Cracking a virtualized binary with Angr
Reversing a custom VM-based obfuscation challenge using traditional patching, brute forcing, and symbolic execution with angr.
Reverse-Engineering
Reverse-engineering Strava's route map API
Intercepting the Strava API to generate route maps without a subscription
Bypassing Volkswagen's jailbreak detection
Reversing SecurityKit and patching out Volkswagen’s layers of anti-debugging and jailbreak checks.
Manually decrypting iOS & tvOS apps with LLDB and debugserver
When automated tools like TrollDecrypt fail on newer jailbreaks, it’s time to dust off the old-school manual decryption method using LLDB to dump memory directly.
Nuking Ads in Oqee app via Google IMA SDK
How I reversed the Google IMA SDK implementation in the Oqee app to completely block pre-roll and mid-roll ads on iOS and tvOS using a custom VMAP payload.
Unlocking Oqee's hidden developer mode and Konami code
Reversing Free’s Oqee app to find hidden developer settings, NSUserDefaults bypasses, and a literal Konami code gesture sequence.
Anatomy of an iOS crack
Breaking down obfuscated dylibs, CloudKit crashes, and certificate pinning.
Blocking ads on the TF1+ iPhone app
Reverse engineering the myTF1 iPhone app to block video ads using a Theos tweak.
Blocking ads on the TF1+ Apple TV app
Reverse engineering the myTF1 Apple TV app to block video ads using Frida and a Theos tweak.
Keygenning a barcode software license validation system
Deep dive into reverse engineering a REALbasic/Xojo application’s license validation logic, analyzing the serial number format, checksum algorithm, and hex phrase conversion using IDA Pro and LLDB.