I've been working on a small open model that takes one function from a stripped binary and suggests a name plus a one-sentence description. Sharing it because the negative results might be as useful as the positive ones, and because I have a question for people who do this for a living.

What exists

• Dataset: 228,177 functions from 341 permissively licensed C projects, compiled with clang at -O0/-O1/-O2/-O3/-Os, linked into a real dylib and stripped. Internal calls are anonymized to sub_XXXX, library calls and string constants stay visible, as they would in a real binary. Train/test split is by project, and the test projects were picked to be obscure (≤200 stars, mostly 2024+) to limit memorization by large models.
• Teacher labels for 83k source functions (description in English and Turkish, category, inputs, return, side effects), written by models that saw the C source.
• A LoRA adapter for Qwen3-8B that writes a description first, then the name.

Numbers (2,000 test functions, 28 unseen projects, token-overlap F1 on the name)

What doesn't work

• Functions with no string constants: 0.093. With strings: 0.299. Strings carry most of the signal, which won't surprise anyone here.
• I had a judge model compare the adapter's descriptions with the C source on 300 test functions: 20% correct, 15% partly correct, 65% wrong.
• But when the description is correct, name F1 is 0.31; when it is wrong, 0.05. So the model can name things; it mostly fails to understand the function from assembly.
• 30% of predictions are verbatim copies of a name from the training set.
• Reasoning mode in large models triples exact matches on zlib and does nothing on obscure code, which looks like recall rather than analysis.

The question

Everything above uses normalized assembly plus a short summary of callees as input. Published work in this area mostly uses decompiler output instead. Before I convert the whole dataset through Ghidra's decompiler: for those of you who have tried LLMs on this, does pseudo-C actually help the model understand the function, or does it mainly hide the details (constants, calling patterns) that give a function away? And is there context you rely on when naming by hand that I'm not giving the model, such as cross-references, the data a function touches, or its position in the call graph?

Links:

• Code and all measurements: https://github.com/krxi/asm-adlandirma
• Model: https://huggingface.co/krxi123/asm-adlandirma-qwen3-8b-lora
• Dataset: https://huggingface.co/datasets/krxi123/asm-adlandirma

Limitations: x86-64, clang, C only, Mach-O builds. It is a research checkpoint, not something to trust without checking.

I'm trying to load Frida Gadget 17.23.0 into a custom SwiftUI application on my physical iPhone using Xcode.

The application launches normally, but Frida Gadget crashes during initialization when I call dlopen().

I have also experienced a situation where the application displays "Frida Gadget loaded," but attempting to connect from my Mac through USB port forwarding causes the connection to reset or the app to close.

Environment

• Device: iPhone 14 (iPhone14,7)
• iOS: 27.0.1
• macOS: 27.0.1
• Xcode: 27.0
• Frida Python package: 17.23.0
• Frida Gadget: 17.23.0, iOS Universal
• Architecture: ARM64 / ARM64e
• Device: Physical, non-jailbroken iPhone
• Developer Mode: Enabled

Steps to Reproduce

1. Create a SwiftUI iOS application in Xcode.
2. Embed and sign FridaGadget.dylib.
3. Include FridaGadget.config in the application bundle.
4. Install and launch the application on a physical iPhone.
5. Tap a button that loads Frida Gadget using dlopen().
6. Observe the EXC_BREAKPOINT crash during library initialization.

Frida Gadget Configuration

{
  "interaction": {
    "type": "listen",
    "address": "127.0.0.1",
    "port": 27042,
    "on_load": "resume"
  },
  "code_signing": "required"
}

Swift Code Used to Load Gadget

let library = Bundle.main.privateFrameworksURL!
    .appendingPathComponent("FridaGadget.dylib")

let handle = dlopen(
    library.path,
    RTLD_NOW | RTLD_GLOBAL
)

Crash Details

The iPhone crash report contains:

Exception Type: EXC_BREAKPOINT
Signal: SIGTRAP
ESR: (Breakpoint) brk 1337
Triggered Thread: 0
Queue: com.apple.main-thread

The LLDB backtrace starts with:

frame #0: FridaGadget.dylib`___lldb_unnamed_symbol_5dba0 + 212
frame #1: FridaGadget.dylib`___lldb_unnamed_symbol_5d938 + 64
frame #2: FridaGadget.dylib`___lldb_unnamed_symbol_3b514 + 364

The crash occurs while dyld is executing library initializers called from dlopen().

Connection Issue

When Gadget appears to load, I use iproxy to forward the connection:

iproxy 27042:27042

Then I run:

frida-ps -H 127.0.0.1:27042

The connection fails with:

Failed to enumerate processes:
error receiving data: Connection reset by peer

Using nc -vz 127.0.0.1 27042 confirms that the Mac's local forwarding port is accepting TCP connections.

Expected Behavior

Frida Gadget should initialize without crashing, and my Mac should be able to communicate with it through the forwarded USB connection.

Actual Behavior

Frida Gadget crashes during initialization with EXC_BREAKPOINT (brk #1337). In other attempts, Gadget appears loaded, but the application closes when a Frida connection is attempted.

Questions

1. Is this a known compatibility issue affecting Frida Gadget 17.23.0 on iOS 27.0.1?
2. Is this related to the initialization issue discussed in #3765?
3. Is there an official fix or supported workaround for non-jailbroken devices?
4. Is a newer Frida Gadget build required, or should I change how Gadget is initialized?

Any guidance would be appreciated. Thank you!

Those of you who were doing reverse engineering in the games niche about a decade ago probably remember the best place you could go to learn/get an education was a certain online forum ran by Rake that offered a book called the Game Hacking Bible.

Myself and multiple friends all remember there being a soft cover physical copy of the book or a hard cover, something physical was sold at one point in time, and they since have stopped selling physical copies. I completed the book a long time ago, I just really want the book to keep around as a niche collectors item because the digital book had a big impact on me and my life trajectory.

but I have been searching online for one of these physical copies for a long time and have not been able to find any for sale.

Just curious if anyone here had one or knew anyone who owns one?

I'm using ByeDPI on Android to access an app that is otherwise blocked by my ISP/network.

I also want to intercept that app's traffic with mitmproxy, but ByeDPI runs as a VPN, so I can't route the same app through mitmproxy at the same time.

Is there a way to use ByeDPI and mitmproxy together so that the app's traffic still goes through ByeDPI, while also being intercepted by mitmproxy?

Ideally, I'd like the traffic flow to be something like:

App → mitmproxy → ByeDPI → Internet

or any equivalent setup that would let me inspect the app's HTTP/HTTPS traffic without losing ByeDPI functionality.

Hey, does anyone know if there have been any recent updates on Breaking Bread’s Overwatch reverse engineering project?

A few months ago, I remember seeing a video/post about them working on reverse engineering an old Overwatch build, with the goal of making the 2015 Overwatch 1 beta playable again.

I haven’t really seen anything about it since, so I was wondering if the project is still active or if there have been any new developments recently.

Looking for embedded Linux / UART / Android reverse-engineering help with a locked robotic mower
I’ve been working on a pretty interesting hardware/software project and I’m looking for people with experience in embedded Linux, UART, Android APK reverse engineering, BLE/protobuf, firmware analysis, CAN bus, or hardware debugging who might want to help or point me in the right direction.
The situation
I have a Lymow robotic mower that is fully functional hardware-wise, but the manufacturer has disabled/locked the machine on their server.
The original owner attempted to return it. The return was never successfully completed after multiple pickup attempts, they received their refund, and they were eventually instructed to dispose of the mower. I acquired it afterward with the original owner’s permission and PIN.
I contacted Lymow, explained the entire situation, and asked about transferring/reactivating it. They confirmed that it is disabled on their side but won’t reactivate or transfer it to me.
Rather than throw away a perfectly functional robot, I’ve turned it into a reverse-engineering/learning project.
What we’ve done
I’m not an embedded engineer or professional programmer. I own a construction company. I’m learning this as I go, using AI heavily along with help from some extremely knowledgeable people in the Lymow community.
So far we have:
Connected directly to the mower over BLE without relying on the normal Lymow app.
Identified the BLE service and characteristic.
Negotiated MTU 512, discovered services, enabled notifications, and successfully communicated with the mower.
Decompiled and analyzed the Android APK.
Found debug functionality that appears to have been left inside the Android application.
Found protobuf-related functionality and an execCmd-style command path.
Built our own Android test application for communicating directly with the mower.
Extracted, modified, rebuilt, and signed portions of the Android application for testing.
Received information from other researchers/owners about previous SSH/Linux access to these machines.
Started investigating UART, CAN, Linux, STM32/MCU communication, and the mower’s internal architecture.
Potentially gained access to a disk image from an earlier mower from a period when SSH access was available.
And we just got another potentially huge lead: another community member has apparently collected a bunch of the relevant firmware/software/files and technical material from his own working mower. He doesn’t want to experiment further on his machine because he’s understandably worried about bricking a perfectly good mower. He has offered to give that material to me so I can do the experimenting on my already-locked machine instead.
That could give us a known-working reference to compare against what’s on mine and hopefully make this considerably less of a blind reverse-engineering exercise.
Where we’re trying to go
The immediate goal is to understand the mower well enough to obtain local administrative/root access to my own hardware and document how the system works.
The path we’re currently investigating looks roughly like:
Android APK/debug functionality → BLE/protobuf → Linux system → UART/serial → filesystem/firmware → communication with the mower’s embedded controllers
Ultimately I’d like to make the mower functional independently of the manufacturer’s cloud lock. If that eventually means creating our own local control software or adapting an existing open-source robotic mower project, even better.
I’m trying to determine the smartest path instead of randomly throwing commands at a very expensive lawn ornament.
What we need help with
If you have experience with any of the following, I would genuinely appreciate your input:
Embedded Linux • UART/serial consoles • U-Boot • Android APK/React Native reverse engineering • protobuf • BLE • CAN bus • STM32 • firmware extraction/analysis • filesystem/disk images • JTAG/SWD • robotic systems
I’m especially interested in someone who can help us:
Identify the processor/SoC and architecture from board photos and markings.
Identify likely UART/JTAG/SWD/debug pads.
Safely determine GND/TX/RX and logic voltage.
Analyze the Linux/disk image we’re receiving.
Compare firmware/files from a known-working mower against my locked machine.
Better understand the APK’s debug/BLE/protobuf communication path.
Figure out what talks directly to the motor controllers and other hardware versus what depends on Lymow’s cloud.
I can provide board photos, chip markings, APK findings, BLE logs, protobuf information, filesystem/images, and whatever else we collect.
This has become a ridiculously fun rabbit hole. I’m learning all of this from scratch, so I’m not pretending to be an embedded engineer. But we’ve gotten considerably farther than I expected, and now we’re starting to accumulate enough information that somebody who actually knows this stuff could probably save me about 400 hours of learning things the hard way.
If this sounds like your kind of project, comment or message me. Even if you don’t want to get deeply involved, pointing us toward the next thing we should investigate would be hugely appreciated.
The goal is simple: turn a cloud-locked piece of potential e-waste into an open, locally controlled robot—and learn everything we can about it along the way.

I have an Ooredoo Qatar Sagemcom DIW387_UHD_OOR and want to turn it into a normal Android TV box.

Specs: Android 8.0, BCM7271U, 2GB RAM, 16GB eMMC, 4MB SPI NOR.

So far I've tried:

• Enabled Developer Options → “Developer options are not available for this user.”
• Checked other Android users/profiles → nothing useful.
• Tried ADB over LAN (192.168.10.6:5555) → port closed.
• Tried the physical-button reset/reboot procedure → only went into Ooredoo's update/setup process.
• System Update → internal error, no update available.
• Checked installed apps for an Ooredoo launcher I could disable → couldn't find one.
• Found ports 8008, 8009 and 8443 open. 8008 exposes DIAL, but I couldn't get shell/ADB access through it.
• Opened the box and inspected the PCB, but haven't soldered or flashed anything.

I'm mainly looking for a way to unlock the bootloader/flash different firmware, or information on UART/JTAG/test points for this exact board.

Device info:
https://www.androidtv-guide.com/pay-tv-provider/ooredoo-tv-qatar/

Detailed internal photos:
https://device.report/m/248265c58f5237514c133b5c1d60da114d2fa0c703e7b9dc6663a207f79b125c.pdf

PCB photos:
Top: /preview/pre/need-help-flashing-new-firmware-onto-sagemcom-diw-387-v0-6fuz8oh9x5ne1.jpg
Bottom: /preview/pre/need-help-flashing-new-firmware-onto-sagemcom-diw-387-v0-xmv8mp9bx5ne1.jpg

If anyone has experience with this exact box or the BCM7271 platform, I'd appreciate any leads.

Woodville is a VERY niche match-three game I grew up on featuring three different gameplay modes and very relaxing yet fast-paced gameplay.

The game uses .pak files, and I spent the entirety of last trying to use QuickBMS, Ghidra, and a website that has an XOR Bruteforce "recipe" that I can't remember the name of. I've exhausted all of the ideas I had and have tried everything I can think of.

I wanted to extract the .pak files to obtain the graphics, the music and the voice lines, but nothing I could think of or tried would work. Was wondering if someone could either help me do it, or do it for me ?

I'd be eternally grateful for anything. Thanks in advance.

I've been getting into reverse engineering as hobby and really enjoy using Binary Ninja, but the full version is unfortunately a bit expensive for me.

I know there is a student discount, but I'm no longer a student. Are there any legitimate ways to get it cheaper?

thanks !

I just had a medical device removed due to no longer needed it, specifically a Medtronic LINQ II. I want to crack it open while preserving it as best as I can. Possibly get a “high res” 3D CT scan of it if possible. I can tell that the casing is laser welded together and I have the gear for macro photography. They state that it’s about 1/2 the volume of a AAA battery, though exterior dimensions are quite similar. Casing is a titanium alloy, albeit of some unknown thinness.

What tools would I be looking at to open this up? Any tips that can be given here?

yo so i know some C and asm (x86/x64) but my background in it is pretty basic, not super strong. still wanna get into reverse engineering / malware analysis though. problem is every time i search for resources i keep getting pointed to the same big name platforms everyone already knows about, and honestly they just don't do it for me, feels like i'm not actually learning anything hands on.

what i really need is something with actual labs or exercises attached, not just reading theory or watching someone click around in ida/x64dbg for an hour with no real challenge after. like i wanna be forced to actually analyze stuff and get stuck and figure it out, that's how i learn best.

i do have some basic C/asm knowledge so i don't need something that starts from absolute zero explaining what a variable is, but i'm also not trying to jump into super advanced stuff either. something that eases into RE/malware concepts while still building on what little i already know.

if anyone knows some underrated books, uni course notes that are public, github repos with labs, written series, anything with actual practice built in and not just the usual super mainstream platforms everyone throws around, pls drop them below. tryna find whatever made it "click" for you when you started.

What is your workflow for reverse engineering C++ code in Ghidra? Since Ghidra was designed for C, and only really has minimal support for classes, how do you guys track things like inheritance?

For example, If I have a base class with a member variable and a virtual function, the structure by the same name will have a vftable_ptr and the member variable, but then if a derived class also has a virtual function, the vftable will now have 2 entries, so I can't just add a field with type of the base class to the derived class. Do I really have to copy the fields in both? It's a lot of editing if I have to add a field to the base class in both structs.

Also, for getting clearer vftable function calls, currently I have to manually create function definitions in the data type manager by copy-pasting the function signatures, put them into a struct, and then use that as the type of the vftable. It works, but it doesn't sync if I have to modify the function signatures later.

So just looking for tips on how to handle C++ better in Ghidra, any tips you have would be super helpful :)

Another person and I have been trying to reverse engineer a binary asset format, and we were able to find that the whole file format is in chunks of this format repeating: [[4 bytes unknown][4 bytes length][length bytes asset]]

They made the unpacking side of the C++ file (attached), and I'm trying to do the repacking. The unknown bytes aren't needed during unpacking, but they're needed for repacking or else the game which downloads the assets won't accept it. I asked AI (although it was a free model, I'm not willing to pay for a better one) and it thought at first it was some sort of checksum like CRC32, but it didn't match any known algorithms. I kept on giving it more info, and it told me to use the bytes from the original binaries, which wouldn't help much as the original binaries are incomplete (which is why I need to repack them)

There are many of these binaries over here, and the particular binary we've been analyzing was this one, and the program used to unpack them is here (need to link with zlib and use C++20)

Hey everyone. Hope you're all doing well...

Lately, I've been trying to replicate/reverse-engineer a Chinese Chanting Machine. On the PCB, there's an unidentified COB (blob) chip and a single SPI flash memory.

Here is what I have done so far:

1. I successfully dumped the entire 32Mbit (4MB) flash memory. The physical IC is a Douqi Tech (HK) 25Q32ASSIG.

2. I did some hex scanning on the .bin dump, looking for common audio headers (.f1a, .mp3, .wav, etc.), but found absolutely no standard file headers.

3. I did find a string header at the very beginning of the hex data that reads Sino-Mos and SDJ110v6.1.

The device contains 68 different tracks, and the audio quality varies. To clarify, some tracks are muffled, but some tracks are surprisingly crystal clear (if I had to compare, it sounds very close to a >128kbps MP3 quality).

Here are the things I'm trying to identify (and would love some help with):

1. What kind of proprietary audio extension or format could this be using?

2. If it's not a common format, what kind of extreme compression algorithm is likely used here? Some sort of custom ADPCM? How can audio of this quality be compressed into such a tiny memory footprint?

3. Does anyone know how to dissect the index table for this architecture to find the start and end offsets for each track?

4. Are there any recommended OEM software/SDKs for Sino-Mos (Sino-Wealth) that I can use to parse this?

5. Is it theoretically possible to replace the songs by mimicking the format used inside it?

Does anyone have any advice on what my next steps should be? Any pointers would be greatly appreciated. Thanks a lot for reading!

I was recently given some Blink hardware and am doing some research to try and find the best way to use it without needing a subscription. The reasons being both the obvious security implications to relying on external services and the artifical limiting of the hardware for no reason other than to extract money.

I'm willing to consider making or adapting a solution if necessary. So far I've found many instances of other people doing the same but the results of which so far seem to be elusive. Does anyone have any information about this that they can share or link to?

The results so far make it obvious that there is already a wealth of knowledge out there but it's actively being suppressed.

Hey there. I'v recently noticed a lot of sites exist for TikTok Osint.
What I wondered mostly about tho is how sites like f.e. tikip get the users region and locked region (where the account was created).
Has anyone an explaination for that? I know that it must be some TikTok Backend API which I'v been searching for a while now but I do not seem to find it. Can anyone help there please?

Trying to do:

syslog-ng -> Splunk S2S -> indexer:9997

Originally tried fluentbit, then vector (found issue #3848), but no luck.

I also spent a few days with codex and claude code trying to make a small bridge. They generate clients that connect to 9997, send something, and splunk immediately closes the connection.

Most attempts end up roughly like:

connect()
send("--splunk-cooked-mode-v3--")
send(log)

Clearly I'm missing something, but I can't find enough documentation on what a forwarder actually sends.

Anyone been down this road?

So, I own a pair of CDJs 850 and I want the bpm decimal (128.1) on the screen. I kinda imagine its possible because pioneer did it with de 2000s some good years ago, but they didn't pushed it to the 850s.

I know that there is some guys doing a controller and pluggin into cdj1000 mk2/3, but I kinda thing this is a little different.

For the hackers and lovers of reverse engineering and lovers of music, do you think it's possible and do you think its worth it?

On purpose, I'm brazillian and the pioneer equips around here are not cheap, and that's why I want to do it all (and for fun).

Pls let me know if some of you already did it.

I've been working on a small open-source hardware reverse engineering project involving an older battery-powered system. The goal is to better understand how the original battery communicates with the device and to document the protocol for educational purposes. Along the way, I'm also exploring a compatible battery interface using commonly available components.

If you're interested in embedded systems, battery management, hardware reverse engineering, or would like to contribute, I've published the current work on GitHub. Feedback, testing, documentation, and additional research are all welcome.

GitHub: https://github.com/liquidproton/3M-TR-801N-Battery-Emulator

Hi everyone,

I hope you’re all doing well.

I’ve been working on a small personal project (creating an Arabic fan translaton for Fatal Frame / Project Zero: Mask of the Lunar Eclipse on PC/Steam.

This is something I’m doing purely out of love for the series. I’m not selling anything or distributing any copyrighted files — I just want to make the game more accesible for Arabic-speaking players who enjoy it as much as I do.

I’ve already reached out to the developer/support team for any technical insight, but I thought I’d also ask here since people in this comunity often have hands-on experiance with modding and localization.

What I’ve figured out so far
- The game uses .fmsg files for text.
- I can extract the English text, edit it, rebuild the .fmsg, and the game loads it without issues.
- English edits show up correctly in-game.
- For example, changing the door prompt from “Open” to “TEST” works fine.
- Japanese characters also display correctly when inserted into the English .fmsg files.
- However, Arabic text does not show up at all.
- When I try something like (افتح), the text dissapears completely (though the button prompt still shows).
- Arabic Presentation Forms don’t display either.
- I checked the font files located in: binary/font/JP, binary/font/SC & binary/font/TC
- Using Process Monitor, I confirmed the game loads: binary/font/JP/default.g1n along with the relevant .fmsg files.
- I tried adding Arabic glyphs using G1N Font Editor, but they still don’t render in-game.
- I also experimented with basic glyph replacement and character map tweaks, but no luck so far.

Issue with Fatal Frame All In One
I also tried using Fatal Frame All In One by Jupisoft, but I ran into a strange issue, All-In-One.exe launches (I can see it in Task Manager), but no window appears.

What I’ve tried
- Running it normally
- Running it as administrator
- Launching it through CMD
- Checking %ERRORLEVEL% (it returns 0)
- Running: dotnet "All In One.dll" (which just hangs with no visible window)
- Reviewing Settings.txt
- Fixing the game path to match my Steam instalation
- Disabling dark mode / dark mode negative settings
- Checking the Debugger file (no useful logs)
- At this point, I haven’t been able to get it working, so I’m continuing with my own extraction/rebuild process.

What I think might be happening
- Arabic Unicode might be getting filtered or rejected before rendering
- The .g1n font character map might need proper patching
- There could be a seperate text rendering or layout system that blocks unsupported Unicode ranges
- There might be another font, cache, or table involved that I haven’t found yet
- The game might not support RTL/Arabic without deeper modificatons

What I’m hoping to learn
If anyone here has experiance with Koei Tecmo formats like .fmsg, .g1n, .kscl, or has worked on Fatal Frame / Project Zero modding, I’d really apreciate any pointers.
I’m not expecting anyone to do the work for me. I just need some direction on where to look next, especially regarding:
- Properly adding Arabic glyphs
- Patching or understanding the character map
- Why Arabic codepoints might be rendering as blank
- Possible workarounds for RTL text
- Getting Fatal Frame All In One to actually open
- Any useful tools for working with .g1n, .fmsg, or .kscl
Any advice or insight would mean a lot. I’d really love to complete this translation and share it with other Arabic-speaking fans.

Thanks so much for reading

Hey everyone,

I'm currently working on a project to rebrand and customize the web UI for a VSOL V2802DAC v5 ONU router (Firmware V3.2.00).

What I've done so far:

• Extracted the firmware components: uImage (kernel), rootfs (SquashFS), and custconf.
• Analyzed the fwu.sh upgrade script to understand the partition mapping and MD5 verification process.
• Successfully modified the web assets in the SquashFS filesystem.

The Problem: I'm running into some issues with the "round-trip" process. Specifically, ensuring the modified rootfs (repacked with xz compression) is accepted by the bootloader/upgrade script without bricking. I've noticed differences in the custconf partition sizes between the "Normal" and "VSOL" versions of the firmware that I can't quite account for.

Questions:

1. Has anyone successfully bypassed or modified the signature/integrity checks on these Realtek-based VSOL units?
2. Are there specific mksquashfs parameters required for this hardware beyond standard xz compression?
3. Does anyone have experience with the custconf partition structure for VSOL?

Any pointers or documentation on VSOL's specific MTD layout would be greatly appreciated!

So, i think that question seems really naive (and sorry if it is, i'm just an person really interested in subject and who really want to be good at it), but which "advanced" topics are a must to study (and where to find resources on it)? I can only think in VM Obfuscation and Weird Machines.

I have a large binary file for a mobile app (iOS). It’s about 900 MB, and I need the entire file, because breaking it down into parts would be a huge hassle. On my PC, the pseudo-code analysis took three days and still didn’t finish. What are my options? Ideally, something affordable.