Technology enthusiast and mobile security researcher experienced in pentesting of mobile apps. Reach out at [email protected] for technical consultation.
Joined October 2022
- Tweets127
- Following108
- Followers591
- Likes497
Can’t intercept Flutter iOS traffic in Burp?
Flutter ignores NSURLSession via BoringSSL in Dart AOT snapshots.
Fix:
• Parse pool with r2flutter
• Hook onBadCertificateWrapper
• Return Dart’s true (x22 + 0x20)
Guide: youtu.be/lQSBpEJbJaY
AI agent that turns RE research into a queryable knowledge base.
Ingest → Compile → Search → Verify.
Pulls web articles, structures them into a wiki, searches like a graph, tags every claim.
Link: youtu.be/8JgcliENtPQ
Repo: github.com/fatalSec/LLM-RE-K…
FatalSec retweeted
Introducing usbliter8
An A12/A13 SecureROM exploit
A novel iPhone BootROM vulnerability discovered and exploited by our team. It covers the underlying bug, the associated exploitation techniques, and the post-exploitation steps required to achieve application processor's boot-chain compromise.
The exploit leverages both a hardware bug in the USB controller and a specific configuration flaw present in the device firmware.
ps.tc/pages/blog-usbliter8.h…
poc:
github.com/prdgmshift/usblit…
FatalSec retweeted
GitHub - lautarovculic/ioscpy: A macOS CLI that mirrors and controls a jailbroken iPhone over USB. github.com/lautarovculic/ios…
iOS apps often detect manual proxies with CFNetworkCopySystemProxySettings and block Burp Suite traffic.
In this video, we bypass this protection in the @8kSec iOS Challenge 5 (ClearRoute).
Watch the walkthrough:
youtu.be/PZnt3jJhlqo
@mobilesecurity_ @androidmalware2
Join the FatalSec community. We have created this new space to continue sharing content, research, tooling, and discussions around reverse engineering, mobile security, pentesting, and low-level internals.
Stay active, share knowledge, and keep learning.
t.me/+eb4DfS4aXuZlM2Y9
Hey folks!
I've been getting a lot of DMs for guidance, so decided to take action on it.
I'm excited to help folks out and give back to the community via Topmate. Don't hesitate to reach out if you have any questions or just want to say hi!
topmate.click/klvge
Ever injected a Frida script just to watch the app instantly crash?
Modern RASP actively hunts your hooks. In this video, we build a memory trap, catch the scanner, and deploy a live ARM64 patch to completely blind it.
Watch the teardown: youtu.be/yipcDMRHBG4
Standard inline hooks triggering Android RASP?
In this video we use Renef to hook imported functions via PLT/GOT manipulation, leaving function prologues untouched to evade memory detections.
Watch here:
youtu.be/ssqe9PEqTYI
@Nethella @androidmalware2
FatalSec retweeted
Syscall Tracer🔥🔥
Sometimes it’s useful to observe the system calls happening inside a given target process. Especially if the target includes some kind of Frida detection, root detection, or any other kind of Runtime Application Self-Protection (RASP).
frida.re/news/2026/03/09/fri…
#AndroidSecurity #RASP #ReverseEngineering
Frida blocked by advanced RASP?
New Video of "Defeating Modern RASP" is live on FatalSec!
Watch us bypass GarudaDefender using the Renef framework, stealthy process injection, and Lua Java hooks.
Watch Here: youtu.be/zAQ1iYnpUQg
FatalSec retweeted
I took time to wrap up some notes about PAC and play with it!
blog.reversesociety.co/blog/…
FatalSec retweeted
"Dr. Bytecode or: How I Learned to Stop Worrying and Obfuscate Java"
A tale about how @farenain started his journey in Java software obfuscation.
blog.quarkslab.com/how-to-wr…
ALT Java is a bomb you ride backwards.
Cracked @8kSec Challenge 3 by digging deep into Swift memory layouts and spoofing GPS location.
We analyze struct offsets, decode metadata, and use Frida to teleport past the location anti-cheat.
Watch here: youtu.be/8bF6YZLC6Sw
FatalSec retweeted
🚨 REcon 2026 is LIVE!
🚀 Call for papers and registration are now open!
Join the world's top reverse engineers & exploit devs in Montreal:
🛠 Trainings: June 15-18 (19 hands-on classes – AI agents, kernel exploits, Rust/Go reversing, fault injection & more!)
📅 Conference: June 19-21
Tickets & early bird now open → recon.cx
Shoutout to the legends teaching: @SinSinology @KyleMartin @MalachiJonesPhD @andreyknvl @mr_phrazer @yarden_shafir @DrCh40s @pulsoid
+ more elite instructors! See website for all trainers and session info.
Limited spots – see you in MTL! #REcon2026 #ReverseEngineering
#BytecodeEmulator
Just open-sourced a Dalvik bytecode emulator 🎉
It's useful for string decryption and static analysis of Android apps/malware. No need to run a full Android environment - just point it at an APK and a method to emulate.
GitHub: github.com/fatalSec/DaliVM
#MobileSecurity #SecurityResearch
Bypassing Android System Library Integrity Checks!
Learn how to defeat checks that flag your Frida hooks. We dive deep into system libraries memory modification techniques.
Don't let integrity checks stop your research.
youtu.be/8FZYmsDUj-c
Unlock iOS reverse-engineering skills with the @8kSec Challenge2 — a hands-on guide to static analysis & runtime manipulation.
Dive in, level up, and break new ground in mobile security!
Watch here: youtu.be/c8UkuOxTWCk
#iOSHacking #ReverseEngineering #8KSEC
#iOSReverseEngineering #Frida #8KSEC #MobileSecurity
I take on @8kSec iOS Challenge 1 — FridaInTheMiddle 🔍
✔️ Bypass Frida detection
✔️ Hook Swift symbols
✔️ Parse Swift strings to capture the flag
Watch here: youtu.be/C2U85c799JI
@mobilesecurity_