Awesome Reverse Engineering

Featured: REA — Agent-oriented reverse-engineering tools, from application behavior to native binaries. By the creators of awesome-reverse-engineering.

A curated starting point for understanding binaries, applications, firmware, file formats, and protocols.

Find a tool by the work you need to do. Each entry describes its purpose; commercial tools are marked commercial. This is an initial selection, open to additions and corrections.

Start here

Your task	Start with
Learn assembly and reversing fundamentals	Learning
Identify an executable and its capabilities	File identification and triage
Read native code or step through it	Native analysis and Debuggers
Trace calls or instrument a running program	Dynamic instrumentation and tracing
Bypass anti-debugging, unpack or rebuild imports	Deobfuscation and anti-analysis
Examine a suspicious file, process, or memory image	Malware analysis
Inspect an APK, .NET assembly, or Java program	Android and managed code
Inspect an iOS app, macOS binary, or Apple firmware	iOS and macOS
Unpack a Python, Go, Flutter, or Hermes binary	Language runtimes and packagers
Understand browser behavior or an undocumented protocol	Web and protocols
Extract firmware or inspect a binary format	Firmware and hardware and File formats
Reconstruct game memory structures, assets, or bytecode	Game reverse engineering
Compare builds or audit binary diffs	Binary diffing and patch analysis
Solve constraints, explore states, or lift semantics	Symbolic execution and formal analysis and Instruction lifting and semantics
Accelerate an investigation with AI agents	AI-assisted analysis

Contents

• Learning
  • Books
• File identification and triage
• Native analysis
• Debuggers
• Dynamic instrumentation and tracing
• Deobfuscation and anti-analysis
• Malware analysis
• Android and managed code
• iOS and macOS
• Language runtimes and packagers
• Web and protocols
• Firmware and hardware
• File formats
• Game reverse engineering
• Binary diffing and patch analysis
• Symbolic execution and formal analysis
• Instruction lifting and semantics
• AI-assisted analysis
• Practice and communities
• Related lists
• Contributing and maintenance
• License

Learning

• Azeria Labs - ARM assembly tutorials with exercises for learning registers, memory, and calling conventions.
• Compiler Explorer - Compiles code in the browser with many compilers and shows the generated assembly, for seeing how source constructs and optimization levels translate to machine code.
• Corkami - Visual references and posters explaining binary formats and file structures, including executable-format layouts.
• Corkami PoCs - Minimal and unusual executable and document samples for studying file-format edge cases and parser behavior.
• Hextree - Hands-on mobile and hardware reverse-engineering courses and interactive labs; Commercial, with some free content.
• Malware Analysis Training - Windows malware-analysis course with programming, Windows-internals, and reversing exercises; labs need a suitable Windows analysis environment.
• Malware Unicorn RE101 - Introductory Windows malware-reversing workshop covering x86 assembly, triage, and debugging; its VM-based lab instructions use older software images.
• Nightmare - Course built from annotated CTF challenges, progressing from assembly and reversing basics to binary exploitation.
• OpenSecurityTraining2 - Structured courses in assembly, architecture, debugging, and reverse engineering.
• pwn.college - Free courses with hands-on challenges in Linux, assembly, reverse engineering, and binary exploitation, run in a browser-accessible environment.
• Reverse Engineering by Kevin Thomas - Annotated assembly and reverse-engineering lessons across x86, x64, ARM, AVR, and RISC-V, with lesson-specific toolchain and hardware requirements.
• Reverse Engineering for Beginners - Free book connecting compiled C and C++ examples to assembly across several architectures.
• RPISEC Modern Binary Exploitation - Course materials and labs covering reverse engineering, memory corruption, and exploitation; no commits since December 2021, so labs may need older toolchains.

Books

• Hacking the Xbox - Introduction to hardware reverse engineering through the original Xbox's security design; free PDF edition released by the author.
• Practical Binary Analysis - Covers ELF and PE internals, disassembly, binary instrumentation, taint analysis, and symbolic execution, with tools built in the exercises.
• Practical Malware Analysis - Hands-on introduction to static and dynamic Windows malware analysis with lab exercises; published in 2012, so some tooling chapters are dated.
• The Ghidra Book - Guide to Ghidra's disassembler, decompiler, scripting, and extension APIs; the 2026 second edition covers BSim and PyGhidra.

File identification and triage