The article outlines a systematic reverse‑engineering process for legacy systems that extracts factual system knowledge, organizes it into AI‑consumable context, and integrates the workflow into a continuous delivery loop to improve AI draft accuracy and team cognition.
OpenAI's GPT-5.4-Cyber, released in April 2026, introduces advanced defensive capabilities such as lifted safety restrictions, binary reverse engineering, cross‑codebase reasoning, and a Trust Access System, while reshaping cybersecurity workflows, accelerating threat response, and raising new attacker risks.
It warns that over‑reliance on AI‑based automatic penetration tools erodes manual reverse‑engineering skills, jeopardizes national cyber defense, and endangers colleagues, urging security experts to retain hands‑on expertise and avoid becoming dependent on AI.
The article documents a week‑long, cross‑platform reverse‑engineering project that catalogs over 37 undocumented internal tools in Claude.ai, describing their schemas, behavior tests, edge cases, and platform‑specific availability, and reveals that Claude actually consists of three distinct toolsets with notable fragmentation.
The article walks through six real penetration‑testing scenarios, dissecting common encryption and authentication mechanisms in mini‑programs and web applications, demonstrating how to reverse‑engineer, debug, and script the bypass of Hawk signatures, MD5 timestamps, RSA and AES encryptions to achieve unauthorized data access and account takeover.
The article walks through setting up a Windows 2012 IIS environment, reverse‑engineering the product’s 3DES license check, analyzing web.config permissions, and uncovering multiple vulnerabilities—including SSRF, several SQL injections, and arbitrary file‑upload flaws—culminating in a full bypass of the EIS system’s authentication.
The unofficial notebooklm-py library reverse‑engineers Google’s private NotebookLM API, offering a full Python and CLI interface that enables batch downloads, content export, AI‑agent integration, and automated research workflows, while outlining its architecture, quick‑start steps, suitable users, and the risk of API changes.
The article walks through a security test of a WeChat public account that uses AES‑encrypted payloads, RSA‑encrypted keys, and an MD5 signature, showing how the author first tried memory editing with Cheat Engine, then succeeded by intercepting and modifying the JavaScript in Burp Suite to fix the key, and finally summarises why front‑end encryption can be bypassed.
This guide walks through two methods for using PowerDesigner to reverse‑engineer existing database tables into a PDM file, detailing the recommended step‑by‑step UI workflow and an alternative approach that may not work across all versions.
LibrePods is an open‑source project that reverse‑engineers Apple’s proprietary AirPods protocol, enabling Android and Linux users to access native features such as active noise cancellation, ear detection, battery status, and custom transparency modes, with detailed compatibility notes, installation steps, and a public GitHub repository.
This tutorial explains how to analyze Docker image internals, use the Dive tool and Docker Engine Python API to extract layer information, and employ the Dedockify script to reconstruct a functional Dockerfile from any pre‑built container image.
This comprehensive guide explains why debugging stripped binaries is crucial, walks through installing GDB, shows how to disassemble code, set address‑based breakpoints, inspect memory, handle signals, use advanced features like backtraces, conditional breakpoints, watchpoints, remote debugging, and even basic heap analysis for C/C++ programs.
An in‑depth reverse‑engineering of Anthropic’s Claude Code reveals its multi‑agent architecture, real‑time steering queue, and novel context‑compression engine, exposing the 50k+ line obfuscated JavaScript core, the Agent scheduling layers, tool ecosystem, and storage system that power this local AI coding assistant.
This guide walks through using Frida to hook common Android methods, print stack traces, and extract runtime data, providing ready-to-use code snippets for functions like HashMap.put, ArrayList.add, TextUtils.isEmpty, Base64 encoding, and UI event handling.
This tutorial demonstrates how to reverse‑engineer the X‑Product Android app, locate the dynamic newSign parameter, hook the RequestUtils.c method with Frida, and expose it via an RPC‑based FastAPI service to generate valid signed requests for the search API.
This comprehensive tutorial walks through using Frida to hook Android applications, covering official API references, loading APKs, hooking normal and static methods, modifying parameters and return values, handling constructors, inner and anonymous classes, enumerating loaded classes and methods, dynamic dex loading, selective hooking, and practical examples such as programmatically clicking a login button, all illustrated with clear code snippets and explanations.
This tutorial walks you through setting up a Python virtual environment, installing Frida and frida‑server on a rooted Android device, configuring the server, verifying the connection, and writing JavaScript hooks to intercept login functions, complete with code snippets, command examples, and troubleshooting tips.
This guide demonstrates how to strip splash-screen ads from an Android game by decompiling the APK, locating and altering the launch activity in AndroidManifest.xml, and recompiling the app, offering a practical reverse-engineering workflow for mobile developers.
This guide introduces JsRpc, a lightweight WebSocket‑based bridge that lets a Go server communicate with injected JavaScript in the browser, enabling reverse‑engineering of encrypted functions and data extraction through easy API calls.
This article provides a comprehensive guide on how to employ GDB for debugging programs that lack symbol information, covering basic commands, breakpoint techniques, core‑dump analysis, reverse debugging, and a practical example of integrating VSCode, GDB, and QEMU to debug an ARM64 Linux kernel.
The article analyzes a crash that occurs on Windows 10 when a 64‑bit program mixes RSP and ESP instructions, explains how writing to the 32‑bit ESP register zero‑extends the upper 32 bits of RSP, and shows how this stack‑pointer mismatch leads to an access‑violation error that does not appear on Windows 7.
This article introduces the OpenCoreAnalysisKit project, an open‑source suite for offline analysis of Android Core memory files across multiple architectures, detailing its components, build requirements, usage guides for kernel‑ and user‑mode debugging, and various command‑line tools and code snippets for comprehensive reverse‑engineering and memory‑analysis workflows.
This article explains the ticket‑purchasing workflow, identifies critical timing points for successful ticket grabbing, and presents two common technical approaches—browser automation with Selenium and reverse‑engineering ticket‑booking APIs—to automate the process, while warning about limitations and legal considerations.
This tutorial explains how to locate and eliminate the persistent WinRAR advertisement window by using Spy++, API Monitor, and IDA to identify the RarReminder class, find the CreateWindow call at offset 0xaa56d, and replace the call instruction with NOP bytes, effectively disabling the popup.
The article investigates undocumented x86 opcodes, describing a depth‑first search that uses page‑faults to locate hidden instruction boundaries, and reports finding dozens of executable but undocumented instructions on Intel and AMD CPUs, highlighting potential security risks and the need for vigilant hardware analysis.
This guide explains how a simple batch file can launch two or more WeChat instances on Windows by analyzing the app’s global mutex mechanism, reverse‑engineering the related DLL functions, and showing why the rapid start‑up bypasses the built‑in single‑instance guard.
This article explains how a simple batch file can launch two or more simultaneous WeChat processes on Windows, and provides a detailed reverse‑engineering analysis of WeChat's singleton enforcement using mutexes, API monitoring, and IDA disassembly to reveal why the trick works.
This guide explains how to extract .pyc files from a Python‑generated executable, restore missing bytecode headers, and use tools such as pyinstxtractor, pyi‑archive_viewer, and uncompyle6 to decompile the bytecode back into readable Python scripts while highlighting common pitfalls and protection mechanisms.
This guide walks through configuring and using Frida's server, gadget, and inject tools on Android devices, detailing installation steps, command‑line usage, persistent and non‑persistent hooking methods, and common pitfalls to avoid for effective mobile reverse engineering.
This guide walks you through rebuilding a fragmented EXE file, fixing a hidden byte error, analyzing its PE structure with IDA, and three ways to bypass the license check—by writing a DLL, patching the binary, or directly decoding the hidden flag.
This article details the methodology for discovering and analyzing Android local socket service vulnerabilities, outlines prerequisite skills, explains service classifications, demonstrates data‑handling function tracing, and presents a CVE‑2023‑35694 case study, highlighting common flaw types and mitigation insights.
The article reverse‑engineers GitHub Copilot’s VSCode extension, detailing how its webpack‑bundled JavaScript is unpacked, its registerGhostText entry point identified, and its prompt‑building, multi‑layer caching, debouncing, and Jaccard‑based similarity mechanisms operate, offering insights into AI‑assisted code completion design.
An Ant Group engineer reverse‑engineered a severe iOS 16 keyboard crash affecting the Alipay app, traced it to a faulty lock in UIKeyboardTaskQueue, and implemented an assembly‑level patch that eliminated the bug across millions of devices.
This article details how a hidden memory‑management bug in iOS 16’s keyboard component caused massive crashes in the Alipay app, explains the reverse‑engineering process that identified the faulty UIKeyboardTaskQueue logic, and describes the assembly‑level patch that eliminated the issue across millions of devices.
Android reverse engineering involves extracting an APK, decompiling it with tools like apktool, dex2jar, or JADX, analyzing and modifying Smali or Java code, recompiling and signing the package with jarsigner, and testing the changes, while using adb commands to retrieve the original file and emphasizing deeper analysis for robust security.
This article introduces FirmAE, an automated framework for firmware emulation and vulnerability analysis, details its installation and usage steps on Ubuntu, and presents a comprehensive reverse‑engineering case study of a Zyxel router firmware to illustrate troubleshooting and manual analysis techniques.
A University of Illinois researcher reverse‑engineers GitHub Copilot, revealing how its VS Code extension builds complex prompts, selects models, manages telemetry, and decides which suggestions to display, while exposing configuration details, prompt‑engineering pipelines, model calls, and privacy implications for developers.
This article introduces the Mach-O executable format, explains how its structure can be leveraged to attribute dynamic and static libraries at runtime and during build, and presents two practical projects—library attribution and fast API scanning—complete with implementation details and code snippets.
During a penetration testing exercise, the team discovered a cleverly disguised GitHub repository that leaked credentials, leading to a vulnerable admin interface, a malicious Python‑based VPN client which, after reverse‑engineering with PyInstaller extraction, revealed embedded shellcode hidden in images, allowing the attackers to trace the command‑and‑control server and pinpoint the origin of the intrusion.
This guide demonstrates how to use Frida for Android reverse engineering, covering essential commands, stack tracing, and practical hook scripts for common methods such as HashMap.put, Base64.encodeToString, and UI event listeners, enabling developers to locate and analyze encryption logic within apps.
This tutorial demonstrates how to capture and reproduce the dynamic newSign parameter of the X‑Wu Android app by reverse‑engineering the request‑signing method with Frida, exposing it via an RPC server, and then using the generated signature to call the official search API.
This article explains how to employ Frida RPC to intercept and forward encrypted mobile app requests, demonstrates the required environment, provides hook scripts for encryption and decryption, and shows how to wrap them in a FastAPI service for automated crawling.
This tutorial walks you through using Frida to hook Android applications, covering API basics, method interception, constructor and field manipulation, overload handling, dynamic class loading, and practical code snippets for both static and instance methods, all while emphasizing safe, educational use.
This tutorial walks you through installing Frida, setting up a Python virtual environment, deploying frida‑server to an Android device, and writing JavaScript hooks to intercept app functions, providing detailed commands, code snippets, and verification steps for effective mobile reverse‑engineering.
This article walks through static analysis and Frida hooking of an Android app’s login flow, dissecting the JsonRequest, RequestUtil, and encryption steps, then reproduces the MD5‑based sign generation and DES‑CBC encryption in JavaScript, providing full code snippets and explanations.
This article explores whether modern CPUs contain undocumented or hidden instructions, explains the challenges of searching the variable‑length x86 ISA, presents a depth‑first algorithm that skips irrelevant bytes, shows how to infer instruction length using page‑fault side‑effects, and reveals discovered hidden opcodes on Intel and AMD processors.
The article investigates whether modern x86 CPUs contain undocumented or hidden instructions, explains how to search the instruction space using a depth‑first algorithm that leverages page‑fault side‑effects to determine instruction length, and presents the results of uncovering such hidden opcodes on Intel and AMD processors, highlighting the potential security risks.
This guide walks you through using AndroidKiller and a virtual emulator to decompile an APK, identify and modify the main activity in AndroidManifest.xml, recompile the app, and verify that the splash advertisement is permanently removed.
This article explains how to reverse‑engineer the Shumei slider captcha by retrieving its configuration API, extracting the obfuscated JavaScript, locating the decryption function, and using Python regex and execjs to capture dynamic parameters and DES keys for successful automated submissions.
This article demonstrates how to reverse‑engineer the NetEase Cloud Music web API to extract encrypted parameters, use Python to fetch song comments, and apply SnowNLP for sentiment analysis and word‑cloud visualization, providing a step‑by‑step guide with code examples.
This article presents a detailed technical analysis of the Y‑BotManager anti‑spam system, describing its architecture, the reverse‑engineering process of its SensorData generation, the device and user‑interaction features used for bot detection, and the practical attempts to bypass the protection.
This tutorial walks you through using the jsrpc tool to reverse‑engineer a site’s encrypted parameters, extract data from 100 pages, and automate requests with Python, providing detailed code snippets, debugging tips, and a complete end‑to‑end example.
This article explains the concept of Remote Procedure Call (RPC), demonstrates how to apply RPC for web reverse engineering by injecting JavaScript through WebSocket communication, and introduces the Sekiro framework and related tools for automating encryption parameter retrieval in browser environments.
This article explains how to statically analyze Android apps to identify privacy‑related method calls hidden in native .so libraries, extract method signatures from smali files, construct a call‑graph with callers and callees, handle cycles, and traverse the graph to reveal call chains.
The article dissects Apple’s FairPlay DRM, detailing its kernel‑driver and daemon decryption workflow, the LC_ENCRYPTION_INFO metadata, per‑user licensing files, LLVM‑level obfuscation techniques such as opaque predicates and control‑flow flattening, and the identified weaknesses that enable reverse‑engineering and key extraction.
Swedish parents, frustrated by the costly and unusable official Skolplattformen app, reverse‑engineered its API and released the open‑source Öppna Skolplattformen, sparking legal battles, privacy debates, and a community‑driven alternative that now serves thousands of families.
This tutorial explains how to unpack a PyInstaller‑packed executable, restore the missing .pyc header, and decompile the resulting bytecode back to readable Python source using pyinstxtractor, 010Editor, and uncompyle6.
This article provides a comprehensive overview of Android app hardening methods, detailing the evolution from first‑generation dex and so protection to advanced code virtualization, and outlines various unpacking (脱壳) techniques—including memory dump, dynamic debugging, hook‑based and custom ROM approaches—used to bypass these protections.
A former Apple developer has released a 350‑page reverse‑engineering report that dissects the M1 ARM chip’s architecture, performance, and cache design, offering detailed experiments, patent analysis, and insights for readers with strong CPU knowledge while highlighting the challenges of opening Apple’s closed hardware ecosystem.
This tutorial explains how to retrieve the 32‑byte encryption key of the PC version of WeChat by attaching OllyDbg to the WeChat process, locating the password in memory, and then using a custom C++ program built with OpenSSL to decrypt the WeChat SQLite database files.
Mozilla reverse‑engineered Windows' default‑browser enforcement, enabling users to set Firefox as the system default with a single click on both Windows 10 and Windows 11, bypassing the cumbersome file‑type settings introduced in the new OS version.
The article introduces JavaTweakHook, a lightweight Android hook framework that avoids Xposed by directly manipulating ART structures, compares it with existing solutions, details the hook process—including method creation, ArtMethod copying, assembly trampolines, and native‑Java integration—and provides compilation, usage, and limitation notes.
This article walks through the step‑by‑step reverse‑engineering process used to identify and replicate the MD5‑based sign generation in a web API request, detailing parameter extraction, code inspection, and cookie handling to recreate the required authentication logic.
A reverse‑engineer discovered that GTA Online’s slow startup stems from an inefficient if‑loop that scans a 10 MB JSON file 1.98 billion times, and by hooking strlen and replacing the loop with a hash‑map, reduced load times from six minutes to under two minutes.
This guide explains how to locate the JavaScript responsible for generating URL parameters by inspecting event listeners and searching source files in Chrome, observe its execution with breakpoints, and then replicate the logic in Python using js2py to obtain login credentials.
This guide explains how to compile Python code into .pyd files, unpack PyInstaller‑packed executables, decompile bytecode, analyze the generated assembly in IDA, and patch conditional logic to bypass license checks, providing a practical workflow for binary reverse engineering.
This guide explains how to use Django's inspectdb command to generate model classes from existing MySQL tables, handle migration issues, write the output directly into an app, and correctly configure timestamp fields for automatic creation and updates.
This article explains the fundamentals of hooking on iOS, covering Method Swizzle and Facebook's fishhook, detailing the Mach‑O file structure, PIC technique, and providing complete source code examples that demonstrate how to replace system functions such as NSLog at runtime.
ImHex is a rapidly popular open‑source hex editor designed for eye‑friendly binary editing, offering features such as hex view, byte patching, custom language support, multi‑architecture disassembly, data import/export, and a sleek dark‑theme UI, with compilation instructions for Windows and Linux provided.
This tutorial explains how to set up the Xposed framework on a rooted Android device, create a hook module that intercepts the IMEI‑retrieving method, compile and install the module, and demonstrates additional privacy‑related use cases such as data masking and ad removal.
This article walks through the discovery, reverse‑engineering, and full reproduction of a malicious Nginx backdoor, detailing its cookie‑based trigger, shell‑reversal mechanism, code analysis, compilation steps, and detection methods for security researchers.
This article compiles a comprehensive, categorized collection of penetration testing resources—including anonymity tools, antivirus evasion utilities, books, CTF frameworks, Docker containers, network analysis tools, OSINT platforms, and more—providing security professionals and researchers with a valuable reference for offensive security engagements.
This article explains how to perform static analysis of Android APK files with Python, covering environment preparation, unpacking the APK, extracting basic metadata, analyzing classes and methods using the Androguard library, and generating a method call graph for deeper reverse‑engineering insights.
This tutorial explains how to recognize and eliminate dead code and flower‑instruction obfuscation techniques in JavaScript, walks through using Obfuscator.io to generate heavily mixed code, and demonstrates step‑by‑step static analysis to strip away useless statements, ultimately restoring the original concise logic.
This guide introduces ten fundamental Linux commands—file, ldd, ltrace, strace, hexdump, strings, readelf, objdump, nm, and gdb—explaining how each tool reveals a binary's type, dependencies, function calls, raw bytes, symbols, and runtime behavior for effective reverse‑engineering and debugging.
This tutorial walks you through using Navicat 12 to design, relate, and export a database schema for a mall permission management module, covering model opening, table creation, foreign‑key setup, auto‑layout, SQL export, and reverse engineering with clear screenshots.
A Chinese court case reveals how a reverse‑engineered, unauthorized WeChat client for feature phones spread illegal ads, compromised encrypted communications, and led to criminal charges for providing tools to infiltrate computer systems, highlighting serious information‑security risks and the legal consequences of software piracy.
This comprehensive collection presents a curated list of penetration testing resources—including anonymity tools, antivirus‑evasion utilities, books, CTF frameworks, Docker containers for vulnerable systems, network analysis utilities, OSINT services, reverse‑engineering tools, and security education materials—providing security professionals and researchers with a valuable reference for offensive security testing and learning.
This article explains how to locate and modify in‑memory game data, write simple Windows‑API cheat programs, automate gameplay actions, and intercept network traffic for popular PC games, providing step‑by‑step examples and full source code for each technique.
This article examines the Android shared library (SO) loading mechanism, identifies security vulnerabilities, and presents a method of packing the SO to hinder reverse engineering, detailing each loading step, challenges across Android versions, and before‑after protection results.
This article explains practical anti‑debugging methods for Android applications—covering Java tools like Proguard and debugger checks, as well as NDK strategies such as ptrace, file‑node monitoring, Inotify, SO hash verification, and timing analysis—to raise reverse‑engineering difficulty.
A comprehensive, curated list of 123 Python-based security tools spans network analysis, debugging, reverse engineering, fuzzing, web testing, forensics, malware analysis, PDF inspection, miscellaneous utilities, plus recommended libraries, books, and learning resources for penetration testers and security researchers.
This report details the analysis of a JD security CTF challenge that uses a Keras deep‑learning model to detect function entry points in binary code, describing the environment, manual data processing, model inspection, training adjustments, and optimization steps to achieve correct detection.
This article provides an in‑depth overview of the ELF file format, describing its headers, section and program tables, symbol structures, and demonstrates how to use this knowledge to locate and hook functions in Android native libraries such as libmedia.so.
This article presents a detailed overview of Android app security threats, the essential components of an Android project, the full APK build and decompilation process, and a range of reverse‑engineering tools and protection strategies—including Smali analysis, SO manipulation, and signing bypass—to help developers safeguard their applications against piracy and data tampering.
This article introduces the ELF file format used in Linux and Android, explains its three main types, compares it to Windows PE, and outlines how linkers and loaders interpret ELF headers, sections, and segments for native development and reverse engineering.
This article introduces the macOS vmmap utility, explains why a lightweight version was re‑implemented for iOS, and details the step‑by‑step code that obtains task handles, region data, dyld image information, formats and prints memory maps to aid reverse‑engineering on iOS devices.
This article examines the current Android security landscape, outlines the platform's security model, discusses program, data, and system vulnerabilities, analyzes a tampered APK case study, and presents comprehensive protection techniques such as obfuscation, shelling, and integrity verification.
This article explains the Lua 5.2 bytecode format, details each field of the Luac file header and function prototypes, and shows how to create a 010 Editor binary template to parse and edit Luac files for reverse‑engineering and security analysis.
This article examines why an inline hook created with Substrate on ARM Thumb crashes, detailing the hook mechanism, the offending PC‑relative ADR instruction, and the necessary instruction fixes to prevent control‑flow errors.
This article walks through extracting the hidden ID from Battle of Balls' short share URL, decoding the base64 parameters, and using the revealed ID to request dragon eggs (or lollipops) automatically with a Python script.
This article reverse‑engineers a single‑line JavaScript snippet that creates a 128‑byte ray‑tracing demo, explains how the code works, refactors it for readability, and analyses the underlying arithmetic and bitwise operations that produce the patterned output.
This article compiles a comprehensive list of 123 Python-based penetration testing tools, covering network utilities, debugging and reverse‑engineering frameworks, fuzzing platforms, web testing kits, forensic analysis utilities, malware analysis helpers, PDF inspection modules, miscellaneous libraries, recommended books, talks, and additional resources for security professionals.
This article walks through the reverse‑engineering of a compact JavaScript one‑liner that draws a patterned image, refactors it into readable modules, explains each transformation—including variable renaming, loop conversion, ternary expansion, bitwise operations, and switch‑case replacement—while illustrating the underlying math with graphs and code snippets.
This article presents a comprehensive list of Python-based tools covering network packet analysis, debugging, reverse engineering, fuzzing, web testing, forensics, malware analysis, PDF inspection, and various miscellaneous utilities useful for security professionals and researchers.
This article provides a step‑by‑step tutorial on setting up the development environment, installing essential tools, and performing APK reverse engineering and security analysis on Android applications, covering JDK, SDK, NDK, Apktool, Dex2jar, JD‑GUI, IDA, WinHex, and Eclipse.
This article outlines a systematic approach to onboarding and training new Site Reliability Engineers, covering trust building, readiness assessment, diverse learning methods, structured curricula, on‑call milestones, project‑focused work, reverse‑engineering skills, statistical thinking, and improvisation techniques to develop high‑performing SRE teams.
The article outlines common Android security vulnerabilities such as unprotected resources, easily decompiled Java and native code, and proposes protection measures like resource obfuscation, code encryption, native code hardening, and introduces the Qotector platform for APK analysis and reinforcement.
A programmer hired to fix a quirky questionnaire program on an old 3B2 machine discovers that the source code repeatedly reverts, the curses library is tampered, and ultimately a malicious compiler injects backdoor code, leading to a multi‑day forensic investigation and replacement of the toolchain.
This article dissects Qingting FM’s Android app, revealing how it spawns multiple background services, launches invisible activities, and uses hidden WebViews to fake daily active users and ad impressions, while providing step‑by‑step reverse‑engineering instructions for developers.
