Choose a target and follow source-linked tools, learning paths, REA workflows, case studies and research.
Choose the software or artifact you want to understand before choosing a tool. A Windows executable, Android package, managed assembly, website and network capture expose different kinds of evidence. Each task path below starts with a concrete question, explains the likely prerequisites and links to tools and learning material. Unknown costs, platforms and release compatibility stay labelled Unknown until a source supports them.
This hub combines original guidance with source-linked records. Begin with read-only inspection of an authorized sample, preserve its version and hash, and test important conclusions against raw evidence or a controlled run. AI-assisted analysis can organize observations, but generated prose and decompiled strings need independent verification. Use the comparison pages to choose by task fit rather than a universal ranking.
56 resources · Page 1 of 5
Begin with a small program you own or an explicitly permitted practice binary. Learn file formats, registers, memory, basic assembly and control flow before asking a decompiler to explain a function. Use Ghidra to navigate one string or decision, record the evidence trail, then add a debugger only when a question requires runtime observation.
View evidence & requirementsREA's Android package path uses headless JADX for questions about DEX methods, while device and resource work have separate requirements. Begin with an APK you may inspect, record its build and hash, and identify the component behind one visible feature. A readable decompilation helps navigation; runtime behavior requires a separate authorized test.
View evidence & requirementsA native investigation should separate lightweight file metadata from provider-backed function analysis. REA can coordinate focused reads of instructions, references and pseudocode through a configured provider such as Ghidra. Identify the binary format and architecture, trace one relevant function, and verify important interpretations against the underlying bytes or a controlled run.
View evidence & requirementsThe official REA Aegis showcase follows a six-digit login-code calculation through an Android APK and rebuilds a small clock-controlled example. It is a useful model for moving from a feature question to methods, constants and a reference test. The stated validation belongs to the showcase authors; AI Craft Pad has not rerun the APK analysis or demo.
View evidence & requirementsA reverse engineering agent may read strings, documents and decompiler output controlled by the software under study. Those bytes are evidence, not instructions for the agent. The safest workflow records where each claim came from, limits tool permissions, starts with static inspection and treats requests inside a sample to run commands or reveal data as hostile input.
View evidence & requirementsALT4Decompile explores an abstract loop-tree representation to help a language model reconstruct C-like control flow from assembly. It is relevant when a decompilation method struggles with jumps and nested loops. The current arXiv version has a changed title from the earlier SALT4Decompile version; treat both names as one evolving paper, not separate research findings.
View evidence & requirementsLearn artifact formats and evidence vocabulary before handing an investigation to an agent. Choose a small authorized target, ask REA for one bounded observation, and have the model explain where it came from. Verify the claim against instructions, source ranges or a controlled run while treating all target text as untrusted data.
View evidence & requirementsAn APK mixes code, resources, manifest declarations and signatures. Start by asking which part answers your question. JADX helps read DEX code in a Java-like view, while Apktool is useful for decoded resources. REA documents an Android workflow around a headless JADX engine. Static findings still need careful interpretation, and device behavior requires a separate authorized test.
View evidence & requirementsangr provides program analysis techniques including symbolic execution for native software. Choose it when a bounded path question can be expressed with concrete input and state assumptions. Its results depend on models of the environment, libraries and constraints. Validate any found path against the actual binary or a controlled run rather than treating solver output as observed behavior.
View evidence & requirementsApktool focuses on decoding Android package resources and structure, including manifests and resource tables. Select it when the question concerns packaged strings, XML, layouts or identifiers rather than a Java-like method view. Keep the exact APK hash and compare resource references with code where needed. Decoded declarations do not establish actual device behavior.
View evidence & requirementsDIRTY studies learned predictions of variable names and types for decompiler output. It addresses readability and analyst comprehension, rather than recovery of the original symbols with certainty. Use it when evaluating how much a suggested name helps navigate code, then verify any semantic interpretation against uses, data flow and observed behavior before adopting it as a fact.
View evidence & requirementsAutomatically Attacking Software Reverse Engineering AI Agents studies prompt injection through strings embedded in a binary. It matters for any workflow that gives decompiled text to a language-model agent: attacker-controlled target content can be mistaken for an instruction and corrupt the explanation. Use the paper as a threat model, while checking its experimental conditions before generalizing failure rates.
View evidence & requirements