Global

I built Fieldwatch as a personal tool to look at what Wi-Fi access points and Bluetooth LE ads my phone was able to pick up, so that I could better understand what devices were being used around me.

Claude Code skill to support Android app's reverse engineering

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.

This is a complete implementation of the keystore, which fully implements the AOSP AIDL interface, referencing the official AOSP implementation.

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

Hacker101 is a free class for web security. Whether you're a programmer with an interest in bug bounties or a seasoned security professional, Hacker101 has something to teach you.

0 and later do not register filza:// or another URL scheme. The release build removes CFBundleURLTypes and fails if that key remains. For these versions, there is no separate standard build.

The classic profile pipeline stays untouched: CVE-2026-43499 payloads (local or Shizuku), Root My Galaxy integration, per-device validated profiles (S25 ZZHL/ZZI4, S26 Ultra ZZHK, S93XX, Oppo), profile editor, instant root, and run-log archives.

The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering.

A list of resources for those interested in getting started in bug bounties

Goodnotes uses RevenueCat to manage subscriptions. Every time the app starts, it sends a request to a GoodNotes proxied RevenueCat's API (/v1/subscribers/ ) to check your subscription status

This is a proof-of-concept for developers and not anything meaningfully usable at the moment.