Romain Thomas

Introduction DexProtector is a comprehensive security solution providing a complete set of features to protect mobile apps (Android/iOS) against different threats including reverse engineering and malware.

Introduction Coverage-guided fuzzing is a well-known technique that improves the efficiency of a fuzzer by providing runtime feedback This blog post explores this concept on Windows ARM64, using QBDI for code instrumentation and LLVM’s libFuzzer as the fu…

Introduction The purpose of this blog post is to demonstrate how to extract a library from an Apple visionOS 2.0 dyld shared cache to instrument it with QBDI on an Apple M1.

Introduction iCDump is a tool to access and process Objective-C metadata located in 64-bits Mach-O binaries.

BinLift combines QBDL’s portable binary loading with DynaMIR instrumentation, DWARF-backed types, and modern C++ and Python APIs.

CLayout parses C and C++ declarations into a queryable description of their target ABI layout.

DynaMIR is a dynamic binary instrumentation engine for x86-64, ARM64, and RISC-V64.

Hooky is a cross-platform, cross-architecture function-hooking framework with a modern C++ API.

iCDump parses Objective-C metadata from Mach-O binaries and reconstructs classes, protocols, categories, properties, instance variables, and methods as readable declarations.

Lypid provides a modern C++ API for navigating DWARF and PDB debug information: compilation units, functions, variables, types, public symbols, and source-line data can all be inspected through a consistent interface.

MCStone is an assembler and disassembler built directly on LLVM’s MC layer.

Symbi builds on DynaMIR to turn dynamic instruction traces into symbol-aware execution data.

This workshop aims to provide the key concepts in reverse engineering to address the main challenges while analyzing a binary.

Open-obfuscator is an open-source project composed of o-mvll and dProtect.

Introduction This post is about a new project on which I (intensively) worked this month.

The first part is here: Part 1 – SingPass RASP Analysis After SingPass, I took a look at another application protected with the same obfuscator but with enhanced protections.

Introduction I started to dig into the SingPass application which turned out to be obfuscated and protected with Runtime Application Self-Protection (RASP).

Back in July 2021, I took a look at the protections provided by Arxan to detect jailbroken devices in PokemonGO for iOS (Gotta Catch ‘Em All: Frida & jailbreak detection).

Slides PDF document preview The inline viewer is loaded only when requested.

Slides PDF document preview The inline viewer is loaded only when requested.

This is a PoC that shows basic integrity bypass without MagiskHide by modifying the execution of DroidGuard.

Introduction A few days after the release of the blog post Gotta Catch ‘Em All: Frida & jailbreak detection, someone on reddit - r/ReverseEngineering caught my attention on a cheating app for the Android version of PokemonGO: So here it is!

Slides PDF document preview The inline viewer is loaded only when requested.

NoteDo not expect a click & play solution for PokemonGO in this blog post.

QBDL (QuarkslaB Dynamic Loader) is a cross-platform library that enables to load ELF, PE, and Mach-O binaries with an abstraction on the targeted system.

Slides PDF document preview The inline viewer is loaded only when requested.

Slides PDF document preview The inline viewer is loaded only when requested.

Introduction In the first part of this write-up, we described the anti-frida, anti-debug and anti-root techniques used in the application and how to remove most of them.

Introduction This series of blog posts explains one way to resolve the r2-pay challenge released during the r2con2020 conference.

Legu Unpacker Scripts to unpack Android applications protected by Tencent Legu.

This post has been originally posted on the Quarkslab’s Blog Introduction This blog post deals with the Legu packer, an Android protector developed by Tencent that is currently one of the state-of-the-art solutions to protect APK DEX files.

This post has been originally posted on the Quarkslab’s Blog Introduction During the past few months we improved the ARM support in QBDI.

PoC that demonstrates how to disable runtime restrictions (hidden-api and dlopen namespaces) in user-land. https://github.com/quarkslab/android-restriction-bypass

NoteThis publication is also available on the Quarkslab Blog.

This post has been originally posted on the Quarkslab’s Blog Here is an Android crackme developed for the Android training given at Quarkslab.

Here are internal structures of Android OAT: OAT 124 PDF Version OAT 79 PDF Version OAT 64 PDF Version

Here are internal structures of Android VDEX: VDEX 10 PDF Version VDEX 06 PDF Version

Many instrumentation techniques are based on modifying code or system environment of the target.

This post has been originally posted on the Quarkslab’s Blog Introduction For those of you following our SideChannelMarvels1, you know that we add each non-commercial white-box implementation we encounter to the Deadpool project.

This post is a part of the LIEF tutorials.

This post has been originally posted on the Quarkslab’s blog This blog post introduces new features of LIEF as well as some uses cases.

When analyzing an executable, the first layer of information is the format in which the executable is wrapped.

This post has been originally posted on the Quarkslab’s blog Executable File Formats in a Nutshell When dealing with executable files, the first layer of information is the format in which the code is wrapped.

Slides PDF document preview The inline viewer is loaded only when requested.

LIEF is a cross-platform library to parse, inspect, modify, and rebuild executable formats through a consistent API.

PDF document preview The inline viewer is loaded only when requested.

Introduction The crypto 300 challenge was about RSA with a special generation of the prime numbers $p$ and $q$.

Introduction The crypto 400 challenge deals with the Even Mansour cryptosystem.

Introduction Code coverage is mainly used in the vulnerability research area.

PDF document preview The inline viewer is loaded only when requested.