Compare source-reviewed reverse engineering tools by target, host, license and task fit.
Start with your artifact and the evidence you need. Ghidra helps inspect native code; JADX follows Android methods; Apktool focuses on package resources; a debugger or dynamic instrumentation tool answers questions that static inspection cannot settle. The cards show the source, documented scope, host requirements and important limitations. A tool name in this directory does not certify that it supports every target version or that a particular analysis has been reproduced.
Repository activity is a dated observation, not proof of meaningful maintenance. A GitHub release can belong to one component of a larger project. Read the project's own documentation and license terms for the version you plan to use. If a field says Unknown, the evidence is incomplete and should be checked before committing to a workflow.
20 resources · Page 1 of 2
angr provides program analysis techniques including symbolic execution for native software. Choose it when a bounded path question can be expressed with concrete input and state assumptions. Its results depend on models of the environment, libraries and constraints. Validate any found path against the actual binary or a controlled run rather than treating solver output as observed behavior.
View evidence & requirementsApktool focuses on decoding Android package resources and structure, including manifests and resource tables. Select it when the question concerns packaged strings, XML, layouts or identifiers rather than a Java-like method view. Keep the exact APK hash and compare resource references with code where needed. Decoded declarations do not establish actual device behavior.
View evidence & requirementsBinDiff compares binaries to suggest corresponding functions and changed regions across builds. It fits a question about what changed between two known versions when both inputs and their analysis projects are available. Matching scores are leads, not proof of semantic equivalence. Inspect candidate changes and confirm important differences against instructions, symbols and observed behavior.
View evidence & requirementsBinwalk helps identify embedded formats and regions inside firmware or other composite files. It is a starting point for an authorized firmware inventory, especially before deciding which extracted component needs deeper analysis. Record image hashes and offsets. A detected signature is a candidate, not proof that a complete, safe or executable component has been recovered.
View evidence & requirementsFLARE-VM is a Windows analysis environment that brings together tools used for defensive reverse engineering and malware work. Choose it when a disposable Windows workspace is needed for multiple investigation steps. Record installed tool versions and isolate specimens. The environment's presence does not make every bundled tool safe, current or suitable for a particular target.
View evidence & requirementsFrida provides dynamic instrumentation for an authorized running process. Choose it when a static hypothesis needs a controlled observation of calls, values or timing on a specific device or host. Record the application build and environment before collecting evidence. Instrumentation changes the runtime setting, and a single trace cannot prove every possible execution path.
View evidence & requirementsGhidra is a software analysis environment for inspecting native binaries, functions, references and decompiler output. It is a strong starting point when you need to map a Windows or Linux program before tracing one behavior. Choose the correct processor and file format, keep the original binary, and check important pseudocode claims against instructions or controlled behavior.
View evidence & requirementsILSpy helps inspect managed .NET assemblies, their types, methods and decompiled code. It suits questions about a .NET application's call chain or public API before a runtime test is necessary. Keep the exact assembly version and check whether native dependencies or generated code affect the path. Readable output still differs from the original developer source.
View evidence & requirementsJADX opens Android DEX and APK code in a navigable Java-like view. It is useful when a question concerns classes, methods, calls or references rather than only resources. Start with the exact APK build and trace one method from an observable action. Decompiled output can be distorted by obfuscation and compiler transformations, so verify important branches against bytecode or behavior.
View evidence & requirementsMobSF brings static and dynamic workflows together for mobile application security assessment. It is useful for a broad authorized review that needs an inventory before narrower manual questions. Separate observations the framework extracted from its risk interpretations. Dynamic components need a correctly configured device or emulator, and automated findings should be checked against the app build and evidence.
View evidence & requirementsobjection is a mobile runtime exploration toolkit built on Frida. Choose it when its ready-made interaction fits an authorized device question, and use Frida directly when you need a more specific custom observation. Keep the exact app and device versions. Its presence does not bypass the setup, permission and evidence limits of the underlying instrumentation layer.
View evidence & requirementspwndbg adds low-level views and commands to GDB for inspecting a running program. It can help when a native investigation requires registers, stack state and memory context around a specific event. Use a controlled sample with a recorded build and input. The added presentation helps navigation but does not replace the debugger's raw observations or prove unexplored paths.
View evidence & requirements