A Glimpse Into DexProtector
This blog post provides a high-level overview of DexProtector’s security features and their limitations
Romain Thomas
Software obfuscation, reverse engineering, program analysis, and open-source binary tooling by Romain Thomas.
Latest posts
Fuzzing Windows ARM64 closed-source binary
This blog post introduces coverage-guided fuzzing with QBDI and libFuzzer targeting Windows ARM64.
Instrumenting an Apple Vision Pro Library with QBDI
This blog post demonstrates how to extract liblockdown.dylib from the visionOS dyld shared cache to be instrumented with QBDI on an Apple M1.
iCDump: A Modern Objective-C Class Dump
This blog post introduces iCDump, a new Objective-C class dump based on LLVM.
Symbi
A dynamic trace symbolizer built on DynaMIR.
MCStone
A clean, high-performance assembler and disassembler built on LLVM’s MC layer for production reverse-engineering workloads.
Lypid
A user-friendly library for inspecting and generating DWARF and PDB debug information.
iCDump
A modern, cross-platform Objective-C class dump that reconstructs declarations from Mach-O metadata with LIEF and LLVM.
Hooky
A modern C++ hooking framework for x86-64, ARM64, and RISC-V64, with cross-platform detours and function replacement.
DynaMIR
A modern dynamic binary instrumentation engine for x86-64, ARM64, and RISC-V64, built around a custom MLIR-based IR.
CLayout
A Clang-powered analyzer for C and C++ layouts that resolves target-specific records, field offsets, sizes, methods, and types.
BinLift
A user-friendly binary lifter built on QBDL, with DWARF-aware types and native or instrumented function calls.
Introduction to Reverse Engineering
This workshop introduces the main concepts to get started in reverse engineering
Open-Obfuscator: A free and open-source obfuscator for mobile applications
This blog post introduces open-obfuscator, a new open-source project to obfuscate mobile applications.
Open-Obfuscator
A free and open-source obfuscator for mobile applications
Part 2 – iOS Native Code Obfuscation and Syscall Hooking
This second blog post deals with native code obfuscation and RASP syscall interception
Part 1 – SingPass RASP Analysis
This first blog post introduces the RASP checks used in SingPass
A Journey in iOS App Obfuscation
This series of blog posts details how obfuscators can protect iOS applications from reverse engineering
The Poor Man's Obfuscator
Slides PDF document preview The inline viewer is loaded only when requested. Open inline preview Download PDF Whitepaper PDF document preview The inline viewer is loaded only when requested. Open inline preview Download PDF Video (English) Your browser cannot play this video. Download the recording.
DroidGuard: A Deep Dive into SafetyNet
Slides PDF document preview The inline viewer is loaded only when requested. Open inline preview Download PDF Whitepaper PDF document preview The inline viewer is loaded only when requested. Open inline preview Download PDF Talk at BlackHat (English) Talk at SSTIC (French) Your browser cannot play this video. Download …
DroidGuard
DroidGuard / SafetyNet bypass
PGSharp: Analysis of a Cheating App for PokemonGO
This blog post is about the internal mechanisms of PGSharp, a cheat engine for PokemonGO.
PGSharp: Analysis of a Cheat Engine on Android
Slides PDF document preview The inline viewer is loaded only when requested. Open inline preview Download PDF Talk Blog Post PGSharp: Analysis of a Cheating App for PokemonGO
Gotta Catch 'Em All: Frida & jailbreak detection
This blog post analyzes the Frida and Jailbreak detection in PokemonGO for iOS.
QBDL: QuarksLab Dynamic Loader
Slides PDF document preview The inline viewer is loaded only when requested. Open inline preview Download PDF Talk (In French) Your browser cannot play this video. Download the recording.
QBDL
QuarkslaB Dynamic Loader: Generic loader for ELF, PE, and Mach-O
Dynamic Binary Instrumentation Techniques to Address Native Code Obfuscation
Slides PDF document preview The inline viewer is loaded only when requested. Open inline preview Download PDF Whitepaper PDF document preview The inline viewer is loaded only when requested. Open inline preview Download PDF Talk Demo #1: Snapchat Your browser cannot play this video. Download the recording.
r2-pay: whitebox (part 2)
This second blog post explains how to recover the whitebox’s key from the obfuscated library libnative-lib.so
r2-pay: anti-debug, anti-root & anti-frida (part 1)
This first blog post describes the protections in the challenge r2-pay.
Tencent Legu Unpacker
Scripts to unpack Android applications protected by Tencent Legu
A Glimpse Into Tencent's Legu Packer
Analysis of Tencent Legu: a packer for Android applications.
Android Native Library Analysis with QBDI
This blog post deals with QBDI and how it can be used to reverse an Android JNI library
Android Runtime Restrictions Bypass (PoC)
Android application that disables Android restrictions without root privileges
Android Runtime Restrictions Bypass
NoteThis publication is also available on the Quarkslab Blog. With the release of Android Nougat, Google introduced restriction about native libraries that can be loaded from an Android application. Basically, it prevents developers to link against some internal libraries such as libart.so. Later on and with the …
Android crackme challenge
Android crackme that uses system’s internals
Android VDEX formats
Internal structures of VDEX format
Android OAT formats
Internal structures of OAT format
Static Instrumentation Based on Executable Formats
Many instrumentation techniques are based on modifying code or system environment of the target. It can be suitable for scenarios but it could not work under certain circumstance (integrity checking, non-rooted environment…) In this talk we propose similar techniques by only modifying the executable format. This …
When SideChannelMarvels meets LIEF
On how we used LIEF to lift an Android x86_64 library to Linux to perform our usual white-box attacks on it.
How to use frida on a non-rooted device
This post explains how to use Frida gadget on a non-rooted device.
Have fun with LIEF and Executable Formats
This blog post introduces new features of LIEF as well as some uses cases.
LIEF: Library to Instrument Executable Formats
When analyzing an executable, the first layer of information is the format in which the executable is wrapped. Many tools and libraries can analyze and instrument machine code wrapped by one format. However, no library handled all three mainstream executable formats while supporting both reading and modification. LIEF …
Open-sourcing LIEF
We are open-sourcing LIEF, a library to parse and manipulate ELF, PE, and Mach-O binary formats. This blog post explains the purpose of this project and some parts of its architecture.
How Triton can help to reverse virtual machine based software protections
Slides PDF document preview The inline viewer is loaded only when requested. Open inline preview Download PDF Video Your browser cannot play this video. Download the recording.
LIEF
Parse, inspect, modify, and build ELF, PE, Mach-O, DEX, and more through one consistent C++, Python, Rust, Java, or C API.
Work Experience
Security engineering roles and research experience spanning software obfuscation, reverse engineering, Android security, and binary tooling.
Dynamic Binary Analysis and Obfuscated Codes
PDF document preview The inline viewer is loaded only when requested. Open inline preview Download PDF
HITB 2015 Write-up - Crypto 400
Write up
HITB 2015 Write-up - Crypto 300
Write-up for the Crypto 300 challenge
Code coverage using a dynamic symbolic execution
This blog post introduces code coverage with Triton