Recovering a Car App's `sd` Signature: White-Box AES and DFA Key Recovery
Recovering a car app's sd signature, reversing the signing algorithm behind the vehicle-control API to craft valid signed requests, and the code traced down to the core.
Tag: aes
Reverse Engineering a Java Equinox OSGi Application: From Encrypted Bundles to the Decryption Hook
Reverse engineering a Java Equinox OSGi application, from encrypted bundles to the decryption hook that unlocks the class files, with a full walkthrough of the technique.
Inside ttEncrypt - Tracing a VM-Protected JNI Cipher Down to SHA-512 and AES
Inside ttEncrypt: tracing a VM-protected JNI cipher down to its SHA-512 and AES primitives, unwrapping the virtualization to recover the algorithm, with the algorithm recovered in detail.
Trace-Based Data-Flow Analysis: A Practical Walkthrough
A practical walkthrough of trace-based data-flow analysis, using execution traces to follow tainted values through heavily obfuscated native code, with the analysis method shown end to end.
Analyzing the ttEncrypt Algorithm with Unidbg
Analyzing the ttEncrypt algorithm with Unidbg, emulating the native ARM64 library to recover its AES and SHA-512 structure without a device, so you can reproduce it yourself.
Analyzing the Login Protocol of a Fitness App
Analyzing a fitness app's login protocol, reversing its MD5, SHA1, and AES layers with Frida to reconstruct the sign and password scheme, with the algorithm recovered in detail.
Reversing a Modified AES in a Mobile App - Reconstructing Bangcle laes with Frida Stalker
Reversing a modified AES in a mobile app, reconstructing Bangcle's white-box laes cipher with Frida Stalker and IDA on ARM64 to recover the original algorithm.
Instrumenting an Android App to Dump Bluetooth AES Keys and Ciphertext
Instrumenting an Android app with smali edits to dump Bluetooth AES keys and ciphertext via logcat, a clean way to capture encrypted traffic without hooks.
Reverse Engineering a VPN Accelerator's Protection Stack: Root Detection, Encryption, and Device-ID Rotation
Reverse engineering a VPN accelerator's protection stack: root and proxy detection, AES encryption, and the device-ID rotation scheme that keeps it ahead of bans.
Reimplementing WhatsApp End-to-End Encryption: Signal Protocol, Curve25519, and the Double Ratchet
Reimplementing WhatsApp's end-to-end encryption: Signal protocol, Curve25519 key exchange, HKDF, and the double ratchet, recovered with Frida from the real app.
Reverse Engineering a Chat App's Protobuf Protocol and Building a Message Client
Reversing a chat app's Protobuf protocol over Netty, then building a working message client from scratch by reimplementing its AES and RSA encryption layers.
iOS Reverse Engineering: Environment Setup and Cracking an App's Sign Algorithm with Frida
Setting up an iOS reverse-engineering environment from scratch, then cracking an app's sign algorithm by tracing CCCrypt and CC_MD5 with Frida to recover the key material.
Apple GSA Login — the SRP6a Variant
Reverse engineering Apple's GSA login to document the SRP6a variant it uses, tracing the PBKDF2 key derivation and the AES steps behind Apple ID authentication straight from the binary.
A Hardened App's One Fatal Flaw: Token Verification Anchored to a Spoofable android_id
How a heavily hardened app's VIP token fell apart: its server-side verification was anchored to a spoofable android_id, so rotating the device ID mints unlimited fresh tokens.