{"slug":"reverse-engineering","title":"Reverse Engineering","description":"Software reverse engineering for legitimate analysis: binary and malware triage, decompilers, debugging and instrumentation, platform targets, and RE tools driven by AI agents over MCP.","tags":["reverse-engineering","ghidra","ida","frida","malware-analysis","mcp","devtools"],"category":"devtools","scope":{"covers":"Triage of unknown binaries and suspicious samples (DIE, FLOSS, capa, YARA/YARA-X); decompilation with Ghidra, IDA, Rizin/Cutter, JEB and Hopper; GDB/pwndbg and Frida for inspection; Android, .NET/NativeAOT, Go/Rust/Dart, JavaScript/Electron, WebAssembly, firmware and EVM targets; network captures; reverse engineering over MCP with REA and others.","notCovered":"Exploit development, DRM/licence cracking, anti-cheat or anti-detection bypass, malware development, Windows kernel/WinDbg, and EU decompilation law; use the web for those or for tool versions newer than the pinned releases.","currentAs":"2026-10-16 (6.5.0)"},"lastUpdated":"2026-10-16","documentCount":27,"raw_base":"/raw/reverse-engineering/","html_base":"/wiki/reverse-engineering/","xl":{"documentCount":9,"subscribe":"/pro","auth":"Authorization: Bearer <api key>"},"documents":[{"path":"README.md","title":"LLM Wiki","type":null,"updated":null,"gated":false},{"path":"wiki-xl/index.md","title":"XL Edition Index","type":"index","updated":"2026-10-16","gated":true},{"path":"wiki/index.md","title":"Reverse Engineering KB — Master Index","type":"index","updated":"2026-10-16","gated":false},{"path":"wiki-xl/reference/android-toolchain-reference.md","title":"Android Toolchain Reference","type":"reference","updated":"2026-10-16","gated":true},{"path":"wiki-xl/reference/frida-api-reference.md","title":"Frida API Reference","type":"reference","updated":"2026-10-16","gated":true},{"path":"wiki-xl/reference/gdb-and-pwndbg-command-reference.md","title":"GDB and pwndbg Command Reference","type":"reference","updated":"2026-10-16","gated":true},{"path":"wiki-xl/reference/ghidra-processor-and-pcode-notes.md","title":"Ghidra Processor Selection and P-code Notes","type":"reference","updated":"2026-10-16","gated":true},{"path":"wiki-xl/reference/ghidra-scripting-headless-debugger.md","title":"Ghidra Scripting, Headless Analysis, Debugger and BSim","type":"reference","updated":"2026-10-16","gated":true},{"path":"wiki-xl/reference/ida-scripting-and-idalib.md","title":"IDA Scripting, idalib and Batch Automation","type":"reference","updated":"2026-10-16","gated":true},{"path":"wiki-xl/reference/rea-mcp-cli-and-providers-reference.md","title":"REA MCP, CLI and Providers Reference","type":"reference","updated":"2026-10-16","gated":true},{"path":"wiki-xl/reference/rizin-command-reference.md","title":"Rizin Command Reference","type":"reference","updated":"2026-10-16","gated":true},{"path":"wiki/concepts/decompilation-concepts.md","title":"Decompilation Concepts","type":"concept","updated":"2026-10-16","gated":false},{"path":"wiki/concepts/dotnet-and-nativeaot.md","title":".NET Assemblies and NativeAOT","type":"concept","updated":"2026-10-16","gated":false},{"path":"wiki/concepts/evm-bytecode.md","title":"EVM Bytecode Analysis","type":"concept","updated":"2026-10-16","gated":false},{"path":"wiki/concepts/executable-formats.md","title":"Executable Formats: ELF, PE, Mach-O and DEX","type":"concept","updated":"2026-10-16","gated":false},{"path":"wiki/concepts/go-rust-and-dart-binaries.md","title":"Go, Rust and Flutter/Dart Binaries","type":"concept","updated":"2026-10-16","gated":false},{"path":"wiki/concepts/legal-and-ethics.md","title":"Legal and Ethical Boundaries of Reverse Engineering","type":"concept","updated":"2026-10-16","gated":false},{"path":"wiki/concepts/webassembly.md","title":"WebAssembly Modules","type":"concept","updated":"2026-10-16","gated":false},{"path":"wiki/entities/frida.md","title":"Frida","type":"entity","updated":"2026-10-16","gated":false},{"path":"wiki/entities/gdb-and-pwndbg.md","title":"GDB and pwndbg","type":"entity","updated":"2026-10-16","gated":false},{"path":"wiki/entities/ghidra.md","title":"Ghidra","type":"entity","updated":"2026-10-16","gated":false},{"path":"wiki/entities/ida-pro.md","title":"IDA Pro","type":"entity","updated":"2026-10-16","gated":false},{"path":"wiki/entities/rea.md","title":"REA (rea-agents): One MCP for Reverse Engineering","type":"entity","updated":"2026-10-16","gated":false},{"path":"wiki/entities/rizin-and-cutter.md","title":"Rizin and Cutter","type":"entity","updated":"2026-10-16","gated":false},{"path":"wiki/log.md","title":"Activity Log","type":"log","updated":null,"gated":false},{"path":"wiki/syntheses/android-apk-analysis.md","title":"Android APK Analysis","type":"synthesis","updated":"2026-10-16","gated":false},{"path":"wiki/syntheses/choosing-a-disassembler.md","title":"Choosing a Disassembler","type":"synthesis","updated":"2026-10-16","gated":false},{"path":"wiki/syntheses/dynamic-analysis-workflow.md","title":"Dynamic Analysis Workflow","type":"synthesis","updated":"2026-10-16","gated":false},{"path":"wiki/syntheses/firmware-analysis.md","title":"Firmware Analysis: binwalk, unblob and Loading Raw Images","type":"synthesis","updated":"2026-10-16","gated":false},{"path":"wiki/syntheses/javascript-and-electron-apps.md","title":"JavaScript Bundles and Electron Apps","type":"synthesis","updated":"2026-10-16","gated":false},{"path":"wiki/syntheses/malware-triage.md","title":"Malware Triage: DIE, FLOSS, capa and YARA/YARA-X","type":"synthesis","updated":"2026-10-16","gated":false},{"path":"wiki/syntheses/network-captures-and-protocols.md","title":"Network Captures and Protocols: Wireshark, tshark, TLS Keys and mitmproxy","type":"synthesis","updated":"2026-10-16","gated":false},{"path":"wiki/syntheses/overview.md","title":"Reverse Engineering: Overview and Where to Start","type":"synthesis","updated":"2026-10-16","gated":false},{"path":"wiki/syntheses/re-with-ai-agents-mcp.md","title":"Reverse Engineering with AI Agents: REA vs IDA MCP, JEB, GhidraMCP and the rest","type":"synthesis","updated":"2026-10-16","gated":false},{"path":"wiki/syntheses/triage-an-unknown-binary.md","title":"Triage an Unknown Binary: The First 15 Minutes","type":"synthesis","updated":"2026-10-16","gated":false},{"path":"wiki/syntheses/troubleshooting.md","title":"Troubleshooting: Symptom-First Fixes by Tool","type":"synthesis","updated":"2026-10-16","gated":false}]}