4 Min ReadLast updated: July 9, 2026

Rothalyx RE Framework

Rothalyx is a native, cross-platform reverse engineering framework and desktop workstation for binary analysis, disassembly, control-flow recovery, decompilation, runtime debugging, scripting, and optional AI-assisted analyst workflows. It is written primarily in C++ (C++20), ships a Qt Widgets desktop application, a CLI, and a versioned C SDK, and persists analysis state to SQLite. It is developed by Regaan R, founder of ROT Independent Security Research Lab, and released under AGPL-3.0.

Overview

The framework is built around one native analysis pipeline that every surface consumes. Rather than reimplementing behavior separately in the GUI, the command line, and automation, Rothalyx routes the desktop app, CLI, SDK, plugins, and AI workflows through the same core. The design rule stated in the architecture doc is explicit: if a capability must exist in more than one interface, it belongs in the core first.

Features

  • Native Qt Widgets desktop application for project-based reverse engineering.
  • CLI for analysis, automation, packaging, and scripted workflows.
  • PE, ELF, and Mach-O loading with address-space mapping, rebasing, and symbol resolution.
  • Disassembly across the supported architecture layer (Capstone is a listed toolchain dependency).
  • Function discovery, CFG recovery, cross-references, loop and switch-edge detection, and call graph generation.
  • IR and SSA lifting, analysis and simplification passes, type recovery, and structured C-like decompiler output.
  • Runtime debugging integration with breakpoints, thread-aware state inspection, runtime patching, and static/runtime correlation.
  • SQLite-backed project persistence for annotations, version history, and analysis artifacts.
  • Embedded Python for plugins and automation.
  • Optional AI-assisted summaries, function-rename suggestions, pattern detection, and vulnerability hints (OpenAI, Anthropic, Gemini, OpenAI-compatible gateways, local LLM, or heuristic-only).
  • Sanitizer-backed corpus fuzzing for loader and trace-ingestion parsers.
  • Release packaging for Windows (NSIS), macOS (DMG), Linux (AppImage), Debian (DEB), and Arch (pacman).

Architecture Summary

Rothalyx is a layered native system. The pipeline runs: loader → memory model → disassembly → function discovery and CFG recovery → IR and SSA → analysis and type recovery → decompiler → debugger integration → persistence, SDK, plugins, and optional AI. Each stage produces data the next stage consumes. Core modules live under core/ (loader, memory, disasm, cfg, ir, ssa, analysis, type, decompiler, debugger, database, sdk). Applications live under apps/ (desktop_qt, cli). Extension surfaces are plugins (Python) and scripting (embedded Python bindings). The desktop UI is a client of the pipeline, not a parallel implementation.

Technology Stack

  • Language: C++20 core and application layer.
  • UI: Qt 6 Widgets.
  • Build: CMake 3.26+, Ninja, CMake presets (dev, asan-fuzz).
  • Disassembly / networking deps: Capstone, cURL (full toolchain).
  • Persistence: SQLite3.
  • Scripting / extensions: embedded Python.
  • Public interface: C ABI (core/sdk/include/rothalyx/sdk/api.h), FFI-friendly for Python, Rust, Go.
  • Secret storage: Windows Credential Manager, macOS Keychain, Linux Secret Service (secret-tool).
  • Packaging / CI: GitHub Actions release workflows across five targets.
  • License: AGPL-3.0.

Problem Statement

Reverse engineering work is typically spread across a fragmented toolchain: one tool for disassembly, another for decompilation, a separate debugger, and ad hoc scripts to move state between them. That fragmentation forces analysts to reconstruct context repeatedly and makes automation brittle, because each tool exposes a different model of the same binary. Rothalyx addresses this by putting binary recovery, decompilation, runtime debugging, persistence, and automation on a single native core so that project state carries forward across static and dynamic analysis.

Why This Project Exists

Rothalyx exists to provide a native reverse engineering environment where the analysis engine is the product, and every interface (desktop, CLI, SDK, plugins, AI) is a thin consumer of that engine. The stated goal is a working research environment rather than a collection of independent component claims. AI is deliberately optional: the pipeline runs fully in heuristic-only mode, and model-backed insight is an added layer that can be disabled.

Sub-Articles (this knowledge base)

  • Zara — the pre-rename identity of this same project; historical references and older asset names use the zara slug. Not a separate product.
  • ROT Independent Security Research Lab — the research lab under which Rothalyx is developed.
🖊️ Edit this page on GitHub← Back to Project Hub