Security research notes: web, binary, mobile and CTFhttps://omiilgo.com/en/enhttps://omiilgo.com/en/posts/android-arm64-initializers-relocations-jni-timing/https://omiilgo.com/en/posts/android-arm64-initializers-relocations-jni-timing/Trace zero initializer slots through ELF relocations and loader metadata. A minimal NDK fixture separates file edits from constructor timing, ART class loading, JNI registration and instrumentation readiness.Tue, 14 Oct 2025 04:00:00 GMTandroidreverse-engineeringhttps://omiilgo.com/en/posts/android-conscrypt-roots-mount-namespaces/https://omiilgo.com/en/posts/android-conscrypt-roots-mount-namespaces/Trace Android certificate trust across Conscrypt and framework selectors, active APEX modules, process mount namespaces, submounts and disabled roots, using fixed source revisions and Pixel 3a records.Thu, 05 Jun 2025 04:00:00 GMTandroidreverse-engineeringhttps://omiilgo.com/en/posts/ccleaner-helper-socket-task-authorization/https://omiilgo.com/en/posts/ccleaner-helper-socket-task-authorization/Trace CCleaner 1.18.30 from its Unix socket and eleven-byte framing markers to NSTask. Separate installation approval, argument splitting, and privileged execution from the limits of the historical evidence.Tue, 25 Mar 2025 04:00:00 GMTmacosreverse-engineeringhttps://omiilgo.com/en/posts/cve-2025-24200-usb-lock-state-authorization/https://omiilgo.com/en/posts/cve-2025-24200-usb-lock-state-authorization/Separate accessibility prompts from backend policy writes. Use build differences, Boolean conditions, and address models to distinguish patch evidence, debugging observations, and the hardware hypothesis.Fri, 14 Feb 2025 04:00:00 GMTiosreverse-engineeringhttps://omiilgo.com/en/posts/cve-2024-2961-iconv-php-bucket-lifetimes/https://omiilgo.com/en/posts/cve-2024-2961-iconv-php-bucket-lifetimes/Trace a fixed-byte encoding overflow through PHP stream filters. Separate valid length, allocation requests, and ownership, then examine Zend free lists and error cleanup.Thu, 13 Jun 2024 04:00:00 GMTmemory-safetyreverse-engineeringhttps://omiilgo.com/en/posts/android-dex-dgc-runtime-bytecode-restoration/https://omiilgo.com/en/posts/android-dex-dgc-runtime-bytecode-restoration/Trace eight hidden DEX files into an external method pool. Separate RC4 key derivations, DGC indexes, and instruction boundaries, then examine ART's conditional repair point.Tue, 06 Feb 2024 04:00:00 GMTandroidartreverse-engineeringhttps://omiilgo.com/en/posts/hyperv-ium-guest-context-debugging/https://omiilgo.com/en/posts/hyperv-ium-guest-context-debugging/Trace VP, VTL, and VMCS state at a VTL return. Separate raw offsets from architectural field encodings, then correlate two address translations, a stack return value, and call bytes.Thu, 07 Sep 2023 04:00:00 GMTreverse-engineeringwindowshttps://omiilgo.com/en/posts/windows-token-creation-effective-impersonation/https://omiilgo.com/en/posts/windows-token-creation-effective-impersonation/Separate token creation, effective thread impersonation, and file access. Examine error 1346, logon-session comparisons, and the StorSvc loading path, with validated SID and buffer-size checks.Thu, 17 Aug 2023 04:00:00 GMTreverse-engineeringwindowshttps://omiilgo.com/en/posts/xnu-arm64-pac-context-state-authentication/https://omiilgo.com/en/posts/xnu-arm64-pac-context-state-authentication/Trace PAC state across boot, shared regions, scheduling, and exceptions. Separate hardware keys from software values and discriminators, and verify jophash inputs, carry masking, and accepted helper keys.Mon, 06 Dec 2021 04:00:00 GMTiosmemory-safetyreverse-engineeringhttps://omiilgo.com/en/posts/arm64-kpti-roots-ranges-exception-entry/https://omiilgo.com/en/posts/arm64-kpti-roots-ranges-exception-entry/Compare Linux trampolines with XNU's TCR switch. Track VBAR, TTBR, ASID, and X30 ordering, explain the T1SZ direction, and examine how fixed vectors survive both translation views.Mon, 29 Nov 2021 04:00:00 GMTiosmemory-safetyreverse-engineeringhttps://omiilgo.com/en/posts/dns-beacon-fragment-reassembly-authentication/https://omiilgo.com/en/posts/dns-beacon-fragment-reassembly-authentication/Reconstruct TXT downloads and query-name uploads from DNS Beacon records. Separate controls from data, detect duplicate or missing fragments, and authenticate three ciphertext envelopes before interpreting them.Mon, 29 Nov 2021 04:00:00 GMTmalware-analysisreverse-engineeringhttps://omiilgo.com/en/posts/ios-ktrr-ctrr-ranges-lockdown-order/https://omiilgo.com/en/posts/ios-ktrr-ctrr-ranges-lockdown-order/Follow boot-map reduction through CTRR lockdown. Check physical endpoints, KTRR versus CTRR ranges, generation-specific TLB sequencing, debug controls, and conditional CPU reset entry.Mon, 29 Nov 2021 04:00:00 GMTiosmemory-safetyreverse-engineeringhttps://omiilgo.com/en/posts/ios-ppl-entry-state-page-ownership/https://omiilgo.com/en/posts/ios-ppl-entry-state-page-ownership/Trace boot setup, service dispatch, and page handoff in an ARM64 kernel. Separate per-CPU state, ownership, and permission encodings, and check stack strides, atomic updates, and exception recovery.Fri, 26 Nov 2021 04:00:00 GMTiosmemory-safetyreverse-engineeringhttps://omiilgo.com/en/posts/dcsync-dcshadow-rpc-context-detection/https://omiilgo.com/en/posts/dcsync-dcshadow-rpc-context-detection/Correlate interface negotiation, context IDs, and opnums in directory replication. Examine flowbit blind spots, DCShadow's reverse pull, byte order, protocol-aware rules, and deployment regression cases.Mon, 15 Nov 2021 04:00:00 GMTreverse-engineeringwindowshttps://omiilgo.com/en/posts/x86-shellcode-ror13-resolver-assumptions/https://omiilgo.com/en/posts/x86-shellcode-ror13-resolver-assumptions/Recover nine API constants through call/pop, PEB list offsets, and PE exports. Check signed byte normalization, capacity-dependent hashes, collisions, standard-handle relationships, and exit conditions.Thu, 02 Sep 2021 04:00:00 GMTmalware-analysisreverse-engineeringwindowshttps://omiilgo.com/en/posts/wdnisdrv-flow-context-device-boundaries/https://omiilgo.com/en/posts/wdnisdrv-flow-context-device-boundaries/Trace WFP filters, flow contexts, and asynchronous notifications in WdNisDrv. Separate documented injection behavior, service-SID access, and three buffer defects from claims about default reachability.Tue, 13 Jul 2021 04:00:00 GMTmemory-safetyreverse-engineeringwindowshttps://omiilgo.com/en/posts/cve-2021-24086-nested-ipv6-reassembly/https://omiilgo.com/en/posts/cve-2021-24086-nested-ipv6-reassembly/Trace nested IPv6 fragments from patch checks to a 65,528-byte header request. Follow the unchecked NDIS result separately from a later call, and connect memory layout, protocol limits, and the denial-of-service crash.Wed, 07 Apr 2021 04:00:00 GMTmemory-safetyreverse-engineeringwindowshttps://omiilgo.com/en/posts/android-emulator-kernel-structure-location/https://omiilgo.com/en/posts/android-emulator-kernel-structure-location/Follow task discovery, SELinux state differences, and cold-boot relocation in an Android 11 x86_64 AVD. Separate configuration-dependent layouts, structural evidence, arithmetic models, and runtime validation.Thu, 04 Mar 2021 04:00:00 GMTandroidreverse-engineeringhttps://omiilgo.com/en/posts/msvc-xfg-type-hash-encoding/https://omiilgo.com/en/posts/msvc-xfg-type-hash-encoding/Reconstruct the x64 C type-hash pipeline in an MSVC 19.28 preview build. Validate two prototypes and separate normalization, recursive digests, back-end masks, entry markers, and unsupported type cases.Thu, 12 Nov 2020 04:00:00 GMTmemory-safetyreverse-engineeringwindowshttps://omiilgo.com/en/posts/cve-2020-16898-rdnss-parser-boundaries/https://omiilgo.com/en/posts/cve-2020-16898-rdnss-parser-boundaries/Trace RDNSS length parity through two parser passes and the NdisGetDataBuffer copy path. Verify the eight-byte mismatch with a model, then separate fragment handling, stack corruption, and code-execution claims.Fri, 16 Oct 2020 04:00:00 GMTmemory-safetyreverse-engineeringwindowshttps://omiilgo.com/en/posts/flutter-ios-routing-tls-analysis/https://omiilgo.com/en/posts/flutter-ios-routing-tls-analysis/Separate VPN routing, transparent proxying, Mach-O address translation, and TLS decisions in a 2020 ARM64 Flutter sample. Check constant-search candidates, a 32-byte prefix, and correlated proxy and device results.Fri, 12 Jun 2020 04:00:00 GMTflutteriosreverse-engineeringhttps://omiilgo.com/en/posts/vba-signature-source-cache-divergence/https://omiilgo.com/en/posts/vba-signature-source-cache-divergence/A Word document's source says Hello while its P-Code contains calc and Shell. Separate signature coverage, cache selection, and macro policy, then design a one-byte control experiment and check V3 signature deployment.Thu, 04 Jun 2020 04:00:00 GMTmalware-analysisofficevbahttps://omiilgo.com/en/posts/evidence-of-vba-purging-found-in-malicious-documents/https://omiilgo.com/en/posts/evidence-of-vba-purging-found-in-malicious-documents/A malicious PowerPoint add-in keeps only compressed VBA source, with a zero-length cache. Walk its VBA storage with zipdump.py and oledump.py, see why rules keyed on cached strings miss VBA purging, and cross-check structure against behavior.Sat, 15 Feb 2020 20:00:00 GMTmaldocmalware-analysisofficevbahttps://omiilgo.com/en/posts/checkm8-dfu-object-lifetime/https://omiilgo.com/en/posts/checkm8-dfu-object-lifetime/Follow the DFU buffer, USB transfer state, and reset cleanup in t8015 SecureROM. Use a lifetime model and request layout to separate dangling references, memory reuse, and callback control despite valid transfer lengths.Tue, 29 Oct 2019 04:00:00 GMTiosmemory-safetyreverse-engineeringhttps://omiilgo.com/en/posts/excel-embedded-png-dll-analysis/https://omiilgo.com/en/posts/excel-embedded-png-dll-analysis/Trace an Excel document from OLE streams to two adjacent PE payloads. Check extraction boundaries and overlay hashes, then separate VBA architecture-selection declarations from evidence of actual execution.Wed, 18 Sep 2019 04:00:00 GMTmaldocmalware-analysisofficevbahttps://omiilgo.com/en/posts/flutter-armv7-proxy-tls-analysis/https://omiilgo.com/en/posts/flutter-armv7-proxy-tls-analysis/Separate proxy routing from TLS trust in a 2019 Android ARMv7 Flutter build. Trace handshake errors and string references to a Thumb entry point, then check return values, side effects, and plugin-layer boundaries.Tue, 13 Aug 2019 04:00:00 GMTandroidflutterreverse-engineeringhttps://omiilgo.com/en/posts/obfuscated-okhttp-certificate-pinning/https://omiilgo.com/en/posts/obfuscated-okhttp-certificate-pinning/Compare three request paths in normal and obfuscated Android 7.1.2 builds. Separate platform policy from OkHttp pinning, then identify the obfuscated method through Smali descriptors, arguments, and Builder timing.Tue, 02 Apr 2019 04:00:00 GMTandroidokhttpreverse-engineeringhttps://omiilgo.com/en/posts/android-runtime-restrictions-bypass/https://omiilgo.com/en/posts/android-runtime-restrictions-bypass/Trace native-library and Hidden API restrictions through soinfo and Runtime in Android 7–9, distinguish inline field access from symbol imports, and define a controlled validation procedure.Wed, 27 Mar 2019 04:00:00 GMTandroidartreverse-engineering