Android app and native-binary reverse engineering: unpacking, hooking frameworks, signature algorithms, device fingerprinting, and kernel internals.
89 articles
Reversing an ARM64 VMP: virtual instructions, virtual registers, and de-virtualization, mapping the custom ISA back to real ARM64, with every step broken down clearly.
Android app hardening from whole-APK to code-extraction packing, tracing the evolution of protectors and how each generation is defeated, with every step broken down clearly.
A source deep dive into Frida Stalker, explaining how its dynamic code instrumentation and recompilation actually work under the hood, with the commands and code included.
Detecting Zygisk injection via dlclose, a clever trick that catches Magisk's Zygisk hooks by watching for a suspicious library unload, with a full walkthrough of the technique.
Bypassing libmsaoaidsec anti-Frida, another walkthrough of defeating the SDK's Frida detection routines to keep instrumentation running, and the mechanism explained clearly.
A mobile game's mmap-modular anti-hook protection, analyzing how it splits code into mmap'd modules to detect and resist hooking, and the bypass logic broken down.
The native activity launch flow on Android, tracing how an NDK-based app boots from Zygote through the runtime all the way to its native entry point, with the setup and commands all covered.
Recovering a car app's sd signature, reversing the signing algorithm behind the vehicle-control API to craft valid signed requests, and the code traced down to the core.
A Frida-powered Xposed, building an Xposed-like hooking framework on top of Frida to hook Java methods without the Xposed runtime, and the gotchas flagged along the way.
Hardware breakpoints with Frida, using debug registers to set precise breakpoints that survive code that clears software breakpoints, for anyone reversing similar targets.
Locating ssl_log_secret in a statically-linked BoringSSL, finding the TLS key-logging function to decrypt traffic from a hardened app, with the analysis method shown end to end.
How Android app virtualization works, explaining the sandboxed dual-app cloning technology and the hooking and IPC layers underneath it, so you can reproduce it yourself.
Real-time HTTPS decryption with Frida and Wireshark, hooking the app to export TLS session keys and decrypt traffic live in the capture, with the tools and offsets documented.
Detecting Frida by byte comparison, a lightweight defense that checks instruction bytes to spot inline hooks the framework left behind, with the setup and commands all covered.
Reversing OLLVM control-flow flattening, reconstructing the original control flow from the dispatcher loop, state variable, and jump tables, and the code traced down to the core.
An eBPF-based Android CLI debugger, using kernel BPF programs to set breakpoints and trace execution without ptrace or a userspace agent, with the result and caveats spelled out.
Bypassing a Korean game's anti-debugging, walking through its ptrace and timing checks and patching them to keep the debugger attached, and the gotchas flagged along the way.
Analyzing the VMP behind a hardened app's onCreate, unwrapping the virtualization layer to recover the real initialization logic and control flow, with the analysis method shown end to end.
From Java to native: how a .so's functions get loaded, tracing the JNI bridge from a Java call down to the native symbol resolution, for anyone reversing similar targets.
Bypassing bilibili's Frida detection, working through the checks the app runs at startup and neutralizing them to keep instrumentation attached, so you can reproduce it yourself.
How PRoot works under the hood, a source-level walkthrough of its ptrace-based syscall emulation that fakes a root filesystem without root, with the tools and offsets documented.
Bypassing libmsaoaidsec.so Frida anti-debugging, walking through the detection routines and patching them so Frida stays hidden on the device, including the pitfalls and the fix.
A first look at Android CRC detection and bypass, showing how apps checksum their own code at runtime and how to patch around those checks, with the commands and code included.
How Android loads a native SO file, walking through the source of the linker and ClassLoader to explain the full dlopen and JNI load path, with a full walkthrough of the technique.
An offense-defense walkthrough of Android signature verification: how it works, how attackers bypass it, and how to defend against tampering, and the mechanism explained clearly.
Reversing dpt-shell, a class-extraction packer, from the inside out to document how it protects and restores DEX classes at runtime, and the bypass logic broken down.
Calling TikTok's signature SO directly with Unidbg, emulating the native library so you can generate valid signatures without running the app, with the algorithm recovered in detail.
Abyss: intercepting svc syscalls on Android with BPF and seccomp, a kernel-level approach to syscall hooking that leaves no userspace trace behind, and the code traced down to the core.
Decrypting a car infotainment OTA package, reversing the firmware's encryption and signing scheme so you can unpack and inspect the update contents, and the gotchas flagged along the way.
A practical walkthrough of trace-based data-flow analysis, using execution traces to follow tainted values through heavily obfuscated native code, with the analysis method shown end to end.
Reconstructing a DEX VMP from trace capture to opcode recovery, walking the full path from virtualized bytecode back into readable smali you can analyze.
Unidbg as black-box magic for Android native reversing, showing how to emulate SO files to call and trace JNI functions without a device or debugger, for anyone reversing similar targets.
Analyzing the LIAPP game protection SDK, mapping its anti-tamper checks and obfuscation to understand how it shields mobile games, and the internals laid out in detail.
A survey of Android injection techniques plus an open-source injection module, comparing ptrace, Zygote, and other routes to load code into a process.
An introduction to reversing Cocos2d-JS games, locating the bundled JavaScript, decrypting the game logic, and hooking it to modify behavior, so you can reproduce it yourself.
Unpacking a numeric-brand packer, bypassing its Frida detection, and repacking the app with a valid signature for further analysis, with the tools and offsets documented.
Reverse engineering a ticketing app: bypassing its anti-debugging and proxy detection, then cracking the okhttp request signature with Frida, with the commands and code included.
Analyzing the Android boot process from source, tracing init, Zygote, and system_server to explain how the system actually comes up, and the mechanism explained clearly.
Automating system-level device fingerprint countermeasures on Android, using Magisk, Zygisk, APatch, and ptrace to spoof fingerprints at scale, with the algorithm recovered in detail.
A general approach to bypassing Frida detection on Android, using svc hooks and Stalker to hide the framework from apps that actively hunt it, and the bypass logic broken down.
DEX VMP 101: recovering Android DEX virtualization from a real app, walking the unpacking and smali reconstruction, then assessing its security, and the code traced down to the core.
Dynamically injecting Java and native code into a rooted Android device, combining ptrace, Xposed, SandHook, and JNI for runtime code loading, with the result and caveats spelled out.
Analyzing the mtgsig 2.4 signing algorithm, reverse engineering Meituan's risk-control signature to understand its protocol and parameters, and the gotchas flagged along the way.
Bypassing iQIYI's updated libmsaoaidsec.so Frida detection, working around its new anti-debug checks to keep Frida attached to the app, with the analysis method shown end to end.
Analyzing the ttEncrypt algorithm with Unidbg, emulating the native ARM64 library to recover its AES and SHA-512 structure without a device, so you can reproduce it yourself.
Intercepting Android's Binder IPC at the ioctl layer, hooking the native call so you can observe and tamper with every binder transaction in the app, including the pitfalls and the fix.
Reverse engineering a ticketing platform's sign parameter to build a ticket-restock monitor, cracking the mtop MD5 signature from the H5 client, with a full walkthrough of the technique.
Compiling rwProcMem33 into the Android kernel to get hardware-breakpoint-driven read and write of process memory, built into a Pixel AOSP image, and the mechanism explained clearly.
Bypassing an unusual anti-debug and anti-hook in a commercial mobile-game packer, defeating TracerPid and breakpoint detection on ARM64, and the bypass logic broken down.
A general method for capturing HTTPS from Cronet-based apps, working around Chrome's cert pinning and MITM resistance to inspect the traffic, with the setup and commands all covered.
A universal svc hook for Android using seccomp and sigaction, intercepting syscalls with BPF filters to trace or modify kernel calls globally, and the gotchas flagged along the way.
Explaining the Hunter environment-detection SDK used by big-tech anti-fraud: emulator detection, seccomp and binder checks, and how it spots Frida and sandboxes.
Instrumenting an Android app with smali edits to dump Bluetooth AES keys and ciphertext via logcat, a clean way to capture encrypted traffic without hooks.
Reverse engineering a VPN accelerator's protection stack: root and proxy detection, AES encryption, and the device-ID rotation scheme that keeps it ahead of bans.
Part four of an AOSP source-build series: customizing the ROM and erasing root fingerprints from build.prop and Magisk so detection apps can't spot your device.
Quickly locating a VM-protected algorithm with Frida Stalker, using instruction tracing to cut straight through the obfuscation and pinpoint the real logic.
Custom bcc and eBPF for DWARF-based userspace stack unwinding on Android, combining kernel tracing with libunwindstack to profile native code, and the internals laid out in detail.
Reimplementing WhatsApp's end-to-end encryption: Signal protocol, Curve25519 key exchange, HKDF, and the double ratchet, recovered with Frida from the real app.
The Android property system from the inside: how properties work, how apps detect tampering through them, and how to hide fingerprints from a custom AOSP build.
How Android apps fingerprint your device and the countermeasures that defeat it, from ptrace and svc hooks to netlink and system-property spoofing, with every step broken down clearly.
Deobfuscating libDexHelper.so inside an enterprise Android shell, defeating its junk instructions, string encryption, and VMP layer with Unicorn and Frida.
Building a ptrace and seccomp sandbox for inline svc hooks, using BPF filters to intercept syscalls tracelessly and read their register arguments, so you can reproduce it yourself.
A new approach to emulating and debugging the Android runtime with Qiling and Unicorn, attaching GDB to ART and JNI for deeper native analysis, with the tools and offsets documented.
Reversing the sign algorithm of a major e-commerce app with Charles, Jadx, Frida, Unidbg, and IDA to reconstruct the MD5-based request signature step by step.
A generic Frida-based method to trace and hook svc syscalls on Android using seccomp, including the threading deadlock pitfall and the fix that avoids it.
Getting a device's MAC address on Android without any permissions, using a netlink socket and inline svc calls to sidestep the OS's access controls, including the pitfalls and the fix.
A deep look at ART internals across DEX loading, JIT and AOT compilation, and class initialization, and how these mechanisms power Android's security.
A source-level walkthrough of the Android 12 app launch process, tracing Activity, Zygote, AMS, and Binder AIDL calls from the very first tap to a running process.
Using GDA's built-in Frida support to hook and invoke methods directly on decompiled code, fusing static and dynamic analysis into one seamless workflow.
Bypassing SSL pinning when an app rolls its own HTTP framework and links a non-system SSL library like BoringSSL or Cronet, with Frida hooks for each layer.
Making Frida hooks persistent on Android without repackaging the APK, using frida-gadget and JNI tricks so your instrumentation survives app restarts.
A clear breakdown of Android's debugging architecture across JDWP, adb port forwarding, and ptrace, and how IDA plugs into all three to debug native code.
Semi-automated reversing with Unicorn: emulate an e-commerce app's native code to recover its sign algorithm without manually tracing every ARM instruction.
Disabling Android Verified Boot 2.0 by patching vbmeta.img, with the exact flags and steps needed to keep root and Magisk working on a locked-down device.
Reversing a chat app's Protobuf protocol over Netty, then building a working message client from scratch by reimplementing its AES and RSA encryption layers.
Reversing the Protobuf-based chat protocol of a live-streaming app, decoding the message schemas from bytecode to understand how the chat client talks to the server.
How to intercept Flutter app traffic on Android: patch the Flutter engine's SSL pinning with Frida and route the device through Drony for clean Burp captures.
Persistent native hooking without repackaging: swap the .so and inline-hook the linker's dlopen and dlsym so every library load routes through your own code.
Reimplementing FART's active-invocation unpacker from scratch in Frida, walking the ART call chain to dump every class a packed Android app actually loads.
Why a scalping assistant's client-side VIP flag was a decoy: the real gate was server-side, a reminder that unpacking and patching the APK isn't always where the value is.
How a heavily hardened app's VIP token fell apart: its server-side verification was anchored to a spoofable android_id, so rotating the device ID mints unlimited fresh tokens.
Tracing a short-video app's sig3 request signature from the Java layer through OLLVM-obfuscated native code, using Jadx and Frida to walk the call chain down to the signing routine.
A full-stack Frida walkthrough on a 360-jiagu-protected app: unpacking the DEX, hooking the In-App Purchase logic, simulating packet capture, and analyzing the protocol end to end.
Reversing a plugin-based Android app with Frida from the outside in, navigating its custom class loaders and enum-based dispatch to reach the VIP check and flip the paywall flag for full access.
A comprehensive catalog of the fingerprints Xposed leaves behind, mapping every detection vector from framework stubs to system properties so you know exactly what a detector looks for.
A full teardown of a gray-market livestream app: unpacking the APK, bypassing its payment check, and forensically recovering user data from misconfigured Qiniu cloud storage.
How to reverse WeChat's SnsUploadUI with Frida and post Moments programmatically, tracing the upload flow from a tapped UI down to the underlying network calls.
A walkthrough of reversing an Android app's request signature down into Alibaba's libsgmain.so, tracing the JNI call chain and reconstructing the RC4-based sign algorithm.
A deep dive into FART, the DEX unpacker that dumps Android apps by actively invoking every method in ART, with the Android 9.0 source adapted and the core anti-tamper workarounds explained.