---
title: "Articles"
description: "Long-form technical research into software obfuscation, reverse engineering, program analysis, mobile security, and binary tooling."
canonical_url: "https://www.romainthomas.fr/post/"
language: "en-US"
section: "post"
---

# Articles

> Long-form technical research into software obfuscation, reverse engineering, program analysis, mobile security, and binary tooling.

- [A Glimpse Into DexProtector](https://www.romainthomas.fr/post/26-01-dexprotector/index.md): This blog post provides a high-level overview of DexProtector's security features and their limitations

- [Fuzzing Windows ARM64 closed-source binary ](https://www.romainthomas.fr/post/25-04-windows-arm64-qbdi-fuzzing/index.md): This blog post introduces coverage-guided fuzzing with QBDI and libFuzzer targeting Windows ARM64.

- [Instrumenting an Apple Vision Pro Library with QBDI](https://www.romainthomas.fr/post/24-09-apple-lockdown-dbi-lifting/index.md): This blog post demonstrates how to extract liblockdown.dylib from the visionOS dyld shared cache to be instrumented with QBDI on an Apple M1.

- [iCDump: A Modern Objective-C Class Dump](https://www.romainthomas.fr/post/23-01-icdump/index.md): This blog post introduces iCDump, a new Objective-C class dump based on LLVM.

- [Open-Obfuscator: A free and open-source obfuscator for mobile applications](https://www.romainthomas.fr/post/22-10-open-obfuscator/index.md): This blog post introduces open-obfuscator, a new open-source project to obfuscate mobile applications.

- [Part 2 – iOS Native Code Obfuscation and Syscall Hooking](https://www.romainthomas.fr/post/22-09-ios-obfuscation-syscall-hooking/index.md): This second blog post deals with native code obfuscation and RASP syscall interception

- [Part 1 – SingPass RASP Analysis](https://www.romainthomas.fr/post/22-08-singpass-rasp-analysis/index.md): This first blog post introduces the RASP checks used in SingPass

- [A Journey in iOS App Obfuscation](https://www.romainthomas.fr/post/22-08-ios-obfuscation/index.md): This series of blog posts details how obfuscators can protect iOS applications from reverse engineering

- [PGSharp: Analysis of a Cheating App for PokemonGO](https://www.romainthomas.fr/post/21-11-pgsharp-analysis/index.md): This blog post is about the internal mechanisms of PGSharp, a cheat engine for PokemonGO.

- [Gotta Catch 'Em All: Frida & jailbreak detection](https://www.romainthomas.fr/post/21-07-pokemongo-anti-frida-jailbreak-bypass/index.md): This blog post analyzes the Frida and Jailbreak detection in PokemonGO for iOS.

- [r2-pay: whitebox (part 2)](https://www.romainthomas.fr/post/20-09-r2con-obfuscated-whitebox-part2/index.md): This second blog post explains how to recover the whitebox's key from the obfuscated library libnative-lib.so

- [r2-pay: anti-debug, anti-root & anti-frida (part 1)](https://www.romainthomas.fr/post/20-09-r2con-obfuscated-whitebox-part1/index.md): This first blog post describes the protections in the challenge r2-pay.

- [A Glimpse Into Tencent's Legu Packer](https://www.romainthomas.fr/post/a-glimpse-into-tencents-legu-packer/index.md): Analysis of Tencent Legu: a packer for Android applications.

- [Android Native Library Analysis with QBDI](https://www.romainthomas.fr/post/android-native-library-analysis-with-qbdi/index.md): This blog post deals with QBDI and how it can be used to reverse an Android JNI library

- [Android crackme challenge](https://www.romainthomas.fr/post/android-crackme/index.md): Android crackme that uses system's internals

- [Android VDEX formats](https://www.romainthomas.fr/post/android-vdex/index.md): Internal structures of VDEX format

- [Android OAT formats](https://www.romainthomas.fr/post/android-oat/index.md): Internal structures of OAT format

- [When SideChannelMarvels meets LIEF](https://www.romainthomas.fr/post/18-05-when-sidechannelmarvels-meets-lief/index.md): On how we used LIEF to lift an Android x86_64 library to Linux to perform our usual white-box attacks on it.

- [How to use frida on a non-rooted device](https://www.romainthomas.fr/post/how-to-use-frida-on-a-non-rooted-device/index.md): This post explains how to use Frida gadget on a non-rooted device.

- [Have fun with LIEF and Executable Formats](https://www.romainthomas.fr/post/17-11-have-fun-with-lief-and-executable-formats/index.md): This blog post introduces new features of LIEF as well as some uses cases.

- [Open-sourcing LIEF](https://www.romainthomas.fr/post/lief-release/index.md): We are open-sourcing LIEF, a library to parse and manipulate ELF, PE, and Mach-O binary formats. This blog post explains the purpose of this project and some parts of its …

- [HITB 2015 Write-up - Crypto 400](https://www.romainthomas.fr/post/15-11-hitb2015-crypto400/index.md): Write up

- [HITB 2015 Write-up - Crypto 300](https://www.romainthomas.fr/post/15-11-hitb2015-crypto300/index.md): Write-up for the Crypto 300 challenge

- [Code coverage using a dynamic symbolic execution](https://www.romainthomas.fr/post/15-10-triton-code-coverage/index.md): This blog post introduces code coverage with Triton