Romain Thomas

the-poor-mans-obfuscator. Binary & scripts associated with "The Poor Man's Obfuscator" presentation

reverse-engineering-workshop. Slides & Hands-on for the reverse engineering workshop

iCDump. A modern Objective-C class dump based on LIEF and LLVM.

droidguard-samples. DroidGuard VM Samples

pgsharp. Script & materials associated with the PGSharp reverse engineering

r2pay. Files used to resolve the r2pay challenge

tencent_packer. Utility to read custom structure from Tencent's libshell packer

visionOS-liblockdown. Code lifting for executing a visionOS library os macOS using QBDL and QBDI

dumplog. Android log utility

windows-arm64-qbdi-fuzzing. C++

android-restriction-bypass. PoC to bypass Android restrictions

legu_unpacker_2019. Scripts to unpack APK protected by Legu

romainthomas.github.io. https://www.romainthomas.fr

LeguDecompile. 乐固so静态脱壳；模仿乐固so加壳

LIEF. LIEF - Library to Instrument Executable Formats

ghidra. Ghidra is a software reverse engineering (SRE) framework

jni.hpp. A modern, type-safe, header-only, C++14 wrapper for JNI

spdlog. Fast C++ logging library.

llvm-passes. Collection of various llvm passes

whitebox. C++

shell-factory. C++-based shellcode builder

diaphora. Diaphora, a Free and Open Source program diffing tool

QBDI. A Dynamic Binary Instrumentation framework based on LLVM.

demumble. A better c++filt and a better undname.exe, in one binary.

functionsimsearch. Some C++ example code to demonstrate how to perform code similarity searches using SimHashing.

romainthomas.

Deadpool. Repository of various public white-box cryptographic implementations and their practical attacks.

autocxx. Tool for safe ergonomic Rust/C++ interop driven from existing C++ headers

apk-signature-scheme-v2. APK Signature Scheme V2

binmap. system scanner

android-system-core. Mirror of https://android.googlesource.com/platform/system/core

workflow_objc. Binary Ninja plugin & workflow to help analyze Objective-C code

android-checkin. Pretends to be a phone to get a legit android_id

jadx. Dex to Java decompiler

kotlin-metadata-printer. Prints the Kotlin metadata attached to Java class files

proguard. ProGuard, Java optimizer and obfuscator

awesome-copycats. Awesome WM themes

PHP-CPP. Library to build PHP extensions with C++

micropython. MicroPython - a lean and efficient Python implementation for microcontrollers and constrained systems

mbedTLS. C

musl. C

irma-probe. IRMA probe

pybind11. Seamless operability between C++11 and Python

Triton. Concolic execution framework based on Pin. It provides components like a taint engine, a dynamic symbolic execution engine, a snapshot engine, translation of x64 instructions into SMT2-LIB, a Z3 interface to solve constraints and Python bindings. Based on these components, you can build tools for automated reverse engineering.