Reverse-engineering Strava's route map API
Intercepting the Strava API to generate route maps without a subscription
IOS
Bypassing Volkswagen's jailbreak detection
Reversing SecurityKit and patching out Volkswagen’s layers of anti-debugging and jailbreak checks.
Manually decrypting iOS & tvOS apps with LLDB and debugserver
When automated tools like TrollDecrypt fail on newer jailbreaks, it’s time to dust off the old-school manual decryption method using LLDB to dump memory directly.
Nuking Ads in Oqee app via Google IMA SDK
How I reversed the Google IMA SDK implementation in the Oqee app to completely block pre-roll and mid-roll ads on iOS and tvOS using a custom VMAP payload.
Unlocking Oqee's hidden developer mode and Konami code
Reversing Free’s Oqee app to find hidden developer settings, NSUserDefaults bypasses, and a literal Konami code gesture sequence.
Anatomy of an iOS crack
Breaking down obfuscated dylibs, CloudKit crashes, and certificate pinning.
Blocking ads on the TF1+ iPhone app
Reverse engineering the myTF1 iPhone app to block video ads using a Theos tweak.
Blocking ads on the TF1+ Apple TV app
Reverse engineering the myTF1 Apple TV app to block video ads using Frida and a Theos tweak.
Bypassing Crédit Agricole's jailbreak detection
Reversing the Crédit Agricole app: Analyzing its Swift-based jailbreak checks, debugging with LLDB to identify the specific file triggering the block, and implementing a Frida bypass.
Bypassing Banque Postale's jailbreak detection - Part 2
Reversing the main Banque Postale app: Dealing with Hermes bytecode, analyzing the JailMonkey library, and discovering why the detection logic fails on modern rootless jailbreaks.