UnleashedRecomp is a PC port of *Sonic Unleashed* (Xbox 360) achieved through static recompilation. It replaces the original console's kernel, GPU, audio, and input APIs with native implementations, then applies a large set of behavioral patches to the recompiled game code for modern PC features like high resolutions, high frame rates, ultrawide support, and configurable controls. The application includes a full installer that extracts and validates game files from an ISO or directory dump, a custom achievement system, mod loading compatible with existing mod managers, and an ImGui-based UI for settings, achievements, and the installation wizard. The architecture is monolithic but modular: the kernel layer (memory, threading, file I/O) is separated from the GPU backend (with dedicated render thread), audio system, input handling, and OS abstraction for Windows, Linux, and macOS. The project relies on proprietary recompiled code (UnleashedRecompLib) and the original game assets, which are not distributed. The codebase demonstrates high engineering craftsmanship in areas such as deterministic memory allocation, virtual file systems, configuration templates, and cross-platform build orchestration, though it contains hardcoded game-specific addresses and auto-generated data that limit extensibility to other titles.
Special K is a sophisticated Windows game enhancement and injection framework, primarily a C++ DLL injection payload that hooks graphics APIs (DirectX 8/9/11/12, Vulkan, OpenGL, DXGI), input devices, and storefront overlays (Steam, Epic Online Services, GOG Galaxy, Xbox). Its core functionality includes real-time framerate and latency monitoring via ETW trace analysis (PresentMon integration), HDR injection and tone mapping, screenshot capture, shader modification, and a fully customizable ImGui-based control panel for configuring performance overlays, input remapping, and compatibility workarounds for specific games. The project demonstrates high craftsmanship with a modular architecture featuring COM wrapper patterns, a custom hooking infrastructure built on MinHook, and reusable utilities such as a hardware-accelerated CRC32 implementation, a thread-safe lazy singleton, and an INI parser with COM-style interfaces. It bundles extensive third-party dependencies including Boost, GLM, LZMA, and various vendor SDKs. While the codebase is primarily a tool for end users, it also contains data-driven components like game-specific plugin modules and performance event tracing that could inform research into game rendering behavior. The repository is actively maintained with frequent commits, though its large dependency surface and reliance on low-level Windows APIs introduce moderate technical drift risk.
CodeGraph is a Python command-line tool that performs static analysis on Python source code to generate dependency graphs. It parses Python files to extract functions, classes, and import statements, then builds a graph showing how these entities depend on each other. The tool outputs an interactive HTML visualization (using D3.js by default) or can export the data to CSV or print it to the console. The architecture is modular, consisting of a parser (using Python's tokenize module), a core module that builds the dependency graph, utility functions for file discovery, and a visualizer that supports both D3.js (interactive) and matplotlib (legacy) backends. The tool does not execute the code being analyzed, making it safe and fast for large codebases. Key strengths include a robust parser that handles various import styles and class inheritance, and a flexible visualization system that provides features like search, collapsing/expanding nodes, and detailed tooltips. The project is actively maintained with comprehensive tests and supports multiple Python versions.
ImHex is a cross-platform hex editor and binary analysis tool designed for reverse engineers, programmers, and digital forensics. It provides a rich GUI built on Dear ImGui and GLFW, with a modular plugin architecture that allows extending functionality through dynamically loaded plugins. The core library (libimhex) implements a provider abstraction for various data sources (files, disks, process memory, GDB, SSH, UDP, etc.), an event-driven communication system, a content registry for registering views, tools, settings, and data inspectors, and a pattern language engine for declarative binary parsing. The application includes built-in plugins for hex editing, data inspection, disassembly (Capstone), diffing, YARA rule matching, hashing, decompression, visualizations (3D, plots, images), scripting (C and .NET), and a Model Context Protocol (MCP) server for AI-assisted analysis. It supports undo/redo, bookmarks, patches, projects, themes, layouts, achievements, tutorials, and a command palette. The codebase is well-structured with clear separation between core library, plugins, and platform-specific code, though some components are tightly coupled to ImGui internals and the custom pattern language.
shadPS4 is a PlayStation 4 emulator for Windows, Linux, and macOS, written in C++20. It emulates the PS4's AMD GCN GPU via a custom shader recompiler that translates GCN instructions to SPIR-V, and implements high-level emulation (HLE) of PS4 system libraries (kernel, libc, networking, audio, video, input, etc.). The architecture is monolithic with modular subsystems: a Vulkan renderer with texture/buffer caches, a shader recompiler with IR optimization passes, a file system abstraction supporting host files and ZArchive, and an ImGui-based debug UI. While many library functions are stubbed or partially implemented, the core GPU and CPU emulation is functional enough to run several commercial games. The codebase demonstrates strong engineering practices with reusable common utilities (bitfields, slot containers, thread-safe queues) and a well-structured shader compilation pipeline. It is a hybrid project, combining software application development with significant reverse-engineering and data analysis of PS4 firmware and GPU architecture.
This repository implements an MCP (Model Context Protocol) server that exposes IDA Pro's disassembler, decompiler, debugger, and type system as a set of tools and resources consumable by LLM clients (Claude, Codex, Cursor, etc.). It operates in two distinct modes: an IDA GUI plugin that starts an MCP server on a configurable port, and a headless supervisor (`idalib-mcp`) that manages persistent worker processes for multiple databases. The architecture is a hybrid of a plugin and a standalone server, built on a custom, vendored MCP server implementation (`zeromcp`) with HTTP/SSE/stdio transports. The core API surface is defined via a decorator-based registration system (`@tool`, `@resource`, `@unsafe`, `@ext`) in `rpc.py`, which also handles output truncation middleware and JSON schema generation from TypedDicts. All IDA SDK calls are marshalled onto the main thread through a robust execution pipeline (`sync.py`) that manages timeouts, cancellation, and batch mode. The headless mode uses a supervisor/worker pattern (`idalib_supervisor.py`, `idalib_server.py`, `worker_lifecycle.py`) with health probing, idle TTL, and session management. A comprehensive compatibility layer (`compat.py`) provides version-gated shims for IDA 8.4 through 9.3. Key features include decompilation, disassembly, cross-references, memory read/write, patching, type declaration/inference, debugger control (breakpoints, step, registers), signature generation, and binary survey. Tool calls are always-on traced into the IDB as gzipped JSONL batches. The project includes an extensive test suite with a custom test framework, MCP spec regression tests, and CI running against multiple IDA versions in Docker containers. The codebase is actively maintained and demonstrates strong engineering practices, but the plugin mode is explicitly deprecated in favor of the official Hex-Rays IDA MCP Server. The heavy reliance on IDA's internal APIs and the vendored MCP server implementation represent ongoing maintenance risks. The code is well-structured with several genuinely reusable components, though some modules (e.g., `api_analysis.py`) are monolithic.
LiveContainer is an iOS application that acts as a runtime host for running third-party iOS apps (guest apps) without actually installing them. It leverages extensive reverse engineering of Apple's dyld, Mach-O binary format, and private iOS APIs to bypass code signing, inject tweaks (via CydiaSubstrate/ElleKit), manage multiple data containers per app, and provide multitasking (floating dock, Picture-in-Picture). The project includes a full code signing library (ZSign), a dyld validation bypass, hooking infrastructure, and integration with AltStore/SideStore for certificate import and app refreshing. The architecture is modular with separate targets for the main app, SwiftUI UI, tweak loader, signing library, process launcher, and share extension. While the code demonstrates deep iOS internals knowledge and is actively maintained, its heavy reliance on private APIs and dyld internals makes it fragile across iOS versions and limits the reusability of most components outside this specific project.
DexKit is a high-performance C++ library for runtime parsing and querying of Android DEX bytecode, primarily used by Xposed module developers to locate obfuscated classes, methods, and fields. It provides a rich DSL in Kotlin/Java for constructing structural queries based on annotations, opcodes, string usage, field/method references, and more. The core engine parses DEX files from APK archives, builds in-memory indexes, and uses algorithms like Aho-Corasick for substring matching and the Hungarian algorithm for unordered set matching. Communication between the native C++ layer and JVM is handled via FlatBuffers serialization. The library also includes an optional caching layer (`DexKitCacheBridge`) for persisting query results across app restarts. It is distributed as an Android AAR via Maven Central and includes a demo app and unit tests.
ipatool is a cross-platform command-line tool that acts as an unofficial Apple App Store client. It enables searching, purchasing, and downloading iOS/iPadOS/tvOS/watchOS/visionOS/macOS applications and packages directly from Apple's servers. The tool implements Apple's private SAP authentication and signing protocol by emulating Apple's StoreAgent binary in-process using the Unicorn CPU emulator, allowing it to generate kbsync blobs and decrypt macOS packages. It also includes low-level parsers for Apple's proprietary formats (AEA encrypted archives, APFS filesystems, dyld shared caches) to extract assets from macOS restore images. The architecture is modular: a CLI layer (using cobra) dispatches to domain logic in pkg/appstore, which relies on a generic HTTP client (pkg/http), keychain storage (pkg/keychain), and platform abstractions (pkg/util). An MCP (Model Context Protocol) server subcommand exposes the same functionality over stdio. The codebase is heavily tested with unit and integration tests, and CI builds for macOS, Linux, Windows, and iOS. While primarily an application, it contains significant reverse-engineering and protocol-analysis components, giving it a hybrid character.
frida-gum is the core instrumentation engine of the Frida reverse-engineering framework. It is a cross-platform C library that provides dynamic binary instrumentation: function hooking/interception, instruction-level tracing (Stalker), memory access monitoring, and a JavaScript runtime (GumJS) for scripting. The library operates at the assembly level with architecture-specific backends for x86, x86-64, ARM, ARM64, and MIPS, and platform modules for Linux, macOS, Windows, iOS, Android, and QNX. It is not a standalone application but a library consumed by frida-core; it exposes a GObject-based C API plus JavaScript and C++ bindings.
Rivalcfg is a Python 3 library and command-line tool for configuring SteelSeries gaming mice (Rival, Sensei, Prime, Aerox, Kana, Kinzu, etc.) on Linux, macOS, and Windows. It communicates with devices via HID (using hidapi) using reverse-engineered HID report protocols. The system provides a clean device profile dictionary schema for each mouse, a plugin-like handler system for different value types (choice, range, RGB color, button mapping, gradients, etc.), and a CLI that dynamically generates argparse options from the device profiles. It also includes persistent settings storage in JSON, udev rule management for Linux, and test doubles (FakeDevice, FakeMouseSettings) for testing without physical hardware. The project is community-driven, with new devices added frequently through reverse engineering.
pret/pokeruby is a reverse-engineering project that reconstructs the complete source code of Pokémon Ruby and Sapphire (Game Boy Advance) in C and ARM assembly. The build system compiles the entire game into byte-identical .gba ROMs, verified by pinned SHA1 checksums across a matrix of variants: Ruby/Sapphire, revisions 0/1/2, German localization, debug builds, and a modern-toolchain mode. The repository is the actual working source of the game engine, not documentation: it contains the battle system (turn logic, AI, animations via sprite templates and affine transforms), overworld/field state machines (weather, poison, cut, evolving, day care), Pokémon storage and save/load serialization, contest/link multiplayer subsystems, and the m4a sound driver, all written directly against GBA hardware registers and ARM7TDMI constraints. The architecture is a monolithic single-binary ROM rather than a service or library. Entry points are AgbMain() and the CB2_* main-loop callback system; game systems are orchestrated by a 16-slot task scheduler and a sprite/OAM manager. The build is driven by a sophisticated Makefile that feeds custom C++ asset pipelines — gbagfx (PNG↔GBA tile conversion, Huffman compression), preproc (charmap string embedding, INCBIN expansion), scaninc (include/incbin dependency resolution), mid2agb and wav2agb (MIDI/WAV to m4a data), mapjson/jsonproc (map JSON to assembly) — which generate C arrays and assembly that the hand-written sources consume. Data flows are: raw asset → tool → generated C/asm table → compile/link → .gba ROM → SHA1 comparison against the retail cartridge dump. Because this is a decompilation, the code carries inherent artifacts: sub_* function names, NONMATCHING stubs with NAKED asm fallbacks, unused/unreferenced data, and known UB comments. However, the project is professionally maintained with CI, organized headers, careful localization branching, and a clean separation between game code and build tooling. The tools/ directory is the most reusable asset — each utility is standalone and portable to any GBA homebrew or decomp effort — followed by small hardware-abstraction layers like include/gba/macro.h and src/trig.c.
Ghidra Firmware Utilities is a Ghidra plugin extension that provides file system loaders and custom binary loaders for analyzing PC firmware. It supports FMAP, Intel Flash Descriptor, Coreboot CBFS, PCI Option ROMs (legacy x86 and UEFI), UEFI Firmware Volumes with nested FFS files/sections, and Terse Executable (TE) images. The extension also includes a UEFI helper script that automates analysis tasks such as fixing entry point signatures, propagating UEFI global variable types, and locating known GUIDs. The code is well-structured, using factory patterns for parsing variant formats and Ghidra's file system interfaces. It relies on a native C library for EFI/Tiano decompression via JNI.
Radare2 is a modular reverse engineering framework written in C. It provides a comprehensive set of libraries and command-line tools for binary analysis, disassembly, debugging, emulation, and file format parsing. The architecture is plugin-based: every major subsystem (architectures, binary formats, I/O backends, debuggers, filesystems, crypto, scripting languages) is implemented as a plugin registered via a common RLibStruct pattern. The core library (libr/) contains reusable data structures (RBTrees, RBuffer, RStrBuf, RList, etc.), utilities (base64, ASN.1, regex, event system, thread wrappers), and analysis engines (ESIL emulator, search algorithms, type propagation). The framework supports dozens of CPU architectures (x86, ARM, MIPS, RISC-V, etc.) and binary formats (ELF, PE, Mach-O, DEX, etc.), and can be extended via language bindings (JavaScript, Python, Rust, etc.) and a package manager (r2pm). Despite its large codebase and some legacy components, the project is actively maintained with continuous integration, fuzz testing, and a responsive issue tracker.
ctf-tools is a Nix flake that packages and manages CTF/security research tools. It provides a CLI interface (manage-tools) for installing, upgrading, and removing tools from a user's Nix profile. The system isolates each tool in its own derivation, builds from source or fetches prebuilt binaries from a Cachix cache, and handles complex packaging requirements like tools needing writable directories at runtime (BeEF, libc-database) or proprietary software requiring user-provided binaries (IDA). The architecture is modular with separate derivations for each tool, CI/CD for automated building and caching, and thoughtful handling of runtime dependencies through wrapper scripts.
RetDec is a retargetable machine-code decompiler based on LLVM, designed to convert binary executables (supporting ELF, PE, Mach-O, COFF, Intel HEX, and raw machine code) into high-level code (primarily C-like) and perform various analyses. The architecture is modular, consisting of stages: binary loading and format detection, conversion to LLVM IR, optimization and analysis on the IR, lifting to a high-level intermediate representation, and finally generation of readable code or other outputs (like JSON, debug information, etc.). Key entry points include the command-line tools `retdec-decompiler`, `retdec-fileinfo`, and `retdec-unpacker`, as well as a library interface for integration into other tools. The project demonstrates strong software engineering practices with a clear separation of concerns, extensive use of design patterns (such as visitor, factory, and smart pointers), and a focus on reusability. Notable reusable components include a thread-safe smart pointer implementation with weak pointer support and a comprehensive C type system that enables type-safe representation and manipulation of C language constructs. These components are sufficiently isolated to be extracted and used in other projects with minimal modification. Despite its strengths, the repository shows signs of technical drift due to delayed dependency updates and operates under a limited maintenance mode where issue responses may be delayed and only critical fixes are prioritized. However, the core functionality remains robust and well-tested, making it a reliable tool for reverse engineering tasks.
Twikit is an asynchronous Python library that provides a comprehensive, unofficial client for the Twitter (X) API. It allows users to perform a wide range of Twitter operations—such as posting tweets, searching for tweets and users, managing bookmarks and lists, sending direct messages, uploading media, and streaming real-time events—without requiring an official API key. The library achieves this by reverse-engineering Twitter's internal GraphQL and REST v1.1 endpoints, handling authentication via login flows or guest tokens, and implementing sophisticated anti-bot evasion techniques like client-side transaction ID generation (X-Client-Transaction-Id) and UI metrics obfuscation. The architecture separates concerns into GraphQL (gql) and REST (v11) client modules, with data models for tweets, users, communities, and more. It includes optional CAPTCHA solving and cookie persistence for session reuse. The codebase is well-structured, actively maintained, and demonstrates deep reverse-engineering skill, particularly in the `x_client_transaction` module that mimics Twitter's client-side telemetry.
DeepZero is an automated vulnerability research pipeline engine, primarily targeting Windows kernel driver (BYOVD) analysis. It provides a highly concurrent, resumable orchestration framework where pipelines are defined declaratively in YAML. The engine supports stages: ingest, map (parallel analysis), reduce (aggregation), and bulk_map, with built-in fault tolerance, atomic state persistence, and live progress dashboards. It integrates external tools like Ghidra (headless decompilation), Semgrep (static analysis), LIEF (PE parsing), and LLM backends (LiteLLM, Claude Code) for exploitability assessment. The repository includes a full reference pipeline (loldrivers) and multiple language documentation sites. While primarily an application framework, it has strong data research characteristics due to its focus on binary corpus analysis and heuristic/AI assessment.
REPENTOGON is a comprehensive modding framework for the game The Binding of Isaac: Repentance. It extends the game's Lua API with hundreds of new functions, provides low-level hooking and assembly patching capabilities, integrates ImGui for developer tools, and adds features like custom item pools, save syncing, virtual room management, and achievement tracking. The architecture is a hybrid of a C++ DLL that injects into the game process and a set of Lua scripts that run in the game's Lua environment. Key entry points include the DLL main (dllmain.cpp) which initializes hooks and patches, and the Lua registration system (LuaInit.cpp) which exposes new classes and callbacks. The framework relies on reverse-engineered game structures, signature scanning, and runtime code modification to achieve deep integration. External dependencies include the game itself, Lua 5.4, ImGui, and several bundled libraries (glad, rapidxml, rapidjson, mINI). The codebase is large and actively maintained, with a strong focus on modder extensibility and bug fixing.
The mviewer repository is a Rust-based application for viewing and exporting Marmoset .mview scene files. It features a dual-mode interface: launching a GUI (using tao/wry embedded webview) for interactive preview when no arguments are provided, or running in CLI mode for batch conversion when arguments are given. The GUI loads a local HTTP server to serve an embedded, forked Marmoset JavaScript viewer that renders scenes with visual parity to Marmoset Toolbag. The core Rust logic handles loading the proprietary .mview archive format, extracting scene data (meshes, materials, animations, cameras, lights, textures), and exporting to glTF/GLB/OBJ formats. The application demonstrates strong modularity with clear separation between archive parsing, data processing, export pipelines, and GUI integration. While the embedded JavaScript viewer introduces some maintenance considerations due to its forked nature, the Rust components exhibit high reusability and craftsmanship, particularly in handling complex binary formats and data transformations.