https://bsky.app/profile/hexproofdev.bsky.socialhttps://bsky.app/profile/hexproofdev.bsky.social/post/3mmpvpm54os2w1/ droidsaw's DEX and Hermes decompilers are verified against first-party disassemblers via bit-identical bytecode roundtrips. Effectively, droidsaw turns closed-source Android apps into a bidirectional xref graph, with semgrep, VEX, Frida, R8 rec, and TruffleHog support.26 May 2026 02:04 +0000at://did:plc:tyi6qo7x3ngibryn5qalntkg/app.bsky.feed.post/3mmpvpm54os2whttps://bsky.app/profile/hexproofdev.bsky.social/post/3mlz3yacwrc2c1/ Demonic (CVE-2022-32969) hit MetaMask's browser extension — key material persisting beyond its intended lifecycle. MetaMask said in 2022 it didn't affect Mobile.17 May 2026 00:25 +0000at://did:plc:tyi6qo7x3ngibryn5qalntkg/app.bsky.feed.post/3mlz3yacwrc2chttps://bsky.app/profile/hexproofdev.bsky.social/post/3mkp63etww22sCerberus is one of the longest-running stalkerware apps on Android. We reversed their ecosystem, and document why Google must remove it from the Play Store, AdMob, and FCM. tl;dr https://hexproof.dev/datagrams/cerberus-on-play/ long https://hexproof.dev/datagrams/cerberus-stalkerware-re/ #reverseengineering #android #stalkerware30 Apr 2026 08:11 +0000at://did:plc:tyi6qo7x3ngibryn5qalntkg/app.bsky.feed.post/3mkp63etww22shttps://bsky.app/profile/hexproofdev.bsky.social/post/3mj6gfqzcyk2pHello world, I'll be posting about security and systems performance on @hexproof My first post compares the recently leaked Claude Code source code with other harnesses: https://hexproof.dev/datagrams/fossil-record-harness-engineering/10 Apr 2026 22:59 +0000at://did:plc:tyi6qo7x3ngibryn5qalntkg/app.bsky.feed.post/3mj6gfqzcyk2p