hexproofdev.bsky.social
@hexproofdev.bsky.social
1/ droidsaw's DEX and Hermes decompilers are verified against first-party disassemblers via bit-identical bytecode roundtrips.
Effectively, droidsaw turns closed-source Android apps into a bidirectional xref graph, with semgrep, VEX, Frida, R8 rec, and TruffleHog support.
Effectively, droidsaw turns closed-source Android apps into a bidirectional xref graph, with semgrep, VEX, Frida, R8 rec, and TruffleHog support.
May 26, 2026 at 2:04 AM
1/ droidsaw's DEX and Hermes decompilers are verified against first-party disassemblers via bit-identical bytecode roundtrips.
Effectively, droidsaw turns closed-source Android apps into a bidirectional xref graph, with semgrep, VEX, Frida, R8 rec, and TruffleHog support.
Effectively, droidsaw turns closed-source Android apps into a bidirectional xref graph, with semgrep, VEX, Frida, R8 rec, and TruffleHog support.
1/ Demonic (CVE-2022-32969) hit MetaMask's browser extension — key material persisting beyond its intended lifecycle. MetaMask said in 2022 it didn't affect Mobile.
May 17, 2026 at 12:25 AM
1/ Demonic (CVE-2022-32969) hit MetaMask's browser extension — key material persisting beyond its intended lifecycle. MetaMask said in 2022 it didn't affect Mobile.
Cerberus is one of the longest-running stalkerware apps on Android.
We reversed their ecosystem, and document why Google must remove it from the Play Store, AdMob, and FCM.
tl;dr hexproof.dev/datagrams/ce...
long hexproof.dev/datagrams/ce...
#reverseengineering #android #stalkerware
We reversed their ecosystem, and document why Google must remove it from the Play Store, AdMob, and FCM.
tl;dr hexproof.dev/datagrams/ce...
long hexproof.dev/datagrams/ce...
#reverseengineering #android #stalkerware
Cerberus is stalkerware. Google Play hosts it.
Cerberus on Google Play: €5/month buys silent camera, microphone, GPS, and SMS access on a victim's phone. Researchers reported it to Google as intimate-partner-violence spyware in 2018; Google remove...
hexproof.dev
April 30, 2026 at 8:11 AM
Cerberus is one of the longest-running stalkerware apps on Android.
We reversed their ecosystem, and document why Google must remove it from the Play Store, AdMob, and FCM.
tl;dr hexproof.dev/datagrams/ce...
long hexproof.dev/datagrams/ce...
#reverseengineering #android #stalkerware
We reversed their ecosystem, and document why Google must remove it from the Play Store, AdMob, and FCM.
tl;dr hexproof.dev/datagrams/ce...
long hexproof.dev/datagrams/ce...
#reverseengineering #android #stalkerware
Hello world, I'll be posting about security and systems performance on @hexproof
My first post compares the recently leaked Claude Code source code with other harnesses:
hexproof.dev/datagrams/fo...
My first post compares the recently leaked Claude Code source code with other harnesses:
hexproof.dev/datagrams/fo...
The Fossil Record of Harness Engineering
How Claude Code, Aider, Cursor, Windsurf, and Copilot engineer the systems around their models — and what the architecture reveals about each team's priorities. From source code and leaked prompts.
hexproof.dev
April 10, 2026 at 10:59 PM
Hello world, I'll be posting about security and systems performance on @hexproof
My first post compares the recently leaked Claude Code source code with other harnesses:
hexproof.dev/datagrams/fo...
My first post compares the recently leaked Claude Code source code with other harnesses:
hexproof.dev/datagrams/fo...