Inside ttEncrypt: tracing a VM-protected JNI cipher down to its SHA-512 and AES primitives, unwrapping the virtualization to recover the algorithm, with the algorithm recovered in detail.
Analyzing the VMP behind a hardened app's onCreate, unwrapping the virtualization layer to recover the real initialization logic and control flow, with the analysis method shown end to end.
From Java to native: how a .so's functions get loaded, tracing the JNI bridge from a Java call down to the native symbol resolution, for anyone reversing similar targets.