github.comrepoZX41R/awesome-reverse-engineering-and-malware-analysis
A curated, upkept "awesome list" for reverse engineering and malware analysis that organizes hundreds of resources into guided learning tracks (Windows malware triage-to-config-extraction, Linux/ELF reversing, exploit development, firmware & embedded, mobile, anti-analysis) plus a full taxonomy covering foundations, RE tooling (IDA, Ghidra, Binary Ninja, radare2, x64dbg), malware analysis/unpacking/YARA/C2 tracking, fuzzing (AFL++, libFuzzer), firmware, mobile, OS internals, LOLBAS/GTFOBins living-off-the-land resources, DFIR, and threat intelligence. It also surfaces niche researcher communities like Kanxue, 52pojie, Tuts4You, the WASM Russian RE forum, 0x00sec, and back.engineering (VTIL/VMProtect devirtualization work), with every link manually vetted and dead links pruned.
What it is
ZX41R/awesome-reverse-engineering-and-malware-analysis is a CC0 (public domain) reading list maintained by nil (zx41r). Its page title is "unpacked". The page says every link was opened before inclusion and is removed when it rots.
How entries are labelled
Each entry states what it is and who it is for, and carries tags:
- Level: intro, working, deep.
- Type: tool, blog, writeup, course, video, paper, book.
- Warnings: paid, signup, archived, or a language code such as zh or ru for non-English pages.
These tags let you filter by depth and by access barriers before opening a link.
Coverage beyond the summary
The taxonomy has 14 sections. Two are not named in the catalog summary: Malware development (injection, evasion, reading real source, labelled study/lab) and Learning, CTFs & wargames (challenges and practice platforms). Researcher blogs and writeups are embedded in the section they belong to, not kept on a separate page.
The community list also includes Reverse Engineering Stack Exchange, r/ReverseEngineering and r/Malware. The page describes the first as the place to look when decompiler output will not resolve. Kanxue and 52pojie are tagged zh, and WASM is tagged ru.
Caveats
The page says the six learning tracks "land as their sections do", so some tracks may not yet be filled in. The Windows malware track is described as an ordered path: setup and safe handling, triage, static, dynamic, unpacking, config extraction. Check that a track is populated before planning around it.
The fetched text contains no individual links or entries, so the "every link vetted" claim and the "no commit in years" contrast with older lists come from the maintainer and were not checked here.
Corrections and additions go through an issue or a PR.
Organisations named here
- 52pojie
- Kanxue
Technologies named here
- PE format
- IDA
- ELF
- Ghidra
- Binary Ninja
- Mach-O
- radare2
- x86-64
- x64dbg
- ARM
- Windows
- AFL++
- libFuzzer
- Linux
- YARA
- macOS
- Android
- VTIL
- iOS
- LOLBAS
- GTFOBins
- VMProtect
Techniques named here
- Static Analysis
- Dynamic analysis
- Unpacking
- Config extraction
- Sandboxing
- Exploit development
- Fuzzing
- Firmware extraction and emulation
- Hardware attacks
- Obfuscation
- Packing
- Anti-debug
- Anti-VM
- Process injection
- Evasion
- Living off the Land
- Memory forensics
- Timeline analysis
- Threat intelligence tracking
Related in Malware & RE
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupPost-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
huntress.comwriteupClickFix Removes Your Background but Leaves the Malware
