Reverse engineering tools: 36 open-source projects (2026)

MCP server and CLI letting AI agents reverse engineer native binaries, Electron apps, .NET assemblies and websites.

Ghidra is an open-source software reverse engineering framework from the NSA, offering disassembly, decompilation, graphing and scripting for compiled code.

A cross-platform hex editor for reverse engineering and binary analysis, with a pattern language for parsing file structures.

Command-line and GUI tools that decompile Android Dex, APK and related files into readable Java source code.

An AI agent skill pack that routes reverse engineering, pentest, and CTF tasks to the right playbook and checks which tools are installed.

A command-line tool for reverse engineering closed Android APK files, decoding resources to near-original form and rebuilding them after changes.

Open-source, cross-platform .NET assembly browser and decompiler that turns compiled .NET binaries back into readable C#.

Libre reverse engineering framework and command-line toolset for analyzing, disassembling, debugging and emulating binaries on Unix-like systems.

A free, open-source reverse engineering platform with a GUI, built on the rizin framework.

A Rust-based firmware analysis tool that identifies and optionally extracts files and data embedded inside other files.

MCP server that connects IDA Pro to LLM clients so an AI assistant can decompile, annotate and rename binaries during reverse engineering.

Cross-platform file identification and static analysis tool that detects file types, compilers, packers and protections in executables.

An MCP server that exposes Ghidra's reverse engineering functions so LLM clients can decompile and analyze binaries.

Unofficial continuation of dnSpy, a debugger and editor for .NET and Unity assemblies that works without source code.

A lightweight CPU emulator framework based on QEMU that runs machine code for multiple architectures through a clean, architecture-neutral API.

A Python extension that adds an enhanced, exploit-development-oriented interface to GDB for x86, ARM, MIPS, PowerPC and SPARC.

A Java and Android bytecode editor with an IDE-like interface for decompiling, editing, deobfuscating and exporting compiled applications.

MCP server letting AI assistants drive Ghidra for binary analysis, with 200+ tools for decompiling, renaming and annotating.

A cross-platform C++ library with Python and Rust bindings to parse, modify and abstract ELF, PE, Mach-O and Android executable formats.

A UNIX-like reverse engineering framework and command-line toolset for analyzing binaries, disassembling code and debugging programs.

A command-line toolkit for Apple firmware research, covering IPSW/OTA downloads, Mach-O and dyld cache analysis, kernelcaches, and connected iOS devices.

An IDA Pro plugin that sends decompiled functions to large language models to explain them, add comments, and suggest variable names.

A JADX plugin plus Python MCP server that lets LLMs such as Claude analyze decompiled Android APKs live from the JADX GUI.

An MCP plugin for x64dbg that lets AI assistants control the debugger over HTTP for breakpoints, stepping, and memory reads.

Command-line tool that recursively extracts files from 78+ archive, compression and file-system formats and carves out unknown chunks in binary blobs.

An MCP server extension for Ghidra that lets AI language models drive reverse engineering analysis through small, focused tools.

An LLM-powered extension for Ghidra that adds AI-assisted code explanation, chat, and agentic analysis to reverse engineering workflows.

LLM-powered plugin for radare2 that adds an r2ai command for AI-assisted reverse engineering, with a decai decompilation plugin.

A Windows-focused PE viewer and analyzer for EXE, DLL, SYS, static libraries, COFF objects and ELF files, with disassembly and decompilation.

An MCP server that lets AI agents drive radare2 for binary analysis, running from the CLI, as an r2 plugin, or over HTTP.