Reversals

A complete static reversal of MICO 4.2026.04.23.1145, the eyecon caller-ID and spam-blocker app. The e-auth credential scheme reversed end to end so any request it makes can be forged by hand, 50 endpoints across 36 hosts, the complete clientId issuance chain, 21 database tables, 96 activities, and five ARM native libraries with three reversed including a recovered XOR string decryptor and a cipher seeded from the wall clock. Seven parts covering the attack surface, the backend, the data layer, every feature flow, and every first-party package in the APK.

A complete technical breakdown of the Silent Net family. Fabric mod loader entry, reflective Mojang access token theft, C2 resolution from a Polygon smart contract, DNS over HTTPS to defeat blocking, a ZIP payload hidden in a PNG chunk called hIds, and handoff to a Python stage. Full obfuscation taxonomy, deobfuscated code for every stage, and IOCs.

A walk through the full stack of fud.su, a subscription crypter served as a website. The auth flow and the session internals, the credit system, the Bitcart crypto payments, the crypt builder, the chunk by chunk JavaScript load plan, an admin story told through a compiled but undeployed build artifact, and a complete API map.

A reversal of the GameSafe ANO anticheat stack inside the Garena Free Fire APK: the com.ano.gshell loader, ROT-5-obfuscated Java shim, and the libanogs/libanort/libGGP native trio.