Malware Analysis & Reverse Engineering
Sandboxes, disassemblers, debuggers and related tooling for examining suspicious binaries and scripts in controlled environments. Endpoint detection products belong in Defensive Security & Monitoring; exploit frameworks belong in Offensive Security & Pentesting.
REA (Reverse Engineer Anything)
REA is an open-source, agent-driven reverse engineering tool used to analyze binaries, Android APKs, and app behavior for security researchers and developers.
Malware Analysis & Reverse EngineeringFreeOpen source
angr
angr is a free binary analysis platform used to explore program behavior with symbolic execution for reverse engineers and vulnerability researchers.
Malware Analysis & Reverse EngineeringFreeOpen source
Detect It Easy (DiE)
Detect It Easy is a free file identification tool used to detect compilers, packers, and file types for malware analysts and reverse engineers.
Malware Analysis & Reverse EngineeringFreeOpen source
binwalk (ReFirmLabs)
binwalk is a free open source firmware analysis tool used to find and extract embedded files and file systems from binary images for researchers and analysts.
Malware Analysis & Reverse EngineeringFreeOpen source
Rizin
Rizin is a free reverse engineering framework used to disassemble, debug, and analyze binaries from the command line for malware analysts and researchers.
Malware Analysis & Reverse EngineeringFreeOpen source
Cutter
Cutter is a free open-source reverse engineering platform used to disassemble, decompile, and debug binaries through a GUI for malware analysts and researchers.
Malware Analysis & Reverse EngineeringFreeOpen source
capa
capa is a free open-source tool from Mandiant's FLARE team used to identify what an executable can do, such as persistence or injection, for malware analysts.
Malware Analysis & Reverse EngineeringFreeOpen source
radare2
radare2 is a free open-source command-line reverse engineering framework used to disassemble, debug, and patch binaries for malware analysts and CTF players.
Malware Analysis & Reverse EngineeringFreeOpen source
Binary Ninja
Binary Ninja is a freemium reverse engineering platform used to disassemble, decompile, and debug compiled programs for malware analysts and researchers.
Malware Analysis & Reverse EngineeringFreemium
x64dbg
x64dbg is a free open-source Windows debugger used to step through executables and DLLs without source code for malware analysts and reverse engineers.
Malware Analysis & Reverse EngineeringFreeOpen sourceYARA-X
YARA-X is the free open-source Rust rewrite and successor of YARA, used to scan files with pattern rules and sort malware into families for malware researchers.
Malware Analysis & Reverse EngineeringFreeOpen sourceYARA
YARA is a pattern-matching tool used to identify and classify malware samples for malware researchers, and it is free under the BSD 3-Clause license.
Malware Analysis & Reverse EngineeringFreeOpen source
CyberChef
CyberChef is a free open-source web app from GCHQ for encoding, decoding, hashing and transforming data during security analysis and investigations.
ANY.RUN
ANY.RUN is an interactive malware sandbox with a free Community tier plus paid Hunter and Enterprise plans for private, deeper analysis.
Malware Analysis & Reverse EngineeringFreemium
Frida
Frida is a free open-source dynamic instrumentation toolkit for hooking and tracing running apps on desktop, mobile and embedded platforms.
IDA Pro
IDA Pro is Hex-Rays commercial multi-architecture disassembler and decompiler suite for professional reverse engineering, sold as yearly Pro subscriptions.
Malware Analysis & Reverse EngineeringPaid
Volatility
Volatility is an open-source memory forensics framework for extracting digital artifacts from RAM dumps during incident response and malware analysis.
Ghidra
NSA open-source software reverse-engineering suite for disassembly, decompilation and binary analysis on many processor architectures.
Malware Analysis & Reverse EngineeringFreeOpen source
VirusTotal
Online multi-engine scanner for analyzing files, URLs, domains and IPs for malware signals, with free public and paid tiers.
Malware Analysis & Reverse EngineeringFreemium