# Reverse Engineering

> Software reverse engineering for legitimate analysis: binary and malware triage, decompilers, debugging and instrumentation, platform targets, and RE tools driven by AI agents over MCP.
> Covers: Triage of unknown binaries and suspicious samples (DIE, FLOSS, capa, YARA/YARA-X); decompilation with Ghidra, IDA, Rizin/Cutter, JEB and Hopper; GDB/pwndbg and Frida for inspection; Android, .NET/NativeAOT, Go/Rust/Dart, JavaScript/Electron, WebAssembly, firmware and EVM targets; network captures; reverse engineering over MCP with REA and others.
> Not covered: Exploit development, DRM/licence cracking, anti-cheat or anti-detection bypass, malware development, Windows kernel/WinDbg, and EU decompilation law; use the web for those or for tool versions newer than the pinned releases.
> Current as of: 2026-10-16 (6.5.0)

- [LLM Wiki](/raw/reverse-engineering/README.md)
- [Reverse Engineering KB — Master Index](/raw/reverse-engineering/wiki/index.md)
- [Decompilation Concepts](/raw/reverse-engineering/wiki/concepts/decompilation-concepts.md)
- [.NET Assemblies and NativeAOT](/raw/reverse-engineering/wiki/concepts/dotnet-and-nativeaot.md)
- [EVM Bytecode Analysis](/raw/reverse-engineering/wiki/concepts/evm-bytecode.md)
- [Executable Formats: ELF, PE, Mach-O and DEX](/raw/reverse-engineering/wiki/concepts/executable-formats.md)
- [Go, Rust and Flutter/Dart Binaries](/raw/reverse-engineering/wiki/concepts/go-rust-and-dart-binaries.md)
- [Legal and Ethical Boundaries of Reverse Engineering](/raw/reverse-engineering/wiki/concepts/legal-and-ethics.md)
- [WebAssembly Modules](/raw/reverse-engineering/wiki/concepts/webassembly.md)
- [Frida](/raw/reverse-engineering/wiki/entities/frida.md)
- [GDB and pwndbg](/raw/reverse-engineering/wiki/entities/gdb-and-pwndbg.md)
- [Ghidra](/raw/reverse-engineering/wiki/entities/ghidra.md)
- [IDA Pro](/raw/reverse-engineering/wiki/entities/ida-pro.md)
- [REA (rea-agents): One MCP for Reverse Engineering](/raw/reverse-engineering/wiki/entities/rea.md)
- [Rizin and Cutter](/raw/reverse-engineering/wiki/entities/rizin-and-cutter.md)
- [Activity Log](/raw/reverse-engineering/wiki/log.md)
- [Android APK Analysis](/raw/reverse-engineering/wiki/syntheses/android-apk-analysis.md)
- [Choosing a Disassembler](/raw/reverse-engineering/wiki/syntheses/choosing-a-disassembler.md)
- [Dynamic Analysis Workflow](/raw/reverse-engineering/wiki/syntheses/dynamic-analysis-workflow.md)
- [Firmware Analysis: binwalk, unblob and Loading Raw Images](/raw/reverse-engineering/wiki/syntheses/firmware-analysis.md)
- [JavaScript Bundles and Electron Apps](/raw/reverse-engineering/wiki/syntheses/javascript-and-electron-apps.md)
- [Malware Triage: DIE, FLOSS, capa and YARA/YARA-X](/raw/reverse-engineering/wiki/syntheses/malware-triage.md)
- [Network Captures and Protocols: Wireshark, tshark, TLS Keys and mitmproxy](/raw/reverse-engineering/wiki/syntheses/network-captures-and-protocols.md)
- [Reverse Engineering: Overview and Where to Start](/raw/reverse-engineering/wiki/syntheses/overview.md)
- [Reverse Engineering with AI Agents: REA vs IDA MCP, JEB, GhidraMCP and the rest](/raw/reverse-engineering/wiki/syntheses/re-with-ai-agents-mcp.md)
- [Triage an Unknown Binary: The First 15 Minutes](/raw/reverse-engineering/wiki/syntheses/triage-an-unknown-binary.md)
- [Troubleshooting: Symptom-First Fixes by Tool](/raw/reverse-engineering/wiki/syntheses/troubleshooting.md)

## XL edition (Pro)

> Deeper per-item reference pages. Requires a subscription (/pro). Over MCP,
> set AGENTWIKIS_API_KEY (agentwikis-mcp 0.2.0+) and these pages join search
> and open_wiki automatically. Over HTTP, send `Authorization: Bearer <api key>`
> on the /raw/ URLs below.

- [XL Edition Index](/raw/reverse-engineering/wiki-xl/index.md) — Pro
- [Android Toolchain Reference](/raw/reverse-engineering/wiki-xl/reference/android-toolchain-reference.md) — Pro
- [Frida API Reference](/raw/reverse-engineering/wiki-xl/reference/frida-api-reference.md) — Pro
- [GDB and pwndbg Command Reference](/raw/reverse-engineering/wiki-xl/reference/gdb-and-pwndbg-command-reference.md) — Pro
- [Ghidra Processor Selection and P-code Notes](/raw/reverse-engineering/wiki-xl/reference/ghidra-processor-and-pcode-notes.md) — Pro
- [Ghidra Scripting, Headless Analysis, Debugger and BSim](/raw/reverse-engineering/wiki-xl/reference/ghidra-scripting-headless-debugger.md) — Pro
- [IDA Scripting, idalib and Batch Automation](/raw/reverse-engineering/wiki-xl/reference/ida-scripting-and-idalib.md) — Pro
- [REA MCP, CLI and Providers Reference](/raw/reverse-engineering/wiki-xl/reference/rea-mcp-cli-and-providers-reference.md) — Pro
- [Rizin Command Reference](/raw/reverse-engineering/wiki-xl/reference/rizin-command-reference.md) — Pro