Awesome Reverse Engineering Anything

An independent collection of tools, case studies and research for websites, games, apps, native binaries, firmware and communication protocols.

English · 简体中文

Search & filter · Browse cases · Research papers · HTML survey

Source review does not imply runtime verification. Review method

Find by task

Task	Relevant sections
Inspect a website or app interface	Websites · Apps
Rebuild a game or check matching code	Games · Game cases
Analyze compiled code or recover symbols	Native binaries · Agents and MCP
Investigate firmware or device protocols	Firmware · Protocols
Compare methods and evaluation evidence	Papers · Survey comparisons

Resources

Names link to original sources. Each line gives the opening sentence of the description, then the type and relationship; “Full entry” opens the complete description, prerequisites, limitations and review sources.

Each resource appears once under its main purpose. Cases reuse these entries; papers are listed separately. Browse the resource directory.

REA labels refer to the separate upstream CLI and MCP project. Listing does not imply REA integration. About this independent collection.

Tags: Official REA: published by the REA project · Community REA: third-party REA work · REA maintainer: an REA maintainer's list · Independent MCP, Independent agent, Independent reconstruction: no established REA connection · Mixed workflow: REA plus other tools, per the author · Android, .NET, JVM, WebAssembly: platform · Library: code library · type only: foundation tool or learning resource.

Website

↑ Contents

Case studies

Dinosaur runner: recovering one acceleration rule - REA’s documented teaching case inspects the HTTP t-rex-runner edition and reconstructs its speed-update rule. _{Case study · Official REA · Also: Game · Full entry}
rauchg.com: rebuilding an RSC blog from captured Flight output - Documents a website-rebuild-skill case that decodes browser-delivered React Server Component Flight streams, reconstructs a buildable Next project and compares its output with a captured site. _{Case study · Independent reconstruction · Full entry}
BaoCut Slides: adapting an interactive web editor - Documents BaoCut’s interactive slide editor, whose author says the implementation draws on Claude Slides. _{Case study · Independent reconstruction · Also: App · Full entry}
REA in Claude Code: an isolated static-analysis A/B trial - A Japanese field report connects REA 6.4.0 to Claude Code in a separate project directory, denies 43 of its 170 tools and common shell launch forms, and compares REA-enabled and REA-disabled runs on two real tasks: an Electron terminal’s packaged files and a saved HAR capture. _{Case study · Mixed workflow · Also: App · Full entry}
Dinosaur runner: an REA-inspected speed rule rebuilt with Codex - The author uses REA’s MCP browser tools to passively capture the JavaScript loaded by wayou’s open-source T-Rex Runner page, then has Codex rebuild its acceleration rule in one self-contained HTML5 Canvas game. _{Case study · Mixed workflow · Also: Game · Full entry}
BaoCut Design: porting reconstructed canvas and design-system editors - Documents BaoCut’s design-canvas and design-system editors, which the project says it ported 1:1 from TypeScript reconstructions of Claude Design’s editors and hosts in agent sessions with annotation and export. _{Case study · Independent reconstruction · Also: App · Full entry}
whatsapp-web-reveng: documenting the legacy WhatsApp Web protocol - Documents and reimplements the WebSocket protocol WhatsApp Web used while browser sessions mirrored a paired phone: QR pairing, Curve25519/HKDF key setup, AES/HMAC-protected binary messages, the token-based node encoding and end-to-end media encryption. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
Ruffle: a Rust reimplementation of Adobe Flash Player - Reimplements Adobe Flash Player in Rust so that SWF content, from ActionScript 1/2 (AVM1) to ActionScript 3 (AVM2), runs in a native desktop player or in browsers through WebAssembly, as a self-hosted script or a browser extension. _{Case study · Independent reconstruction · Also: Game · Full entry}
Littlebird.ai static home-page rebuild - Rebuilds the Littlebird.ai home page in plain HTML/CSS/JavaScript from captured markup and assets, with source-wired mobile navigation, FAQ toggles, scroll reveals and OS-dependent call-to-action presentation. _{Case study · Independent reconstruction · Full entry}

Tools, projects and integrations

webcrack - Improves JavaScript readability by reversing supported obfuscation patterns and unpacking webpack/Browserify bundles. _{Tool · Also: App · Full entry}
humanify - Rename identifiers in minified JavaScript with LLM-suggested names, applied through scope-aware AST rewriting so the program structure stays unchanged. _{Tool · Full entry}
WABT - WebAssembly tools for binary-to-text conversion, section inspection, validation, interpretation and C translation. _{Tool · WebAssembly · Also: Binary · Full entry}
wasm-tools - Bytecode Alliance CLI and Rust libraries for inspecting WebAssembly modules, metadata, components and WIT interfaces. _{Tool · WebAssembly · Also: Binary · Full entry}
Chrome DevTools MCP - Connect an agent to Chrome for live page inspection, network debugging, and performance traces. _{Integration · Independent MCP · Full entry}
mitmproxy - Inspect and record HTTP traffic with an interactive proxy, web interface, or scriptable command-line tools. _{Tool · Also: App, Protocol · Full entry}
Playwright MCP - Drive browser interactions through structured accessibility snapshots to investigate reproducible web behavior. _{Integration · Independent MCP · Full entry}
Burp Suite MCP Server - PortSwigger's Burp Suite extension serves an MCP endpoint, plus a packaged stdio proxy, so agents can query proxy HTTP and WebSocket history, send HTTP/1.1 or HTTP/2 requests, and open Repeater or Intruder tabs. _{Integration · Independent MCP · Also: App · Full entry}
Wakaru - Recover readable modules from shipped JavaScript bundles by reversing recognized minifier and transpiler patterns. _{Tool · Full entry}
Spectral - Analyze captured application HTTP traffic with an LLM to generate MCP tools, OpenAPI 3.1 specifications, or GraphQL schemas. _{Integration · Independent agent · Also: App, Protocol · Full entry}
jsdeob-workbench - Inspect JavaScript ASTs and variable scopes while building visual chains of Babel transforms. _{Tool · Full entry}
Browser Reverse Engineering Toolkit - Capture browser-session evidence, crawl websites in a persistent Chromium session, and generate offline architecture/API reports plus OpenAPI, SDK and mock-server drafts from saved captures. _{Tool · Full entry}
screenshot-to-code - Generate HTML/CSS, Tailwind, React, Vue, Bootstrap or Ionic front-end code from screenshots, mockups, Figma designs or screen recordings with multimodal models; an optional headless-browser preview lets the model check its rendered output. _{Tool · Full entry}
Dembrandt - Node.js CLI that renders a website in Playwright-driven Chromium or Firefox and reads computed styles from the DOM to extract its design system: logo, color roles with the evidence behind each pick, typography, spacing, borders, shadows, motion, breakpoints and component styles such as buttons and inputs. _{Tool · Full entry}
shuji - Command-line tool that writes the original JavaScript and CSS sources embedded in source maps back out as files. _{Tool · Full entry}
Obfuscator.io Deobfuscator - Deobfuscator dedicated to JavaScript produced by Obfuscator.io (javascript-obfuscator), which its README says also handles most forks. _{Tool · Full entry}
javascript-deobfuscator - General-purpose JavaScript deobfuscator for common obfuscation patterns, published on npm as js-deobfuscator and usable as a library or CLI. _{Tool · Full entry}
mitmproxy2swagger - Command-line tool that reverse-engineers undocumented REST APIs from captured traffic. _{Tool · Also: Protocol · Full entry}
JPEXS Free Flash Decompiler (FFDec) - Java desktop decompiler and editor for Adobe Flash SWF files. _{Tool · Also: Game · Full entry}
WasmLens: exploratory WebAssembly inspection - Python CLI with static paths for inspecting WebAssembly sections and function signatures, producing WAT-style instruction listings, and reconstructing limited C-like pseudocode. _{Tool · WebAssembly · Also: Binary · Full entry}

Game

↑ Contents

Case studies

DX-Ball: reconstruct sound panning - Recover one sound-pan function from instructions and constants; upstream cites 3,205 cases and a 63-byte match. _{Case study · Official REA · Also: Binary · Full entry}
TH04: recover a DOS bullet-ring helper - Inspect a 16-bit PC-98 DOS helper and relate its angle calculation to a pinned reconstruction and historical compiler checks. _{Case study · Official REA · Also: Binary · Full entry}
Super Mario 64 DS: matching decompilation with relocation checks - Reconstructs Super Mario 64 DS functions as C/C++ and permitted assembly primitives, comparing compiled output with a user-supplied cartridge dump. _{Case study · Independent reconstruction · Full entry}
GoldenEye 007: an agent-assisted native port from a decompilation - Builds a native PC port on the existing GoldenEye 007 decompilation, with a host platform layer and assets extracted from the user’s ROM. _{Case study · Independent reconstruction · Full entry}
ssbu-recomp: static recompilation with explicit mode limits - Translates Super Smash Bros. Ultimate 13.0.4 AArch64 code ahead of time and supplies a Windows runtime with Vulkan/OpenGL rendering. _{Case study · Independent reconstruction · Full entry}
KartPad: platform integration for a Mario Kart Wii recompilation - Builds Apple and Android integration around WiiCompiled’s ahead-of-time translation of Mario Kart Wii, with native graphics, input and optional Retro Rewind support. _{Case study · Independent reconstruction · Full entry}
BattleShip: an AI-assisted Super Smash Bros. native port - Ports the existing Super Smash Bros. N64 decompilation using libultraship and Torch. _{Case study · Independent reconstruction · Full entry}
Agent decompilation: a byte-matching retrospective - Maurice Heumann describes replacing plausible-looking agent output with compiler-based checks of reconstructed functions, relocations, data and types. _{Case study · Independent reconstruction · Full entry}
Snowboard Kids 2: an LLM-assisted N64 matching decompilation - A public matching decompilation of the N64 game Snowboard Kids 2, begun in 2024 with community decompilation tools. _{Case study · Independent reconstruction · Full entry}
IsaacRecomp: translating Flash game bytecode to native C++ - Translates The Binding of Isaac’s Flash AVM1 bytecode into C++ functions and supplies a native rendering/input runtime. _{Case study · Independent reconstruction · Full entry}
Nanolathe: a documented Total Annihilation engine reimplementation - Reimplements a Total Annihilation-compatible strategy-game engine in Go, with public file-format research and separate gameplay profiles. _{Case study · Independent reconstruction · Full entry}
TH08: exact-source reconstruction and separately tested ports - Reconstructs the original Japanese Touhou 8 version 1.00d against its binary and original compiler, then adapts the recovered code for other platforms. _{Case study · Independent reconstruction · Full entry}
Zelda 64: Recompiled — a native Majora’s Mask port without a full source decompilation - Uses N64Recomp to translate Majora’s Mask into a native application and RT64 for rendering. _{Case study · Independent reconstruction · Full entry}
OpenGOAL: recovering GOAL code and rebuilding the Jak games - Reconstructs readable GOAL code from the original Jak binaries and compiles it with a new GOAL compiler for modern PCs. _{Case study · Independent reconstruction · Full entry}
LEGO Island: source reconstruction with separately reported exact rebuilds - Reconstructs the English LEGO Island 1.1 source for its original 32-bit Windows target. _{Case study · Independent reconstruction · Full entry}
Snowball War: a bounded REA-assisted minigame reconstruction - The author uses REA’s Ghidra workflow to investigate the DOS Ski or Die binary, document Snowball War rules and rebuild that one minigame in Rust with SDL2. _{Case study · Mixed workflow · Full entry}
SpaceCadetPinball: decompiled game logic adapted to SDL2 - Converts the reverse-engineered Space Cadet pinball game into compilable C++ for desktop platforms. _{Case study · Independent reconstruction · Full entry}
Super Mario 64: ROM reconstruction with explicit comparison gates - Reconstructs Super Mario 64 source for Japanese, North American, European, Shindou and iQue releases. _{Case study · Independent reconstruction · Full entry}
Unleashed Recompiled: translating Xbox 360 game code and shaders - Builds an unofficial Sonic Unleashed PC port by statically recompiling Xbox 360 PowerPC code with XenonRecomp and Xenos shaders with XenosRecomp. _{Case study · Independent reconstruction · Full entry}
OpenMW: replacing Morrowind’s engine while reusing original content - Provides an independent engine for playing Morrowind and an alternative editor, OpenMW-CS. _{Case study · Independent reconstruction · Full entry}
REDRIVER2: reconstructing Driver 2 through a PlayStation compatibility layer - Translates reverse-engineered Driver 2 MIPS routines into C/C++ and uses Psy-X/Psy-Cross to adapt PlayStation interfaces for desktop systems. _{Case study · Independent reconstruction · Full entry}
DevilutionX: porting Diablo’s reconstructed engine - Builds a modern Diablo and Hellfire port on the Devilution reconstruction, with platform support, bug fixes and optional quality-of-life features. _{Case study · Independent reconstruction · Full entry}
Touhou reconstructions: an agent-driven method across three games - An essay published on REA’s site, with pinned evidence notes, describes one author’s agent-driven reconstructions of TH08, TH095 and TH04. _{Case study · Official REA · Also: Binary · Full entry}
TicTacToe-AI: a bounded REA-fork reconstruction of one game method - The author’s REA fork, posted as rea-engine and since renamed RE-Agent, decompiles the shipped .NET executable of the GPL-licensed TicTacToe-AI game, recompiles the recovered C# and resources, and repairs one decompiler error against the original IL. _{Case study · Mixed workflow · Full entry}
UltraSunnyMoon: a partial, REA-led Pokémon Ultra Sun reconstruction - The author uses a pinned REA build with Ghidra to analyze a user-supplied Pokémon Ultra Sun base executable, rebuild it byte for byte from split objects, and swap in two small compiled C runtime routines. _{Case study · Mixed workflow · Full entry}
DX-Ball: an REA-guided function-level reconstruction with Codex - The author has Codex use REA’s Ghidra tools to inspect the English DX-Ball 1.07 executable and recover it as typed C/C++, then compiles each function with the original-era Visual C++ 4.0 and compares it byte for byte with the original after mapping relocations. _{Case study · Mixed workflow · Also: Binary · Full entry}
re2ds: a native Nintendo DS engine for Resident Evil 2 - Reimplements Resident Evil 2’s PS1 game rules in a native Nintendo DS engine, with converters that turn data from the user’s own disc into DS formats. _{Case study · Mixed workflow · Full entry}
LASRecomp: Link’s Awakening static recompilation - A native desktop reconstruction of the 2019 Switch version of Link’s Awakening using static recompilation. _{Case study · Independent reconstruction · Also: Binary · Full entry}
ArkWeb: a two-game movement and collision experiment - Runs Spider-Man Remastered and Arkham Knight together, streaming Gotham collision into Spider-Man’s physics world and compositing his rendered frame into Arkham. _{Case study · Independent reconstruction · Full entry}
Perfect Dark: matching Nintendo 64 decompilation - Reconstructs Perfect Dark’s Nintendo 64 code with a documented matching-ROM build. _{Case study · Independent reconstruction · Full entry}
Super Mario Sunshine: a native PC port from an AI-assisted decompilation - Builds a native PC port of Super Mario Sunshine’s North American release from a pinned matching-decompilation fork, adding a host platform layer for graphics, disc, audio, input and OS services. _{Case study · Independent reconstruction · Full entry}
Majora’s Mask: matching US N64 decompilation - Recreates a C source base for The Legend of Zelda: Majora’s Mask from information in the game and static or dynamic analysis, then rebuilds the US Nintendo 64 ROM. _{Case study · Independent reconstruction · Full entry}
DLSSNR-AMD: reimplementing DLSS 5 neural rendering for RDNA4 - Reimplements the neural-rendering network of NVIDIA’s DLSS 5 library as Vulkan compute shaders for AMD RX 9000 (RDNA4) cards and supplies it to games through an NGX-compatible core and ReShade or Vulkan-layer routes. _{Case study · Independent reconstruction · Also: Binary · Full entry}
Breath of the Wild: per-function matching decompilation of the Switch executable - Reimplements part of Breath of the Wild’s Switch v1.5.0 main executable in C++ and checks each function against the original machine code. _{Case study · Independent reconstruction · Full entry}
Skyward Sword: Wii decompilation with hash-checked relinking - Reconstructs C++ source for The Legend of Zelda: Skyward Sword’s Wii main.dol and REL modules, starting from the user’s NTSC-U 1.0 (SOUE01) disc files. _{Case study · Independent reconstruction · Full entry}
2 Ship 2 Harkinian: a native Majora’s Mask port built on the decompilation - Builds native Windows, Linux and macOS versions of The Legend of Zelda: Majora’s Mask from an adapted copy of the zeldaret/mm decompilation, with libultraship reimplementing N64 SDK functions. _{Case study · Independent reconstruction · Full entry}
Ship of Harkinian: a native Ocarina of Time port built on the decompilation - Builds Ocarina of Time as a native PC application from the OoT decompilation’s source, with libultraship standing in for the N64 libultra SDK and DirectX 11, OpenGL or Metal rendering. _{Case study · Independent reconstruction · Full entry}
The Minish Cap: a GBA decompilation targeting five ROMs - Recreates a C source base for The Legend of Zelda: The Minish Cap from information in the game and static or dynamic analysis, building five Game Boy Advance ROMs: USA, EU, JP and two demos. _{Case study · Independent reconstruction · Full entry}
Ocarina of Time: decompilation with MD5-checked ROM builds for 16 versions - Recreates a C source base for Ocarina of Time that rebuilds 16 Nintendo 64, GameCube and iQue Player ROM versions, using information from the game and static and dynamic analysis. _{Case study · Independent reconstruction · Full entry}
Project Arwing: Star Fox recompiled from a matching disassembly - Disassembles Star Fox’s 65816 and SuperFX code from runtime coverage and recursive descent, reassembles it into the original ROM, then translates it statically to C on a from-scratch SNES runtime for Windows, macOS and Linux. _{Case study · Independent reconstruction · Full entry}
Project Arwing (2): Star Fox 2 recompiled from a matching disassembly - Rebuilds Star Fox 2 from a coverage-seeded 65816 and SuperFX disassembly that reassembles to the original ROM, then translates it statically to C for native Windows, macOS and Linux builds. _{Case study · Independent reconstruction · Full entry}
Little Planet: Sonic CD recompiled from a matching disassembly - Disassembles every executable file on the Sonic CD disc from runtime coverage and recursive descent, reassembles them byte-identically, and translates the code statically to C on a from-scratch Mega-CD runtime that replaces the BIOS with a high-level implementation. _{Case study · Independent reconstruction · Full entry}
vf2-decomp: differentially validated Virtua Fighter 2 recovery - Recovers Virtua Fighter 2 Version 2.1’s Sega Model 2A i960 program into portable, non-matching C17, accepting each recovered path only when it matches a reference i960 executor at controlled boundaries. _{Case study · Independent reconstruction · Full entry}
z2rs: an incremental Rust reconstruction of Zelda II checked against an emulator - Rebuilds Zelda II: The Adventure of Link (NES) in Rust for desktop, browser and Android by replacing the game’s 6502 routines one at a time. _{Case study · Independent reconstruction · Full entry}
sm64ex: an enhanced Super Mario 64 PC port from the decompilation - Builds native Super Mario 64 executables from decompiled source, extending the sm64-port fork of the n64decomp reconstruction with renderer, input, camera, save-format and external-data options. _{Case study · Independent reconstruction · Full entry}
Ghostship: a libultraship native port of Super Mario 64 - Builds Super Mario 64 as a native PC, Switch and Android program by compiling decompilation-style game source against the libultraship platform library. _{Case study · Independent reconstruction · Full entry}
Super Mario Sunshine: an in-progress matching GameCube decompilation - Reconstructs Super Mario Sunshine’s C++ source so that the original Metrowerks compiler reproduces byte-identical object files for four GameCube releases and the Switch 3D All-Stars build. _{Case study · Independent reconstruction · Full entry}
Dusklight: a native Twilight Princess port built on the decompilation - Reimplements Twilight Princess as a native application for desktop and mobile platforms, building on the zeldaret/tp decompilation and the Aurora GameCube/Wii compatibility layer. _{Case study · Independent reconstruction · Full entry}
Metaforce: a Metroid Prime engine reimplementation rebuilt on the decompilation - Started in 2015 as a reverse-engineered reimplementation of the Metroid Prime engine, Metaforce has been rewritten on top of the PrimeDecomp matching decompilation. _{Case study · Independent reconstruction · Full entry}
Super Mario Sunshine (USA): an AI-assisted matching decompilation fork - Extends the doldecomp Super Mario Sunshine decompilation to the North American GMSE01 release. _{Case study · Independent reconstruction · Full entry}
Donkey Kong 64: Recompiled — an N64Recomp native port - Uses N64Recomp to statically recompile the US Nintendo 64 release of Donkey Kong 64 into a native port, with RT64 as the renderer. _{Case study · Independent reconstruction · Full entry}
Twilight Princess: a decompilation with fully matching GameCube code - Reconstructs Twilight Princess source that compiles back to binaries identical to the originals, building GameCube, Wii and Nvidia Shield releases from one codebase through conditional compilation. _{Case study · Independent reconstruction · Full entry}
Castlevania: Symphony of the Night: matching decompilation across PlayStation, PSP and Saturn builds - Recreates C source for Castlevania: Symphony of the Night from its PlayStation, PSP and Saturn binaries, aiming for code that compiles byte for byte to the original game files. _{Case study · Independent reconstruction · Full entry}
LEGO Island, portable: a multi-platform port of the decompiled source - Adapts the LEGO Island decompilation into a portable build for desktop, mobile, console, DOS and Web targets. _{Case study · Independent reconstruction · Full entry}
c1: a C port of PlayStation Crash Bandicoot - Ports the original PlayStation Crash Bandicoot game code to C function by function; its coding standard labels functions with the addresses of their original implementations. _{Case study · Independent reconstruction · Full entry}
Metroid Prime Port: an AI-assisted native port of the PrimeDecomp decompilation - Compiles the PrimeDecomp decompilation of Metroid Prime’s game and engine code as native C++20 for Linux, Windows and Android, with an experimental macOS build. _{Case study · Independent reconstruction · Full entry}
The Wind Waker: a GameCube decompilation with hash-checked relinking - Reconstructs source for The Wind Waker’s GameCube executable and REL modules across the USA/Korea, PAL and Japanese releases and a Japanese kiosk demo. _{Case study · Independent reconstruction · Full entry}
Sonic Mania: a game-code decompilation for the RSDKv5 engine - Reconstructs Sonic Mania’s game code in C and builds it with the separately decompiled RSDKv5 or RSDKv5U engine for Windows, Linux, Switch and Android. _{Case study · Independent reconstruction · Full entry}
MediEvil Recomp: a PlayStation static recompilation to C# - Statically recompiles the North American PlayStation release of MediEvil into C# with the RecompOne recompiler and runtime. _{Case study · Independent reconstruction · Full entry}
Crash Bandicoot 2 Recompiled: a PSXRecomp native build - A Windows launcher that uses the PSXRecomp recompiler and runtime to translate the user’s Crash Bandicoot 2: Cortex Strikes Back disc to C and compile it locally, so the game runs as native code with an emulated PlayStation hardware layer. _{Case study · Independent reconstruction · Full entry}
Petari: a matching Super Mario Galaxy decompilation - Reconstructs Super Mario Galaxy’s Wii code as C++ that rebuilds, object by object, against main.dol files extracted from the user’s own Japanese, North American, PAL or Korean disc. _{Case study · Independent reconstruction · Full entry}
Wind Waker HD Recomp: a native port by static recompilation of the Wii U game - Statically recompiles The Wind Waker HD’s Wii U PowerPC code to C ahead of time, reimplements the Cafe OS libraries the game uses and implements GX2 graphics on Metal or Vulkan, producing native macOS, Linux, Windows and Android builds without a Cemu runtime. _{Case study · Independent reconstruction · Full entry}
Castlevania 64: Recompiled — a beta static-recompilation port - Uses N64Recomp to statically recompile the US 1.0 Nintendo 64 release of Castlevania into a native PC port rendered with RT64. _{Case study · Independent reconstruction · Full entry}
RSDKv5 Decompilation: reconstructing Retro Engine v5 and v5U - Reconstructs the Retro Engine (RSDK) v5 and v5 Ultimate runtime, the engine that runs Sonic Mania’s game code, and builds it for Windows, Linux, Switch and Android. _{Case study · Independent reconstruction · Full entry}
C2C: hybrid recompilation and hand decompilation of Crash Bandicoot 2 - An early reverse-engineering effort on PlayStation Crash Bandicoot 2 that converts the engine’s MIPS machine code directly into a very large C file and runs it against a modified PCSX-R emulator library for hardware I/O. _{Case study · Independent reconstruction · Full entry}
MediEvil decompilation: an early checksum-gated PlayStation project - Decompiles the US PlayStation release of MediEvil toward C source that rebuilds its main executable, game executable and 26 overlays. _{Case study · Independent reconstruction · Full entry}
Conker's Bad Fur Day: Recompiled — an N64Recomp native port - Statically recompiles the US Nintendo 64 release of Conker’s Bad Fur Day with N64Recomp into a native Windows, Linux and macOS port on N64ModernRuntime and RT64. _{Case study · Independent reconstruction · Full entry}
ProjectCane: a native PC port of Sly Cooper and the Thievius Raccoonus - Rebuilds the NTSC PlayStation 2 release of Sly Cooper and the Thievius Raccoonus as a native C++ game for Windows and Linux, running on data extracted from the player's own disc image. _{Case study · Independent reconstruction · Full entry}
Firefighter: a decompiled DOS game ported to Rust - Eric S. Raymond’s terminal port of Firefighter, Eben Sprinsock’s 1985 DOS shareware game. _{Case study · Independent reconstruction · Full entry}
Kingdom Hearts 358/2 Days: native PC port built on a matching decompilation - Compiles the C of the khdays-decomp matching decompilation for Windows x64 and supplies a native platform layer for the Nintendo DS hardware, SDK services and sound driver. _{Case study · Independent reconstruction · Full entry}
ico-pc: a native ICO port compiled from the PS2 decompilation - Compiles the decompiled C of the PlayStation 2 game ICO natively for Windows, Linux, Android, iPhone and Apple-silicon Macs, with host code standing in for the PS2 hardware and Sony libraries. _{Case study · Independent reconstruction · Full entry}
Sly Cooper and the Thievius Raccoonus: matching PlayStation 2 decompilation - Reconstructs source code for SCUS_971.98, the NTSC-U PlayStation 2 executable of Sly Cooper and the Thievius Raccoonus, as a work-in-progress matching decompilation. _{Case study · Independent reconstruction · Full entry}
Pokémon Emerald: a matching Game Boy Advance decompilation - Reconstructs Pokémon Emerald for the Game Boy Advance as buildable C source, with game scripts and data kept as assembler directives. _{Case study · Independent reconstruction · Full entry}
Paper Mario: matching Nintendo 64 decompilation for four releases - Reconstructs Paper Mario’s Nintendo 64 code as C source that rebuilds the US, Japanese, PAL and iQue ROMs. _{Case study · Independent reconstruction · Full entry}
Budokai Tenkaichi 3: a native PC port built on a matching decompilation - Compiles the decompiled code of Dragon Ball Z: Budokai Tenkaichi 3 (PS2, USA release SLUS-21678) for PC on a new renderer, sound, input and platform layer rather than an emulator. _{Case study · Independent reconstruction · Full entry}
D2R Mobile: rehosting Diablo II: Resurrected’s Switch program on Apple devices - Runs the Nintendo Switch release’s own aarch64 program natively on iPhone, iPad and Apple silicon Macs, rewriting only instructions that depend on the Horizon kernel and supplying its system services and the NVN graphics API on Metal. _{Case study · Independent reconstruction · Full entry}
Ratchet & Clank: a matching PS2 decompilation with a documented agent workflow - Reconstructs C source for SCES_509.16, the PAL v2.00 PlayStation 2 executable of Ratchet & Clank (2002), with every function linked at its retail address. _{Case study · Independent reconstruction · Full entry}
Banjo: Recompiled — an N64Recomp Banjo-Kazooie native port - Uses N64Recomp to statically recompile the US 1.0 Nintendo 64 release of Banjo-Kazooie into a native port on N64ModernRuntime, rendered by RT64 and extended with mod support. _{Case study · Independent reconstruction · Full entry}
Pokémon FireRed and LeafGreen: a matching Game Boy Advance decompilation - Reconstructs the English Game Boy Advance releases of Pokémon FireRed and LeafGreen as buildable C source, with game scripts and data kept as assembler directives. _{Case study · Independent reconstruction · Full entry}
PaperBoat: a native Paper Mario port built on the decompilation - Compiles Paper Mario decompilation sources, credited to the pmret and Paper Mario DX projects, into a native US-version application on libultraship. _{Case study · Independent reconstruction · Full entry}
Halo 2: an agent-assisted matching decompilation of an LTCG Xbox build - A work-in-progress matching decompilation of Halo 2 for the original Xbox: contributors write C and C++ that the period compiler, building the whole program with link-time code generation, must turn back into the retail executable's bytes function by function. _{Case study · Independent reconstruction · Full entry}
DiabloWeb: a WebAssembly browser port built on Devilution - Runs Diablo in web browsers by compiling a stripped-down fork of Devilution, the community reconstruction of the game’s original source, to WebAssembly behind a React front end. _{Case study · Independent reconstruction · Full entry}
pokered: a matching Pokémon Red and Blue disassembly - Reconstructs the Game Boy games Pokémon Red and Blue as RGBDS assembly, with graphics and data kept as editable source files. _{Case study · Independent reconstruction · Full entry}
Lighthouse: a Banjo-Kazooie PC port built on the decompilation - A native Windows, Linux and macOS port of Banjo-Kazooie that compiles game C sources, many tagged with their Banjo-Kazooie decompilation file paths, against libultraship, a reimplementation of the N64 SDK. _{Case study · Independent reconstruction · Full entry}
Lost Odyssey Recomp: statically recompiling an Xbox 360 RPG into native ports - Translates Lost Odyssey’s Xbox 360 PowerPC executable with patched XenonRecomp tooling and runs the generated code on a native runtime that renders through Direct3D 12, Vulkan or Metal. _{Case study · Independent reconstruction · Full entry}
Super Smash Bros. Melee: a matching GameCube decompilation with a shiftable build - A matching decompilation of Super Smash Bros. Melee's US 1.02 release (GALE01) that rebuilds main.dol from C with the original Metrowerks compilers and checks it against the retail SHA-1. _{Case study · Independent reconstruction · Full entry}
pokecrystal: a matching Pokémon Crystal disassembly - Reconstructs the Game Boy Color game Pokémon Crystal as RGBDS assembly, with graphics, maps and data stored as editable sources. _{Case study · Independent reconstruction · Full entry}
Pokémon HeartGold and SoulSilver: a work-in-progress, checksum-matched DS disassembly - Rebuilds the US Nintendo DS releases of Pokémon HeartGold and SoulSilver from a work-in-progress disassembly in which part of the code has been decompiled to C. _{Case study · Independent reconstruction · Full entry}
FFTARecomp: static recompilation of Final Fantasy Tactics Advance - Recompiles the user’s Final Fantasy Tactics Advance (USA) Game Boy Advance ROM ahead of time into native code for Windows, Linux and Steam Deck, building on JRickey’s gba-recomp toolkit. _{Case study · Independent reconstruction · Full entry}
SymphonyRecomp: a RecompOne static recompilation of Symphony of the Night - Statically recompiles the North American PlayStation release of Castlevania: Symphony of the Night into C# with BlackLabelHQ’s RecompOne, whose runtime simulates the BIOS, memory-mapped I/O, GPU and CD-ROM so the game runs natively without a console BIOS. _{Case study · Independent reconstruction · Full entry}
The Two Towers Recompiled: an original Xbox static-recompilation port - Statically recompiles the x86 code of The Lord of the Rings: The Two Towers (Xbox, USA, 2002) into C with the bundled xboxrecomp toolkit, producing native Windows, Linux and experimental macOS builds. _{Case study · Independent reconstruction · Full entry}
Melee Unlocked: a Windows source port and static recompilation of Melee - A beta Windows build of Super Smash Bros. Melee (NTSC 1.02) with two engines: a source port that compiles the doldecomp decompilation as a native library, and a static recompilation that translates the retail DOL's PowerPC code and Slippi's Gecko codes into C++. _{Case study · Independent reconstruction · Full entry}
pokeruby: a matching Pokémon Ruby and Sapphire decompilation - Reconstructs the Game Boy Advance games Pokémon Ruby and Sapphire as C source built with pret's agbcc compiler, alongside assembly data scripts and editable graphics. _{Case study · Independent reconstruction · Full entry}
Vandal Hearts: native PC port built on matching decompilations - Builds on shao113’s matching decompilation of PlayStation Vandal Hearts, adds a Japanese matching tree, and carries both through to a native Windows and Linux port. _{Case study · Independent reconstruction · Full entry}
Pokémon Platinum: a checksum-matched Nintendo DS decompilation - Reconstructs the US Nintendo DS release of Pokémon Platinum as C source that rebuilds revision 1 by default and revision 0 on request. _{Case study · Independent reconstruction · Full entry}
Saints Reborn: a ReXGlue static recompilation of Saints Row - An unofficial native Windows port of Saints Row (Xbox 360, 2006) that statically recompiles the game's PowerPC executable to C++ for x86-64 with the ReXGlue SDK, which also reimplements the console's kernel, GPU (on Direct3D 12), audio and input. _{Case study · Independent reconstruction · Full entry}
Pokémon Platinum PC Port: a native port built on the pret decompilation - Builds native 64-bit Windows and Linux executables of Pokémon Platinum from a fork of pret’s decompilation, replacing NitroSDK with the author’s libntr libraries; the same tree keeps the DS ROM build and an experimental Switch target. _{Case study · Independent reconstruction · Full entry}
MikuPan: a native Fatal Frame PC port built on the Himuro decompilation - Ports the PS2 game Fatal Frame to native PC builds without emulation; its repository description names the Himuro decompilation as its basis. _{Case study · Independent reconstruction · Full entry}
Starfox 64: Recompiled — an N64Recomp static-recompilation port - Uses N64: Recompiled to statically recompile the US 1.1 (Rev A) Nintendo 64 release of Star Fox 64 into a native port for Windows, Linux and macOS, rendered with RT64. _{Case study · Independent reconstruction · Full entry}
Syphon Filter: The Omega Strain — matching PS2 executable decompilation - Reconstructs much of the NTSC-U PlayStation 2 executable of Syphon Filter: The Omega Strain as C; with the remaining functions kept as split assembly, the build reproduces the retail SCUS_972.64 byte for byte. _{Case study · Independent reconstruction · Full entry}
Animal Crossing: a native PC port of the GameCube decompilation - Runs Animal Crossing’s decompiled GameCube C code natively on 32-bit x86, replacing the GX graphics API with an OpenGL 3.3 translation layer and console services with SDL2-based platform code. _{Case study · Independent reconstruction · Full entry}
GoldenEye 007: matching Nintendo 64 decompilation for three releases - Reconstructs GoldenEye 007’s Nintendo 64 code as C source that rebuilds the US, Japanese and PAL ROMs. _{Case study · Independent reconstruction · Full entry}
Starship: a Star Fox 64 PC port built from the decompilation - A native PC port of Star Fox 64 that compiles the game's decompiled C code against libultraship, an N64 porting library that reimplements libultra and renders through Fast3D. _{Case study · Independent reconstruction · Full entry}
CTR Turbocharged: a PC sourceport built on the Crash Team Racing decompilation - Extends the Crash Team Racing: High Octane sourceport, which derives from the CTR Native port of the CTR-ModSDK PlayStation decompilation, into Windows and Linux builds with a native 3D renderer, selectable aspect ratios and frame rates up to 240 FPS. _{Case study · Independent reconstruction · Full entry}
The Darkness Recomp: an Xbox 360 static recompilation with a native D3D11 renderer - Builds a native Windows x64 port of The Darkness by translating its Xbox 360 executable to C++ ahead of time with a patched XenonRecomp. _{Case study · Independent reconstruction · Full entry}
MarioKart 64: Recompiled — a native port through N64Recomp static recompilation - Statically recompiles the US Nintendo 64 release of Mario Kart 64 into a native Windows, Linux and macOS application with N64Recomp, rendering through RT64. _{Case study · Independent reconstruction · Full entry}
Animal Crossing: matching GameCube decompilation - Reconstructs Animal Crossing’s GameCube code as C and C++ source that rebuilds the USA release’s main executable and its foresta.rel module. _{Case study · Independent reconstruction · Full entry}
Kingdom Hearts 358/2 Days: a matching Nintendo DS decompilation - Reconstructs the ARM9 program and overlays of the EU Nintendo DS release of Kingdom Hearts 358/2 Days as C that recompiles byte for byte with CodeWarrior. _{Case study · Independent reconstruction · Full entry}
TonyWasAProSkater: a THPS1 native port forked from a matching decompilation - Ports Tony Hawk’s Pro Skater (PlayStation, USA) to native Windows and Linux builds from a fork of an in-progress matching decompilation of the retail executable. _{Case study · Independent reconstruction · Full entry}
P.T. for PC: a behavior-based engine reimplementation that reads the PS4 data - Reimplements P.T.’s game logic in C++ on a new Vulkan engine that reads levels, models, textures, sounds, scripts and cutscenes from the user’s own PS4 copy at run time. _{Case study · Independent reconstruction · Full entry}
SpaghettiKart: a native Mario Kart 64 port built on decompiled source - Builds a native Mario Kart 64 port for Windows, Linux, macOS and Switch from source that keeps the Mario Kart 64 decompilation’s file layout, running on libultraship’s reimplemented N64 SDK. _{Case study · Independent reconstruction · Full entry}
Animal Crossing: Wild World: matching Korean DS decompilation with differential runtime checks - Reconstructs the ARM9 game code of Animal Crossing: Wild World’s Korean DS release as one C or C++ source per function, checked against the user’s ROM with the original Metrowerks compiler and linker. _{Case study · Independent reconstruction · Full entry}
King Kong Recompiled: an AI-developed Xbox 360 static recompilation - Translates the Xbox 360 release of Peter Jackson's King Kong into native Windows code with the ReXGlue static-recompilation SDK, adding a launcher and display, control and graphics options. _{Case study · Independent reconstruction · Full entry}
Mario Party 4: matching GameCube decompilation of the USA releases - Reconstructs Mario Party 4’s GameCube main executable and REL modules as C source that rebuilds both USA releases. _{Case study · Independent reconstruction · Full entry}
SpeedBreaker: statically recompiling Need for Speed: Most Wanted for Xbox 360 - Translates the Xbox 360 executable of Need for Speed: Most Wanted (2005) into native C++ with a patched XenonRecomp and runs it on a project runtime that stands in for the console’s kernel, Xenos GPU, XMA audio and controllers. _{Case study · Independent reconstruction · Full entry}
The Sims: Bustin' Out: an AI-driven partial GBA matching decompilation - Rebuilds the USA/Europe Game Boy Advance release of The Sims: Bustin' Out byte for byte while gradually replacing ROM regions with matching C compiled by agbcc. _{Case study · Independent reconstruction · Full entry}
Destiny 2 build 86657: Sunrise/Dawn reconstruction research report - A dated research report on the Sunrise/Dawn reconstruction of the archived Destiny 2 build 86657 client, which emulates platform sign-on and the examined Bungie service contracts locally and adds reconstructed mission host policy. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
SVR2011-Recomp: a ReXGlue recompilation of WWE SmackDown vs. Raw 2011 - Translates the Xbox 360 executable of WWE SmackDown vs. Raw 2011 to C++ ahead of time with ReXGlue and builds it as a Windows program on a Vulkan runtime derived from Xenia. _{Case study · Independent reconstruction · Full entry}
Snap64 Recomp: a static-recompilation port of Pokémon Snap - Uses N64Recomp to statically recompile the US Nintendo 64 release of Pokémon Snap into a native Windows, Linux, Steam Deck and macOS port rendered with RT64. _{Case study · Independent reconstruction · Full entry}
Dead Rising 2: Case Zero — an Xbox 360 XBLA static recompilation port - Builds a native Windows, Linux, Steam Deck and Apple Silicon port of the XBLA game Dead Rising 2: Case Zero by statically recompiling its Xbox 360 code with patched XenonRecomp and translating its shaders with patched XenosRecomp. _{Case study · Independent reconstruction · Full entry}
OpenRA: an engine reimplementation reimagining early Westwood RTS games - Provides a C# engine for early Westwood real-time strategy games, with mods that reimagine Command & Conquer: Red Alert, Tiberian Dawn and Dune 2000. _{Case study · Independent reconstruction · Full entry}
Dead Rising 2: Case West — a sibling Xbox 360 XBLA static recompilation port - Builds a native Windows, Linux, Steam Deck and Apple Silicon port of the XBLA epilogue Dead Rising 2: Case West by statically recompiling its Xbox 360 code with patched XenonRecomp and translating its shaders with patched XenosRecomp. _{Case study · Independent reconstruction · Full entry}
The Simpsons Wrestling Recompiled: a psxrecomp PlayStation static recompilation - Translates the PlayStation game’s MIPS code to C with a pinned psxrecomp fork and builds Windows and Linux programs on its hardware-modelling runtime, with a launcher and a game-specific plugin. _{Case study · Independent reconstruction · Full entry}
OpenRCT2: an open re-implementation of RollerCoaster Tycoon 2 - Re-implements RollerCoaster Tycoon 2, originally written in x86 assembly, as a C++ engine that runs on the original game’s data. _{Case study · Independent reconstruction · Full entry}
Touhou 6: reconstructing Embodiment of Scarlet Devil 1.02h source - Reconstructs C++ source for the Windows executable of Touhou 6: Embodiment of Scarlet Devil version 1.02h, aiming at an exact rebuild with the original Visual Studio .NET 2002 and DirectX 8 toolchain. _{Case study · Independent reconstruction · Full entry}
Driver Recompiled: a psxrecomp setup host that builds the game locally - Packages a psxrecomp static-recompilation project for Driver (PlayStation, USA) as a setup host: releases carry the recompiler, runtime and a recomp-ui launcher, and the player’s machine generates and compiles the game from the user’s own disc image. _{Case study · Independent reconstruction · Full entry}
Himuro: a matching Fatal Frame PS2 decompilation - Reconstructs Fatal Frame’s PS2 executable as C for the US, EU and Japanese releases, built with the original EE-GCC 2.9 toolchain and checked by SHA-1 against the user’s own executables. _{Case study · Independent reconstruction · Full entry}
DOAXVB Native PC Port: statically recompiling Dead or Alive Xtreme Beach Volleyball - Lifts the original Xbox executable of Dead or Alive Xtreme Beach Volleyball to C with a fork of xboxrecomp and links it with a hand-written runtime that replaces kernel imports, audio and key Direct3D 8 and DirectSound APIs. _{Case study · Independent reconstruction · Full entry}
TH08 Web: a WebAssembly port built from reconstructed source - Compiles the reconstructed C++ source of the Japanese Touhou 8 1.00d release to WebAssembly with Emscripten, adding WebGL 2 rendering, Web Audio, browser input and IndexedDB saves behind the game’s D3D8-, DirectSound- and DirectInput-shaped interfaces. _{Case study · Independent reconstruction · Full entry}
OpenXcom: an open-source clone of X-COM: UFO Defense and Terror from the Deep - Reimplements MicroProse’s UFO: Enemy Unknown (X-COM: UFO Defense) and X-COM: Terror from the Deep as a C++/SDL engine that runs on the user’s original game resources. _{Case study · Independent reconstruction · Full entry}
Skate 3 Recomp: a native Xbox 360 recompilation through ReXGlue - Recompiles the Xbox 360 version of Skate 3 into native Windows, Linux and macOS builds with a Skate-specific fork of the ReXGlue SDK. _{Case study · Independent reconstruction · Full entry}
Uncharted: The Nathan Drake Collection native Windows port - Runs the PS4 Uncharted: The Nathan Drake Collection’s own x86-64 executables natively on Windows: a runtime supplies the PS4 system libraries and a shadPS4-derived Vulkan renderer executes the GPU work. _{Case study · Independent reconstruction · Full entry}
TH095: function-level reconstruction of Shoot the Bullet 1.02a - Reconstructs source for the original Japanese Touhou 9.5: Shoot the Bullet 1.02a executable, accepting function exactness only through reproducible byte comparison of pinned Visual C++ .NET 2003 builds against one hash-attested target. _{Case study · Independent reconstruction · Full entry}
CorsixTH: an open reimplementation of Theme Hospital - Reimplements the engine of Bullfrog’s 1997 Theme Hospital, with game logic in Lua and C++ for graphics, sound, movies and pathfinding, on top of the original game’s data files. _{Case study · Independent reconstruction · Full entry}
OpenRiseOfNations: a native macOS engine reimplementation - Reimplements the Rise of Nations: Extended Edition engine as a native macOS app with a Metal renderer, a deterministic simulation, a computer opponent and a compatible BigHugeScript compiler and virtual machine, loading art, maps, rules and scripts from the user’s own Windows installation. _{Case study · Independent reconstruction · Full entry}
TH04: rebuilding Lotus Land Story’s four PC-98 programs from source - Reconstructs source for the Japanese PC-98 Touhou 4: Lotus Land Story and rebuilds all four DOS programs, MAIN.EXE, OP.EXE, MAINE.EXE and ZUN.COM, with a pinned Borland toolchain under Wine. _{Case study · Independent reconstruction · Full entry}
inFAMOUS Second Son native PC port - Runs the PS4 inFAMOUS Second Son’s own x86-64 code natively on Windows and Linux: a runtime reimplements the PS4 system libraries the game uses, and a shadPS4-derived core translates its GPU commands and shaders to Vulkan. _{Case study · Independent reconstruction · Full entry}
xoreos: an open reimplementation of BioWare’s Aurora engine family - Reimplements BioWare’s Aurora engine and its later derivatives as a portable C++ engine that runs on the user’s installed game data, targeting nine games from Neverwinter Nights to Dragon Age II. _{Case study · Independent reconstruction · Full entry}
librw: a re-implementation of the RenderWare Graphics engine - Re-implements a large part of the RenderWare Graphics middleware API as a portable C++ library that reads and writes its DFF model and TXD texture files for PS2, D3D8, D3D9 and Xbox and is meant to convert them between platforms. _{Case study · Independent reconstruction · Full entry}
Super Mario Odyssey: per-function matching decompilation of the Switch executable - Reconstructs C++ source for Super Mario Odyssey’s Switch 1.0 main executable and checks each function against the original AArch64 machine code with the shared nx-decomp-tools checker. _{Case study · Independent reconstruction · Full entry}
Star Fox 64: a complete matching Nintendo 64 decompilation - Reconstructs C source for the US 1.1 (Rev A) Nintendo 64 release of Star Fox 64 that, compiled with the IDO compiler through a static recompilation, rebuilds a ROM with the published MD5; the README badge counts all 2,951 functions as matching. _{Case study · Independent reconstruction · Full entry}
Metroid Prime: the PrimeDecomp matching GameCube decompilation - Reconstructs C++ source for Metroid Prime’s GameCube executable and its NES-emulator module so that CodeWarrior builds match the originals, across the USA, Korean, PAL and Japanese releases, with early configurations for demo discs and three Wii releases. _{Case study · Independent reconstruction · Full entry}
Batla 3D server emulator (2015 client) - C# server emulator for the 2015 Steam client of Batla 3D, covering HTTP account, shop and room services and Lidgren UDP gameplay. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
RSDKv4 Decompilation: Retro Engine v4 and the Sonic 1 & 2 (2013) menus - Decompiles Retro Engine (RSDK) v4, the engine behind Sonic the Hedgehog and Sonic the Hedgehog 2 (2013), together with the games’ natively coded menus, and builds it for Windows, Linux and Android. _{Case study · Independent reconstruction · Full entry}
OpenRW: an open re-implementation of the Grand Theft Auto III engine - Re-implements Rockstar Games’ Grand Theft Auto III (2001) as a cross-platform C++ engine that runs on the data of a legitimate PC copy. _{Case study · Independent reconstruction · Full entry}
CoD4 Rewrite: Rust/Bevy reconstruction - A Rust/Bevy reconstruction of Call of Duty 4 multiplayer systems, using assets from a local game installation. _{Case study · Independent reconstruction · Also: Binary · Full entry}
libd2: Diablo II 1.14d engine-core libraries - Zig libraries reconstructing Diablo II 1.14d seeded maps, item generation, saves, simulation rules and network formats. _{Case study · Independent reconstruction · Also: Binary, Protocol · Full entry}
Underworld Exhumed: reconstructing Ultima Underworld I and II - Pairs reconstructed DOS sources with native ports of Ultima Underworld I and II. _{Case study · Independent reconstruction · Also: Binary · Full entry}
LineWars II: a portable SDL3 reconstruction - Provides an SDL3 backend for a portable-C reconstruction of the 1994 DOS game. _{Case study · Independent reconstruction · Also: Binary · Full entry}
BFM-decomp: Brave Fencer Musashi matching decompilation - Documents an agent-assisted reconstruction of the USA PlayStation game with a pinned compiler and whole-binary SHA-1 gates. _{Case study · Independent reconstruction · Also: Binary · Full entry}
Snowboard Kids: an agent-assisted N64 matching decompilation - A matching decompilation of the original Nintendo 64 Snowboard Kids that rebuilds SHA1-identical North American and Japanese ROMs from a user-supplied ROM. _{Case study · Independent reconstruction · Full entry}
Sonic Advance 3: an AI-assisted match of one enemy module - Macabeus’s dated study describes prompting Claude Sonnet 3.5 and DeepSeek R1 with assembly, similar decompiled functions and structs to write matching C for Marun, one enemy module of the community Sonic Advance 3 GBA decompilation. _{Case study · Independent reconstruction · Full entry}

Tools, projects and integrations

RenderDoc - Inspect frame captures, draw calls, shaders, and graphics resources in your own game or graphics application. _{Tool · Also: App · Full entry}
AssetRipper - Analyze Unity game files, inspect asset dependencies, and convert supported assets into Unity project formats. _{Tool · Full entry}
Cpp2IL - Recover managed representations from Unity IL2CPP builds using binary and metadata analysis; reconstruction remains a work in progress. _{Tool · Also: App, Binary · Full entry}
Il2CppDumper - Recover IL2CPP metadata and dummy assemblies, and generate helper scripts for native analysis tools; method code is not restored. _{Tool · Also: App, Binary · Full entry}
RenderDoc MCP - Expose existing RenderDoc captures to an agent for bounded frame, pipeline, resource, and shader inspection. _{Integration · Independent MCP · Also: App · Full entry}
UndertaleModTool - Browse and modify supported GameMaker data files, extract assets, and decompile or compile GML VM code. _{Tool · Full entry}
frida-il2cpp-bridge - Inspect IL2CPP classes, methods, and fields in a live process, and trace or intercept method calls without supplying global-metadata.dat. _{Tool · Also: App · Full entry}
objdiff - Compare functions and data in reference and rebuilt object files to guide matching decompilation. _{Tool · Also: Binary · Full entry}
decomp-permuter - Randomly or systematically permutes one C function, recompiling each variant and scoring it against a target object file to search for matching compiler output. _{Tool · Also: Binary · Full entry}
asm-differ - Diffs original and rebuilt assembly for one function or ROM address to guide matching decompilation; its watch mode can rerun make when sources change. _{Tool · Also: Binary · Full entry}
UE Explorer - Explore Unreal packages through class, property, and dependency trees; decompile and export UnrealScript classes, inspect bytecode, and examine structured binary data. _{Tool · Also: Binary · Full entry}
GARbro - Browse recognized visual-novel resource archives as folders, preview their contents, and extract images or audio with conversion to common formats. _{Tool · Full entry}
Godot RE Tools - Recover supported Godot project files, GDScript and imported resources from exported games. _{Tool · Full entry}
UE4SS - Inspect Unreal Engine games at runtime through live UObject property views, reflected C++ header dumps, property mappings and actor dumps. _{Tool · Full entry}
FModel - Explore Unreal Engine game archives with CUE4Parse-backed package and property inspection, asset previews and export. _{Tool · Full entry}
PSP Web Recomp - Translate PSP MIPS executables into C++ and WebAssembly, backed by a PSP high-level emulation runtime and WebGL2 renderer. _{Project · Also: Website · Full entry}
N64: Recompiled - Statically recompiles N64 MIPS binaries into C functions from symbol metadata, emitting function lookups and relocation macros so a runtime can handle statically linked and relocatable overlays. _{Tool · Also: Binary · Full entry}
XenonRecomp - Converts Xbox 360 PowerPC executables into C++ that can be compiled for other platforms, with the XenonAnalyse companion detecting jump tables and function boundaries. _{Tool · Also: Binary · Full entry}
decomp.me - Collaborative decompilation website for matching work: its compile service builds candidate source with a selected platform compiler, assembles the target assembly and diffs the two objects with asm-differ. _{Tool · Also: Binary · Full entry}
splat - Binary splitter for decompilation and modding projects: a YAML config says where and how to cut an N64 ROM or PSX, PS2 or PSP binary into code, data and asset segments. _{Tool · Also: Binary · Full entry}
m2c - Decompiler for matching projects that turns GNU as-format 32-bit MIPS, ARM, PowerPC and SuperH assembly into draft C, with partial C++ support. _{Tool · Also: Binary · Full entry}
decomp-toolkit - GameCube/Wii matching-decompilation toolkit that analyzes DOL and REL executables and, from a project configuration, splits them into relocatable objects plus an ldscript.lcf for CodeWarrior's linker, so decompiled objects can replace original ones while the relinked binary is checked against the original. _{Tool · Also: Binary · Full entry}
Cheat Engine MCP Bridge - Connects MCP clients to Cheat Engine through a Lua bridge script and a Python MCP server, so an agent can inspect a process the user runs under Cheat Engine: memory reads and value scans, pointer-chain resolution, structure dissection, RTTI class names, disassembly, cross-references and hardware or DBVM breakpoints. _{Integration · Independent MCP · Also: Binary · Full entry}
ido-static-recomp - Statically recompiles the IRIX MIPS programs of SGI's IDO 5.3 and 7.1 C toolchain, such as cc, cfe, uopt, ugen and as1, into native Linux, macOS and Windows executables, so matching decompilation projects can build with the original compiler code on modern hosts. _{Tool · Also: Binary · Full entry}
PS2Recomp - Experimental static recompiler that translates MIPS R5900 code from PlayStation 2 ELF executables into C++ and links it with a bundled runtime. _{Tool · Also: Binary · Full entry}
Xenosaga I Decomp Compatibility Kit - Checks a PS2 matching decompilation from outside its own build: the C is recompiled with a stock, unpatched ee-gcc 2.96 and assembler, then each function is byte-compared against the original and every difference is classified by its likely toolchain cause. _{Tool · Also: Binary · Full entry}
GB Recompiled - Static recompiler that turns Game Boy and Game Boy Color ROMs into portable C projects: it decodes and analyzes banked LR35902 code, emits C with machine-readable metadata, and links it with a shared SDL2 runtime for video, audio, input, saves and hardware timing. _{Tool · Also: Binary · Full entry}
dtk-template - Project template for starting GameCube and Wii matching-decompilation repositories around decomp-toolkit. _{Tool · Full entry}
N64ModernRuntime - Runtime for N64Recomp static recompilations and traditional source ports of N64 games, made of two libraries. _{Tool · Full entry}
REDscript - Compiler and decompiler toolkit for REDscript, a statically typed, object-oriented language for writing scripts for REDengine, CD Projekt's engine used in Cyberpunk 2077. _{Tool · Full entry}
Spice86 - PC emulator for executing, reverse engineering and rewriting real-mode DOS programs whose source code is unavailable. _{Tool · Also: Binary · Full entry}
PS2 Web Recomp - Statically recompiles PlayStation 2 games for the browser: eerecomp translates the Emotion Engine code of a game's boot executable into C++ that is compiled to WebAssembly, and a runtime emulates the rest of the console, including a high-level EE kernel, an interpreted I/O processor running the disc's IRX modules, the vector units, SPU2 sound and the Graphics Synthesizer on WebGPU compute shaders. _{Tool · Also: Binary · Full entry}
xboxrecomp - Static-recompilation toolkit for original Xbox games: a Python pipeline parses a retail XBE, disassembles it, classifies library functions, recovers calling conventions and lifts every x86 function to C. _{Tool · Also: Binary · Full entry}
PCSX-Redux - PlayStation 1 emulator forked from PCSX and built around development and reverse engineering, with an interpreter and dynamic recompiler, software and OpenGL renderers, a MIPS debugger, VRAM viewer, SPU and GPU debugging tools, and a built-in GDB server that its documentation connects to gdb, IDA Pro and Ghidra's debugger. _{Tool · Also: Binary · Full entry}
Il2CppInspector - Static analysis tool for Unity IL2CPP applications that reads an IL2CPP binary with its global-metadata.dat and outputs the application's type structure and method addresses as C# stub code, .NET assembly shim DLLs for decompilers such as ILSpy and dnSpy, IDA and Ghidra Python scripts that apply symbols and types, C++ type scaffolding and JSON address maps. _{Tool · Also: App, Binary · Full entry}
MelonLoader - Mod loader for Unity games on both the Mono and IL2CPP runtimes, which loads plugins and mods from folders in a locally installed game; on Windows a proxy DLL, version.dll by default, starts it with the game. _{Tool · Full entry}
BepInEx - Plugin and patching framework for Unity Mono, Unity IL2CPP and .NET Framework games such as XNA, FNA and MonoGame titles, which loads mods and analysis plugins into a locally installed game. _{Tool · Full entry}
ReXGlue SDK - Experimental SDK for statically recompiling Xbox 360 executables into portable C++23 that runs natively on Windows, Linux and macOS. _{Tool · Also: Binary · Full entry}
ps3recomp - Toolkit and runtime for statically recompiling PlayStation 3 games into native executables. _{Tool · Also: Binary · Full entry}
Nebula (NebulaFD) - Work-in-progress decompiler for games made with Clickteam Fusion 2.5, with fixes for older Multimedia Fusion 1.5 files. _{Tool · Full entry}
swe1r-assets-unity: Racer model-block editor sample - Work-in-progress Unity editor sample for importing and modifying Star Wars Episode I: Racer model blocks, then serializing them back through swe1r-assets. _{Tool · Full entry}

App

↑ Contents

Case studies

Aegis: trace a login-code calculation - An official APK investigation follows TOTP methods in Aegis and publishes artifact identities and selected Evidence. _{Case study · Official REA · Full entry}
Notion: trace the clipboard bridge - Trace a packaged Electron clipboard path using REA findings and separate source inspection; the dynamic wrapper remains a stated limit. _{Case study · Official REA · Full entry}
PicoPrint: LX-D02 printer investigation - The author describes REA-assisted Android investigation followed by separate Hermes decompilation to support a Windows BLE printer. _{Case study · Mixed workflow · Also: Protocol · Full entry}
ReaCut: video-editor reconstruction - An independent video editor whose authors document REA-assisted investigation of Jianying/CapCut behavior and project formats. _{Case study · Mixed workflow · Full entry}
CF632BLE: a local client from scale-protocol research - Reimplements the CF632BLE scale’s BLE protocol and body-composition calculations from research on the vendor’s Unique Health Android app. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
zee-rp: reconstructing supported Axure RP 11 document operations - Reads and rewrites supported native Axure RP 11 documents through a binary-record codec, reference-aware cloning and constrained interaction writers. _{Case study · Independent reconstruction · Full entry}
Virtual Desktop Streamer: rehosting the platform layer on Linux - An author-reported Claude Code and REA workflow replaces the macOS streamer’s capture, encoding, audio and input layer with Linux implementations while reusing vendor protocol libraries. _{Case study · Mixed workflow · Full entry}
Open Claude UI: REA-informed interface reference components - Publishes React components, motion helpers and design-system notes derived from the author’s reported REA investigation of Claude Desktop. _{Case study · Mixed workflow · Full entry}
PlxNative: reconstructing a native webOS media-client interface - An unofficial Plex client built after the author investigated LG webOS native media interfaces with Ghidra and coding agents. _{Case study · Independent reconstruction · Full entry}
Windows Calculator: reconstructing percentage rules - REA’s case traces the installed Windows Calculator model DLL to explain different percentage behavior for multiplication/division and other operations. _{Case study · Official REA · Also: Binary · Full entry}
Feishu: an author-reported isolated second app instance - The author reports using Codex and REA analysis to adapt a separate macOS Feishu copy with its own application identity, data directory and single-instance lock. _{Case study · Mixed workflow · Full entry}
PhotoCraft: editor workflow reconstruction and PSD round-trip boundaries - The authors describe this Rust image editor as a clean-room reimplementation of Photoshop-style workflows. _{Case study · Independent reconstruction · Full entry}
WordCraft: document workflow reconstruction and bounded DOCX compatibility - The authors describe WordCraft as a clean-room Rust implementation of familiar Microsoft Word workflows. _{Case study · Independent reconstruction · Full entry}
GridCraft: spreadsheet workflow reconstruction and XLSX round-trip limits - The authors describe GridCraft as a clean-room Rust implementation of Excel-style spreadsheet workflows. _{Case study · Independent reconstruction · Full entry}
DeckCraft: presentation workflow reconstruction and bounded PPTX interchange - The authors describe DeckCraft as a clean-room Rust implementation of PowerPoint-style presentation workflows. _{Case study · Independent reconstruction · Full entry}
Ledger Reborn: an independent accounting app informed by QuickBooks study - The maintainer reports using REA and Ghidra to study selected QuickBooks Desktop for Mac behavior, then independently implements a local accounting application. _{Case study · Mixed workflow · Full entry}
Pocket Tasks: reconstructing task state and persistence - A teaching case with disclosed prior source access carries a REA-assisted investigation of a small command-line app into a separate Node implementation. _{Case study · Mixed workflow · Full entry}
Open Scrantic: reconstructing the Johnny Castaway screensaver engine - Reconstructs the Johnny Castaway screensaver engine in Rust, with author-disclosed REA and Claude Code use. _{Case study · Mixed workflow · Full entry}
Screen Studio: an author-reported REA study of auto-zoom rules - The author reports using REA to map Screen Studio’s Electron package, reading six auto-zoom and cursor rules from its obfuscated code with Claude Code’s help, and having Claude Code write an independent recorder and renderer from those rules. _{Case study · Mixed workflow · Full entry}
Claude Code background lab: an REA-informed reimplementation of a desktop animation - Reimplements the glyph-wind background of the Claude desktop app’s Claude Code New session view as an offline WebGL2 page with a 38-slider control panel. _{Case study · Mixed workflow · Full entry}
LSX II Volume Fixer: reconstructing volume behavior - Uses measured USB-volume behavior and a macOS audio proxy to map volume keys to a KEF LSX II’s LAN control. _{Case study · Independent reconstruction · Full entry}
UU Remote on Linux: an unofficial protocol implementation - Implements an unofficial native Linux host for NetEase UU Remote, using protocol behavior the maintainer says was recovered from official-client traffic and shipped programs. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
TCLimate: reconstructing selected TCL Home cloud controls - Implements selected TCL Home air-conditioner controls and electricity reporting in a native macOS menu-bar app. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
Browserbase plugin: re-hosting Claude in Chrome’s browser bridge - Stands in for the Claude in Chrome extension side of Claude Code’s local browser bridge and runs the requested actions in Browserbase cloud browsers. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
Visor: an independent Ray-Ban Meta glasses client - Implements an Android replacement for the Meta AI companion app that speaks the Ray-Ban Meta glasses’ own Bluetooth and Wi-Fi Direct protocol, imports media, exposes settings and answers “Hey Meta” with a model the user chooses. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
wine-uwp: running packaged Windows Store apps on a patched Wine - Extends Wine 11.17 so that signed MSIX Store apps, with Shapr3D as the main target, install and run on Linux without their source or symbols. _{Case study · Independent reconstruction · Full entry}
RKD Telemetry Extractor: decoding Race-Keeper track-day recordings - Documents the proprietary .rkd telemetry format written by Race-Keeper “Instant Video” recorders, whose bundled player runs only on Windows, and implements matching Python and Go parsers that export GPS and IMU channels as Telemetry Overlay CSV and GPX. _{Case study · Independent reconstruction · Full entry}
Elgato HDR: a userspace capture path for the Elgato 4K X’s 10-bit mode - A native macOS app that reaches the Elgato 4K X capture card’s 10-bit P010 video mode, which the project says Apple’s built-in webcam driver does not expose to apps. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
LGwebOS-menubar: a native macOS remote for LG webOS TVs - A native macOS menu-bar app that pairs with an LG webOS TV over its local encrypted WebSocket interface to launch apps, switch inputs, adjust volume and picture settings, send pointer input and cast selected media. _{Case study · Independent reconstruction · Full entry}
Galaxy Buds Client: an unofficial manager built on Samsung’s earbud protocol - Reimplements control of Samsung Galaxy Buds over their proprietary RFCOMM serial protocol in a cross-platform desktop and Android manager. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
Wino Mail: recreating Windows Mail and Calendar - Native Windows client that aims to preserve the familiar Windows Mail and Calendar experience while rebuilding its functionality. _{Case study · Independent reconstruction · Full entry}
ScooterLink: reconstructing Honda RoadSync’s handlebar-button protocol - Replaces Honda RoadSync’s Apple Music-only media control with an iOS app that pairs with a Honda PCX 2025 TFT dash over Bluetooth Low Energy and turns handlebar presses into system-wide commands for any player. _{Case study · Independent reconstruction · Also: Protocol · Full entry}
iX500 Scan: a macOS client for the reverse-engineered ScanSnap Wi-Fi protocol - Replaces ScanSnap Home for a Fujitsu/PFU ScanSnap iX500 on macOS with a SwiftUI app and Python service that scan over Wi-Fi through the community-reverse-engineered VENS protocol, or over USB through SANE, and produce searchable PDFs. _{Case study · Independent reconstruction · Also: Protocol · Full entry}

Tools, projects and integrations

JADX-AI-MCP - JADX plugin paired with a Python MCP server to inspect decompiled Android classes, resources, cross-references and debugger context. _{Integration · Independent MCP · Full entry}
apktool-mcp-server - Python MCP server that drives a local Apktool install so agents can decode APKs; list, read, search and edit smali and resource files; read AndroidManifest.xml and apktool.yml; and rebuild the project. _{Integration · Independent MCP · Full entry}
frida-mcp (yfe404) - Frida MCP server with persistent instrumentation sessions, runtime inspection and Android static-to-dynamic navigation. _{Integration · Independent MCP · Also: Game · Full entry}
Super Trouper - Single-binary Frida MCP server for discovering devices, managing process sessions and loading instrumentation scripts. _{Integration · Independent MCP · Also: Game · Full entry}
Frida - Dynamic instrumentation toolkit for observing and scripting the behavior of live native and managed processes. _{Tool · Also: Game · Full entry}
JADX - Dex-to-Java decompiler with CLI/GUI navigation, resource decoding and cross-reference search for Android packages. _{Tool · Android · Full entry}
Apktool - Decodes Android resources and smali into a project-like tree and can rebuild modified packages. _{Tool · Android · Full entry}
Androguard - Python toolkit for APK/DEX metadata, bytecode and reference analysis; the v5 source branch also documents agent skills and MCP. _{Tool · Android · Full entry}
ILSpy - .NET assembly browser and C# decompiler with whole-project export, metadata inspection and a scriptable command-line frontend. _{Tool · .NET · Full entry}
dnSpyEx - Community continuation of dnSpy for debugging and editing .NET assemblies without the original source. _{Tool · .NET · Full entry}
@electron/asar - Electron's archive tool lists and extracts ASAR contents so packaged JavaScript and application assets can be inspected. _{Tool · Also: Website · Full entry}
Mobile Security Framework (MobSF) - Inspect mobile application packages with static analysis and supported-device dynamic testing, including runtime behavior and network traffic, through a web interface and APIs. _{Tool · Android · Full entry}
objection - Explore running Android and iOS apps with a Frida-backed command interface for inspecting app storage, memory, runtime objects, and instrumented behavior. _{Tool · Android · Full entry}
Grapefruit - Inspect and hook running iOS and Android apps from a Frida-based web interface, with method and crypto-API hooks, filesystem and SQLite browsers, iOS keychain and UI-hierarchy views, and HTTP capture from common networking libraries. _{Tool · Full entry}
Blutter - Analyze Flutter Android ARM64 AOT binaries using the matching Dart runtime. _{Tool · Android · Also: Binary · Full entry}
hermes-dec - Parse, disassemble and partially decompile React Native Hermes bytecode bundles. _{Tool · Android · Full entry}
Recaf - Inspect and modify compiled JVM applications with integrated decompilers, bytecode assembly, reference search, mappings and deobfuscation tools. _{Tool · JVM · Also: Binary · Full entry}
nibkit - Decode compiled iOS/macOS interface archives into object trees, Outlet/Action connections, custom classes and navigation relationships. _{Tool · Full entry}
AOTopsy - Statically inspect Flutter/Dart AOT libapp.so files to recover available metadata, class structures, call edges and pseudocode without embedding a Dart VM or compiling a matching SDK. _{Tool · Android · Also: Binary · Full entry}
hbctool - Disassemble and reassemble supported React Native Hermes bytecode bundles through HASM files, enabling bytecode inspection and editing for the explicitly supported legacy HBC versions. _{Tool · Android · Full entry}
Vineflower - Fernflower-derived decompiler for Java and other JVM languages that continues the ForgeFlower, Fabric and Quiltflower forks, focused on output quality and modern Java, including records, sealed classes, switch expressions and pattern matching through Java 21+. _{Tool · JVM · Full entry}
Droid ASC - Python Android decompiler that answers queries directly against an APK instead of first unpacking and indexing it. _{Tool · Android · Full entry}
APKEditor - Command-line APK editor built on ARSCLib that decodes an APK's binary resources and DEX into editable JSON, XML or smali and rebuilds a package from them, independent of aapt and aapt2. _{Tool · Android · Full entry}
jnitrace - Frida-based dynamic-analysis tool that traces an Android app's use of the JNI API, similar to frida-trace or strace but for the Java Native Interface. _{Tool · Android · Full entry}
AsmResolver - C# library for reading, modifying and rebuilding Portable Executable files, covering both native Windows images and images with .NET metadata. _{Tool · .NET · Also: Binary · Full entry}
CodemerxDecompile - Cross-platform desktop .NET decompiler maintained by the original JustDecompile creators as a continuation of their JustDecompile Engine, built with Mono.Cecil and an Avalonia UI. _{Tool · .NET · Full entry}
wxapkg - Desktop GUI for Windows and macOS, built with Wails, that unpacks WeChat mini-program .wxapkg packages for study. _{Tool · Full entry}
React Native Decompiler - Alpha-stage Node.js CLI that splits a React Native JavaScript bundle (index.android.bundle or main.jsbundle), an unbundled js-modules folder, or Webpack entrypoint and chunk bundles into one readable file per module. _{Tool · Full entry}
hermes-decomp - Rust decompiler and analysis toolkit for Hermes bytecode (.hbc), the compiled form React Native apps ship for the Hermes engine; the README lists HBC versions 40 to 99. _{Tool · Android · Full entry}
MEDUSA - Modular Frida-based framework for runtime analysis of Android and iOS apps the analyst is authorized to test. _{Tool · Android · Full entry}
Android Unpinner - Tool from the mitmproxy project that removes certificate pinning from an Android APK you own or are authorized to test, without a rooted device. _{Tool · Android · Also: Protocol · Full entry}
apk-mitm - Command-line tool that prepares an Android APK you own or are authorized to test for HTTPS traffic inspection. _{Tool · Android · Also: Protocol · Full entry}
Frida Mobile Interception Scripts - A set of Frida scripts from HTTP Toolkit for inspecting a mobile app's HTTPS traffic while analysing apps you own or are authorized to test. _{Tool · Android · Also: Protocol · Full entry}
reFlutter - Flutter reverse-engineering framework for apps the analyst is authorized to inspect. _{Tool · Android · Also: Protocol · Full entry}
ddc - Rust decompiler that turns Android DEX bytecode, versions 035 to 041, from APKs, multi-dex apps and XAPK/APKS/APKM containers into Java, folding lambdas and string concatenation back into Java syntax and giving locals jadx-style names. _{Tool · Android · Full entry}
Simplify - Generic Android deobfuscator built on smalivm, a sandboxed Dalvik virtual machine that executes each method and records every possible register and class value along all execution paths, taking both branches when a value such as file or network input is unknown. _{Tool · Android · Full entry}
GDA (GJoy Dex Analyzer) - Windows-native Dalvik decompiler and Android analysis workbench written in C++ that opens APK, DEX, ODEX, OAT, JAR, AAR and class files without installation. _{Tool · Android · Full entry}
APKLab - VS Code extension that turns the editor into an Android reverse-engineering workbench around Apktool, Jadx, smali-lsp and uber-apk-signer. _{Tool · Android · Full entry}
Fernflower - JetBrains' analytical decompiler that turns Java class files back into Java source; IntelliJ IDEA bundles it to show code when debugging or browsing class files. _{Tool · JVM · Full entry}
Bytecode Viewer - Desktop suite for inspecting compiled Java and Android programs: drop in a class, JAR, WAR, APK, DEX, XAPK or APKM file to browse its classes and resources, with up to three decompiler or disassembler views side by side. _{Tool · JVM · Full entry}
Logic-Lens - Experimental JavaScript source-analysis toolkit that classifies AST-token sequences into configured formula families after local training, and produces heuristic structure, call-graph and intent reports. _{Tool · Full entry}
Android Security Toolkit - Local Python APK triage tool that drives apktool and strings, checks manifest settings and source/native-library strings, and produces TXT/JSON findings for manual review. _{Tool · Android · Full entry}
ilspy-cli: targeted .NET decompilation for agents - Rust CLI that hosts an ILSpy C# bridge in-process for assembly, type and named-method decompilation, source search and structured JSON output. _{Tool · .NET · Full entry}
React-Decode - Static-analysis CLI for compiled React JavaScript that produces readable bundle output and inferred API-request, route and application-constant reports. _{Tool · Also: Website · Full entry}

Native Binary

↑ Contents

Case studies

DownUnderCTF: masked-squares flag checker - An official educational challenge investigation connects binary checks to equations and records an original-program validation. _{Case study · Official REA · Full entry}
Show Your Work: a measured dissection of REA's evidence architecture - An unofficial field study that reads REA's source and then drives the running server through 1,012 recorded calls across 27 artifact classes, measuring its content-addressed Evidence records, revision-chained unknown ledger, typed refusals, cold starts and response limits. _{Case study · Mixed workflow · Full entry}

Tools, projects and integrations

Ghidra - Open-source analysis suite for disassembly, decompilation, graphs and Java/Python automation across executable formats. _{Tool · Also: Game, Firmware · Full entry}
radare2 - Scriptable command-line framework for inspecting, disassembling, debugging and modifying binaries across many architectures. _{Tool · Also: Game · Full entry}
Cutter - Rizin-powered graphical reverse-engineering workspace with extensible views and Ghidra decompiler integration. _{Tool · Also: Game · Full entry}
Qiling - Python emulation framework that adds OS, filesystem and API behavior around CPU emulation for instrumented binary analysis. _{Tool · Also: Firmware · Full entry}
Unicorn Engine - Multi-architecture CPU emulator for executing selected instruction ranges with register, memory and hook control. _{Tool · Library · Also: Game, Firmware · Full entry}
angr - Python binary-analysis framework combining control-flow recovery, symbolic execution, data-flow analysis and decompilation. _{Tool · Library · Full entry}
LIEF - Library for structured parsing and modification of executable formats including ELF, PE and Mach-O. _{Tool · Library · Full entry}
Capstone - Disassembly library with architecture-neutral APIs and instruction details for custom binary-analysis pipelines. _{Tool · Library · Full entry}
ImHex - Hex editor with a binary-pattern language, structured data inspection and visual tools for understanding file formats. _{Tool · Also: Game, Firmware · Full entry}
x64dbg - Windows binary debugger with disassembly, memory views and plugins for analyzing programs without source code. _{Tool · Full entry}
GDB - Native and remote debugger for controlling execution and inspecting live or crashed program state. _{Tool · Also: Game · Full entry}
rr - Records process execution and replays it under GDB, enabling repeatable inspection and reverse execution. _{Tool · Full entry}
Diaphora - IDA-based binary diffing that matches functions and transfers names, comments and types between analyzed versions. _{Tool · Also: Game · Full entry}
BinDiff - Compares disassembled binaries to find matching functions and changed code across versions. _{Tool · Also: Game · Full entry}
Detect It Easy - Format-aware file identification and static inspection using parsers, signatures and programmable heuristics. _{Tool · Also: Game · Full entry}
r2frida - Use radare2 commands and Frida instrumentation together to inspect local or remote process memory, symbols, classes, and runtime calls on desktop and mobile targets. _{Tool · Also: App · Full entry}
Kaitai Struct - Turn documented binary layouts into reusable parsers for files and network packets. _{Tool · Library · Also: Firmware, Protocol · Full entry}
GoReSym - Recover Go build metadata, function names and address ranges, source file and line tables, embedded types and strings from Go binaries, including stripped and some malformed unpacked samples. _{Tool · Full entry}
rev.ng - Open-source decompilation pipeline that lifts x86-64, AArch64, i386, ARM and MIPS code with QEMU, runs LLVM-based analyses and emits C designed to be valid and recompilable. _{Tool · Full entry}
Rizin - Command-line reverse-engineering framework that began as a fork of radare2. _{Tool · Full entry}
Decompiler Explorer - Web service at dogbolt.org that runs one small uploaded executable through many decompilers and shows their C-like output side by side, described as Compiler Explorer in reverse. _{Tool · Full entry}
pwndbg - Python plug-in that loads into GDB, or runs as a REPL around LLDB, to make live program state easier to inspect. _{Tool · Full entry}
DynamoRIO - Runtime code manipulation system for building dynamic tools that observe or transform any part of an unmodified program while it runs. _{Tool · Full entry}
Decompyle++ (pycdc) - C++ disassembler and decompiler for compiled Python bytecode that aims to support bytecode from any Python version. _{Tool · Also: App · Full entry}
cwe_checker - Static analyzer from Fraunhofer FKIE that searches binary executables, mainly Linux and Unix ELF files, for code paths matching Common Weakness Enumeration bug classes such as buffer overflows, use-after-free and double free, NULL pointer dereferences, format strings and integer overflows. _{Tool · Also: Firmware · Full entry}
FLARE-VM - Mandiant FLARE installer that sets up and maintains a Windows virtual machine for reverse engineering and malware analysis. _{Tool · Full entry}
B2R2 - Binary analysis framework written in F# for .NET by KAIST's SoftSec Lab. _{Tool · Library · Full entry}
rz-ghidra - Rizin plugin that embeds Ghidra's C++ decompiler and Sleigh disassembler, so no Java Ghidra installation is needed. _{Tool · Full entry}
dewolf - Research decompiler from Fraunhofer FKIE, developed with Singapore's DSO National Laboratories between 2019 and 2021, that runs as a Binary Ninja plugin and starts from Binary Ninja's Medium Level IL. _{Tool · Full entry}
decomp2dbg - Decompiler-to-debugger bridge that serves function names, global variables, stack and register variable names and decompiled code from IDA Pro, Binary Ninja, Ghidra or angr-management to GDB over an XML-RPC connection. _{Tool · Full entry}
E9Patch - Static binary rewriter for x86-64 Linux ELF executables and shared objects that inserts instrumentation without control-flow recovery and writes a drop-in replacement binary, following the PLDI 2020 paper Binary Rewriting without Control Flow Recovery. _{Tool · Full entry}
Rellic - Trail of Bits implementation of the pattern-independent structuring algorithm from the No More Gotos paper, turning LLVM bitcode into goto-free C as a small, hackable decompiler back end that interoperates with LLVM and Remill. _{Tool · Library · Full entry}
ghidra-delinker-extension - Ghidra extension that delinks a selected part of a program back into a relocatable object file. _{Tool · Also: Game · Full entry}
BinExport - The exporter component of BinDiff: plugins for IDA Pro and Binary Ninja and an extension for Ghidra that write an analyzed disassembly to the Protocol Buffer format BinDiff requires. _{Tool · Full entry}
Karta - Source-code-assisted IDA Python plugin from Check Point Research that finds and matches open-source libraries compiled into large binaries and firmware. _{Tool · Also: Firmware · Full entry}
VTIL-Core - C++20 core of the VTIL (Virtual-machine Translation Intermediate Language) project, an intermediate language and optimizing compiler that the README describes as built for binary de-obfuscation and de-virtualization. _{Tool · Library · Full entry}
Frida Workbench for VSCode - Unofficial Visual Studio Code extension for Frida work. _{Tool · Also: App · Full entry}
ghidriff - Command-line binary diffing engine that drives Ghidra headlessly through pyghidra: it imports and analyzes an old and a new binary, then reports added, deleted and modified functions, with patch diffing as its main use. _{Tool · Also: Firmware · Full entry}
Ddisasm - GrammaTech's Datalog disassembler, which turns ELF and PE binaries for x86-32, x86-64, ARM32, ARM64 and MIPS32 into the GTIRB intermediate representation. _{Tool · Full entry}
PINCE - Linux front end for the GNU Debugger (GDB), focused on games but usable for other reverse engineering; the name stands for “PINCE is not Cheat Engine”. _{Tool · Also: Game · Full entry}
uncompyle6 - Cross-version decompiler that translates Python bytecode back into equivalent Python source, accepting bytecode from Python 1.0 through 3.8 as well as some PyPy bytecode and Dropbox's Python 2.5. _{Tool · Also: App · Full entry}
ret-sync - Reverse-Engineering Tools SYNChronization: plugins that keep IDA, Ghidra or Binary Ninja graph and decompiler views following a live WinDbg, GDB, LLDB, OllyDbg 1.10/2 or x64dbg session, rebasing addresses on the fly so ASLR does not break the mapping. _{Tool · Full entry}
PyInstaller Extractor (pyinstxtractor) - Single-file Python script that extracts the contents of executables built with PyInstaller, including Linux ELF builds without other tools. _{Tool · Also: App · Full entry}
Binary Analysis Platform (BAP) - OCaml binary analysis platform from Carnegie Mellon University. _{Tool · Library · Full entry}
Reko - General-purpose decompiler that loads executables or raw images, scans their machine code into a machine-independent register transfer language, groups it into procedures and decompiles them into high-level C code. _{Tool · Also: Firmware · Full entry}
Dyninst - Binary instrumentation, analysis and modification libraries from the Paradyn project. _{Tool · Full entry}
goblin - Rust crate for zero-copy, endian-aware parsing of ELF32/64, 32/64-bit Mach-O and multi-architecture fat containers, PE32/PE32+, COFF objects, Terse Executable (TE) images and Unix/BSD archives; Object::parse picks the format from its magic bytes. _{Tool · Library · Full entry}
FLOSS (FLARE Obfuscated String Solver) - Mandiant FLARE string extractor for malware analysis that is used like strings.exe but also recovers obfuscated strings. _{Tool · Full entry}
Zydis - Lightweight C11 x86/x86-64 disassembler and code-generation library. _{Tool · Library · Full entry}
QBDI - Quarkslab's modular dynamic binary instrumentation (DBI) framework, which JIT-recompiles a program's basic blocks inside its own process so that an instrumentation tool can register callbacks before or after instructions, on memory reads and writes, and on VM events. _{Tool · Also: App · Full entry}
binsider - Terminal user interface for inspecting ELF binaries. _{Tool · Full entry}
iced - x86 instruction library for 16-, 32- and 64-bit code that decodes, formats, assembles and encodes instructions, with masm, nasm, GNU AT&T and Intel XED output syntaxes. _{Tool · Library · Full entry}
hrtng - IDA plugin published by Kaspersky that extends the Hex-Rays decompiler with tools its author collected for reverse-engineering work, including malware analysis. _{Tool · Full entry}
BinCAT - Static binary code analysis toolkit designed for reverse engineers. _{Tool · Full entry}
GEF (GDB Enhanced Features) - Single-file Python extension, gef.py, that adds dynamic-analysis commands to GDB. _{Tool · Full entry}
Triton - C++ library with Python bindings for dynamic binary analysis of x86, x86-64, ARM32, AArch64 and RISC-V 32/64 code. _{Tool · Library · Full entry}
PyLingual - Research decompiler for CPython bytecode from Python 3.6 onward that pairs per-version transformer models with control-flow reconstruction. _{Tool · Also: App · Full entry}
Miasm - Python reverse-engineering framework for analyzing, modifying and generating binary programs. _{Tool · Library · Full entry}
HyperDbg - Hypervisor-assisted Windows debugger that virtualizes the running system with Intel VT-x and Extended Page Tables to debug kernel and user mode, either locally as a tracing and introspection tool or from a host attached over a serial connection to a guest virtual machine. _{Tool · Full entry}
Kuna - Agent-first decompiler written in Rust that began as a port of Ghidra’s C++ decompiler and SLEIGH compiler, and has since diverged with option-gated features, some ported from angr. _{Tool · Full entry}
Binary Ninja API - Vector 35’s public C++, Python and Rust APIs for Binary Ninja, with their documentation, examples and the open-source plugins built on them. _{Tool · Also: Firmware · Full entry}
capa - Mandiant FLARE tool that reports what an executable can do by matching a YAML rule set against features extracted from PE, ELF and .NET files or 32/64-bit shellcode, such as API calls, imports, strings and constants. _{Tool · Full entry}

Firmware and Hardware

↑ Contents

Case studies

ThinkPad IMX471: recovering camera tuning for Linux - Recovers selected camera-tuning structures from an Intel Windows driver package and uses them to repair Linux image capture on one ThinkPad model. _{Case study · Independent reconstruction · Full entry}
flipper-telink: replacement firmware for Tuya Zigbee remotes - A Flipper Zero app that bit-bangs Telink’s SWire debug interface to dump and reflash TLSR825x Zigbee devices, with static-analysis notes on the dumps and freshly written firmware for two of them. _{Case study · Independent reconstruction · Full entry}
Supermodel: initial Real3D Pro-1000 image-generator emulation - Adds emulation of Real3D’s Pro-1000, the SCSI-attached image generator from which Sega’s Model 3 graphics hardware derives, to the Supermodel arcade emulator. _{Case study · Independent reconstruction · Full entry}
OpenDMCUFirm: a reimplemented Wii U DMCU display firmware - Reimplements in C the firmware of the Wii U’s DMCU, the M68HC11-compatible display microcontroller in its AMD graphics controller, which in Wii mode reads the Video Interface state and configures display output, deinterlacing, scaling and overscan. _{Case study · Independent reconstruction · Full entry}
reflecticon-224: running Lexicon 224 reverb firmware on emulated hardware - Emulates the Lexicon 224, 224X and 224XL digital reverbs so that their own firmware runs in a browser page or a JUCE plugin. _{Case study · Independent reconstruction · Full entry}

Tools, projects and integrations

Binwalk - Identifies embedded formats and optionally extracts their contents, with entropy analysis for firmware triage. _{Tool · Full entry}
unblob - Recursively extracts archives and filesystems from binary blobs while reporting chunk boundaries and unknown regions. _{Tool · Full entry}
Ghidra Firmware Utilities - Ghidra loaders and helpers for PCI option ROMs, UEFI firmware volumes, Intel flash descriptors and coreboot images. _{Tool · Full entry}
EMBA - Extract firmware, combine static checks with emulation-based analysis, inventory software components, and generate web reports and SBOMs for further investigation. _{Tool · Full entry}
Firmware Analysis and Comparison Tool (FACT) - Unpack and analyze firmware through an extensible platform whose web interface and HTTP API make component contents and analysis results searchable and comparable across samples. _{Tool · Full entry}
OFRAK - Recursively identify, unpack, analyze, modify, and repack firmware and binary formats using a resource-tree GUI and Python API, with optional disassembler backends. _{Tool · Also: Binary · Full entry}
FirmAE - Emulate router and IP-camera firmware to inspect network services and runtime behavior, with automated emulation checks and separate analysis, run, and debugging modes. _{Tool · Full entry}
PulseView - Examine captured logic and analog waveforms with sigrok's graphical frontend. _{Tool · Also: Protocol · Full entry}
UEFITool - Parse UEFI firmware images into an inspectable tree and check their structure. _{Tool · Full entry}
Glasgow Interface Explorer - Use FPGA-based open hardware and Python applets to read and write SPI flash, I2C EEPROM and parallel memory chips, determine JTAG pinouts, debug supported processors and analyze UART, SPI and QSPI transactions on physical devices. _{Tool · Also: Protocol · Full entry}
Penguin - Rehost embedded Linux firmware from an extracted root filesystem using a generated, editable configuration of emulation transformations, then refine it through a guest root shell, forwarded network services and recorded dynamic-analysis output. _{Tool · Full entry}
ipsw - Command-line toolkit for Apple firmware research and reverse engineering. _{Tool · Also: App, Binary · Full entry}
avatar² - Python framework from EURECOM's S3 group that orchestrates emulators, debuggers and physical devices for dynamic analysis of embedded firmware. _{Tool · Full entry}
efiXplorer - IDA Pro plugin and loader that automate static analysis of UEFI firmware. _{Tool · Full entry}
vmlinux-to-elf - Rebuild an analyzable ELF with function and variable symbols from a Linux kernel image, whether a raw or compressed vmlinux, vmlinuz, zImage or bzImage blob, certain Android boot.img files or a stripped kernel ELF, by locating and decoding the embedded kallsyms symbol table. _{Tool · Also: Binary · Full entry}
Sony-PMCA-RE - USB tool built from reverse engineering Sony digital cameras. _{Tool · Also: Protocol · Full entry}
cpu_rec - Statistically recognize the CPU instruction set in an arbitrary binary file, such as an unknown firmware image, by comparing Markov-chain byte statistics with a default corpus covering dozens of architectures, from 6502 and 8051 to ARM, MIPS, PowerPC, RISC-V, x86-64 and WebAssembly. _{Tool · Also: Binary · Full entry}
ME Analyzer - Parse Intel Management Engine (CS)ME, TXE and SPS firmware, Graphics System Controller firmware and their independent PMC, PCHC, PHY and option-ROM images to report family, version, release, SKU, platform, size and health status. _{Tool · Full entry}

Protocol

↑ Contents

Case studies

open-appleremote: Siri Remote protocol reconstruction - Reconstructs first-generation Siri Remote Bluetooth reports for Linux, decoding buttons, touch and tvOS-style gestures. _{Case study · Independent reconstruction · Full entry}
GAMEKB-K17: reconstructing a macropad configuration protocol - Implements the vendor HID configuration protocol for the GAMEKB-K17/HCY-K017 macropad. _{Case study · Independent reconstruction · Full entry}
cooler-lcd: a Thermalright display protocol implementation - Implements a USB picture-transfer driver for Thermalright Vision cooler displays, with a Rust dashboard replacing the vendor display application. _{Case study · Independent reconstruction · Full entry}
NJFE: a Soulear camera protocol bridge for desktop inspection - Reuses otoscope's reverse-engineered i4season/Soulear protocol in an ESP32-C3 bridge and Python desktop viewer. _{Case study · Independent reconstruction · Full entry}
hw-harness: scanner USB protocol investigation - Documents an author-reported scanner investigation comparing vendor-driver USB control transfers with Linux-driver traces to infer initialization, timing and resolution parameters. _{Case study · Independent reconstruction · Full entry}

Tools, projects and integrations

Wireshark - Inspect captured application and device traffic as decoded protocol fields, with filtering and shared GUI/TShark dissection. _{Tool · Also: App, Firmware · Full entry}
Netzob - Model communication protocols and infer message layouts from traces, with configured active learning for protocol state machines. _{Tool · Full entry}
Scapy - Script packet dissection, construction, request/reply matching and capture-file analysis in Python. _{Tool · Full entry}
Universal Radio Hacker (URH) - Demodulate and decode signals captured with software-defined radios, with automatic modulation-parameter detection and customizable decodings. _{Tool · Full entry}
SavvyCAN - Capture or load CAN bus traffic and investigate frames with sniffer, graphing, file-comparison and ISO-TP/UDS decoding views; loaded or analyst-edited DBC files map raw bytes to named signals. _{Tool · Full entry}
AALpy - General-purpose Python automata-learning library that infers deterministic, non-deterministic, stochastic and pushdown models of black-box systems from active queries or passive traces. _{Tool · Full entry}
rtl_433 - Receives and decodes transmissions from ISM-band devices such as weather sensors, remote controls, doorbells and alarm sensors, using RTL-SDR or SoapySDR receivers or recorded I/Q files, and emits decoded fields as JSON, CSV, MQTT and other outputs. _{Tool · Full entry}
Blackbox Protobuf - NCC Group's tools for decoding and re-encoding Protocol Buffers messages without the matching .proto definition. _{Tool · Also: App · Full entry}
furiousMAC Continuity - Reverse-engineering notes and a Wireshark dissector for Apple's proprietary Continuity Bluetooth LE advertisements, continuing the authors' PETS 2019 privacy study. _{Tool · Full entry}
opendbc - comma.ai's repository of DBC files describing the CAN messages and signals of many car makes, with a Python library that parses and builds CAN messages from those definitions; its porting guide has contributors reverse engineer new messages from recorded drives in the cabana tool. _{Tool · Full entry}
FISSURE - GNU Radio-based RF framework that carries a signal from survey and detection through IQ capture, inspection, conditioning, feature extraction and classification into a protocol discovery workflow. _{Tool · Full entry}
friTap - Frida-based tool that hooks TLS libraries such as OpenSSL, BoringSSL, NSS and GnuTLS inside a running process and writes NSS key logs and decrypted payloads as PCAP, so analysts can inspect an application's encrypted traffic in Wireshark. _{Tool · Also: App · Full entry}
pbtk - Recover Protobuf message definitions from compiled programs as readable .proto files. _{Tool · Also: App · Full entry}

Agents and MCP

↑ Contents

Also in target sections: Website: Chrome DevTools MCP, Playwright MCP, Burp Suite MCP Server, Spectral · Game: RenderDoc MCP, Cheat Engine MCP Bridge · App: JADX-AI-MCP, apktool-mcp-server, frida-mcp (yfe404), Super Trouper

REA — Reverse Engineer Anything - The upstream CLI and MCP server for evidence-based investigations of shipped software and runtime behavior. _{Project · Official REA · Targets: Website, Game, App, Binary, Firmware · Full entry}
Official reverse-engineer-anything skill - Target routing, connection recovery and evidence practices for agents using REA. _{Integration · Official REA · Targets: Website, Game, App, Binary, Firmware · Full entry}
dsh-mcp-rea - A community MCP bridge presents a smaller selected tool surface and forwards explicit commands to the REA CLI. _{Integration · Community REA · Targets: Website, Game, App, Binary, Firmware · Full entry}
rea-jev - A Claude Code plugin adds Jev-based routing and evidence checks around a pinned REA MCP integration. _{Integration · Community REA · Targets: Website, App · Full entry}
rea-casebook - A Claude Code mod collects received REA Evidence, tracks unknowns and records findings that cite delivered evidence IDs. _{Integration · Community REA · Targets: Binary · Full entry}
Eleven - An agent-first desktop reverse-engineering app that opens Mach-O, ELF and PE binaries, Android packages and GPU kernels, and lets any Agent Client Protocol agent read code, rename functions, add notes and propose patches in a shared window. _{Integration · Community REA · Targets: App, Binary · Full entry}
REA plugin for Hermes Agent - Nous Research’s Hermes Agent plugin package for REA. _{Integration · Community REA · Targets: Website, App, Binary, Firmware · Full entry}
crashlens - A crash-triage tool that turns Linux core dumps, runtime panics, exception traces and sanitizer reports into Markdown bug reports naming the crash type, the first frame in the user’s code and a stable signature. _{Integration · Community REA · Targets: Binary · Full entry}
REA Workspace Template - A clone-first Chinese workspace template for analyzing one target per workspace with REA from Claude Code or Codex. _{Integration · Community REA · Targets: Website, App, Binary · Full entry}
REA Reconstruction Companion - A third-party Agent Skill that works alongside REA’s own skill to turn reverse-engineering evidence into scoped requirements, design, staged implementation and validation, from one feature or format to a whole app. _{Integration · Community REA · Targets: App, Binary · Full entry}
Hex-Rays IDA MCP - Official Hex-Rays MCP server for agent access to IDA databases, with headless operation and optional GUI integration. _{Integration · Independent MCP · Targets: Binary · Full entry}
GhidraMCP - Ghidra extension and MCP bridge exposing decompilation, symbol navigation and renaming to agents, with GUI and headless modes. _{Integration · Independent MCP · Targets: Binary · Full entry}
Binary Ninja MCP (official) - Binary Ninja's own MCP interface exposes functions, symbols, disassembly, intermediate languages and decompiled text to agents. _{Integration · Independent MCP · Targets: Binary · Full entry}
Binary Ninja MCP (fosdickio) - Community Binary Ninja plugin and bridge for MCP clients, including workflows that switch among multiple open binaries. _{Integration · Independent MCP · Targets: Binary · Full entry}
IDA Pro MCP (mrexodia) - Community IDA integration useful for existing setups and migration context; its maintainer now recommends the official Hex-Rays MCP server. _{Integration · Independent MCP · Targets: Binary · Full entry}
Radare2 MCP Server - Native radare2 MCP server offering binary-analysis tools, reusable sessions and configurable read-only access. _{Integration · Independent MCP · Targets: Binary · Full entry}
r2ai - AI plugins inside radare2 for function explanations, naming suggestions and model-assisted decompilation using local or remote models. _{Integration · Independent agent · Targets: Binary · Full entry}
DAILA - Decompiler-independent AI assistant for function summaries and naming across IDA, Ghidra, Binary Ninja and angr-management. _{Integration · Independent agent · Targets: Binary · Full entry}
RevEng.AI Ghidra Plugin - Connects Ghidra to RevEng.AI for function similarity, recovered names, AI explanations and agent-assisted annotation. _{Integration · Independent agent · Targets: Binary · Full entry}
LLDB MCP - LLDB's official MCP interface gives agents debugger sessions and commands for breakpoints, memory inspection and stepping. _{Integration · Independent MCP · Targets: App, Binary · Full entry}
Claude Reverse Engineering Skill - Community agent skill for triage, headless exports and evidence-based RE reports; explicitly documents workflows with REA and other MCP servers. _{Integration · Independent agent · Targets: App, Binary · Full entry}
SpecterOps Reverse Engineering Skills - Focused Binary Ninja and Ghidra analysis skills that describe MCP tool use, analysis recipes and annotation practices. _{Integration · Independent agent · Targets: Binary · Full entry}
pyghidra-mcp - PyGhidra-based MCP server that analyzes every binary in a Ghidra project and exposes decompilation, cross-references, call graphs, symbol and string search, indexed semantic code search, and renaming, typing and comment edits. _{Integration · Independent MCP · Targets: Binary · Full entry}
LeanREA - An independent agent skill that routes application and binary investigations through ordinary command-line tools. _{Integration · Independent agent · Targets: App, Binary · Full entry}
Universal Modder - Packages agent skills, three role briefs, a Python CLI and preconfigured fal MCP settings for modding PC games the user owns. _{Integration · Independent agent · Targets: Game · Full entry}
ReVa (Reverse Engineering Assistant) - Ghidra extension that runs an MCP server inside Ghidra, giving agents decompilation with namespace and cross-reference context, symbol, string, data-type, structure and call-graph tools, program diffing, renaming and PyGhidra scripting. _{Integration · Independent MCP · Targets: Binary · Full entry}
x64dbg-MCP Server - Native x64dbg plugin, written in Zig for both x32dbg and x64dbg, that serves an MCP endpoint over streamable HTTP and SSE from inside the debugger. _{Integration · Independent MCP · Targets: Binary · Full entry}
mcp-windbg - Independent, community-built MCP server that runs Microsoft's cdb.exe and kd.exe headless, so agents can open and triage user-mode and kernel crash dumps, attach to cdb remote debug servers and KD kernel targets, and run arbitrary debugger commands in separately addressed sessions. _{Integration · Independent MCP · Targets: Binary · Full entry}
Wireshark MCP - MCP server that wraps tshark, and optionally other Wireshark command-line tools, so agents can query saved captures through Wireshark's dissectors: packet lists and details, stream following, arbitrary field extraction, protocol hierarchies and conversations, decode-as rules for non-standard ports, protocol preferences, TLS and WPA decryption with user-supplied keys, and one tool that applies preset fields and filters for 25 protocols such as Modbus, S7comm, MQTT, Zigbee and BLE. _{Integration · Independent MCP · Targets: Protocol · Full entry}
BINNY - An open-source terminal agent harness from OpenBin that runs a user-chosen hosted or local model over binary-analysis data. _{Integration · Independent agent · Targets: App, Binary, Firmware · Full entry}
decomp.wtf - A discontinued local app and MCP server that hands AI coding agents one function of a user-owned console game at a time, compiles each C attempt with the game’s period compiler and accepts it only when the linked result matches the original bytes. _{Integration · Independent agent · Targets: Game · Full entry}
Claude Intercept - A local man-in-the-middle proxy and dashboard that captures HTTP/S traffic from the user’s own computer and devices, stores it in SQLite and hands it to Claude Code through an /intercept skill and CLI. _{Integration · Independent agent · Targets: App, Protocol · Full entry}
Ghidra MCP Server (bethington) - A Ghidra GUI plugin, standalone headless server and Python MCP bridge exposing a 209-tool catalog: decompilation, cross-references, renaming, typing, structures, comments and batch edits, plus P-code emulation, live debugging through Ghidra’s TraceRmi framework, shared Ghidra Server repository and version-control operations, and hash-based transfer of function documentation between binary versions. _{Integration · Independent MCP · Targets: Binary · Full entry}
DecompilerServer - Stdio MCP server built on the ICSharpCode.Decompiler engine that lets agents load managed .NET assemblies, including a Unity game's Assembly-CSharp.dll located from its game directory, then search symbols, string literals and attributes, read decompiled C# or IL, and trace callers, callees, usages and inheritance. _{Integration · Independent MCP · Targets: Game, App · Full entry}
Gepetto - IDA Pro plugin that sends Hex-Rays pseudocode to a hosted or local language model the user selects, to explain a function, comment it or propose new variable and function names, which the user picks from before they are applied. _{Integration · Independent agent · Targets: Binary · Full entry}
GhidrAssistMCP - Ghidra extension that runs an MCP server inside Ghidra over streamable HTTP and legacy SSE, with 100 explicitly named tools (93 enabled by default) for pseudocode, disassembly, P-code, control-flow and call graphs, cross-references, strings, imports and exports, plus renaming, retyping, comments and structure inference. _{Integration · Independent MCP · Targets: Binary · Full entry}
Android Reverse Engineering Skill - Claude Code plugin and agent skill that drives jadx and Fernflower/Vineflower to decompile Android APK, XAPK, JAR and AAR files and document their HTTP APIs. _{Integration · Independent agent · Targets: App · Full entry}
Reverify - Python CLI and stdio MCP server that checks a model’s structured claims about a binary, such as bytes or typed values at an offset, strings, imports and exports, instruction mnemonics, emulation results and tested or Z3-proved equivalence, and returns VERIFIED, REFUTED or INCONCLUSIVE with the evidence the tools observed. _{Integration · Independent agent · Targets: Binary · Full entry}
DecompAI - Gradio chat application whose LangGraph ReAct agent analyses an uploaded x86 Linux ELF binary: it lists and disassembles functions, decompiles them with Ghidra, drives radare2 and gdb, and runs shell commands and Python scripts in a privileged Kali Linux runner container. _{Integration · Independent agent · Targets: Binary · Full entry}
Kong - Command-line pipeline that runs Ghidra in-process through PyGhidra and asks Claude, OpenAI or OpenAI-compatible models to name the functions, types and parameters of a stripped binary, working bottom-up through the call graph so callers see already-named callees. _{Integration · Independent agent · Targets: Binary · Full entry}
Co-op Anything - Agent playbook, skill set and stdio MCP server for adding online or split-screen co-op to single-player games the players already have installed. _{Integration · Community REA · Targets: Game · Full entry}
DeepExtract (DeepExtractIDA) - IDA Pro 9.x plugin and PowerShell batch extractor that turn Windows PE files into material AI coding agents can read: a per-binary SQLite database of PE metadata, signatures, disassembly, Hex-Rays pseudocode, cross-references, strings, stack frames, loops and dangerous API calls, plus optional grouped C++ and assembly files with per-function caller, callee and string headers and JSON indexes. _{Integration · Independent agent · Targets: Binary · Full entry}
Mizuchi - Plugin pipeline for matching decompilation that loops over functions in an existing decomp project: m2c drafts C, decomp-permuter mutates it, Claude rewrites it through a compile-and-diff tool, and objdiff accepts a result only when the compiled object matches the target assembly. _{Integration · Independent agent · Targets: Game, Binary · Full entry}
ReAgent - An open-source Python agent, published on PyPI as auto-re-agent, that drafts C/C++ implementations of functions in a compiled program from Ghidra evidence and has a separately configurable checker model review each draft in a bounded fix loop. _{Integration · Independent agent · Targets: Game, Binary · Full entry}

Related Collections

↑ Contents

Awesome Reverse Engineering - A task-oriented reverse-engineering resource list by REA's maintainer, useful for broader tools and foundations. _{Collection · REA maintainer · Targets: Website, Game, App, Binary, Firmware · Full entry}
Awesome REA Cases - A bilingual collection of REA and other AI-assisted reverse engineering cases, with source links and explicit distinctions between reported and reproduced outcomes. _{Collection · Community REA · Targets: Website, Game, App, Binary, Firmware · Full entry}
awesome-rea (yibie): verification-focused projects and practice reports - Organizes AI-assisted game decompilation, native ports, static recompilation and tooling around stated acceptance checks, alongside a separate track of practitioner write-ups and discussions. _{Collection · Community REA · Targets: Game, Binary · Full entry}
Awesome REA/Decompiled Games - Groups game decompilations, source reconstructions, recompilations, native ports and demos by original game, with comparison rows linking related projects. _{Collection · Community REA · Targets: Game · Full entry}
Reversed with AI - A moderated website directory of AI-assisted reverse-engineering projects across games, firmware, file formats, APIs and protocols, apps and legacy software. _{Collection · Community REA · Targets: Game, App, Binary, Firmware, Protocol · Full entry}
awesome-game-decompilations - A single-README list of about 480 game decompilation, recompilation and disassembly projects, grouped by console from the NES and Game Boy to the Xbox 360, PC and mobile, with a large uncategorised section. _{Collection · Targets: Game · Full entry}
Awesome Decomp Games - A generated, rated index of public game reconstruction projects: decompilations, disassemblies, static recompilations, source ports, engine remakes and browser ports. _{Collection · Targets: Game · Full entry}

References and Learning

↑ Contents

Installation and client setup - Reviewed setup plans, client registration, provider prerequisites and scoped readiness checks. _{Documentation · Official REA · Targets: Website, Game, App, Binary, Firmware · Full entry}
CLI and Evidence - CLI workflows for saving Evidence and projecting smaller views from completed analysis. _{Documentation · Official REA · Targets: Website, Game, App, Binary, Firmware · Full entry}
MCP contracts and generated catalog - Canonical tool contracts, provider discovery and Evidence semantics for integration authors. _{Documentation · Official REA · Targets: Website, Game, App, Binary, Firmware · Full entry}
Native binary investigation - Locate a function, inspect instructions and pseudocode, and follow references with a selected native provider. _{Documentation · Official REA · Targets: Game, Binary · Full entry}
Cross-layer JavaScript application workflows - Trace features and compare authenticated JavaScript application graphs while preserving static-analysis limits. _{Documentation · Official REA · Targets: Website, App · Full entry}
Static Android APK analysis - Inspect Android package identity, classes, methods and references through REA's JADX integration. _{Documentation · Official REA · Targets: App · Full entry}
Managed-code analysis - Read PE/CLI metadata and CIL, compare managed members and inspect declared native boundaries without loading the assembly. _{Documentation · Official REA · Targets: App · Full entry}
Historical web network captures - Inspect saved web captures offline; recorded URLs are not fetched and no proxy is started. _{Documentation · Official REA · Targets: Website, App, Protocol · Full entry}
Firmware analysis - Inspect firmware regions with Binwalk and explicitly extract with Unblob, retaining tool and artifact identity. _{Documentation · Official REA · Targets: Firmware · Full entry}
Recorded packet capture inspection - Select TShark fields, display filters and decode-as rules over an existing network, USB or Bluetooth capture, and look up installed field names. _{Documentation · Official REA · Targets: Protocol · Full entry}
Packet capture summaries - Summarize a saved pcap or pcapng file’s endpoints, DNS questions and addresses, TLS SNI, protocol stacks and HTTP URIs into paged Evidence views. _{Documentation · Official REA · Targets: Protocol · Full entry}
Recorded signal decoding - Run caller-chosen sigrok protocol decoders, such as UART or I2C, over an existing logic-signal recording and keep annotation text with sample ranges. _{Documentation · Official REA · Targets: Firmware, Protocol · Full entry}
Browser observation guide - Follow a user-triggered export request in the supplied Notes browser example and connect it to the downloaded result. _{Documentation · Official REA · Targets: Website · Full entry}
JavaScript and Electron: follow a CSV export - A source-owned Notes fixture teaches the renderer, preload, IPC and CSV path with linked analysis evidence. _{Documentation · Official REA · Targets: App · Full entry}
rea-playbook - An Electron practice target, Evidence extractor and MCP probe; offline fixture mode is distinguished from real REA analysis. _{Learning resource · Community REA · Targets: App · Full entry}
rea-lab - A Windows REA/Ghidra lab with seeded challenges, published studies, upstream contributions and recorded limitations. _{Research · Community REA · Targets: Binary · Full entry}
Flutter build identification - Identifies a Flutter APK’s Dart snapshot hash, per-ABI library digests and engine build provenance, then inspects one ABI’s AOT snapshot sections, through REA’s pure-parsing CLI and MCP tools. _{Documentation · Official REA · Targets: App · Full entry}
Static HarmonyOS package inventory - Inventories HarmonyOS HAP, HSP and App Pack files through REA’s hardened ZIP reader and projects an execution-free application graph: component paths, IDs and hashes, Stage/FA packaging hints, runtime-family hints and path-based native-bridge hypotheses. _{Documentation · Official REA · Targets: App · Full entry}
MIPS ELF analysis through Ghidra - Documents REA’s Ghidra lane for MIPS ELF executables, relocatable objects and MIPS16 shared images, including a pinned 32-bit language for recordless legacy firmware executables that Ghidra would otherwise import as 64-bit. _{Documentation · Official REA · Targets: Binary, Firmware · Full entry}
PSP static ELF analysis through Ghidra - Documents REA’s bounded Ghidra profile for static PSP ELF executables, which leaves Allegrex instructions, PSP loading and calling conventions to a caller-installed ghidra-allegrex extension while reusing REA’s CLI, MCP, Evidence and snapshot workflows. _{Documentation · Official REA · Targets: Game, Binary · Full entry}
NativeAOT metadata recovery with Ghidra - Recovers .NET 8 NativeAOT metadata from x64 PE executables during REA’s Ghidra analysis: MethodTable relationships, virtual slots and frozen strings from RTR 9.1 data, through a built-in read-only parser or an optional headless adapter that annotates the Ghidra database. _{Documentation · Official REA · Targets: Binary · Full entry}
OpenSecurityTraining2 - Free self-paced security courses with learning paths for reverse engineering, firmware and systems foundations. _{Learning resource · Targets: Binary · Full entry}
pwn.college: Reverse Engineering - Hands-on reverse-engineering module covering functions, data access, static tools and dynamic tools with hosted exercises. _{Learning resource · Targets: Binary · Full entry}
Reverse Engineering for Beginners - Dennis Yurichev's free book on understanding compiled programs and assembly, available in multiple languages. _{Learning resource · Targets: Binary · Full entry}
The Official Radare2 Book - Official practical reference for radare2 analysis, disassembly, scripting, debugging and related plugins. _{Learning resource · Targets: Binary · Full entry}
Finding Jingle Town: Debugging an N64 Game without Symbols - A walkthrough from the Snowboard Kids 2 decompilation project on attaching gdb-multiarch to the Ares emulator while the matching build still cannot carry debug information. _{Learning resource · Targets: Game · Full entry}
JPCERT/CC: APK analysis and API probing on attack servers - JPCERT/CC’s 15 October 2026 blog post on the infrastructure behind a series of unauthorized-access incidents in Japan. _{Learning resource · Targets: App · Full entry}
Reverse Engineering (mytechnotalent) - A free, English lesson index by mytechnotalent that grows almost daily: 490 numbered lessons, most of which have learners write small programs and then debug and patch ("hack") them, across x86, x64, 32/64-bit ARM, RISC-V and AVR. _{Learning resource · Targets: Binary, Firmware · Full entry}
Z0FCourse Reverse Engineering - A free English course by Z0F on reverse engineering 64-bit Windows programs, which its README pitches as taking learners from beginner to intermediate. _{Learning resource · Targets: Binary · Full entry}
OWASP Mobile Application Security Testing Guide (MASTG) - OWASP’s open manual for Android and iOS app security testing and reverse engineering, published at mas.owasp.org. _{Learning resource · Targets: App · Full entry}
The Decompilation Wiki - Community wiki explaining how decompilers work, from disassembly, lifting and control-flow recovery to type recovery, control-flow structuring, quality evaluation and neural decompilation, citing the research behind each technique. _{Learning resource · Targets: Game, Binary · Full entry}
Frontkick vs Rikugan: a CREBench agent comparison - Matthieu Breuil’s Synacktiv article explains tool-calling and code-executing agent designs and describes Frontkick, a CodeAct agent that runs generated Python inside Binary Ninja. _{Learning resource · Targets: Binary · Full entry}

Papers

134 papers, grouped by topic and ordered newest first. Each line shows the study’s opening sentence, venue, publication status and first author.

Browse the paper directory · Complete bibliography JSON · Suggest a paper

By topic

Agent evaluation (9) · Decompilation (57) · Websites (22)
Games (8) · Apps (12) · Firmware (13)
Protocols (13)

Each paper’s “Full entry” holds its complete summary, scope and limitations, all authors and citation. Some papers also appear among curated resources; counts are not additive.

Reverse-engineering agent evaluation

↑ Paper topics · Contents

Humans vs. Machines: A Comparison With AI Agents in Software Reverse Engineering - Compares human and LLM-agent understanding and navigation on the same static reverse-engineering challenges, then studies how binary representations consume context windows. _{arXiv 2026 · Preprint · Samuele Doria et al. · PDF · Full entry}
The Next Challenge for Agentic Cybersecurity: A Realistic, Contamination-Free Reverse Engineering Benchmark - Introduces SRE-Bench, with privately authored programs and protected binary variants, to study agent recovery of program semantics while reducing training-data contamination. _{arXiv 2026 · Preprint · Jeremy Spence et al. · PDF · Full entry}
Automatically Attacking Software Reverse Engineering AI Agents - A proof of concept for indirect prompt injection against Cline/GhidraMCP binary-analysis agents. _{ECCWS 2026 · Conference paper · Brian Crawford et al. · PDF · Full entry}
CrackMeBench: Binary Reverse Engineering for Agents - Evaluates agents on executable-checked CrackMe tasks: infer validation logic from binaries and submit an accepted input or artifact, while recording tool use, time, and scoring attempts. _{arXiv 2026 · Preprint · Isaac David et al. · PDF · Full entry}
Towards LLM-Resistant Software Protection: Agent Failure Patterns in CTF Reverse Engineering - Runs Claude Code, Codex CLI and ChatGPT-5.2 Pro on 24 crackme-style challenges selected from 15 international CTF events held in 2025, and attributes their failures to stages of an Observe–Comprehend–Plan loop and to three protection effects: concealment, complication and misdirection. _{Workshop on Binary Analysis Research (BAR) 2026 · Conference paper · Ryutaro Nishizaka et al. · PDF · Full entry}
ProgramBench: Can Language Models Rebuild Programs From Scratch? - Evaluates black-box program reconstruction across 200 tasks: agents query an executable and read its documentation, then independently implement a codebase whose behavior is checked by generated tests. _{NeurIPS 2026 · Accepted · John Yang et al. · PDF · Code · Full entry}
Decompiling the Synergy: An Empirical Study of Human–LLM Teaming in Software Reverse Engineering - Studies how human analysts work with LLM assistance during static software reverse engineering. _{NDSS 2026 · Conference paper · Zion Leonahenahe Basque et al. · PDF · Code · Full entry}
CREBench: Evaluating Large Language Models in Cryptographic Binary Reverse Engineering - Benchmarks cryptographic binary reverse engineering across algorithm recognition, key or IV extraction, wrapper reconstruction, and flag recovery using 432 controlled challenges. _{COLM 2026 · Conference paper · Baicheng Chen et al. · PDF · Code · Full entry}
EnIGMA: Interactive Tools Substantially Assist LM Agents in Finding Security Vulnerabilities - EnIGMA extends SWE-agent for capture-the-flag challenges with interactive agent tools that keep a gdb debugging session or a pwntools server connection open across turns, alongside decompile and disassemble commands, an LM summarizer for long outputs, and category-specific demonstrations and guidelines. _{ICML 2025 · Conference paper · Talor Abramovich et al. · PDF · Code · Full entry}

Decompilation and symbol recovery

↑ Paper topics · Contents

Locate, Then Reason: End-to-End Patch Presence Testing in Stripped Binaries - Locates patch-relevant code in stripped binaries using instruction-aligned retrieval and caller/callee context, then uses an LLM to screen candidate matches and compare patch-specific behavior with vulnerable and patched references. _{arXiv 2026 · Preprint · Huaijin Wang et al. · PDF · Full entry}
Recall-Oriented Precise Binary-to-Source Function Matching - BScout matches decompiled functions to a source corpus using chunked embeddings and inlining-aware training. _{arXiv 2026 · Preprint · Junlin Li et al. · PDF · Full entry}
Decoding What iOS Location Services Send to Apple: An LLM Is an Unreliable Analyst but a Useful Toolmaker - Compares direct LLM recovery of Apple PBCodable schemas with an AI-written Extractor checked against compiled synthetic fixtures, published descriptors and captured traffic. _{arXiv 2026 · Preprint · Douglas Leith · PDF · Code · Full entry}
SoK: Are LLMs Reliable at Source Code Recovery? A Taxonomy and Empirical Evaluation - This SoK organizes LLM-assisted source-recovery designs and separates compilation, readability, structural and behavioral metrics. _{arXiv 2026 · Preprint · Varun Kohli et al. · PDF · Code · Full entry}
The CodeInverter Suite: Structure- and Data-Aware Binary Decompilation with Efficient LLMs - CodeInverter studies function-level LLM decompilation using control-flow graphs and memory-to-data mappings extracted with IDA/objdump. _{ASE 2026 · Conference paper · Peipei Liu et al. · PDF · Code · Full entry}
Beyond Text Matching: Towards Reference-Free Evaluation for Human-Oriented Binary Reverse Engineering - BinJudgeBench collects expert judgments for function naming, binary-code summaries and decompilation refinement. _{ASE 2026 · Conference paper · Xiuwei Shang et al. · PDF · Full entry}
Decompiling Quantum Assembly into Structured Programs - Quelle recovers library calls, loops, functions and symbolic parameters from compiled OpenQASM. _{arXiv 2026 · Preprint · Pingchuan Ma et al. · PDF · Full entry}
ASAP: Assembly-Source Aligned Pseudocode Refinement For Binary Decompilation - ASAP aligns assembly and source representations during training, compresses assembly features into tokens, and supplies them alongside decompiler pseudocode to an LLM refiner. _{arXiv 2026 · Preprint · Yujian Zhuang et al. · PDF · Full entry}
Faultless: A Program Equivalence Technique for Validating and Evaluating Neural Decompilers - Compares neural-decompiler C output with deterministic decompilation or reference functions using symbolic execution and a specialized memory model. _{arXiv 2026 · Preprint · Luke Dramko et al. · PDF · Code · Full entry}
Between the Commits: Process, Error, and Claim Reliability in a Wholly AI-Authored Codebase - Studies development of the Extractor reverse-engineering tool through commits, available session logs and code-provenance tracing. _{arXiv 2026 · Preprint · Douglas Leith · PDF · Full entry}
Echo: Learning-based Matching Decompilation using Trusted Back Translation - Echo iteratively generates source and compiler configurations, recompiles candidates, and uses assembly differences to guide configuration search and code refinement. _{arXiv 2026 · Preprint · Jun Bi et al. · PDF · Full entry}
A Memorization Floor for LLM Refinement of Decompiled Code - Studies whether LLM refinement of decompiled C recovers identifiers from input evidence or prior knowledge. _{arXiv 2026 · Preprint · Muhammad Asjad · PDF · Full entry}
When LLM Decompilers Recompile More and Preserve Less - Decompile-Diverge builds function-level behavioral comparisons from source-derived drivers and fuzzed reference inputs. _{arXiv 2026 · Preprint · Chang Liu et al. · PDF · Full entry}
Reveree: Diagnosing LLM Reverse-Engineering Agents - Evaluates reverse-engineering agent traces through flag recovery, eight analysis milestones and action profiles. _{arXiv 2026 · Preprint · Hadjer Benkraouda et al. · PDF · Full entry}
Decoupling is a Necessity: Transformation-Agnostic Decompiled Code Recovery under Optimization and Obfuscation - ReSource refines decompiled functions affected by compiler optimization and obfuscation. _{arXiv 2026 · Preprint · Zhiping Zhou et al. · PDF · Full entry}
STILL: Recovering Lowered STL Semantics for LLM-assisted C++ Decompilation - STILL predicts function-level STL container presence from stripped control-flow graphs and turns those predictions into compact hints for LLM refinement of Ghidra output. _{arXiv 2026 · Preprint · Xiaohan Wang et al. · PDF · Full entry}
The Evolution of Binary Decompilation in the Modern Era: A Taxonomy, Literature Review, and Future Perspectives - This survey maps traditional, dynamic, matching and neural decompilation approaches, then organizes type recovery, control-flow restructuring, naming and refinement tasks alongside evaluation metrics and benchmark choices. _{arXiv 2026 · Preprint · Omar Abusabha et al. · PDF · Full entry}
MirrorCode: AI can rebuild entire programs from behavior alone - Tests reimplementation of 25 command-line programs using execute-only reference access, documentation and visible examples. _{arXiv 2026 · Preprint · Tom Adamczewski et al. · PDF · Code · Full entry}
SoK: AI-Augmented Binary Reversing - A systematization-of-knowledge survey of machine-learning, LLM and agentic approaches to binary reversing. _{arXiv 2026 · Preprint · Yujeong Kwon et al. · PDF · Full entry}
Binary Decompilation LLM with Feedback-Driven Multi-Turn Refinement - AutoDecompiler trains function-level decompilation models to revise assembly- or pseudocode-derived outputs using compilation, execution and I/O feedback. _{arXiv 2026 · Preprint · Peipei Liu et al. · PDF · Code · Full entry}
LLM Agent-Assisted Reverse Engineering with Quantitative Readability Metrics - Uses a composite Quantitative Readability Score (QRS) to guide agents refining decompiled C. _{arXiv 2026 · Preprint · Neil Archibald et al. · PDF · Full entry}
Semantic Validation of Packer Identification Tools: Characterization, Repair, and Downstream Impact - Uses unpacking outcomes as reference evidence to assess packer labels, normalizes heterogeneous tool results, and evaluates complementary signature/heuristic pools with static predicates derived from unpacker implementations. _{arXiv 2026 · Preprint · Fangtian Zhong et al. · PDF · Full entry}
Decaf: Improving Neural Decompilation with Automatic Feedback and Search - Decaf samples multiple candidate decompilations, recompiles them and ranks them using compiler-derived byte distance or a learned reranker. _{arXiv 2026 · Preprint · Alexander Shypula et al. · PDF · Code · Full entry}
NotDec: WebAssembly Decompilation With Inter-Procedural Type Recovery - NotDec lifts WebAssembly into SSA-based IR, uses Retypd-derived type constraints and pointer/value distinctions to recover structures, and emits C. _{ICSE 2026 · Conference paper · Jikai Wang et al. · PDF · Code · Full entry}
The Deception Delta: Adversarial Evaluation of LLM-Based Smart Contract Bytecode Forensics - Evaluates how language models interpret raw EVM bytecode from purpose-built deceptive and control contracts. _{ACM CCS 2026 · Accepted · Timo Schefold · PDF · Full entry}
SK2Decompile: LLM-based Two-Phase Binary Decompilation from Skeleton to Skin - Splits LLM decompilation into two phases: a Structure Recovery model turns decompiler pseudocode into an identifier-free IR that keeps control flow and data structures, trained with compiler-based RL rewards, and an Identifier Naming model then restores names under a semantic-similarity reward. _{ICLR 2026 · Conference paper · Hanzhuo Tan et al. · PDF · Code · Full entry}
Idioms: A Simple and Effective Framework for Turbo-Charging Local Neural Decompilation with Well-Defined Types - Idioms fine-tunes code language models to turn Hex-Rays output for one target function into predicted original C together with definitions of the user-defined structs, unions and typedefs it uses. _{NDSS 2026 · Conference paper · Luke Dramko et al. · PDF · Code · Full entry}
FidelityGPT: Correcting Decompilation Distortions with Retrieval Augmented Generation - FidelityGPT post-processes existing decompiler output: an LLM labels lines with six distortion types, such as non-conventional dereferencing, redundant variables and confusing control flow, and then rewrites the labeled lines. _{NDSS 2026 · Conference paper · Zhiping Zhou et al. · PDF · Code · Full entry}
CHISEL-ing Back Source Code with AI-enabled Iterative Recovery - CHISEL refines Ghidra pseudocode using compiler diagnostics and type-aware differential fuzzing against the original function. _{SURE @ ACM CCS 2026 · Accepted · Varun Kohli et al. · PDF · Code · Full entry}
BinMetric: A Comprehensive Binary Code Analysis Benchmark for Large Language Models - BinMetric poses 1,000 questions across six binary-analysis tasks: call-site reconstruction, decompilation, signature recovery, binary code summarization, algorithm classification and assembly instruction generation. _{IJCAI 2025 · Conference paper · Xiuwei Shang et al. · PDF · Full entry}
DecompileBench: A Comprehensive Benchmark for Evaluating Decompilers in Real-World Scenarios - Evaluates traditional and LLM-based decompilers using functions from real programs, runtime behavioral checks, and an LLM-assisted assessment of analyst-facing code understandability. _{Findings of ACL 2025 · Conference paper · Zeyu Gao et al. · PDF · Code · Full entry}
DecLLM: LLM-Augmented Recompilable Decompilation for Enabling Programmatic Use of Decompiled Code - DecLLM repairs decompiler pseudocode that does not recompile into C that compiles and runs, so source-level tools such as CodeQL can be applied to binaries. _{Proceedings of the ACM on Software Engineering (ISSTA 2025) · Journal article · Wai Kin Wong et al. · PDF · Full entry}
DiSCo: Towards Decompiling EVM Bytecode to Source Code using Large Language Models - DiSCo lifts Ethereum contract creation bytecode to Solidity source by prompting a frozen LLM, instead of emitting decompiler pseudocode. _{Proceedings of the ACM on Software Engineering (FSE 2025) · Journal article · Xing Su et al. · PDF · Full entry}
Unleashing the Power of Generative Model in Recovering Variable Names from Stripped Binary - GenNm suggests names for placeholder variables in decompiled code of stripped binaries by fine-tuning generative code models (CodeGemma-2B by default; CodeLlama-7B and a LoRA-tuned CodeLlama-34B are also tested). _{NDSS 2025 · Conference paper · Xiangzhe Xu et al. · PDF · Code · Full entry}
TypeForge: Synthesizing and Selecting Best-Fit Composite Data Types for Stripped Binaries - TypeForge recovers composite data types, including struct layouts, unions and pointer or nesting relationships, from stripped binaries. _{IEEE S&P 2025 · Conference paper · Yanzhong Wang et al. · PDF · Code · Full entry}
Nova: Generative Language Models for Assembly Code with Hierarchical Attention and Contrastive Learning - Nova is a generative LLM for x86-64 assembly, trained from DeepSeek-Coder checkpoints on stripped, normalized gcc -O0 to -O3 assembly built from AnghaBench and The Stack. _{ICLR 2025 · Conference paper · Nan Jiang et al. · PDF · Code · Full entry}
Decompile-Bench: Million-Scale Binary-Source Function Pairs for Real-World Binary Decompilation - Introduces two million C/C++ binary-source function pairs using a Compile-Trace-Filter pipeline, with an evaluation suite spanning translated HumanEval/MBPP tasks and recent GitHub functions. _{NeurIPS 2025 Datasets and Benchmarks · Conference paper · Hanzhuo Tan et al. · PDF · Code · Full entry}
Beyond Classification: Inferring Function Names in Stripped Binaries via Domain Adapted LLMs - SymGen infers function names for stripped binaries by generating them with a LoRA-fine-tuned Code Llama model instead of classifying over a fixed name vocabulary. _{NDSS 2025 · Conference paper · Linxi Jiang et al. · PDF · Code · Full entry}
ReSym: Harnessing LLMs to Recover Variable and Data Structure Symbols from Stripped Binaries - Combines two fine-tuned language models with Prolog-based cross-function reasoning to infer local-variable symbols and user-defined data structures from stripped-binary decompilation. _{ACM CCS 2024 · Conference paper · Danning Xie et al. · PDF · Code · Full entry}
Self-Constructed Context Decompilation with Fined-grained Alignment Enhancement - Adds two techniques to LLM decompilation of function-level x86-64 GCC assembly into C. _{Findings of EMNLP 2024 · Conference paper · Yunlong Feng et al. · PDF · Code · Full entry}
LLM4Decompile: Decompiling Binary Code with Large Language Models - Trains language models for assembly-to-C decompilation and for refining Ghidra pseudocode, evaluating whether recovered functions can be recompiled and executed correctly. _{EMNLP 2024 · Conference paper · Hanzhuo Tan et al. · PDF · Code · Full entry}
WaDec: Decompiling WebAssembly Using Large Language Model - WaDec decompiles WebAssembly text (wat) into C by fine-tuning CodeLlama-7b with LoRA on loop-level wat–C snippet pairs. _{ASE 2024 · Conference paper · Xinyu She et al. · PDF · Code · Full entry}
StackSight: Unveiling WebAssembly through Large Language Models and Neurosymbolic Chain-of-Thought Decompilation - StackSight decompiles WebAssembly text-format functions into C++ with LLM prompting. _{ICML 2024 · Conference paper · Weike Fang et al. · PDF · Full entry}
BinaryAI: Binary Software Composition Analysis via Intelligent Binary Source Code Matching - BinaryAI identifies which open-source C/C++ libraries a stripped binary reuses by matching its functions to source code. _{ICSE 2024 · Conference paper · Ling Jiang et al. · PDF · Full entry}
SLaDe: A Portable Small Language Model Decompiler for Optimized Assembly - SLaDe translates function-level assembly into C with a 200M-parameter encoder–decoder model, code-specific tokenization and PsycheC type completion. _{IEEE/ACM CGO 2024 · Conference paper · Jordi Armengol-Estapé et al. · PDF · Code · Full entry}
“Len or index or count, anything but v1”: Predicting Variable Names in Decompilation Output with Transfer Learning - VarBERT suggests variable names for IDA Hex-Rays and Ghidra decompiler output with a BERT-style model pre-trained on 5.2M human-written C functions from Debian and fine-tuned on decompiled code; it also predicts whether each variable came from the developer or was introduced by the decompiler. _{IEEE S&P 2024 · Conference paper · Kuntal Kumar Pal et al. · PDF · Code · Full entry}
DeGPT: Optimizing Decompiler Output with LLM - Refines existing C-like decompiler output through three coordinated roles that select, propose and check changes. _{NDSS 2024 · Conference paper · Peiwei Hu et al. · PDF · Code · Full entry}
XFL: Naming Functions in Binaries with Extreme Multi-label Learning - XFL treats function naming in stripped binaries as extreme multi-label classification: names are split into tokens, and PfastreXML ranks which tokens from a vocabulary of frequent labels fit each function. _{IEEE S&P 2023 · Conference paper · James Patrick-Evans et al. · PDF · Code · Full entry}
SymLM: Predicting Function Names in Stripped Binaries via Context-Sensitive Execution-Aware Code Embeddings - SymLM predicts function names for stripped binaries as sets of name words. _{ACM CCS 2022 · Conference paper · Xin Jin et al. · PDF · Code · Full entry}
Augmenting Decompiler Output with Learned Variable Names and Types - Introduces DIRTY, a Transformer model that recommends variable names and types from decompiled code and layout information, together with the DIRT corpus for training and evaluation. _{USENIX Security 2022 · Conference paper · Qibin Chen et al. · PDF · Code · Full entry}
jTrans: Jump-Aware Transformer for Binary Code Similarity Detection - jTrans embeds binary functions for similarity search with a BERT-style Transformer. _{ACM ISSTA 2022 · Conference paper · Hao Wang et al. · PDF · Code · Full entry}
ExeBench: an ML-scale dataset of executable C functions - ExeBench is a dataset, not a decompiler. _{ACM SIGPLAN MAPS 2022 · Conference paper · Jordi Armengol-Estapé et al. · PDF · Code · Full entry}
Beyond the C: Retargetable Decompilation using Neural Machine Translation - BTC (Beyond The C) treats decompilation as plain-text translation from compiler-emitted x86-64 assembly to source code. _{Workshop on Binary Analysis Research (BAR) 2022 · Conference paper · Iman Hosseini et al. · PDF · Code · Full entry}
Neural reverse engineering of stripped binaries using augmented control flow graphs - Nero predicts names for procedures in stripped x86-64 Linux executables; it does not produce decompiled code. _{Proceedings of the ACM on Programming Languages (OOPSLA 2020) · Journal article · Yaniv David et al. · PDF · Code · Full entry}
DIRE: A Neural Approach to Decompiled Identifier Naming - Combines lexical and structural information from decompiler output to predict meaningful variable names, with a training and evaluation corpus derived from compiled C projects. _{ASE 2019 · Conference paper · Jeremy Lacomis et al. · PDF · Code · Full entry}
Coda: An End-to-End Neural Program Decompiler - Coda decompiles the assembly of short functions into C in two phases. _{NeurIPS 2019 · Conference paper · Cheng Fu et al. · PDF · Full entry}
Debin: Predicting Debug Information in Stripped Binaries - Debin predicts debug information for stripped ELF binaries on x86, x64 and ARM. _{ACM CCS 2018 · Conference paper · Jingxuan He et al. · PDF · Code · Full entry}

Website reconstruction

↑ Paper topics · Contents

PrismaCoder: Pushing the Boundaries of Open Multimodal Code Intelligence through Decomposed Rubric Synthesis - Trains visual-code models using separate code and rendered-output rubrics for data filtering and reinforcement learning. _{arXiv 2026 · Preprint · Qiushi Sun et al. · PDF · Full entry}
State-Aware Generation of Deployable Websites from Visual Prototypes and Requirements - VisStateCoder links visual prototype elements, project files, interaction requirements and render evidence in a project state graph, then uses those links to generate websites and limit subsequent repairs to selected files. _{arXiv 2026 · Preprint · Ruwei Pan et al. · PDF · Full entry}
TaoD2C-Bench: Benchmarking MLLMs for Industrial UI Code Generation Beyond Visual Fidelity - TaoD2C-Bench reconstructs interfaces from design images, layer metadata and component-library documentation. _{arXiv 2026 · Preprint · Chengwei Shi et al. · PDF · Full entry}
Vision2Web: A Hierarchical Benchmark for Visual Website Development with Agent Verification - Benchmarks website development from visual prototypes and written requirements across 100 static-page, 66 interactive-frontend and 27 full-stack tasks, combining workflow-based functional checks with model-judged visual comparison. _{ICML 2026 · Conference paper · Zehai He et al. · PDF · Code · Full entry}
IChart2Code: Benchmarking Multimodal Large Language Models for Interactive Chart Code Generation - Benchmarks reconstruction of interactive charts from a reference screenshot, local data and specified actions. _{arXiv 2026 · Preprint · Xu Zhang et al. · PDF · Full entry}
Stage-Supervised Latent Reasoning for Single-Shot JavaScript Deobfuscation - Uses intermediate Webcrack rewrites to supervise Coconut-style latent reasoning for JavaScript deobfuscation. _{arXiv 2026 · Preprint · Rong Feng et al. · PDF · Full entry}
ProgramDistill: From Interactive Web Apps to Verifiable Reference-Guided SWE Tasks - Evaluates recovery of web-app behavior from a live reference with hidden source. _{arXiv 2026 · Preprint · Jeonghye Kim et al. · PDF · Code · Full entry}
Does It Render Everywhere? A Study of Cross-Environment Compatibility in MLLM-Generated Webpages - WebCompat evaluates screenshot-reconstructed webpages across browsers and devices. _{arXiv 2026 · Preprint · Ziyun Guo et al. · PDF · Code · Full entry}
UI2App: Benchmarking Visual Interaction Inference in Executable Web Application Generation - UI2App evaluates runnable React/TypeScript applications generated from 600 screenshots across 95 web applications. _{arXiv 2026 · Preprint · Grace Man Chen et al. · PDF · Code · Full entry}
Dashboard2Code: Evaluating Multimodal Models on Reconstructing Interactive Dashboards - Evaluates agents that actively explore a running dashboard and reconstruct its appearance and interaction logic. _{ACL 2026 · Conference paper · Tianhao Niu et al. · PDF · Code · Full entry}
UniCoder: Unified Visual-to-Code Generation via Symbolic Rewards and Reference-Guided Code Optimization - UniCoder trains a visual-to-code model for charts, SVGs and webpages. _{arXiv 2026 · Preprint · Yaozhi Zheng et al. · PDF · Code · Full entry}
CASCADE: LLM-powered JavaScript Deobfuscator at Google - Uses Gemini to locate the prelude functions that Obfuscator.IO inserts for string obfuscation, then applies constant-propagation and inlining passes in the JSIR compiler IR to restore string literals and API names deterministically. _{ICSE-SEIP 2026 · Conference paper · Shan Jiang et al. · PDF · Code · Full entry}
ScreenCoder: Advancing Visual-to-Code Generation for Front-End Automation via Modular Multimodal Agents - Splits screenshot-to-code generation among grounding, planning and generation agents that label UI regions, build a hierarchical layout tree and write HTML/CSS. _{EMNLP 2026 · Accepted · Yilei Jiang et al. · PDF · Code · Full entry}
IWR-Bench: Can LVLMs reconstruct interactive webpage from a user interaction video? - Tests reconstruction of interactive webpages from user-interaction videos and supplied static assets. _{ICLR 2026 · Conference paper · Yang Chen et al. · PDF · Code · Full entry}
JsDeObsBench: Measuring and Benchmarking LLMs for JavaScript Deobfuscation - Builds an execution-verifiable JavaScript deobfuscation benchmark by applying seven JavaScript-Obfuscator transformations to Project CodeNet programs with test cases, then scores LLM and tool outputs for syntax, execution, code simplification and similarity to the original code. _{ACM CCS 2025 · Conference paper · Guoqiang Chen et al. · PDF · Code · Full entry}
Interaction2Code: Benchmarking MLLM-based Interactive Webpage Code Generation from Interactive Prototyping - Benchmarks reconstruction of interactive webpages from screenshots before and after an interaction. _{ASE 2025 · Conference paper · Jingyu Xiao et al. · PDF · Code · Full entry}
WebUIBench: A Comprehensive Benchmark for Evaluating Multimodal Large Language Models in WebUI-to-Code - Diagnoses webpage-to-code capability through visual perception, HTML programming, image-to-HTML understanding, and screenshot reconstruction tasks. _{Findings of ACL 2025 · Conference paper · Zhiyu Lin et al. · PDF · Full entry}
Divide-and-Conquer: Generating UI Code from Screenshots - Recursively divides a webpage screenshot along visual separation lines, has a multimodal model generate HTML/CSS for each leaf segment, and assembles child code upward into the full page; evaluated with GPT-4o, Gemini and Claude models and a small developer study. _{Proceedings of the ACM on Software Engineering 2025 · Journal article · Yuxuan Wan et al. · PDF · Code · Full entry}
WebCode2M: A Real-World Dataset for Code Generation from Webpage Designs - WebCode2M pairs about 2.56 million real-world webpage screenshots with purified HTML/CSS code and element bounding-box layout trees. _{WWW 2025 · Conference paper · Yi Gui et al. · PDF · Code · Full entry}
Design2Code: Benchmarking Multimodal Code Generation for Automated Front-End Engineering - Evaluates reconstruction of frontend code from webpage screenshots using real-world reference pages, visual-element and layout metrics, and human assessment. _{NAACL 2025 · Conference paper · Chenglei Si et al. · PDF · Code · Full entry}
Large Language Models for Code Analysis: Do LLMs Really Do Their Job? - Evaluates GPT-3.5-turbo, GPT-4, LLaMA-2-13B, Code-LLaMA-2-13B-Instruct and StarChat-Beta on explaining what de-commented JavaScript, Python and C code does, then repeats the task on JavaScript obfuscated with JavaScript Obfuscator (identifier renaming, dead-code injection, control-flow flattening and string splitting) and with Wobfuscator’s WebAssembly transformation. _{USENIX Security 2024 · Conference paper · Chongzhou Fang et al. · PDF · Full entry}
Web2Code: A Large-scale Webpage-to-Code Dataset and Evaluation Framework for Multimodal LLMs - Studies screenshot-to-HTML reconstruction through instruction tuning and two evaluation benchmarks. _{NeurIPS 2024 Datasets and Benchmarks · Conference paper · Sukmin Yun et al. · PDF · Code · Full entry}

Game reconstruction and reverse engineering

↑ Paper topics · Contents

Schema: Discovering Unknown Environments via Agentic Program Induction - Infers executable models of game state and transition rules from interaction. _{arXiv 2026 · Preprint · Guanning Zeng et al. · PDF · Code · Full entry}
SWE-Game: Can Coding Agents Build the Games We Want? - Evaluates construction, completion, repair and Godot-to-Unity porting against executable reference games. _{arXiv 2026 · Preprint · Xiaoyu Chen et al. · PDF · Full entry}
GameReplica: A Benchmark for Black-Box Visual Game Replication by Vision-Language Agents - Evaluates whether vision-language agents can infer hidden game rules through screenshots and active interaction, then build runnable single-file HTML replicas across 125 tasks from 25 web games, each with five difficulty levels. _{arXiv 2026 · Preprint · Boyu Qiao et al. · PDF · Full entry}
Tycho: Active Abstraction with Programmatic World Models for ARC-AGI-3 - Tycho constructs editable Python models of game state, transitions, rendering and outcomes from action/observation histories in unfamiliar ARC-AGI-3 games. _{arXiv 2026 · Preprint · Jens Lehmann et al. · PDF · Code · Full entry}
RevengeBench: Reverse Engineering Code-Space Policies from Behavioral Experiments - Tests whether agents can recover executable decision policies from behavioral traces and self-designed opponent probes, using 75 synthetic policies across five game arenas and measuring held-out action agreement and downstream competitive value. _{arXiv 2026 · Preprint · Babak Rahmani et al. · PDF · Code · Full entry}
SPRITE: From Static Mockups to Engine-Ready Game UI - Transforms game-interface screenshots into editable engine assets through hierarchical YAML, visual grounding, asset extraction, and Unity UXML/USS synthesis, with evaluation on a curated game-UI benchmark and review by three senior UI/UX designers. _{CHI EA 2026 (poster/extended abstract) · Conference paper · Yunshu Bai et al. · PDF · Full entry}
WorldCoder, a Model-Based LLM Agent: Building World Models by Writing Code and Interacting with the Environment - WorldCoder learns executable Python transition and reward models from environment interactions and natural-language goals. _{NeurIPS 2024 · Conference paper · Hao Tang et al. · PDF · Code · Full entry}
Generating Code World Models with Large Language Models Guided by Monte Carlo Tree Search - GIF-MCTS generates executable Python transition and reward models from natural-language environment descriptions and offline state-transition trajectories, using prediction feedback to generate, improve and repair code. _{NeurIPS 2024 · Conference paper · Nicola Dainese et al. · PDF · Code · Full entry}

App reconstruction and analysis

↑ Paper topics · Contents

From Dead Code and Static Requirements to Working Engines: Software Revival with Coding Agents - ReviveBench evaluates repair of nonrunning software and source-unavailable implementation of bounded computational and transactional engines from open specifications, using hidden reference-based checks. _{arXiv 2026 · Preprint · Tianyu Liu et al. · PDF · Full entry}
From Code to Requirements: Agentic Reverse Engineering of Business Rules at Enterprise Scale - Uses seven agents and human review to recover business requirements from source, tests, configuration and documentation. _{arXiv 2026 · Preprint · Garima Agrawal et al. · PDF · Full entry}
On the Viability of Requirements Generation from Code: An Experience Report - Studies a RAG-based, human-supervised pipeline for recovering requirements and code traces from two projects. _{IEEE REW 2026 / AIRE · Conference paper · Alexander Korn et al. · PDF · Full entry}
From Visual Widgets to UI Code: Efficient Tool-Grounded Generation - WidgetGen reconstructs widget screenshots as React JSX. _{MUCG @ ECCV 2026 · Accepted · Houston H. Zhang et al. · PDF · Full entry}
Agentic Reverse Engineering: From I/O to Code with Discovery Agent - Synthesizes executable programs from input/output observations using LLM-guided evolutionary search, progressively revealed examples, simple-to-complex mutations and execution-error feedback. _{NeurIPS 2026 · Accepted · Yihong Dong et al. · PDF · Code · Full entry}
UIOrchestra: Generating High-Fidelity Code from UI Designs with a Multi-agent System - UIOrchestra converts static mobile UI designs into React/CSS through layout-description, code-generation and rendered-image comparison agents. _{Findings of EMNLP 2025 · Conference paper · Chuhuai Yue et al. · PDF · Full entry}
DeclarUI: Bridging Design and Development with Automated Declarative UI Code Generation - Combines visual component extraction, multimodal models, page-transition graphs and iterative checks to reconstruct multi-page mobile UI code from designs or screenshots, evaluated with React Native, Flutter and ArkUI. _{Proceedings of the ACM on Software Engineering 2025 · Journal article · Ting Zhou et al. · PDF · Code · Full entry}
Machine Learning-Based Prototyping of Graphical User Interfaces for Mobile Apps - ReDraw turns screenshots or design mock-ups into native Android GUI prototypes by detecting components, classifying widget types with a CNN, and assembling a plausible view hierarchy with a data-driven nearest-neighbor method. _{IEEE Transactions on Software Engineering 2020 · Journal article · Kevin Moran et al. · PDF · Full entry}
pix2code: Generating Code from a Graphical User Interface Screenshot - Learns screenshot-to-DSL generation for native Android XML, iOS Storyboards and web HTML/CSS interfaces, then compiles the DSL into platform UI code. _{EICS 2018 · Conference paper · Tony Beltramelli · PDF · Code · Full entry}
From UI Design Image to GUI Skeleton: A Neural Machine Translator to Bootstrap Mobile GUI Implementation - UI2code translates a mobile UI image into an Android component hierarchy and layout skeleton using a neural encoder-decoder. _{ICSE 2018 · Conference paper · Chunyang Chen et al. · PDF · Code · Full entry}
Statistical Deobfuscation of Android Applications - DeGuard reverses layout obfuscation in Android APKs, predicting original names for the fields, methods, classes and packages that ProGuard renames. _{ACM CCS 2016 · Conference paper · Benjamin Bichsel et al. · PDF · Full entry}
Reverse Engineering Mobile Application User Interfaces with REMAUI (T) - Reconstructs native Android UI code from screenshots or design bitmaps using OCR, computer vision, and layout heuristics; evaluates visual similarity and view hierarchies on 488 screenshots from over 100 Android and iOS applications. _{ASE 2015 · Conference paper · Tuan Anh Nguyen et al. · PDF · Code · Full entry}

Firmware analysis and rehosting

↑ Paper topics · Contents

SoK: A Large-Scale Empirical Study of Emulation-Based Dynamic Analysis Research for ARM Cortex-M Firmware (Extended Version) - Organizes 24 MCU analysis tools into configuration recovery, emulation, fuzzing and diagnosis stages, then evaluates the runnable, pipeline-compatible subset on 4,571 filtered Cortex-M firmware images. _{arXiv (extended version) 2026 · Preprint · Hongyuan Li et al. · PDF · Code · Full entry}
POZZER: A Power Side Channel-guided Fuzzer for Black-Box Embedded Systems - Builds a noise-tolerant pseudo execution-flow graph from one power trace per test input, using newly observed behavior as LibAFL feedback. _{arXiv 2026 · Preprint · Pouya Narimani et al. · PDF · Full entry}
Reactive Peripheral Modeling for Faithful Firmware Rehosting - Bluezz models peripherals as stateful event-condition-action systems, coordinating interrupts, MMIO and DMA rather than treating accesses independently. _{arXiv 2026 · Preprint · Qinying Wang et al. · PDF · Full entry}
Khost: KVM-based Near Native MCU Firmware Rehosting - Extends KVM with MCU instruction handling, memory mapping and interrupt modeling to rehost firmware on ARMv8-A hosts. _{USENIX Security '26 2026 · Conference paper · Chunlin Wang et al. · PDF · Code · Full entry}
FirmPilot: Evidence-Guided Multi-Agent Environment Recovery for IoT Firmware Rehosting - FirmPilot reconstructs QEMU execution environments through coordinated retrieval, planning, filesystem, persistent-state and network recovery. _{arXiv 2026 · Preprint · Yanbing Shen et al. · PDF · Full entry}
FirmCure:Towards Autonomous and Adaptive Rehosting of Linux-Based Firmware - FirmCure combines static dependency analysis, iterative boot-configuration repair and runtime fault diagnosis to rehost Linux firmware in QEMU. _{arXiv 2026 · Preprint · Chuan Hong et al. · PDF · Full entry}
SatBleed: Security of Commoditized Communication Modules in Satellites - Studies satellite communication modules through hardware inspection, firmware reverse engineering, protocol analysis, partial rehosting and targeted testing. _{IEEE S&P 2026 · Conference paper · Ulysse Planta et al. · PDF · Code · Full entry}
User-Space Dependency-Aware Rehosting for Linux-Based Firmware Binaries - FIRMWELL reconstructs the execution environment of Linux firmware services by running their initialization processes, locating blocking dependencies and repairing missing system-level behavior. _{NDSS 2026 · Conference paper · Chuan Qin et al. · PDF · Code · Full entry}
Target-Centric Firmware Rehosting with Penguin - Penguin rehosts embedded Linux firmware from an extracted filesystem by deriving an editable configuration of emulation transformations, such as file changes, pseudofiles, NVRAM values and network interfaces, from static analysis. _{Workshop on Binary Analysis Research (BAR) 2025 · Conference paper · Andrew Fasano et al. · PDF · Code · Full entry}
Fuzzware: Using Precise MMIO Modeling for Effective Firmware Fuzzing - Rehosts monolithic ARM Cortex-M firmware for fuzzing, using locally scoped symbolic execution to model memory-mapped I/O accesses and focus input mutations on values relevant to firmware logic. _{USENIX Security 2022 · Conference paper · Tobias Scharnowski et al. · PDF · Code · Full entry}
FirmAE: Towards Large-Scale Emulation of IoT Firmware for Dynamic Analysis - Extends Firmadyne with empirically derived interventions for boot, networking, NVRAM, kernel behavior, and other runtime failures, enabling Linux router and IP-camera firmware web services to run for dynamic analysis. _{ACSAC 2020 · Conference paper · Mingeun Kim et al. · PDF · Code · Full entry}
HALucinator: Firmware Re-hosting Through Abstraction Layer Emulation - HALucinator rehosts monolithic ARM Cortex-M firmware by identifying hardware-abstraction-library functions and replacing them with authored Python handlers and peripheral models. _{USENIX Security 2020 · Conference paper · Abraham A Clements et al. · PDF · Code · Full entry}
Towards Automated Dynamic Analysis for Linux-based Embedded Firmware - Firmadyne crawls, extracts and emulates Linux-based firmware for network-connected commercial devices such as routers and IP cameras. _{NDSS 2016 · Conference paper · Daming D. Chen et al. · PDF · Code · Full entry}

Protocol inference and analysis

↑ Paper topics · Contents

Protocol Reverse Engineering via Deep Transfer Learning - Transfers field-boundary patterns from standardized protocol traces labeled by Tshark to poorly documented target protocols. _{Proceedings of the ACM on Software Engineering / FSE 2026 · Journal article · Yanyang Zhao et al. · PDF · Full entry}
RFCLLM: Evaluating LLMs' Reasoning Ability of Network Protocol State Machines - Tests reasoning over protocol state machines using 1,482 questions across 16 protocols. _{Findings of EMNLP 2026 · Accepted · Anqi Chen et al. · PDF · Code · Full entry}
Recovering Process Variables from Industrial Network Traffic via Search-Based Optimization - PVParser recovers process-variable layouts from industrial traffic and historian records. _{CCS 2026 · Accepted · Chuan Sheng et al. · PDF · Full entry}
ICEPRE: ICS Protocol Reverse Engineering via Data-Driven Concolic Execution - Infers message-field boundaries by following concrete message-guided paths through binary protocol parsers, then symbolically replaying them to extract byte-level data flow. _{Proceedings of the ACM on Software Engineering (ISSTA 2025) · Journal article · Yibo Qu et al. · PDF · Code · Full entry}
BinPRE: Enhancing Field Inference in Binary Analysis Based Protocol Reverse Engineering - Infers protocol-message field boundaries and semantics from instrumented server binaries and input messages. _{ACM CCS 2024 · Conference paper · Jiayi Jiang et al. · PDF · Code · Full entry}
DynPRE: Protocol Reverse Engineering via Dynamic Inference - DynPRE starts from captured client–server traces and then interacts with a live protocol server to infer message formats and types. _{NDSS 2024 · Conference paper · Zhengxiong Luo et al. · PDF · Full entry}
Lifting Network Protocol Implementation to Precise Format Specification with Security Applications - NetLifter statically lifts source-available C protocol parsers into BNF-style message grammars and first-order constraints between packet fields. _{ACM CCS 2023 · Conference paper · Qingkai Shi et al. · PDF · Code · Full entry}
BinaryInferno: A Semantic-Driven Approach to Field Inference for Binary Message Formats - Infers partial binary-message formats from static message samples without instrumenting an executable. _{NDSS 2023 · Conference paper · Jared Chandler et al. · PDF · Code · Full entry}
The Closer You Look, The More You Learn: A Grey-box Approach to Protocol State Machine Learning - StateInspector learns protocol Mealy machines by combining active message queries with snapshots of runtime memory, without requiring the target’s source code. _{ACM CCS 2022 · Conference paper · Chris McMahon Stone et al. · PDF · Code · Full entry}
Fingerprinting and analysis of Bluetooth devices with automata learning - Learns Mealy-machine models of Bluetooth Low Energy implementations on physical peripherals by active automata learning. _{Formal Methods in System Design 2022 · Journal article · Andrea Pferscher et al. · PDF · Code · Full entry}
NetPlier: Probabilistic Network Protocol Reverse Engineering from Message Traces - Uses multiple sequence alignment and probabilistic keyword-field inference to cluster network messages by type, evaluated across ten protocols with downstream format and state-machine analysis. _{NDSS 2021 · Conference paper · Yapeng Ye et al. · PDF · Code · Full entry}
Automatic Wireless Protocol Reverse Engineering - Infers message formats of proprietary wireless protocols from demodulated physical-layer captures: it aligns messages by preamble and sync word, then uses RSSI and dedicated engines to label length, address, sequence-number and checksum fields, optionally using known addresses or field positions. _{13th USENIX Workshop on Offensive Technologies (WOOT 19) 2019 · Conference paper · Johannes Pohl et al. · PDF · Code · Full entry}
NEMESYS: Network Message Syntax Reverse Engineering by Analysis of the Intrinsic Structure of Individual Messages - Infers approximate field boundaries within individual binary-protocol messages from changes in bit congruence, and introduces Format Match Score to compare inferred segmentation with known protocol dissectors. _{12th USENIX Workshop on Offensive Technologies (WOOT 18) 2018 · Conference paper · Stephan Kleber et al. · PDF · Code · Full entry}

Full Repository Index

This published selection contains 3,500 captured repository records and 3,309 browsable entries. 187 scope-excluded entries and 4 whose upstream repository is no longer available remain in the published JSON. Original capture totals remain separate in the source evidence. Automatically discovered entries are not individually curated or execution-tested recommendations.

Browse by category on GitHub · Search website · Full bilingual index JSON · Curated catalog JSON

The resource list above is curated from primary sources. Detailed requirements, original evidence, and review dates are available in the catalog data.

Contributing

Help improve an entry or share a useful source. Start with the contribution guide, then suggest a resource, recommend a paper, correct a translation or report an outdated entry.

Contributors

Yuxuan Zhang — Lead.

Haozhe Wang — Game reconstruction resource collection: awesome-rea-games.

About

REA (Reverse Engineer Anything) is a separate upstream CLI and MCP project. This collection's name echoes it, but it is not the REA repository; “REA” in entry tags and labels such as “Official REA documentation” refers to that project.

This is an independent community collection. Original descriptions and code are MIT licensed; linked projects retain their own licenses.

To cite the collection itself, use its citation metadata. Cite listed papers, tools and other works from their own primary sources, and give the commit or snapshot date with any scan-derived counts.

For AI-built software and agent training or evaluation resources, explore AI Can What? across games, websites and applications.

Catalog format · Scan methodology · Build status · Back to top

Name		Name	Last commit message	Last commit date
.github		.github
assets		assets
data		data
docs		docs
scripts		scripts
site		site
tests		tests
.gitignore		.gitignore
CITATION.cff		CITATION.cff
CONTRIBUTING.md		CONTRIBUTING.md
CONTRIBUTING.zh-CN.md		CONTRIBUTING.zh-CN.md
LICENSE		LICENSE
README.md		README.md
README.zh-CN.md		README.zh-CN.md
SECURITY.md		SECURITY.md

Latest commit

History

Folders and files

Repository files navigation

Awesome Reverse Engineering Anything

Contents

Find by task

Resources

Website

Case studies

Tools, projects and integrations

Game

Case studies

Tools, projects and integrations

App

Case studies

Tools, projects and integrations

Native Binary

Case studies

Tools, projects and integrations

Firmware and Hardware

Case studies

Tools, projects and integrations

Protocol

Case studies

Tools, projects and integrations

Agents and MCP

Related Collections

References and Learning

Papers

Reverse-engineering agent evaluation

Decompilation and symbol recovery

Website reconstruction

Game reconstruction and reverse engineering

App reconstruction and analysis

Firmware analysis and rehosting

Protocol inference and analysis

Full Repository Index

Contributing

Contributors

About

About

Topics

Resources

Contributing

Security policy

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages