FuseFixer is an Android Xposed module that hooks into the MediaProvider's FUSE daemon to prevent package name existence leakage via Unicode Default_Ignorable_Code_Points. The module intercepts path comparison functions (strcasecmp, EqualsIgnoreCase) and access control checks (is_package_owned_path, is_app_accessible_path, is_bpf_backing_path) in the native libfuse_jni.so library, stripping out ignorable code points before evaluation. This closes a vulnerability where attackers could bypass directory access restrictions on /storage/emulated/.../Android/data by inserting invisible Unicode characters. The project includes a custom ELF parser for dynamic symbol resolution, a maps scanner, and a debug UI for testing. The native code is written in C++20 and demonstrates deep understanding of Android's FUSE implementation, kernel casefold behavior, and FUSE BPF internals.
DWARF Explorer is a cross-platform GUI utility for visualizing DWARF debugging information in executable files. Built on PyQt6, pyelftools, and filebytes, it allows users to open ELF, Mach-O, PE, WASM, and ar files to browse their DWARF debug information tree. The application provides views for DIEs (Debugging Information Entries), attributes, references, and includes specialized tools for analyzing locals at addresses, function maps, data sections, frame information, and unwind data. The architecture follows a modular design with clear separation between the GUI layer (PyQt6-based interface in __main__.py and ui.py) and the DWARF analysis logic. Core functionality includes parsing various binary formats via formats.py, building and navigating the DIE tree through tree.py and die.py, and performing specialized analyses using utilities in dwarfutil.py, locs.py, and other modules. The application supports features like following DIE references, searching by conditions, highlighting DIEs, and exporting C skeletons. Key strengths include robust error handling with crash reporting, support for multiple binary formats and DWARF versions (including experimental v1 support), and thoughtful UI design with keyboard navigation, bookmarking, and detailed views. The code demonstrates good practices in separating concerns, with reusable components like the Mach-O unwind parser that could be extracted for use in other projects.
vivisect is a comprehensive reverse engineering framework providing static analysis, dynamic debugging, emulation, and symbolic execution capabilities. It consists of several core packages: `envi` (multi-architecture disassemblers, emulators, memory abstraction), `vivisect` (workspace-based static analysis with analysis passes, import emulation, symbolic execution engine), `vtrace` (cross-platform debugging with ptrace/GDB stub support), `vdb` (debugger CLI and Qt GUI), `vstruct` (declarative binary structure parsing for formats like PE, ELF, Mach-O, minidump), `visgraph` (graph layout for control flow and call graphs), and `cobra` (custom RPC framework for remote collaboration). The system can parse and analyze PE, ELF, Mach-O, and other formats; perform function detection, control-flow recovery, switch-case identification, pointer analysis, and symbolic path exploration. It includes a full-featured debugger with breakpoints, watchpoints, and process control, and offers a Qt GUI for interactive reverse engineering. The architecture is modular but tightly integrated; many components are reusable in isolation. The codebase shows signs of long-term evolution with some Python 2/3 drift, deprecated API usage, and incomplete migration to PyQt6, but remains actively maintained with recent commits and a substantial test suite.
Il2CppMemoryDumper is a shell script designed to extract Il2Cpp metadata and native libraries from the memory of a running Android process. It operates by scanning the target process's memory maps for regions associated with libil2cpp.so, global-metadata.dat, and split-config APKs, then dumps these regions to files after verifying their content via magic number checks. The script includes logic to merge adjacent memory regions for ELF files and handle anonymous .bss sections, outputting files with naming conventions based on memory offsets. It is intended for use in a rooted Android shell environment and relies solely on standard Linux utilities (awk, bc, dd, grep, etc.) without external dependencies.