Tools for binaries

Native executables, firmware and shellcode.

80 tools indexed

Speakeasy

—

Windows kernel + user-mode emulator.

AnalyzeBinaries

PythonMIT

T3MP3ST

—

Multi-agent offensive-security harness that turns your AI coding agent into a bug hunter.

ExploitReconWeb appsSource code

TypeScriptAGPL-3.0

The Sleuth Kit

—

Filesystem forensics library.

AnalyzeEndpointsBinaries

CCustom

TinyInst

—

Lightweight dynamic instrumentation.

AnalyzeBinaries

C++Apache-2.0

UPX

—

Ultimate Packer for eXecutables.

AnalyzeBinaries

C++GPL-2.0

Unicorn Engine

—

Multi-arch CPU emulator framework.

AnalyzeBinaries

CGPL-2.0

Volatility 3

—

Memory forensics framework.

AnalyzeEndpointsBinaries

PythonVSL

WinAFL

—

AFL fork for Windows binaries.

FuzzBinaries

CApache-2.0

YARA

—

Pattern matching for malware research.

AnalyzeMonitorBinariesEndpoints

CBSD-3-Clause

YARA Rules

—

Community YARA rule repository.

MonitorAnalyzeBinariesEndpoints

YARAGPL-2.0

Z3

—

Theorem prover for SMT problems.

AnalyzeBinariesSource code

C++MIT

Zydis

—

Fast x86/x86-64 disassembler library.

AnalyzeBinaries

CMIT

al-khaser

—

Malware analysis evasion test suite.

AnalyzeBinaries

C++GPL-3.0

angr

—

Binary analysis with symbolic execution.

AnalyzeBinaries

PythonBSD-2-Clause

bulk_extractor

—

High-speed forensic feature extractor.

AnalyzeEndpointsBinaries

C++MIT

capa

—

Identify executable capabilities.

AnalyzeBinaries

PythonApache-2.0

dex2jar

—

DEX ↔ JAR conversion toolkit.

AnalyzeMobile appsBinaries

JavaApache-2.0

dnSpy

—

.NET assembly debugger and editor.

AnalyzeBinaries

C#GPL-3.0

flare-emu

—

IDA Pro emulation scripting framework.

AnalyzeBinaries

PythonApache-2.0

fq

—

jq for binary formats.

AnalyzeBinariesNetworks

GoMIT

hacksguard

—

Terminal-based malware triage toolkit written in Rust

AnalyzeScanBinaries

RustMIT

honggfuzz

—

Google's general-purpose fuzzer.

FuzzBinariesSource code

CApache-2.0

malcontent

—

Detect malicious capabilities in code, binaries and containers.

ScanAnalyzeBinariesSource code

GoApache-2.0

mkPIVM

—

Turn x86/x64 shellcode into polymorphic position-independent VMs.

ExploitAutomateBinariesEndpoints

C++MIT