https://overkazaf.github.io/blogs/categories/reverse-engineering/Recent content in 逆向工程与二进制安全 on +5 Security ResearchHugozh-cnWed, 26 Aug 2026 15:36:00 +0800https://overkazaf.github.io/blogs/posts/android-apk-hardening-packer-vmp-rasp-mainstream/Tue, 25 Aug 2026 14:50:00 +0800https://overkazaf.github.io/blogs/posts/android-apk-hardening-packer-vmp-rasp-mainstream/从构建期混淆、DEX/SO 加壳、函数抽取、VMP、RASP，到 APK 签名、Play Integrity、设备注册和服务端风控，系统比较国内外主流 Android APK 加固方案、工程流程、真实安全边界与选型方法。https://overkazaf.github.io/blogs/posts/device-fingerprinting-web-android-mainstream-platforms/Tue, 25 Aug 2026 10:30:00 +0800https://overkazaf.github.io/blogs/posts/device-fingerprinting-web-android-mainstream-platforms/沿着信号采集、设备注册、可信验证、画像归并、业务图谱、风险处置和对抗反馈这一条主线，比较海内外主流 Web / Android 设备风控方案、抖音系注册流程、Play Integrity 架构及其可被规避的边界。https://overkazaf.github.io/blogs/posts/android-svc-syscall-protection/Sat, 08 Aug 2026 11:45:00 +0800https://overkazaf.github.io/blogs/posts/android-svc-syscall-protection/深入分析Android应用中基于SVC指令的内联系统调用保护技术，覆盖反调试、反Hook、完整性校验、进程检测与seccomp-BPF五大对抗场景，并给出Frida Stalker、seccomp拦截、内核模块等六种绕过方案的实战对比https://overkazaf.github.io/blogs/posts/pinduoduo-libpdd-secure-antitoken-evidence-boundaries/Thu, 23 Jul 2026 09:20:00 +0800https://overkazaf.github.io/blogs/posts/pinduoduo-libpdd-secure-antitoken-evidence-boundaries/复核 libpdd_secure.so 7.80/7.85 与 anti-token 历史公开材料，讨论环境记录、缓存和封装能证明什么，以及客户端逆向在设备画像和交易风控前为何停下。https://overkazaf.github.io/blogs/posts/android-native-vmp-analysis/Fri, 10 Jul 2026 14:30:00 +0800https://overkazaf.github.io/blogs/posts/android-native-vmp-analysis/从实战视角拆解 Android Native 层 VMP 保护的三代演进、dispatcher 识别、handler 枚举与语义恢复，讨论 VMP 的真实安全边界与工程误区。https://overkazaf.github.io/blogs/posts/meituan-mtgsig-dfp-risk-control-boundaries/Thu, 18 Jun 2026 21:40:00 +0800https://overkazaf.github.io/blogs/posts/meituan-mtgsig-dfp-risk-control-boundaries/把 2024 年历史 mtgsig 样本、美团公开的 Web 验证与 Zeus 文章、2026 年隐私政策重新排开，讨论请求签名、设备画像和业务风控各自能回答什么。https://overkazaf.github.io/blogs/posts/ollvm-deobfuscation-engineering/Fri, 05 Jun 2026 16:20:00 +0800https://overkazaf.github.io/blogs/posts/ollvm-deobfuscation-engineering/从 IDA 里 400 个基本块的平坦化函数出发，完整拆解 OLLVM 三大混淆 pass 的工程原理与去混淆实战，覆盖 CFF/BCF/指令替换/字符串加密的识别、攻击与工具链对比https://overkazaf.github.io/blogs/posts/xiaohongshu-shield-device-risk-evidence-boundaries/Tue, 26 May 2026 18:10:00 +0800https://overkazaf.github.io/blogs/posts/xiaohongshu-shield-device-risk-evidence-boundaries/回到 2020 年 libshield.so 原始分析与 2023 年历史隐私政策，复核小红书 Shield 请求签名真正覆盖的范围，以及公开材料留空的设备画像和内容风控部分。https://overkazaf.github.io/blogs/posts/arm-trustzone-el0-to-el3-attack-chain-anatomy/Sat, 09 May 2026 00:00:00 +0000https://overkazaf.github.io/blogs/posts/arm-trustzone-el0-to-el3-attack-chain-anatomy/以 Quarkslab/Project Zero/360 Alpha Lab 的四条真实攻击链为案例，从 ARM 异常等级架构出发，逐层解剖 EL0→S-EL0→S-EL1→EL3 的提权技术：共享内存机制、SMC 调用约定、Trustlet 漏洞模式、TEE 内核提权、Secure Monitor 劫持，以及 Boot Chain 替代路径https://overkazaf.github.io/blogs/posts/taobao-securityguard-mtop-four-signatures-boundaries/Fri, 17 Apr 2026 20:35:00 +0800https://overkazaf.github.io/blogs/posts/taobao-securityguard-mtop-four-signatures-boundaries/从一份历史调用链和淘宝官方隐私政策出发，重新判断 x-sign、x-umt、x-mini-wua、x-sgext 所在的协议层，以及客户端逆向看不到的交易风控部分。https://overkazaf.github.io/blogs/posts/douyin-sixgod-metasec-unidbg-reverse-engineering/Sun, 29 Mar 2026 00:00:00 +0000https://overkazaf.github.io/blogs/posts/douyin-sixgod-metasec-unidbg-reverse-engineering/通过 unidbg 仿真抖音 libmetasec_ml.so，突破 OLLVM+VM+JIT 三层防护，完整提取六神签名（X-Gorgon/X-Khronos/X-Argus/X-Ladon/X-Helios/X-Medusa）的逆向工程记录