https://hanh.me/tags/reverse-engineering/Recent content in Reverse-Engineering on Hanh Pham's BlogHugoen-usFri, 23 Oct 2026 09:53:53 +0700https://hanh.me/posts/rea-capability-review/Thu, 15 Oct 2026 15:00:00 +0700https://hanh.me/posts/rea-capability-review/Every result the tool returns carries its own confidence, its authority, and its limits, which is the discipline a claim about a shipped game needs. What REA is, and what people are using it for, from a PC-98 bullet pattern to PS5 executables relinked into native ports.https://hanh.me/posts/rea-under-the-hood/Thu, 15 Oct 2026 09:00:00 +0700https://hanh.me/posts/rea-under-the-hood/The refusal was more useful than the analysis would have been. Inside REA: how an evidence id is computed so two machines agree, why a zero can mean the question was never asked, and the 3 MB file that exhausted Node’s default heap.https://hanh.me/posts/ios-webkit-and-app-layer/Sat, 10 Oct 2026 09:30:00 +0700https://hanh.me/posts/ios-webkit-and-app-layer/WebKit and the app layer are the Apple surfaces you can actually study without a research device. How the browser’s processes are isolated from each other, what crosses between them, and where a third-party app’s own checks sit relative to the server’s.https://hanh.me/posts/xnu-patch-margin-research/Fri, 09 Oct 2026 09:30:00 +0700https://hanh.me/posts/xnu-patch-margin-research/A source-first method for Apple kernel research: diff consecutive XNU tags, mine the regression tests that ship with the fixes, map sibling call sites, and rank candidates by how well they survive Memory Integrity Enforcement. Four evidence gates, a safe workflow, and the stop conditions that keep this work honest.https://hanh.me/posts/ios-reversing-mach-o-dyld-shared-cache/Fri, 09 Oct 2026 09:00:00 +0700https://hanh.me/posts/ios-reversing-mach-o-dyld-shared-cache/iOS system libraries ship inside one dyld shared cache instead of on disk, and a fat Mach-O will happily hand you the wrong architecture without an error. Here is the static workflow that reads headers, metadata, and topology before you open a decompiler.https://hanh.me/posts/ios-architecture-from-sandbox-to-secure-enclave/Wed, 07 Oct 2026 10:00:00 +0700https://hanh.me/posts/ios-architecture-from-sandbox-to-secure-enclave/A boundary-first map of the iOS stack, from app sandbox and XPC through XNU subsystems to PAC, SPTM, and the Secure Enclave, with the evidence gates I use before calling anything a finding.https://hanh.me/posts/how-i-started-learning-reverse-engineering/Sat, 29 Aug 2026 15:00:00 +0700https://hanh.me/posts/how-i-started-learning-reverse-engineering/I spent my first month with Ghidra staring at assembly I didn’t understand, convinced I was too stupid for this. Here’s the honest version of how I got from ‘what is a register’ to solving CTF reversing challenges, and the mistakes that cost me weeks.https://hanh.me/posts/anti-debugging-tricks/Thu, 27 Aug 2026 11:00:00 +0700https://hanh.me/posts/anti-debugging-tricks/Some binaries detect that you’re debugging them and crash, change behavior, or hide the flag. This post covers the common anti-debugging techniques and how to bypass them.https://hanh.me/posts/custom-vms-in-ctf/Tue, 25 Aug 2026 10:00:00 +0700https://hanh.me/posts/custom-vms-in-ctf/Some CTF reversing challenges hide the flag behind a custom virtual machine: a program that interprets its own bytecode. This post shows you how to spot them, reverse the instruction set, and write a solver.https://hanh.me/posts/your-first-crackme-walkthrough/Sat, 22 Aug 2026 14:00:00 +0700https://hanh.me/posts/your-first-crackme-walkthrough/A crackme is a small binary that asks for a password and checks your input. This post walks through solving one, from downloading the binary to extracting the flag, with every tool click explained so you can follow along.https://hanh.me/posts/ghidra-in-30-minutes/Tue, 18 Aug 2026 11:00:00 +0700https://hanh.me/posts/ghidra-in-30-minutes/Ghidra’s decompiler turns machine code into something that looks like C. But the output is full of strange variable names, weird casts, and functions that look nothing like what you’d write. Here’s how to read it anyway.