This article explains the ELF (Executable and Linkable Format) file structure, how to identify ELF binaries, the roles of headers, program and section tables, the compilation‑to‑execution lifecycle, and practical tools for inspecting and manipulating ELF files on Linux.
This article explains how Windows minidump files are structured, detailing the header and key streams such as ThreadListStream, ModuleListStream, ExceptionStream, SystemInfoStream, and MiscInfoStream, and shows how this information helps pinpoint the exact cause of a program crash.
This guide walks you through rebuilding a fragmented EXE file, fixing a hidden byte error, analyzing its PE structure with IDA, and three ways to bypass the license check—by writing a DLL, patching the binary, or directly decoding the hidden flag.
The article explains how Baidu’s iOS app reduces package size by examining Mach‑O binaries with tools like otool and MachOView, then applying Python scripts to locate oversized assets, eliminate unused configuration files, and deduplicate resources, achieving a 12 MB reduction and a repeatable optimization pipeline.
This article introduces the Mach-O executable format, explains how its structure can be leveraged to attribute dynamic and static libraries at runtime and during build, and presents two practical projects—library attribution and fast API scanning—complete with implementation details and code snippets.
This article clarifies three frequent misunderstandings about iOS15+ dynamic linking—namely the encoding of b/bl instructions, the need for rebase/bind in __TEXT segments, and the mismatch between Mach‑O segment VM size and file size—by explaining the underlying ARM64 architecture, PIC concepts, and providing concrete dyld tool examples.
This article provides a comprehensive, byte‑level walkthrough of the ELF file format on Linux, explaining headers, sections, program headers, string tables, and how linkers and loaders interpret each part using tools like readelf and od.
This guide presents a comprehensive overview of Linux binary analysis and debugging tools—including nm, strings, strip, readelf, objdump, addr2line, gdb, ldd, strace, ltrace, time, gprof, valgrind, mtrace, oprofile, the proc filesystem and common system logs—explaining their purposes, key options, and typical usage patterns for both compilation and runtime phases.
This article explains how to detect and remove unused code in mixed Swift and Objective‑C iOS applications by parsing Mach‑O files, analyzing class metadata, and leveraging AccessFunction calls, while discussing the challenges, implementation details of the WBBlades tool, and practical usage steps.
This article explains how to use the otool command to parse Mach-O sections, extract __objc_classlist and __objc_classrefs, compute their differences, and locate unused Objective‑C classes and methods for iOS app size optimization, providing sample Objective‑C code and detailed implementation steps.
This article explores Swift’s binary representation by comparing it with Objective‑C, demonstrating runtime dynamic method invocation, dissecting Mach‑O sections such as __objc_classlist and __swift5_types, and revealing how Swift classes store their metadata and VTables.
This article surveys web file‑upload strategies, from basic Blob/File handling and pre‑upload validation—including MIME, extension, and binary header checks—to advanced techniques such as chunked transfers, progress tracking, resumable uploads with pause/resume, and optional compression or encryption via CDN services.
This article explains how to use LLVM and SanitizerCoverage to insert BasicBlock‑level instrumentation into iOS binaries such as the WeChat SDK, covering the theory of code‑coverage metrics, compilation steps, bitcode extraction, and a practical demo that visualizes runtime execution paths.
This guide outlines key Linux utilities for inspecting binaries during compilation (nm, strings, strip, readelf, objdump, addr2line) and for runtime debugging and profiling (gdb, ldd, strace, ltrace, time, gprof, valgrind, mtrace, oprofile), plus an overview of the proc filesystem and common system logs.
This guide introduces ten fundamental Linux commands—file, ldd, ltrace, strace, hexdump, strings, readelf, objdump, nm, and gdb—explaining how each tool reveals a binary's type, dependencies, function calls, raw bytes, symbols, and runtime behavior for effective reverse‑engineering and debugging.
This report details the analysis of a JD security CTF challenge that uses a Keras deep‑learning model to detect function entry points in binary code, describing the environment, manual data processing, model inspection, training adjustments, and optimization steps to achieve correct detection.
