Reverse Engineering Researcher focused on Android, Obfuscated JS, WASM and Adversarial Scraping/Anti-Bots. I also like music.
Featured Posts
x-client-transaction-id: how I re-reversed X's antibot
X's transaction id header broke every open-source generator in 2026. A lab, a silent webcrack failure, a 300-string RC4 table, and what reading the actual generator reveals that differential testing never could.
codehow I solve cloudflare's cf_clearance at scale
my experience building a microservice to solve Cloudflare challenges and return cf_clearance cookies
session borrowing: defeating TLS channel binding in mobile environment
my experience working around TLS channel binding in an Android application
Stack and Skills
Open Source
x-client-transaction-id
Go signing engine for X's antibot header, re-derived from the deobfuscated generator. Lab, 9/9 ground-truth harness, followers scraper.
apx (Vanilla OS)
Contribution: replaced the connection check with net.Dial over http.Get. 8-10x faster when online, measured with Go benchmarks. Merged.
frodo (MCP server)
Go MCP server that grounds LLM-generated Frida instrumentation against real CodeShare scripts and API signatures.
frodo (dataset)
Published dataset on Hugging Face: a RAG knowledge base scraped from Frida's CodeShare. 440+ downloads.
spigel
Image comparison library using perceptual hashing (pHash/dHash), no ML.