GEF (GDB Enhanced Features) is a production-grade GDB plugin for exploit development, reverse engineering, and binary analysis. It is a single Python script (gef.py) that loads into GDB (>=10.0) and provides over 90 commands covering memory inspection, heap analysis, security mitigation checks (checksec), pattern generation, format string detection, and remote debugging. The architecture is monolithic but well-organized, with a clear separation of concerns via class hierarchies for architectures, memory regions, heap structures, and command registration. The test suite is extensive, using a Docker-based CI matrix that runs on multiple architectures (x86, ARM, AARCH64, etc.) and validates behaviour through RPyC-driven remote GDB sessions. While primarily an application, it also serves as a research tool for heap allocator internals and glibc version-specific behaviour, blending practical utility with deep system understanding.
Capstone is a multi-architecture disassembly engine written in C, derived from LLVM's MC disassembler. It supports over 20 architectures including x86, ARM, AArch64, MIPS, PowerPC, RISC-V, and more. The core library provides a stable C API (cs_open, cs_disasm, cs_option, etc.) and includes per-architecture backends with mapping, disassembler, and instruction printer modules. The architecture is modular: each architecture has a Module.c that registers callbacks into a common cs_struct. The primary data flow is: user provides raw bytes and arch/mode, the engine selects the appropriate disassembler, decodes instructions into MCInst, then prints via instruction printer, optionally filling cs_detail with operand/register/group information. The repository also includes a CLI tool (cstool), extensive test suites (MC regression tests, cstest YAML-based detail tests), fuzzing harnesses, and an automated LLVM sync pipeline (auto-sync) that translates LLVM C++ disassembler code to C using tree-sitter patches. The codebase is well-structured with clean abstractions for operand models (MCInst/MCOperand), string output (SStream), and architecture-specific mapping. The auto-sync tooling is a notable engineering achievement, enabling systematic translation of LLVM backend code to C. Language bindings for Python, Java, OCaml, and others demonstrate the library's embeddability. The test infrastructure is comprehensive, covering both basic disassembly and detailed operand/register analysis. External dependencies are minimal for the core library (pure C), but the auto-sync tooling depends on Python, tree-sitter, clang-format, and lit. Overall, Capstone is a mature, actively maintained disassembly framework with high craftsmanship and reusable components.
cross-rs/cross is a CLI tool that enables zero-setup cross-compilation for Rust projects by wrapping Cargo and executing builds inside container engines (Docker/Podman). It manages a comprehensive registry of pre-built Docker images for dozens of target triples (Linux, musl, Android, FreeBSD, NetBSD, Solaris, Windows, bare-metal, etc.), automatically selects the appropriate image based on the --target flag, mounts the project source and toolchain, and runs cargo build/test inside the container. The tool also supports remote Docker execution, custom Dockerfiles, and advanced configuration via Cross.toml and environment variables. The codebase is structured as a Rust CLI with two binaries (cross and cross-util), a library of container orchestration modules, and a developer xtask workspace for CI, codegen, and changelog management. It demonstrates strong engineering practices with extensive CI, testing, and reusable patterns for command execution, container abstraction, and configuration merging. The repository includes a large collection of Dockerfiles and shell scripts for building target-specific toolchain images, as well as CI workflows that test across many platforms and container engines.
Unicorn Engine is a lightweight, multi-architecture CPU emulation framework derived from QEMU. It provides a pure C API with bindings for Python, Go, Java, Rust, Ruby, .NET, Haskell, Pascal, Zig, and VB6. The engine supports ARM, ARM64, M68K, MIPS, PowerPC, RISC-V, S390X, SPARC, TriCore, and x86 (16/32/64-bit). It is used primarily for security research, reverse engineering, fuzzing, and dynamic analysis of binary code. The architecture is a library with a central C API that exposes memory mapping, register access, hooks (code, block, memory, interrupt, instruction, syscall, TLB), and context save/restore. The core emulation logic is based on QEMU's TCG (Tiny Code Generator) for dynamic binary translation, with a custom glib compatibility layer to eliminate external dependencies. The repository includes extensive regression tests, fuzz targets, and sample programs for each architecture and binding. While the engine is actively maintained and widely used, it carries technical debt from its QEMU fork (based on QEMU 5.0.1) and auto-generated binding constants that may drift from the C API.
This repository provides an Xbox 360 kernel patch to enable unauthorized USB devices (e.g., custom controllers) to function by bypassing authentication and interface checks. It consists of two components: a Dashlaunch plugin (DLL) that patches the kernel at runtime via DllMain, and a XeBuild patch (binary) for permanent kernel modification. The plugin dynamically resolves kernel function addresses using ordinal exports or hardcoded addresses based on kernel version, then patches UsbdIsDeviceAuthenticated to return true and conditionally modifies WgcAddDevice (and WgcBindToUser for devkit 17489) using PowerPC instruction replacement. Build scripts automate patch generation for multiple kernel versions using a PowerPC toolchain.