Tools

bethington/ghidra-mcp

MCP server bridging Ghidra's reverse engineering with AI tools: 256 tools for decompilation, P-code emulation, live debugging, data flow analysis,…

last-emo-boy/rikune

MCP server for reverse engineering Windows executables and binary formats. Combines static triage, Ghidra-assisted function recovery, plugin-driven…

yeet-src/usbsnoop

Live, system-wide USB transfer sniffer in eBPF — decodes USB traffic inline (control SETUP, SCSI, HID) from two universal URB hooks. No usbmon, no…

jatinkapilaq1/intel-me-research

Talk to your Intel Management Engine directly — zero-dependency Python tool. Finds memory leaks, partition manifest, live MKHI probing. First public…

allthingsida/idasql

Vibe Reverse Engineer with IDA SQL: An interface for IDA in SQL via live virtual tables

kernullist/windbg-decompile-ext

WinDbg x64 extension that disassembles live functions and uses an LLM to produce verified pseudocode.

stolevchristian/sylvia

iOS Syscall Explorer for IDA 9.X

deemoun/pulseapk

PulseAPK is a WPF frontend for apktool and uber-signer with drag-and-drop support, live decompilation output, smali analysis, and integrated APK…

mretallack/dronecamera

Drone HASAKEE FPV video app for Android

seyyidkadir/filedumper

Windows memory forensics tool for dumping files from process memory regions, searching byte patterns (PDF, JPG, SWF), and performing live process…

jbsouthe/http-breakout-proxy

HTTP Proxy Analysis for reverse engineering protocol communication

arosenmund/defcon33_silence_kill_edr

Hands-on DEFCON workshop materials for killing and silencing EDR agents: lab setup, BYOVD, custom C/C++ evasion tooling, and reverse engineering.

ignacioj/whacamole

Live memory analysis detecting malware IOCs in processes, modules, handles, tokens, threads, .NET assemblies, memory address space and environment…

nccgroup/asadbg

asadbg is a framework of tools to aid in automating live debugging of Cisco ASA devices