Romain THOMAS

@rh0main@infosec.exchange
419 Followers
186 Following
24 Posts
Security engineer working on Android, reverse-engineering & obfuscation.
Websitehttps://www.romainthomas.fr
LIEFhttps://lief.re
open-obfuscatorhttps://obfuscator.re

The DWARF debug format is well-known for debugging executables,
but it is also an effective format for sharing reverse engineering information
across various tools, such as IDA, BinaryNinja, Ghidra, and Radare2.

In this blog post, I introduce a new high-level API in LIEF that allows the
creation of DWARF files. Additionally, I present two plugins designed to export
program information from Ghidra and BinaryNinja into a DWARF file.

https://lief.re/blog/2025-05-27-dwarf-editor/

(Bonus: The blog post includes a DWARF file detailing my reverse engineering work on DroidGuard)

Fuzzing Windows ARM64 binaries with a DBI and LLVM?
Here we go: https://www.romainthomas.fr/post/25-04-windows-arm64-qbdi-fuzzing/
Fuzzing Windows ARM64 closed-source binary | Romain Thomas

This blog post introduces coverage-guided fuzzing with QBDI and libFuzzer targeting Windows ARM64.

Romain Thomas

New updates in LIEF including better support for PE modifications and ARM64EC/ARM64X binaries.

Blog post: https://lief.re/blog/2025-02-16-arm64ec-pe-support/

PE Support Enhancements

This blog post describes updates and enhancements in the support of PE binaries by LIEF

LIEF

LIEF 0.16.0 is out featuring new (extended) capabilities like Dyld Shared Cache support, Assembler/disassembler, ...

https://lief.re/blog/2024-12-10-lief-0-16-0/

LIEF v0.16.0

LIEF 0.16.0 is out. This blog post highlights important changes and features

LIEF

I'm happy to share that LIEF (extended)
is now providing an API to disassemble code (backed by the LLVM MC layer).

This disassembler is integrated with other functionalities
like dyld shared cache support or DWARF debug info.

You can checkout https://lief.re/doc/latest/extended/disassembler/index.html for the details.

Disassembler — LIEF Documentation

Extracting liblockdown.dylib from visionOS dyld shared cache and running it
with a DBI on macOS?

Challenge accepted!

📖 Blog: https://www.romainthomas.fr/post/24-09-apple-lockdown-dbi-lifting/

🎞️ Demo: https://www.youtube.com/watch?v=5L05OE5mL2o

⌨️ Code: https://github.com/romainthomas/visionOS-liblockdown

Instrumenting an Apple Vision Pro Library with QBDI | Romain Thomas

This blog post demonstrates how to extract liblockdown.dylib from the visionOS dyld shared cache to be instrumented with QBDI on an Apple M1.

Romain Thomas
Rust bindings for LIEF

LIEF Rust Bindings

LIEF
lief - Rust

LIEF

LIEF v0.14.0

LIEF v0.14.0 release highlights

LIEF
Changelog — LIEF Documentation