Hands-on reverse engineering and security research: Android, iOS, x86/x64 and ARM native binaries, packers, DRM, protocol analysis, and cryptography.
From device-side risk detection to a policy closed loop: designing a risk-control SDK, scoring engine, and investigation agent end to end, with the setup and commands all covered.
Reversing an Electron app's self-restore mechanism, tracing how it repairs and restores its own files to understand the underlying protection scheme, and the code traced down to the core.
De-obfuscating VMP 3.5 virtualization, working through the VM's handlers and dispatch loop to recover code protected by the older protector, with the result and caveats spelled out.
Reverse engineering Siemens S7CommPlus symbolic access, decoding the PLC protocol's symbolic addressing for industrial control analysis, and the gotchas flagged along the way.
De-flattening mutated OLLVM control flow with angr symbolic execution, recovering the original logic from heavily obfuscated native binaries, with the analysis method shown end to end.
Static unpacking for VMProtect 3.9.5, reversing the rotating-XOR decryption layer to recover the protected binary without ever running it, for anyone reversing similar targets.
Indirect branch obfuscation with LLVM, replacing direct branches with indirect jumps to break static control-flow analysis of compiled binaries, and the internals laid out in detail.
Graph-topology software watermarking with LLVM, part one: embedding watermarks in a program's control-flow graph to track piracy, with every step broken down clearly.
Page-granular dynamic decryption and lazy re-encryption in a Windows packer, explaining how it hides code until the moment of execution, so you can reproduce it yourself.
De-obfuscating ZKM control-flow flattening with ASM, using bytecode rewriting to reconstruct the original Java control flow and logic, with the tools and offsets documented.
Reversing the Windows Photos AI eraser models, digging into the on-device machine learning model files to understand how the feature works, including the pitfalls and the fix.
A general approach to defeating VMProtect-style code virtualization: JIT tracing, equivalence rewriting, and handler matching, with the commands and code included.
Manually de-virtualizing a VMProtect 3.9.4 cmp-jne handler sequence, tracing the handlers to recover the original comparison logic, with a full walkthrough of the technique.
Writing and removing LLVM bogus control flow, showing how the pass inserts junk blocks and opaque predicates, then how to strip them back out, and the mechanism explained clearly.
De-obfuscating an OLLVM CFF and MBA/BDD dylib, reconstructing 167 hooks hidden behind 223 trampolines to recover the real logic, with the setup and commands all covered.
IDA debugger hooks, automating breakpoints, register reads, and memory access from IDAPython scripts to speed up dynamic analysis work, and the bypass logic broken down.
Reversing a native request-signature algorithm, tracing a JNI signing routine down to its native implementation to recover the scheme, with the algorithm recovered in detail.
Debugging the Windows 11 boot process, walking through the tools and techniques to trace startup from UEFI firmware all the way to the kernel, and the code traced down to the core.
Writing and defeating OLLVM control-flow flattening, an offense-defense look at building the obfuscation pass and then reversing it back out, with the result and caveats spelled out.
VMProtect 3.8.1 obfuscation strategies, cataloging the transformation techniques it applies to protected code and how each complicates analysis, and the gotchas flagged along the way.
Reversing a deeply obfuscated modified MD5, cutting through the obfuscation to recover a custom variant of the hash function and its constants, with the analysis method shown end to end.
Understanding the x64 Windows SEH mechanism, explaining how structured exception handling works at the binary level on modern 64-bit Windows, for anyone reversing similar targets.
Analyzing and deobfuscating Polaris's BogusControlFlow pass, using angr to detect opaque predicates and strip the bogus control flow, and the internals laid out in detail.
A Windows 7 loader bug from static DLL dependency order, debugging a packed application crash down to the loader's resolution sequence, with every step broken down clearly.
Building an open-source ARM64 VMP from scratch, virtualizing all 121 A64 base instructions to create a custom VM-based protector, so you can reproduce it yourself.
Reverse engineering a malicious kernel driver, analyzing its dispatch routines and hooks to understand the rootkit's capabilities and intent, with the tools and offsets documented.
Reversing Cython pyd modules, part one: understanding how Cython compiles Python into C extensions and how to read the resulting binaries, including the pitfalls and the fix.
Deobfuscating VMProtect 3.9.4 with symbolic execution, using symbolic analysis to strip the VM's obfuscation and recover the original logic, with the commands and code included.
Tracing how the disk serial number gets written into ClipSp.sys, following the value from its hardware query all the way down into the driver, with a full walkthrough of the technique.
Tracing a WMI query to the kernel, following the full path end to end from a user-mode WMI call down to the kernel provider that answers it, and the mechanism explained clearly.
How Windows DTrace works under the hood, explaining the tracing architecture and how it hooks into the kernel to instrument code, and the bypass logic broken down.
Swift reverse engineering from string memory layout to recovering ChaCha20-Poly1305 plaintext, key, and nonce from a running app, with the algorithm recovered in detail.
ιldb, a command-line scripting layer for LLDB debugging, adding scripting and automation on top of the debugger for faster workflows, and the code traced down to the core.
Statically recovering UE5 UObject reflection struct offsets, locating object layouts without running the game for reversing and modding, with the setup and commands all covered.
Reconstructing the CCED 4.0 encrypted disk, reverse engineering the 1991 copy protection scheme to recover the encryption and key material, with the result and caveats spelled out.
Reconstructing a Bitlock key disk, reverse engineering 1990s disk copy protection to recover the key material from the floppy, and the gotchas flagged along the way.
Fixing the VMProtect 3.5.1 Win32 runtime compilation issue, a troubleshooting walkthrough for a protected binary that won't compile, with the analysis method shown end to end.
Reversing OLLVM control-flow flattening with IDA Hex-Rays microcode, using the decompiler's IR to reconstruct the flattened logic, for anyone reversing similar targets.
Reversing MSVC compiler IL emission and Warbird obfuscation, tracing how the compiler transforms code into its internal representation, and the internals laid out in detail.
Reversing an ARM64 VMP: virtual instructions, virtual registers, and de-virtualization, mapping the custom ISA back to real ARM64, with every step broken down clearly.
Analyzing VMProtect 3.9.4's virtual machine flow, tracing the dispatch loop and handler set that drive its newest VM architecture and opcode mapping, so you can reproduce it yourself.
Analyzing VMProtect 3.0.0 beta's virtual machine handler chaining, tracing how its handlers link together to interpret protected code at runtime, with the tools and offsets documented.
Analyzing VMProtect 2.12.3's virtual machine handler flow, mapping how its handlers chain together to interpret and execute virtualized code, including the pitfalls and the fix.
Reversing the V8 bytecode format, fingerprinting the engine version and disassembling bytecode to read the compiled JavaScript internals, with the commands and code included.
Reversing the Rondo botnet from CVE-2021-35394 to persistence and C2, dissecting its infection chain and command-and-control protocol, with a full walkthrough of the technique.
Tracing Windows syscalls on Windows 10 and 11 via LSTAR and the SSDT, working out parameter counts to hook kernel calls cleanly, and the mechanism explained clearly.
Reverse engineering an iOS device-registration request, decoding the parameters the device sends during enrollment to register with a service, with the algorithm recovered in detail.
Infinite coins in a single-player tower defense game: a first Cheat Engine and x64dbg walkthrough of finding and patching the currency value, and the bypass logic broken down.
Decrypting CR3 via MMPFN to read the real directory base on Windows 7, 10, and 11, resolving the kernel page table pointer across versions, with the setup and commands all covered.
Extracting a WeCom login QR code via reverse engineering, file monitoring, and screenshots, to capture the login flow programmatically, and the code traced down to the core.
Reversing a hardware-detection tool, harvesting CPU and GPU telemetry through its own DLL to understand what it fingerprints, with the result and caveats spelled out.
Unpacking a .NET JIT protector on .NET Framework 4.8+ with WinDbg TTD, using time-travel debugging to recover JIT-compiled methods, and the gotchas flagged along the way.
Removing OLLVM bogus control flow with angr symbolic execution, using symbolic analysis to strip opaque predicates and junk blocks, with the analysis method shown end to end.
Analyzing Windows boot: bootmgfw.efi and the early UEFI boot flow, tracing how the boot manager hands off to the Windows loader, for anyone reversing similar targets.
The Office 2000 50-launch limit: finding the confirmation ID in memory, reversing the classic activation check to lift the trial cap, and the internals laid out in detail.
Android app hardening from whole-APK to code-extraction packing, tracing the evolution of protectors and how each generation is defeated, with every step broken down clearly.
Three ways to protect Android native libraries: function encryption, program-header obfuscation, and a custom ELF format, compared and explained, with the tools and offsets documented.
Replacing the HWID in VMProtect 3.8.4, patching the machine-binding check inside the VM so a protected binary runs on different hardware, so you can reproduce it yourself.
Reversing a Delphi app's registration logic, recovering the object model to crack the license check and understand the registration flow, including the pitfalls and the fix.
A source deep dive into Frida Stalker, explaining how its dynamic code instrumentation and recompilation actually work under the hood, with the commands and code included.
Detecting Zygisk injection via dlclose, a clever trick that catches Magisk's Zygisk hooks by watching for a suspicious library unload, with a full walkthrough of the technique.
Bypassing libmsaoaidsec anti-Frida, another walkthrough of defeating the SDK's Frida detection routines to keep instrumentation running, and the mechanism explained clearly.
FreeFileSync's connection limits and tamper check, reversing the license gating and integrity verification behind the open-source tool's builds, with the algorithm recovered in detail.
A mobile game's mmap-modular anti-hook protection, analyzing how it splits code into mmap'd modules to detect and resist hooking, and the bypass logic broken down.
The native activity launch flow on Android, tracing how an NDK-based app boots from Zygote through the runtime all the way to its native entry point, with the setup and commands all covered.
Recovering a car app's sd signature, reversing the signing algorithm behind the vehicle-control API to craft valid signed requests, and the code traced down to the core.
Hooking every kernel export to analyze a driver's logic, a brute-force approach to mapping exactly what a Windows driver calls at runtime, with the result and caveats spelled out.
A Frida-powered Xposed, building an Xposed-like hooking framework on top of Frida to hook Java methods without the Xposed runtime, and the gotchas flagged along the way.
Hardware breakpoints with Frida, using debug registers to set precise breakpoints that survive code that clears software breakpoints, for anyone reversing similar targets.
Locating ssl_log_secret in a statically-linked BoringSSL, finding the TLS key-logging function to decrypt traffic from a hardened app, with the analysis method shown end to end.
WeChat 4.0 anti-revoke with a reminder, recovering symbols and decrypting strings to hook the message-revoke path and keep deleted messages, and the internals laid out in detail.
Reading EPROCESS and CR3 from MmPfnDatabase, a kernel technique to resolve process structures and page tables from a known physical address, with every step broken down clearly.
How Android app virtualization works, explaining the sandboxed dual-app cloning technology and the hooking and IPC layers underneath it, so you can reproduce it yourself.
Real-time HTTPS decryption with Frida and Wireshark, hooking the app to export TLS session keys and decrypt traffic live in the capture, with the tools and offsets documented.
Recovering a VM-protection bytecode-to-native compiler, mapping virtual instructions back to real ones to de-virtualize the protected code, including the pitfalls and the fix.
Reverse engineering Windows 10's ObRegisterCallbacks and ObUnRegisterCallbacks, explaining how kernel drivers subscribe to object events, with the commands and code included.
Reverse engineering a Java Equinox OSGi application, from encrypted bundles to the decryption hook that unlocks the class files, with a full walkthrough of the technique.
Inside ttEncrypt: tracing a VM-protected JNI cipher down to its SHA-512 and AES primitives, unwrapping the virtualization to recover the algorithm, with the algorithm recovered in detail.
VMProtect 1.81 under the hood: dissecting its VM structure and de-virtualization, mapping the handlers to reconstruct the original native code, and the mechanism explained clearly.
An OLLVM survival guide, collecting practical techniques for navigating flattened control flow, bogus blocks, and instruction substitution, and the bypass logic broken down.
Detecting Frida by byte comparison, a lightweight defense that checks instruction bytes to spot inline hooks the framework left behind, with the setup and commands all covered.
Reversing OLLVM control-flow flattening, reconstructing the original control flow from the dispatcher loop, state variable, and jump tables, and the code traced down to the core.
An eBPF-based Android CLI debugger, using kernel BPF programs to set breakpoints and trace execution without ptrace or a userspace agent, with the result and caveats spelled out.
Bypassing a Korean game's anti-debugging, walking through its ptrace and timing checks and patching them to keep the debugger attached, and the gotchas flagged along the way.
Analyzing the VMP behind a hardened app's onCreate, unwrapping the virtualization layer to recover the real initialization logic and control flow, with the analysis method shown end to end.
From Java to native: how a .so's functions get loaded, tracing the JNI bridge from a Java call down to the native symbol resolution, for anyone reversing similar targets.
Key techniques for dynamic .NET unpacking, dumping assemblies straight from memory and rebuilding them from their JIT-compiled state, and the internals laid out in detail.
Bypassing bilibili's Frida detection, working through the checks the app runs at startup and neutralizing them to keep instrumentation attached, so you can reproduce it yourself.
MFC under the hood: RTTI, message routing, and class hierarchy recovery, decoding the framework's internals to reconstruct C++ classes, with every step broken down clearly.
How PRoot works under the hood, a source-level walkthrough of its ptrace-based syscall emulation that fakes a root filesystem without root, with the tools and offsets documented.
Bypassing libmsaoaidsec.so Frida anti-debugging, walking through the detection routines and patching them so Frida stays hidden on the device, including the pitfalls and the fix.
A first look at Android CRC detection and bypass, showing how apps checksum their own code at runtime and how to patch around those checks, with the commands and code included.
How Android loads a native SO file, walking through the source of the linker and ClassLoader to explain the full dlopen and JNI load path, with a full walkthrough of the technique.
An offense-defense walkthrough of Android signature verification: how it works, how attackers bypass it, and how to defend against tampering, and the mechanism explained clearly.
Reversing dpt-shell, a class-extraction packer, from the inside out to document how it protects and restores DEX classes at runtime, and the bypass logic broken down.
Calling TikTok's signature SO directly with Unidbg, emulating the native library so you can generate valid signatures without running the app, with the algorithm recovered in detail.
Reconstructing RtlCreateHeap from Windows NTDLL, decoding the assembly optimization patterns that make the original source hard to follow, with the setup and commands all covered.
Abyss: intercepting svc syscalls on Android with BPF and seccomp, a kernel-level approach to syscall hooking that leaves no userspace trace behind, and the code traced down to the core.
Decrypting a car infotainment OTA package, reversing the firmware's encryption and signing scheme so you can unpack and inspect the update contents, and the gotchas flagged along the way.
Speaking DCERPC to Windows directly, creating services without CreateService by hand-crafting the RPC calls to the Service Control Manager, with the result and caveats spelled out.
A practical walkthrough of trace-based data-flow analysis, using execution traces to follow tainted values through heavily obfuscated native code, with the analysis method shown end to end.
Reconstructing a DEX VMP from trace capture to opcode recovery, walking the full path from virtualized bytecode back into readable smali you can analyze.
Unidbg as black-box magic for Android native reversing, showing how to emulate SO files to call and trace JNI functions without a device or debugger, for anyone reversing similar targets.
Breaking VMProtect's local license lock by reversing its RSA and big-number encryption, then building a fully working offline keygen from the recovered math.
A survey of software protection from application packing and code encryption to algorithm-level protection, explaining the full landscape and how each layer actually defends a binary.
Analyzing the LIAPP game protection SDK, mapping its anti-tamper checks and obfuscation to understand how it shields mobile games, and the internals laid out in detail.
Analyzing the mtop device risk-control SDK: its jailbreak detection, VMP layer, and multi-stage encryption, broken down end to end, with every step broken down clearly.
A survey of Android injection techniques plus an open-source injection module, comparing ptrace, Zygote, and other routes to load code into a process.
An introduction to reversing Cocos2d-JS games, locating the bundled JavaScript, decrypting the game logic, and hooking it to modify behavior, so you can reproduce it yourself.
Analyzing the control-flow flattening obfuscation pass, explaining how it breaks the CFG into a dispatcher loop and what it looks like in decompiled code.
Unpacking a numeric-brand packer, bypassing its Frida detection, and repacking the app with a valid signature for further analysis, with the tools and offsets documented.
Packet capturing on iOS with Charles, Clash, and Shadowrocket, comparing VPN-based capture setups and how to route around SSL pinning, including the pitfalls and the fix.
Reverse engineering a ticketing app: bypassing its anti-debugging and proxy detection, then cracking the okhttp request signature with Frida, with the commands and code included.
Emulating an aarch64 shared library with Qiling and reversing its VM-protected RC4, decrypting the cipher without native hardware, with a full walkthrough of the technique.
Analyzing the Android boot process from source, tracing init, Zygote, and system_server to explain how the system actually comes up, and the mechanism explained clearly.
Automating system-level device fingerprint countermeasures on Android, using Magisk, Zygisk, APatch, and ptrace to spoof fingerprints at scale, with the algorithm recovered in detail.
A general approach to bypassing Frida detection on Android, using svc hooks and Stalker to hide the framework from apps that actively hunt it, and the bypass logic broken down.
InfinityHook on modern Windows: an ETW-based syscall hook that survives PatchGuard, with the reverse-engineered pieces the original writeup left out, with the setup and commands all covered.
DEX VMP 101: recovering Android DEX virtualization from a real app, walking the unpacking and smali reconstruction, then assessing its security, and the code traced down to the core.
Dynamically injecting Java and native code into a rooted Android device, combining ptrace, Xposed, SandHook, and JNI for runtime code loading, with the result and caveats spelled out.
Analyzing the mtgsig 2.4 signing algorithm, reverse engineering Meituan's risk-control signature to understand its protocol and parameters, and the gotchas flagged along the way.
Bypassing iQIYI's updated libmsaoaidsec.so Frida detection, working around its new anti-debug checks to keep Frida attached to the app, with the analysis method shown end to end.
Source analysis of Hikari's AntiDebug LLVM pass, how it injects randomized ptrace-based anti-debugging checks into iOS binaries at compile time, and the internals laid out in detail.
Source analysis of Hikari's AntiHook LLVM pass, how it detects inline hooks, blocks fishhook rebinding, and guards the Objective-C runtime, for anyone reversing similar targets.
Source analysis of Hikari's AntiClassDump LLVM pass, showing how it rewrites Objective-C method lists to defeat class-dump tooling entirely, with every step broken down clearly.
Analyzing the ttEncrypt algorithm with Unidbg, emulating the native ARM64 library to recover its AES and SHA-512 structure without a device, so you can reproduce it yourself.
How WeChat Channels encrypts video: reversing the WxIsaac64 PRNG in WebAssembly and the 128KB XOR key it uses, via JS instrumentation and MITM, with the tools and offsets documented.
Intercepting Android's Binder IPC at the ioctl layer, hooking the native call so you can observe and tamper with every binder transaction in the app, including the pitfalls and the fix.
Reverse engineering the Alienware keyboard's USB protocol to drive custom RGB lighting, decoding the HID reports with Wireshark for full control, with the commands and code included.
Reverse engineering a ticketing platform's sign parameter to build a ticket-restock monitor, cracking the mtop MD5 signature from the H5 client, with a full walkthrough of the technique.
Compiling rwProcMem33 into the Android kernel to get hardware-breakpoint-driven read and write of process memory, built into a Pixel AOSP image, and the mechanism explained clearly.
Analyzing a fitness app's login protocol, reversing its MD5, SHA1, and AES layers with Frida to reconstruct the sign and password scheme, with the algorithm recovered in detail.
Bypassing an unusual anti-debug and anti-hook in a commercial mobile-game packer, defeating TracerPid and breakpoint detection on ARM64, and the bypass logic broken down.
Reverse engineering the floppy-disk copy protection of KV300+ twenty-five years later, decoding its INT 13 and CRC checks in a retro forensics deep dive.
A general method for capturing HTTPS from Cronet-based apps, working around Chrome's cert pinning and MITM resistance to inspect the traffic, with the setup and commands all covered.
Reversing Source Insight 4.x's license scheme and building an offline keygen, cracking the signature and the base64 registration file format, and the code traced down to the core.
Analyzing an iOS app's login to reverse its _sign and userpwd parameters, tracing CC_MD5 with Frida and IDA to rebuild the exact request, with the result and caveats spelled out.
Reversing a modified AES in a mobile app, reconstructing Bangcle's white-box laes cipher with Frida Stalker and IDA on ARM64 to recover the original algorithm.
A universal svc hook for Android using seccomp and sigaction, intercepting syscalls with BPF filters to trace or modify kernel calls globally, and the gotchas flagged along the way.
How iOS apps detect jailbreaks and how to bypass every check with Frida, hooking stat, dyld, canOpenURL, and fork to hide the jailbreak entirely, with the analysis method shown end to end.
Explaining the Hunter environment-detection SDK used by big-tech anti-fraud: emulator detection, seccomp and binder checks, and how it spots Frida and sandboxes.
Instrumenting an Android app with smali edits to dump Bluetooth AES keys and ciphertext via logcat, a clean way to capture encrypted traffic without hooks.
Comparing four iOS app decryption tools, Clutch, dumpdecrypted, CrackerXI, and frida-ios-dump, with hands-on experience on when each one works best, for anyone reversing similar targets.
Reverse engineering a VPN accelerator's protection stack: root and proxy detection, AES encryption, and the device-ID rotation scheme that keeps it ahead of bans.
Study notes on CodeMeter 7.3's API and communication protocol, covering Wibu's AxProtector, AES-128-CBC, CRC32, and SHA1 inside its license handshake.
Part four of an AOSP source-build series: customizing the ROM and erasing root fingerprints from build.prop and Magisk so detection apps can't spot your device.
Configuring iOS Wi-Fi and proxy settings directly with Frida, driving SpringBoard's WiFikit APIs to script device network setup without ever touching the UI.
Quickly locating a VM-protected algorithm with Frida Stalker, using instruction tracing to cut straight through the obfuscation and pinpoint the real logic.
Custom bcc and eBPF for DWARF-based userspace stack unwinding on Android, combining kernel tracing with libunwindstack to profile native code, and the internals laid out in detail.
Reimplementing WhatsApp's end-to-end encryption: Signal protocol, Curve25519 key exchange, HKDF, and the double ratchet, recovered with Frida from the real app.
The Android property system from the inside: how properties work, how apps detect tampering through them, and how to hide fingerprints from a custom AOSP build.
A first look at a connected-car app wrapped in a commercial packer, mapping its control-flow obfuscation and SSL pinning with Frida, Objection, and Stalker.
Reverse engineering an iOS rhythm game: binary patching with IDA, bypassing TrustKit cert pinning, and intercepting mutual-TLS traffic to capture its API.
How Android apps fingerprint your device and the countermeasures that defeat it, from ptrace and svc hooks to netlink and system-property spoofing, with every step broken down clearly.
Deobfuscating libDexHelper.so inside an enterprise Android shell, defeating its junk instructions, string encryption, and VMP layer with Unicorn and Frida.
Building a ptrace and seccomp sandbox for inline svc hooks, using BPF filters to intercept syscalls tracelessly and read their register arguments, so you can reproduce it yourself.
A new approach to emulating and debugging the Android runtime with Qiling and Unicorn, attaching GDB to ART and JNI for deeper native analysis, with the tools and offsets documented.
Reversing the sign algorithm of a major e-commerce app with Charles, Jadx, Frida, Unidbg, and IDA to reconstruct the MD5-based request signature step by step.
A generic Frida-based method to trace and hook svc syscalls on Android using seccomp, including the threading deadlock pitfall and the fix that avoids it.
Getting a device's MAC address on Android without any permissions, using a netlink socket and inline svc calls to sidestep the OS's access controls, including the pitfalls and the fix.
Hooking objc_msgSend to capture every Objective-C method argument on ARM64, using FishHook and inline hooks to intercept message dispatch right at its core.
A deep look at ART internals across DEX loading, JIT and AOT compilation, and class initialization, and how these mechanisms power Android's security.
Analyzing the network protocol of the blockchain game Mir4, digging into its Unreal Engine build to decode the Protobuf messages exchanged with the server.
Cracking a top-ranked macOS screensaver by tracing its StoreKit restore-purchase flow with Hopper and class-dump until the VIP flag finally shows up, with the commands and code included.
Anti-disassembly tricks on ARM64: building data blocks that decode as bogus instructions, and using B and DCQ to confuse IDA while keeping the code runnable.
A source-level walkthrough of the Android 12 app launch process, tracing Activity, Zygote, AMS, and Binder AIDL calls from the very first tap to a running process.
Using GDA's built-in Frida support to hook and invoke methods directly on decompiled code, fusing static and dynamic analysis into one seamless workflow.
Locating the SM4 encryption key in an iOS ARM64 binary, tracing the key schedule and cipher calls through the disassembly to recover the secret material.
Building a universal iOS tweak that lets you tick any app in settings and bypass its anti-debugging, integrating AppList and PreferenceLoader with Dobby and HookZz.
Bypassing SSL pinning when an app rolls its own HTTP framework and links a non-system SSL library like BoringSSL or Cronet, with Frida hooks for each layer.
An end-to-end iOS reversing journey: jailbreak, dump the FairPlay-encrypted binary, then hook a chat app's dice roll with method swizzling and inline hooks.
Using A64Dbg's ADCpp to call iTunesStored's kbsync remotely over LLDB, invoking an Objective-C method on-device from outside the running process, with a full walkthrough of the technique.
Bypassing an iOS app's layered anti-debugging: well-timed initialization checks, combined ptrace and svc guards, and periodic re-checks, defeated with targeted hooks.
Making Frida hooks persistent on Android without repackaging the APK, using frida-gadget and JNI tricks so your instrumentation survives app restarts.
A clear breakdown of Android's debugging architecture across JDWP, adb port forwarding, and ptrace, and how IDA plugs into all three to debug native code.
Semi-automated reversing with Unicorn: emulate an e-commerce app's native code to recover its sign algorithm without manually tracing every ARM instruction.
Reversing a desktop IM client with Frida: class-dump the headers, find the message-send classes, then tamper with outgoing messages and listen in on incoming ones.
Reversing a messaging app jailbreak-free with MonkeyDev, hooking red packets, message revoke, and step-count spoofing without ever having to jailbreak the device.
From use-after-free to kernel task port: a full exploit walkthrough of CVE-2019-8605, with the heap spraying and Mach ool-message tricks that turn a socket UAF into TFP0.
A root-cause analysis of CVE-2020-27950, an iOS kernel memory leak from an uninitialized Mach message trailer, including the full PoC send and receive flow.
Disabling Android Verified Boot 2.0 by patching vbmeta.img, with the exact flags and steps needed to keep root and Magisk working on a locked-down device.
Reverse engineering SGAVMP, a commercial anti-bot SDK's virtual machine: breaking its anti-F5 decompilation, string encryption, and the signature scheme it protects.
A practical guide to decrypting iOS apps with dumpdecrypted, covering the Mach-O injection, the codesign fix, and the otool verification steps needed to dump a clean binary.
Reversing a chat app's Protobuf protocol over Netty, then building a working message client from scratch by reimplementing its AES and RSA encryption layers.
Reverse engineering a browser's encrypted credential database, recovering the AES-128-ECB key derivation and decrypting stored passwords for forensic analysis.
Setting up an iOS reverse-engineering environment from scratch, then cracking an app's sign algorithm by tracing CCCrypt and CC_MD5 with Frida to recover the key material.
Recovering the encryption seed inside FlexNet Publisher v11.16 and earlier, breaking down the ECC-based license protection that guards commercial software.
Decrypting and re-encrypting a Cocos2d game's Lua scripts, recovering the custom Huffman substitution cipher in the NDK and scripting it back with IDA.
A source-level exploration of FishHook, walking the Mach-O load commands and the symbol and string tables to show exactly how it rewrites lazy GOT pointers to hook functions.
Reversing the Protobuf-based chat protocol of a live-streaming app, decoding the message schemas from bytecode to understand how the chat client talks to the server.
Localizing an iOS game without touching its source code: reuse the bundled translations and drive hook-based text replacement through a dylib to swap in-game strings on the fly.
How to intercept Flutter app traffic on Android: patch the Flutter engine's SSL pinning with Frida and route the device through Drony for clean Burp captures.
Persistent native hooking without repackaging: swap the .so and inline-hook the linker's dlopen and dlsym so every library load routes through your own code.
Bypassing a short-video app's iOS anti-debugging from scratch, working through its ptrace and sysctl checks with MonkeyDev and IDA so the process stays debuggable during analysis.
Reimplementing FART's active-invocation unpacker from scratch in Frida, walking the ART call chain to dump every class a packed Android app actually loads.
Recovering hidden OEM BIOS management endpoints by extracting WMI and MOF interfaces from ACPI tables, turning firmware black boxes into documented attack surface.
A first look at the Swift runtime by building a Frida-based packet capture tool that hooks Alamofire's request flow and defeats SSL pinning on a real device.
Why a scalping assistant's client-side VIP flag was a decoy: the real gate was server-side, a reminder that unpacking and patching the APK isn't always where the value is.
Reverse engineering Apple's GSA login to document the SRP6a variant it uses, tracing the PBKDF2 key derivation and the AES steps behind Apple ID authentication straight from the binary.
Injecting a theos tweak into an iOS game to hijack its avatar upload, swapping the request so the server serves an animated GIF instead of a static image.
Part two of the iOS code-signing deep dive: resource rules, mobileprovision, entitlements, and the exact steps to re-sign an IPA with codesign or ldid.
Part one of a two-part deep dive into iOS code signing: how FairPlay DRM, SC_Info, and CodeResources fit together and what third-party distribution means under the hood.
Combining Frida's API resolver with its Interceptor to hook Objective-C methods reliably, plus method swizzling and file-monitoring tricks from a real iOS session.
A hands-on Frida tutorial on intercepting stripped sub_xxxx functions on iOS, covering NativeFunction and NativeCallback to hook targets that have no symbol names.
How a heavily hardened app's VIP token fell apart: its server-side verification was anchored to a spoofable android_id, so rotating the device ID mints unlimited fresh tokens.
Tracing a short-video app's sig3 request signature from the Java layer through OLLVM-obfuscated native code, using Jadx and Frida to walk the call chain down to the signing routine.
A full-stack Frida walkthrough on a 360-jiagu-protected app: unpacking the DEX, hooking the In-App Purchase logic, simulating packet capture, and analyzing the protocol end to end.
Reversing a plugin-based Android app with Frida from the outside in, navigating its custom class loaders and enum-based dispatch to reach the VIP check and flip the paywall flag for full access.
A comprehensive catalog of the fingerprints Xposed leaves behind, mapping every detection vector from framework stubs to system properties so you know exactly what a detector looks for.
A line-by-line analysis of InfinityHook, the Windows technique that hooks every system call by abusing ETW's CpuClock provider, with the SSDT resolution flow fully explained.
A full teardown of a gray-market livestream app: unpacking the APK, bypassing its payment check, and forensically recovering user data from misconfigured Qiniu cloud storage.
How to reverse WeChat's SnsUploadUI with Frida and post Moments programmatically, tracing the upload flow from a tapped UI down to the underlying network calls.
A walkthrough of reversing an Android app's request signature down into Alibaba's libsgmain.so, tracing the JNI call chain and reconstructing the RC4-based sign algorithm.
How to print Objective-C block parameter signatures straight from LLDB, speeding up iOS reverse engineering by recovering block types without digging through class-dump output.
A deep dive into FART, the DEX unpacker that dumps Android apps by actively invoking every method in ART, with the Android 9.0 source adapted and the core anti-tamper workarounds explained.
Six classic techniques for finding a packed binary's original entry point, from the ESP stack law to language-specific entry points, with OllyDbg walkthroughs that transfer to any modern target.