, payload creation, wireless attacks, reverse engineering, exploit frameworks, etc. Users can pick which tool to run. It is intended more for “ethical / lab / educational” hacking contexts rather than production or stealth scenarios. It depends a lot on external tools, grants, and root privileges in many cases. -
8
Zydis
Fast and lightweight x86/x86-64 disassembler and code generation lib
Zydis is a fast and lightweight disassembler library designed for decoding x86 and x86-64 machine code into human-readable assembly instructions. It focuses on performance and accuracy, making it suitable for applications such as reverse engineering, debugging, and binary analysis. The library provides detailed information about decoded instructions, including operands, prefixes, and instruction lengths, enabling deep inspection of executable code. It is designed to be easy to integrate, with a clean and minimal API that reduces complexity for developers. Zydis also emphasizes portability, allowing it to run across multiple platforms and environments. Its efficiency makes it particularly useful in scenarios where large volumes of code need to be analyzed quickly. Overall, zydis serves as a reliable and high-performance tool for understanding and working with machine-level instructions. -
9
pwndbg
Exploit Development and Reverse Engineering with GDB Made Easy
Pwndbg is a fast, simple and lightweight tool for modern debugging. It improves debugging experience with the strength of GDB for low-level software developers, hardware hackers, reverse engineers, and exploit developers. It provides features crucial for efficient debugging in the world of low-level programming. Vanilla GDB is terrible to use for reverse engineering and exploit development. Typing x/g30x $esp is not fun, and does not confer much information. The year is 2024 and GDB still lacks a real hexdump command! GDB's syntax is arcane and difficult to approach. Windbg users are completely lost when they occasionally need to bump into GDB. -
Paessler: Easy to Use With Enterprise Power. Free TrialYou shouldn't have to choose between a monitoring tool that's easy to use and one that's powerful enough for a complex environment. PRTG's low-code interface lets any admin build dashboards, set alerts and monitor devices without scripting, while custom sensors and full API access are there when your team needs deeper control. One platform, no compromise. Download a free 30-day trial now.
-
10
Capstone
Capstone disassembly/disassembler framework
Capstone is a disassembly framework with the target of becoming the ultimate disasm engine for binary analysis and reversing in the security community. Created by Nguyen Anh Quynh, then developed and maintained by a small community, Capstone offers some unparalleled features. Support multiple hardware architectures: ARM, ARM64 (ARMv8), Ethereum VM, M68K, Mips, MOS65XX, PPC, Sparc, SystemZ, TMS320C64X, M680X, XCore and X86 (including X86_64). Having clean/simple/lightweight/intuitive architecture-neutral API. Provide details on disassembled instruction (called “decomposer” by others). Provide semantics of the disassembled instruction, such as list of implicit registers read & written. Implemented in pure C language, with lightweight bindings for D, Clojure, F#, Common Lisp, Visual Basic, PHP, PowerShell, Emacs, Haskell, Perl, Python, Ruby, C#, NodeJS, Java, GO, C++, OCaml, Lua, Rust, Delphi, Free Pascal & Vala (ready either in main code, or provided externally by the community). -
11
MobileHackersWeapons
Collection of cool tools used by Mobile hackers
MobileHackersWeapons is a curated collection of tools for Android and iOS security analysis, testing, and reverse engineering. The catalog groups projects by purpose rather than bundling them into a single executable toolkit. Categories include application analysis, penetration testing, proxies, reverse engineering, scanners, monitoring, device utilities, NFC, Bluetooth, jailbreak research, and certificate-unpinning tools. Listed projects span many languages and include both desktop utilities and tools that run directly on mobile devices. Android resources cover APK analysis, decompilation, network monitoring, instrumentation, and device interaction. iOS resources include runtime exploration, binary analysis, device automation, and research tooling. The repository is intended as a discovery reference for authorized mobile-security testing and research. -
12
reverse-skill
Reverse Engineering and Authorized Penetration Testing
reverse-skill is a cybersecurity skill router for AI coding agents working on authorized reverse engineering, penetration testing, CTF, and security research tasks. It analyzes the target type and directs the agent to an appropriate methodology instead of relying on improvised commands. Its playbooks cover Android and iOS applications, native binaries, .NET, JavaScript, firmware, malware, APIs, supply chains, and other specialized scenarios. The package checks locally available tools and can bootstrap supporting scripts, MCP servers, and utilities when needed. Scope gates, case initialization, timelines, evidence chains, reports, and field journals encourage repeatable and auditable work. It supports clients such as Claude Code, Codex CLI, Cursor, and Cline across Windows, Linux, macOS, and Kali Linux. The repository also preserves reusable lessons so later investigations can avoid previously documented mistakes. -
13
iced
Blazing fast and correct x86/x64 disassembler, assembler, decoder, etc
iced is a powerful and feature-rich disassembly and assembly library for x86 and x64 architectures, designed to provide accurate decoding, encoding, and formatting of machine instructions. It supports multiple programming languages, including C#, Rust, and Python, making it accessible to a wide range of developers. The library offers both disassembly and assembly capabilities, allowing users to convert between machine code and human-readable instructions in both directions. It includes advanced features such as instruction formatting, symbol resolution, and customizable output, enabling precise control over how code is represented. iced is optimized for performance and correctness, ensuring reliable results even in complex scenarios. It is commonly used in tools for debugging, reverse engineering, and binary analysis. Overall, iced provides a comprehensive solution for working with low-level machine code in modern software systems. -
14
The Bitdefender disassembler
bddisasm is a fast, lightweight, x86/x64 instruction decoder
The Bitdefender disassembler is a highly optimized, lightweight x86/x64 instruction decoder designed for security, reverse engineering, and low-level systems analysis. It focuses on decoding machine instructions with high precision while providing detailed metadata about each instruction, including operands, access modes, CPU flags, and feature requirements. Unlike many disassemblers, bddisasm is built with zero dynamic memory allocation and no external dependencies, making it extremely portable and suitable for constrained environments such as kernels, hypervisors, and embedded systems. The project also includes a companion component called bdshemu, which provides a minimal instruction emulator capable of analyzing shellcode-like behavior in a controlled environment. Its performance is a key strength, achieving millions of decoded instructions per second while maintaining thread safety and deterministic behavior. -
15
FISSURE
The RF and reverse engineering framework for everyone
FISSURE is an open-source radio frequency analysis and signal intelligence framework built to support software-defined radio research, wireless security experimentation, and protocol reverse engineering. The project brings together tools for capturing, inspecting, decoding, replaying, and analyzing RF signals across a wide range of wireless technologies. It is designed as a practical environment for researchers and operators who need to move from raw spectrum observation to structured investigation without stitching together too many separate utilities by hand. The platform supports workflows related to signal discovery, demodulation, packet inspection, fuzzing, and attack simulation, making it useful for both defensive research and controlled lab testing. Its architecture is oriented toward extensibility, so users can integrate additional hardware, signal-processing components, and protocol-specific modules depending on their needs. -
16
WebHackersWeapons
A collection of cool tools used by Web hackers
WebHackersWeapons is a community-maintained catalog of tools used for web application security research and testing. Rather than providing one scanner, it indexes a broad ecosystem of specialized open-source security utilities. The collection spans analysis, penetration testing, proxies, scanners, reconnaissance, reverse engineering, fuzzing, automation, and supporting utilities. Individual entries link to their original projects so researchers can evaluate tools according to a particular assessment task. The repository is organized into categorized data that can be maintained and expanded through community contributions. It also belongs to a wider family of curated security-tool collections maintained by the same author. The catalog is primarily intended for bug bounty, authorized testing, and defensive security research. -
17
sperm
Collection of reverse engineering articles curated for learning
sperm is a curated repository that gathers a collection of notable articles related to reverse engineering and software analysis. It primarily acts as a knowledge archive where previously published technical posts are compiled and organized for easier access and long-term reference. These articles originate from multiple technical communities and platforms and are exported into Markdown format to maintain a consistent and readable structure. sperm focuses on educational material that explores reverse engineering techniques, mobile analysis, and related technical discussions. Its goal is to preserve useful learning resources and make them easier for researchers, students, and security enthusiasts to browse in a single location. sperm emphasizes that the materials are intended strictly for study and technical exchange rather than misuse. By maintaining these articles in a version-controlled repository, the content remains accessible and easier to navigate. -
18
BinExport
Export disassemblies into Protocol Buffers
BinExport is a disassembly export plugin developed by Google as part of the BinDiff ecosystem, designed for reverse engineering and binary analysis. It works with popular disassemblers including IDA Pro, Binary Ninja, and Ghidra, enabling the export of disassembly data into a structured Protocol Buffer format. This exported data can then be used for binary comparison, diffing, and advanced analysis tasks through BinDiff or other compatible tools. BinExport captures detailed information such as instructions, functions, control flow graphs, and metadata, providing a machine-readable representation of a program’s disassembled structure. It supports multiple export formats, including binary, text, and statistics outputs, and can be used interactively or via scripting (IDC, IDAPython, or Ghidra’s headless mode). The project includes complete build instructions for Linux, macOS, and Windows, ensuring reproducibility across platforms. -
19
Miasm
Reverse engineering framework in Python
The Miasm intermediate representation is used for multiple task: emulation through its jitter engine, symbolic execution, DSE, program analysis, but the intermediate representation can be a bit hard to read. We will present in this article new tricks Miasm has learned in 2018. Among them, the SSA/Out-of-SSA transformation, expression propagation and high-level operators can be joined to “lift” Miasm IR to a more human-readable language. We use graphviz to illustrate some graphs. Its layout does not always totally conform with a reverse engineering “ideal view”, so please be tolerant of those odd graphs. Miasm is not the first tool to implement this feature. But, well, as the tool already had everything needed to implement DSE, it was just a matter of time before these features landed in the main branch. -
20
ngrev
Tool for reverse engineering of Angular applications
Graphical tool for reverse engineering of Angular projects. It allows you to navigate in the structure of your application and observe the relationship between the different modules, providers, and directives. The tool performs static code analysis which means that you don't have to run your application in order to use it. ngrev is not maintained by the Angular team. It's a side project developed by the open-source community. The application is not signed, so you may have to explicitly allow your mac to run it in System Preferences. You can add your own theme by creating a [theme-name].theme.json file in Electron [userData]/themes. For a sample theme see Dark. Your application needs to be compatible with Angular Ivy compiler. ngrev is not tested with versions older than v11. To stay up to date check the update guide on angular.io. -
21
After a program has been thrown into the world in binary form, it can boomerang back as source code. The Boomerang reverse engineering framework is the first general native executable decompiler available to the public.
-
22
Cutter
Free and Open Source Reverse Engineering Platform
Cutter is a free and open-source graphical reverse-engineering platform powered by the Rizin framework. It provides a visual interface for inspecting binaries, functions, strings, references, control flow, and low-level program structure. The application is designed to make advanced binary analysis more approachable without sacrificing access to Rizin’s underlying capabilities. Its interface can be extended with Python and native C++ plugins. Community integrations add features such as decompilers and code-coverage visualization. Cutter runs on Linux, macOS, and Windows and is distributed through native packages, portable builds, and Docker-based options. It is intended for software analysis, debugging, research, and authorized security work. -
23
LegacyInsight
Legacy reverse engineering tool
LegacyInsight is an AI-powered reverse engineering platform that transforms legacy software systems into comprehensible business logic. Using cutting-edge GenAI, it analyzes legacy and extracts core operations, business rules, and data transformations—all translated into natural language. LegacyInsight supports enterprise-grade systems built on Java, COBOL, NET and other legacy stacks, helping organizations reclaim understanding of business-critical code. -
24
gendasm
Generic Code-Seeking Diassembler with Fuzzy-Function Analyzer
GenDasm is a Generic Code-Seeking Diassembler engine. It allows you to enter known starting vectors for a given code image for the micro. It will disassemble the code and follow through branches to assist in the separation of code and data. Its included Fuzzy Function Analyzer companion uses a DNA Sequence Alignment Algorithm to locate similar code in multiple binaries to facilitate reverse-engineering and/or code recovery. The original purpose of the Fuzzy Function Analyzer was to assist in code recovery where the source code for the current binaries got lost, yet the source code for an old binary was retained. The Fuzzy Function Analyzer allows you to match up known functions between the two binaries so you can concentrate on disassembling and reverse engineering the parts that are different and recover the code for the current binary that got lost. -
25
minuteProject
Reverse-engineering tool
MinuteProject is reverse-engineering tool. It generates application stacks for opensource technologies. Backend technologies: iBatis, Hibernate, JPA, JPA2, springframework. REST: JEE-jersey, CXF, springMVC. Front-end: Openxava, Grails, Play. Methodology: FitNesse. In incubator: vaadin, jsf-primefaces, jooq, rails.
- Previous
- You're on page 1
- Next
