In this article, I will share a tip for those interested in performing a more detailed analysis of the behavior of native methods, with a…

Deceptive websites hosted on newly registered domains are being used to deliver AndroidOS SpyNote malware. These sites mimic the Google Chrome install page on the Google Play Store.

This article marks the first in a series aimed at sharing my adventures, personal notes, and insights into the Android kernel. My focus…

Full title: Rethinking Emulation for Fu(zzi)n(g) and Profit: Near-Native Rehosting for Embedded ARM Firmware
Slides: https://github.com/binarly-io/Research_Publications/blob/main/REverse_2025/Near-Native%20Rehosting%20for%20Embedded%20ARM%20Firmware.pdf
…

Every year, cryptocurrencies become more and more common as a payment method. According to the data for 2023, in developed countries about 20% of the population has at some time used such a means of payment, and in developing countries, where the banking…

TL;DR #1: Rooting an Android device allows for system modifications, bypassing restrictions, and performing security testing. This post…

Flutter Mobile Application Reverse Engineering Tool - worawit/blutter

SpyMax Variant Targeting Chinese-Speaking Users: In early 2025, our threat intelligence team analyzed a highly sophisticated Android spyware.

Doctor Web’s experts have discovered Android.Spy.1292.origin, spyware whose main target is Russian military personnel. The attackers hide this trojan inside modified Alpine Quest mapping software and distribute it in various ways, including through one of…

How I tracked myself down using leaked location data in the in-app ads, and what I found along the way.

A new fraud campaign based on the Android malware "SuperCard X" and innovative NFC relay techniques is impacting Italian's banking. Read our latest report to learn more.

Fork of https://github.com/xairy/Facedancer/tree/rawgadget with patches for testing CVE-2024-53197 - zhuowei/facedancer

Introduction Rooting an Android emulator is essential for mobile app security research because it allows researchers to use powerful instrumentation and debugging tools that require root privileges. By obtaining full root (superuser) access on an AVD, you…

Kaspersky expert has discovered a new version of the Triada Trojan, with custom modules for Telegram, WhatsApp, TikTok, and other apps.

Oligo Security reveals AirBorne, a new set of vulnerabilities in Apple’s AirPlay protocol and SDK. Learn how zero-click RCEs, ACL bypasses, and wormable exploits could endanger Apple and IoT devices worldwide — and how to protect yourself.

Gui Rambo writes about his coding and reverse engineering adventures.

💡Update May 3, 2025: I have posted a follow-up, Here's the source code for the unofficial Signal app used by Trump officials.

Update May 4, 2025: Another followup, and a big one: The Signal Clone the Trump Admin Uses Was Hacked

Update May 6, 2025: I've…

MCP Client which serves as bridge between mcp servers and local LLMs running on Ollama, Created for MCP Servers Developed by Me, However other MCP Servers may run as well - zinja-coder/zin-mcp-client

PDF | Abstract—A mobile device is usually the carrier of its owner's sensitive data, but it also contains a lot of system data that reveals the... | Find, read and cite all the research you need on ResearchGate

PDF | Nowadays, information obtained from mobile phones is often the subject of evidence in front of a court. ForensicNowadays, information obtained... | Find, read and cite all the research you need on ResearchGate