Understanding systems by observing them: traffic captures, protocols, and a method that survives undocumented APIs.
7 posts
A hands-on Frida tutorial for mobile app testing: what dynamic instrumentation is, running frida-tools, attaching vs spawning, hooking with Interceptor.attach, Java.perform on Android, reading and writing memory, replacing return values, and how real apps push back.
A guided firmware analysis walkthrough for devices you own: where to get a vendor or OTA image, how binwalk recognises squashfs, cramfs, jffs2 and uImage, how to extract firmware with binwalk -e and unsquashfs, and how to hunt hardcoded credentials, private keys and API tokens with strings and grep.
A hands-on method to reverse engineer a serial protocol from a logic analyzer capture: wire up UART and SPI I2C, find the baud rate, read the hex bytes, test hypotheses with checksums, and write a small Python decoder.
A hands-on method for reverse engineering BLE devices: enumerate BLE GATT services and characteristics with bluetoothctl, nRF Connect, and Python's bleak, capture the link with an HCI snoop log, read it in Wireshark, and reconstruct the app's protocol.
A repeatable methodology for HTTP API reverse engineering: observe before you act, map the auth flow, capture traffic with devtools and mitmproxy, replay with curl, detect request signing, and write it up as a state machine.
A packet-level walkthrough of how captive portals actually work: DHCP and DNS interception, the RFC 8910 captive portal API, the Wi-Fi login redirect, CNA detection on Android and iOS, walled gardens, MAB and RADIUS, and how to automate a headless login.
How I reverse-engineered a Ruijie ePortal captive portal and its CAS single sign-on flow to build a headless Python auto-login daemon that reconnects a campus uplink in about 16 seconds.