Skills

Awesome Reverse Engineering: Pick Reverse Engineering Tools and Learning Resources by Task

Best for quickly finding reverse engineering tools and learning resources by task, especially for wiring Ghidra/radare2-style analysis into an AI agent via MCP; it is only a curated list with no install commands, so real tools and prerequisites must be confirmed in each upstream project's docs.

Official source · Awesome Reverse Engineering

Install

浏览 README 任务索引：https://github.com/morluto/awesome-reverse-engineering

Who It's For

  • Anyone doing reverse engineering of binaries, apps, firmware, file formats, or protocols who needs to quickly find the right tools and learning resources for the task at hand.
  • People who want to give AI agents reverse analysis capabilities: the list has an AI-assisted analysis section featuring projects that expose existing analysis tools to agents via MCP, such as Binary Ninja MCP Server, GhidraMCP, and radare2 MCP.
  • Who it's not for: if you expect a complete tool you can install and have an agent call automatically, this repository itself is not a tool — it is a curated list (CC0 1.0 licensed); the actual tools live in the upstream repositories each entry points to.
  • Prerequisites: some commercial tools (e.g., IDA, Binary Ninja, Burp Suite, Malcat) require licenses and are explicitly tagged commercial; for malware analysis, the official guidance is to run samples only in isolated, disposable environments and follow your organization's security handling procedures. The software required by each tool category and the supported clients must be confirmed in the corresponding upstream documentation — this page does not cover that.

First Attempt in 3 Minutes

The recommended main path is to browse the task index in the repository's README rather than install anything:

  1. Open https://github.com/morluto/awesome-reverse-engineering . The README is organized by type of work, every entry states its purpose, and commercial tools carry a commercial tag.
  2. Use the task-style index at the top of the page to locate your need, e.g., "analyze binaries with AI/MCP" or the malware analysis section.
  3. Follow the upstream links of tools or MCP projects that interest you, read their official documentation first to confirm required software and supported clients, and only then decide whether to install. The page itself contains no install commands or scripts — all installation happens through the official process of the upstream tools.
  4. Success signal: you can find at least one entry that fits your needs and whose license/budget is acceptable, and you have confirmed its installation method from the upstream documentation.

The official notes explicitly remind that agent integration merely exposes existing analysis tools to agents or coordinates investigations; agent conclusions must be verified against real code and runtime evidence. Whether the MCP projects read/write files, execute commands, or access the network is not stated on this page — it is unknown — so confirm item by item in the upstream docs before integrating. Tasks involving malicious samples require a prepared isolated environment first; this is a mandatory prerequisite before use.

Use Cases

Case 1: Give an agent binary analysis capabilities. Scenario: you are using an MCP-capable client and want the agent to analyze a native binary. How to start: tell the agent "analyze this file using GhidraMCP (or radare2 MCP)". It will use the corresponding MCP projects listed in the list's AI section. How far you can verify: the list confirms these MCP projects exist and links to their upstreams; client support, analysis depth, and result formats are up to the upstream docs, and the official guidance requires you to verify the agent's conclusions against real code and runtime evidence.

Case 2: Pick a tool by task. Scenario: you need to reverse a protocol or file format but don't know what to use. How to start: no agent needed — go straight to the protocol/format section of the README's task index, read each entry's purpose description, and check license/budget for anything tagged commercial first. What to expect: several candidate tool links with purpose descriptions; installation and usage steps for the tools themselves are in their respective upstream docs, not on this page.

Boundaries of Use

  • This repository only provides links and descriptions; it performs no file, command, or network operations. Real side effects come from the upstream tools you select, which must be verified one by one before integration.
  • Malware analysis has a clear restriction: samples may only be run in isolated, disposable environments.
  • Runtime environment and client prerequisites: the OS, dependency, and agent client requirements of the various tools are not listed on this page — unknown — and must be checked in the upstream docs.
  • This page makes no statements about supported text or binary language ranges or platform compatibility; do not infer them on your own.
  • Note the distinction: the «REA» entry in the repository is an agent-oriented reverse engineering toolkit from the same author; this list is only a navigator — their purposes differ.