Open Source Windows Reverse Engineering Tools
Sort By:
Reverse Engineering Tools for Windows
View 2024 business solutionsBrowse free open source Reverse Engineering tools and projects for Windows below. Use the toggles on the left to filter open source Reverse Engineering tools by OS, license, language, programming language, and project status.
-
MongoDB Atlas runs apps anywhereMongoDB Atlas gives you the freedom to build and run modern applications anywhere—across AWS, Azure, and Google Cloud. With global availability in over 115 regions, Atlas lets you deploy close to your users, meet compliance needs, and scale with confidence across any geography.
-
Custom VMs From 1 to 96 vCPUs With 99.95% UptimeLive migration and automatic failover keep workloads online through maintenance. One free e2-micro VM every month.
-
1
Ghidra
Ghidra is a software reverse engineering (SRE) framework
Ghidra is a free and open-source reverse engineering framework developed by the NSA for analyzing compiled software. It supports a wide array of instruction sets and executable formats, offering features such as decompilation, disassembly, scripting, and interactive graphing. Designed for security researchers and analysts, Ghidra provides a robust environment for understanding malware, auditing code, and performing software forensics. It includes both GUI-based and headless analysis modes. -
2
GenP
This repository preserves source materials and related documentation
GenP is an archival repository that preserves source materials, scripts, and documentation related to a tool historically associated with modifying proprietary software behavior. The project itself does not function as an actively maintained application but instead serves as a research-oriented collection intended for reverse engineering study and educational analysis. It explicitly positions itself as a reference resource, emphasizing that no support or guarantees are provided for compatibility with modern systems. The repository includes materials written in scripting languages such as AutoIt and PowerShell, reflecting its origins in automation and system-level interaction. It also highlights legal and ethical considerations, stating clearly that modifying proprietary software may violate license agreements and that the materials are provided strictly for informational purposes. -
3
Il2CppDumper
Unity il2cpp reverse engineer
Il2CppDumper is a Unity IL2CPP reverse engineering tool for analyzing supported Unity applications and game binaries. It can restore DLL metadata structures without restoring original code, which helps researchers inspect classes, methods, fields, MonoBehaviour data, and MonoScript information. The tool supports executable formats such as ELF, ELF64, Mach-O, PE, NSO, and WASM. It supports Unity versions from 5.3 through 2022.2, according to the repository documentation. Il2CppDumper can generate helper scripts for IDA, Ghidra, and Binary Ninja, along with structure headers and JSON outputs. It is best suited for authorized reverse engineering, interoperability research, security analysis, modding research, and educational binary analysis. -
4
frida
Dynamic instrumentation toolkit for developers
Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers. Inject your own scripts into black box processes. Hook any function, spy on crypto APIs or trace private application code, no source code needed. Edit, hit save, and instantly see the results. All without compilation steps or program restarts. Works on Windows, macOS, GNU/Linux, iOS, Android, and QNX. Install the Node.js bindings from npm, grab a Python package from PyPI, or use Frida through its Swift bindings, .NET bindings, Qt/Qml bindings, or C API. Frida is and will always be free software (free as in freedom). We want to empower the next generation of developer tools, and help other free software developers achieve interoperability through reverse engineering. We are proud that NowSecure is using Frida to do fast, deep analysis of mobile apps at scale. Frida has a comprehensive test-suite and has gone through years of rigorous testing across a broad range of use-cases. -
Paessler: Easy to Use With Enterprise Power. Free TrialYou shouldn't have to choose between a monitoring tool that's easy to use and one that's powerful enough for a complex environment. PRTG's low-code interface lets any admin build dashboards, set alerts and monitor devices without scripting, while custom sensors and full API access are there when your team needs deeper control. One platform, no compromise. Download a free 30-day trial now.
-
5
Radare2
UNIX-like reverse engineering framework and command-line toolset
A free/libre toolchain for easing several low-level tasks like forensics, software reverse engineering, exploiting, and debugging. It is composed by a bunch of libraries (which are extended with plugins) and programs that can be automated with almost any programming language. It is recommended to install it from git, alternatively, you can pick the last release (every 6 weeks) from Github. Batch, Commandline, visual, and panels interactive modes. Embedded webserver with js scripting and WebUI. Assemble and disassemble a large list of CPUs. Runs on Windows and any other UNIX flavor out there. Analyze and emulate code with ESIL. Native debugger and GDB, WINDBG, QNX, and FRIDA. Navigate ASCII-art control flow graphs. Ability to patch binaries, and modify code or data. Search for patterns, magic headers, and function signatures. Easy to extend and modify. Commandline, C API, script with r2pipe in any language. -
6
REA: Reverse Engineer Anything
Reverse engineer anything with agents, from app behavior
REA (Reverse Engineer Anything) is an open-source, AI-powered reverse engineering toolkit that enables developers and AI agents to analyze software applications, native binaries, and runtime behavior. The platform uses the Model Context Protocol (MCP) to connect AI coding assistants with tools for inspecting compiled code, application structures, and software functionality. It supports reverse engineering of native executables, JavaScript and Electron applications, .NET assemblies, Android APKs, WebAssembly modules, firmware, and websites. REA integrates with reverse engineering tools such as Ghidra, Hopper, and IDA to examine assembly instructions, decompiled pseudocode, symbols, functions, and code references. Developers can use the platform to investigate how software features work, trace application behavior, identify implementation details, and reconstruct functionality in their own projects. REA supports AI coding assistants including Claude Code, Codex, Cursor, Gemini CLI, etc. -
7
ImHex
A Hex Editor for Reverse Engineers, Programmers
ImHex is a free, open-source hex editor designed for reverse engineers, software developers, cybersecurity professionals, and digital forensics analysts. The software provides advanced tools for inspecting, editing, and analyzing binary files through a modern, customizable interface. ImHex features a powerful Pattern Language that allows users to define custom data structures, parse complex file formats, and visualize binary information. Its integrated disassembler, data inspector, entropy analyzer, and YARA scanning capabilities make it suitable for malware analysis, vulnerability research, and reverse engineering. The platform supports large files, process memory inspection, remote file access, and advanced searching across multiple data formats and encodings. Available for Windows, macOS, Linux, and FreeBSD, ImHex combines powerful binary analysis capabilities with a user-friendly interface, extensive customization options, and an expandable ecosystem of plugins and patterns. -
8
APK Studio
Open-source, cross platform Qt based IDE for reverse-engineering
Open-source, cross-platform Qt based IDE for reverse-engineering Android application packages. It features a friendly IDE-like layout including code editor with syntax highlighting support for *.smali code files. If you are just willing to quickly decompile an Android app, you can make use of DeAPK - Online APK Decompiler which lets you decompile an Android app using apktool and jadx. -
9
FernFlower
Decompiler from Java bytecode to Java, used in IntelliJ IDEA
Fernflower is an open-source Java decompiler originally developed by JetBrains that takes compiled Java bytecode and reconstructs readable source code, helping developers understand, debug, and recover lost Java code from .class files. It works by analyzing the structure of bytecode and inferring higher-level constructs like loops, conditionals, generics, and exception handling to produce Java source that is as close as possible to what a human would have written, making it useful for both reverse engineering and educational purposes. Fernflower is integrated into popular Java IDEs and tools where decompilation is needed, and its robust analysis handles a wide range of language features introduced across multiple Java versions. Because it outputs clean, structured, and often compilable code, developers use it for auditing binaries, exploring third-party libraries without source, and recovering parts of legacy systems where source was lost or unavailable. -
Train ML Models With SQL You Already KnowBuild and deploy ML models using familiar SQL. Automate data prep with built-in Gemini. Query 1 TB and store 10 GB free monthly.
-
10
Hackingtool
ALL IN ONE Hacking Tool For Hackers
HackingTool by Z4nzu is a large collection (“all-in-one”) of tools and scripts for penetration testing / hacking / OSINT etc. It bundles many utilities (port scanners, payload injectors, web attack tools, phishing tools, wireless attack tools, reverse engineering, etc.) into a menu interface. Includes many individual tools, often wrappers or aggregations of existing well-known tools (e.g. port scanners, web attack tools, steganography, hash cracking etc.). A menu interface offering categories: reconnaissance, payload creation, wireless attacks, reverse engineering, exploit frameworks, etc. Users can pick which tool to run. It is intended more for “ethical / lab / educational” hacking contexts rather than production or stealth scenarios. It depends a lot on external tools, grants, and root privileges in many cases. -
11
Zydis
Fast and lightweight x86/x86-64 disassembler and code generation lib
Zydis is a fast and lightweight disassembler library designed for decoding x86 and x86-64 machine code into human-readable assembly instructions. It focuses on performance and accuracy, making it suitable for applications such as reverse engineering, debugging, and binary analysis. The library provides detailed information about decoded instructions, including operands, prefixes, and instruction lengths, enabling deep inspection of executable code. It is designed to be easy to integrate, with a clean and minimal API that reduces complexity for developers. Zydis also emphasizes portability, allowing it to run across multiple platforms and environments. Its efficiency makes it particularly useful in scenarios where large volumes of code need to be analyzed quickly. Overall, zydis serves as a reliable and high-performance tool for understanding and working with machine-level instructions. -
12
LAMDA
Android reverse engineering & automation framework
Android reverse engineering & automation framework. The most powerful Android capture/reverse/HOOK & cloud phone/remote desktop/automation framework in history, your work has never been so easy and fast. LAMDA is an auxiliary framework for reverse engineering and automation. It is designed to reduce the time and trivial problems of security analysts and application testers. It replaces a large number of manual operations with a programmed interface. It is not a single-function framework. To give you a general idea of its usefulness: Do you install various agents, plug-ins, or point-and-click settings on your phone to complete your work? Do you want to operate a mobile phone thousands of miles away in a different place? Do you have the need to programmatically control your phone? Are you still paying for expensive IP switching , remote ADB debugging , RPA automation and even logcat logs from some cloud mobile phone manufacturers? If so, then yes, just one LAMDA can solve all this. -
13
Capstone
Capstone disassembly/disassembler framework
Capstone is a disassembly framework with the target of becoming the ultimate disasm engine for binary analysis and reversing in the security community. Created by Nguyen Anh Quynh, then developed and maintained by a small community, Capstone offers some unparalleled features. Support multiple hardware architectures: ARM, ARM64 (ARMv8), Ethereum VM, M68K, Mips, MOS65XX, PPC, Sparc, SystemZ, TMS320C64X, M680X, XCore and X86 (including X86_64). Having clean/simple/lightweight/intuitive architecture-neutral API. Provide details on disassembled instruction (called “decomposer” by others). Provide semantics of the disassembled instruction, such as list of implicit registers read & written. Implemented in pure C language, with lightweight bindings for D, Clojure, F#, Common Lisp, Visual Basic, PHP, PowerShell, Emacs, Haskell, Perl, Python, Ruby, C#, NodeJS, Java, GO, C++, OCaml, Lua, Rust, Delphi, Free Pascal & Vala (ready either in main code, or provided externally by the community). -
14
MobileHackersWeapons
Collection of cool tools used by Mobile hackers
MobileHackersWeapons is a curated collection of tools for Android and iOS security analysis, testing, and reverse engineering. The catalog groups projects by purpose rather than bundling them into a single executable toolkit. Categories include application analysis, penetration testing, proxies, reverse engineering, scanners, monitoring, device utilities, NFC, Bluetooth, jailbreak research, and certificate-unpinning tools. Listed projects span many languages and include both desktop utilities and tools that run directly on mobile devices. Android resources cover APK analysis, decompilation, network monitoring, instrumentation, and device interaction. iOS resources include runtime exploration, binary analysis, device automation, and research tooling. The repository is intended as a discovery reference for authorized mobile-security testing and research. -
15
reverse-skill
Reverse Engineering and Authorized Penetration Testing
reverse-skill is a cybersecurity skill router for AI coding agents working on authorized reverse engineering, penetration testing, CTF, and security research tasks. It analyzes the target type and directs the agent to an appropriate methodology instead of relying on improvised commands. Its playbooks cover Android and iOS applications, native binaries, .NET, JavaScript, firmware, malware, APIs, supply chains, and other specialized scenarios. The package checks locally available tools and can bootstrap supporting scripts, MCP servers, and utilities when needed. Scope gates, case initialization, timelines, evidence chains, reports, and field journals encourage repeatable and auditable work. It supports clients such as Claude Code, Codex CLI, Cursor, and Cline across Windows, Linux, macOS, and Kali Linux. The repository also preserves reusable lessons so later investigations can avoid previously documented mistakes. -
16
iced
Blazing fast and correct x86/x64 disassembler, assembler, decoder, etc
iced is a powerful and feature-rich disassembly and assembly library for x86 and x64 architectures, designed to provide accurate decoding, encoding, and formatting of machine instructions. It supports multiple programming languages, including C#, Rust, and Python, making it accessible to a wide range of developers. The library offers both disassembly and assembly capabilities, allowing users to convert between machine code and human-readable instructions in both directions. It includes advanced features such as instruction formatting, symbol resolution, and customizable output, enabling precise control over how code is represented. iced is optimized for performance and correctness, ensuring reliable results even in complex scenarios. It is commonly used in tools for debugging, reverse engineering, and binary analysis. Overall, iced provides a comprehensive solution for working with low-level machine code in modern software systems. -
17
The Bitdefender disassembler
bddisasm is a fast, lightweight, x86/x64 instruction decoder
The Bitdefender disassembler is a highly optimized, lightweight x86/x64 instruction decoder designed for security, reverse engineering, and low-level systems analysis. It focuses on decoding machine instructions with high precision while providing detailed metadata about each instruction, including operands, access modes, CPU flags, and feature requirements. Unlike many disassemblers, bddisasm is built with zero dynamic memory allocation and no external dependencies, making it extremely portable and suitable for constrained environments such as kernels, hypervisors, and embedded systems. The project also includes a companion component called bdshemu, which provides a minimal instruction emulator capable of analyzing shellcode-like behavior in a controlled environment. Its performance is a key strength, achieving millions of decoded instructions per second while maintaining thread safety and deterministic behavior. -
18
FISSURE
The RF and reverse engineering framework for everyone
FISSURE is an open-source radio frequency analysis and signal intelligence framework built to support software-defined radio research, wireless security experimentation, and protocol reverse engineering. The project brings together tools for capturing, inspecting, decoding, replaying, and analyzing RF signals across a wide range of wireless technologies. It is designed as a practical environment for researchers and operators who need to move from raw spectrum observation to structured investigation without stitching together too many separate utilities by hand. The platform supports workflows related to signal discovery, demodulation, packet inspection, fuzzing, and attack simulation, making it useful for both defensive research and controlled lab testing. Its architecture is oriented toward extensibility, so users can integrate additional hardware, signal-processing components, and protocol-specific modules depending on their needs. -
19
WebHackersWeapons
A collection of cool tools used by Web hackers
WebHackersWeapons is a community-maintained catalog of tools used for web application security research and testing. Rather than providing one scanner, it indexes a broad ecosystem of specialized open-source security utilities. The collection spans analysis, penetration testing, proxies, scanners, reconnaissance, reverse engineering, fuzzing, automation, and supporting utilities. Individual entries link to their original projects so researchers can evaluate tools according to a particular assessment task. The repository is organized into categorized data that can be maintained and expanded through community contributions. It also belongs to a wider family of curated security-tool collections maintained by the same author. The catalog is primarily intended for bug bounty, authorized testing, and defensive security research. -
20
sperm
Collection of reverse engineering articles curated for learning
sperm is a curated repository that gathers a collection of notable articles related to reverse engineering and software analysis. It primarily acts as a knowledge archive where previously published technical posts are compiled and organized for easier access and long-term reference. These articles originate from multiple technical communities and platforms and are exported into Markdown format to maintain a consistent and readable structure. sperm focuses on educational material that explores reverse engineering techniques, mobile analysis, and related technical discussions. Its goal is to preserve useful learning resources and make them easier for researchers, students, and security enthusiasts to browse in a single location. sperm emphasizes that the materials are intended strictly for study and technical exchange rather than misuse. By maintaining these articles in a version-controlled repository, the content remains accessible and easier to navigate. -
21
BinExport
Export disassemblies into Protocol Buffers
BinExport is a disassembly export plugin developed by Google as part of the BinDiff ecosystem, designed for reverse engineering and binary analysis. It works with popular disassemblers including IDA Pro, Binary Ninja, and Ghidra, enabling the export of disassembly data into a structured Protocol Buffer format. This exported data can then be used for binary comparison, diffing, and advanced analysis tasks through BinDiff or other compatible tools. BinExport captures detailed information such as instructions, functions, control flow graphs, and metadata, providing a machine-readable representation of a program’s disassembled structure. It supports multiple export formats, including binary, text, and statistics outputs, and can be used interactively or via scripting (IDC, IDAPython, or Ghidra’s headless mode). The project includes complete build instructions for Linux, macOS, and Windows, ensuring reproducibility across platforms. -
22
Miasm
Reverse engineering framework in Python
The Miasm intermediate representation is used for multiple task: emulation through its jitter engine, symbolic execution, DSE, program analysis, but the intermediate representation can be a bit hard to read. We will present in this article new tricks Miasm has learned in 2018. Among them, the SSA/Out-of-SSA transformation, expression propagation and high-level operators can be joined to “lift” Miasm IR to a more human-readable language. We use graphviz to illustrate some graphs. Its layout does not always totally conform with a reverse engineering “ideal view”, so please be tolerant of those odd graphs. Miasm is not the first tool to implement this feature. But, well, as the tool already had everything needed to implement DSE, it was just a matter of time before these features landed in the main branch. -
23
ngrev
Tool for reverse engineering of Angular applications
Graphical tool for reverse engineering of Angular projects. It allows you to navigate in the structure of your application and observe the relationship between the different modules, providers, and directives. The tool performs static code analysis which means that you don't have to run your application in order to use it. ngrev is not maintained by the Angular team. It's a side project developed by the open-source community. The application is not signed, so you may have to explicitly allow your mac to run it in System Preferences. You can add your own theme by creating a [theme-name].theme.json file in Electron [userData]/themes. For a sample theme see Dark. Your application needs to be compatible with Angular Ivy compiler. ngrev is not tested with versions older than v11. To stay up to date check the update guide on angular.io. -
24
After a program has been thrown into the world in binary form, it can boomerang back as source code. The Boomerang reverse engineering framework is the first general native executable decompiler available to the public.
-
25
Cutter
Free and Open Source Reverse Engineering Platform
Cutter is a free and open-source graphical reverse-engineering platform powered by the Rizin framework. It provides a visual interface for inspecting binaries, functions, strings, references, control flow, and low-level program structure. The application is designed to make advanced binary analysis more approachable without sacrificing access to Rizin’s underlying capabilities. Its interface can be extended with Python and native C++ plugins. Community integrations add features such as decompilers and code-coverage visualization. Cutter runs on Linux, macOS, and Windows and is distributed through native packages, portable builds, and Docker-based options. It is intended for software analysis, debugging, research, and authorized security work.
