Romain Thomas Security engineer

CLOSED SOURCE · PRIVATE FOUNDATION

BinLift

A user-friendly binary lifter built on QBDL, with DWARF-aware types and native or instrumented function calls.

Closed source Agentic workflow
DexProtector research

BinLift combines QBDL’s portable binary loading with DynaMIR instrumentation, DWARF-backed types, and modern C++ and Python APIs. It provides a high-level way to resolve functions and variables, translate addresses, access memory, and call native or instrumented code without rebuilding the surrounding runtime by hand.

This tool was used to break DexProtector; the resulting analysis is documented in A Glimpse Into DexProtector.