A workflow for coverage-guided fuzzing, a testing method that automatically feeds many varied inputs to a program while tracking which code paths they reach. It covers AFL++, libFuzzer, honggfuzz, instrumentation, starting test inputs, dictionaries, and structured data.
A guide for extracting and unpacking firmware files such as device images, update packages, and binary files. Firmware is software stored on hardware devices; the guide covers tools including binwalk, unblob, dd, and hexdump.
A workflow for analysing a firmware root filesystem, meaning the directory tree extracted from a device firmware image. It focuses on programs, startup entries, configuration files, keys, hard-coded passwords, and the processor architecture used by binaries.
A guide to analysing game software made with Unity or Unreal, changing values in memory, examining Lua scripts, and inspecting graphics shaders. Cheat Engine is a Windows tool for scanning and modifying a running program's memory.
A guide to dynamic debugging with GDB, a program debugger, plus the pwndbg or gef extensions. It covers Linux programs, core files, and Windows programs running through Wine.
A workflow for using Ghidra, a free tool that examines compiled programs, to import binaries, analyse them, turn machine code into more readable code, and automate tasks with scripts. It covers PE, ELF, and Mach-O files and supports batch analysis without a graphical interface.
A hardware-access workflow for working with physical circuit boards through JTAG or SWD debug connections, UART serial ports, flash chips, and logic analysers. It focuses on extracting firmware, reading startup logs, and debugging hardware.
A workflow for reverse engineering HarmonyOS application packages such as HAP, HSP, and HAR files. It covers package contents, resources, ArkTS code compiled into ABC bytecode, and native libraries.
A hands-on guide to examining chips and circuit boards at the physical level, including opening packages, viewing silicon, probing signals, and tracing PCB connections.
A guide to analyzing industrial control system traffic, including Modbus, DNP3, and OPC UA, the communication protocols used by equipment such as PLCs, HMIs, and SCADA systems.
A workflow for examining iOS applications from IPA packages or installed apps. It covers app packaging, native code, Objective-C and Swift class information, code signing, and controlled runtime analysis.
A workflow for analyzing communication used by connected devices, including MQTT, CoAP, Bluetooth Low Energy, Zigbee, NFC, and smart cards. It explains messages, device commands, and link-layer behavior from captures or live traffic.
A workflow for reading compiled Java programs such as JAR, WAR, and CLASS files. It uses decompilers and archive tools to turn Java bytecode back into code that is easier to inspect.
A guide to analyzing Java Card applets from CAP files, the packaged programs used by smart cards such as SIM cards and bank cards. It covers their components, identifiers, installation data, and command handling.
A workflow for examining Windows drivers and other code that runs inside the operating-system kernel. It covers driver entry points, device requests, process-hiding techniques, and communication between applications and drivers.
A workflow for locating and understanding how software checks registration codes, license files, activation state, or machine binding. It examines whether authorization is checked locally or through an online service.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: