Every result the tool returns carries its own confidence, its authority, and its limits, which is the discipline a claim about a shipped game needs. What REA is, and what people are using it for, from a PC-98 bullet pattern to PS5 executables relinked into native ports.
The refusal was more useful than the analysis would have been. Inside REA: how an evidence id is computed so two machines agree, why a zero can mean the question was never asked, and the 3 MB file that exhausted Node’s default heap.
WebKit and the app layer are the Apple surfaces you can actually study without a research device. How the browser’s processes are isolated from each other, what crosses between them, and where a third-party app’s own checks sit relative to the server’s.
A source-first method for Apple kernel research: diff consecutive XNU tags, mine the regression tests that ship with the fixes, map sibling call sites, and rank candidates by how well they survive Memory Integrity Enforcement. Four evidence gates, a safe workflow, and the stop conditions that keep this work honest.
iOS system libraries ship inside one dyld shared cache instead of on disk, and a fat Mach-O will happily hand you the wrong architecture without an error. Here is the static workflow that reads headers, metadata, and topology before you open a decompiler.
A boundary-first map of the iOS stack, from app sandbox and XPC through XNU subsystems to PAC, SPTM, and the Secure Enclave, with the evidence gates I use before calling anything a finding.
I spent my first month with Ghidra staring at assembly I didn’t understand, convinced I was too stupid for this. Here’s the honest version of how I got from ‘what is a register’ to solving CTF reversing challenges, and the mistakes that cost me weeks.
Some binaries detect that you’re debugging them and crash, change behavior, or hide the flag. This post covers the common anti-debugging techniques and how to bypass them.
Some CTF reversing challenges hide the flag behind a custom virtual machine: a program that interprets its own bytecode. This post shows you how to spot them, reverse the instruction set, and write a solver.
A crackme is a small binary that asks for a password and checks your input. This post walks through solving one, from downloading the binary to extracting the flag, with every tool click explained so you can follow along.
More posts, now spanning the full workspace.