Awesome Reverse Engineering / Identify & Triage
Identify & Triage
First fifteen minutes on any file: what is it, what built it, is it packed, what can it do.
| Tool | Use it when | Cost | Last push · Stars |
|---|---|---|---|
| Detect It Easy | Identifies compiler, linker, packer and protector for PE, ELF and Mach-O files. | Free | 2026-10 · ★ 12k |
| capa | Names what a binary can do (encrypt, network, persist) from rules; points you to the functions that do it. | Free | 2026-10 · ★ 6.3k |
| FLOSS | Extracts obfuscated and stack-built strings that plain strings misses.▶ runs | Free | 2026-10 · ★ 4.2k |
| YARA-X | Rust successor to YARA for pattern-matching rules; turn findings into reusable detections. | Free | 2026-10 · ★ 1.3k |
| PE-bear | Fast PE header and section viewer for first looks at Windows binaries. | Free | 2026-10 · ★ 3.9k |
| XELFViewer | ELF header, section and segment viewer. | Free | 2026-10 · ★ 1.6k |
| checksec | Reports RELRO, canaries, NX, PIE and FORTIFY; now written in Go (checksec file <bin>). | Free | 2026-10 · ★ 2.4k |
| pestudio | Static Windows executable triage: imports, strings, indicators. | Free · Paid | website |