Compare source-reviewed reverse engineering tools by target, host, license and task fit.
Start with your artifact and the evidence you need. Ghidra helps inspect native code; JADX follows Android methods; Apktool focuses on package resources; a debugger or dynamic instrumentation tool answers questions that static inspection cannot settle. The cards show the source, documented scope, host requirements and important limitations. A tool name in this directory does not certify that it supports every target version or that a particular analysis has been reproduced.
Repository activity is a dated observation, not proof of meaningful maintenance. A GitHub release can belong to one component of a larger project. Read the project's own documentation and license terms for the version you plan to use. If a field says Unknown, the evidence is incomplete and should be checked before committing to a workflow.
20 resources · Page 2 of 2
REA coordinates evidence-focused investigations through a local CLI and MCP interface. Choose a target and check its particular provider requirements before starting: native pseudocode, Android methods, browser observations and firmware extraction use different underlying tools. Its structured output can help an analyst or agent stay on a question, but it does not independently verify a model's interpretation.
View evidence & requirementsRetDec decompiles machine code into a higher-level representation for inspection. It can provide another perspective on a native function when one decompiler's output is unclear. Keep the exact binary and architecture context, then compare important control flow with assembly. Different pseudocode does not by itself prove which interpretation matches the original program behavior.
View evidence & requirementsUnblob extracts recognized file formats from firmware and other composite files. Choose it when you need a bounded map of nested components before inspecting code or configuration. Keep the original image and the extracted file lineage. Extraction identifies candidates for review; it does not establish device behavior, firmware authenticity or the safety of executing any recovered file.
View evidence & requirementsVolatility 3 examines memory images for forensic questions about processes, modules and system state. Use it when you have an authorized capture and a specific question about what was present in that snapshot. Preserve acquisition details and image integrity. A memory image is incomplete by nature, and a plugin result should be traced back to the structures it interpreted.
View evidence & requirementsWireshark inspects captured network packets and protocol fields. It is useful when you need to understand a bounded exchange, identify endpoints or test a hypothesis about message framing. Keep the capture origin, time window and permissions with the analysis. A packet trace covers the traffic that was actually recorded; encryption and missing sessions limit what it can show.
View evidence & requirementsx64dbg is a Windows user-mode debugger for inspecting a native program while it runs. Use it after a static question has produced a likely address or event to observe. Breakpoints and traces can show values in one controlled scenario, while later paths may differ. The repository's modified GPL text needs exact license review, so this catalog leaves its license as Unknown.
View evidence & requirementsYARA applies pattern rules to files or other data in defensive analysis. Choose it when you can describe observable features of a family or sample set and want reproducible matches. Test rules against positive and negative examples, then review every hit. A match supports a classification hypothesis; it does not prove intent, safety or a complete malware family identity.
View evidence & requirementsYARA-X is a rule engine in the YARA ecosystem. It is relevant when you need to evaluate rule processing with the newer implementation, but the compatibility boundary must be checked for the exact syntax and version you use. Preserve the rules and test corpus. A successful scan returns matches for that input; it is not a general certification of detection quality.
View evidence & requirements