Reverse Engineering
2026
- Fake recruitment, remote JSON payloads, and function-inliner malware (analysis) May 19 Clone-and-run recruitment lures that pull obfuscated Node.js from jsonkeeper-style hosts: IOCs, SHA-256 hashes, a small fetch script, function-inliner teardown, MITRE mappings with links, and what to do if you already ran the artifact.
- Unlocking the Vault: A Deep Dive into macOS ARM64 Trial Enforcement and Binary Patching Feb 1 Introduction In the course of analyzing a decompiled macOS productivity application—a calendar and meeting alert utility with a time-limited …
2025
- Malicious Code Loading via Base64 Encoded .dex File Nov 10 Introduction In the course of analyzing a decompiled Java application, we encountered an unusual code segment that decodes a Base64 encoded …
- Identifying Packages Used by Flutter Apps Sep 8 Sometimes it’s useful to determine what Flutter packages are used in a Flutter app. This can be useful for security audits, …
- Analyzing a Weird Behavior in a Tenda AX3000 WiFi6 Mesh Router Sep 7 I recently purchased a Tenda AX3000 WiFi6 Mesh Router from AliExpress. The setup was quite straightforward and it works well. However, I was …
2024
- Intercepting HTTP traffic in Android Flutter Apps Nov 2 Intercepting HTTP traffic in Flutter apps has attracted significant interest among security researchers. Tools like reflutter have …
- Frida APK Patcher Aug 16 This tool allows you to patch APK files for Frida instrumentation using the Frida gadget. It injects the required libraries and smali code …
- Analyzing KD Live Memory Dump with Volatility May 1 Step 1: Identify the Memory Image NB: Volatility version 2 Ensure you have the memory dump file ready, potentially in a raw format or the …