ILSpy is a production-grade .NET assembly browser and decompiler, serving as the open-source successor to SharpDevelop's decompiler. It is architected as a hybrid monolith with a clear plugin system (MEF), separating the core decompilation engine (`ICSharpCode.Decompiler`) from the cross-platform GUI (`ILSpy`, built on Avalonia) and the command-line interface (`ICSharpCode.ILSpyCmd`). The core engine implements a full .NET type system, an intermediate language (IL) with a comprehensive transform pipeline, and a C#/VB syntax tree generator, enabling it to faithfully reconstruct high-level source code from compiled bytecode. The primary data flow begins with loading binary assemblies (PE, ELF, bundles) through a registry of file loaders. The `ILReader` parses bytecode into IL instructions, which undergo a series of transforms (control flow analysis, pattern matching, type inference) before being built into a C# AST. This AST is then processed by output visitors to produce formatted source code, debug information, or project files. The GUI provides a dockable workspace, syntax-highlighted editor, metadata table viewers, analyzers for code navigation (find usages, overrides), and a search engine. The codebase exhibits high craftsmanship, particularly in its utility libraries and AST pattern matching. Self-contained, extractable components include a generic Union-Find data structure (`UnionFind.cs`), an immutable interval-based map for 64-bit keys (`LongSet.cs`/`LongDict.cs`), a declarative AST pattern matching DSL (`Pattern.cs`), and thread-safe lazy initialization utilities (`LazyInit.cs`). These components solve non-trivial problems (efficient range queries, backtracking tree matching) and are isolated from the rest of the codebase. The project is actively maintained, with recent commits, extensive CI/CD pipelines (CodeQL, Scorecard, Dependabot), and a large test suite covering decompilation correctness and UI behavior. Technical drift is low; the codebase targets modern .NET versions and has successfully migrated from WPF to Avalonia. While the sheer size introduces complexity, the architecture is sound, making it a strong reference for decompiler design, .NET internals, and cross-platform desktop application architecture.
angr is a platform-agnostic binary analysis framework developed by the Shellphish research group at UC Santa Barbara. It provides a comprehensive suite of program analysis capabilities including disassembly and IR lifting (via VEX), control-flow graph construction (CFG fast/emulated), symbolic execution, data-dependency analysis, value-set analysis, and a full decompiler pipeline that produces C-like pseudocode. The framework supports multiple architectures (x86, ARM, MIPS, PowerPC, etc.) and operating systems (Linux, Windows, CGC, FreeBSD, Java VM, UEFI) through a modular SimOS layer and extensive library procedure models (libc, POSIX, Linux kernel, Windows API, C++ stdlib, Java/JNI). The architecture is built around a mixin-based engine composition pattern, where execution engines (VEX, AIL, Soot, Pcode, unicorn) are combined into an UberEngine. Analyses are registered via an AnalysesHub and instantiated as project.analyses.Name. A knowledge-base plugin system stores functions, variables, types, cross-references, and other analysis results. The decompiler is particularly sophisticated, with dozens of optimization passes, peephole optimizations, region simplifiers, and multiple structuring algorithms (SAILR, Phoenix, Dream). Native Rust components (clarirs-core, clarirs-vsa, clarirs-z3) provide high-performance symbolic reasoning and solver integration. Key entry points include angr.Project for loading binaries, project.factory for block/engine creation, project.analyses for running analyses, and simulation_manager for symbolic execution. The framework also includes an MCP server for LLM integration, a distributed analysis framework, and database persistence via AngrDB. External dependencies include claripy (solver abstraction), cle (binary loader), pyvex (VEX IR), capstone/keystone (disassembly/assembly), unicorn (concrete execution), and Z3 (SMT solver).
Ghidra is a software reverse engineering (SRE) framework developed by the NSA. It provides a full-featured desktop application for analyzing compiled binaries, supporting disassembly, decompilation, debugging, and scripting across multiple architectures (x86, ARM, MIPS, PowerPC, RISC-V, etc.). The system is modular, built on a plugin architecture with services, actions, and extension points discovered at runtime. Key entry points include the GUI launcher (ghidra.Ghidra) and headless mode (ghidra.GhidraRun), as well as a Gradle build system for extension development. The debugger integrates with GDB, LLDB, dbgeng, drgn, and x64dbg via a Trace RMI protocol, and includes a p-code emulator and JIT compiler. Ghidra also offers binary similarity search (BSim), version tracking, and a rich API for scripting in Java, Python, and Jython. External dependencies include Java 17, Gradle, and optional third-party tools for PDB and DWARF processing.
This repository implements an MCP (Model Context Protocol) server that exposes IDA Pro's disassembler, decompiler, debugger, and type system as a set of tools and resources consumable by LLM clients (Claude, Codex, Cursor, etc.). It operates in two distinct modes: an IDA GUI plugin that starts an MCP server on a configurable port, and a headless supervisor (`idalib-mcp`) that manages persistent worker processes for multiple databases. The architecture is a hybrid of a plugin and a standalone server, built on a custom, vendored MCP server implementation (`zeromcp`) with HTTP/SSE/stdio transports. The core API surface is defined via a decorator-based registration system (`@tool`, `@resource`, `@unsafe`, `@ext`) in `rpc.py`, which also handles output truncation middleware and JSON schema generation from TypedDicts. All IDA SDK calls are marshalled onto the main thread through a robust execution pipeline (`sync.py`) that manages timeouts, cancellation, and batch mode. The headless mode uses a supervisor/worker pattern (`idalib_supervisor.py`, `idalib_server.py`, `worker_lifecycle.py`) with health probing, idle TTL, and session management. A comprehensive compatibility layer (`compat.py`) provides version-gated shims for IDA 8.4 through 9.3. Key features include decompilation, disassembly, cross-references, memory read/write, patching, type declaration/inference, debugger control (breakpoints, step, registers), signature generation, and binary survey. Tool calls are always-on traced into the IDB as gzipped JSONL batches. The project includes an extensive test suite with a custom test framework, MCP spec regression tests, and CI running against multiple IDA versions in Docker containers. The codebase is actively maintained and demonstrates strong engineering practices, but the plugin mode is explicitly deprecated in favor of the official Hex-Rays IDA MCP Server. The heavy reliance on IDA's internal APIs and the vendored MCP server implementation represent ongoing maintenance risks. The code is well-structured with several genuinely reusable components, though some modules (e.g., `api_analysis.py`) are monolithic.
RetDec is a retargetable machine-code decompiler based on LLVM, designed to convert binary executables (supporting ELF, PE, Mach-O, COFF, Intel HEX, and raw machine code) into high-level code (primarily C-like) and perform various analyses. The architecture is modular, consisting of stages: binary loading and format detection, conversion to LLVM IR, optimization and analysis on the IR, lifting to a high-level intermediate representation, and finally generation of readable code or other outputs (like JSON, debug information, etc.). Key entry points include the command-line tools `retdec-decompiler`, `retdec-fileinfo`, and `retdec-unpacker`, as well as a library interface for integration into other tools. The project demonstrates strong software engineering practices with a clear separation of concerns, extensive use of design patterns (such as visitor, factory, and smart pointers), and a focus on reusability. Notable reusable components include a thread-safe smart pointer implementation with weak pointer support and a comprehensive C type system that enables type-safe representation and manipulation of C language constructs. These components are sufficiently isolated to be extracted and used in other projects with minimal modification. Despite its strengths, the repository shows signs of technical drift due to delayed dependency updates and operates under a limited maintenance mode where issue responses may be delayed and only critical fixes are prioritized. However, the core functionality remains robust and well-tested, making it a reliable tool for reverse engineering tasks.
jadx is a production-grade Android DEX/APK to Java source decompiler, providing both a command-line tool (jadx-cli) and a feature-rich Swing GUI (jadx-gui). The architecture is a multi-module Gradle project with a plugin system for input formats (DEX, Java class files, Smali, AAB, XAPK), decompilation passes, resource handling, and deobfuscation. The core decompilation pipeline uses a visitor pattern over a custom intermediate representation (IR) with type inference, SSA construction, region-based control flow, finally block extraction, and code generation. The codebase is actively maintained with a large test suite, but exhibits technical drift through deprecated APIs, complex state machines, and some unmaintained code paths. The plugin system and zip reader module are well-isolated and potentially reusable.
UndertaleModTool is a comprehensive, open-source modding and reverse-engineering tool for GameMaker games, specifically Undertale and Deltarune. It provides a full suite of functionality: reading/writing GameMaker data files (.win, .unx, etc.) with byte-for-byte accuracy, decompiling GML VM bytecode back into human-readable GameMaker Language (GML), compiling modified GML back into bytecode, and editing all game assets (sprites, sounds, rooms, code, textures, shaders, fonts, etc.) through a Windows-only WPF GUI or a cross-platform CLI. The tool also includes a project system for exporting/importing assets as JSON and PNG, a built-in C# scripting engine for automation, and game-specific definitions that tailor decompilation and modding to Undertale and Deltarune. The architecture is a classic library-plus-front-end pattern: the core library `UndertaleModLib` handles all binary serialization, decompilation, compilation, and project management. The GUI application `UndertaleModTool` and CLI `UndertaleModCli` are thin layers that use this library. The library itself is heavily version-aware, supporting multiple GameMaker versions (GMS1, GMS2, 2022-2024) with hundreds of conditional checks. The decompiler integrates with the external `Underanalyzer` submodule for advanced GML compilation and decompilation. A large collection of built-in C# scripts covers common modding tasks (resource export/import, technical utilities, game-specific modifications). While primarily an application, the repository also serves as a living document of GameMaker's internal data format—a significant reverse-engineering effort. The code is rich with comments explaining undocumented structures, version differences, and workarounds for engine bugs. This hybrid nature makes it both a practical modding tool and a valuable research resource for understanding GameMaker internals.
pycdc/pycdas is a C++11 command-line toolchain for reverse engineering CPython bytecode. pycdc decompiles compiled .pyc files back into human-readable Python source; pycdas emits a detailed bytecode disassembly (with options like --show-caches and --pycode-extra). Version coverage spans Python 1.0 (1994) through 3.13, with the correct opcode semantics selected from the .pyc magic number at load time. The entry points are pycdc.cpp and pycdas.cpp, which are thin CLIs over the pycxx static library that owns marshal-format parsing (pyc_object.cpp, pyc_numeric.cpp, pyc_string.cpp, pyc_sequence.cpp), code-object extraction (pyc_code.cpp), and interpreter version detection (pyc_module.cpp). It also supports decompiling raw marshalled code objects via -c -v <version>. Decompilation loads the code object and interprets its bytecode on a virtual stack machine (FastStack with history snapshots) inside ASTree.cpp, reconstructing structured control flow (loops, try/except, comprehensions, with-blocks) and lowering it into an ASTNode tree for source emission. Opcode semantics are maintained as an X-macro include (bytecode_ops.inl) with explicit version ranges, and per-version opcode-name maps live in bytes/python_*_*.cpp. The module boundaries cleanly separate binary I/O (endian-aware PycBuffer/PycFile streams), object marshalling, disassembly, AST construction, and printing - although the decompiler core itself is a dense, version-conditional megafile. QA is the project's strongest asset. Roughly 200 .pyc fixtures spanning every Python major release (plus an xfail set for known-unfixed cases) are checked by tests/run_tests.py, which compares decompiler output to expected output as token streams rather than exact text - tolerating cosmetic whitespace differences while still catching semantic regressions. Linux and Windows CI run the suite, and scripts/pymultic, Dockerfile.pybuild, and a collection of Autoconf modernization patches make it possible to rebuild ancient CPython releases to regenerate those fixtures. Recent commits cover Python 3.13 opcode support, and the repository is actively maintained. Caveats: the 25-year version matrix forces heavily conditional decompilation logic, some mutable global state exists in ASTree, and unknown or future-modified opcodes degrade to partial output with an 'Unsupported opcode' warning. For its niche, it is the most complete open-source CPython decompiler available.
Apktool is a command-line tool for reverse engineering Android APK files. It decodes binary resources (resources.arsc, AndroidManifest.xml, 9-patch images) back to nearly original form, disassembles DEX bytecode into Smali assembly using baksmali, and provides a rebuild pipeline that reassembles and signs the APK via aapt2 and apksigner. The tool manages Android framework APK installations to resolve resource references during decoding. The architecture is a multi-module Gradle project: a core library (apktool-lib) exposing programmatic APIs (ApkDecoder, ApkBuilder, ResTable, Framework), and a CLI wrapper (apktool-cli) that provides commands like decode, build, install-framework, and list-frameworks. Supporting libraries (brut.j.util, brut.j.dir, brut.j.yaml, brut.j.xml) handle I/O, directory abstraction, YAML metadata, and XML serialization. External dependencies include Google's aapt2 binary (bundled per platform) and the smali/baksmali libraries for DEX compilation. The codebase demonstrates deep knowledge of Android binary formats, with custom parsers for chunked resource tables, binary XML, and resource qualifiers, and includes extensive regression tests covering edge cases and security vulnerabilities.
GDA (GJoy Dex Analyzer) is a Windows-native, closed-source Dalvik bytecode decompiler and Android APK reversing tool, written in C++. It provides a GUI for interactive analysis, a CLI for batch operations, and a socket-based server for programmatic access. The open-source components in this repository include Java and Python plugin APIs for scripting analysis tasks (e.g., string decryption, method tracing), example scripts, and skill definitions for LLM-driven automated malware analysis. The core decompiler is not open source, but the plugin interfaces and skill scripts are well-structured and reusable for integrating GDA with other tools or AI agents. The repository also contains color themes, documentation images, and a DEX patching utility.
This repository implements BTD, a deep neural network (DNN) executable decompiler for x86 binaries. It recovers model specifications (operator types, topology, dimensions, parameters) from DNN executables compiled by TVM, Glow, and NNFusion frameworks. The system uses dynamic binary instrumentation via Intel Pin to collect execution traces, applies symbolic execution and taint analysis to recover tensor shapes, extracts parameters from memory dumps, and rebuilds models in PyTorch for correctness verification. The architecture consists of interconnected Python scripts and Pin tools organized around a three-phase decompilation pipeline: trace collection and filtering, shape recovery via symbolic execution, and parameter extraction. Key entry points include evaluation shell scripts (decompile_eval.sh, op_infer_eval.sh) and model-specific decompile/rebuild scripts in the evaluation/ directory. The system relies on external dependencies including Intel Pin 3.14, IDA Pro 7.5 (optional), and specific compiler versions (TVM v0.7-v0.9, Glow 2020-2022, NNFusion).