Collection of Some Publically Available POC Apps to Detect Root/Magisk presence.

No description.

Generic Script To Bypass Some AntiFrida Checks

Some Of Anti-Frida Stuff

Anti Tamper & Anti Frida Bypass For Our Lovely LolGuard

No description.

A POC to detect zygisk

Easy-to-use Android library for tampering detection, with a sample app included

Generic Frida Script To Bypass Root Detection

Small Apps As PoC to Detect Frida With Frida

No description.

No description.

No description.

Code to extracts stable ARM CPU register values directly from system hardware for fingerprinting device.

Small POC code that detects known root-related apps by attempting to launch their activities and monitoring security exception.

IDA plugin which queries Local language models to speed up reverse-engineering

A dynamic frida script for detecting possible vulnerabilities in Android apps, automating security scanning and reporting.

No description.

Files used in my blog

A zygisk module that dumps so file from process memory

PoC and writeup for bypassing the initial patch of CVE-2024-0044, Android run-as any app vulnerability allowing privilege escalation from adb to installed app

Kernel building tutorials for Any device which is currently unsupported with APatch.

Files for Open-Obfuscator Challenge

Fridare 是一个用于修改和定制 Frida-server 的魔改工具，专为 iOS 越狱设备设计。Fridare is a custom modification tool designed for modifying and customizing Frida-server, specifically for jailbroken iOS devices.

Basics on commands/tools/info on how to assess the security of mobile applications

A repo to store general purpose code/script

Burp proxy flutter apps

aiDAPal is an IDA Pro plugin that uses a locally running LLM that has been fine-tuned for Hex-Rays pseudocode to assist with code analysis.

Injects frida gadget using zygisk to bypass anti-tamper checks.

Spoof a locked bootloader in local attestations

Detect installed app list on iOS using unauthorized iOS private APIs (SBSLaunchApplicationWithIdentifierAndURLAndLaunchOptions)

xVision is a plugin for the JadX decompiler that aims to integrate with Large Language Models (LLMs) to provide code analysis directly in the JAdX.

TikTok Reverse Engineering - Security Algorithms

r2con2025

基于 Unicorn 引擎的轻量级 ARM64 动态追踪模拟工具。支持 IDA Pro、生成 Tenet 日志、本地代码模拟、内存转储、寄存器状态追踪和指令级日志记录。

No description.

Some Frida Tutorial

Exploit and writeup for Magisk Bug #8279, Privileges Escalation / Arbitrary Code Execution Vulnerability

SherlockElf is a powerful tool designed for both static and dynamic analysis of Android ELF binaries.

Miscellaneous utilities and such that I use for pwning. Open sourced since people might find these useful. Be warned: nothing is stable.

JADX-gui scripting plugin for dynamic decompiler manipulation

Dump L3 CDM from any Android device

30 days of Python programming challenge is a step-by-step guide to learn the Python programming language in 30 days. This challenge may take more than100 days, follow your own pace. These videos may help too: https://www.youtube.com/channel/UC7PNRuno1rzYPb1xLa4yktw

No description.

No description.

A POC to disable TamperProtection and other Defender / MDE components

This repository contains a few leaked files of HookBot.

Generate Frida Script

Small tips about R2 which runs everywhere

No description.

🎇 AOT compiler to translate dalvikvm code into cpp code

Inject frida script when process starts

No description.

Rust crate for analyzing and neutering Arxan in FromSoftware games

No description.

Frida-powered hook runner based on JSON hook files.

No description.

No description.

CVE-2025-31200 is a zero-day, zero-click RCE in iOS CoreAudio’s AudioConverterService, triggered by a malicious audio file via iMessage/SMS. Exploitation bypassed Blastdoor, enabled kernel escalation (CVE-2025-31201), and allowed token theft until patched in iOS 18.4.1 (Apr 16, 2025).

Training neural networks on Apple Neural Engine via reverse-engineered private APIs

IOGPUFamily bitmap_mask underflow → kernel heap OOB write. First public PoC. Original discovery by Wang Yu of Cyberserval.

Semi-Jailbreak for 16.5.1-16.7 RC, 17.0

reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities

No description.

Higher iOS IPA Decrypter for JB

这是一个Android Project，具备设备指纹采集，设备安全检测的能力

Prove of concept of detecting meowna module

Source code for Oracle VirtualBox

Customized Frida build for bypassing basic detections and helping ajeossideul (guys) test mobile apps with Frida

Xposed module to bypass Inka AppSealing

Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android

Exploit for 6.4 - 6.5 kernels

A decompiler-agnostic plugin for interacting with AI in your decompiler. GPT-4, Claude, and local models supported!

CWE-781: Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code

A kernel exploit for Pixel7/8 Pro with Android 14

一款支持多人协作的渗透测试图形化框架、支持lua插件扩展、域前置/CDN上线、自定义多个模块、自定义shellcode、文件管理、进程管理、内存加载、反向代理等功能

DxFx is a proof-of-concept DJI Pilot unpacker

No description.

Program for determining types of files for Windows, Linux and MacOS.

KeePass-compatible password manager for iOS

C++ server core implemetation for old SC games using ARC4 encryption algorithm

Analysis and proof-of-concept bypass of Promon SHIELD's Android application protection

Compile frida scripts into injectable libraries or executables that inject themselfs

This repo contains a Frida agent that lets you hook read and write method for flutter biometric storage package

Radare2 and Frida better together.

No description.

Defeat Java packers via Frida instrumentation

Slides & Hands-on for the reverse engineering workshop

this is frida trace assemble and register change tools

Ressources and papers related to my conferences on RASPs

Generate Frida hooks directly from JEB!

PoCs and exploits for CVEs discovered by VEGA.

PoC for CVE-2021-39749, allowing starting arbitrary Activity on Android 12L Beta

Google Chrome CVE-2026-6307 PoC

CVE-2026-43499 PoC

A verified C++ AirPlay 2 realtime-audio SENDER: streams lossless ALAC to a modern Apple TV / HomePod / macOS. The encrypted RAOP/RTSP recipe nobody else published. Proven in FXChainPlayer.

CVE-2026-0047: Missing permission check in ActivityManagerService.dumpBitmapsProto() — steal UI bitmaps from every running app with zero permissions (Android 16 QPR2 Beta)

SPTM (Secure Page Table Monitor) patchfinder for iOS 26-27. Bypasses CTRR lockdown, CPU register locking, and page table protection. 6 patches per device, 16/16 success rate across A13-M1.

TXM (Trust eXecution Monitor) patchfinder for iOS 27 A13+ devices. Bypasses code signing, trustcache, and security policy configuration. 15 patches per device, 100% success rate across A13-M1.

Universal iBoot/iBSS/iBEC patchfinder for A12/A13 devices. Bypasses image4 signature verification, CTRR lockdown, and injects custom boot-args. Works across all A12/A13 iPhones and iPads, iOS 17-27.

watchOS kernel R/W + live process memory dumping on Apple Watch Series 4 (watchOS 10.6.1). Named after the children's book Peepo!

arm64e kernelcache patchfinder for A12/A13 usbliter8 jailbreak research. Finds 20 patch targets automatically in ~6 seconds.

An A12/A13 SecureROM exploit

GreatXML bitlocker bypass vulnerability

This is a proof of concept for CVE-2025-38352, a vulnerability in the Linux kernel's POSIX CPU timers implementation. The September 2025 Android Bulletin mentions that this vulnerability has been used in limited, targeted exploitation in the wild.

AGXCommandBuffer::generateMTLBarriers reachable kernel assertion via out-of-range barrier mask — iOS 26.5 (23F77)

Advanced Android RAT Framework for Authorized Security Testing | Supports Android 5.0-16 | Telegram Integration | Multi-Device Management

Unlocking qualcomm bootloader

Listen to your binaries

The Red Sun vulnerability repository

No description.

Write to any where in /var/mobile/Containers/, running on iOS 16.0 - 26.2 beta 1 (Fixed on iOS 26.2 beta 2)

D810-ng (Next Generation) is an updated, tested, refactored, and optimized IDA Pro plugin used to deobfuscate code at decompilation time by modifying IDA Pro microcode.

Android Wiki of Attacks, Knowledge & Exploits

No description.

Have you ever wondered: what if IDA had great Ctrl+F search support for Pseudocode windows? No longer!

CVE-2025-54957

No description.

PoC for CVE-2024-23700, Android slient privilege escalation allow to read/write contacts, SMS, calendar, call log and voicemail, make outgoing calls or answer incoming calls, manipulate call settings, access & control notifications sent by other apps, control nearby devices, record audio, access device identifiers, and bypass background restriction

Analysis of CVE-2025-43529 (WebKit UAF) + CVE-2025-14174 (ANGLE OOB) exploit chain - iOS Safari

Let you use your device to turn it into a decrypt iPA bot Telegram.

appdecrypt is a tool to make decrypt application encrypted binaries on macOS when SIP-enabled (macOS 11.3 or below)

Android kernel exploit for CVE-2025-38352, previously exploited in-the-wild. Targets vulnerable Linux kernels v5.10.x.

A Glimpse Into DexProtector

No description.

LLVM based, compile-time obfuscator plugin.

Deobfuscate Java code using LLMs ("ChatGPT,Ollama,DeepSeek,etc.")

FairPlay decryptor (dump iPA) for iOS Application that running on macOS with SIP-enabled, using CVE-2025-24204. Support macOS 15.0-15.2

http://www.radare.org/

A method for CVE-2025-31710 and to connect to cmd_skt to obtain a root shell on unisoc unpatched models

Yet another llvm based obfuscator based on goron.

ARM64 Assembly Code and Memory Simulator

Package Manager for Radare2

Source of VMProtect (NOT OFFICIALLY)

LSPosed module to prevent Santander UK app from detecting Zygisk implementations

Research on the internal workings of Google's Play Integrity Protect Virtual Machine (VM) with tools for both disassembling and decompiling the bytecode.

Dopamine is a semi-untethered jailbreak for iOS 15 and 16

No description.

Fix Play Integrity (and SafetyNet) verdicts.

A demo app to detect Zygisk injections

An iOS app that lets you practice your Frida skills

FLARE Team's Binary Navigator

ACVTool (Android Code Coverage Tool) is a tool to measure fine-grained code coverage of 3rd-party Android apps.

Python implementation of Google's Widevine DRM CDM (Content Decryption Module)

OSWE, OSEP, OSED, OSEE

No description.

Radare2 official book

Dalvik bytecode disassembler and graph view

No description.

CVE-2024-32002 RCE PoC

POC for CVE-2024-27804

A symbolic execution engine for EVM smart contract binaries

Python learn

Apple Silicon devices emulated on QEMU, currently only iPhone 11. With SEP and SpringBoard, eventually

Property extractor for Android apps

the last repo of skiffs apps

Work in progress...

Password manager app for Android

Using Zygisk to dump il2cpp data at runtime

Malware dynamic instrumentation tool based on frida framework

Improved CenturionInfoSec/konyutils for decrypting/dumping Kony app JavaScript bundles

This is a simple chatting program for multiple users.

Some basic sorting algos

PDBRipper is a utility for extract an information from PDB-files.

No description.

The ISRA security-risk-assessment-tool project is an Electron based application used to do security risk assessments at a technical level

Collection of materials relating to FORCEDENTRY, will eventually delete this repo and migrate the materials to my main exploit repo once finished

No description.

dex-vm used to protect the android classes.dex file

:electron: O-MVLL is a LLVM-based obfuscator for native code (Android & iOS)

Source code for Twitter's Recommendation Algorithm

My malware analysis code snippets

新一代SKRoot，挑战全网root检测手段，跟面具完全不同思路，摆脱面具被检测的弱点，完美隐藏root功能，全程不需要暂停SELinux，实现真正的SELinux 0%触碰，通用性强，通杀所有内核，不需要内核源码，直接patch内核，兼容安卓APP直接JNI调用，稳定、流畅、不闪退。

A simple program for Windows for working with hexadecimal numbers

radius2 is a fast binary emulation and symbolic execution framework using radare2

NodeJS module and commandline utility for re-signing iOS applications (IPA files).

📱 objection - runtime mobile exploration

APK/DEX detector for Windows, Linux and MacOS.

搜索macho中的汇编指令

No description.

基于eBPF的syscall追踪工具，适用于安卓平台

The home for Interruptor, a human-friendly interrupts hook library based on Frida's Stalker

Put this script in a folder with lots of .EXE files and it will sort them into categories: NET (VB NET/C#/IL) / Native.

No description.

PE file viewer/editor for Windows, Linux and MacOS.

The Nopgisk build system

Hardware Assisted Unpacking of Android Apps

App for learnfrida.info

Binary & scripts associated with "The Poor Man's Obfuscator" presentation

Bindings of the r2 api for Valabind and friends

I'd ask you to fork, but identity theft is not a joke Jim. Leave a star if you like it.

No description.

Frida CLI tools

No description.

Bot only works for this group 😄

IDA Python Script for anti ollvm

Android terminal and Linux environment - packages repository.

No description.