Static Unpacking for VMProtect 3.9.5: the Rotating-XOR Layer
Static unpacking for VMProtect 3.9.5, reversing the rotating-XOR decryption layer to recover the protected binary without ever running it, for anyone reversing similar targets.
Tag: unpacking
Fixing the VMProtect 3.5.1 Win32 Runtime Compilation Issue
Fixing the VMProtect 3.5.1 Win32 runtime compilation issue, a troubleshooting walkthrough for a protected binary that won't compile, with the analysis method shown end to end.
Analyzing the VMProtect 3.9.4 Virtual Machine: Backward Virtual Code and the Final Boss
Analyzing VMProtect 3.9.4's virtual machine flow, tracing the dispatch loop and handler set that drive its newest VM architecture and opcode mapping, so you can reproduce it yourself.
Analyzing the VMProtect 3.0.0beta Virtual Machine: Handler Chaining and Double Encryption
Analyzing VMProtect 3.0.0 beta's virtual machine handler chaining, tracing how its handlers link together to interpret protected code at runtime, with the tools and offsets documented.
Analyzing the VMProtect 2.12.3 Virtual Machine: Handler Flow and Virtual-Register Mapping
Analyzing VMProtect 2.12.3's virtual machine handler flow, mapping how its handlers chain together to interpret and execute virtualized code, including the pitfalls and the fix.
Unpacking a .NET JIT Protector on .NET Framework 4.8+ with WinDbg TTD
Unpacking a .NET JIT protector on .NET Framework 4.8+ with WinDbg TTD, using time-travel debugging to recover JIT-compiled methods, and the gotchas flagged along the way.
Android App Hardening: From Whole-APK Packing to Code-Extraction Packing — Principles and Implementation
Android app hardening from whole-APK to code-extraction packing, tracing the evolution of protectors and how each generation is defeated, with every step broken down clearly.
Key Techniques for Dynamic .NET Unpacking
Key techniques for dynamic .NET unpacking, dumping assemblies straight from memory and rebuilding them from their JIT-compiled state, and the internals laid out in detail.
Reversing dpt-shell - A Class-Extraction Packer from the Inside Out
Reversing dpt-shell, a class-extraction packer, from the inside out to document how it protects and restores DEX classes at runtime, and the bypass logic broken down.
Breaking VMProtect's Local License Lock: RSA, Big-Number Encryption, and a Working Keygen
Breaking VMProtect's local license lock by reversing its RSA and big-number encryption, then building a fully working offline keygen from the recovered math.
Software Protection, Explained: From Application Packing to Algorithm Protection
A survey of software protection from application packing and code encryption to algorithm-level protection, explaining the full landscape and how each layer actually defends a binary.
Analyzing the LIAPP Game Protection: Anti-Debugging, Root/Emulator Detection, and an il2cpp Dump
Analyzing the LIAPP game protection SDK, mapping its anti-tamper checks and obfuscation to understand how it shields mobile games, and the internals laid out in detail.
An Introduction to Reversing Cocos2d-JS Games
An introduction to reversing Cocos2d-JS games, locating the bundled JavaScript, decrypting the game logic, and hooking it to modify behavior, so you can reproduce it yourself.
Unpacking a Numeric-Brand Packer, Bypassing Frida Detection, and Repacking
Unpacking a numeric-brand packer, bypassing its Frida detection, and repacking the app with a valid signature for further analysis, with the tools and offsets documented.
DEX VMP 101: Recovering Android DEX Virtualization and a Security Assessment
DEX VMP 101: recovering Android DEX virtualization from a real app, walking the unpacking and smali reconstruction, then assessing its security, and the code traced down to the core.
ART Internals and How They Power Android Security
A deep look at ART internals across DEX loading, JIT and AOT compilation, and class initialization, and how these mechanisms power Android's security.
Writing a Class-Extraction Unpacker with Frida: FART's Active Invocation Chain, Reimplemented
Reimplementing FART's active-invocation unpacker from scratch in Frida, walking the ART call chain to dump every class a packed Android app actually loads.
The VIP Flag That Didn't Matter: Server-Side Auth in a Scalping Assistant App
Why a scalping assistant's client-side VIP flag was a decoy: the real gate was server-side, a reminder that unpacking and patching the APK isn't always where the value is.
A Hardened App's One Fatal Flaw: Token Verification Anchored to a Spoofable android_id
How a heavily hardened app's VIP token fell apart: its server-side verification was anchored to a spoofable android_id, so rotating the device ID mints unlimited fresh tokens.
A Full-Stack Frida Walkthrough: Unpacking, Hooking, Simulated Packet Capture, and Protocol Analysis
A full-stack Frida walkthrough on a 360-jiagu-protected app: unpacking the DEX, hooking the In-App Purchase logic, simulating packet capture, and analyzing the protocol end to end.
Reverse-Engineering a Gray-Market Livestream App: Unpacking, Payment Bypass, and Cloud Forensics
A full teardown of a gray-market livestream app: unpacking the APK, bypassing its payment check, and forensically recovering user data from misconfigured Qiniu cloud storage.
FART: Automated Unpacking on ART via Active Invocation (Android 9.0 Source Adapted)
A deep dive into FART, the DEX unpacker that dumps Android apps by actively invoking every method in ART, with the Android 9.0 source adapted and the core anti-tamper workarounds explained.
A Field Guide to Common Unpacking Techniques
Six classic techniques for finding a packed binary's original entry point, from the ESP stack law to language-specific entry points, with OllyDbg walkthroughs that transfer to any modern target.