Malware Analysis GitHub Repositories (2026) · Open Source Tools

Curated reverse-engineering tools and learning resources for binaries, apps, firmware, formats, and protocols.

Stop your AI from making things up — it proposes, deterministic tools decide, every claim checked against ground truth with evidence. Grounded facts and context survive resets. Reverse engineering is the proving ground. MCP server + CLI.

Program for determining types of files for Windows, Linux and MacOS.

BINNY: an open source agent harness for reverse engineering. Plug in any model, or a local one.

Windows-based AI-powered Reverse Engineering Toolkit "AIO", Built for Security (Malware analysis, Pentesting) & Educational purposes.

0-day malware detection for binaries, source & scripts (that doesn't suck)

MISP (core software) - Open Source Threat Intelligence and Sharing Platform

Exploit Development and Reverse Engineering with GDB & LLDB Made Easy

WinDbg-like kernel debugger for Windows, from Linux and macOS

LIEF - Library to Instrument Executable Formats (C++, Python, Rust)

APK/DEX detector for Windows, Linux and MacOS.

Run Windows and Linux programs on Windows, Linux and Android. A user-mode NT and Linux kernel emulator with WHP/KVM acceleration.

🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙‍♀️

The FLARE team's open-source tool to identify capabilities in executable files.

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

Portable Executable reversing tool with a friendly GUI

Windows kernel and user mode emulation.

Open-source AI reverse-engineering agent platform and MCP server for Ghidra, Frida, x64dbg and Rizin — automated PE/APK/binary analysis, CTF and malware research, with 100+ MCP tools and a 194-article runnable knowledge base.

A library for creating, reading and editing PE files and .NET modules.