thehardwarestore.ai

angr is a platform-agnostic binary analysis framework developed by the Shellphish research group at UC Santa Barbara. It provides a comprehensive suite of program analysis capabilities including disassembly and IR lifting (via VEX), control-flow graph construction (CFG fast/emulated), symbolic execution, data-dependency analysis, value-set analysis, and a full decompiler pipeline that produces C-like pseudocode. The framework supports multiple architectures (x86, ARM, MIPS, PowerPC, etc.) and operating systems (Linux, Windows, CGC, FreeBSD, Java VM, UEFI) through a modular SimOS layer and extensive library procedure models (libc, POSIX, Linux kernel, Windows API, C++ stdlib, Java/JNI). The architecture is built around a mixin-based engine composition pattern, where execution engines (VEX, AIL, Soot, Pcode, unicorn) are combined into an UberEngine. Analyses are registered via an AnalysesHub and instantiated as project.analyses.Name. A knowledge-base plugin system stores functions, variables, types, cross-references, and other analysis results. The decompiler is particularly sophisticated, with dozens of optimization passes, peephole optimizations, region simplifiers, and multiple structuring algorithms (SAILR, Phoenix, Dream). Native Rust components (clarirs-core, clarirs-vsa, clarirs-z3) provide high-performance symbolic reasoning and solver integration. Key entry points include angr.Project for loading binaries, project.factory for block/engine creation, project.analyses for running analyses, and simulation_manager for symbolic execution. The framework also includes an MCP server for LLM integration, a distributed analysis framework, and database persistence via AngrDB. External dependencies include claripy (solver abstraction), cle (binary loader), pyvex (VEX IR), capstone/keystone (disassembly/assembly), unicorn (concrete execution), and Z3 (SMT solver).

GEF (GDB Enhanced Features) is a production-grade GDB plugin for exploit development, reverse engineering, and binary analysis. It is a single Python script (gef.py) that loads into GDB (>=10.0) and provides over 90 commands covering memory inspection, heap analysis, security mitigation checks (checksec), pattern generation, format string detection, and remote debugging. The architecture is monolithic but well-organized, with a clear separation of concerns via class hierarchies for architectures, memory regions, heap structures, and command registration. The test suite is extensive, using a Docker-based CI matrix that runs on multiple architectures (x86, ARM, AARCH64, etc.) and validates behaviour through RPyC-driven remote GDB sessions. While primarily an application, it also serves as a research tool for heap allocator internals and glibc version-specific behaviour, blending practical utility with deep system understanding.

Capstone is a multi-architecture disassembly engine written in C, derived from LLVM's MC disassembler. It supports over 20 architectures including x86, ARM, AArch64, MIPS, PowerPC, RISC-V, and more. The core library provides a stable C API (cs_open, cs_disasm, cs_option, etc.) and includes per-architecture backends with mapping, disassembler, and instruction printer modules. The architecture is modular: each architecture has a Module.c that registers callbacks into a common cs_struct. The primary data flow is: user provides raw bytes and arch/mode, the engine selects the appropriate disassembler, decodes instructions into MCInst, then prints via instruction printer, optionally filling cs_detail with operand/register/group information. The repository also includes a CLI tool (cstool), extensive test suites (MC regression tests, cstest YAML-based detail tests), fuzzing harnesses, and an automated LLVM sync pipeline (auto-sync) that translates LLVM C++ disassembler code to C using tree-sitter patches. The codebase is well-structured with clean abstractions for operand models (MCInst/MCOperand), string output (SStream), and architecture-specific mapping. The auto-sync tooling is a notable engineering achievement, enabling systematic translation of LLVM backend code to C. Language bindings for Python, Java, OCaml, and others demonstrate the library's embeddability. The test infrastructure is comprehensive, covering both basic disassembly and detailed operand/register analysis. External dependencies are minimal for the core library (pure C), but the auto-sync tooling depends on Python, tree-sitter, clang-format, and lit. Overall, Capstone is a mature, actively maintained disassembly framework with high craftsmanship and reusable components.

The Witchcraft Compiler Collection (WCC) is a binary analysis and modification toolkit focused on ELF executables. It provides three primary tools: wld converts executables to shared libraries, wcc 'unlinks' binaries into relocatable objects, and wsh offers an interactive Lua-scriptable shell for runtime binary inspection and modification. The architecture is modular with shared utilities, leveraging BFD for binary format abstraction, Capstone for disassembly, and Lua/JIT for extensibility. Key capabilities include section/header manipulation, symbol table management, relocation processing, and cross-architecture analysis via Qemu user-mode emulation. WCC demonstrates strong craftsmanship in its Lua-C API extension patterns, sophisticated ELF handling, and modular tool design. The wsh tool's Lua integration exposes binary analysis functions (memory access, symbol lookup, section iteration) through a clean C extension interface. The wld tool implements robust ELF section/header manipulation and relocation processing with careful attention to binary format details. The disassembler wrapper in disasm.c provides multi-architecture support while maintaining integration with WCC's data structures. These components show non-obvious skill in binary manipulation and language embedding. The project shows active maintenance with commits up to 2026 and updated copyright notices. Technical drift is low due to recent updates and compatibility with modern dependencies (Lua 5.3, Capstone). While focused on Linux/ELF and primarily x86_64, the code maintains portability through conditional compilation and abstracted binary handling. The build system uses Makefiles with git submodules for dependency management, and the MIT-licensed codebase includes comprehensive documentation and demonstration materials for security research use cases.

Ghidra is a software reverse engineering (SRE) framework developed by the NSA. It provides a full-featured desktop application for analyzing compiled binaries, supporting disassembly, decompilation, debugging, and scripting across multiple architectures (x86, ARM, MIPS, PowerPC, RISC-V, etc.). The system is modular, built on a plugin architecture with services, actions, and extension points discovered at runtime. Key entry points include the GUI launcher (ghidra.Ghidra) and headless mode (ghidra.GhidraRun), as well as a Gradle build system for extension development. The debugger integrates with GDB, LLDB, dbgeng, drgn, and x64dbg via a Trace RMI protocol, and includes a p-code emulator and JIT compiler. Ghidra also offers binary similarity search (BSim), version tracking, and a rich API for scripting in Java, Python, and Jython. External dependencies include Java 17, Gradle, and optional third-party tools for PDB and DWARF processing.

CoBRA is a C++ library and CLI tool for simplifying mixed Boolean-arithmetic (MBA) expressions, commonly used in software obfuscation. It ingests expressions combining arithmetic (+, -, *) with bitwise (&, |, ^, ~) and shift operators and outputs a simplified equivalent form. The core engine uses a worklist orchestrator that coordinates 36+ passes, including signature-based transforms (CoB butterfly, ANF recovery), semilinear normalization with bit partitioning, decomposition (product, polynomial, template cores), ghost residual solving, and pattern matching. An optional Z3 verifier proves full-width equivalence. The tool can be used as a standalone CLI (`cobra-cli`), as an LLVM pass for automatic deobfuscation during compilation, or as a library (`cobra::Simplify()`). The codebase is well-structured with extensive test coverage (1195+ tests) and benchmark datasets from multiple research projects. While the core is tightly coupled internally, several generic utilities (Result type, profiling stubs, math helpers) are reusable independently.

x64dbg is an open-source binary debugger for Windows targeting malware analysis and reverse engineering. The architecture is a three-layer system: a GUI layer (Qt-based Windows application), a bridge layer (C API for communication), and a debugger core layer (TitanEngine/GleeBug/StaticEngine backends). The debugger supports x86 and x64 processes with comprehensive features including conditional breakpoints, memory analysis, symbol handling, and an extensive plugin SDK. The codebase demonstrates strong engineering in several areas. The analysis engine implements multiple analysis passes (linear, recursive, control flow, xrefs) with a clean pass-based architecture. The command system uses a flexible registration pattern with consistent error handling. The bridge layer provides a well-defined C API surface for plugins with careful attention to thread safety and marshaling between GUI and debugger threads. Recent development shows active work on Linux support (ElfBug debugger), cross-platform tools (hex viewer, minidump analyzer, remote table), and a comprehensive test framework with headless testing infrastructure. The test system uses convention-based test discovery with script-driven scenarios and plugin-based assertions. Technical debt includes some outdated documentation (docs reference Python 2.7 for CHM generation), mixed use of Qt versions (5.12+ required but some paths reference older configurations), and the inherent complexity of maintaining both Windows debugger and cross-platform analysis tools in one repository. The dependency on precompiled libraries (TitanEngine, Zydis, XEDParse) creates build complexity but is managed through CMake.

ImHex is a cross-platform hex editor and binary analysis tool designed for reverse engineers, programmers, and digital forensics. It provides a rich GUI built on Dear ImGui and GLFW, with a modular plugin architecture that allows extending functionality through dynamically loaded plugins. The core library (libimhex) implements a provider abstraction for various data sources (files, disks, process memory, GDB, SSH, UDP, etc.), an event-driven communication system, a content registry for registering views, tools, settings, and data inspectors, and a pattern language engine for declarative binary parsing. The application includes built-in plugins for hex editing, data inspection, disassembly (Capstone), diffing, YARA rule matching, hashing, decompression, visualizations (3D, plots, images), scripting (C and .NET), and a Model Context Protocol (MCP) server for AI-assisted analysis. It supports undo/redo, bookmarks, patches, projects, themes, layouts, achievements, tutorials, and a command palette. The codebase is well-structured with clear separation between core library, plugins, and platform-specific code, though some components are tightly coupled to ImGui internals and the custom pattern language.

This repository implements an MCP (Model Context Protocol) server that exposes IDA Pro's disassembler, decompiler, debugger, and type system as a set of tools and resources consumable by LLM clients (Claude, Codex, Cursor, etc.). It operates in two distinct modes: an IDA GUI plugin that starts an MCP server on a configurable port, and a headless supervisor (`idalib-mcp`) that manages persistent worker processes for multiple databases. The architecture is a hybrid of a plugin and a standalone server, built on a custom, vendored MCP server implementation (`zeromcp`) with HTTP/SSE/stdio transports. The core API surface is defined via a decorator-based registration system (`@tool`, `@resource`, `@unsafe`, `@ext`) in `rpc.py`, which also handles output truncation middleware and JSON schema generation from TypedDicts. All IDA SDK calls are marshalled onto the main thread through a robust execution pipeline (`sync.py`) that manages timeouts, cancellation, and batch mode. The headless mode uses a supervisor/worker pattern (`idalib_supervisor.py`, `idalib_server.py`, `worker_lifecycle.py`) with health probing, idle TTL, and session management. A comprehensive compatibility layer (`compat.py`) provides version-gated shims for IDA 8.4 through 9.3. Key features include decompilation, disassembly, cross-references, memory read/write, patching, type declaration/inference, debugger control (breakpoints, step, registers), signature generation, and binary survey. Tool calls are always-on traced into the IDB as gzipped JSONL batches. The project includes an extensive test suite with a custom test framework, MCP spec regression tests, and CI running against multiple IDA versions in Docker containers. The codebase is actively maintained and demonstrates strong engineering practices, but the plugin mode is explicitly deprecated in favor of the official Hex-Rays IDA MCP Server. The heavy reliance on IDA's internal APIs and the vendored MCP server implementation represent ongoing maintenance risks. The code is well-structured with several genuinely reusable components, though some modules (e.g., `api_analysis.py`) are monolithic.

Radare2 is a modular reverse engineering framework written in C. It provides a comprehensive set of libraries and command-line tools for binary analysis, disassembly, debugging, emulation, and file format parsing. The architecture is plugin-based: every major subsystem (architectures, binary formats, I/O backends, debuggers, filesystems, crypto, scripting languages) is implemented as a plugin registered via a common RLibStruct pattern. The core library (libr/) contains reusable data structures (RBTrees, RBuffer, RStrBuf, RList, etc.), utilities (base64, ASN.1, regex, event system, thread wrappers), and analysis engines (ESIL emulator, search algorithms, type propagation). The framework supports dozens of CPU architectures (x86, ARM, MIPS, RISC-V, etc.) and binary formats (ELF, PE, Mach-O, DEX, etc.), and can be extended via language bindings (JavaScript, Python, Rust, etc.) and a package manager (r2pm). Despite its large codebase and some legacy components, the project is actively maintained with continuous integration, fuzz testing, and a responsive issue tracker.

ctf-tools is a Nix flake that packages and manages CTF/security research tools. It provides a CLI interface (manage-tools) for installing, upgrading, and removing tools from a user's Nix profile. The system isolates each tool in its own derivation, builds from source or fetches prebuilt binaries from a Cachix cache, and handles complex packaging requirements like tools needing writable directories at runtime (BeEF, libc-database) or proprietary software requiring user-provided binaries (IDA). The architecture is modular with separate derivations for each tool, CI/CD for automated building and caching, and thoughtful handling of runtime dependencies through wrapper scripts.

RetDec is a retargetable machine-code decompiler based on LLVM, designed to convert binary executables (supporting ELF, PE, Mach-O, COFF, Intel HEX, and raw machine code) into high-level code (primarily C-like) and perform various analyses. The architecture is modular, consisting of stages: binary loading and format detection, conversion to LLVM IR, optimization and analysis on the IR, lifting to a high-level intermediate representation, and finally generation of readable code or other outputs (like JSON, debug information, etc.). Key entry points include the command-line tools `retdec-decompiler`, `retdec-fileinfo`, and `retdec-unpacker`, as well as a library interface for integration into other tools. The project demonstrates strong software engineering practices with a clear separation of concerns, extensive use of design patterns (such as visitor, factory, and smart pointers), and a focus on reusability. Notable reusable components include a thread-safe smart pointer implementation with weak pointer support and a comprehensive C type system that enables type-safe representation and manipulation of C language constructs. These components are sufficiently isolated to be extracted and used in other projects with minimal modification. Despite its strengths, the repository shows signs of technical drift due to delayed dependency updates and operates under a limited maintenance mode where issue responses may be delayed and only critical fixes are prioritized. However, the core functionality remains robust and well-tested, making it a reliable tool for reverse engineering tasks.

DeepZero is an automated vulnerability research pipeline engine, primarily targeting Windows kernel driver (BYOVD) analysis. It provides a highly concurrent, resumable orchestration framework where pipelines are defined declaratively in YAML. The engine supports stages: ingest, map (parallel analysis), reduce (aggregation), and bulk_map, with built-in fault tolerance, atomic state persistence, and live progress dashboards. It integrates external tools like Ghidra (headless decompilation), Semgrep (static analysis), LIEF (PE parsing), and LLM backends (LiteLLM, Claude Code) for exploitability assessment. The repository includes a full reference pipeline (loldrivers) and multiple language documentation sites. While primarily an application framework, it has strong data research characteristics due to its focus on binary corpus analysis and heuristic/AI assessment.

A comprehensive, actively maintained collection of IDA Pro plugins, scripts, and tooling authored by Willi Ballenthin (Hex-Rays). The repository spans multiple domains: UI enhancement plugins (oplog, bookmark_hints, colorize_calls, navband_visited, tag_func, hint_calls), analysis utilities (flirt-data-pack, vtloader, global_struct_dissector), a CLI binary inspector (idals), and a modern LLM-integrated reverse engineering agent (ida-codemode) consisting of a sandbox, portable API, AI agent, and evaluation framework. The core idawilli package provides reusable syntax and lexing utilities for IDA's tagged-line output. The codebase is well-engineered with modern Python practices: Pydantic models, type hints, uv workspace management, Rich CLI interfaces, and comprehensive pytest suites. While primarily an application for IDA Pro enhancement, it also includes data/research elements in the form of LLM benchmarking evaluations (c2_extraction) and systematic test data. The sandbox isolation pattern, evaluator framework, and tagged-line parsing utilities are especially clean and potentially reusable outside this repository.

Speakeasy is a Windows malware emulation framework developed by Mandiant (FireEye). It executes Windows PE executables, DLLs, drivers, and shellcode in a fully emulated Windows environment, intercepting API calls via a large set of stub handlers that model kernel32, ntdll, ws2_32, user32, ntoskrnl, and many other DLLs. The emulation is powered by Unicorn (CPU emulation) and Capstone (disassembly). It provides both a CLI tool (`speakeasy`) and a Python library (`Speakeasy` class) for programmatic use. Key features include: user-mode and kernel-mode emulation, GDB remote debugging support, configurable file system, registry, network, and process models, SEH handling, API hammering detection, and structured JSON reports with profiling events, memory captures, and artifact deduplication. The architecture is a monolithic Python package with a core emulator class, platform-specific emulators (Win32Emulator, WinKernelEmulator), and a large set of API handler modules organized by DLL. Dependencies include unicorn, capstone, pefile, pydantic, rich, and pyelftools. The project is primarily used for automated malware analysis and reverse engineering.

ROPgadget is a Python CLI security tool that statically scans executable binaries for ROP, JOP, and SYS gadgets. It discovers architecture-specific byte patterns (x86/x64, ARM/ARM64, MIPS, PowerPC, SPARC, RISC-V), disassembles candidate regions with Capstone, and outputs address/instruction listings. It supports ELF, PE, Mach-O, raw, and universal/fat binaries, and offers filtering by mnemonic, regex, bad bytes, address ranges, and call-preceded gadgets. For x86/x64 ELF targets it can also generate a Python exploit script that chains gadgets into a ROP payload.

DWARF Explorer is a cross-platform GUI utility for visualizing DWARF debugging information in executable files. Built on PyQt6, pyelftools, and filebytes, it allows users to open ELF, Mach-O, PE, WASM, and ar files to browse their DWARF debug information tree. The application provides views for DIEs (Debugging Information Entries), attributes, references, and includes specialized tools for analyzing locals at addresses, function maps, data sections, frame information, and unwind data. The architecture follows a modular design with clear separation between the GUI layer (PyQt6-based interface in __main__.py and ui.py) and the DWARF analysis logic. Core functionality includes parsing various binary formats via formats.py, building and navigating the DIE tree through tree.py and die.py, and performing specialized analyses using utilities in dwarfutil.py, locs.py, and other modules. The application supports features like following DIE references, searching by conditions, highlighting DIEs, and exporting C skeletons. Key strengths include robust error handling with crash reporting, support for multiple binary formats and DWARF versions (including experimental v1 support), and thoughtful UI design with keyboard navigation, bookmarking, and detailed views. The code demonstrates good practices in separating concerns, with reusable components like the Mach-O unwind parser that could be extracted for use in other projects.

This repository contains otx, a Mach-O disassembler for macOS that provides both a graphical user interface and a command-line tool. It specializes in disassembling Mach-O executables (supporting x86_64 and arm64 architectures) and enhancing the output with semantic information such as Objective-C method names, demangled C++ and Swift symbols, and annotations for literal pools and data references. The application also detects and repairs obfuscated NOP sequences (an anti-disassembly technique) for x86_64 binaries. The architecture features a modular processor hierarchy where a base `ExeProcessor` class is extended for specific architectures (e.g., `X8664Processor`, `ARM64Processor`), with functionality added via Objective-C categories (such as `Searchers64` for binary search and `List64Utils` for linked list operations). The GUI is built with Cocoa/AppKit and follows an MVC pattern, with `AppController` managing the user interface and workflow. The CLI shares the same core processing logic but uses a separate controller for argument parsing. Preferences are managed via a synchronized system of user default keys between Objective-C and Swift components. Key reusable components include a custom endianness swap utility (`MachOSwap.h`) that replaces deprecated Apple functions, a smooth view animation helper (`SmoothViewAnimation`) for polished UI transitions, a drag-and-drop file handler (`DropBox`), and utility categories for linked list operations and binary search. The project demonstrates solid engineering practices but shows signs of technical drift through conditional compilation for obsolete macOS versions (Tiger, Leopard, Snow Leopard), though modern builds target macOS 12+.

vivisect is a comprehensive reverse engineering framework providing static analysis, dynamic debugging, emulation, and symbolic execution capabilities. It consists of several core packages: `envi` (multi-architecture disassemblers, emulators, memory abstraction), `vivisect` (workspace-based static analysis with analysis passes, import emulation, symbolic execution engine), `vtrace` (cross-platform debugging with ptrace/GDB stub support), `vdb` (debugger CLI and Qt GUI), `vstruct` (declarative binary structure parsing for formats like PE, ELF, Mach-O, minidump), `visgraph` (graph layout for control flow and call graphs), and `cobra` (custom RPC framework for remote collaboration). The system can parse and analyze PE, ELF, Mach-O, and other formats; perform function detection, control-flow recovery, switch-case identification, pointer analysis, and symbolic path exploration. It includes a full-featured debugger with breakpoints, watchpoints, and process control, and offers a Qt GUI for interactive reverse engineering. The architecture is modular but tightly integrated; many components are reusable in isolation. The codebase shows signs of long-term evolution with some Python 2/3 drift, deprecated API usage, and incomplete migration to PyQt6, but remains actively maintained with recent commits and a substantial test suite.