Frida: Java Wrapper vs JNI Interceptor on the Same Call
Lab APK com.lab.jni.trace. Hook NativeBridge.nInit in Java.perform and the Java_* export with Interceptor.attach, then compare argument length and prefix. Console output redacted.
Binary Analysis
Entitlements and the Simulator Sandbox on a Lab iOS App
codesign -d –entitlements on a self-signed LabSession: get-task-allow, redacted application-identifier, container paths on the simulator, sandbox-exec, deny logs when a file read walks outside the container. cryptid=1 stops the lab.
V8 Security Surface Notes for Defenders
d8 toy typed-array lab, LAB_ASSERT bounds throw, optional –allow-natives-syntax DebugPrint — a crash, not an exploit.
apktool Smali: if-eqz Chains That Want to Be a switch
Lab APK with packed-looking if-eqz obfuscation around a 5-way dispatch. apktool smali, jadx Java, reconstruct a packed-switch, plus a planted stack copy crash. Not a commercial packer unpack.
Walking .init_array on a Toy Packed ELF
Lab stub that mprotects RWX, XOR-decodes a 32-byte .text blob, restores r-x, then returns into real code. readelf of .init_array and PT_GNU_STACK, gdb break on mprotect, dump of the r-x region.
Dirty Pipe Class Analysis for Defenders
Toy splice/pipe lab on a temp file we own, uname -r vs CVE-2022-0847, SIGSEGV on a PROT_READ map — not a setuid hijack.
Reversing objc_msgSend on a Self-Signed arm64 Mach-O
otool load commands, class-dump selectors, lldb break on objc_msgSend, recover IMP for -[LabSession startWithToken:], redacted argument log. FairPlay-encrypted App Store bins are out of scope.
Binary Auditing Checklist, Filled on a Toy ELF
First-pass checklist actually filled: checksec + readelf + objdump on a 60-line toy with gets/sprintf/printf(user). One-pager of mitigations, sinks, and the ASan crash.