Capstone is a multi-architecture disassembly engine written in C, derived from LLVM's MC disassembler. It supports over 20 architectures including x86, ARM, AArch64, MIPS, PowerPC, RISC-V, and more. The core library provides a stable C API (cs_open, cs_disasm, cs_option, etc.) and includes per-architecture backends with mapping, disassembler, and instruction printer modules. The architecture is modular: each architecture has a Module.c that registers callbacks into a common cs_struct. The primary data flow is: user provides raw bytes and arch/mode, the engine selects the appropriate disassembler, decodes instructions into MCInst, then prints via instruction printer, optionally filling cs_detail with operand/register/group information. The repository also includes a CLI tool (cstool), extensive test suites (MC regression tests, cstest YAML-based detail tests), fuzzing harnesses, and an automated LLVM sync pipeline (auto-sync) that translates LLVM C++ disassembler code to C using tree-sitter patches. The codebase is well-structured with clean abstractions for operand models (MCInst/MCOperand), string output (SStream), and architecture-specific mapping. The auto-sync tooling is a notable engineering achievement, enabling systematic translation of LLVM backend code to C. Language bindings for Python, Java, OCaml, and others demonstrate the library's embeddability. The test infrastructure is comprehensive, covering both basic disassembly and detailed operand/register analysis. External dependencies are minimal for the core library (pure C), but the auto-sync tooling depends on Python, tree-sitter, clang-format, and lit. Overall, Capstone is a mature, actively maintained disassembly framework with high craftsmanship and reusable components.
Ghidra is a software reverse engineering (SRE) framework developed by the NSA. It provides a full-featured desktop application for analyzing compiled binaries, supporting disassembly, decompilation, debugging, and scripting across multiple architectures (x86, ARM, MIPS, PowerPC, RISC-V, etc.). The system is modular, built on a plugin architecture with services, actions, and extension points discovered at runtime. Key entry points include the GUI launcher (ghidra.Ghidra) and headless mode (ghidra.GhidraRun), as well as a Gradle build system for extension development. The debugger integrates with GDB, LLDB, dbgeng, drgn, and x64dbg via a Trace RMI protocol, and includes a p-code emulator and JIT compiler. Ghidra also offers binary similarity search (BSim), version tracking, and a rich API for scripting in Java, Python, and Jython. External dependencies include Java 17, Gradle, and optional third-party tools for PDB and DWARF processing.
x64dbg is an open-source binary debugger for Windows targeting malware analysis and reverse engineering. The architecture is a three-layer system: a GUI layer (Qt-based Windows application), a bridge layer (C API for communication), and a debugger core layer (TitanEngine/GleeBug/StaticEngine backends). The debugger supports x86 and x64 processes with comprehensive features including conditional breakpoints, memory analysis, symbol handling, and an extensive plugin SDK. The codebase demonstrates strong engineering in several areas. The analysis engine implements multiple analysis passes (linear, recursive, control flow, xrefs) with a clean pass-based architecture. The command system uses a flexible registration pattern with consistent error handling. The bridge layer provides a well-defined C API surface for plugins with careful attention to thread safety and marshaling between GUI and debugger threads. Recent development shows active work on Linux support (ElfBug debugger), cross-platform tools (hex viewer, minidump analyzer, remote table), and a comprehensive test framework with headless testing infrastructure. The test system uses convention-based test discovery with script-driven scenarios and plugin-based assertions. Technical debt includes some outdated documentation (docs reference Python 2.7 for CHM generation), mixed use of Qt versions (5.12+ required but some paths reference older configurations), and the inherent complexity of maintaining both Windows debugger and cross-platform analysis tools in one repository. The dependency on precompiled libraries (TitanEngine, Zydis, XEDParse) creates build complexity but is managed through CMake.
ImHex is a cross-platform hex editor and binary analysis tool designed for reverse engineers, programmers, and digital forensics. It provides a rich GUI built on Dear ImGui and GLFW, with a modular plugin architecture that allows extending functionality through dynamically loaded plugins. The core library (libimhex) implements a provider abstraction for various data sources (files, disks, process memory, GDB, SSH, UDP, etc.), an event-driven communication system, a content registry for registering views, tools, settings, and data inspectors, and a pattern language engine for declarative binary parsing. The application includes built-in plugins for hex editing, data inspection, disassembly (Capstone), diffing, YARA rule matching, hashing, decompression, visualizations (3D, plots, images), scripting (C and .NET), and a Model Context Protocol (MCP) server for AI-assisted analysis. It supports undo/redo, bookmarks, patches, projects, themes, layouts, achievements, tutorials, and a command palette. The codebase is well-structured with clear separation between core library, plugins, and platform-specific code, though some components are tightly coupled to ImGui internals and the custom pattern language.
Radare2 is a modular reverse engineering framework written in C. It provides a comprehensive set of libraries and command-line tools for binary analysis, disassembly, debugging, emulation, and file format parsing. The architecture is plugin-based: every major subsystem (architectures, binary formats, I/O backends, debuggers, filesystems, crypto, scripting languages) is implemented as a plugin registered via a common RLibStruct pattern. The core library (libr/) contains reusable data structures (RBTrees, RBuffer, RStrBuf, RList, etc.), utilities (base64, ASN.1, regex, event system, thread wrappers), and analysis engines (ESIL emulator, search algorithms, type propagation). The framework supports dozens of CPU architectures (x86, ARM, MIPS, RISC-V, etc.) and binary formats (ELF, PE, Mach-O, DEX, etc.), and can be extended via language bindings (JavaScript, Python, Rust, etc.) and a package manager (r2pm). Despite its large codebase and some legacy components, the project is actively maintained with continuous integration, fuzz testing, and a responsive issue tracker.
rspirv is a Rust workspace providing comprehensive SPIR-V module processing functionality. It includes a core library (rspirv) with a low-level data representation (DR) for raw instructions and a higher-level structured representation (SR) with type-safe indices. The project also features a binary parser, an assembler, a disassembler CLI (rspirv-dis), and a code generator (rspirv-autogen) that derives Rust types from the official SPIR-V JSON grammar. The parser supports custom consumers via the Consumer trait, enabling streaming or custom processing. The builder (dr/build) allows programmatic construction of SPIR-V modules. The lift module converts from DR to SR, bridging the two representations. The codebase is heavily auto-generated from the SPIR-V specification, ensuring spec compliance, but this also introduces risks of drift if the grammar submodule is not updated. The project is actively maintained with CI/CD pipelines, and the multi-crate workspace is designed for both library reuse and standalone tool usage.
pycdc/pycdas is a C++11 command-line toolchain for reverse engineering CPython bytecode. pycdc decompiles compiled .pyc files back into human-readable Python source; pycdas emits a detailed bytecode disassembly (with options like --show-caches and --pycode-extra). Version coverage spans Python 1.0 (1994) through 3.13, with the correct opcode semantics selected from the .pyc magic number at load time. The entry points are pycdc.cpp and pycdas.cpp, which are thin CLIs over the pycxx static library that owns marshal-format parsing (pyc_object.cpp, pyc_numeric.cpp, pyc_string.cpp, pyc_sequence.cpp), code-object extraction (pyc_code.cpp), and interpreter version detection (pyc_module.cpp). It also supports decompiling raw marshalled code objects via -c -v <version>. Decompilation loads the code object and interprets its bytecode on a virtual stack machine (FastStack with history snapshots) inside ASTree.cpp, reconstructing structured control flow (loops, try/except, comprehensions, with-blocks) and lowering it into an ASTNode tree for source emission. Opcode semantics are maintained as an X-macro include (bytecode_ops.inl) with explicit version ranges, and per-version opcode-name maps live in bytes/python_*_*.cpp. The module boundaries cleanly separate binary I/O (endian-aware PycBuffer/PycFile streams), object marshalling, disassembly, AST construction, and printing - although the decompiler core itself is a dense, version-conditional megafile. QA is the project's strongest asset. Roughly 200 .pyc fixtures spanning every Python major release (plus an xfail set for known-unfixed cases) are checked by tests/run_tests.py, which compares decompiler output to expected output as token streams rather than exact text - tolerating cosmetic whitespace differences while still catching semantic regressions. Linux and Windows CI run the suite, and scripts/pymultic, Dockerfile.pybuild, and a collection of Autoconf modernization patches make it possible to rebuild ancient CPython releases to regenerate those fixtures. Recent commits cover Python 3.13 opcode support, and the repository is actively maintained. Caveats: the 25-year version matrix forces heavily conditional decompilation logic, some mutable global state exists in ASTree, and unknown or future-modified opcodes degrade to partial output with an 'Unsupported opcode' warning. For its niche, it is the most complete open-source CPython decompiler available.
vivisect is a comprehensive reverse engineering framework providing static analysis, dynamic debugging, emulation, and symbolic execution capabilities. It consists of several core packages: `envi` (multi-architecture disassemblers, emulators, memory abstraction), `vivisect` (workspace-based static analysis with analysis passes, import emulation, symbolic execution engine), `vtrace` (cross-platform debugging with ptrace/GDB stub support), `vdb` (debugger CLI and Qt GUI), `vstruct` (declarative binary structure parsing for formats like PE, ELF, Mach-O, minidump), `visgraph` (graph layout for control flow and call graphs), and `cobra` (custom RPC framework for remote collaboration). The system can parse and analyze PE, ELF, Mach-O, and other formats; perform function detection, control-flow recovery, switch-case identification, pointer analysis, and symbolic path exploration. It includes a full-featured debugger with breakpoints, watchpoints, and process control, and offers a Qt GUI for interactive reverse engineering. The architecture is modular but tightly integrated; many components are reusable in isolation. The codebase shows signs of long-term evolution with some Python 2/3 drift, deprecated API usage, and incomplete migration to PyQt6, but remains actively maintained with recent commits and a substantial test suite.