Common Ways to Bypass libmsaoaidsec.so's Anti-Frida Protection
Bypassing libmsaoaidsec anti-Frida, another walkthrough of defeating the SDK's Frida detection routines to keep instrumentation running, and the mechanism explained clearly.
Tag: hook
Recovering a Car App's `sd` Signature: White-Box AES and DFA Key Recovery
Recovering a car app's sd signature, reversing the signing algorithm behind the vehicle-control API to craft valid signed requests, and the code traced down to the core.
How Android App Virtualization Works — The VirtualApp Architecture
How Android app virtualization works, explaining the sandboxed dual-app cloning technology and the hooking and IPC layers underneath it, so you can reproduce it yourself.
Bypassing a Korean Game's Anti-Debugging, Layer by Layer
Bypassing a Korean game's anti-debugging, walking through its ptrace and timing checks and patching them to keep the debugger attached, and the gotchas flagged along the way.
From Java to Native: How a .so's Functions Get Loaded, Step by Step
From Java to native: how a .so's functions get loaded, tracing the JNI bridge from a Java call down to the native symbol resolution, for anyone reversing similar targets.
Unidbg: Black-Box Magic for Android Native Reversing
Unidbg as black-box magic for Android native reversing, showing how to emulate SO files to call and trace JNI functions without a device or debugger, for anyone reversing similar targets.
A Discussion of Android Injection Techniques, and an Open-Source Injection Module
A survey of Android injection techniques plus an open-source injection module, comparing ptrace, Zygote, and other routes to load code into a process.
InfinityHook on Modern Windows: An ETW-Based Hook That Survives PatchGuard
InfinityHook on modern Windows: an ETW-based syscall hook that survives PatchGuard, with the reverse-engineered pieces the original writeup left out, with the setup and commands all covered.
Deep-Dive: Intercepting Binder at the ioctl Layer
Intercepting Android's Binder IPC at the ioctl layer, hooking the native call so you can observe and tamper with every binder transaction in the app, including the pitfalls and the fix.
A Universal SVC Hook for Android Using seccomp + sigaction
A universal svc hook for Android using seccomp and sigaction, intercepting syscalls with BPF filters to trace or modify kernel calls globally, and the gotchas flagged along the way.
Jailbreak Detection in iOS and Bypassing It with Frida
How iOS apps detect jailbreaks and how to bypass every check with Frida, hooking stat, dyld, canOpenURL, and fork to hide the jailbreak entirely, with the analysis method shown end to end.
Android Device Fingerprinting: Collection and Countermeasures
How Android apps fingerprint your device and the countermeasures that defeat it, from ptrace and svc hooks to netlink and system-property spoofing, with every step broken down clearly.
A ptrace+seccomp Sandbox for Inline SVC Hooks
Building a ptrace and seccomp sandbox for inline svc hooks, using BPF filters to intercept syscalls tracelessly and read their register arguments, so you can reproduce it yourself.
ART Internals and How They Power Android Security
A deep look at ART internals across DEX loading, JIT and AOT compilation, and class initialization, and how these mechanisms power Android's security.
Frida Support in GDA: Hook and Invoke Methods Directly on Decompiled Code
Using GDA's built-in Frida support to hook and invoke methods directly on decompiled code, fusing static and dynamic analysis into one seamless workflow.
Bypassing SSL Pinning in an App with a Custom HTTP Framework and a Non-System SSL Library
Bypassing SSL pinning when an app rolls its own HTTP framework and links a non-system SSL library like BoringSSL or Cronet, with Frida hooks for each layer.
Persistent Frida Hooks on Android Without Repackaging
Making Frida hooks persistent on Android without repackaging the APK, using frida-gadget and JNI tricks so your instrumentation survives app restarts.
Reversing a Messaging App on iOS (Jailbreak-Free): Red Packets, Message Revoke, and Step Count
Reversing a messaging app jailbreak-free with MonkeyDev, hooking red packets, message revoke, and step-count spoofing without ever having to jailbreak the device.
Exploring the Low-Level Implementation of FishHook
A source-level exploration of FishHook, walking the Mach-O load commands and the symbol and string tables to show exactly how it rewrites lazy GOT pointers to hook functions.
iOS Game Localization: Reusing Translations and Hook-Based Text Replacement
Localizing an iOS game without touching its source code: reuse the bundled translations and drive hook-based text replacement through a dylib to swap in-game strings on the fly.
Injecting a theos Tweak to Modify a Game's Avatar Upload and Serve an Animated GIF
Injecting a theos tweak into an iOS game to hijack its avatar upload, swapping the request so the server serves an animated GIF instead of a static image.
Frida in Practice: Combining the API Resolver with the Interceptor
Combining Frida's API resolver with its Interceptor to hook Objective-C methods reliably, plus method swizzling and file-monitoring tricks from a real iOS session.
A Full-Stack Frida Walkthrough: Unpacking, Hooking, Simulated Packet Capture, and Protocol Analysis
A full-stack Frida walkthrough on a 360-jiagu-protected app: unpacking the DEX, hooking the In-App Purchase logic, simulating packet capture, and analyzing the protocol end to end.
Reversing InfinityHook: Hooking Every System Call via the ETW CpuClock
A line-by-line analysis of InfinityHook, the Windows technique that hooks every system call by abusing ETW's CpuClock provider, with the SSDT resolution flow fully explained.