PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Fork Bomb for Flutter

swarm.ptsecurity.com | research | #reverse-engineering | #frida | #flutter | #reflutter | #dartvm
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

PT SWARM presents reFlutter, a toolchain for reverse-engineering Flutter apps: a custom Docker-built Engine with DartVM patches plus Burp/Frida interception, demonstrated against a real application.
Published
Collected

Related coverage

research · blog.quarkslab.com
Bypassing Android Hardware Attestation from the Analyst's Chair
Hardware key attestation lets an Android app prove to its backend that a key lives in secure hardware on a locked, verified device. It is also the wall that stops a security analyst working on a rooted phone. This article opens the mechanism from the analyst's chair, from the certificate chain and the attestation extension down to the root of trust, then shows a simple bypass that never touches the secure hardware. We relay the attestation to a clean device and splice a genuine chain back into the target app with a Frida hook. A companion repository ships the validation backend, the demo apps and the instrumentation, so the whole setup can be run and inspected rather than taken on faith.
research · blog.quarkslab.com
Intego X9: Why your macOS antivirus should not trust PIDs
Part two of Quarkslab's Intego series: combining Ghidra static analysis with Frida tracing to show how a PID reuse race can bypass XPC authentication checks on privileged macOS services.
research · blog.quarkslab.com
Android greybox fuzzing with AFL++ Frida mode
How to greybox-fuzz native Android userland targets directly on a device with AFL++'s Frida mode, including strategies for fuzzing JNI functions that interact with Java bytecode.
research · blog.quarkslab.com
Why are Frida and QBDI a Great Blend on Android?
The post shows how combining Frida and QBDI gives instruction-level visibility into obfuscated native Android functions, based on a Pass The Salt 2020 talk about tracing JNI code.
research · blog.quarkslab.com
Slaying Dragons with QBDI
Solving the CSAW CTF 2015 'Wyvern 500' crackme with QBDI and its Frida bindings: tracing basic blocks to locate the password check and inject valid inputs without a full reverse engineering effort.
research · github.com
php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations
Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
Back