https://pilfer.github.io/Recent content on @PilferHugo -- gohugo.ioen-usWed, 16 Oct 2024 00:00:00 +0000https://pilfer.github.io/mobile-reverse-engineering/react-native/heresy-inspect-and-instrument-react-native-apps/Wed, 16 Oct 2024 00:00:00 +0000https://pilfer.github.io/mobile-reverse-engineering/react-native/heresy-inspect-and-instrument-react-native-apps/Heresy I made a neat little tool called heresy, which hooks the JavaScript and Hermes Bundle loader in React Native apps and allows you to inject your own JavaScript into the Hermes engine’s global context. This is essentially the same as injecting a JavaScript snippet into a web page with GreaseMonkey or similar. This is especially useful if you don’t feel like digging through the Hermes bytecode. Potential Use Cases Inspecting HTTP or WebSocket traffic between a React Native application and a remote host Modifying the UI at runtime Inspecting and modifying application state Finding which specific Hermes functions are being called when a button is pressed High-Level Architecture The RPC Server only really exists as a way to provide a REPL from the main app to the Hermes runtime, but you can modify it as-needed to support your needs.https://pilfer.github.io/mobile-reverse-engineering/react-native/reverse-engineering-and-instrumenting-react-native-apps/Fri, 04 Oct 2024 13:00:00 +0000https://pilfer.github.io/mobile-reverse-engineering/react-native/reverse-engineering-and-instrumenting-react-native-apps/Update: Use Bytecode Studio I’ve launched Bytecode Studio - a comprehensive tool built for reverse engineering, analyzing, disassembling, and decompiling React Native applications and Hermes binaries. Table of Contents What is React Native? Tooling Landscape Bytecode Studio - Hermes disassembler, decompiler, and all-in-one Reverse Engineering tool Mine: hermes_rs - Hermes disassembler and assembler Mine: heresy - Hermes Engine instrumentation utility Official Hermes Resources Third Party: hermes-dec Third Party: hbctool Third Party: hasmer Injecting JavaScript into the React Native Global Context Intercepting React Native HTTP Traffic What about JSON.https://pilfer.github.io/sneaky-javascript/anonymous-functions/Mon, 29 Aug 2022 13:01:10 -0400https://pilfer.github.io/sneaky-javascript/anonymous-functions/Preface I find myself muttering “Hmm…I wonder if this will work…” under my breath a lot, usually as an excuse to distract myself from whatever task I’m supposed to be working on. On a good day I’m able to stifle the urge to pull on whichever thread has stolen my attention, but this was not one of those days. The musing caught me shortly after I finished writing an anonymous function declaration in a Javascript codebase I was working on.https://pilfer.github.io/about/Mon, 01 Jan 0001 00:00:00 +0000https://pilfer.github.io/about/I’m a software engineer who enjoys: Security stuff Reversing mobile apps Building tooling for weird stuff Automating the un-automatable My github has some neat things on it.