I am a professional reverse engineer and cyber security enthusiast. I take apart obfuscated Android and native code, analyze malware end to end, and turn the findings into reproducible tooling, detection rules, and removal guidance.
Everything published here is independent research: sanitized, evidence-backed, and written for defenders.
| Area | What I work on |
|---|---|
| Android / native RE | DEX internals, JNI, ELF analysis, JNI_OnLoad, RegisterNatives, cross-ABI behavior |
| Malware analysis | RATs, stealers, clipboard hijackers - kill chains, IOCs, YARA, removal runbooks |
| Protection research | Packers, virtualization-based protection, Dex2C-style native transformation |
| Tooling | Analysis pipelines in Python, Ghidra scripting, Frida instrumentation, detection engineering |
| Platforms | Arch Linux daily driver; Windows and Android internals as required |
Evidence-driven toolkit for APKs protected with Dex2C: DEX and native inventory, transformed-method discovery, JNI mapping, native implementation analysis, and deterministic reports with provenance.
Full technical analysis of a commercial Android RAT distributed through a fake "TikTok Pro" Instagram ad campaign - kill chain, infrastructure, IOCs, YARA rules, and a removal runbook.
Static reconstruction of a packed Android VM: recovered string encoding, method-record layout, and the native execution pipeline behind the VMP container.
Field report and detection toolkit for a crypto clipboard hijacker that persists through a WPDShServiceObj COM hijack while masquerading as the Edge WebView2 loader.
Python C C++ Java Kotlin Bash PowerShell
Ghidra IDA radare2 Frida x64dbg Wireshark YARA Burp Suite
Arch Linux Android Windows
- Public artifacts are sanitized: no third-party binaries, no personal data, no redistributed proprietary code.
- Claims are backed by retained evidence and reproducible steps.
- Detection content is written to be deployed, not just read.
- Disclosure and removal guidance are part of the research, not an afterthought.
Independent security research · FG_Teams · Arch Linux