Detecting Zygisk Injection via the dlclose soinfo Gap
Detecting Zygisk injection via dlclose, a clever trick that catches Magisk's Zygisk hooks by watching for a suspicious library unload, with a full walkthrough of the technique.
Tag: root-detection
Bypassing a Korean Game's Anti-Debugging, Layer by Layer
Bypassing a Korean game's anti-debugging, walking through its ptrace and timing checks and patching them to keep the debugger attached, and the gotchas flagged along the way.
Analyzing the LIAPP Game Protection: Anti-Debugging, Root/Emulator Detection, and an il2cpp Dump
Analyzing the LIAPP game protection SDK, mapping its anti-tamper checks and obfuscation to understand how it shields mobile games, and the internals laid out in detail.
Reverse Engineering a VPN Accelerator's Protection Stack: Root Detection, Encryption, and Device-ID Rotation
Reverse engineering a VPN accelerator's protection stack: root and proxy detection, AES encryption, and the device-ID rotation scheme that keeps it ahead of bans.
AOSP Source Build, Part 4: Customizing and Erasing Root Fingerprints
Part four of an AOSP source-build series: customizing the ROM and erasing root fingerprints from build.prop and Magisk so detection apps can't spot your device.