The core: taking software apart when you don't have the source. Start with the foundations if assembly is new to you, then the tools. The malware-specific workflow lives in malware analysis once that section lands.
- Reverse Engineering for Beginners - Dennis Yurichev's free ~1000-page book (also known as RE4B). Puts C and C++ next to their x86/x64, ARM, and MIPS assembly, line by line. The standard free on-ramp.
bookintro - OpenSecurityTraining2 - free, university-style courses with exercises: x86-64 assembly, computer architecture, debugging, and RE. Structured material, not a video dump.
courseintro - Malware Unicorn RE101 - a self-contained workshop on RE fundamentals framed around malware, with a follow-on RE102.
courseintro - Azeria Labs - the reference free tutorials for ARM assembly and ARM exploitation, starting from registers.
introworking - mytechnotalent/Reverse-Engineering - a free from-scratch course working up through assembly and Ghidra on ARM and x86.
courseintro - crackmes.one - the practice ground: thousands of small "defeat this" binaries, graded by difficulty and platform. Reading about RE only gets you so far.
ctf - Reversing for Everyone - a free, from-zero reverse-engineering book.
bookintro - Z0F Reverse Engineering Course - a free course focused on x64 Windows reverse engineering, from fundamentals up.
courseintro - x86 Software RE, Cracking & Counter-Measures - companion material to the book: x86 reversing and software-protection study.
courseworking - Introduction to Reverse Engineering with Ghidra - VoidStar's lab-style Ghidra intro using small binaries, cross-references, strings, and patches.
intro - Ghidra Software Reverse Engineering for Beginners code - companion project files for Packt's Ghidra book, useful when following the exercises.
working - Reverse Engineering Armv8-A Systems code - companion code for Packt's ARMv8-A reversing book, with ELF and firmware-style lab material.
working - Advanced Binary Analysis - hands-on workshop material covering lifting, symbolic execution, obfuscation, and packer exercises.
courseworking - Ghidra quickstart & tutorial - stacksmashing solves a simple crackme in Ghidra end to end; the fastest first hour with the tool.
videointro - Pwn Adventure 3 - LiveOverflow's 26-part series hacking a real 3D MMO: memory, packets, and cheats, learned by doing.
videocourse - REpsych: Psychological Warfare in Reverse Engineering - Chris Domas' DEF CON 23 talk on hiding pictures in a function's control-flow graph; equal parts fun and instructive.
videodeep
- Ghidra - the NSA's open-source RE suite with a multi-architecture decompiler. The default free alternative to IDA, and the reason a beginner no longer needs an expensive licence to start.
free - IDA Free - the free edition of IDA, the long-time industry standard. Recent versions bundle the cloud decompiler; paid editions add architectures and the local decompiler.
paid - Binary Ninja - commercial disassembler built around a clean multi-level IL (BNIL) and a strong scripting API; a free in-browser version handles small binaries.
paid - Hopper - commercial disassembler and decompiler for macOS and Linux, popular for Mach-O and iOS work.
paid - radare2 - the veteran open-source RE framework. All command line, fully scriptable, notoriously steep - but it does everything.
free - rizin - a radare2 fork focused on a cleaner codebase and usability; the engine underneath Cutter.
free - Cutter - the free GUI over rizin, with an optional Ghidra decompiler. The gentlest way into the r2/rizin world.
free - RetDec - Avast's open-source machine-code decompiler; works standalone or as an IDA/Ghidra plugin.
free - Relyze - commercial interactive RE tool for Windows with built-in binary diffing.
paid - iaito - the official radare2 GUI, closer to raw r2 workflows than Cutter.
tool - IDA Pro MCP - MCP bridge that lets LLM clients query and annotate an IDA database during RE.
tool - ida9rewriter - rewrites older IDAPython scripts toward the IDA 9 API changes.
tool - Rubber Room - browser PE analyzer: reads PE32/PE32+, NE, LE/LX and DOS MZ images with x86-64 disassembly, decompilation and a debugger that runs 64-bit Windows console programs on emulated Win32 functions. Nothing is uploaded.
free
- x64dbg - the open-source x86/x64 debugger for Windows, and the default for Windows malware RE. Plugins, scripting, and bridges to Ghidra and IDA.
free - WinDbg - Microsoft's user- and kernel-mode debugger. The one you need for Windows internals, drivers, and crash dumps.
free - GDB - the standard Unix debugger, and the base the two plugins below extend.
free - pwndbg - GDB plugin for RE and exploitation: heap visualisation, a readable context view, and process introspection.
free - GEF - GDB Enhanced Features; same territory as pwndbg, single file, thoroughly documented.
free - LLDB - the LLVM project's debugger, and the default on macOS.
free - Frida - dynamic instrumentation: inject JavaScript into a live process to hook, trace, and rewrite functions at runtime. Widely used in mobile and malware analysis.
free - HyperDbg - a hypervisor-assisted debugger for deep kernel work and analysis that resists ordinary debuggers.
free - OllyDbg - the classic 32-bit Windows user-mode debugger; superseded by x64dbg but still referenced across older tutorials.
free
For automation, symbolic execution, emulation, and building your own tooling.
- angr - the Python binary-analysis framework: symbolic execution, CFG recovery, and constraint solving. A workhorse for CTF and research.
working - fnprint - behavioral function fingerprinting: names functions in stripped ELF binaries and patch-diffs vuln vs patched builds by microexecuting each function rather than matching bytes or CFG. Runs untrusted binaries in a seccomp-jailed worker.
working - Triton - dynamic symbolic execution and taint analysis as a C++/Python library.
deep - Miasm - assemble, disassemble, lift to IR, emulate, and run symbolic execution in one framework.
deep - BAP - CMU's Binary Analysis Platform; OCaml, research-grade, plugin-driven.
deep - Capstone - the multi-architecture disassembly engine a large share of other tools are built on.
free - Unicorn - a lightweight multi-arch CPU emulator (QEMU-derived) for running code fragments in isolation.
free - Keystone - the assembler framework that pairs with Capstone.
free - redress - recovers types and function names from stripped Go binaries.
free - DiffRays - binary patch diffing for vulnerability research and 1-day analysis.
free - reverser_ai - automated reversing assistance using local LLMs on consumer hardware.
free - IAT-Tracer - traces functions through the import table, built on Tiny-Tracer.
free - Diaphora - the most advanced open-source binary-diffing plugin for IDA.
free - BinDiff - Google's free binary-diffing tool for comparing builds and porting analysis.
free - Dependencies - a modern, open Dependency Walker replacement for tracing PE imports.
free - rz-ghidra - the Ghidra decompiler as a rizin and Cutter plugin.
free - ERESI - an old but complete ELF reverse-engineering and instrumentation framework with its own scripting language.
tooldeeparchived
- ImHex - a hex editor built for reversers: a C-like pattern language for mapping a file's structure, a data-processor graph, an entropy view, and a built-in disassembler.
tool - Kaitai Struct - describe a binary format once in a
.ksyspec and compile parsers for a dozen languages; ships a gallery of ready-made specs for common formats.tool - Hex Harbinger - browser hex editor with structure templates for PE, MZ, ELF, COFF, Mach-O, ZIP, PNG, DEX, WIM and PDF; nothing is installed or uploaded. Marked alpha.
free
Binaries from managed and interpreted runtimes carry their own metadata - the right tool recovers far more than a raw disassembler.
- dnSpyEx - the maintained fork of dnSpy: decompile, edit, and live-debug .NET assemblies with an inline IL/C# view. The default for .NET RE.
tool - ILSpy - open-source .NET decompiler and assembly browser; the cross-platform companion to dnSpy.
tool - Bytecode Viewer - a Java and Android APK suite that runs six decompilers (Procyon, CFR, FernFlower, JADX…) side by side.
tool - pyinstxtractor - unpacks PyInstaller executables back to their
.pycfiles, the first step in reversing "compiled" Python.tool - decompyle3 - decompiles Python 3.7+ bytecode back to readable source.
tool - GoReSym - Mandiant's parser that recovers function names, types, and metadata from stripped Go binaries.
tool
- Trail of Bits - deep posts on program analysis, cryptography, and vulnerability research.
blog - Quarkslab - reverse engineering, cryptography, and low-level security research.
blog - Synacktiv - offensive research and Pwn2Own writeups.
blog - Hex-Rays - the IDA makers on decompiler internals and RE technique.
blog - NCC Group Research - broad security research, including RE and exploitation.
blog - secret.club - a collective's blog on anti-cheat, RE, and low-level tricks.
blog - Margin Research - reverse engineering and vulnerability research.
blog - Doyensec - application and low-level security research.
blog - Megabeets - radare2 tutorials and reverse-engineering writeups.
blog - Möbius Strip Reverse Engineering - Rolf Rolles on program analysis, deobfuscation, and decompilation theory.
blogdeep - David Buchanan (retr0id) - file-format wizardry, PNG/PDF tricks, and offbeat exploitation.
blogdeep - Addition, XOR, Roll - Thomas Dullien (Halvar Flake) on program analysis, reverse engineering, and security theory.
blogdeep - revers.engineering - Daax's Applied Reverse Engineering series and deep hypervisor-development writeups.
blogdeep - The Reverser's Draft - reverse-engineering and malware-analysis writeups.
blog - s0uthwood - reverse-engineering and angr symbolic-execution writeups.
blog - j00ru - Mateusz Jurczyk (Google Project Zero) on Windows kernel bugs, font and codec fuzzing, and long research series.
blogdeep - RageStorm - Gil Dabah, author of diStorm, on x86/x64 disassembly, Windows kernel bugs, and Win32k internals.
blogdeep - Gynvael Coldwind - reverse engineering, CTF, vulnerability research, and low-level programming, from a long-running researcher.
blog - Xakep (Хакер) - the long-running Russian security magazine; deep reverse-engineering, malware, and exploitation features.
blogru - Ramen Software - Michael Maltsev's tools and notes: Multiline Ultimate Assembler for x64dbg and OllyDbg, Windhawk, and Resource Hacker FX.
toolblog - terrynini - Balsn member on IDA plugin tricks for debugging and diffing WebKit source against shipped Safari patches.
blogdeep - Maple Bacon - UBC's team blog; includes reversing a custom CPU architecture from its DMA behavior.
blog - TeamRocketIST - Portuguese team archive with steady RE and pwn writeups.
blog - 86hh - hh86's site, hosting the complete four-issue Valhalla zine archive plus his CFG-teleportation and shellcode-golfing papers.
blogdeep - H4X research - the "Touching Small ELFs" series on how far ELF parsers can be pushed before real tools break.
blogdeep - evilpan - Chinese researcher writing on Android, iOS and tooling internals; long posts, no filler.
blogdeepzh - Symgrate - Travis Goodspeed's SVD database and web API for recovering peripheral symbols in stripped firmware.
tooldeep - can.ac - can1357 on kernel and systems work, including his own JIT and virtualization projects.
blogdeep - es3n1n - obfuscation and deobfuscation engineering from someone who writes both sides.
blogdeep - blob.re - self-hosted reversing and fuzzing notes.
blogworking - Willi Ballenthin - author of capa and FLOSS, writing on disassembly, emulation, and RE tooling in Python and Rust.
blogdeep - redplait - years of undocumented Windows kernel notes, lately reversing NVIDIA's toolchain: the PTX grammar out of ptxas, SASS latencies, fatbin internals.
blogdeep
- Symbolic Execution, Part 1 - a from-scratch introduction to symbolic execution.
writeup - Symbolic Execution for fun and Flare-On - applying symbex to solve a real Flare-On challenge.
writeup - Developing a WinDbg extension in C++ - extending your debugger to do the boring parts for you.
writeup - Reverse engineering the Yamaha DX7 - Ken Shirriff reverses a synthesizer down to the silicon.
writeup - ghidriff: Ghidra binary diffing - building a patch-diffing engine on top of Ghidra.
writeup - RE tips: run-time type identification - recovering C++ class info from RTTI.
writeup - Reverse engineering Dark Souls 3 networking - a long, careful game-protocol RE writeup.
writeup - angr_ctf: symbolic memory - a worked angr symbolic-execution exercise.
writeup - Exploring Ghidra's decompiler internals - NCC Group on P-code and automatic analysis scripts.
writeupdeep - Reverse engineering WebAssembly - reversing a WebAssembly module, from the JEB team.
writeup - Reverse engineering integrity checks in Black Ops 3 - defeating a game's anti-tamper, step by step.
writeuparchived - Porting an IDAPython Plugin to IDA 9 - concrete replacements for APIs removed or changed in IDA 9.
writeup - Writing a Debugger From Scratch - TimDbg's Rust debugger series, starting with attaching to a Windows process.
writeupworking - Ghidra Basics: Cobalt Strike shellcode - uses Ghidra and x32dbg to recover API hashes, the ROR13 hash loop, and the C2 address from beacon shellcode.
writeup - Reverse engineering Ticketmaster's rotating barcodes - working out the rotating-token scheme behind SafeTix from the client side alone.
writeupdeep - CPU Adventure: reversing an unknown CPU - Robert Xiao recovers an entire unknown instruction set from nothing but traces.
writeupdeep - Dis86 - xorvoid's log of building a from-scratch 16-bit x86 decompiler to recover a DOS game.
writeupdeep - Reversing the NeXT keyboard protocol - Spencer Nelson works out an undocumented hardware protocol with a logic analyzer.
writeupworking - Factorio's RNG - recovering a game's random number generator from the binary.
writeupworking - Reversing an ASIC - Kjartan van Driel going down to silicon.
writeupdeep - Reverse engineering undocumented APIs - method for pulling apart private mobile and web APIs.
writeupworking - Bypassing JEB's licence check with a Java agent - instrumenting a JVM application to defeat its own protection.
writeupdeepzh - Dynamic instrumentation against a crackme - a worked thread from elhacker's long-running reversing board.
writeupworkinges - DeepBinDiff - Duan, Li, Wang and Yin learn program-wide basic-block embeddings for cross-version binary diffing with no labelled data.
paperdeep - DeGPT: Optimizing Decompiler Output with LLM - pairs an LLM rewriter with a control-flow-preserving verifier so renaming cannot silently change semantics.
paperdeep - NEMESYS - infers unknown network message formats from the structure of single messages instead of large traffic traces.
paperdeep - Divergent Representations - Kellas, Cao, Goodman and Yang on compiler optimisations producing exploitable behavior that source-level analysis cannot see.
paperdeep - AirTag of the Clones - Roth, Freyer, Hollick and Classen reverse Find My item finders and ship the glitcher and hooks.
paperdeep
- Awesome-Reversing - a broad RE resource list, well organised by subtopic.
reference - awesome-ghidra - everything Ghidra: plugins, scripts, and extensions.
reference - HackTricks: reversing & exploiting - the reversing section of the sprawling HackTricks wiki.
reference - Interactive IDA Plugin List - searchable IDA plugin index with categories, install links, and compatibility notes.
reference
- The IDA Pro Book - Chris Eagle's reference on getting the most out of IDA.
book - Practical Binary Analysis - Dennis Andriesse's book on binary analysis, instrumentation, and building your own tools.
book - PoC‖GTFO - the "International Journal of PoC or GTFO": file-format tricks, exploitation, and polyglots.
zine - tmp.0ut - a zine of low-level ELF, binary, and Unix-internals wizardry.
zine
Links verified 2026-07-06. Found rot? Open an issue or PR.