Tools

The actively maintained, heavily extended fork of American Fuzzy Lop — coverage-guided mutational fuzzing for finding crashes in binaries and libraries.

afl-fuzz -i in -o out -- ./target @@

Python library and CLI for reverse-engineering Android apps programmatically — parses DEX/APK structure, builds call graphs and diffs for scripted analysis rather than manual GUI review.

androguard analyze app.apk

Python binary analysis platform combining symbolic execution, CFG recovery and taint tracking — the go-to for scripting a solve against a stripped pwn or reversing binary.

python3 -c "import angr; p = angr.Project('./chall'); print(p.factory.entry_state())"

Fingerprints an APK's toolchain, compiler and packer/obfuscator (PEiD for Android) — quickly flags whether a sample was built with a known obfuscation or packing tool.

apkid app.apk

Decodes Android APK resources back to a near-original form and rebuilds them after edits — the standard first step in Android reverse engineering and repackaging.

apktool d app.apk

Commercial disassembler and decompiler (with a free Cloud/Personal tier) built around a scriptable intermediate-language stack (LLIL/MLIL/HLIL) that is friendlier to automate than most.

Binary diffing tool (originally Zynamics, now Google) that matches functions between two versions of a binary — invaluable for spotting exactly what a patched-vs-unpatched CTF binary changed.

Visualizes a binary file as a space-filling curve image, making repeated structure, embedded files, and anomalies visually obvious — useful both for RE triage and for spotting a likely stego carrier.

Identifies and extracts embedded files and firmware images buried inside a binary blob — signature-scans for known file/filesystem headers and carves out what it finds.

binwalk -e firmware.bin

GTK hex editor for Linux with a plugin architecture and support for very large files — a lightweight option when a full RE hex-editor is overkill.

Protocol-aware fuzzing framework (fork/successor of Sulley) for building fuzzers against network services and file formats with defined message structures.

All-in-one Java/Android reverse engineering GUI bundling several decompilers (Procyon, CFR, FernFlower) side by side plus a bytecode editor and debugger.

Identifies capabilities in an executable — "reads the clipboard", "installs a service", "encrypts files" — by matching disassembly and API-call patterns, so an analyst gets a functional summary before doing manual reverse engineering.

capa malware.exe

Multi-architecture disassembly engine and library (with Python/C/Rust/… bindings) that many other RE tools — including Frida and Qiling — embed rather than write their own.

python3 -c "import capstone"

PE file viewer/editor (part of the Explorer Suite) for inspecting and hand-modifying PE headers, sections, imports and resources.

PE editor and viewer for manually inspecting and patching Windows executable headers, sections, imports and resources — a staple of PE-format malware triage.

Actively maintained Java decompiler that copes well with modern bytecode and mildly obfuscated class files.

java -jar cfr.jar ./Challenge.class --outputdir out

Memory scanner, debugger and code injector originally built for game hacking — the go-to tool for CTF "game reversing" challenges that ask you to find and patch a value in a running process.

Reports which exploit-mitigating protections (RELRO, stack canary, NX, PIE, RPATH) a binary was built with, the first thing to run against any new CTF pwn challenge.

checksec --file=./chall
# or from a pwntools script:
python3 -c "from pwn import *; print(ELF('./chall').checksec())"

Reports which exploit mitigations (NX, PIE, RELRO, canaries, stripped symbols) a binary was built with — the first command run against any new pwn challenge.

checksec --file=./chall

Generates Objective-C header files from a compiled Mach-O binary, exposing an iOS app or framework's class/method structure without source — the starting point for most iOS reversing.

class-dump -H MyApp.app/MyApp -o headers/

Community-maintained repository of "crackmes" — small deliberately-obfuscated binaries for practicing reverse engineering, searchable by language, platform and difficulty.

Zardus's collection of install scripts for a wide range of CTF tools, used to quickly provision a fresh box with a working pwn/RE toolchain instead of installing everything by hand.

./ctf-tools/pwntools/install.sh

Qt GUI built on top of Rizin, giving radare2-family analysis a graph view, decompiler panes and debugger without living in the r2 command line.

Deobfuscator for .NET assemblies that recognises and reverses common obfuscators (ConfuserEx, Babel, etc), a frequent prerequisite before a .NET CTF binary can be decompiled cleanly.

de4dot ./chall.exe

Python bytecode decompiler for 3.7-3.8 .pyc files — turns a compiled Python challenge back into readable source.

decompyle3 challenge.pyc

Signature-based packer, compiler and file-type identifier for PE/ELF/Mach-O binaries — the modern, actively maintained successor to PEiD for "what packed this".

diec ./sample.exe

Converts Android's Dalvik .dex bytecode into a standard .jar so ordinary Java decompilers (JD-GUI, Bytecode Viewer) can read it.

d2j-dex2jar.sh app.apk

Advanced binary diffing plugin for IDA/Ghidra with more heuristics than BinDiff for matching renamed or restructured functions across versions.

.NET assembly debugger, editor and decompiler in one — lets you set breakpoints and edit method bodies live inside a decompiled .NET binary, common in CTF "unmanaged reversing" of C# challenges.

.NET assembly editor, debugger and decompiler in one — edit IL or C# in place and re-save the assembly. The dnSpyEx fork carries on the original, now-archived dnSpy project.

Community-maintained continuation of dnSpy — a .NET assembly editor, debugger and decompiler, the standard tool for analysing .NET malware and unpacking .NET loaders.

Lightweight PE packer/compiler signature scanner with built-in unpacker scripts for common packers — a quick first pass before deeper static analysis.

Series of downloadable VM-based wargames (Phoenix, Nebula, Fusion and others) teaching binary exploitation fundamentals step by step.

strings piped through a targeted grep is still the fastest way to spot an embedded API key, password or URL in an unfamiliar binary.

strings -n 8 ./binary | grep -iE 'password|api[_-]?key|token|http://|https://'

IDA/Ghidra plugin that scans a binary for known cryptographic constants (AES S-boxes, SHA/MD5 initialisation vectors, CRC tables) and flags exactly where a crypto routine sits.

Mandiant's tool for extracting obfuscated/encoded strings from a binary by emulating the routines that decode them at runtime — surfaces strings plain `strings` cannot see.

floss ./chall

Mandiant's successor to plain `strings` for malware triage — statically emulates a binary just enough to decode stack strings, obfuscated strings and strings built at runtime that a normal string dump never reveals.

floss malware.exe

Dynamic instrumentation toolkit for injecting JavaScript into a running process to hook functions, dump traffic or bypass checks — as at home reversing a mobile app as a native binary.

frida -U -f com.target.app -l hook.js --no-pause

The GNU Debugger, and GEF — the plugin that turns it into a usable exploit-development environment with heap analysis, ASLR/PIE-aware context, and pwn-focused conveniences GDB alone doesn't have.

gdb -q ./binary

Another exploit-dev focused GDB plugin, with heap/format-string/ropper helpers and a large command set; the main alternative to pwndbg.

bash -c "$(curl -fsSL https://gef.blah.cat/sh)"

Generates a De Bruijn-style non-repeating pattern to feed a crashing binary, then recovers the exact byte offset to the overwritten return address/register from the crash value.

python3 -c "from pwn import *; print(cyclic(200))"
# after the crash, recover the offset from the corrupted value:
python3 -c "from pwn import *; print(cyclic_find(0x6161616161616161))"

NSA's free, open-source software reverse-engineering suite — disassembler, decompiler and a scripting API, the free alternative most people reach for before IDA Pro.

Downloads and builds any historical glibc version with debug symbols so a pwn exploit can be developed and tested against the exact libc the target ships.

./download.sh
./build.sh 2.31-0ubuntu9.9 amd64

Google's security-oriented fuzzer that can drive coverage from hardware performance counters as well as compile-time instrumentation, useful when source is unavailable.

honggfuzz -i in -o out -- ./target ___FILE___

Commercial disassembler/decompiler for macOS and Linux binaries (x86/x64/ARM), a common pick where Ghidra/IDA feel heavier than a single-binary CTF challenge needs.

Shellphish's collection of annotated, runnable examples of glibc heap exploitation techniques (fastbin dup, unsafe unlink, tcache poisoning and more) across libc versions — the standard reference for learning heap pwn.

The long-standing commercial gold standard for disassembly and decompilation — deep processor/format support and a mature plugin ecosystem, still the default in a lot of professional RE work.

Open-source .NET decompiler with a CLI (ilspycmd) for scripted use alongside the desktop app, decompiling IL back to readable C#.

ilspycmd MyAssembly.dll -o out/

Hex editor built for reverse engineering, with a C++-like pattern language for describing and colour-highlighting a binary format live as you scroll through it.

Windows debugger built for exploit development, with a Python API and the PyCommands ecosystem (mona.py) that a lot of older exploit-dev writeups still assume.

Decompiles Android DEX bytecode back into readable Java source, with a GUI for browsing the result — usually paired with Apktool for a full APK reversing workflow.

jadx app.apk

Standalone Java decompiler GUI for browsing .class/.jar bytecode as reconstructed source — quick and disposable compared to a full IDE decompiler plugin.

IDA plugin that uses Keystone to assemble and patch instructions directly in the disassembly view, instead of hand-editing raw bytes.

Multi-architecture assembler framework from the Capstone team — turns assembly text back into machine code for shellcode and patch development.

Symbolic execution engine that runs LLVM bitcode and generates test cases covering every path it can reach — used for both bug-hunting and CTF challenges compiled to bitcode.

klee ./program.bc

Java decompiler and assembler that specifically handles malformed or deliberately obfuscated class files other decompilers choke on — a favourite when a CTF Java challenge fights back.

Lists a binary's dynamic library dependencies and where it resolves them from — if one resolves to a directory you can write to, that's a privesc primitive.

ldd ./suspicious-binary

Local database and search tool for identifying which glibc build a leaked symbol address or offset belongs to, once you have leaked one libc pointer.

./find printf 7c0

Python library that searches a local libc-database for the exact libc version matching one or more leaked symbol addresses, then resolves the offsets of other symbols in it.

In-process, coverage-guided fuzzing engine linked directly into an LLVM/Clang target — the standard way to fuzz a single function without forking a process per input.

clang -fsanitize=fuzzer,address target.c -o fuzz && ./fuzz

Library to parse, modify and abstract ELF, PE and Mach-O binaries from a single API — handy for scripting patches (add a section, change an entry point) without reaching for a hex editor.

Queries the public libc.rip / libc-database mirror with one or more leaked symbol addresses to identify the exact libc build a remote pwn target is running.

curl -s https://libc.rip/api/find -H 'Content-Type: application/json' -d '{"symbols":{"printf":"0x7f..."}}'

Hex-editor-meets-static-analyzer built for malware and CTF work — combines hex view, disassembly, string extraction, entropy visualisation and YARA scanning in one IDE-like window.

Static PE analysis tool aimed at malware triage — plugin architecture scores suspicious imports, packing, resources and sections and can run YARA rules over the binary.

manalyze --dump=all suspicious.exe

Trail of Bits' symbolic execution tool for exploring a binary's (or EVM contract's) execution paths and generating concrete inputs that reach a chosen state.

manticore ./chall

Python reverse-engineering framework covering disassembly, lifting to an intermediate representation, emulation and symbolic execution across several architectures.

Finds single-address "one gadget RCE" offsets inside a given libc that pop a shell if a small set of register/memory constraints happen to hold — a pwn-exploit shortcut.

one_gadget ./libc.so.6

Modifies an ELF's dynamic linker (interpreter) and RPATH after the fact — the standard way to force a CTF pwn binary to run against a downloaded libc instead of the host's.

patchelf --set-interpreter ./ld-2.31.so --set-rpath . ./chall

GUI PE file analyzer for inspecting and editing headers, sections, imports and resources of Windows executables — a staple for manual PE malware/CTF triage.

hasherezade's scanner for detecting and dumping malicious implants (process hollowing, reflective DLL injection, shellcode) from a single running Windows process, recovering an unpacked copy for analysis.

pe-sieve64.exe /pid 1234

Python Exploit Development Assistance for GDB — an older but still-used GDB enhancement predating pwndbg/GEF, with register/stack context and pattern-offset helpers.

echo "source ~/peda/peda.py" >> ~/.gdbinit

Python library for parsing and editing PE files, used to script header/section/import inspection instead of clicking through a GUI.

python3 -c "import pefile; pe = pefile.PE('chall.exe'); print(pe.dump_info())"

Open-source Python tool for static malware analysis of PE files — extracts strings, imports, indicators of packing and generic obfuscation with a simple CLI report.

peframe suspicious.exe

Static PE-file triage tool that surfaces imports, strings, resources and known-bad indicators in a suspicious Windows executable up front — designed specifically to be run without ever executing the sample.

Collection of LD_PRELOAD libraries (desock, patchmain and others) that make CTF pwn binaries easier to run and fuzz locally, e.g. turning a socket-only server into one that reads stdin.

LD_PRELOAD=./desock.so ./chall

Java decompiler with particularly good handling of modern language features (lambdas, generics) compared to older decompilers.

java -jar procyon.jar -o out ./Challenge.class

Long-running wargame focused on system/binary exploitation ("pwnable") challenges of increasing difficulty, one of the most cited practice grounds for CTF pwn.

Taiwan-based binary exploitation wargame in the same spirit as pwnable.kr, with a broad and well-regarded set of pwn challenges.

GDB plugin adding heap/memory visualisation, exploit-dev commands and better context display for pwn work — one of the two dominant GDB enhancements alongside GEF.

echo "source ~/pwndbg/gdbinit.py" >> ~/.gdbinit

scwuaptx's GDB script (Pwngdb) and companion IDA Pro plugin (angelheap) for visualising glibc heap chunks, bins and tcache state during a heap exploitation session.

Automates the pwn-challenge setup chores: patches a binary's interpreter/rpath to a given libc, fetches a matching ld.so, and scaffolds a pwntools solve script.

pwninit

A Python CTF/exploit-development library — process interaction, packing/unpacking, ROP chain building and remote connection handling, the framework almost every pwn writeup script is built on.

from pwn import *
p = remote('target', 1337)

C++ Python bytecode decompiler covering a much wider range of Python versions than most pure-Python decompilers, handy when a challenge ships an unusual interpreter version.

./pycdc challenge.pyc

Python library for parsing ELF and DWARF, used to script section/symbol/relocation inspection of a Linux binary.

Higher-level binary emulation framework built on Unicorn that emulates whole userspace programs (Linux/Windows/macOS/firmware) including syscalls, letting you run a target off its own OS.

qltool run -f ./sample --rootfs ./rootfs

Bridges radare2's static analysis and Frida's dynamic instrumentation into one session, so a mobile (or desktop) binary can be disassembled and hooked from the same prompt.

r2 frida://usb//com.example.app

General-purpose test-case mutator that takes sample inputs and spits out mutated variants — a quick way to build a crude fuzzing corpus for a CTF parser challenge.

radamsa -n 1000 -o out-%n.bin sample.bin

A free, scriptable reverse-engineering framework — disassembler, debugger, hex editor and binary analysis in one command-line-first toolset, with the Cutter GUI on top for those who want it.

r2 -A ./binary

Avast's open-source retargetable machine-code decompiler covering several architectures (x86, ARM, MIPS, PowerPC) and executable formats, usable as a CLI or library.

retdec-decompiler ./chall

Reverse-engineering focused wargame site with a long-standing set of crackme-style challenges.

Community fork of radare2's core, focused on a cleaner API and UX while keeping the same disassembly/analysis engine; Cutter is its official GUI front end.

rz-bin -I ./binary

A structured series of binary exploitation challenges purpose-built to teach ROP techniques, with the same challenge repeated across x86, x86-64, ARM and MIPS builds.

Scans a binary for usable ROP/JOP gadgets and can auto-build a full ROP chain — the standard first step once a pwn challenge needs code reuse instead of shellcode.

ROPgadget --binary ./chall --ropchain

Automatic ROP chain generator that reasons about gadget semantics rather than just pattern-matching mnemonics, so it can combine several gadgets to satisfy a constraint no single gadget meets.

Gadget finder and ROP-chain builder similar to ROPgadget, with its own semantic gadget search (e.g. "pop rdi; ret") across ELF/PE/Mach-O.

ropper --file ./chall --search "pop rdi"

Import table reconstruction and process-dumping tool, used to rebuild a valid PE from a manually-unpacked process image whose imports were resolved at runtime.

Anti-anti-debug plugin for x64dbg, OllyDbg and IDA that hides the debugger from common Windows detection checks (PEB flags, timing checks, NtQueryInformationProcess).

Dumps and disassembles a running process's seccomp-BPF syscall filter, which pwn challenges use to restrict which syscalls a shellcode-based exploit is allowed to make.

seccomp-tools dump ./chall

Shellcode development toolkit for converting between asm/opcode/C-string/objdump representations and testing shellcode in an isolated environment.

Mandiant's Windows binary emulator for malware analysis — runs a sample's code against an emulated Windows API surface to observe its behaviour (registry, network, file activity) without a full sandbox VM or real execution.

speakeasy -t malware.exe -o report.json

Traces every syscall a binary makes — the fastest way to spot a privesc-relevant file it reads/writes, or a library it loads from a writable path.

strace -f -e trace=open,openat,execve ./suspicious-binary 2>&1 | less

Extracts printable character sequences from a binary file — the first, fastest thing to run against any unknown file, from GNU binutils.

strings -n 8 suspicious.bin | less

Microsoft's classic Windows diagnostics suite (Process Monitor, Process Explorer, Autoruns) — used in RE to watch a challenge binary's file/registry/process activity live instead of guessing from static analysis.

Coverage-guided kernel fuzzer built by Google, used to find Linux/Windows/macOS kernel bugs that CTF kernel-pwn challenges are frequently modelled on.

Kernel-mode driver that hides a debugger's presence from a target process at a lower level than user-mode hooking alone can reach.

Dynamic binary analysis library combining symbolic execution and taint analysis, usable as a scriptable engine for deobfuscation and constraint solving in RE work.

Lightweight, multi-architecture CPU emulator library used to run a snippet of machine code (or an entire firmware routine) in isolation to observe its behaviour without real hardware.

The ultimate packer for executables — used legitimately to shrink binaries, but in CTF reversing it usually shows up the other way round: unpacking a UPX-wrapped challenge binary.

upx -d packed_binary

Google Project Zero's fork of AFL targeting Windows binaries, using DynamoRIO instrumentation to fuzz closed-source Windows executables and DLLs.

Open-source user-mode x86/x64 debugger for Windows with a plugin ecosystem (ScyllaHide, x64dbgpy) that is the de facto free alternative to OllyDbg/Immunity on modern binaries.

Microsoft's SMT solver, used constantly in CTF reversing and crypto to turn 'find x such that these constraints hold' into a script instead of manual algebra — a frequent shortcut past custom validation logic.

python3 -c "
from z3 import *
x = BitVec('x', 32)
s = Solver()
s.add(x * 3 + 7 == 100)
print(s.check(), s.model())
"

Microsoft Research's SMT solver, scripted from Python to encode a challenge's constraints (a keygen check, a crypto relation, a logic puzzle) and let the solver produce a satisfying input.

python3 -c "from z3 import *; s = Solver()"

Transparent input fuzzer that randomly flips bits in a program's input stream via LD_PRELOAD, a quick way to probe robustness without instrumenting the target.

zzuf -s 0:100 ./parser input.bin