Romain Thomas
Security Engineer
Reverse Engineering
Tooling
Code Obfuscation
Training
I'm a security engineer interested in reverse-engineering, code obfuscation, software protections, and tools development.
I develop and maintain LIEF, a library to parse and manipulate executable formats and I'm also working on Open-Obfuscator, a free and open-source obfuscator for mobile applications.
I enjoy going back and forth between reverse-engineering and tooling. I started at Quarkslab back in 2016 where I had the chance to work on various topics from JTAG ports detection to the support of AArch64 in QBDI. I also participated in the bootstrapping of an Android training covering both: system internals and app analysis. I left the company in 2021 to work on the security of banking applications. This new topic involves code obfuscation and software protection analysis from the perspective of EMVCo certifications.
Interests
- Reverse engineering
- Cryptography
- Executable file formats
- Mobile applications & internals
- Obfuscation
- Privacy
- Protocols Analysis
Blog Posts
Fuzzing Windows ARM64 closed-source binary
This blog post introduces coverage-guided fuzzing with QBDI and libFuzzer targeting Windows ARM64.
Instrumenting an Apple Vision Pro Library with QBDI
This blog post demonstrates how to extract liblockdown.dylib from the visionOS dyld shared cache to be instrumented with QBDI on an Apple M1.
iCDump: A Modern Objective-C Class Dump
This blog post introduces iCDump, an new Objective-C class dump based on LLVM
Projects
Android Runtime Restrictions Bypass (PoC)
Android application that disables Android restrictions without root privileges
Publications
Conferences & White Papers
The Poor Man's Obfuscator
The purpose of this publication is to present ELF and Mach-O transformations which impact or hinder disassemblers like IDA, BinaryNinja, Ghidra, and Radare2.
DroidGuard: A Deep Dive into SafetyNet
SafetyNet is the Android component developed by Google to verify the devices’ integrity. These checks are used by the developers to prevent running applications on devices that would not meet security requirements but it is also used by Google …
PGSharp: Analysis of a Cheat Engine on Android
PGSharp is a cheating app for PokemonGO that works on non-rooted devices. This talk introduces its functionalities and the protections used to prevent reverse-engineering.
Misc
DroidGuard
DroidGuard / Safetynet bypass
QString
QString object layout from Qt 5.11.2
QList
QList object layout from Qt 5.11.2
