Romain Thomas Security engineer
Romain Thomas Romain ThomasSecurity Engineer · Paris, France

SOFTWARE OBFUSCATION · REVERSE ENGINEERING

Breaking and Building Defenses: Software Security and Code Obfuscation

I work in a continuous loop: breaking protections to build better, automated solutions. To achieve this, I balance my time between reverse engineering and software protection engineering.

RESEARCH FIELD / 01

Protection, analysis, tooling, and publication form one continuous research loop.

Research areas

  • Obfuscation engineering
  • Deobfuscation & reversing
  • Mobile RASP
  • Agentic Binary Tooling

BUILD / BREAK / LEARN

Protection gets stronger when the offensive and defensive sides work together.

On the defensive side, I created the open-obfuscator projects including tools like O-MVLL & dProtect. On the offensive side, I reverse-engineer commercial protection stacks to uncover their underlying architectures, assumptions, and limitations

I'm also the author and core developer of LIEF, the cross-platform library that makes executable formats consistent to parse, inspect, modify, and rebuild from C++, Python, Rust, and more.

CORE RESEARCH

Obfuscation: Both Sides.

I build protections to understand the constraints, and I reverse protections deployed in the wild to learn where they bend or break.

01 / DEFENSIVE

Contributions

open-obfuscator provides a free and easy way to get started with protection on mobile

  • O-MVLL for LLVM-based native code protection
  • dProtect for Android Java and Kotlin bytecode
  • Open designs following known protections

Non-public work

  • Architected an innovative, non-intrusive IR-based obfuscation pipeline that integrates seamlessly across Android, iOS, and Windows toolchains.
  • Engineered a stealthy Android packer designed to provide robust anti-tampering protection for mobile video games.
Visit obfuscator.re

FIELD NOTES

Blog Posts

Deep dives into obfuscation, deobfuscation, program analysis, and the protections found in the wild.

Browse all articles RSS
Looking for a specific analysis?Browse the complete archive by date, platform, and topic.
View the complete article archive

BUILT FOR AUTOMATION

Tooling

Open-source tools, private components, and the systems behind an agentic reverse-engineering workflow.

All projects
LIEF cross-platform executable format architecture

Flagship project

LIEF

Parse, inspect, modify, and build ELF, PE, Mach-O, DEX, and more through one consistent C++, Python, Rust, Java, or C API.

  • ELF
  • PE
  • Mach-O
  • DEX
  • multi-language
Visit lief.re
Closed source LIEF Extended

MCStone

A clean, high-performance assembler and disassembler built on LLVM's MC layer for production reverse-engineering workloads.

  • LLVM MC
  • assembler
  • disassembler
View overview
Closed source LIEF Extended

Lypid

A user-friendly library for inspecting and generating DWARF and PDB debug information.

  • DWARF
  • PDB
  • debug information
View overview
Closed source

Hooky

A modern C++ hooking framework for x86-64, ARM64, and RISC-V64, with cross-platform detours and function replacement.

  • hooking
  • x86-64
  • ARM64
  • RISC-V64
View overview
Closed source

DynaMIR

A modern dynamic binary instrumentation engine for x86-64, ARM64, and RISC-V64, built around a custom MLIR-based IR.

  • DBI
  • MLIR
  • x86-64
  • ARM64
  • RISC-V64
View overview
Closed source

BinLift

A user-friendly binary lifter built on QBDL, with DWARF-aware types and native or instrumented function calls.

  • binary lifting
  • QBDL
  • QBDI
  • DWARF
View overview
Closed source

CLayout

A Clang-powered analyzer for C and C++ layouts that resolves target-specific records, field offsets, sizes, methods, and types.

  • Clang
  • C++
  • type layout
View overview
Closed source LIEF Extended

iCDump

A modern, cross-platform Objective-C class dump that reconstructs declarations from Mach-O metadata with LIEF and LLVM.

  • Objective-C
  • Mach-O
  • LIEF Extended
View overview

OPEN SOURCE

Public research tools

Source-available projects, proofs of concept, and reusable research infrastructure.

ON THE RECORD

Publications.

Conference talks, white papers, and technical publications.

Browse every publication

TRAINING / WORKSHOP

Learn by taking things apart.

This workshop introduces the main concepts to get started in reverse engineering

4 hours Engineers/Students Beginners
Explore the workshop

SIDE CHANNELS

From the workbench.

Small experiments, visual tools, and useful detours.

EXPERIMENT

QString

QString object layout from Qt 5.11.2

EXPERIMENT

QList

QList object layout from Qt 5.11.2