About

Hi — I'm Colin Xiao. I reverse engineer software for a living, and this site is my lab notebook.

I take things apart to understand how they really work: Android apps and native binaries, iOS and macOS, and Windows/PC targets. Most of my time goes into unpacking packers and VMProtect/OLLVM-protected binaries, recovering signature and crypto algorithms, analyzing protocols, and building Frida-based instrumentation. The writeups on this site are the distilled version of that work — real binaries, real techniques, nothing theoretical.

Background

I hold a degree in cybersecurity and work independently as a security researcher. Outside of reverse engineering, I spend a lot of my time on bug bounty hunting — finding and reporting security issues across web, mobile, and infrastructure through vulnerability research and coordinated disclosure.

What I can help you with

• Reverse engineering of Android / iOS / desktop binaries
• Unpacking, deobfuscation, and anti-tamper analysis
• Protocol and crypto algorithm recovery
• Vulnerability research, bug bounty work, and coordinated disclosure
• Malware analysis and technical threat reports

…and more. That list is a starting point, not a limit — my scope includes, but is not limited to, everything above. If it involves understanding, analyzing, breaking, or securing software, I can probably help. Tell me what you're dealing with and I'll tell you if I can take it on.

Work with me

Have a target that needs reversing, or a vulnerability you want disclosed properly? Get in touch:

• Telegram: @ColinXiao666
• X: @colinxiao_lab

I reply fastest on Telegram.