The awesome-reverse-engineering list on GitHub is a curated directory of tools and learning resources for analysing binaries, applications, firmware, file formats and protocols. As of 25 October 2026, GitHub's API showed 1,217 stars, 262 forks and a CC0-1.0 licence for the repository.
What the list covers and how it is organised
The list sorts entries by the job a reader needs to do, not by operating system or vendor. Sections include learning material, file identification and triage, native analysis, debuggers, dynamic instrumentation, malware analysis, Android and managed code, iOS and macOS, language runtimes, and web and protocol tools. Each entry carries a one-line description of its purpose.
The maintainers say the selection is an initial one and open to additions and corrections. They also mark commercial tools, which matters for teams with licensing budgets.
Which tools should a beginner start with?
For someone new to the field, the learning section is the most direct entry point. The list names Azeria Labs for ARM assembly exercises, Compiler Explorer for seeing how source code becomes assembly at different optimisation levels, and the free book Reverse Engineering for Beginners, which links compiled C and C++ examples to assembly across several architectures.
For analysis work, the list points to a mix of free and commercial options. Ghidra is described as covering disassembly, decompilation, scripting and headless analysis for native binaries. Binary Ninja and IDA are commercial, with free editions. Radare2 and Rizin are command-line oriented. Each choice depends on whether the user prefers a graphical interface, scripting or a command line.
What does the list say about tools that have stopped moving?
The list flags several projects that are no longer actively developed. RetDec is in limited maintenance mode. YARA is in maintenance mode, with YARA-X named as its successor, and the list advises checking documented differences before migrating rules. class-dump has been unmaintained since 2019 and has no Swift support, and the list suggests ipsw class-dump as a maintained alternative. Il2CppDumper has had no commits since July 2024, with Cpp2IL offered as a maintained alternative.
Where the list warns about limits and requirements
Several entries include practical conditions. hexvero's CLI, MCP server and local web UI require Node.js 22.12 or newer, and its pattern-based JavaScript analysis can miss indirect code. Vineflower needs Java 17 or newer to run current releases. PyLingual requires Python 3.12 or newer and downloads large per-version models. MemProcFS needs Dokany, FUSE or macFUSE to mount memory images.
The list also states that some tools cover only part of a format or version. Hermit supports Hermes bytecode versions 94, 95 and 96, with 98 unsupported. The RPISEC Modern Binary Exploitation course has had no commits since December 2021, so its labs may need older toolchains.
Malware work carries its own warning. The list says samples should be run only in isolated, disposable environments and handled under the organisation's procedures.
Who it is for and where it falls short
The list suits students, security teams, and developers who need to take apart a binary or an app they do not control. It is most useful as a map: it tells a reader which category of tool to look at, then leaves the evaluation to the reader.
It has clear gaps. It is a list of links and one-line descriptions, so it does not benchmark tools against each other or report how well each one performs on real samples. Descriptions come from the maintainers and the projects, and the list does not independently verify them. The list also features REA, described as agent-oriented reverse-engineering tools by the creators of the list itself. Readers should weigh that as a maintainer's promotion rather than an independent endorsement.
Bottom line: Use the list to shortlist tools for a specific task, then check each project's licence, requirements and recent commit history before adopting it. Treat the maintenance flags as the first thing to verify.
Source and verification: The information comes from the morluto/awesome-reverse-engineering repository on GitHub, with the page dated 22 October 2026 in the source metadata. Repository figures for stars, forks, licence, main language and last commit push date (25 October 2026) come from the GitHub API as of 25 October 2026.
Frequently asked questions
Is awesome-reverse-engineering free to use?
The repository is licensed under CC0-1.0, according to GitHub's API as of 25 October 2026. Many of the tools it lists are free, while others, such as Malcat and Burp Suite, are commercial with free editions.
Which language is the repository written in?
GitHub's API lists Python as the main language of the repository as of 25 October 2026. The list itself is a collection of links and descriptions for tools written in many languages.
Does the list cover mobile apps?
Yes. The Android and managed code section includes Apktool, JADX and MobSF, and the iOS and macOS section includes objection and pymobiledevice3, according to the list.
Related: Rubix: A Tiny x86-64 Assembly Language Without libc · CleanYourTV: Debloat Android TV Over Wi-Fi and Get a New Home Screen
Comments (0)