Open Source Linux Reverse Engineering Tools
Sort By:
Reverse Engineering Tools for Linux
View 1360 business solutionsBrowse free open source Reverse Engineering tools and projects for Linux below. Use the toggles on the left to filter open source Reverse Engineering tools by OS, license, language, programming language, and project status.
-
Custom VMs From 1 to 96 vCPUs With 99.95% UptimeLive migration and automatic failover keep workloads online through maintenance. One free e2-micro VM every month.
-
Go from Code to Production URL in SecondsSkip the Kubernetes configs. Cloud Run handles HTTPS, scaling, and infrastructure automatically. Two million requests free per month.
-
1
Ghidra
Ghidra is a software reverse engineering (SRE) framework
Ghidra is a free and open-source reverse engineering framework developed by the NSA for analyzing compiled software. It supports a wide array of instruction sets and executable formats, offering features such as decompilation, disassembly, scripting, and interactive graphing. Designed for security researchers and analysts, Ghidra provides a robust environment for understanding malware, auditing code, and performing software forensics. It includes both GUI-based and headless analysis modes. -
2
frida
Dynamic instrumentation toolkit for developers
Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers. Inject your own scripts into black box processes. Hook any function, spy on crypto APIs or trace private application code, no source code needed. Edit, hit save, and instantly see the results. All without compilation steps or program restarts. Works on Windows, macOS, GNU/Linux, iOS, Android, and QNX. Install the Node.js bindings from npm, grab a Python package from PyPI, or use Frida through its Swift bindings, .NET bindings, Qt/Qml bindings, or C API. Frida is and will always be free software (free as in freedom). We want to empower the next generation of developer tools, and help other free software developers achieve interoperability through reverse engineering. We are proud that NowSecure is using Frida to do fast, deep analysis of mobile apps at scale. Frida has a comprehensive test-suite and has gone through years of rigorous testing across a broad range of use-cases. -
3
Il2CppDumper
Unity il2cpp reverse engineer
Il2CppDumper is a Unity IL2CPP reverse engineering tool for analyzing supported Unity applications and game binaries. It can restore DLL metadata structures without restoring original code, which helps researchers inspect classes, methods, fields, MonoBehaviour data, and MonoScript information. The tool supports executable formats such as ELF, ELF64, Mach-O, PE, NSO, and WASM. It supports Unity versions from 5.3 through 2022.2, according to the repository documentation. Il2CppDumper can generate helper scripts for IDA, Ghidra, and Binary Ninja, along with structure headers and JSON outputs. It is best suited for authorized reverse engineering, interoperability research, security analysis, modding research, and educational binary analysis. -
4
REA: Reverse Engineer Anything
Reverse engineer anything with agents, from app behavior
REA (Reverse Engineer Anything) is an open-source, AI-powered reverse engineering toolkit that enables developers and AI agents to analyze software applications, native binaries, and runtime behavior. The platform uses the Model Context Protocol (MCP) to connect AI coding assistants with tools for inspecting compiled code, application structures, and software functionality. It supports reverse engineering of native executables, JavaScript and Electron applications, .NET assemblies, Android APKs, WebAssembly modules, firmware, and websites. REA integrates with reverse engineering tools such as Ghidra, Hopper, and IDA to examine assembly instructions, decompiled pseudocode, symbols, functions, and code references. Developers can use the platform to investigate how software features work, trace application behavior, identify implementation details, and reconstruct functionality in their own projects. REA supports AI coding assistants including Claude Code, Codex, Cursor, Gemini CLI, etc. -
$300 Free Credits to Build on Google CloudPut your $300 in credit toward real workloads, then keep building with free monthly usage for 20+ products. No commitment and no charge until you upgrade.
-
5
Hackingtool
ALL IN ONE Hacking Tool For Hackers
HackingTool by Z4nzu is a large collection (“all-in-one”) of tools and scripts for penetration testing / hacking / OSINT etc. It bundles many utilities (port scanners, payload injectors, web attack tools, phishing tools, wireless attack tools, reverse engineering, etc.) into a menu interface. Includes many individual tools, often wrappers or aggregations of existing well-known tools (e.g. port scanners, web attack tools, steganography, hash cracking etc.). A menu interface offering categories: reconnaissance, payload creation, wireless attacks, reverse engineering, exploit frameworks, etc. Users can pick which tool to run. It is intended more for “ethical / lab / educational” hacking contexts rather than production or stealth scenarios. It depends a lot on external tools, grants, and root privileges in many cases. -
6
UEFITool
UEFI firmware image viewer and editor
UEFITool is a free, open-source utility for examining and manipulating firmware images that conform to UEFI Platform Initialization specifications. It provides a graphical interface for exploring the internal structure of firmware used by computers and other electronic devices. The application parses firmware images into hierarchical trees containing volumes, files, sections, and related components. Users can inspect these elements and examine firmware organization without manually interpreting raw binary data. Its parsing engine performs structural and integrity checks to identify potential problems. UEFITool supports firmware research, reverse engineering, diagnostics, and analysis of low-level system components. The project includes editing capabilities in its established branches, while newer development versions continue to expand firmware parsing support. -
7
JPEXS Free Flash Decompiler
JPEXS Free Flash Decompiler is open-source Flash SWF decompiler
JPEXS Free Flash Decompiler is a free, open-source application for analyzing, editing, and extracting content from Adobe Flash SWF files. It enables users to inspect compiled Flash applications and recover resources such as images, sounds, fonts, shapes, and scripts. The software supports ActionScript 1, 2, and 3 decompilation, allowing developers to examine and modify embedded program logic. Users can replace multimedia assets, edit text, and modify SWF structures without access to the original project files. It also supports converting SWF content into FLA format for further editing. Its integrated interface provides resource previews, script editing, and multiple export options. Built with Java, it runs on Windows, macOS, and Linux and is useful for software preservation, reverse engineering, and Flash content recovery. -
8
AssetRipper
GUI application to analyze game files
AssetRipper is an open-source application for analyzing and extracting assets from games developed with the Unity engine. It helps developers inspect compiled game files and recover resources into formats compatible with Unity development workflows. The software can process assets such as textures, models, audio files, and other game resources. It assists in identifying unused dependencies, broken asset references, and code that remains in compiled builds. AssetRipper supports a broad range of Unity versions, although compatibility and extraction accuracy can vary. Its graphical interface makes complex asset structures easier to explore and understand. The application is particularly useful for debugging, recovering project resources, studying game architecture, and investigating Unity build contents. -
9
APK Studio
Open-source, cross platform Qt based IDE for reverse-engineering
Open-source, cross-platform Qt based IDE for reverse-engineering Android application packages. It features a friendly IDE-like layout including code editor with syntax highlighting support for *.smali code files. If you are just willing to quickly decompile an Android app, you can make use of DeAPK - Online APK Decompiler which lets you decompile an Android app using apktool and jadx. -
Paessler: Easy to Use With Enterprise Power. Free TrialYou shouldn't have to choose between a monitoring tool that's easy to use and one that's powerful enough for a complex environment. PRTG's low-code interface lets any admin build dashboards, set alerts and monitor devices without scripting, while custom sensors and full API access are there when your team needs deeper control. One platform, no compromise. Download a free 30-day trial now.
-
10
Radare2
UNIX-like reverse engineering framework and command-line toolset
A free/libre toolchain for easing several low-level tasks like forensics, software reverse engineering, exploiting, and debugging. It is composed by a bunch of libraries (which are extended with plugins) and programs that can be automated with almost any programming language. It is recommended to install it from git, alternatively, you can pick the last release (every 6 weeks) from Github. Batch, Commandline, visual, and panels interactive modes. Embedded webserver with js scripting and WebUI. Assemble and disassemble a large list of CPUs. Runs on Windows and any other UNIX flavor out there. Analyze and emulate code with ESIL. Native debugger and GDB, WINDBG, QNX, and FRIDA. Navigate ASCII-art control flow graphs. Ability to patch binaries, and modify code or data. Search for patterns, magic headers, and function signatures. Easy to extend and modify. Commandline, C API, script with r2pipe in any language. -
11
FISSURE
The RF and reverse engineering framework for everyone
FISSURE is an open-source radio frequency analysis and signal intelligence framework built to support software-defined radio research, wireless security experimentation, and protocol reverse engineering. The project brings together tools for capturing, inspecting, decoding, replaying, and analyzing RF signals across a wide range of wireless technologies. It is designed as a practical environment for researchers and operators who need to move from raw spectrum observation to structured investigation without stitching together too many separate utilities by hand. The platform supports workflows related to signal discovery, demodulation, packet inspection, fuzzing, and attack simulation, making it useful for both defensive research and controlled lab testing. Its architecture is oriented toward extensibility, so users can integrate additional hardware, signal-processing components, and protocol-specific modules depending on their needs. -
12
MobileHackersWeapons
Collection of cool tools used by Mobile hackers
MobileHackersWeapons is a curated collection of tools for Android and iOS security analysis, testing, and reverse engineering. The catalog groups projects by purpose rather than bundling them into a single executable toolkit. Categories include application analysis, penetration testing, proxies, reverse engineering, scanners, monitoring, device utilities, NFC, Bluetooth, jailbreak research, and certificate-unpinning tools. Listed projects span many languages and include both desktop utilities and tools that run directly on mobile devices. Android resources cover APK analysis, decompilation, network monitoring, instrumentation, and device interaction. iOS resources include runtime exploration, binary analysis, device automation, and research tooling. The repository is intended as a discovery reference for authorized mobile-security testing and research. -
13
pwndbg
Exploit Development and Reverse Engineering with GDB Made Easy
Pwndbg is a fast, simple and lightweight tool for modern debugging. It improves debugging experience with the strength of GDB for low-level software developers, hardware hackers, reverse engineers, and exploit developers. It provides features crucial for efficient debugging in the world of low-level programming. Vanilla GDB is terrible to use for reverse engineering and exploit development. Typing x/g30x $esp is not fun, and does not confer much information. The year is 2024 and GDB still lacks a real hexdump command! GDB's syntax is arcane and difficult to approach. Windbg users are completely lost when they occasionally need to bump into GDB. -
14
BinExport
Export disassemblies into Protocol Buffers
BinExport is a disassembly export plugin developed by Google as part of the BinDiff ecosystem, designed for reverse engineering and binary analysis. It works with popular disassemblers including IDA Pro, Binary Ninja, and Ghidra, enabling the export of disassembly data into a structured Protocol Buffer format. This exported data can then be used for binary comparison, diffing, and advanced analysis tasks through BinDiff or other compatible tools. BinExport captures detailed information such as instructions, functions, control flow graphs, and metadata, providing a machine-readable representation of a program’s disassembled structure. It supports multiple export formats, including binary, text, and statistics outputs, and can be used interactively or via scripting (IDC, IDAPython, or Ghidra’s headless mode). The project includes complete build instructions for Linux, macOS, and Windows, ensuring reproducibility across platforms. -
15
Cutter
Free and Open Source Reverse Engineering Platform
Cutter is a free and open-source graphical reverse-engineering platform powered by the Rizin framework. It provides a visual interface for inspecting binaries, functions, strings, references, control flow, and low-level program structure. The application is designed to make advanced binary analysis more approachable without sacrificing access to Rizin’s underlying capabilities. Its interface can be extended with Python and native C++ plugins. Community integrations add features such as decompilers and code-coverage visualization. Cutter runs on Linux, macOS, and Windows and is distributed through native packages, portable builds, and Docker-based options. It is intended for software analysis, debugging, research, and authorized security work. -
16
Capstone
Capstone disassembly/disassembler framework
Capstone is a disassembly framework with the target of becoming the ultimate disasm engine for binary analysis and reversing in the security community. Created by Nguyen Anh Quynh, then developed and maintained by a small community, Capstone offers some unparalleled features. Support multiple hardware architectures: ARM, ARM64 (ARMv8), Ethereum VM, M68K, Mips, MOS65XX, PPC, Sparc, SystemZ, TMS320C64X, M680X, XCore and X86 (including X86_64). Having clean/simple/lightweight/intuitive architecture-neutral API. Provide details on disassembled instruction (called “decomposer” by others). Provide semantics of the disassembled instruction, such as list of implicit registers read & written. Implemented in pure C language, with lightweight bindings for D, Clojure, F#, Common Lisp, Visual Basic, PHP, PowerShell, Emacs, Haskell, Perl, Python, Ruby, C#, NodeJS, Java, GO, C++, OCaml, Lua, Rust, Delphi, Free Pascal & Vala (ready either in main code, or provided externally by the community). -
17
iaito
Official radare2 GUI
iaito is a free, open-source graphical interface for radare2, a reverse engineering and binary analysis framework. Built with Qt, it provides an accessible environment for examining executable files and understanding program structures. The software combines disassembly, binary inspection, and program analysis tools within a unified interface. Users can investigate functions, examine memory contents, and explore relationships between different sections of a program. It also supports binary patching, forensic analysis, and binary comparison workflows. iaito maintains compatibility with radare2 commands, plugins, and scripts, allowing users to extend its capabilities. Available for Windows, macOS, and Linux, it helps security researchers, developers, and reverse engineers analyze compiled software. -
18
REHex
Reverse Engineers' Hex Editor
ReHex is a cross-platform hexadecimal editor designed for reverse engineering, binary analysis, and low-level file manipulation. It supports editing extremely large files exceeding one terabyte. Users can inspect raw bytes and decode integer, floating-point, and text representations. Inline machine code disassembly helps analyze executable instructions directly within binary files. Advanced tools allow byte ranges to be highlighted, annotated, and mapped to virtual addresses. A comparison feature identifies differences between complete files or selected regions. Binary templates automatically interpret structured data, while Lua scripting enables custom analysis workflows. Additional functionality includes bitmap visualization, bit manipulation, checksums, and Intel HEX importing and exporting. ReHex runs on Windows, macOS, Linux, and BSD. -
19
WebHackersWeapons
A collection of cool tools used by Web hackers
WebHackersWeapons is a community-maintained catalog of tools used for web application security research and testing. Rather than providing one scanner, it indexes a broad ecosystem of specialized open-source security utilities. The collection spans analysis, penetration testing, proxies, scanners, reconnaissance, reverse engineering, fuzzing, automation, and supporting utilities. Individual entries link to their original projects so researchers can evaluate tools according to a particular assessment task. The repository is organized into categorized data that can be maintained and expanded through community contributions. It also belongs to a wider family of curated security-tool collections maintained by the same author. The catalog is primarily intended for bug bounty, authorized testing, and defensive security research. -
20
Zydis
Fast and lightweight x86/x86-64 disassembler and code generation lib
Zydis is a fast and lightweight disassembler library designed for decoding x86 and x86-64 machine code into human-readable assembly instructions. It focuses on performance and accuracy, making it suitable for applications such as reverse engineering, debugging, and binary analysis. The library provides detailed information about decoded instructions, including operands, prefixes, and instruction lengths, enabling deep inspection of executable code. It is designed to be easy to integrate, with a clean and minimal API that reduces complexity for developers. Zydis also emphasizes portability, allowing it to run across multiple platforms and environments. Its efficiency makes it particularly useful in scenarios where large volumes of code need to be analyzed quickly. Overall, zydis serves as a reliable and high-performance tool for understanding and working with machine-level instructions. -
21
iced
Blazing fast and correct x86/x64 disassembler, assembler, decoder, etc
iced is a powerful and feature-rich disassembly and assembly library for x86 and x64 architectures, designed to provide accurate decoding, encoding, and formatting of machine instructions. It supports multiple programming languages, including C#, Rust, and Python, making it accessible to a wide range of developers. The library offers both disassembly and assembly capabilities, allowing users to convert between machine code and human-readable instructions in both directions. It includes advanced features such as instruction formatting, symbol resolution, and customizable output, enabling precise control over how code is represented. iced is optimized for performance and correctness, ensuring reliable results even in complex scenarios. It is commonly used in tools for debugging, reverse engineering, and binary analysis. Overall, iced provides a comprehensive solution for working with low-level machine code in modern software systems. -
22
sperm
Collection of reverse engineering articles curated for learning
sperm is a curated repository that gathers a collection of notable articles related to reverse engineering and software analysis. It primarily acts as a knowledge archive where previously published technical posts are compiled and organized for easier access and long-term reference. These articles originate from multiple technical communities and platforms and are exported into Markdown format to maintain a consistent and readable structure. sperm focuses on educational material that explores reverse engineering techniques, mobile analysis, and related technical discussions. Its goal is to preserve useful learning resources and make them easier for researchers, students, and security enthusiasts to browse in a single location. sperm emphasizes that the materials are intended strictly for study and technical exchange rather than misuse. By maintaining these articles in a version-controlled repository, the content remains accessible and easier to navigate. -
23
The Bitdefender disassembler
bddisasm is a fast, lightweight, x86/x64 instruction decoder
The Bitdefender disassembler is a highly optimized, lightweight x86/x64 instruction decoder designed for security, reverse engineering, and low-level systems analysis. It focuses on decoding machine instructions with high precision while providing detailed metadata about each instruction, including operands, access modes, CPU flags, and feature requirements. Unlike many disassemblers, bddisasm is built with zero dynamic memory allocation and no external dependencies, making it extremely portable and suitable for constrained environments such as kernels, hypervisors, and embedded systems. The project also includes a companion component called bdshemu, which provides a minimal instruction emulator capable of analyzing shellcode-like behavior in a controlled environment. Its performance is a key strength, achieving millions of decoded instructions per second while maintaining thread safety and deterministic behavior. -
24
ngrev
Tool for reverse engineering of Angular applications
Graphical tool for reverse engineering of Angular projects. It allows you to navigate in the structure of your application and observe the relationship between the different modules, providers, and directives. The tool performs static code analysis which means that you don't have to run your application in order to use it. ngrev is not maintained by the Angular team. It's a side project developed by the open-source community. The application is not signed, so you may have to explicitly allow your mac to run it in System Preferences. You can add your own theme by creating a [theme-name].theme.json file in Electron [userData]/themes. For a sample theme see Dark. Your application needs to be compatible with Angular Ivy compiler. ngrev is not tested with versions older than v11. To stay up to date check the update guide on angular.io. -
25
reverse-skill
Reverse Engineering and Authorized Penetration Testing
reverse-skill is a cybersecurity skill router for AI coding agents working on authorized reverse engineering, penetration testing, CTF, and security research tasks. It analyzes the target type and directs the agent to an appropriate methodology instead of relying on improvised commands. Its playbooks cover Android and iOS applications, native binaries, .NET, JavaScript, firmware, malware, APIs, supply chains, and other specialized scenarios. The package checks locally available tools and can bootstrap supporting scripts, MCP servers, and utilities when needed. Scope gates, case initialization, timelines, evidence chains, reports, and field journals encourage repeatable and auditable work. It supports clients such as Claude Code, Codex CLI, Cursor, and Cline across Windows, Linux, macOS, and Kali Linux. The repository also preserves reusable lessons so later investigations can avoid previously documented mistakes.
