Choose a target and follow source-linked tools, learning paths, REA workflows, case studies and research.
Choose the software or artifact you want to understand before choosing a tool. A Windows executable, Android package, managed assembly, website and network capture expose different kinds of evidence. Each task path below starts with a concrete question, explains the likely prerequisites and links to tools and learning material. Unknown costs, platforms and release compatibility stay labelled Unknown until a source supports them.
This hub combines original guidance with source-linked records. Begin with read-only inspection of an authorized sample, preserve its version and hash, and test important conclusions against raw evidence or a controlled run. AI-assisted analysis can organize observations, but generated prose and decompiled strings need independent verification. Use the comparison pages to choose by task fit rather than a universal ranking.
56 resources · Page 2 of 5
The AutoDecompiler paper presents feedback-driven, multi-turn refinement of decompiled code using compilation, execution and input/output tests. Its useful idea is to treat a generated program as a hypothesis that can fail observable checks. Read the reported benchmark conditions carefully: compilation success alone does not establish the same behavior as the original binary.
View evidence & requirementsBinDiff compares binaries to suggest corresponding functions and changed regions across builds. It fits a question about what changed between two known versions when both inputs and their analysis projects are available. Matching scores are leads, not proof of semantic equivalence. Inspect candidate changes and confirm important differences against instructions, symbols and observed behavior.
View evidence & requirementsBinwalk helps identify embedded formats and regions inside firmware or other composite files. It is a starting point for an authorized firmware inventory, especially before deciding which extracted component needs deeper analysis. Record image hashes and offsets. A detected signature is a candidate, not proof that a complete, safe or executable component has been recovered.
View evidence & requirementsDecomperson investigates how people use decompiler output and what that reveals about human reverse-engineering work. It is useful for designing analyst tools and AI assistance that support real questions instead of optimizing only a code-generation score. Read the study tasks and participant conditions before treating its observations as universal behavior across every analyst and binary type.
View evidence & requirementsThe official REA DownUnderCTF showcase traces a small flag checker from its prompt and result strings to the accepting conditions. It demonstrates a question-driven sequence: locate the check, translate constraints and test a candidate against the original challenge. The success claim is from the project case narrative; AI Craft Pad did not run the binary.
View evidence & requirementsThe official DX-Ball REA showcase examines how a brick position becomes a stereo sound-pan value in a Windows game executable. Its strongest lesson is that an incomplete pseudocode view can be repaired by reading the caller, instructions and stored constants. The project's differential and compiler checks concern a specific function and checkpoint, not a fully rebuilt game.
View evidence & requirementsFLARE-VM is a Windows analysis environment that brings together tools used for defensive reverse engineering and malware work. Choose it when a disposable Windows workspace is needed for multiple investigation steps. Record installed tool versions and isolate specimens. The environment's presence does not make every bundled tool safe, current or suitable for a particular target.
View evidence & requirementsFrida provides dynamic instrumentation for an authorized running process. Choose it when a static hypothesis needs a controlled observation of calls, values or timing on a specific device or host. Record the application build and environment before collecting evidence. Instrumentation changes the runtime setting, and a single trace cannot prove every possible execution path.
View evidence & requirementsReverse engineering starts with a precise question about software you may inspect. Choose a small, lawful sample, identify its format, save the original file and record what you can observe without running it. Learn enough assembly and program structure to test an explanation. Use tools to inspect evidence, then confirm each conclusion against behavior or bytes.
View evidence & requirementsGhidra is a software analysis environment for inspecting native binaries, functions, references and decompiler output. It is a strong starting point when you need to map a Windows or Linux program before tracing one behavior. Choose the correct processor and file format, keep the original binary, and check important pseudocode claims against instructions or controlled behavior.
View evidence & requirementsILSpy helps inspect managed .NET assemblies, their types, methods and decompiled code. It suits questions about a .NET application's call chain or public API before a runtime test is necessary. Keep the exact assembly version and check whether native dependencies or generated code affect the path. Readable output still differs from the original developer source.
View evidence & requirementsJADX opens Android DEX and APK code in a navigable Java-like view. It is useful when a question concerns classes, methods, calls or references rather than only resources. Start with the exact APK build and trace one method from an observable action. Decompiled output can be distorted by obfuscation and compiler transformations, so verify important branches against bytecode or behavior.
View evidence & requirements