Week of September 30, 2024

A security researcher details a methodology to bypass Runtime Application Self-Protection (RASP) checks in a mobile app, including root detection, hooking framework detection, and developer mode detection, using Frida dynamic instrumentation. The technique involves reverse engineering the app with JADX, identifying RASP-related classes, and crafting a Frida script to override security checks. This demonstrates a practical bypass of mobile endpoint security controls.

Security researcher 0xOvid released farsidePacker, an open-source packer that demonstrates various methods to bypass EDR and AV solutions. The tool encrypts a target binary with AES and uses a stub to unpack and execute it in memory, evading detection. It was presented at BSides Copenhagen 2024 and includes techniques like resolving imports and relocations for memory execution.