x64dbg / x64dbg
An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.
x64dbg / x64dbg
JoasASantos / Malvex
AI-driven malware analysis framework with 30+ integrated tools, web REPL, and MCP server
THREATBYTES / Malware-Analysis-Report-Template
A standardised malware analysis report template with a JSON Schema and Markdown format mapped to MITRE ATT&CK. Validate, share and compare reports consistently. Part of ThreatBytes.
radareorg / radare2
UNIX-like reverse engineering framework and command-line toolset
MobSF / Mobile-Security-Framework-MobSF
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
horsicq / Detect-It-Easy
Program for determining types of files for Windows, Linux and MacOS.
pwndbg / pwndbg
Exploit Development and Reverse Engineering with GDB & LLDB Made Easy
mandiant / flare-vm
A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.
We5ter / Scanners-Box
The Ultimate Open-Source Security Arsenal for Hackers, Enterprises, and AI Agents——面向极客、企业与 AI 智能体的全域开源网络安全工具矩阵
bee-san / pyWhat
🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙♀️
MISP / MISP
MISP (core software) - Open Source Threat Intelligence and Sharing Platform
mandiant / capa
The FLARE team's open-source tool to identify capabilities in executable files.
lief-project / LIEF
LIEF - Library to Instrument Executable Formats (C++, Python, Rust)
intelowlproject / IntelOwl
IntelOwl: manage your Threat Intelligence at scale
mandiant / flare-floss
FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
HyperDbg / HyperDbg
State-of-the-art native debugging tools
alexandreborges / malwoverview
Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.
hasherezade / pe-bear
Portable Executable reversing tool with a friendly GUI
kevoreilly / CAPEv2
Malware Configuration And Payload Extraction
rednaga / APKiD
Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android
duty1g / x64dbg-mcp-server
x64dbg-MCP Server is a native MCP (Model Context Protocol) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Connect any MCP-compatible AI assistant and control x64dbg programmatically: set breakpoints, step through code, read memory, dump registers, and more. Built with Zig — zero dependencies, single-binary output, cros
mandiant / speakeasy
Windows kernel and user mode emulation.
ev-flow / quark-engine
—
packing-box / awesome-executable-packing
A curated list of awesome resources related to executable packing
CERT-Polska / drakvuf-sandbox
DRAKVUF Sandbox - automated hypervisor-level malware analysis system
2akouwu / reverify
Stop your AI from making things up — it proposes, deterministic tools decide, every claim checked against ground truth with evidence. Grounded facts and context survive resets. Reverse engineering is the proving ground. MCP server + CLI.
LING71671 / open-reverselab
Open-source AI reverse-engineering agent platform and MCP server for Ghidra, Frida, x64dbg and Rizin — automated PE/APK/binary analysis, CTF and malware research, with 100+ MCP tools and a 194-article runnable knowledge base.
tklengyel / drakvuf
DRAKVUF Black-box Binary Analysis
Washi1337 / AsmResolver
A library for creating, reading and editing PE files and .NET modules.
cisagov / thorium
A scalable file analysis and data generation platform that allows users to easily orchestrate arbitrary docker/vm/shell tools at scale.
morluto / awesome-reverse-engineering
Curated reverse-engineering tools and learning resources for binaries, apps, firmware, formats, and protocols.
certsocietegenerale / fame
FAME Automates Malware Evaluation
binref / refinery
High Octane Triage Analysis
lkimuk / ReArk
An intelligent reverse engineering and AI-assisted analysis tool for HarmonyOS NEXT (HAP/APP/ABC), Android (APK/AAB), iOS (IPA), and native PE/ELF/Mach-O binaries.
horsicq / XAPKDetector
APK/DEX detector for Windows, Linux and MacOS.
chainguard-dev / malcontent
#supply #chain #attack #detection
darama22 / Malware-Research-Hub
Self-contained malware research hub: curated catalog of 80 families (1971-2024) + 2,764 real encrypted samples, indexed and searchable. Local Flask app, bilingual.
Spacial / awesome-csirt
Awesome CSIRT is an curated list of links and resources in security and CSIRT daily activities.
secana / PeNet
Portable Executable (PE) library written in .Net
horsicq / Nauz-File-Detector
Linker/Compiler/Tool detector for Windows, Linux and MacOS.
digitalisx / awesome-memory-forensics
A curated list of awesome Memory Forensics for DFIR
CybercentreCanada / assemblyline
Assemblyline 4: File triage and malware analysis
ImKKingshuk / LockKnife
LockKnife: The Ultimate Android Security Research Tool. A unified TUI workspace and headless CLI for deep Android security research, built for researchers and hackers. Powered by Python orchestration and a Rust-accelerated core, enabling AI agent–driven hacking, credential recovery/cracking, APK analysis, intelligence gathering, runtime inspection.
bl4ckr0ss3 / knife
A terminal-first reverse engineering toolkit in Rust: PE/ELF/Mach-O analysis through CLI, TUI, and MCP. Installs as knife.
atomdrift-project / scan
0-day malware detection for binaries, source & scripts (that doesn't suck)
Ablation-Tool / ablation
Ablation is an autonomous reverse engineering system.
dslsdzc / rev-skills
122 个逆向工程 AI 技能：恶意软件分析 / 软件逆向 / 固件嵌入式 / 协议逆向 / 移动应用 / 脱壳反混淆 / 软件破解 / 漏洞挖掘 / 托管代码 / 取证情报 / CTF。
openbin-ai / binny
BINNY: an open source agent harness for reverse engineering. Plug in any model, or a local one.
scottalt / senior-securityengineer-cybersecuritybookmarks
A senior security engineer's actual browser bookmarks. 40+ curated cybersecurity resources for recon, OSINT, exploitation, privilege escalation, and malware analysis.
HackingLZ / sleepwalker
Passive backdoor implant that sniffs for a covert magic-packet trigger and runs tasks written in a custom 23-opcode bytecode command language.
1rhino2 / fnprint
match functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.
doxsir / peep
PE file parser in plain C++17 - reading exe headers byte by byte
luantak / is-malicious
A codebase scanner that helps you not run malicous code
yankywilson / kyber-ransomware-analysis
Full teardown of the Kyber ransomware Windows encryptor. Six corrections to public reporting, each independently verifiable. Includes analysis tooling, detection content, and incident response guidance.
prox0959 / CyberCodex
Autonomous 23-Source Zero-Cost OSINT, Binary Image Forensics (EXIF/GPS/Stego), Data Breach/Leak & Threat Intelligence Engine in Pure Python