Sanitized engineering notes from my independent UE4, Android game reverse-engineering, and ARM64 systems research.
I am an independent reverse-engineering researcher working with physical Android devices, ARM64 native binaries, UE4 runtimes, and custom GKI kernels. My current work focuses on runtime-structure reconstruction, emulation correctness, protected native control flow, memory consistency, authenticated protocols, and cross-version verification.
My work spans EL0 game and native runtime analysis together with EL1 Android kernel knowledge. The kernel work provides the memory, concurrency, and privilege-boundary foundation for reliable game reverse engineering.
The private work that motivated these reviews includes runtime-analysis tooling, binary-specific research artifacts, and security-sensitive kernel and driver code. This repository publishes the review methodology, failure modes, remediation principles, and regression strategy without publishing operational offsets, credentials, private keys, deployment details, or third-party data.
- Authorized Unreal Engine 4 binary and runtime-structure analysis
- ARM64 native component lifecycle, control-flow, and state reconstruction
- Runtime emulation, snapshot consistency, and version drift
- EL0/EL1 memory, concurrency, and privilege-boundary reasoning
- Android GKI 5.10, 5.15, 6.1, 6.6, and 6.12
- Kernel-driver memory safety, object lifetime, and failure handling
- Authentication, replay resistance, session separation, and update integrity
- Cross-version Linux kernel API and patch-context drift
All testing described here is limited to devices, kernels, binaries, services, and source code that I own or am explicitly authorized to test. Unless stated otherwise, this is self-directed work and is not conducted on behalf of my university.
| Date | Area | Note |
|---|---|---|
| 2026-07-30 | UE4 runtime analysis | Temporal consistency in emulated UE4 runtime analysis |
| 2026-07-30 | Native binary analysis | Systematic mapping of a protected ARM64 native component |
| 2026-07-30 | Control-flow analysis | Reconstructing dispatch and evidence graphs in protected ARM64 binaries |
| 2026-07-30 | Native binary analysis | Runtime state integrity in native security components |
| 2026-07-29 | Binary analysis | Authorized Unreal Engine 4 runtime analysis |
| 2026-07-29 | Protocol security | Authenticated kernel-to-service protocol review |
| 2026-07-29 | Patch engineering | Cross-version Android GKI patch verification |
The notes use the same review loop:
- Define the assets, trust boundaries, and owner-controlled test environment.
- Identify invariants that must survive concurrency, faults, disconnects, and partial failure.
- Trace state transitions rather than reviewing isolated functions.
- Compare the implementation against kernel or cryptographic API contracts.
- Convert each finding into a narrowly scoped remediation.
- Add a regression case for the original failure and nearby edge cases.
- Re-run the review against every supported kernel version or protocol state.
These documents are engineering case studies, not vulnerability advisories. They do not claim a CVE or vendor acknowledgement.
- Android Unreal Engine dumper research fork
- GKI KernelSU and SUSFS build maintenance
- Android GKI build automation
- OnePlus/Oppo/Realme SM8750 kernel build maintenance
- OnePlus SM8750 kernel builds
- GitHub: @Ray170910