https://blog.omiilgo.com/tags/reverse-engineering/ Recent content in Reverse-Engineering on Security Notes Hugo en-us Tue, 15 Sep 2026 09:00:00 +0800 https://blog.omiilgo.com/posts/elf-symbol-and-relocation-basics/ Tue, 15 Sep 2026 09:00:00 +0800 https://blog.omiilgo.com/posts/elf-symbol-and-relocation-basics/ Toy PIE: readelf -s / -r / -d / -S in one sitting. .dynsym UND vs .symtab, JUMP_SLOT vs RELATIVE, how a stripped copy still names puts. gdb bind check. https://blog.omiilgo.com/posts/ios-swift-vs-objc-name-recovery/ Fri, 21 Mar 2025 13:00:00 +0800 https://blog.omiilgo.com/posts/ios-swift-vs-objc-name-recovery/ Lab Swift class LabVault: $s… mangled names, xcrun swift demangle, nm before/after strip, the one @objc method that survives in __objc_methname. class-dump, lldb, ASAN. cryptid=1 stops the lab. https://blog.omiilgo.com/posts/android-native-library-re-notes/ Sat, 04 Jan 2025 10:00:00 +0800 https://blog.omiilgo.com/posts/android-native-library-re-notes/ One lab APK, one arm64-v8a .so. file/readelf/llvm-objdump through JNI_OnLoad, Java_* exports, GetStringUTFChars, a 32-byte stack copy, tombstone and ASAN. Frida logs length and prefix only. https://blog.omiilgo.com/posts/android-binder-parcel-reversing/ Fri, 16 Feb 2024 09:00:00 +0800 https://blog.omiilgo.com/posts/android-binder-parcel-reversing/ Self-built AIDL service com.lab.binder. dumpsys and logcat Binder, Parcel bytes for writeInterfaceToken + int + string, ARM64 BnEcho::onTransact. No privilege escalation. https://blog.omiilgo.com/posts/android-frida-jni-trace-lab/ Mon, 04 Sep 2023 11:00:00 +0800 https://blog.omiilgo.com/posts/android-frida-jni-trace-lab/ Lab APK com.lab.jni.trace. Hook NativeBridge.nInit in Java.perform and the Java_* export with Interceptor.attach, then compare argument length and prefix. Console output redacted. https://blog.omiilgo.com/posts/android-smali-control-flow-notes/ Tue, 08 Nov 2022 14:00:00 +0800 https://blog.omiilgo.com/posts/android-smali-control-flow-notes/ Lab APK with packed-looking if-eqz obfuscation around a 5-way dispatch. apktool smali, jadx Java, reconstruct a packed-switch, plus a planted stack copy crash. Not a commercial packer unpack. https://blog.omiilgo.com/posts/packed-elf-init-array-dump/ Mon, 18 Jul 2022 09:30:00 +0800 https://blog.omiilgo.com/posts/packed-elf-init-array-dump/ Lab stub that mprotects RWX, XOR-decodes a 32-byte .text blob, restores r-x, then returns into real code. readelf of .init_array and PT_GNU_STACK, gdb break on mprotect, dump of the r-x region. https://blog.omiilgo.com/posts/ios-objc-msgsend-reversing/ Wed, 27 Oct 2021 16:40:00 +0800 https://blog.omiilgo.com/posts/ios-objc-msgsend-reversing/ otool load commands, class-dump selectors, lldb break on objc_msgSend, recover IMP for -[LabSession startWithToken:], redacted argument log. FairPlay-encrypted App Store bins are out of scope. https://blog.omiilgo.com/posts/binary-auditing-checklist/ Sat, 21 Aug 2021 16:00:00 +0800 https://blog.omiilgo.com/posts/binary-auditing-checklist/ First-pass checklist actually filled: checksec + readelf + objdump on a 60-line toy with gets/sprintf/printf(user). One-pager of mitigations, sinks, and the ASan crash. https://blog.omiilgo.com/posts/android-jni-registernatives-lab/ Wed, 09 Jun 2021 14:10:00 +0800 https://blog.omiilgo.com/posts/android-jni-registernatives-lab/ APK where nm -D shows no Java_* exports. Walk JNI_OnLoad, recover the JNINativeMethod table, map Java names to ARM64 IMPs, Frida-trace the native with arguments redacted. https://blog.omiilgo.com/posts/cpp-vtable-recovery-from-disassembly/ Thu, 11 Mar 2021 10:00:00 +0800 https://blog.omiilgo.com/posts/cpp-vtable-recovery-from-disassembly/ Two-class toy hierarchy, virtual dtor plus two methods. objdump/readelf of the compiler vtable, ctor writing the vptr, virtual call through [x0,#16], gdb print of the slot. https://blog.omiilgo.com/posts/rop-versus-ret2libc-mental-model/ Tue, 09 Feb 2021 14:00:00 +0800 https://blog.omiilgo.com/posts/rop-versus-ret2libc-mental-model/ Mental model plus objdump of a toy: ret2libc is whole-function reuse, ROP is fragment reuse. Classify epilogue rets vs pop;ret vs leave;ret. Overflow crash with RIP=0x4141… — no system("/bin/sh") chain. https://blog.omiilgo.com/posts/arm64-calling-convention-for-reversers/ Mon, 03 Aug 2020 13:00:00 +0800 https://blog.omiilgo.com/posts/arm64-calling-convention-for-reversers/ AAPCS64 as it shows up in IDA: x0–x7, x29/x30, 16-byte SP, PACIBSP. Toy function with nine integer args so the ninth is on the stack. objdump of prologue and epilogue. https://blog.omiilgo.com/posts/relro-got-plt-reading-notes/ Mon, 15 Jun 2020 09:00:00 +0800 https://blog.omiilgo.com/posts/relro-got-plt-reading-notes/ Partial vs Full RELRO measured on one toy: readelf FLAGS/GNU_RELRO, objdump of puts@plt, gdb GOT slot before and after bind, /proc maps of .got.plt. Companion to the lazy-binding lab. https://blog.omiilgo.com/posts/elf-got-plt-lazy-binding-lab/ Wed, 22 Apr 2020 11:20:00 +0800 https://blog.omiilgo.com/posts/elf-got-plt-lazy-binding-lab/ Lab walkthrough of lazy PLT binding on a PIE: readelf, objdump, GOT slot before/after the first call, Partial vs Full RELRO. https://blog.omiilgo.com/posts/ios-macho-load-commands-lab/ Thu, 16 Jan 2020 11:00:00 +0800 https://blog.omiilgo.com/posts/ios-macho-load-commands-lab/ Full otool -l walk of a self-signed LabSession: mach_header_64, LC_SEGMENT_64 __TEXT/__DATA, LC_LOAD_DYLIB, LC_CODE_SIGNATURE, LC_ENCRYPTION_INFO_64 cryptid=0. size -x, nm, class-dump, lldb. cryptid=1 stops the lab. https://blog.omiilgo.com/posts/android-jni-onload-name-mangling/ Mon, 02 Dec 2019 10:00:00 +0800 https://blog.omiilgo.com/posts/android-jni-onload-name-mangling/ Self-built APK where javah-style Java_com_lab_onload_Bridge_* exports sit next to a RegisterNatives table. readelf -s, ARM64 JNIEnv GetObjectClass, crash on an unbounded UTF copy.