Disassemblers & triage

Disassemblers, hex editors and file-identification tools for first-look triage.

For legal, authorized and educational use only. Only analyze software you own or have written permission to examine.

Binwalk — authorized firmware triage onlyMIT firmware triage — lab images and authorized dumps only.Binwalk carve overview — authorized firmware onlyMIT binwalk 3.1.0 — authorized firmware signature scan + carve.Capstone — multi-architecture disassembly libraryMulti-arch disassembly engine — embed in authorized tooling.FLARE FLOSS — authorized string extractionApache-2.0 string extraction — lab and IR samples you may hold.Keystone — multi-architecture assembler libraryGPL-2.0 assembler engine — companion to Capstone in authorized tooling.LIEF — authorized binary parsing overviewApache-2.0 format library — PE/ELF/Mach-O triage in authorized labs.llvm-objdump — authorized object-file inspectionLLVM objdump — object/headers/disasm for authorized files.Medusa — authorized interactive disassemblerMedusa 0.4.3 — interactive modular disassembler for authorized labs.PE-bear — PE triage GUIGPL-2.0 PE viewer — authorized Windows binaries.radare2 r2pipe — authorized lab overviewr2pipe — radare2 automation pipes; authorized binaries only.REDasm — authorized binary disassembler GUIGPL-3.0 REDasm — Qt disassembler GUI for authorized binaries.Rizin scripting — authorized lab overviewRizin scripting / rz-pipe — authorized binaries only; not a cracker.Zydis — fast x86/x86-64 disassembly libraryMIT x86/x64 decode library — embed in authorized tooling.