Indetectables Toolkit: a curated bundle of reversing and analysis tools

A bundle of 102 programs, not a program

The description is blunt about what this is. The repository is the essential toolkit for reversing, malware analysis and cracking, the primary language is listed as Inno Setup, and the toolkit is described as a Swiss Army knife, a curated collection that is invaluable for malware analysts, crackers and cybersecurity experts, crafted to support both novice and experienced users.

The important word is curated. The toolkit includes 102 applications, and the readme says plainly that it features both well-known tools and lesser-known but highly useful ones, as well as rare tools that are hard to find. The complete list is in a separate file, TOOLS.md, and a smaller list is in TOOLS-LITE.md for the reduced variant.

None of this code is the authors' own. Every tool is sourced from its official website, and the readme attaches a warning to that fact: exercise caution, especially with tools that come from forum threads. That sentence is the most important line in the document for anyone installing this, because a curated bundle of a hundred binaries is exactly the shape of supply chain risk, and the author is telling you which part of the list to trust less.

The project also points at two related repositories on the same organisation, a manuals repository and a mirror of numbered theories from the site. Those are the learning material, and the toolkit is the instrument set that goes with them.

The installer handles dependencies and environment variables

Automatic setup is listed as one of the five advantages, and the details in the readme are what make it more than a marketing word.

The installer handles dependencies, environment variables, and can schedule weekly updates. That is a lot of automation for a bundle of unrelated third-party programs, because every one of those tools has its own expectations about where its libraries live, and setting that up by hand for a hundred tools is exactly the kind of busywork that stops people from bothering.

The installation instructions themselves are short. You download the stable version from the release section, you use the Universal Updater at a fixed path to keep the tools updated, and if you need a specific tool, they are all compressed in the toolkit folder of the repository. That last point matters for air-gapped or curated workflows: the tools are present in the repository as compressed archives, so you can pull one out without running the installer at all.

The updater is a separate project, the Universal Updater, and the readme links it rather than describing it. It is worth clicking through, because an updater that downloads and replaces a hundred binaries is a privileged component on an analysis machine, and the analysis machine is often the one place where you do not want a silent network fetch. The toolkit also registers a Windows right-click context menu entry for files, through a project called SendTo Recomposed, which is what lets you send a sample straight into a tool without a command line.

Full, lite and four extras packs

Each release ships more than one installer, and the three shapes exist for different reasons.

The full installer is named for the version and contains every tool in the list. The lite installer, with a suffix in its name, is a leaner selection, and its contents are documented separately in TOOLS-LITE.md. A handful of tools also ship as separate optional extras packs, named with the version and the pack name, and the packs that exist are ghidra, oldies, unpacking and vbdec.

The extras exist to solve a specific problem. The oldies pack is the historical material, the tools from the era when the toolkit lineage began. The unpacking pack covers the executables that need to be unpacked before they can be analysed.

The readme explains that the extras are marked in the main tool list, with a note saying which extra is needed for a given tool. That is a small but thoughtful piece of documentation, because it means the tool list is honest about what you get with the base install.

The full and lite distinction is a judgement about what most analysts need on a given day. The lite install is the one to start with, because a smaller set is easier to reason about, and the extras can be added later for the specific format you are looking at.

Where the tools come from, and what the extension points are

Extensibility is the third advantage, and it works through two files rather than through a plugin API.

New tools are added by updating the tools configuration file in the updater directory and linking them in the sendto file, and both live under the bin directory. In practice that means the updater knows what to download and update, and the sendto registry knows which tools appear in the right-click menu for a file. It is a pragmatic design rather than a plugin system, and it has the advantage that adding a tool does not require writing code, which matters when the tools are binaries you did not build.

The sendto integration is the part that changes daily workflow. Right-click a sample, and the tools you have registered are in the menu, which is much faster than opening each program and finding the right import path. The context menu integration is listed as its own advantage, and it works through the separate SendTo Recomposed project rather than through something built into the toolkit.

The tool list itself is where the judgement lives. The readme says the set includes rare tools that are hard to find, and that all tools are sourced from their official websites, with the caution about forum-sourced ones. For an analyst, a rare tool from a forum thread is often the tool that unpacks the sample nobody else can handle, and it is also the one most likely to be somebody's malware. The distinction is not something a list can make for you.

The project states that the toolset was inspired by the old Crackers Kits that were popular around 2010, with their limitations and flaws addressed, and that the selection is based on the tools the community has traditionally recommended.

Inno Setup and a seven-zip naming convention

The packaging details are simple and they tell you how the project is actually maintained.

The primary language is Inno Setup, which is the Windows installer script language, and the repository is organised around the installer output rather than around source code. There is a toolkit directory holding the compressed tools, an extras directory for the optional packs, a bin directory with the updater and the sendto wiring, an assets directory, a changelog, a licence file, the two tool lists, and a second readme in Spanish.

Contributions are described with a specific convention. Pull requests are welcome, and for major changes an issue should be opened first for discussion. Tools are compressed with 7-zip, and the file name format is the tool name, a dash, the version, and the extension. That convention is what makes the toolkit folder browsable, and it is also what lets a script pull a specific tool out of the repository by name and version.

The presence of the Spanish readme and the site itself pointing at Spanish and English versions of the manuals suggests a project with an international user base, and the release names follow a year.month scheme, with 2026.9 the current one, after 2025.6 and 2025.5.

The first release was version 2020.2, published on February 17, 2020, and the readme makes a point of that date, describing the project as more veteran than many current alternatives. The last push was on 2026-09-02, which is consistent with the release cadence.

What to verify before you install it on a real machine

Because this is a bundle of redistributable binaries rather than source code, a few checks are worth doing before it touches a machine you care about.

Start with the tool list, TOOLS.md, and read the entries for tools you do not recognise. The readme flags that some tools come from forum threads, and that is the line to draw: a tool with an official site and a published release is a different proposition from a binary someone posted in a thread. The lite tool list is the shorter version of the same question, and it is a reasonable place to start since the smaller set is easier to vet.

Then look at what the installer changes. Automatic setup means dependencies, environment variables and a scheduled weekly update, and each of those is a change to a machine that an analysis workstation depends on being predictable. Running the installer on a disposable virtual machine first is the obvious precaution, and for a tool set that includes unpackers and debuggers, it is also the only sensible first step.

The updater deserves the same attention. It is the component with network access and the ability to replace files, and it is a separate project whose behaviour you have not audited by reading this repository. If you run analysis on a host that must stay clean, decide in advance how the updater is allowed to behave on it.

The licence is the last item. The repository records a custom licence that GitHub cannot classify, and the licence file is LICENSE.txt, so read it rather than assuming the AGPL or the MIT applies. For an analyst using the toolkit internally that may not matter, but for anyone redistributing the bundle, or building it into a lab image, the terms are what decide whether you can.

Editorial conclusion

The Indetectables Toolkit suits an analyst who wants a working set of reversing utilities on a Windows box without hunting for individual downloads, and who will read TOOLS.md before installing anything. It is a poor fit for a clean or auditable environment, since the bundle installs 102 programs with their own dependencies and environment variables, and it is a poor fit for reproducible builds because the tools are redistributed binaries rather than source. Before you install it, read the tool list and the upstream notes for anything unfamiliar, run the installer on a disposable virtual machine, and check what the updater is allowed to change on the machine you use for analysis.

Frequently asked questions

Official sources

1. indetectables-net/toolkit on GitHub
2. Issues
3. Project website
4. README
5. Releases