morluto/awesome-reverse-engineering

What it is

morluto/awesome-reverse-engineering is a CC0 list in which each entry gives one line on purpose, prerequisites, and often a maintenance or licence flag. Listed projects keep their own licences. The page opens with a task-to-section table ("Bypass anti-debugging, unpack or rebuild imports" points to Deobfuscation and anti-analysis, for example). Commercial tools are marked. The list calls itself an initial selection open to additions and corrections. A featured link promotes REA, a tool from the list's own creators.

What to do

Use the per-entry notes to rule tools out before installing them. The page records these version and status boundaries:

• Maintenance: de4dot was archived in 2020. class-dump has been unmaintained since 2019 and lacks Swift support, so the list points to ipsw class-dump. Il2CppDumper has had no commits since July 2024, and the list names Cpp2IL as the maintained alternative. RetDec is in limited maintenance. YARA is in maintenance mode, with YARA-X as successor (check documented rule differences before migrating). flare-emu is archived.
• Version floors: WinDbg 1.2610.1001.0 or later includes the official WinDbg MCP server. Hex-Rays IDA MCP needs IDA 9.4+, idalib, Python 3.11+ and uv. Gepetto needs IDA 7.6+. Chrome DevTools MCP needs Node.js LTS and Chrome. r2flutter needs radare2 6.2.2+. PyLingual needs Python 3.12+. hexvero needs Node.js 22.12+.
• Format coverage: hermes-dec loads HBC 98 and 99 with an unsupported-version warning. Hermit supports HBC 94 to 96 and not 98. pyinstxtractor-ng uses xdis, so the host Python need not match the build version, but neither pyinstxtractor variant decompiles bytecode.
• Licensing: Keystone is GPL-2.0 with a separate commercial licence. Its latest PyPI release (0.9.2, 2020) ships wheels only for x86 and x86-64 hosts. Binary Ninja's headless MCP variant needs a Commercial or Ultimate licence.

For agent work, the integrations section lists MCP servers for Binary Ninja, Ghidra (GhidraMCP and a derived Ghidra MCP Server), IDA (Hex-Rays official and IDA Pro MCP), JADX, radare2 and WinDbg. The WinDbg server supports VS Code with GitHub Copilot and GitHub Copilot CLI, with one active MCP client per session.

For malware work, the page says to run samples only in isolated, disposable environments. FLARE-VM and REMnux are the listed prebuilt workstations.

Caveats

The page states several limits on tool output:

• checksec mitigation flags are not a vulnerability verdict.
• re-audit findings are heuristic candidates for manual review.
• Heimdall and WhatsABI output is inferred and needs validation.
• Rubber Room's pseudocode is experimental and may omit program logic.
• Several newer entries are labelled alpha: Rubber Room, Hex Harbinger, Struct Smith and usb-rea.

For agent integrations, the page says to confirm conclusions against the underlying code and runtime evidence.

The page says a passing link check confirms availability, not tool quality or maintenance. Its links to a list-structure review (a dated comparison of 21 collections) and a 2026-10-25 catalog source review were not fetched, so their findings are not covered here. The page does not report star counts or recent activity for the list itself.