
8 OSS repos that let you reverse engineer almost anything
Reverse engineering is basically asking:
“What the hell is this thing actually doing?”
A binary, an Android app, firmware, network traffic, a weird file format, or a program whose interesting behavior only shows up at runtime.
There is an OSS tool for almost every layer.
01 Turn compiled binaries back into something humans can read
NationalSecurityAgency/ghidra — 81.9k★
Ghidra gives you disassembly, decompilation, control-flow graphs, scripting, and support for a huge range of executable formats and processors.
If all you have is the binary, this is usually where the archaeology starts.
02 Look at the bytes when abstractions stop helping
WerWolv/ImHex — 55k★
ImHex is a hex editor built specifically for reverse engineering, combining raw bytes with pattern definitions, analysis, visualization, and disassembly.
Sometimes the fastest way to understand a mystery format is still to stare directly at what is actually on disk.
03 Turn an Android APK back into readable code
skylot/jadx — 50.8k★
JADX decompiles Android APK/DEX files into Java-like source and gives you a GUI for navigating classes, references, resources, and manifests.
Probably the fastest route from “I have this APK” to “okay, now I understand how this app works.”
04 Watch what the program does while it is actually running
frida/frida — 22.2k★
Static code only tells you so much.
Frida lets you instrument running applications and inspect behavior dynamically, especially when the interesting logic only appears after launch or after runtime state changes.
05 Reverse engineer the conversation between apps and servers
mitmproxy/mitmproxy — 45.1k★
mitmproxy lets you inspect HTTP, HTTP/2, WebSocket, and TLS traffic in systems you are authorized to test.
When the code is confusing, watching what goes in and what comes back out can tell you much more.
06 Crack open firmware instead of treating it like one giant blob
ReFirmLabs/binwalk — 14.4k★
Binwalk identifies and extracts files, compressed data, filesystems, and other structures embedded inside firmware images.
Router firmware goes in. Suddenly you have configs, binaries, certificates, and actual components you can inspect.
07 Make the computer explore binaries for you
angr/angr — 9.1k★
angr is a Python framework for program analysis and symbolic execution.
Instead of manually following every branch through a binary, you can reason about which inputs reach particular states or code paths.
Reverse engineering starts becoming searchable.
08 Turn an unknown binary format into an executable specification
kaitai-io/kaitai_struct — 4.7k★
Kaitai Struct lets you describe binary file and network formats declaratively, then generates parsers for Python, Rust, Java, Go, C++, JavaScript, and more.
Once you understand the bytes, you do not have to reverse engineer them forever.
Write the format down and make it executable.
The workflow is almost embarrassingly clean:
unknown thing → inspect bytes → decompile → watch runtime → inspect traffic → extract internals → automate analysis → document the format
Reverse engineering used to feel like black magic.
OSS has slowly turned most of it into a toolbox.
Use it on software, devices, and systems you own or are authorized to analyze.