nullpt.rs

I actually wrote a separate blog post about this! Changing the debugger keyword :) see: https://nullpt.rs/evading-anti-debugging-techniques

In my bookmarks I found this RE examples as well: https://www.nullpt.rs/reverse-engineering-tiktok-vm-1 https://ibiyemiabiodun.com/projects/reversing-tiktok-pt2/

> 2. Despite tiktok having a giant target painted on its back for its perceived connections to the CCP, I haven't really seen any evidence that it does any more tracking/fingerprinting that most other websites (eg. facebook) or security services (eg. cloudflare or recaptcha) already do. Take a look for request parameters in TikTok vs. Instagram for example. Every request for TikTok forces you to pass most of the information that browser can collect from the end-user before server responds: https://www.nullpt.rs/reverse-engineering-tiktok-vm-1

TikTok and DJI do similar things https://www.nullpt.rs/reverse-engineering-tiktok-vm-1 https://arstechnica.com/information-technology/2020/07/chinese-made-dr… Never install Chinese apps on your phone.

No, they absolutely export malware still. All of DJI's apps need to be sideloaded on android because the obfuscated data collection they do is not allowed in Play Store apps[0]. TikTok uses an obfuscated VM to do user tracking[1]. Then there's the malware that the US government has to routinely delete from compromised computers [2][3] Chinese software deserves the reputation it has. [0] https://arstechnica.com/information-technology/2020/07/chinese-made-dr… [1] https://www.nullpt.rs/reverse-engineering-tiktok-vm-1 [2] https://arstechnica.com/tech-policy/2025/01/fbi-forces-chinese-malware… [3] https://arstechnica.com/security/2024/01/chinese-malware-removed-from-…

This researcher [0] found the optimal solution was to use a custom build of Firefox with the `debugger` keyword changed to something else :) [0] https://www.nullpt.rs/evading-anti-debugging-techniques

> I'm sure there are more advanced anti-debugger techniques with different denial-of-service vectors. Just rename debugger to banana. Edit: I see you have posted it below already! https://www.nullpt.rs/evading-anti-debugging-techniques

Also Tiktok's backend: https://www.nullpt.rs/reverse-engineering-tiktok-vm-1

Yes, but automatic obfuscation can be interesting, if not only simple substitution methods presented here. E.g. something like [1] (Devirtualizing Nike.com's Bot Protection) discussed here [2]. Or something like this [3] (Analysis of Obfuscation Techniques Found in Apple FairPlay) [1] https://www.nullpt.rs/devirtualizing-nike-vm-1 [2] https://news.ycombinator.com/item?id=34285747 [3] https://news.ycombinator.com/item?id=37307653

This was inevitably going to get more popular after the new API pricing was announced. Unfortunately this also means they're going to start being more aggressive on bot detection. We may soon find ourselves needing to run headless browsers to scrape data, like with TikTok: https://nullpt.rs/reverse-engineering-tiktok-vm-1

Quietly? https://www.nullpt.rs/reverse-engineering-tiktok-vm-1

For reference, here is part 1 from last week: https://www.nullpt.rs/devirtualizing-nike-vm-1 https://news.ycombinator.com/item?id=34285747 (121 comments)

Snapchat's API call obfuscation: https://hot3eed.github.io/snap_part1_obfuscations.html This one about TikTok was recently on the HN front page: https://www.nullpt.rs/reverse-engineering-tiktok-vm-1

See https://www.nullpt.rs/reverse-engineering-tiktok-vm-1

Quite a few ways, whether through device/session fingerprinting [1], in-app browser keystroke tracking [2], frequent third-party post requests [3], individiual app usage patterns [4], geo-tracking [5], dark-patterned user onboarding [6] and continual facial recognition [7]. A canary blog series kicked off by the company itself is worth keeping an eye on to see the 'myths' they want to debunk most scrupously (such as keytracking)[8]. [1]: https://www.nullpt.rs/reverse-engineering-tiktok-vm-1 [2]: https://krausefx.com/blog/announcing-inappbrowsercom-see-what-javascri… [3]: https://app.urlgeni.us/blog/new-research-across-200-ios-apps-hints-sur… [4]: https://www.nytimes.com/2021/12/05/business/media/tiktok-algorithm.htm… [5]: https://www.afr.com/technology/tiktok-admits-collecting-location-data-… [6]: https://au.reset.tech/uploads/resettechaustralia_policymemo_tiktok_fin… [7]: https://www.npr.org/2021/02/25/971460327/tiktok-to-pay-92-million-to-s… [8]: https://newsroom.tiktok.com/en-us/tiktok-truths-a-new-series-on-our-pr…

I'm sure that happens, but I haven't done any work with gyro data myself. There's similar logic for mouse cursor movements, there are libraries out there that will generate a natural looking curve that moves the cursor from one position to another, with imperfections that emulate human hand movement. > Why do we even need an actual device? We can emulate if we even need to and set our headers to look like we're coming from a device browser. This one is much harder, your browser, OS, and hardware leave a uniquely identifiable fingerprint (with Javascript enabled). A website can render some graphical pattern on a <canvas> or audio in an audio context, and the resulting output will have minute differences that originate from your rendering and audio pipelines. Check out: https://amiunique.org/fingerprint https://browserleaks.com/ https://fingerprint.com/ https://coveryourtracks.eff.org/ You can try to fake these, but it all depends on the sophistication of the target website. You can quickly end up in really deep rabbit holes: https://www.nullpt.rs/devirtualizing-nike-vm-1