vadim-a-yegorov

emulate

unicorn — CPU emulation (C) †unicorn-engine, map segments, set regs + stack, hook code/mem, stub imports/syscalls, run one function, read the output. Arch-portable.
QEMU user-mode runs a whole foreign-arch userland binary on the host (and backs AFL++ qemu-mode coverage). qiling (Python, on unicorn) emulates syscalls + a sandboxed rootfs with snapshot/restore and hooks — run firmware or a userland binary headless and script around it; cross-OS (Linux / Windows / macOUEFI loaders).
Ghidra P-Code emulator - arch-neutral single-function emulate from the decompiler's IR (EmulatorHelper) — portable transform execution with no arch backend of your own.

1  unicorn (CPU emulation, C/py)
  map segments, set regs + stack, hook code/mem, stub imports/syscalls, run one function, read the output. Arch-portable.

  #include <unicorn/unicorn.h>

vadim-a-yegorov

formats

1  Mach-O (Darwin) †loader.h
  Magic: fat 0xcafebabe/0xcafebabef (big-endian, per-slice fat_arch); thin MH_MAGIC_64 0xfeedfacf. mach_header_64 = { magic, cputype, cpusubtype, filetype (MH_EXECUTE/MH_DYLIB/MH_BUNDLE/MH_KEXT_BUNDLE), ncmds, sizeofcmds, flags, reserved }. Walk ncmds load commands, each a {uint32 cmd; uint32 cmdsize;} header; advance by cmdsize.
  - LC_SEGMENT_64 (0x19) → segment_command_64 = { cmd, cmdsize, char segname[16], uint64 vmaddr, vmsize, fileoff, filesize, int maxprot, initprot, uint32 nsects, flags } then nsects × section_64 { char sectname[16], segname[16], uint64 addr, size, uint32 offset, align, reloff, nreloc, flags, reserved1,2,3 }. __TEXT.__text is the code; vmaddr of __TEXT is the slide base.
  - LC_SYMTAB (0x2) symoff/nsyms/stroff; LC_DYSYMTAB (0xb) indirect-symbol table (lazy/nonlazy pointer names).
  - LC_DYLD_INFO_ONLY (0x80000022) rebase/bind/lazy_bind/export opcode streams; on arm64e LC_DYLD_CHAINED_FIXUPS (0x80000034) + LC_DYLD_EXPORTS_TRIE.
  - LC_MAIN (0x80000

vadim-a-yegorov

glibc ptmalloc

chunk = { prev_size; size (low 3 bits A|M|P); data }; free chunk reuses data for fd/bk (+ fd_nextsize/bk_nextsize in large). Bins: fastbin (LIFO single-link fd, <=0x80), tcache (2.26+, 7/bin, next + key at +0x18), unsorted, small (double-link), large (size-sorted). First read: the glibc version. It decides the technique; read it before anything.

LEAKS
- unsorted/small chunk fd or bk -> points into main_arena -> libc base.
- any tcache/fastbin chunk -> heap base (for the safe-linking encode).
- stdout FSOP leak (above) when no free-list leak exists.

TARGETS ON CURRENT GLIBC (hooks gone 2.34)

vadim-a-yegorov

frida

Attach: frida -U -n App -l s.js  |  frida -U -f com.x.app --no-pause -l s.js  |  frida -p PID.

1  Frida Interceptor.attach — read/modify args + return  [cross]
  inspect or tweak inputs/outputs of a known function without replacing it.
  1 resolve the address (Module.getExportByName(null,...) searches all modules; pass a module name to scope).
  2 onEnter runs before the body: args is a NativePointer[]; read with .readUtf8String()/.readU32()/.readPointer(); edit by assigning args[i]=ptr(x) (writes the register/stack slot).
  3 stash per-call state on this (a fresh object per invocation) to use it in onLeave.
  4 this.context is the CpuContext (this.context.rdi / .x0 ...) for register reads and backtraces.

vadim-a-yegorov

-Xmx24576M -Xms24576M -XX:+UseG1GC -XX:+ParallelRefProcEnabled -XX:MaxGCPauseMillis=200
-XX:+UnlockExperimentalVMOptions -XX:+DisableExplicitGC -XX:+AlwaysPreTouch -XX:G1NewSizePercent=40
-XX:G1MaxNewSizePercent=50 -XX:G1HeapRegionSize=16M -XX:G1ReservePercent=15 -XX:G1HeapWastePercent=5
-XX:G1MixedGCCountTarget=4 -XX:InitiatingHeapOccupancyPercent=20 -XX:G1MixedGCLiveThresholdPercent=90
-XX:G1RSetUpdatingPauseTimePercent=5 -XX:SurvivorRatio=32 -XX:+PerfDisableSharedMem
-XX:MaxTenuringThreshold=1 -Daikars.new.flags=true -Dusing.aikars.flags=https://mcflags.emc.gs

vadim-a-yegorov

-XX:+IdleTuningGcOnIdle -XX:+UseAggressiveHeapShrink -XX:-OmitStackTraceInFastThrow 
-XX:+UseFastAccessorMethods -XX:+OptimizeStringConcat -Xaot -XX:+UseCompressedOops -XX:ObjectAlignmentInBytes=256 
-XX:SharedCacheHardLimit=800M -XX:+UseCodeCacheFlushing -Xshareclasses:none 
-XX:+TieredCompilation -XX:InitialTenuringThreshold=5 -Dlog4j2.formatMsgNoLookups=true 
-XX:-DisableExplicitGC -XX:InitiatingHeapOccupancyPercent=35 -XX:+UnlockExperimentalVMOptions 
-XX:MaxGCPauseMillis=50 -Djava.net.preferIPv4Stack=true -XX:-ParallelRefProcEnabled
-XX:+UseTLAB -XX:ReservedCodeCacheSize=70M -Xgcpolicy:gencon -Xmns800M -Xmnx800M
-XX:ConcGCThreads=2 -XX:+UseZGC -XX:AllocatePrefetchStyle=1 -XX:-ZProactive
-XX:+UseTransparentHugePages -Xlp -Xlp64k -Xnoclassgc -Xcompressedrefs

vadim-a-yegorov

-XX:MinHeapFreeRatio=25 -XX:MaxHeapFreeRatio=50 -XX:UsePerfData -Xgcthreads2 -Xcompactgc
-XcompilationThreads4 -XX:+UseG1GC -XX:+ParallelRefProcEnabled -XX:MaxGCPauseMillis=200
-XX:+UnlockExperimentalVMOptions -XX:+DisableExplicitGC -XX:+AlwaysPreTouch -XX:G1NewSizePercent=30
-XX:G1MaxNewSizePercent=40 -XX:G1HeapRegionSize=8M -XX:G1ReservePercent=20 -XX:G1HeapWastePercent=5
-XX:G1MixedGCCountTarget=4 -XX:InitiatingHeapOccupancyPercent=15 -XX:G1MixedGCLiveThresholdPercent=90
-XX:G1RSetUpdatingPauseTimePercent=5 -XX:SurvivorRatio=32 -XX:+PerfDisableSharedMem
-XX:MaxTenuringThreshold=1 -Dusing.aikars.flags=https://mcflags.emc.gs -Daikars.new.flags=true

vadim-a-yegorov

-XX:MinHeapFreeRatio=25 -XX:MaxHeapFreeRatio=50 -XX:UsePerfData -Xgcthreads2 -Xcompactgc
-XcompilationThreads4 --add-modules=jdk.incubator.vector -XX:+UseG1GC -XX:+ParallelRefProcEnabled
-XX:MaxGCPauseMillis=200 -XX:+UnlockExperimentalVMOptions -XX:+ExplicitGCInvokesConcurrent
-XX:+AlwaysPreTouch -XX:G1HeapWastePercent=5 -XX:G1MixedGCCountTarget=4
-XX:InitiatingHeapOccupancyPercent=15 -XX:G1MixedGCLiveThresholdPercent=90
-XX:G1RSetUpdatingPauseTimePercent=5 -XX:SurvivorRatio=32 -XX:+PerfDisableSharedMem
-XX:MaxTenuringThreshold=1 -Dusing.aikars.flags=https://mcflags.emc.gs -Daikars.new.flags=true
-XX:G1NewSizePercent=30 -XX:G1MaxNewSizePercent=40 -XX:G1HeapRegionSize=8M -XX:G1ReservePercent=20

vadim-a-yegorov

/**
 * Android, iOS (12.0-15.7.3), Linux universal SSLKEYLOG dumper.
 *
 * Usage:
 * 
 *   # For iOS and mac:
 *   rvictl -s [UDID]
 *   # Then open Wireshark and select rvi0
 * 
 *   # For iOS and not mac: