jadx is a production-grade Android DEX/APK to Java source decompiler, providing both a command-line tool (jadx-cli) and a feature-rich Swing GUI (jadx-gui). The architecture is a multi-module Gradle project with a plugin system for input formats (DEX, Java class files, Smali, AAB, XAPK), decompilation passes, resource handling, and deobfuscation. The core decompilation pipeline uses a visitor pattern over a custom intermediate representation (IR) with type inference, SSA construction, region-based control flow, finally block extraction, and code generation. The codebase is actively maintained with a large test suite, but exhibits technical drift through deprecated APIs, complex state machines, and some unmaintained code paths. The plugin system and zip reader module are well-isolated and potentially reusable.
mitmproxy2swagger is a CLI tool that automatically converts HTTP traffic captures from mitmproxy or browser HAR exports into OpenAPI 3.0 specifications. It enables reverse-engineering REST APIs by analyzing recorded traffic without manual inspection. The tool uses a two-pass workflow: the first pass identifies API paths and generates a template file with parameter placeholders; after the user edits the template to select endpoints, the second pass produces full endpoint descriptions with inferred request/response schemas. Architecturally, the tool is a single-purpose Python application organized into modular components: input readers (mitmproxy_capture_reader.py for binary flow files, har_capture_reader.py for HAR JSON), a core orchestration module (mitmproxy2swagger.py) that handles argument parsing, format auto-detection, and schema merging, and utility modules (swagger_util.py for OpenAPI schema generation, console_util.py for progress display). The tool supports multiple content types (JSON, msgpack, form-urlencoded) and can optionally include example data and headers in the output. Key entry points are the `mitmproxy2swagger` command with arguments for input file, output path, API prefix, and optional flags. External dependencies include mitmproxy for reading flow files, ruamel.yaml for YAML output, json-stream for streaming HAR parsing, and msgpack for msgpack support. The codebase is well-maintained with CI/CD, tests, Docker support, and pre-commit hooks.
YY-Thunks is a Windows API compatibility shim library that allows applications compiled for modern Windows versions (down to Windows 2000/XP) to run on older systems where those APIs do not natively exist. It achieves this through a sophisticated macro-based thunk framework: each API is declared with `__DEFINE_THUNK` which, at runtime, attempts to resolve the real export via `GetProcAddress` and falls back to a hand-coded emulation if missing. The library covers hundreds of APIs across dozens of system DLLs, including kernel32, bcrypt, user32, shell32, DNS, WinHttp, D3D11, and many more. The fallback implementations often reverse-engineer Windows internals, such as SRWLock/condition variable data structures, HSTRING layout, API-set namespace resolution, and threadpool dispatch. The repository also provides a companion tool (YY.Depends.Analyzer) for analyzing binary dependencies and identifying missing APIs, as well as a PE header patcher (MinimumRequiredVersionHelper) for lowering the reported minimum OS version in executables. The project is delivered as static .obj/.lib files and a NuGet package, integrated into the MSBuild pipeline. It is heavily tested with a custom unit test framework that can force fallback paths via `AwaysNullGuard` guards. While the codebase exhibits high craftsmanship in its emulation patterns, the sheer breadth and reliance on undocumented Windows internals introduce maintenance challenges. Some components (e.g., bcrypt.hpp) are monolithic, and hardcoded offsets or version-specific workarounds require continuous updates as Windows evolves.
elfcat is a zero-dependency Rust CLI tool that transforms ELF binary files into interactive, self-contained HTML visualizations. It parses the full ELF structure—file header, program headers, section headers, segments, sections, notes, and string tables—and generates an HTML page with a hex dump where bytes are color-coded by their structural role (e.g., ident, header fields, segments, sections). The output includes interactive features: hovering highlights the corresponding bytes in the hex dump, clicking fields with cross-references (like e_phoff or sh_offset) jumps to the referenced area and draws SVG arrows, and detailed info tables appear on hover for headers, segments, and sections. The tool is purely client-side; no server is involved, and the HTML report works offline in any modern browser. The codebase is well-structured, using Rust's trait system to abstract over 32-bit and 64-bit ELF formats without duplication, and it depends only on the Rust standard library.
Core Analyzer is a production-grade memory debugging tool that integrates with GDB (as a plugin) and WinDbg (as an extension) to provide deep heap introspection, object reference tracking, and memory corruption detection for core dumps and live processes. It supports multiple heap allocators (glibc ptmalloc, tcmalloc, jemalloc, mimalloc, Windows CRT, Darwin malloc) by parsing their internal metadata structures directly from target memory. The tool offers commands to walk heap blocks, search for pointer references across registers/stack/globals/heap, detect C++ objects via vtables, find shared objects across threads (race condition candidates), and annotate disassembly with object context. The architecture is a plugin system where each allocator registers a `CoreAnalyzerHeapInterface` struct, and the core engine provides segment management, binary-search-accelerated block lookup, and bit-vector-optimized memory scanning. The codebase is heavily coupled to debugger internals (GDB C API, WinDbg COM) and maintains separate source copies for multiple GDB versions (9.2, 12.1, 16.3, 17.1), which increases maintenance burden but ensures compatibility. The project includes a comprehensive test suite using Docker containers across Linux distributions and allocator versions.
A comprehensive, actively maintained collection of IDA Pro plugins, scripts, and tooling authored by Willi Ballenthin (Hex-Rays). The repository spans multiple domains: UI enhancement plugins (oplog, bookmark_hints, colorize_calls, navband_visited, tag_func, hint_calls), analysis utilities (flirt-data-pack, vtloader, global_struct_dissector), a CLI binary inspector (idals), and a modern LLM-integrated reverse engineering agent (ida-codemode) consisting of a sandbox, portable API, AI agent, and evaluation framework. The core idawilli package provides reusable syntax and lexing utilities for IDA's tagged-line output. The codebase is well-engineered with modern Python practices: Pydantic models, type hints, uv workspace management, Rich CLI interfaces, and comprehensive pytest suites. While primarily an application for IDA Pro enhancement, it also includes data/research elements in the form of LLM benchmarking evaluations (c2_extraction) and systematic test data. The sandbox isolation pattern, evaluator framework, and tagged-line parsing utilities are especially clean and potentially reusable outside this repository.
SpotiFLAC is a cross-platform desktop application (built with Wails v2) that enables users to download high-quality FLAC audio from streaming services (Tidal, Qobuz, Amazon Music, Deezer) by leveraging Spotify metadata. The user inputs a Spotify track, album, playlist, or artist URL; the backend fetches metadata via Spotify's internal GraphQL API using reverse-engineered TOTP authentication, resolves streaming URLs through Songlink/Songstats, then downloads from the chosen service. The app includes a comprehensive suite of audio processing tools: audio analysis (spectrogram, FFT), BPM/key detection (Essentia.js), format conversion, resampling, ReplayGain tagging, lyrics management (LRCLIB), metadata enrichment, and file management. The frontend is built with React 19, TypeScript, Tailwind CSS, and shadcn/ui components, communicating with the Go backend via Wails bindings. The backend handles persistent storage (BoltDB for queue, history, caches), FFmpeg integration, and community API sessions for Tidal/Qobuz/Amazon. The architecture is a monolith desktop app with a clear separation between frontend UI and backend services, but the backend modules are tightly coupled to the app's specific workflow. The app is open-source (MIT) with a Patreon funding model and has a large internationalization footprint (11 languages). Key entry points include the SearchBar for URL input, the download queue for batch processing, and various tool pages (Audio Analysis, Converter, Resampler, ReplayGain, File Manager, Lyrics Manager). External dependencies include Spotify's undocumented API, Tidal/Qobuz/Amazon community APIs, Songlink, LRCLIB, MusicBrainz, FFmpeg, and Essentia.js. The codebase demonstrates significant reverse-engineering effort but carries maintenance risks due to reliance on fragile third-party APIs and hardcoded secrets.
Psst is a native desktop Spotify client written in Rust, designed as a fast, lightweight alternative to the official Electron-based client. It implements the proprietary Spotify session protocol (Shannon cipher, Diffie-Hellman key exchange, Mercury messaging) to stream audio directly, bypassing the Web API for playback. The application is structured as a workspace with three crates: `psst-core` (session management, audio pipeline, caching, Last.fm scrobbling), `psst-gui` (Druid-based GUI with controllers, widgets, and Web API integration), and `psst-cli` (simple command-line player). The GUI features a full browsing experience (home, search, library, artist/album/playlist/show details, lyrics, recommendations, credits) with async data loading via a Promise pattern and remote image caching. The audio pipeline includes decryption, decoding (symphonia), resampling, normalization, and output via cpal or cubeb. Authentication uses OAuth2 with PKCE and supports user-provided Spotify Client IDs. The project is actively developed with rolling releases and cross-platform builds (Windows, macOS, Linux).
UndertaleModTool is a comprehensive, open-source modding and reverse-engineering tool for GameMaker games, specifically Undertale and Deltarune. It provides a full suite of functionality: reading/writing GameMaker data files (.win, .unx, etc.) with byte-for-byte accuracy, decompiling GML VM bytecode back into human-readable GameMaker Language (GML), compiling modified GML back into bytecode, and editing all game assets (sprites, sounds, rooms, code, textures, shaders, fonts, etc.) through a Windows-only WPF GUI or a cross-platform CLI. The tool also includes a project system for exporting/importing assets as JSON and PNG, a built-in C# scripting engine for automation, and game-specific definitions that tailor decompilation and modding to Undertale and Deltarune. The architecture is a classic library-plus-front-end pattern: the core library `UndertaleModLib` handles all binary serialization, decompilation, compilation, and project management. The GUI application `UndertaleModTool` and CLI `UndertaleModCli` are thin layers that use this library. The library itself is heavily version-aware, supporting multiple GameMaker versions (GMS1, GMS2, 2022-2024) with hundreds of conditional checks. The decompiler integrates with the external `Underanalyzer` submodule for advanced GML compilation and decompilation. A large collection of built-in C# scripts covers common modding tasks (resource export/import, technical utilities, game-specific modifications). While primarily an application, the repository also serves as a living document of GameMaker's internal data format—a significant reverse-engineering effort. The code is rich with comments explaining undocumented structures, version differences, and workarounds for engine bugs. This hybrid nature makes it both a practical modding tool and a valuable research resource for understanding GameMaker internals.
IFL (Interactive Functions List) is an IDA Pro plugin that provides an enhanced interface for browsing, analyzing, and navigating functions within binary files. The plugin creates a dockable window displaying a comprehensive table of all functions with their attributes (addresses, names, types, arguments, reference counts) and features tabbed views showing incoming/outgoing references for selected functions. Key capabilities include real-time filtering, double-click navigation to addresses, in-place function renaming, and import/export of function names in CSV, TAG, and .imports.txt formats (compatible with tools like PE-sieve). The architecture follows a model-view pattern using Qt (PyQt5/PySide6 abstraction) integrated with IDA's plugin framework, featuring automatic theme adaptation to match IDA's UI and sophisticated reference tracking logic.
LibrePods is a cross-platform application suite whose verified purpose is to liberate Apple AirPods from the Apple ecosystem, providing full accessory management on non-Apple hardware. The Android app (Kotlin/Jetpack Compose) offers battery monitoring via BLE manufacturer-data parsing, noise-control mode switching, ear detection, head-gesture recognition, hearing aid adjustments, custom EQ, device takeover, home-screen widgets, Quick Settings tiles, and iOS-style popup overlays. The Linux companion (Qt6/QML) delivers the same control surface through a system tray app backed by BlueZ and PulseAudio, with a Rust rewrite in progress per the ci-linux-rust.yml workflow.
This repository implements a reverse-engineered proxy that converts Google Gemini's web interface into an OpenAI-compatible API. The server provides endpoints /v1/chat/completions, /v1/models, /v1/responses, and Google-native /v1beta models, supporting streaming (SSE), function calling, multimodal input (images), and multiple Gemini models with configurable thinking depth. It is architecturally a threaded HTTP server built on Python's standard library, with an optional httpx dependency for true streaming. The code is modular across packages (config, gemini protocol, models, server, tools, multimodal) and includes a separate monolithic entry point for simplicity. It demonstrates robust reverse-engineering of Gemini's StreamGenerate protocol, proper handling of authentication via cookies and SAPISID hashing, and thorough conversion between OpenAI and Gemini message formats. Testing coverage exists for payload building, message parsing, streaming endpoints, and multimodal uploads.
Auto-Redbook-Skills is a CLI tool for creating and publishing Xiaohongshu (Little Red Book) social media notes. It takes Markdown content with YAML front matter, renders it into a cover image and multiple card images using Playwright (headless browser), and optionally publishes the note to Xiaohongshu via a built-in, reverse-engineered HTTP signature client. The tool supports 8 visual themes (e.g., sketch, neo-brutalism, botanical) and 4 pagination modes (manual separator, auto-fit, auto-split, dynamic height). The publishing pipeline is entirely self-contained within the repository, using a vendor module that implements the Xiaohongshu creator platform's authentication, signing, and upload protocols without external API services. The project is primarily a content creation automation tool, not a data research project, though it does involve some data transformation (Markdown to images).
WinObjEx64 is a native Windows GUI application that provides deep introspection into the Windows Object Manager namespace and kernel internals. It allows users to browse, view properties, and edit security descriptors for a wide range of NT object types (processes, threads, tokens, sections, ALPC ports, drivers, etc.). The tool also includes 'Extras' dialogs for inspecting system call tables (SSDT), kernel callbacks, unloaded drivers, private namespaces, and more. It relies on a kernel driver (or alternative providers) for reading kernel memory and supports a plugin system for extensibility. Architecturally, the application is a monolith with a plugin subsystem. It uses a custom tree-list control, a lightweight runtime library (minirtl), and a driver provider abstraction layer that supports multiple backends (Microsoft's kldbgdrv, WinIO, custom driver). The codebase is heavily version-aware, with many structures and patterns hardcoded per Windows build (from 7 to 11 25H2). The plugin ABI is well-defined and versioned, allowing third-party plugins to integrate seamlessly. The repository is actively maintained, with recent commits and zero open issues. However, it exhibits medium technical drift due to reliance on undocumented kernel structures, hardcoded byte patterns, and some deprecated Win32 APIs. The code is of high craftsmanship for its niche, with several reusable components that could be extracted for other Windows internals projects.
NootedRed is a macOS kernel extension (Lilu plugin) that enables AMD integrated GPUs (Raven, Picasso, Renoir, Green Sardine) on macOS by patching Apple's proprietary AMD GPU drivers. It operates through binary patching, runtime vtable manipulation, and firmware injection to spoof GPU identity, fix display/audio/backlight issues, and provide hardware acceleration. The codebase is a intricate reverse-engineering effort, with hardcoded version-specific offsets and byte patterns, but it is structured into modular components such as display controllers, hardware library patches, and a reusable patching toolkit (PenguinWizardry). While the project is highly specialized and fragile due to its reliance on exact binary layouts, it demonstrates advanced kernel programming and reverse engineering skills. The repository is actively maintained for current macOS versions and includes a CI pipeline with static analysis.
This repository is a multi-platform decompilation of **Castlevania: Symphony of the Night**, targeting the original PlayStation (PSX), PSP, Sega Saturn, and a modern PC port. It reconstructs the game's source code from original binaries to produce byte-identical builds, while also providing a full reimplementation with a cross-platform port. The codebase is organized into per-stage, per-boss, and per-weapon overlay modules, each defining entity update tables, initialization data, and asset references. A central entity system with step-based state machines drives all game objects, and a shared `g_api` function table enables cross-overlay communication. The project includes extensive tooling for asset extraction/rebuilding (Go), automated code linting and transformation (Rust), binary diffing (Python), and duplicate function detection (Rust). While the decompilation is largely complete for the US PSX version, many PSP and Saturn functions remain as `INCLUDE_ASM` stubs, and the PC port contains several `UnsupportedEntity` placeholders. The architecture demonstrates high craftsmanship in its overlay system, entity dispatch patterns, and modular toolchain, though platform-specific `#ifdef` branching and code duplication across overlays introduce maintenance complexity.
HyperCeiler is an Xposed/LSPosed module for Xiaomi HyperOS devices that hooks into system applications (SystemUI, Launcher, Settings, Camera, etc.) to unlock hidden features, disable ads/telemetry, and customize UI elements. The project is a multi-module Android application with a settings UI for toggling hundreds of individual hook rules. It uses a dual-layer architecture: Java/Kotlin hooks via EzHookTool and DexKit for dynamic method interception, and native C++ code for low-level inline patching of ARM64 binaries in system libraries. The codebase includes extensive mutation testing and regression harnesses that compile production source against frozen ROM snapshots and verify behavior via QEMU emulation. While highly specialized for Xiaomi's proprietary stack, the project demonstrates advanced reverse engineering skills and a robust testing methodology.
FareBot is a Kotlin Multiplatform (KMP) application designed to read, parse, and analyze contactless transit smart cards (NFC/RFID). It targets Android, iOS, Desktop (JVM), and Web (Wasm), utilizing Jetpack Compose Multiplatform for the UI layer. The core functionality involves interacting with NFC hardware (Android NFC, PC/SC, CoreNFC) or external devices (Flipper Zero, PN533 USB readers) to extract raw card data. This data is then processed through a layered architecture of protocol readers (MIFARE Classic, DESFire, FeliCa, ISO7816) and transit-specific factories (EN1545, Calypso, proprietary formats) to display balances, trip history, and card identity. The architecture relies heavily on the Factory pattern to support hundreds of global transit systems without modifying core logic. It uses SQLDelight for local persistence of card dumps and keys, and Metro for dependency injection. The codebase demonstrates significant craftsmanship in reverse-engineering proprietary transit protocols, handling complex binary formats, bit-level parsing, and currency normalization across different regions. Hardware abstraction layers (`CardTransceiver`, `FlipperTransport`) allow the same core logic to run across diverse platforms and devices. While the application is actively maintained (last commit 2026-03-22), it faces technical drift risks due to its reliance on experimental Web APIs (WebUSB/WebBluetooth), cutting-edge Gradle versions (9.3.1), and the inherent fragility of reverse-engineered transit protocols. The project is a robust example of cross-platform hardware interaction and data parsing, suitable for engineers interested in NFC protocols, KMP architecture, and hardware abstraction.
Unicorn Engine is a lightweight, multi-architecture CPU emulation framework derived from QEMU. It provides a pure C API with bindings for Python, Go, Java, Rust, Ruby, .NET, Haskell, Pascal, Zig, and VB6. The engine supports ARM, ARM64, M68K, MIPS, PowerPC, RISC-V, S390X, SPARC, TriCore, and x86 (16/32/64-bit). It is used primarily for security research, reverse engineering, fuzzing, and dynamic analysis of binary code. The architecture is a library with a central C API that exposes memory mapping, register access, hooks (code, block, memory, interrupt, instruction, syscall, TLB), and context save/restore. The core emulation logic is based on QEMU's TCG (Tiny Code Generator) for dynamic binary translation, with a custom glib compatibility layer to eliminate external dependencies. The repository includes extensive regression tests, fuzz targets, and sample programs for each architecture and binding. While the engine is actively maintained and widely used, it carries technical debt from its QEMU fork (based on QEMU 5.0.1) and auto-generated binding constants that may drift from the C API.
FLARE-VM is a collection of PowerShell and Python scripts for automating the setup of a Windows-based reverse engineering virtual machine. The core installer (`install.ps1`) uses Chocolatey and Boxstarter to deploy a curated set of malware analysis tools, configure environment variables, registry settings, and taskbar layout. It provides both a GUI and CLI mode for package selection. The repository also includes a set of VirtualBox helper scripts (`virtualbox/`) for building, exporting, and cleaning VM snapshots, as well as monitoring network adapter status. These scripts are well-structured and can be reused independently for VirtualBox automation. The project is actively maintained by Mandiant (Google) and serves the malware analysis community.