radare

Radare, the highly featured reverse engineering framework. NOTE: it is better to use the "radare 2", not the "radare".

Features

Multi-architecture and multi-platform GNU/Linux, Android, *BSD, OSX, iPhoneOS, Windows{32,64} and Solaris i8080, 8051, x86{16,32,64}, avr, arc{4,compact}, arm{thumb,neon,aarch64}, c55x+, dalvik, ebc, gb, java, sparc, mips, nios2, powerpc, whitespace, brainfuck, malbolge, z80, psosvm, m68k, msil, sh, snes, gb, dcpu16, csr, arc pe{32,64}, te, [fat]mach0{32,64}, elf{32,64}, bios/uefi, dex and java classes Highly scriptable Vala, Go, Python, Guile, Ruby, Perl, Lua, Java, JavaScript, sh, .. batch mode and native plugins with full internal API access native scripting based in mnemonic commands and macros Hexadecimal editor 64bit offset support with virtual addressing and section maps Assemble and disassemble from/to many architectures colorizes opcodes, bytes and debug register changes print data in various formats (int, float, disasm, timestamp, ..) search multiple patterns or keywords with binary mask support checksumming and data analysis of byte blocks IO is wrapped support Files, disks, processes and streams virtual addressing with sections and multiple file mapping handles gdb:// and rap:// remote protocols Filesystems support allows to mount ext2, vfat, ntfs, and many others support partition types (gpt, msdos, ..) Debugger support gdb remote and brainfuck debugger support software and hardware breakpoints tracing and logging facilities Diffing between two functions or binaries graphviz friendly code analysis graphs colorize nodes and edges Code analysis at opcode, basicblock, function levels embedded simple virtual machine to emulate code keep track of code and data references