Inside ttEncrypt: tracing a VM-protected JNI cipher down to its SHA-512 and AES primitives, unwrapping the virtualization to recover the algorithm, with the algorithm recovered in detail.
Bypassing a Korean game's anti-debugging, walking through its ptrace and timing checks and patching them to keep the debugger attached, and the gotchas flagged along the way.
From Java to native: how a .so's functions get loaded, tracing the JNI bridge from a Java call down to the native symbol resolution, for anyone reversing similar targets.
How Android loads a native SO file, walking through the source of the linker and ClassLoader to explain the full dlopen and JNI load path, with a full walkthrough of the technique.
Reconstructing a DEX VMP from trace capture to opcode recovery, walking the full path from virtualized bytecode back into readable smali you can analyze.
Unidbg as black-box magic for Android native reversing, showing how to emulate SO files to call and trace JNI functions without a device or debugger, for anyone reversing similar targets.
Dynamically injecting Java and native code into a rooted Android device, combining ptrace, Xposed, SandHook, and JNI for runtime code loading, with the result and caveats spelled out.
A new approach to emulating and debugging the Android runtime with Qiling and Unicorn, attaching GDB to ART and JNI for deeper native analysis, with the tools and offsets documented.
Getting a device's MAC address on Android without any permissions, using a netlink socket and inline svc calls to sidestep the OS's access controls, including the pitfalls and the fix.
Making Frida hooks persistent on Android without repackaging the APK, using frida-gadget and JNI tricks so your instrumentation survives app restarts.
Persistent native hooking without repackaging: swap the .so and inline-hook the linker's dlopen and dlsym so every library load routes through your own code.
A walkthrough of reversing an Android app's request signature down into Alibaba's libsgmain.so, tracing the JNI call chain and reconstructing the RC4-based sign algorithm.