---
title: "Publications"
description: "Conference talks, white papers, and technical publications on program analysis, executable formats, software protection, and mobile security."
canonical_url: "https://www.romainthomas.fr/publication/"
language: "en-US"
section: "publication"
---

# Publications

> Conference talks, white papers, and technical publications on program analysis, executable formats, software protection, and mobile security.

- [The Poor Man's Obfuscator](https://www.romainthomas.fr/publication/22-pst-the-poor-mans-obfuscator/index.md): The purpose of this publication is to present ELF and Mach-O transformations which impact or hinder disassemblers like IDA, BinaryNinja, Ghidra, and Radare2.

- [DroidGuard: A Deep Dive into SafetyNet](https://www.romainthomas.fr/publication/22-sstic-blackhat-droidguard-safetynet/index.md): SafetyNet is the Android component developed by Google to verify the devices' integrity. These checks are used by the developers to prevent running applications on devices that …

- [PGSharp: Analysis of a Cheat Engine on Android](https://www.romainthomas.fr/publication/21-ekoparty-mobile-hacking-space-pgsharp/index.md): PGSharp is a cheating app for PokemonGO that works on non-rooted devices. This talk introduces its functionalities and the protections used to prevent reverse-engineering.

- [QBDL: QuarksLab Dynamic Loader](https://www.romainthomas.fr/publication/21-sstic-qbdl/index.md): The QuarkslaB Dynamic Loader (QBDL) is a modular, portable library for dynamically loading and linking binaries.

- [Dynamic Binary Instrumentation Techniques to Address Native Code Obfuscation](https://www.romainthomas.fr/publication/20-bh-asia-dbi/index.md): Android applications are becoming more and more obfuscated to prevent reverse engineering. While obfuscation can be applied on both, the Dalvik bytecode and the native code, the …

- [Android Runtime Restrictions Bypass](https://www.romainthomas.fr/publication/android-restrictions-bypass/index.md): This paper explains how to disable runtime restrictions without root privileges

- [Static Instrumentation Based on Executable Formats](https://www.romainthomas.fr/publication/static-instrumentation/index.md): Talk given at Recon Montréal and PassTheSalt18 about static instrumentation and its use cases.

- [LIEF: Library to Instrument Executable Formats](https://www.romainthomas.fr/publication/lief/index.md): When analyzing an executable, the first layer of information is the format in which the executable is wrapped. Many tools and libraries can analyze and instrument machine code …

- [How Triton can help to reverse virtual machine based software protections](https://www.romainthomas.fr/publication/triton-vm-protection/index.md): The first part of the talk is going to be an introduction to the Triton framework to expose its components and to explain how they work together. Then, the second part will include …

- [Dynamic Binary Analysis and Obfuscated Codes](https://www.romainthomas.fr/publication/dynamic-binary-analysis-and-obfuscation/index.md): This presentation explains how dynamic binary analysis (DBA) can help reverse engineers understand obfuscated code. We introduce basic obfuscation techniques and demonstrate how …

- [How Triton may help analyze obfuscated binaries](https://www.romainthomas.fr/publication/triton/index.md): Binary obfuscation protects software intellectual property by transforming a binary while preserving its semantics. It preserves the original information among irrelevant data to …