Hands-on reverse engineering and security research: Android, iOS, x86/x64 and ARM native binaries, packers, DRM, protocol analysis, and cryptography.https://colinxiao.com/https://colinxiao.com/device-risk-detection-policy-closed-loop/https://colinxiao.com/device-risk-detection-policy-closed-loop/From device-side risk detection to a policy closed loop: designing a risk-control SDK, scoring engine, and investigation agent end to end, with the setup and commands all covered.Sun, 20 Sep 2026 00:00:00 GMThttps://colinxiao.com/reversing-electron-self-restore-mechanism/https://colinxiao.com/reversing-electron-self-restore-mechanism/Reversing an Electron app's self-restore mechanism, tracing how it repairs and restores its own files to understand the underlying protection scheme, and the code traced down to the core.Mon, 14 Sep 2026 00:00:00 GMThttps://colinxiao.com/deobfuscating-vmp35-virtualization/https://colinxiao.com/deobfuscating-vmp35-virtualization/De-obfuscating VMP 3.5 virtualization, working through the VM's handlers and dispatch loop to recover code protected by the older protector, with the result and caveats spelled out.Mon, 07 Sep 2026 00:00:00 GMThttps://colinxiao.com/reversing-siemens-s7commplus-optimized-db-access/https://colinxiao.com/reversing-siemens-s7commplus-optimized-db-access/Reverse engineering Siemens S7CommPlus symbolic access, decoding the PLC protocol's symbolic addressing for industrial control analysis, and the gotchas flagged along the way.Fri, 04 Sep 2026 00:00:00 GMThttps://colinxiao.com/deflattening-mutated-ollvm-with-angr/https://colinxiao.com/deflattening-mutated-ollvm-with-angr/De-flattening mutated OLLVM control flow with angr symbolic execution, recovering the original logic from heavily obfuscated native binaries, with the analysis method shown end to end.Thu, 30 Jul 2026 00:00:00 GMThttps://colinxiao.com/static-unpacking-vmprotect-3-9-5-rotating-xor/https://colinxiao.com/static-unpacking-vmprotect-3-9-5-rotating-xor/Static unpacking for VMProtect 3.9.5, reversing the rotating-XOR decryption layer to recover the protected binary without ever running it, for anyone reversing similar targets.Wed, 29 Jul 2026 00:00:00 GMThttps://colinxiao.com/llvm-indirect-branch-obfuscation/https://colinxiao.com/llvm-indirect-branch-obfuscation/Indirect branch obfuscation with LLVM, replacing direct branches with indirect jumps to break static control-flow analysis of compiled binaries, and the internals laid out in detail.Wed, 08 Jul 2026 00:00:00 GMThttps://colinxiao.com/graph-topology-software-watermarking-llvm-part1/https://colinxiao.com/graph-topology-software-watermarking-llvm-part1/Graph-topology software watermarking with LLVM, part one: embedding watermarks in a program's control-flow graph to track piracy, with every step broken down clearly.Sun, 21 Jun 2026 00:00:00 GMThttps://colinxiao.com/page-granular-dynamic-decryption-lazy-encryption/https://colinxiao.com/page-granular-dynamic-decryption-lazy-encryption/Page-granular dynamic decryption and lazy re-encryption in a Windows packer, explaining how it hides code until the moment of execution, so you can reproduce it yourself.Sun, 24 May 2026 00:00:00 GMThttps://colinxiao.com/deobfuscating-zkm-control-flow-flattening/https://colinxiao.com/deobfuscating-zkm-control-flow-flattening/De-obfuscating ZKM control-flow flattening with ASM, using bytecode rewriting to reconstruct the original Java control flow and logic, with the tools and offsets documented.Fri, 15 May 2026 00:00:00 GMThttps://colinxiao.com/reversing-windows-photos-ai-eraser-models/https://colinxiao.com/reversing-windows-photos-ai-eraser-models/Reversing the Windows Photos AI eraser models, digging into the on-device machine learning model files to understand how the feature works, including the pitfalls and the fix.Mon, 11 May 2026 00:00:00 GMThttps://colinxiao.com/general-approach-vmprotect-code-virtualization/https://colinxiao.com/general-approach-vmprotect-code-virtualization/A general approach to defeating VMProtect-style code virtualization: JIT tracing, equivalence rewriting, and handler matching, with the commands and code included.Sat, 09 May 2026 00:00:00 GMThttps://colinxiao.com/manually-devirtualizing-vmp-3-9-4-cmp-jne/https://colinxiao.com/manually-devirtualizing-vmp-3-9-4-cmp-jne/Manually de-virtualizing a VMProtect 3.9.4 cmp-jne handler sequence, tracing the handlers to recover the original comparison logic, with a full walkthrough of the technique.Thu, 30 Apr 2026 00:00:00 GMThttps://colinxiao.com/writing-and-removing-llvm-bogus-control-flow/https://colinxiao.com/writing-and-removing-llvm-bogus-control-flow/Writing and removing LLVM bogus control flow, showing how the pass inserts junk blocks and opaque predicates, then how to strip them back out, and the mechanism explained clearly.Tue, 28 Apr 2026 00:00:00 GMThttps://colinxiao.com/deobfuscating-ollvm-cff-mba-bdd-dylib-167-hooks/https://colinxiao.com/deobfuscating-ollvm-cff-mba-bdd-dylib-167-hooks/De-obfuscating an OLLVM CFF and MBA/BDD dylib, reconstructing 167 hooks hidden behind 223 trampolines to recover the real logic, with the setup and commands all covered.Sun, 26 Apr 2026 00:00:00 GMThttps://colinxiao.com/ida-debugger-hooks-automation/https://colinxiao.com/ida-debugger-hooks-automation/IDA debugger hooks, automating breakpoints, register reads, and memory access from IDAPython scripts to speed up dynamic analysis work, and the bypass logic broken down.Sun, 26 Apr 2026 00:00:00 GMThttps://colinxiao.com/reversing-native-request-signature-algorithm/https://colinxiao.com/reversing-native-request-signature-algorithm/Reversing a native request-signature algorithm, tracing a JNI signing routine down to its native implementation to recover the scheme, with the algorithm recovered in detail.Sun, 26 Apr 2026 00:00:00 GMThttps://colinxiao.com/debugging-windows-11-boot-process/https://colinxiao.com/debugging-windows-11-boot-process/Debugging the Windows 11 boot process, walking through the tools and techniques to trace startup from UEFI firmware all the way to the kernel, and the code traced down to the core.Thu, 23 Apr 2026 00:00:00 GMThttps://colinxiao.com/writing-and-defeating-ollvm-control-flow-flattening/https://colinxiao.com/writing-and-defeating-ollvm-control-flow-flattening/Writing and defeating OLLVM control-flow flattening, an offense-defense look at building the obfuscation pass and then reversing it back out, with the result and caveats spelled out.Wed, 15 Apr 2026 00:00:00 GMThttps://colinxiao.com/vmprotect-3-8-1-obfuscation-strategies/https://colinxiao.com/vmprotect-3-8-1-obfuscation-strategies/VMProtect 3.8.1 obfuscation strategies, cataloging the transformation techniques it applies to protected code and how each complicates analysis, and the gotchas flagged along the way.Thu, 09 Apr 2026 00:00:00 GMThttps://colinxiao.com/reversing-deeply-obfuscated-modified-md5/https://colinxiao.com/reversing-deeply-obfuscated-modified-md5/Reversing a deeply obfuscated modified MD5, cutting through the obfuscation to recover a custom variant of the hash function and its constants, with the analysis method shown end to end.Tue, 07 Apr 2026 00:00:00 GMThttps://colinxiao.com/understanding-x64-windows-seh-mechanism/https://colinxiao.com/understanding-x64-windows-seh-mechanism/Understanding the x64 Windows SEH mechanism, explaining how structured exception handling works at the binary level on modern 64-bit Windows, for anyone reversing similar targets.Sun, 29 Mar 2026 00:00:00 GMThttps://colinxiao.com/analyzing-deobfuscating-polaris-boguscontrolflow-pass/https://colinxiao.com/analyzing-deobfuscating-polaris-boguscontrolflow-pass/Analyzing and deobfuscating Polaris's BogusControlFlow pass, using angr to detect opaque predicates and strip the bogus control flow, and the internals laid out in detail.Sun, 22 Mar 2026 00:00:00 GMThttps://colinxiao.com/windows7-loader-dll-dependency-order-crash/https://colinxiao.com/windows7-loader-dll-dependency-order-crash/A Windows 7 loader bug from static DLL dependency order, debugging a packed application crash down to the loader's resolution sequence, with every step broken down clearly.Wed, 11 Mar 2026 00:00:00 GMThttps://colinxiao.com/building-arm64-vmp-from-scratch/https://colinxiao.com/building-arm64-vmp-from-scratch/Building an open-source ARM64 VMP from scratch, virtualizing all 121 A64 base instructions to create a custom VM-based protector, so you can reproduce it yourself.Wed, 04 Mar 2026 00:00:00 GMThttps://colinxiao.com/reversing-malicious-kernel-driver-injection/https://colinxiao.com/reversing-malicious-kernel-driver-injection/Reverse engineering a malicious kernel driver, analyzing its dispatch routines and hooks to understand the rootkit's capabilities and intent, with the tools and offsets documented.Sun, 08 Feb 2026 00:00:00 GMThttps://colinxiao.com/reversing-cython-pyd-modules-part-1/https://colinxiao.com/reversing-cython-pyd-modules-part-1/Reversing Cython pyd modules, part one: understanding how Cython compiles Python into C extensions and how to read the resulting binaries, including the pitfalls and the fix.Mon, 26 Jan 2026 00:00:00 GMThttps://colinxiao.com/deobfuscating-vmprotect-3-9-4/https://colinxiao.com/deobfuscating-vmprotect-3-9-4/Deobfuscating VMProtect 3.9.4 with symbolic execution, using symbolic analysis to strip the VM's obfuscation and recover the original logic, with the commands and code included.Sun, 25 Jan 2026 00:00:00 GMThttps://colinxiao.com/tracing-disk-serial-number-write-into-clipsp-sys/https://colinxiao.com/tracing-disk-serial-number-write-into-clipsp-sys/Tracing how the disk serial number gets written into ClipSp.sys, following the value from its hardware query all the way down into the driver, with a full walkthrough of the technique.Sat, 03 Jan 2026 00:00:00 GMThttps://colinxiao.com/tracing-wmi-query-to-kernel-serial-number-uid/https://colinxiao.com/tracing-wmi-query-to-kernel-serial-number-uid/Tracing a WMI query to the kernel, following the full path end to end from a user-mode WMI call down to the kernel provider that answers it, and the mechanism explained clearly.Tue, 23 Dec 2025 00:00:00 GMThttps://colinxiao.com/how-windows-dtrace-works-under-the-hood/https://colinxiao.com/how-windows-dtrace-works-under-the-hood/How Windows DTrace works under the hood, explaining the tracing architecture and how it hooks into the kernel to instrument code, and the bypass logic broken down.Sat, 20 Dec 2025 00:00:00 GMThttps://colinxiao.com/swift-reverse-engineering-chacha20poly1305/https://colinxiao.com/swift-reverse-engineering-chacha20poly1305/Swift reverse engineering from string memory layout to recovering ChaCha20-Poly1305 plaintext, key, and nonce from a running app, with the algorithm recovered in detail.Sat, 20 Dec 2025 00:00:00 GMThttps://colinxiao.com/ildb-command-line-scripting-layer-lldb/https://colinxiao.com/ildb-command-line-scripting-layer-lldb/ιldb, a command-line scripting layer for LLDB debugging, adding scripting and automation on top of the debugger for faster workflows, and the code traced down to the core.Thu, 18 Dec 2025 00:00:00 GMThttps://colinxiao.com/statically-recovering-ue5-uobject-reflection-offsets/https://colinxiao.com/statically-recovering-ue5-uobject-reflection-offsets/Statically recovering UE5 UObject reflection struct offsets, locating object layouts without running the game for reversing and modding, with the setup and commands all covered.Thu, 18 Dec 2025 00:00:00 GMThttps://colinxiao.com/reconstructing-cced-4-encrypted-disk/https://colinxiao.com/reconstructing-cced-4-encrypted-disk/Reconstructing the CCED 4.0 encrypted disk, reverse engineering the 1991 copy protection scheme to recover the encryption and key material, with the result and caveats spelled out.Mon, 01 Dec 2025 00:00:00 GMThttps://colinxiao.com/reconstructing-bitlock-key-disk/https://colinxiao.com/reconstructing-bitlock-key-disk/Reconstructing a Bitlock key disk, reverse engineering 1990s disk copy protection to recover the key material from the floppy, and the gotchas flagged along the way.Sun, 30 Nov 2025 00:00:00 GMThttps://colinxiao.com/fixing-vmprotect-3-5-1-win32-runtime-compilation-issue/https://colinxiao.com/fixing-vmprotect-3-5-1-win32-runtime-compilation-issue/Fixing the VMProtect 3.5.1 Win32 runtime compilation issue, a troubleshooting walkthrough for a protected binary that won't compile, with the analysis method shown end to end.Mon, 17 Nov 2025 00:00:00 GMThttps://colinxiao.com/reversing-ollvm-control-flow-flattening-ida-microcode/https://colinxiao.com/reversing-ollvm-control-flow-flattening-ida-microcode/Reversing OLLVM control-flow flattening with IDA Hex-Rays microcode, using the decompiler's IR to reconstruct the flattened logic, for anyone reversing similar targets.Tue, 11 Nov 2025 00:00:00 GMThttps://colinxiao.com/reversing-msvc-compiler-il-emission-warbird-obfuscation/https://colinxiao.com/reversing-msvc-compiler-il-emission-warbird-obfuscation/Reversing MSVC compiler IL emission and Warbird obfuscation, tracing how the compiler transforms code into its internal representation, and the internals laid out in detail.Fri, 17 Oct 2025 00:00:00 GMThttps://colinxiao.com/reversing-arm64-vmp/https://colinxiao.com/reversing-arm64-vmp/Reversing an ARM64 VMP: virtual instructions, virtual registers, and de-virtualization, mapping the custom ISA back to real ARM64, with every step broken down clearly.Fri, 10 Oct 2025 00:00:00 GMThttps://colinxiao.com/analyzing-vmprotect-3-9-4-virtual-machine-flow/https://colinxiao.com/analyzing-vmprotect-3-9-4-virtual-machine-flow/Analyzing VMProtect 3.9.4's virtual machine flow, tracing the dispatch loop and handler set that drive its newest VM architecture and opcode mapping, so you can reproduce it yourself.Sat, 04 Oct 2025 00:00:00 GMThttps://colinxiao.com/analyzing-vmprotect-3-0-0beta-virtual-machine-flow/https://colinxiao.com/analyzing-vmprotect-3-0-0beta-virtual-machine-flow/Analyzing VMProtect 3.0.0 beta's virtual machine handler chaining, tracing how its handlers link together to interpret protected code at runtime, with the tools and offsets documented.Wed, 01 Oct 2025 00:00:00 GMThttps://colinxiao.com/analyzing-vmprotect-2-12-3-virtual-machine-handler-flow/https://colinxiao.com/analyzing-vmprotect-2-12-3-virtual-machine-handler-flow/Analyzing VMProtect 2.12.3's virtual machine handler flow, mapping how its handlers chain together to interpret and execute virtualized code, including the pitfalls and the fix.Mon, 29 Sep 2025 00:00:00 GMThttps://colinxiao.com/reversing-v8-bytecode-format-version-fingerprinting-disassembly/https://colinxiao.com/reversing-v8-bytecode-format-version-fingerprinting-disassembly/Reversing the V8 bytecode format, fingerprinting the engine version and disassembling bytecode to read the compiled JavaScript internals, with the commands and code included.Sat, 27 Sep 2025 00:00:00 GMThttps://colinxiao.com/reversing-rondo-botnet-cve-2021-35394-persistence-c2/https://colinxiao.com/reversing-rondo-botnet-cve-2021-35394-persistence-c2/Reversing the Rondo botnet from CVE-2021-35394 to persistence and C2, dissecting its infection chain and command-and-control protocol, with a full walkthrough of the technique.Mon, 22 Sep 2025 00:00:00 GMThttps://colinxiao.com/tracing-windows-syscalls-win10-win11-lstar-ssdt-parameter-count/https://colinxiao.com/tracing-windows-syscalls-win10-win11-lstar-ssdt-parameter-count/Tracing Windows syscalls on Windows 10 and 11 via LSTAR and the SSDT, working out parameter counts to hook kernel calls cleanly, and the mechanism explained clearly.Fri, 15 Aug 2025 00:00:00 GMThttps://colinxiao.com/reverse-engineering-ios-device-registration-fingerprint/https://colinxiao.com/reverse-engineering-ios-device-registration-fingerprint/Reverse engineering an iOS device-registration request, decoding the parameters the device sends during enrollment to register with a service, with the algorithm recovered in detail.Mon, 04 Aug 2025 00:00:00 GMThttps://colinxiao.com/infinite-coins-tower-defense-ce-x64dbg/https://colinxiao.com/infinite-coins-tower-defense-ce-x64dbg/Infinite coins in a single-player tower defense game: a first Cheat Engine and x64dbg walkthrough of finding and patching the currency value, and the bypass logic broken down.Fri, 01 Aug 2025 00:00:00 GMThttps://colinxiao.com/decrypting-cr3-via-mmpfn/https://colinxiao.com/decrypting-cr3-via-mmpfn/Decrypting CR3 via MMPFN to read the real directory base on Windows 7, 10, and 11, resolving the kernel page table pointer across versions, with the setup and commands all covered.Sun, 27 Jul 2025 00:00:00 GMThttps://colinxiao.com/extracting-wecom-login-qr-code/https://colinxiao.com/extracting-wecom-login-qr-code/Extracting a WeCom login QR code via reverse engineering, file monitoring, and screenshots, to capture the login flow programmatically, and the code traced down to the core.Fri, 27 Jun 2025 00:00:00 GMThttps://colinxiao.com/reversing-hardware-detection-tool-dll/https://colinxiao.com/reversing-hardware-detection-tool-dll/Reversing a hardware-detection tool, harvesting CPU and GPU telemetry through its own DLL to understand what it fingerprints, with the result and caveats spelled out.Fri, 20 Jun 2025 00:00:00 GMThttps://colinxiao.com/unpacking-dotnet-jit-protector-net-framework-4-8-windbg-ttd/https://colinxiao.com/unpacking-dotnet-jit-protector-net-framework-4-8-windbg-ttd/Unpacking a .NET JIT protector on .NET Framework 4.8+ with WinDbg TTD, using time-travel debugging to recover JIT-compiled methods, and the gotchas flagged along the way.Fri, 13 Jun 2025 00:00:00 GMThttps://colinxiao.com/removing-ollvm-bogus-control-flow-angr-symbolic-execution/https://colinxiao.com/removing-ollvm-bogus-control-flow-angr-symbolic-execution/Removing OLLVM bogus control flow with angr symbolic execution, using symbolic analysis to strip opaque predicates and junk blocks, with the analysis method shown end to end.Tue, 03 Jun 2025 00:00:00 GMThttps://colinxiao.com/analyzing-windows-boot-bootmgfw-efi-early-uefi-boot-flow/https://colinxiao.com/analyzing-windows-boot-bootmgfw-efi-early-uefi-boot-flow/Analyzing Windows boot: bootmgfw.efi and the early UEFI boot flow, tracing how the boot manager hands off to the Windows loader, for anyone reversing similar targets.Sat, 31 May 2025 00:00:00 GMThttps://colinxiao.com/office-2000-50-launch-limit-confirmation-id/https://colinxiao.com/office-2000-50-launch-limit-confirmation-id/The Office 2000 50-launch limit: finding the confirmation ID in memory, reversing the classic activation check to lift the trial cap, and the internals laid out in detail.Sat, 24 May 2025 00:00:00 GMThttps://colinxiao.com/android-app-hardening-whole-apk-to-code-extraction/https://colinxiao.com/android-app-hardening-whole-apk-to-code-extraction/Android app hardening from whole-APK to code-extraction packing, tracing the evolution of protectors and how each generation is defeated, with every step broken down clearly.Wed, 21 May 2025 00:00:00 GMThttps://colinxiao.com/android-native-library-protection-techniques/https://colinxiao.com/android-native-library-protection-techniques/Three ways to protect Android native libraries: function encryption, program-header obfuscation, and a custom ELF format, compared and explained, with the tools and offsets documented.Sun, 18 May 2025 00:00:00 GMThttps://colinxiao.com/replacing-hwid-vmprotect-3-8-4/https://colinxiao.com/replacing-hwid-vmprotect-3-8-4/Replacing the HWID in VMProtect 3.8.4, patching the machine-binding check inside the VM so a protected binary runs on different hardware, so you can reproduce it yourself.Sun, 18 May 2025 00:00:00 GMThttps://colinxiao.com/reversing-si-objectbrowser-registration/https://colinxiao.com/reversing-si-objectbrowser-registration/Reversing a Delphi app's registration logic, recovering the object model to crack the license check and understand the registration flow, including the pitfalls and the fix.Fri, 16 May 2025 00:00:00 GMThttps://colinxiao.com/frida-stalker-source-code-deep-dive/https://colinxiao.com/frida-stalker-source-code-deep-dive/A source deep dive into Frida Stalker, explaining how its dynamic code instrumentation and recompilation actually work under the hood, with the commands and code included.Thu, 15 May 2025 00:00:00 GMThttps://colinxiao.com/detecting-zygisk-injection-dlclose-soinfo-gap/https://colinxiao.com/detecting-zygisk-injection-dlclose-soinfo-gap/Detecting Zygisk injection via dlclose, a clever trick that catches Magisk's Zygisk hooks by watching for a suspicious library unload, with a full walkthrough of the technique.Sun, 11 May 2025 00:00:00 GMThttps://colinxiao.com/bypassing-libmsaoaidsec-anti-frida/https://colinxiao.com/bypassing-libmsaoaidsec-anti-frida/Bypassing libmsaoaidsec anti-Frida, another walkthrough of defeating the SDK's Frida detection routines to keep instrumentation running, and the mechanism explained clearly.Fri, 09 May 2025 00:00:00 GMThttps://colinxiao.com/freefilesync-connection-limits-and-tamper-check/https://colinxiao.com/freefilesync-connection-limits-and-tamper-check/FreeFileSync's connection limits and tamper check, reversing the license gating and integrity verification behind the open-source tool's builds, with the algorithm recovered in detail.Wed, 07 May 2025 00:00:00 GMThttps://colinxiao.com/mobile-game-mmap-modular-anti-hook-protection/https://colinxiao.com/mobile-game-mmap-modular-anti-hook-protection/A mobile game's mmap-modular anti-hook protection, analyzing how it splits code into mmap'd modules to detect and resist hooking, and the bypass logic broken down.Tue, 06 May 2025 00:00:00 GMThttps://colinxiao.com/native-activity-launch-flow-launcher-to-oncreate/https://colinxiao.com/native-activity-launch-flow-launcher-to-oncreate/The native activity launch flow on Android, tracing how an NDK-based app boots from Zygote through the runtime all the way to its native entry point, with the setup and commands all covered.Sat, 03 May 2025 00:00:00 GMThttps://colinxiao.com/car-app-sd-signature-whitebox-aes-dfa/https://colinxiao.com/car-app-sd-signature-whitebox-aes-dfa/Recovering a car app's sd signature, reversing the signing algorithm behind the vehicle-control API to craft valid signed requests, and the code traced down to the core.Mon, 28 Apr 2025 00:00:00 GMThttps://colinxiao.com/hooking-every-kernel-export-to-analyze-driver-logic/https://colinxiao.com/hooking-every-kernel-export-to-analyze-driver-logic/Hooking every kernel export to analyze a driver's logic, a brute-force approach to mapping exactly what a Windows driver calls at runtime, with the result and caveats spelled out.Sun, 27 Apr 2025 00:00:00 GMThttps://colinxiao.com/frida-xposed-zygote-injection-serverless-hooking/https://colinxiao.com/frida-xposed-zygote-injection-serverless-hooking/A Frida-powered Xposed, building an Xposed-like hooking framework on top of Frida to hook Java methods without the Xposed runtime, and the gotchas flagged along the way.Sat, 26 Apr 2025 00:00:00 GMThttps://colinxiao.com/frida-hardware-breakpoints-watchpoints/https://colinxiao.com/frida-hardware-breakpoints-watchpoints/Hardware breakpoints with Frida, using debug registers to set precise breakpoints that survive code that clears software breakpoints, for anyone reversing similar targets.Fri, 25 Apr 2025 00:00:00 GMThttps://colinxiao.com/locating-ssl-log-secret-boringssl-frida/https://colinxiao.com/locating-ssl-log-secret-boringssl-frida/Locating ssl_log_secret in a statically-linked BoringSSL, finding the TLS key-logging function to decrypt traffic from a hardened app, with the analysis method shown end to end.Fri, 25 Apr 2025 00:00:00 GMThttps://colinxiao.com/wechat-4-anti-revoke-symbol-recovery-string-decryption/https://colinxiao.com/wechat-4-anti-revoke-symbol-recovery-string-decryption/WeChat 4.0 anti-revoke with a reminder, recovering symbols and decrypting strings to hook the message-revoke path and keep deleted messages, and the internals laid out in detail.Fri, 25 Apr 2025 00:00:00 GMThttps://colinxiao.com/reading-eprocess-and-cr3-from-mmpfndatabase/https://colinxiao.com/reading-eprocess-and-cr3-from-mmpfndatabase/Reading EPROCESS and CR3 from MmPfnDatabase, a kernel technique to resolve process structures and page tables from a known physical address, with every step broken down clearly.Wed, 23 Apr 2025 00:00:00 GMThttps://colinxiao.com/android-app-virtualization-virtualapp-architecture/https://colinxiao.com/android-app-virtualization-virtualapp-architecture/How Android app virtualization works, explaining the sandboxed dual-app cloning technology and the hooking and IPC layers underneath it, so you can reproduce it yourself.Fri, 18 Apr 2025 00:00:00 GMThttps://colinxiao.com/frida-wireshark-https-decryption-hook-libssl/https://colinxiao.com/frida-wireshark-https-decryption-hook-libssl/Real-time HTTPS decryption with Frida and Wireshark, hooking the app to export TLS session keys and decrypt traffic live in the capture, with the tools and offsets documented.Wed, 16 Apr 2025 00:00:00 GMThttps://colinxiao.com/recovering-vm-protection-bytecode-to-native/https://colinxiao.com/recovering-vm-protection-bytecode-to-native/Recovering a VM-protection bytecode-to-native compiler, mapping virtual instructions back to real ones to de-virtualize the protected code, including the pitfalls and the fix.Fri, 11 Apr 2025 00:00:00 GMThttps://colinxiao.com/reverse-engineering-windows-obregistercallbacks-obunregistercallbacks/https://colinxiao.com/reverse-engineering-windows-obregistercallbacks-obunregistercallbacks/Reverse engineering Windows 10's ObRegisterCallbacks and ObUnRegisterCallbacks, explaining how kernel drivers subscribe to object events, with the commands and code included.Fri, 04 Apr 2025 00:00:00 GMThttps://colinxiao.com/reverse-engineering-java-equinox-osgi-encrypted-bundles-decryption-hook/https://colinxiao.com/reverse-engineering-java-equinox-osgi-encrypted-bundles-decryption-hook/Reverse engineering a Java Equinox OSGi application, from encrypted bundles to the decryption hook that unlocks the class files, with a full walkthrough of the technique.Wed, 02 Apr 2025 00:00:00 GMThttps://colinxiao.com/reversing-ttencrypt-vm-protected-jni-cipher/https://colinxiao.com/reversing-ttencrypt-vm-protected-jni-cipher/Inside ttEncrypt: tracing a VM-protected JNI cipher down to its SHA-512 and AES primitives, unwrapping the virtualization to recover the algorithm, with the algorithm recovered in detail.Mon, 31 Mar 2025 00:00:00 GMThttps://colinxiao.com/vmprotect-under-the-hood-vm-structure-devirtualization/https://colinxiao.com/vmprotect-under-the-hood-vm-structure-devirtualization/VMProtect 1.81 under the hood: dissecting its VM structure and de-virtualization, mapping the handlers to reconstruct the original native code, and the mechanism explained clearly.Mon, 31 Mar 2025 00:00:00 GMThttps://colinxiao.com/ollvm-survival-guide/https://colinxiao.com/ollvm-survival-guide/An OLLVM survival guide, collecting practical techniques for navigating flattened control flow, bogus blocks, and instruction substitution, and the bypass logic broken down.Sun, 30 Mar 2025 00:00:00 GMThttps://colinxiao.com/detecting-frida-hook-byte-comparison/https://colinxiao.com/detecting-frida-hook-byte-comparison/Detecting Frida by byte comparison, a lightweight defense that checks instruction bytes to spot inline hooks the framework left behind, with the setup and commands all covered.Fri, 28 Mar 2025 00:00:00 GMThttps://colinxiao.com/reversing-ollvm-control-flow-flattening/https://colinxiao.com/reversing-ollvm-control-flow-flattening/Reversing OLLVM control-flow flattening, reconstructing the original control flow from the dispatcher loop, state variable, and jump tables, and the code traced down to the core.Sun, 23 Mar 2025 00:00:00 GMThttps://colinxiao.com/ebpf-android-cli-debugger-edbg/https://colinxiao.com/ebpf-android-cli-debugger-edbg/An eBPF-based Android CLI debugger, using kernel BPF programs to set breakpoints and trace execution without ptrace or a userspace agent, with the result and caveats spelled out.Fri, 21 Mar 2025 00:00:00 GMThttps://colinxiao.com/bypassing-korean-game-anti-debugging/https://colinxiao.com/bypassing-korean-game-anti-debugging/Bypassing a Korean game's anti-debugging, walking through its ptrace and timing checks and patching them to keep the debugger attached, and the gotchas flagged along the way.Tue, 18 Mar 2025 00:00:00 GMThttps://colinxiao.com/hardened-app-oncreate-vmp-analysis/https://colinxiao.com/hardened-app-oncreate-vmp-analysis/Analyzing the VMP behind a hardened app's onCreate, unwrapping the virtualization layer to recover the real initialization logic and control flow, with the analysis method shown end to end.Thu, 13 Mar 2025 00:00:00 GMThttps://colinxiao.com/java-to-native-so-loading-step-by-step/https://colinxiao.com/java-to-native-so-loading-step-by-step/From Java to native: how a .so's functions get loaded, tracing the JNI bridge from a Java call down to the native symbol resolution, for anyone reversing similar targets.Mon, 10 Mar 2025 00:00:00 GMThttps://colinxiao.com/key-techniques-for-dynamic-dotnet-unpacking/https://colinxiao.com/key-techniques-for-dynamic-dotnet-unpacking/Key techniques for dynamic .NET unpacking, dumping assemblies straight from memory and rebuilding them from their JIT-compiled state, and the internals laid out in detail.Mon, 10 Mar 2025 00:00:00 GMThttps://colinxiao.com/bypassing-bilibili-frida-detection/https://colinxiao.com/bypassing-bilibili-frida-detection/Bypassing bilibili's Frida detection, working through the checks the app runs at startup and neutralizing them to keep instrumentation attached, so you can reproduce it yourself.Thu, 06 Mar 2025 00:00:00 GMThttps://colinxiao.com/mfc-under-the-hood-rtti-message-routing-class-hierarchy-recovery/https://colinxiao.com/mfc-under-the-hood-rtti-message-routing-class-hierarchy-recovery/MFC under the hood: RTTI, message routing, and class hierarchy recovery, decoding the framework's internals to reconstruct C++ classes, with every step broken down clearly.Thu, 06 Mar 2025 00:00:00 GMThttps://colinxiao.com/how-proot-works-source-walkthrough/https://colinxiao.com/how-proot-works-source-walkthrough/How PRoot works under the hood, a source-level walkthrough of its ptrace-based syscall emulation that fakes a root filesystem without root, with the tools and offsets documented.Wed, 05 Mar 2025 00:00:00 GMThttps://colinxiao.com/bypass-libmsaoaidsec-frida-anti-debugging/https://colinxiao.com/bypass-libmsaoaidsec-frida-anti-debugging/Bypassing libmsaoaidsec.so Frida anti-debugging, walking through the detection routines and patching them so Frida stays hidden on the device, including the pitfalls and the fix.Sun, 02 Mar 2025 00:00:00 GMThttps://colinxiao.com/android-crc-detection-bypass/https://colinxiao.com/android-crc-detection-bypass/A first look at Android CRC detection and bypass, showing how apps checksum their own code at runtime and how to patch around those checks, with the commands and code included.Fri, 28 Feb 2025 00:00:00 GMThttps://colinxiao.com/android-so-loading-process/https://colinxiao.com/android-so-loading-process/How Android loads a native SO file, walking through the source of the linker and ClassLoader to explain the full dlopen and JNI load path, with a full walkthrough of the technique.Fri, 28 Feb 2025 00:00:00 GMThttps://colinxiao.com/android-signature-verification-offense-defense/https://colinxiao.com/android-signature-verification-offense-defense/An offense-defense walkthrough of Android signature verification: how it works, how attackers bypass it, and how to defend against tampering, and the mechanism explained clearly.Wed, 19 Feb 2025 00:00:00 GMThttps://colinxiao.com/reversing-dpt-shell-class-extraction-packer/https://colinxiao.com/reversing-dpt-shell-class-extraction-packer/Reversing dpt-shell, a class-extraction packer, from the inside out to document how it protects and restores DEX classes at runtime, and the bypass logic broken down.Tue, 18 Feb 2025 00:00:00 GMThttps://colinxiao.com/unidbg-tiktok-signature-so/https://colinxiao.com/unidbg-tiktok-signature-so/Calling TikTok's signature SO directly with Unidbg, emulating the native library so you can generate valid signatures without running the app, with the algorithm recovered in detail.Tue, 18 Feb 2025 00:00:00 GMThttps://colinxiao.com/reconstructing-rtlcreateheap-assembly-optimization-patterns-windows-ntdll/https://colinxiao.com/reconstructing-rtlcreateheap-assembly-optimization-patterns-windows-ntdll/Reconstructing RtlCreateHeap from Windows NTDLL, decoding the assembly optimization patterns that make the original source hard to follow, with the setup and commands all covered.Thu, 13 Feb 2025 00:00:00 GMThttps://colinxiao.com/abyss-intercepting-android-svc-syscalls-bpf-seccomp/https://colinxiao.com/abyss-intercepting-android-svc-syscalls-bpf-seccomp/Abyss: intercepting svc syscalls on Android with BPF and seccomp, a kernel-level approach to syscall hooking that leaves no userspace trace behind, and the code traced down to the core.Thu, 23 Jan 2025 00:00:00 GMThttps://colinxiao.com/decrypting-car-infotainment-ota-package/https://colinxiao.com/decrypting-car-infotainment-ota-package/Decrypting a car infotainment OTA package, reversing the firmware's encryption and signing scheme so you can unpack and inspect the update contents, and the gotchas flagged along the way.Thu, 16 Jan 2025 00:00:00 GMThttps://colinxiao.com/speaking-dcerpc-to-windows-creating-services-without-createservice/https://colinxiao.com/speaking-dcerpc-to-windows-creating-services-without-createservice/Speaking DCERPC to Windows directly, creating services without CreateService by hand-crafting the RPC calls to the Service Control Manager, with the result and caveats spelled out.Thu, 16 Jan 2025 00:00:00 GMThttps://colinxiao.com/trace-based-data-flow-analysis-practical-walkthrough/https://colinxiao.com/trace-based-data-flow-analysis-practical-walkthrough/A practical walkthrough of trace-based data-flow analysis, using execution traces to follow tainted values through heavily obfuscated native code, with the analysis method shown end to end.Wed, 15 Jan 2025 00:00:00 GMThttps://colinxiao.com/reconstructing-dex-vmp-trace-capture-to-opcode-recovery/https://colinxiao.com/reconstructing-dex-vmp-trace-capture-to-opcode-recovery/Reconstructing a DEX VMP from trace capture to opcode recovery, walking the full path from virtualized bytecode back into readable smali you can analyze.Sun, 12 Jan 2025 00:00:00 GMThttps://colinxiao.com/unidbg-black-box-magic-android-native-reversing/https://colinxiao.com/unidbg-black-box-magic-android-native-reversing/Unidbg as black-box magic for Android native reversing, showing how to emulate SO files to call and trace JNI functions without a device or debugger, for anyone reversing similar targets.Wed, 01 Jan 2025 00:00:00 GMThttps://colinxiao.com/vmprotect-local-license-lock-analysis-and-keygen/https://colinxiao.com/vmprotect-local-license-lock-analysis-and-keygen/Breaking VMProtect's local license lock by reversing its RSA and big-number encryption, then building a fully working offline keygen from the recovered math.Wed, 01 Jan 2025 00:00:00 GMThttps://colinxiao.com/software-protection-from-packing-to-algorithm-protection/https://colinxiao.com/software-protection-from-packing-to-algorithm-protection/A survey of software protection from application packing and code encryption to algorithm-level protection, explaining the full landscape and how each layer actually defends a binary.Sat, 30 Nov 2024 00:00:00 GMThttps://colinxiao.com/analyzing-liapp-game-protection/https://colinxiao.com/analyzing-liapp-game-protection/Analyzing the LIAPP game protection SDK, mapping its anti-tamper checks and obfuscation to understand how it shields mobile games, and the internals laid out in detail.Thu, 28 Nov 2024 00:00:00 GMThttps://colinxiao.com/analyzing-mtop-device-risk-control-sdk/https://colinxiao.com/analyzing-mtop-device-risk-control-sdk/Analyzing the mtop device risk-control SDK: its jailbreak detection, VMP layer, and multi-stage encryption, broken down end to end, with every step broken down clearly.Mon, 04 Nov 2024 00:00:00 GMThttps://colinxiao.com/android-injection-techniques-open-source-injection-module/https://colinxiao.com/android-injection-techniques-open-source-injection-module/A survey of Android injection techniques plus an open-source injection module, comparing ptrace, Zygote, and other routes to load code into a process.Sat, 05 Oct 2024 00:00:00 GMThttps://colinxiao.com/reversing-cocos2d-js-games/https://colinxiao.com/reversing-cocos2d-js-games/An introduction to reversing Cocos2d-JS games, locating the bundled JavaScript, decrypting the game logic, and hooking it to modify behavior, so you can reproduce it yourself.Thu, 05 Sep 2024 00:00:00 GMThttps://colinxiao.com/obfuscation-pass-analysis-flattening/https://colinxiao.com/obfuscation-pass-analysis-flattening/Analyzing the control-flow flattening obfuscation pass, explaining how it breaks the CFG into a dispatcher loop and what it looks like in decompiled code.Thu, 29 Aug 2024 00:00:00 GMThttps://colinxiao.com/unpacking-numeric-brand-packer-frida-detection-repacking/https://colinxiao.com/unpacking-numeric-brand-packer-frida-detection-repacking/Unpacking a numeric-brand packer, bypassing its Frida detection, and repacking the app with a valid signature for further analysis, with the tools and offsets documented.Sun, 11 Aug 2024 00:00:00 GMThttps://colinxiao.com/ios-packet-capture-charles-clash-shadowrocket/https://colinxiao.com/ios-packet-capture-charles-clash-shadowrocket/Packet capturing on iOS with Charles, Clash, and Shadowrocket, comparing VPN-based capture setups and how to route around SSL pinning, including the pitfalls and the fix.Tue, 30 Jul 2024 00:00:00 GMThttps://colinxiao.com/reverse-engineering-a-ticketing-app/https://colinxiao.com/reverse-engineering-a-ticketing-app/Reverse engineering a ticketing app: bypassing its anti-debugging and proxy detection, then cracking the okhttp request signature with Frida, with the commands and code included.Sat, 27 Jul 2024 00:00:00 GMThttps://colinxiao.com/emulating-aarch64-shared-library-qiling-reversing-vm-protected-rc4/https://colinxiao.com/emulating-aarch64-shared-library-qiling-reversing-vm-protected-rc4/Emulating an aarch64 shared library with Qiling and reversing its VM-protected RC4, decrypting the cipher without native hardware, with a full walkthrough of the technique.Thu, 25 Jul 2024 00:00:00 GMThttps://colinxiao.com/android-boot-process-source-analysis/https://colinxiao.com/android-boot-process-source-analysis/Analyzing the Android boot process from source, tracing init, Zygote, and system_server to explain how the system actually comes up, and the mechanism explained clearly.Tue, 23 Jul 2024 00:00:00 GMThttps://colinxiao.com/automating-android-system-level-device-fingerprint-countermeasures/https://colinxiao.com/automating-android-system-level-device-fingerprint-countermeasures/Automating system-level device fingerprint countermeasures on Android, using Magisk, Zygisk, APatch, and ptrace to spoof fingerprints at scale, with the algorithm recovered in detail.Sat, 25 May 2024 00:00:00 GMThttps://colinxiao.com/general-approach-bypassing-frida-detection/https://colinxiao.com/general-approach-bypassing-frida-detection/A general approach to bypassing Frida detection on Android, using svc hooks and Stalker to hide the framework from apps that actively hunt it, and the bypass logic broken down.Mon, 13 May 2024 00:00:00 GMThttps://colinxiao.com/infinityhook-etw-hook-survives-patchguard/https://colinxiao.com/infinityhook-etw-hook-survives-patchguard/InfinityHook on modern Windows: an ETW-based syscall hook that survives PatchGuard, with the reverse-engineered pieces the original writeup left out, with the setup and commands all covered.Mon, 22 Apr 2024 00:00:00 GMThttps://colinxiao.com/dex-vmp-101-recovering-android-dex-virtualization/https://colinxiao.com/dex-vmp-101-recovering-android-dex-virtualization/DEX VMP 101: recovering Android DEX virtualization from a real app, walking the unpacking and smali reconstruction, then assessing its security, and the code traced down to the core.Fri, 19 Apr 2024 00:00:00 GMThttps://colinxiao.com/dynamically-injecting-java-native-code-rooted-android/https://colinxiao.com/dynamically-injecting-java-native-code-rooted-android/Dynamically injecting Java and native code into a rooted Android device, combining ptrace, Xposed, SandHook, and JNI for runtime code loading, with the result and caveats spelled out.Fri, 22 Mar 2024 00:00:00 GMThttps://colinxiao.com/analyzing-mtgsig-2-4-signing-algorithm/https://colinxiao.com/analyzing-mtgsig-2-4-signing-algorithm/Analyzing the mtgsig 2.4 signing algorithm, reverse engineering Meituan's risk-control signature to understand its protocol and parameters, and the gotchas flagged along the way.Tue, 05 Mar 2024 00:00:00 GMThttps://colinxiao.com/bypassing-new-iqiyi-libmsaoaidsec-frida-detection/https://colinxiao.com/bypassing-new-iqiyi-libmsaoaidsec-frida-detection/Bypassing iQIYI's updated libmsaoaidsec.so Frida detection, working around its new anti-debug checks to keep Frida attached to the app, with the analysis method shown end to end.Sun, 03 Mar 2024 00:00:00 GMThttps://colinxiao.com/hikari-source-analysis-antidebug/https://colinxiao.com/hikari-source-analysis-antidebug/Source analysis of Hikari's AntiDebug LLVM pass, how it injects randomized ptrace-based anti-debugging checks into iOS binaries at compile time, and the internals laid out in detail.Tue, 09 Jan 2024 00:00:00 GMThttps://colinxiao.com/hikari-source-analysis-antihook/https://colinxiao.com/hikari-source-analysis-antihook/Source analysis of Hikari's AntiHook LLVM pass, how it detects inline hooks, blocks fishhook rebinding, and guards the Objective-C runtime, for anyone reversing similar targets.Tue, 09 Jan 2024 00:00:00 GMThttps://colinxiao.com/hikari-source-analysis-anticlassdump/https://colinxiao.com/hikari-source-analysis-anticlassdump/Source analysis of Hikari's AntiClassDump LLVM pass, showing how it rewrites Objective-C method lists to defeat class-dump tooling entirely, with every step broken down clearly.Mon, 08 Jan 2024 00:00:00 GMThttps://colinxiao.com/analyzing-ttencrypt-algorithm-with-unidbg/https://colinxiao.com/analyzing-ttencrypt-algorithm-with-unidbg/Analyzing the ttEncrypt algorithm with Unidbg, emulating the native ARM64 library to recover its AES and SHA-512 structure without a device, so you can reproduce it yourself.Wed, 20 Dec 2023 00:00:00 GMThttps://colinxiao.com/wechat-channels-video-encryption-reverse-engineering/https://colinxiao.com/wechat-channels-video-encryption-reverse-engineering/How WeChat Channels encrypts video: reversing the WxIsaac64 PRNG in WebAssembly and the 128KB XOR key it uses, via JS instrumentation and MITM, with the tools and offsets documented.Fri, 01 Dec 2023 00:00:00 GMThttps://colinxiao.com/deep-dive-intercepting-binder-at-ioctl-layer/https://colinxiao.com/deep-dive-intercepting-binder-at-ioctl-layer/Intercepting Android's Binder IPC at the ioctl layer, hooking the native call so you can observe and tamper with every binder transaction in the app, including the pitfalls and the fix.Thu, 30 Nov 2023 00:00:00 GMThttps://colinxiao.com/reverse-engineering-alienware-keyboard-usb-protocol/https://colinxiao.com/reverse-engineering-alienware-keyboard-usb-protocol/Reverse engineering the Alienware keyboard's USB protocol to drive custom RGB lighting, decoding the HID reports with Wireshark for full control, with the commands and code included.Tue, 24 Oct 2023 00:00:00 GMThttps://colinxiao.com/ticketing-platform-sign-parameter-restock-monitoring/https://colinxiao.com/ticketing-platform-sign-parameter-restock-monitoring/Reverse engineering a ticketing platform's sign parameter to build a ticket-restock monitor, cracking the mtop MD5 signature from the H5 client, with a full walkthrough of the technique.Mon, 09 Oct 2023 00:00:00 GMThttps://colinxiao.com/compiling-rwprocmem33-into-android-kernel/https://colinxiao.com/compiling-rwprocmem33-into-android-kernel/Compiling rwProcMem33 into the Android kernel to get hardware-breakpoint-driven read and write of process memory, built into a Pixel AOSP image, and the mechanism explained clearly.Thu, 31 Aug 2023 00:00:00 GMThttps://colinxiao.com/analyzing-login-protocol-of-fitness-app/https://colinxiao.com/analyzing-login-protocol-of-fitness-app/Analyzing a fitness app's login protocol, reversing its MD5, SHA1, and AES layers with Frida to reconstruct the sign and password scheme, with the algorithm recovered in detail.Wed, 09 Aug 2023 00:00:00 GMThttps://colinxiao.com/bypassing-unusual-antidebug-antihook-game-packer/https://colinxiao.com/bypassing-unusual-antidebug-antihook-game-packer/Bypassing an unusual anti-debug and anti-hook in a commercial mobile-game packer, defeating TracerPid and breakpoint detection on ARM64, and the bypass logic broken down.Fri, 21 Jul 2023 00:00:00 GMThttps://colinxiao.com/reverse-engineering-kv300-floppy-disk-copy-protection/https://colinxiao.com/reverse-engineering-kv300-floppy-disk-copy-protection/Reverse engineering the floppy-disk copy protection of KV300+ twenty-five years later, decoding its INT 13 and CRC checks in a retro forensics deep dive.Mon, 17 Jul 2023 00:00:00 GMThttps://colinxiao.com/general-cronet-https-capture/https://colinxiao.com/general-cronet-https-capture/A general method for capturing HTTPS from Cronet-based apps, working around Chrome's cert pinning and MITM resistance to inspect the traffic, with the setup and commands all covered.Thu, 13 Jul 2023 00:00:00 GMThttps://colinxiao.com/source-insight-4-license-reversing-and-offline-keygen/https://colinxiao.com/source-insight-4-license-reversing-and-offline-keygen/Reversing Source Insight 4.x's license scheme and building an offline keygen, cracking the signature and the base64 registration file format, and the code traced down to the core.Wed, 14 Jun 2023 00:00:00 GMThttps://colinxiao.com/analyzing-ios-app-login-sign-userpwd-parameters/https://colinxiao.com/analyzing-ios-app-login-sign-userpwd-parameters/Analyzing an iOS app's login to reverse its _sign and userpwd parameters, tracing CC_MD5 with Frida and IDA to rebuild the exact request, with the result and caveats spelled out.Mon, 12 Jun 2023 00:00:00 GMThttps://colinxiao.com/reversing-modified-aes-bangcle-laes/https://colinxiao.com/reversing-modified-aes-bangcle-laes/Reversing a modified AES in a mobile app, reconstructing Bangcle's white-box laes cipher with Frida Stalker and IDA on ARM64 to recover the original algorithm.Sat, 10 Jun 2023 00:00:00 GMThttps://colinxiao.com/universal-svc-hook-android-seccomp-sigaction/https://colinxiao.com/universal-svc-hook-android-seccomp-sigaction/A universal svc hook for Android using seccomp and sigaction, intercepting syscalls with BPF filters to trace or modify kernel calls globally, and the gotchas flagged along the way.Fri, 09 Jun 2023 00:00:00 GMThttps://colinxiao.com/ios-jailbreak-detection-frida-bypass/https://colinxiao.com/ios-jailbreak-detection-frida-bypass/How iOS apps detect jailbreaks and how to bypass every check with Frida, hooking stat, dyld, canOpenURL, and fork to hide the jailbreak entirely, with the analysis method shown end to end.Tue, 06 Jun 2023 00:00:00 GMThttps://colinxiao.com/big-tech-device-fingerprinting-part-2-hunter-environment-detection/https://colinxiao.com/big-tech-device-fingerprinting-part-2-hunter-environment-detection/Explaining the Hunter environment-detection SDK used by big-tech anti-fraud: emulator detection, seccomp and binder checks, and how it spots Frida and sandboxes.Mon, 29 May 2023 00:00:00 GMThttps://colinxiao.com/instrumenting-android-app-dump-bluetooth-aes-keys/https://colinxiao.com/instrumenting-android-app-dump-bluetooth-aes-keys/Instrumenting an Android app with smali edits to dump Bluetooth AES keys and ciphertext via logcat, a clean way to capture encrypted traffic without hooks.Fri, 31 Mar 2023 00:00:00 GMThttps://colinxiao.com/ios-decryption-tools-experience/https://colinxiao.com/ios-decryption-tools-experience/Comparing four iOS app decryption tools, Clutch, dumpdecrypted, CrackerXI, and frida-ios-dump, with hands-on experience on when each one works best, for anyone reversing similar targets.Fri, 23 Dec 2022 00:00:00 GMThttps://colinxiao.com/reverse-engineering-vpn-accelerator-protection-stack/https://colinxiao.com/reverse-engineering-vpn-accelerator-protection-stack/Reverse engineering a VPN accelerator's protection stack: root and proxy detection, AES encryption, and the device-ID rotation scheme that keeps it ahead of bans.Mon, 05 Dec 2022 00:00:00 GMThttps://colinxiao.com/codemeter-7-3-api-and-communication-protocol/https://colinxiao.com/codemeter-7-3-api-and-communication-protocol/Study notes on CodeMeter 7.3's API and communication protocol, covering Wibu's AxProtector, AES-128-CBC, CRC32, and SHA1 inside its license handshake.Fri, 02 Dec 2022 00:00:00 GMThttps://colinxiao.com/aosp-source-build-part-4-customizing-erasing-root-fingerprints/https://colinxiao.com/aosp-source-build-part-4-customizing-erasing-root-fingerprints/Part four of an AOSP source-build series: customizing the ROM and erasing root fingerprints from build.prop and Magisk so detection apps can't spot your device.Fri, 11 Nov 2022 00:00:00 GMThttps://colinxiao.com/frida-configure-ios-wifi-proxy/https://colinxiao.com/frida-configure-ios-wifi-proxy/Configuring iOS Wi-Fi and proxy settings directly with Frida, driving SpringBoard's WiFikit APIs to script device network setup without ever touching the UI.Thu, 10 Nov 2022 00:00:00 GMThttps://colinxiao.com/locating-vm-protected-algorithm-frida-stalker/https://colinxiao.com/locating-vm-protected-algorithm-frida-stalker/Quickly locating a VM-protected algorithm with Frida Stalker, using instruction tracing to cut straight through the obfuscation and pinpoint the real logic.Sun, 09 Oct 2022 00:00:00 GMThttps://colinxiao.com/dwarf-userspace-stack-unwinding-android-bcc-ebpf/https://colinxiao.com/dwarf-userspace-stack-unwinding-android-bcc-ebpf/Custom bcc and eBPF for DWARF-based userspace stack unwinding on Android, combining kernel tracing with libunwindstack to profile native code, and the internals laid out in detail.Mon, 26 Sep 2022 00:00:00 GMThttps://colinxiao.com/reimplementing-whatsapp-end-to-end-encryption/https://colinxiao.com/reimplementing-whatsapp-end-to-end-encryption/Reimplementing WhatsApp's end-to-end encryption: Signal protocol, Curve25519 key exchange, HKDF, and the double ratchet, recovered with Frida from the real app.Wed, 24 Aug 2022 00:00:00 GMThttps://colinxiao.com/android-property-system-detection-and-anti-detection/https://colinxiao.com/android-property-system-detection-and-anti-detection/The Android property system from the inside: how properties work, how apps detect tampering through them, and how to hide fingerprints from a custom AOSP build.Sat, 20 Aug 2022 00:00:00 GMThttps://colinxiao.com/connected-car-app-hardening-sdk-analysis/https://colinxiao.com/connected-car-app-hardening-sdk-analysis/A first look at a connected-car app wrapped in a commercial packer, mapping its control-flow obfuscation and SSL pinning with Frida, Objection, and Stalker.Wed, 10 Aug 2022 00:00:00 GMThttps://colinxiao.com/reverse-engineering-ios-rhythm-game-tls-interception/https://colinxiao.com/reverse-engineering-ios-rhythm-game-tls-interception/Reverse engineering an iOS rhythm game: binary patching with IDA, bypassing TrustKit cert pinning, and intercepting mutual-TLS traffic to capture its API.Fri, 29 Jul 2022 00:00:00 GMThttps://colinxiao.com/android-device-fingerprinting-collection-and-countermeasures/https://colinxiao.com/android-device-fingerprinting-collection-and-countermeasures/How Android apps fingerprint your device and the countermeasures that defeat it, from ptrace and svc hooks to netlink and system-property spoofing, with every step broken down clearly.Thu, 21 Jul 2022 00:00:00 GMThttps://colinxiao.com/deobfuscating-libdexhelper-so/https://colinxiao.com/deobfuscating-libdexhelper-so/Deobfuscating libDexHelper.so inside an enterprise Android shell, defeating its junk instructions, string encryption, and VMP layer with Unicorn and Frida.Sun, 10 Jul 2022 00:00:00 GMThttps://colinxiao.com/ptrace-seccomp-svc-sandbox/https://colinxiao.com/ptrace-seccomp-svc-sandbox/Building a ptrace and seccomp sandbox for inline svc hooks, using BPF filters to intercept syscalls tracelessly and read their register arguments, so you can reproduce it yourself.Sat, 04 Jun 2022 00:00:00 GMThttps://colinxiao.com/a-new-approach-to-emulating-and-debugging-the-android-runtime/https://colinxiao.com/a-new-approach-to-emulating-and-debugging-the-android-runtime/A new approach to emulating and debugging the Android runtime with Qiling and Unicorn, attaching GDB to ART and JNI for deeper native analysis, with the tools and offsets documented.Wed, 04 May 2022 00:00:00 GMThttps://colinxiao.com/reversing-sign-algorithm-ecommerce-app/https://colinxiao.com/reversing-sign-algorithm-ecommerce-app/Reversing the sign algorithm of a major e-commerce app with Charles, Jadx, Frida, Unidbg, and IDA to reconstruct the MD5-based request signature step by step.Wed, 30 Mar 2022 00:00:00 GMThttps://colinxiao.com/frida-seccomp-generic-svc-tracing-hooking/https://colinxiao.com/frida-seccomp-generic-svc-tracing-hooking/A generic Frida-based method to trace and hook svc syscalls on Android using seccomp, including the threading deadlock pitfall and the fix that avoids it.Fri, 11 Mar 2022 00:00:00 GMThttps://colinxiao.com/android-netlink-svc-mac-address/https://colinxiao.com/android-netlink-svc-mac-address/Getting a device's MAC address on Android without any permissions, using a netlink socket and inline svc calls to sidestep the OS's access controls, including the pitfalls and the fix.Wed, 02 Mar 2022 00:00:00 GMThttps://colinxiao.com/hooking-objc-msgsend-capture-objc-method-arguments/https://colinxiao.com/hooking-objc-msgsend-capture-objc-method-arguments/Hooking objc_msgSend to capture every Objective-C method argument on ARM64, using FishHook and inline hooks to intercept message dispatch right at its core.Mon, 24 Jan 2022 00:00:00 GMThttps://colinxiao.com/art-internals-android-security/https://colinxiao.com/art-internals-android-security/A deep look at ART internals across DEX loading, JIT and AOT compilation, and class initialization, and how these mechanisms power Android's security.Sun, 26 Dec 2021 00:00:00 GMThttps://colinxiao.com/analyzing-mir4-blockchain-game-network-protocol/https://colinxiao.com/analyzing-mir4-blockchain-game-network-protocol/Analyzing the network protocol of the blockchain game Mir4, digging into its Unreal Engine build to decode the Protobuf messages exchanged with the server.Wed, 22 Dec 2021 00:00:00 GMThttps://colinxiao.com/cracking-macos-screensaver-restore-purchase-vip-flag/https://colinxiao.com/cracking-macos-screensaver-restore-purchase-vip-flag/Cracking a top-ranked macOS screensaver by tracing its StoreKit restore-purchase flow with Hopper and class-dump until the VIP flag finally shows up, with the commands and code included.Thu, 16 Dec 2021 00:00:00 GMThttps://colinxiao.com/anti-disassembly-on-arm64/https://colinxiao.com/anti-disassembly-on-arm64/Anti-disassembly tricks on ARM64: building data blocks that decode as bogus instructions, and using B and DCQ to confuse IDA while keeping the code runnable.Wed, 08 Dec 2021 00:00:00 GMThttps://colinxiao.com/android-12-app-launch-process-analysis/https://colinxiao.com/android-12-app-launch-process-analysis/A source-level walkthrough of the Android 12 app launch process, tracing Activity, Zygote, AMS, and Binder AIDL calls from the very first tap to a running process.Mon, 06 Dec 2021 00:00:00 GMThttps://colinxiao.com/frida-support-gda-hook-invoke-decompiled-code/https://colinxiao.com/frida-support-gda-hook-invoke-decompiled-code/Using GDA's built-in Frida support to hook and invoke methods directly on decompiled code, fusing static and dynamic analysis into one seamless workflow.Wed, 14 Jul 2021 00:00:00 GMThttps://colinxiao.com/locating-sm4-encryption-key-ios-arm64/https://colinxiao.com/locating-sm4-encryption-key-ios-arm64/Locating the SM4 encryption key in an iOS ARM64 binary, tracing the key schedule and cipher calls through the disassembly to recover the secret material.Sun, 11 Jul 2021 00:00:00 GMThttps://colinxiao.com/ios-anti-anti-debugging-tweak/https://colinxiao.com/ios-anti-anti-debugging-tweak/Building a universal iOS tweak that lets you tick any app in settings and bypass its anti-debugging, integrating AppList and PreferenceLoader with Dobby and HookZz.Tue, 29 Jun 2021 00:00:00 GMThttps://colinxiao.com/bypassing-ssl-pinning-custom-http-framework-non-system-ssl/https://colinxiao.com/bypassing-ssl-pinning-custom-http-framework-non-system-ssl/Bypassing SSL pinning when an app rolls its own HTTP framework and links a non-system SSL library like BoringSSL or Cronet, with Frida hooks for each layer.Tue, 08 Jun 2021 00:00:00 GMThttps://colinxiao.com/ios-reverse-engineering-end-to-end-dice-roll/https://colinxiao.com/ios-reverse-engineering-end-to-end-dice-roll/An end-to-end iOS reversing journey: jailbreak, dump the FairPlay-encrypted binary, then hook a chat app's dice roll with method swizzling and inline hooks.Sun, 11 Apr 2021 00:00:00 GMThttps://colinxiao.com/a64dbg-adcpp-itunesstored-kbsync-remote-call/https://colinxiao.com/a64dbg-adcpp-itunesstored-kbsync-remote-call/Using A64Dbg's ADCpp to call iTunesStored's kbsync remotely over LLDB, invoking an Objective-C method on-device from outside the running process, with a full walkthrough of the technique.Fri, 09 Apr 2021 00:00:00 GMThttps://colinxiao.com/bypassing-anti-debugging-ios-app/https://colinxiao.com/bypassing-anti-debugging-ios-app/Bypassing an iOS app's layered anti-debugging: well-timed initialization checks, combined ptrace and svc guards, and periodic re-checks, defeated with targeted hooks.Mon, 05 Apr 2021 00:00:00 GMThttps://colinxiao.com/persistent-frida-hooks-android-fridagadget/https://colinxiao.com/persistent-frida-hooks-android-fridagadget/Making Frida hooks persistent on Android without repackaging the APK, using frida-gadget and JNI tricks so your instrumentation survives app restarts.Wed, 31 Mar 2021 00:00:00 GMThttps://colinxiao.com/understanding-android-debugging-architecture-jdwp-adb-ptrace/https://colinxiao.com/understanding-android-debugging-architecture-jdwp-adb-ptrace/A clear breakdown of Android's debugging architecture across JDWP, adb port forwarding, and ptrace, and how IDA plugs into all three to debug native code.Tue, 09 Mar 2021 00:00:00 GMThttps://colinxiao.com/unicorn-semi-automated-reversing-ecommerce-sign-algorithm/https://colinxiao.com/unicorn-semi-automated-reversing-ecommerce-sign-algorithm/Semi-automated reversing with Unicorn: emulate an e-commerce app's native code to recover its sign algorithm without manually tracing every ARM instruction.Tue, 09 Mar 2021 00:00:00 GMThttps://colinxiao.com/reversing-desktop-im-client-frida/https://colinxiao.com/reversing-desktop-im-client-frida/Reversing a desktop IM client with Frida: class-dump the headers, find the message-send classes, then tamper with outgoing messages and listen in on incoming ones.Mon, 15 Feb 2021 00:00:00 GMThttps://colinxiao.com/reversing-messaging-app-ios-jailbreak-free/https://colinxiao.com/reversing-messaging-app-ios-jailbreak-free/Reversing a messaging app jailbreak-free with MonkeyDev, hooking red packets, message revoke, and step-count spoofing without ever having to jailbreak the device.Wed, 10 Feb 2021 00:00:00 GMThttps://colinxiao.com/cve-2019-8605-sock-port-uaf-to-tfp0/https://colinxiao.com/cve-2019-8605-sock-port-uaf-to-tfp0/From use-after-free to kernel task port: a full exploit walkthrough of CVE-2019-8605, with the heap spraying and Mach ool-message tricks that turn a socket UAF into TFP0.Thu, 04 Feb 2021 00:00:00 GMThttps://colinxiao.com/cve-2020-27950-mach-message-trailer-kernel-memory-leak/https://colinxiao.com/cve-2020-27950-mach-message-trailer-kernel-memory-leak/A root-cause analysis of CVE-2020-27950, an iOS kernel memory leak from an uninitialized Mach message trailer, including the full PoC send and receive flow.Wed, 03 Feb 2021 00:00:00 GMThttps://colinxiao.com/disabling-avb2-verified-boot-vbmeta-magisk/https://colinxiao.com/disabling-avb2-verified-boot-vbmeta-magisk/Disabling Android Verified Boot 2.0 by patching vbmeta.img, with the exact flags and steps needed to keep root and Magisk working on a locked-down device.Mon, 01 Feb 2021 00:00:00 GMThttps://colinxiao.com/reverse-engineering-commercial-anti-bot-sdk-vmp-sgavmp/https://colinxiao.com/reverse-engineering-commercial-anti-bot-sdk-vmp-sgavmp/Reverse engineering SGAVMP, a commercial anti-bot SDK's virtual machine: breaking its anti-F5 decompilation, string encryption, and the signature scheme it protects.Wed, 06 Jan 2021 00:00:00 GMThttps://colinxiao.com/ios-app-decryption-dumpdecrypted/https://colinxiao.com/ios-app-decryption-dumpdecrypted/A practical guide to decrypting iOS apps with dumpdecrypted, covering the Mach-O injection, the codesign fix, and the otool verification steps needed to dump a clean binary.Sun, 27 Dec 2020 00:00:00 GMThttps://colinxiao.com/reversing-chat-app-protobuf-message-client/https://colinxiao.com/reversing-chat-app-protobuf-message-client/Reversing a chat app's Protobuf protocol over Netty, then building a working message client from scratch by reimplementing its AES and RSA encryption layers.Mon, 07 Dec 2020 00:00:00 GMThttps://colinxiao.com/reverse-engineering-a-browser-encrypted-credential-database/https://colinxiao.com/reverse-engineering-a-browser-encrypted-credential-database/Reverse engineering a browser's encrypted credential database, recovering the AES-128-ECB key derivation and decrypting stored passwords for forensic analysis.Tue, 01 Dec 2020 00:00:00 GMThttps://colinxiao.com/ios-reverse-engineering-frida-environment-app-sign/https://colinxiao.com/ios-reverse-engineering-frida-environment-app-sign/Setting up an iOS reverse-engineering environment from scratch, then cracking an app's sign algorithm by tracing CCCrypt and CC_MD5 with Frida to recover the key material.Sat, 28 Nov 2020 00:00:00 GMThttps://colinxiao.com/recovering-the-encryption-seed-in-flexnet-publisher-v11-16/https://colinxiao.com/recovering-the-encryption-seed-in-flexnet-publisher-v11-16/Recovering the encryption seed inside FlexNet Publisher v11.16 and earlier, breaking down the ECC-based license protection that guards commercial software.Mon, 16 Nov 2020 00:00:00 GMThttps://colinxiao.com/decrypting-and-re-encrypting-cocos2d-lua-game-scripts/https://colinxiao.com/decrypting-and-re-encrypting-cocos2d-lua-game-scripts/Decrypting and re-encrypting a Cocos2d game's Lua scripts, recovering the custom Huffman substitution cipher in the NDK and scripting it back with IDA.Thu, 01 Oct 2020 00:00:00 GMThttps://colinxiao.com/exploring-fishhook-low-level-implementation/https://colinxiao.com/exploring-fishhook-low-level-implementation/A source-level exploration of FishHook, walking the Mach-O load commands and the symbol and string tables to show exactly how it rewrites lazy GOT pointers to hook functions.Tue, 22 Sep 2020 00:00:00 GMThttps://colinxiao.com/reversing-protobuf-chat-protocol-live-streaming/https://colinxiao.com/reversing-protobuf-chat-protocol-live-streaming/Reversing the Protobuf-based chat protocol of a live-streaming app, decoding the message schemas from bytecode to understand how the chat client talks to the server.Mon, 21 Sep 2020 00:00:00 GMThttps://colinxiao.com/ios-game-localization-hook-text-replacement/https://colinxiao.com/ios-game-localization-hook-text-replacement/Localizing an iOS game without touching its source code: reuse the bundled translations and drive hook-based text replacement through a dylib to swap in-game strings on the fly.Thu, 17 Sep 2020 00:00:00 GMThttps://colinxiao.com/intercepting-flutter-traffic-frida-ssl-pinning-drony/https://colinxiao.com/intercepting-flutter-traffic-frida-ssl-pinning-drony/How to intercept Flutter app traffic on Android: patch the Flutter engine's SSL pinning with Frida and route the device through Drony for clean Burp captures.Wed, 09 Sep 2020 00:00:00 GMThttps://colinxiao.com/persistent-native-hooking-without-repackaging/https://colinxiao.com/persistent-native-hooking-without-repackaging/Persistent native hooking without repackaging: swap the .so and inline-hook the linker's dlopen and dlsym so every library load routes through your own code.Fri, 04 Sep 2020 00:00:00 GMThttps://colinxiao.com/bypassing-anti-debugging-short-video-app-ios/https://colinxiao.com/bypassing-anti-debugging-short-video-app-ios/Bypassing a short-video app's iOS anti-debugging from scratch, working through its ptrace and sysctl checks with MonkeyDev and IDA so the process stays debuggable during analysis.Sat, 22 Aug 2020 00:00:00 GMThttps://colinxiao.com/writing-class-extraction-unpacker-with-frida/https://colinxiao.com/writing-class-extraction-unpacker-with-frida/Reimplementing FART's active-invocation unpacker from scratch in Frida, walking the ART call chain to dump every class a packed Android app actually loads.Mon, 03 Aug 2020 00:00:00 GMThttps://colinxiao.com/extracting-oem-bios-wmi-interfaces-from-acpi/https://colinxiao.com/extracting-oem-bios-wmi-interfaces-from-acpi/Recovering hidden OEM BIOS management endpoints by extracting WMI and MOF interfaces from ACPI tables, turning firmware black boxes into documented attack surface.Sat, 01 Aug 2020 00:00:00 GMThttps://colinxiao.com/swift-runtime-frida-alamofire-packet-capture/https://colinxiao.com/swift-runtime-frida-alamofire-packet-capture/A first look at the Swift runtime by building a Frida-based packet capture tool that hooks Alamofire's request flow and defeats SSL pinning on a real device.Thu, 16 Jul 2020 00:00:00 GMThttps://colinxiao.com/server-side-auth-vip-flag-decoy/https://colinxiao.com/server-side-auth-vip-flag-decoy/Why a scalping assistant's client-side VIP flag was a decoy: the real gate was server-side, a reminder that unpacking and patching the APK isn't always where the value is.Fri, 26 Jun 2020 00:00:00 GMThttps://colinxiao.com/apple-gsa-login-srp6a-variant/https://colinxiao.com/apple-gsa-login-srp6a-variant/Reverse engineering Apple's GSA login to document the SRP6a variant it uses, tracing the PBKDF2 key derivation and the AES steps behind Apple ID authentication straight from the binary.Sun, 21 Jun 2020 00:00:00 GMThttps://colinxiao.com/theos-tweak-hook-game-avatar-upload-animated-gif/https://colinxiao.com/theos-tweak-hook-game-avatar-upload-animated-gif/Injecting a theos tweak into an iOS game to hijack its avatar upload, swapping the request so the server serves an animated GIF instead of a static image.Sat, 13 Jun 2020 00:00:00 GMThttps://colinxiao.com/ios-code-signing-part-2/https://colinxiao.com/ios-code-signing-part-2/Part two of the iOS code-signing deep dive: resource rules, mobileprovision, entitlements, and the exact steps to re-sign an IPA with codesign or ldid.Mon, 08 Jun 2020 00:00:00 GMThttps://colinxiao.com/ios-code-signing-part-1/https://colinxiao.com/ios-code-signing-part-1/Part one of a two-part deep dive into iOS code signing: how FairPlay DRM, SC_Info, and CodeResources fit together and what third-party distribution means under the hood.Thu, 04 Jun 2020 00:00:00 GMThttps://colinxiao.com/frida-practice-api-resolver-interceptor/https://colinxiao.com/frida-practice-api-resolver-interceptor/Combining Frida's API resolver with its Interceptor to hook Objective-C methods reliably, plus method swizzling and file-monitoring tricks from a real iOS session.Wed, 03 Jun 2020 00:00:00 GMThttps://colinxiao.com/frida-practice-intercepting-sub-functions/https://colinxiao.com/frida-practice-intercepting-sub-functions/A hands-on Frida tutorial on intercepting stripped sub_xxxx functions on iOS, covering NativeFunction and NativeCallback to hook targets that have no symbol names.Sun, 31 May 2020 00:00:00 GMThttps://colinxiao.com/token-verification-spoofable-android-id/https://colinxiao.com/token-verification-spoofable-android-id/How a heavily hardened app's VIP token fell apart: its server-side verification was anchored to a spoofable android_id, so rotating the device ID mints unlimited fresh tokens.Tue, 12 May 2020 00:00:00 GMThttps://colinxiao.com/locating-request-signature-sig3-call-chain/https://colinxiao.com/locating-request-signature-sig3-call-chain/Tracing a short-video app's sig3 request signature from the Java layer through OLLVM-obfuscated native code, using Jadx and Frida to walk the call chain down to the signing routine.Mon, 20 Apr 2020 00:00:00 GMThttps://colinxiao.com/full-stack-frida-walkthrough-unpacking-hooking-capture-protocol/https://colinxiao.com/full-stack-frida-walkthrough-unpacking-hooking-capture-protocol/A full-stack Frida walkthrough on a 360-jiagu-protected app: unpacking the DEX, hooking the In-App Purchase logic, simulating packet capture, and analyzing the protocol end to end.Sun, 12 Apr 2020 00:00:00 GMThttps://colinxiao.com/hooking-plugin-based-android-app-frida/https://colinxiao.com/hooking-plugin-based-android-app-frida/Reversing a plugin-based Android app with Frida from the outside in, navigating its custom class loaders and enum-based dispatch to reach the VIP check and flip the paywall flag for full access.Sun, 12 Apr 2020 00:00:00 GMThttps://colinxiao.com/cataloging-xposed-detection-surface/https://colinxiao.com/cataloging-xposed-detection-surface/A comprehensive catalog of the fingerprints Xposed leaves behind, mapping every detection vector from framework stubs to system properties so you know exactly what a detector looks for.Sun, 05 Apr 2020 00:00:00 GMThttps://colinxiao.com/reversing-infinityhook-etw-cpuclock-system-call-hooking/https://colinxiao.com/reversing-infinityhook-etw-cpuclock-system-call-hooking/A line-by-line analysis of InfinityHook, the Windows technique that hooks every system call by abusing ETW's CpuClock provider, with the SSDT resolution flow fully explained.Thu, 26 Mar 2020 00:00:00 GMThttps://colinxiao.com/reverse-engineering-gray-livestream-app/https://colinxiao.com/reverse-engineering-gray-livestream-app/A full teardown of a gray-market livestream app: unpacking the APK, bypassing its payment check, and forensically recovering user data from misconfigured Qiniu cloud storage.Sat, 21 Mar 2020 00:00:00 GMThttps://colinxiao.com/posting-wechat-moments-reversing-snsuploadui/https://colinxiao.com/posting-wechat-moments-reversing-snsuploadui/How to reverse WeChat's SnsUploadUI with Frida and post Moments programmatically, tracing the upload flow from a tapped UI down to the underlying network calls.Thu, 19 Mar 2020 00:00:00 GMThttps://colinxiao.com/reversing-android-sign-algorithm-libsgmain/https://colinxiao.com/reversing-android-sign-algorithm-libsgmain/A walkthrough of reversing an Android app's request signature down into Alibaba's libsgmain.so, tracing the JNI call chain and reconstructing the RC4-based sign algorithm.Sun, 15 Mar 2020 00:00:00 GMThttps://colinxiao.com/lldb-print-objc-block-parameter-signatures/https://colinxiao.com/lldb-print-objc-block-parameter-signatures/How to print Objective-C block parameter signatures straight from LLDB, speeding up iOS reverse engineering by recovering block types without digging through class-dump output.Wed, 12 Feb 2020 00:00:00 GMThttps://colinxiao.com/fart-automated-unpacking-art-active-invocation/https://colinxiao.com/fart-automated-unpacking-art-active-invocation/A deep dive into FART, the DEX unpacker that dumps Android apps by actively invoking every method in ART, with the Android 9.0 source adapted and the core anti-tamper workarounds explained.Tue, 07 Jan 2020 00:00:00 GMThttps://colinxiao.com/field-guide-common-unpacking-techniques/https://colinxiao.com/field-guide-common-unpacking-techniques/Six classic techniques for finding a packed binary's original entry point, from the ESP stack law to language-specific entry points, with OllyDbg walkthroughs that transfer to any modern target.Fri, 03 Jan 2020 00:00:00 GMT