# Reversense: instrumented reverse engineering as a platform

> Reversense, also known as Dexcalibur 2, is a TypeScript platform that automates the reverse engineering of mobile and embedded applications by putting static analysis, dynamic instrumentation, emulation and scanning into one model of the target. It is a rewrite of Dexcalibur, it is built on Frida, and its most recent release tag is from 2021 even though the master branch now carries version 2.0.0.

**reversenseorg/dexcalibur** — Reversense (Dexcalibur2) is a fully rewriting and rethinking of Dexcalibur.  Reversense is a binary intelligence platform that automates the reverse engineering of mobile and embedded applications. 

- Repository: https://github.com/reversenseorg/dexcalibur
- Stars: 1,188 · Forks: 132
- Language: TypeScript
- License: AGPL-3.0
- Published: 2026-10-19 · Updated: 2026-10-19 · Language: en
- Canonical page: https://hysenlabs.com/projects/reversenseorg-dexcalibur

## One representation of the target instead of disconnected tools

Reversense describes itself as a binary intelligence platform that automates the reverse engineering of mobile and embedded applications. It analyses applications in their real execution context and supports a wide range of target languages, architectures and operating systems.

The design argument is in one sentence, and it is the whole thesis. Instead of scattering work across disconnected tools, Reversense aggregates static analysis, dynamic instrumentation, emulation and scanning into a single universal representation of the target, and lets teams explore it together.

The problem the README sets out explains why a platform rather than a toolkit. Mobile and embedded applications are everywhere, yet their internal behaviour stays opaque: what data they process, whether they are vulnerable or malicious, and how they defend themselves. Traditional approaches run into recurring walls. Obfuscated binaries resist static reading. Behaviour depends on a specific device model or execution context. Secure channels, white-box crypto and proprietary protocols defeat ordinary network interception. Vulnerable third party dependencies stay invisible without an SBOM. And a manual reverse engineering process is slow, costly and hard to staff.

The response is to model the whole application and its environment, then automatically instrument and execute it to observe what really happens. The licence is AGPL-3.0, the code is TypeScript, and the npm package is dexcalibur with the description Universal Reverse Engineering platform focused on dynamic binary instrumentation automation by Reversense. The last push was on 2026-10-02 and the master branch is version 2.0.0.

## Four phases, from discovery to a stateful execution

The how it works section is a four phase pipeline, and each phase is a distinct kind of work.

Discovery discovers the execution environment, meaning permissions, hardware capabilities, CPU and TEE among others, retrieves the target application or firmware, and provisions a virtual test bench.

Modeling models the entire application and environment into the Reversense universal representation, which is updated automatically as tools and bots discover new data.

Instrumentation identifies points of interest, automatically generates probes to trace flows and mechanisms, and then refines and tags the collected traces back into the model.

Execution, exploration and test runs the application to generate traces and then enriches the model and deductions, and the README adds that stateful instrumentation lets the platform adapt to protections observed in previous runs.

That last clause is the one that distinguishes the approach from a scripted trace. A protection that the target uses, an anti-hook check or an emulator detection, becomes part of the model's state, and the next run can act on it. The feedback loop between what was observed and what happens next is the substance of the platform, and the four phases are structured around it rather than around a list of tools.

For a reader evaluating it, the phase list is also a map of the requirements. Discovery implies devices or an emulator, modelling implies storage, instrumentation implies a runtime that can inject hooks, and execution implies somewhere to run the target.

## Hooks, KeyPoints and the assurance model

The feature list is where the platform becomes concrete, and the instrumentation section is the most detailed part of it.

Automatic generation of hooks for Java methods, Objective-C, native functions, instructions, interrupts and instances, in a few clicks. A KeyPoints scheduler marks moments in the app lifecycle to load and unload hooks and trigger actions such as memory dumps, screen recording and custom scenarios. Multi-thread and inter-process observation, multi-terminal scenarios for protocol analysis, device-fingerprint control, and a fuzzing engine. Dynamic cross-references are built automatically during execution.

The scanning side is organised around an editable assurance model. One-click SAST, DAST, IAST and SCA batteries are organized by theme against that model, and the scanners behave like a real user, building a test plan and producing explorable results plus artifacts such as screenshots and input and traffic recordings. The stated coverage includes permissions, SELinux policy, OWASP MASTG, SBOM, and detection of more than 90 types of personal data across multiple states.

Deobfuscation is a separate section. It describes automatic on-the-fly decompilation with static analysis and AST update for dynamically loaded code, ready-to-use bypass tactics for common RASP such as anti-hook, anti-root and anti-emulator, and code synthesis via concrete and symbolic execution to generate simplified representations or find bypass options.

The analysis tooling section is worth one more line, because it is where the platform's own search engine lives. Stereoscopic analysis is a search engine over traces and ASTs spanning more than 100 node types, covering UI components, file content and hooks, with adjacency search, taint analysis and distance, plus a tag system of more than 400 tags by default. Topological analysis provides system-API projection, application-topology visualisation and automatic UI component inventory. Native Radare2 integration and a Merlin search engine are named as the way to explore the representation and find code by its execution behaviour.

## The MCP server and the collaborative project model

Two of the highlights are about how teams work with the tool rather than what the tool finds.

The first is collaboration by design. Several analysts work on the same project and binary codebase at once, each running the target on their own terminal, without conflicts. That is a specific architectural claim, since the shared artefact is the model of the target rather than a shared set of files that two people might edit at the same time.

The second is that the platform is LLM-ready. Every feature is invokable by an AI through a built-in MCP server, with the same access control as the standard API. The access control point matters. An MCP server that can trigger instrumentation and execute targets inherits the authority of whoever is driving it, so the platform puts the same gate on it as on a human operator.

The third highlight is device-farm compatibility, allocating and driving physical or virtual terminals, locally or in a farm. That connects directly to the discovery phase, where a virtual test bench is provisioned, and to the multi-terminal scenarios used for protocol analysis.

There is also a support and licensing split that an evaluator should notice. For professional use, support and modules are pointed at a separate site, reversense.com, while the project itself is AGPL. The community channels are a Discord server, described as the preferred way to get a response, and a Telegram group as the alternative for those not familiar with Discord, plus a Twitter account.

## The 2.0.0 rewrite sitting on top of 2021 release tags

The version story in this repository is unusual and is worth understanding before you plan around it.

The README states that the current git master branch is 2.0.0, and the package version in the manifest is 2.0.0 with the description of a universal reverse engineering platform. The description also says that Reversense, also known as Dexcalibur 2, is a fully rewriting and rethinking of Dexcalibur, a new project which aims to provide a better user experience, and a better coverage, suitable for intelligence and offensive security.

Against that, the published release tags are v0.7.10 from 2021-09-27, v0.7.9 from 2021-04-02 and v0.7.8 from 2021-02-23, and the npm badge points at the dexcalibur package.

So the 2.0 line exists in the repository and in the package metadata, while the tags stop at 0.7.10. Anyone installing from npm and anyone reading the release list are looking at different generations of the same project, and the documentation site is a separate repository, reversenseorg.github.io/rs-doc, rather than the code repository itself.

The repository layout also shows the working arrangements. There is a dexcalibur/ directory with dexcalibur.ts and dexcalibur-adm.mts at the top level, an src/ directory for the implementation, connectors/ and inspectors/ for the integrations with targets and with analysis back ends, a docker/ directory, a doc/ directory, and scripts including build.sh, test.sh and dev.env.sh. There is a TESTED.md at the root, which is the file to read before you point the platform at a target, and a 3TH_LICENSES.md for the third party licence position.

## Conclusion

Adopt Reversense if you analyse mobile or embedded targets in a team, if you want the instrumentation, the modelling and the scanning to share one representation of the target, and if you are prepared to work with a platform whose releases lag its master branch. Do not adopt it for a single manual reverse engineering session with one binary, and do not adopt it if your organisation cannot use AGPL licensed tooling. Verify first that your targets and your environment are in the TESTED.md matrix, that the Frida versions in the dependency list match the targets you intend to instrument, and whether you need the professional modules that the README points to a separate site for.

## FAQ

### What is Reversense and how does it relate to Dexcalibur?

Reversense, also known as Dexcalibur 2, is a binary intelligence platform that automates the reverse engineering of mobile and embedded applications, and it is described as a full rewrite and rethink of Dexcalibur aimed at better user experience and better coverage for intelligence and offensive security work.

### What are the four phases Reversense runs through?

Discovery, which finds the execution environment and provisions a virtual test bench, Modeling, which builds the universal representation, Instrumentation, which identifies points of interest and generates probes, and Execution, exploration and test, which runs the application to generate traces and enrich the model, with stateful instrumentation adapting to protections seen in previous runs.

### Does Reversense support AI tooling?

The README says it is LLM-ready, with every feature invokable by an AI through a built-in MCP server, with the same access control as the standard API.

### What testing does Reversense support?

One-click SAST, DAST, IAST and SCA batteries organised by theme against an editable assurance model, with the scanners behaving like a real user and producing artefacts such as screenshots and input and traffic recordings. Coverage listed in the README includes permissions, SELinux policy, OWASP MASTG, SBOM and detection of more than 90 types of personal data.

## Sources

- [Issues](https://github.com/reversenseorg/dexcalibur/issues)
- [License: AGPL-3.0](https://github.com/reversenseorg/dexcalibur/blob/master/LICENSE)
- [README](https://github.com/reversenseorg/dexcalibur/blob/master/README.md)
- [Releases](https://github.com/reversenseorg/dexcalibur/releases)
- [reversenseorg/dexcalibur on GitHub](https://github.com/reversenseorg/dexcalibur)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/reversenseorg-dexcalibur