Pau Oliva

Telecommunications engineer, sysadmin, developer, security enthusiast, open source advocate with a strong passion for Android devices and chiptune music lover.

[Mobile Hacker @androidmalware2]

DroidRun brings AI-driven automation to Android:
✔ Auto-fill OTP codes
✔ Automate app/device initial setup
✔ Security/malware testing with #Frida running in the background
✔ Automate food orders & shopping
https://t.co/2MiSffCzRp by @droid_run

[Frida @fridadotre]

Frida 17.4 introduces Simmy, a new backend for Apple’s Simulators on macOS.

Spawn, attach, and instrument apps — just like on a real device.

[Pau Oliva @pof]

Dropping the source code for OG IOLI-crackmes here, 18 years later 😅

https://t.co/nrdEfjFKL7

[Pau Oliva @pof]

@Jahaudant Right now it only supports GAN cubes, as it's using gan-web-bluetooth library underneath. I'll try to add support for more smartcubes when I have some free time.

[Pau Oliva @pof]

And in case you were wondering, I used A-Instant to create the previous tweet 🤪 – consider it a sneak peek "A-I" did there.

[Pau Oliva @pof]

Introducing A-Instant: an AI-powered text assistant for Mac that works in any app! Highlight text, double-tap your trigger key, enter a prompt and get instant AI-powered edits or summaries. Supports multiple AI providers & local models. Open source & free! https://t.co/S36Rd4YAdp

[Pau Oliva @pof]

🚀 Just launched Cubedex – a new smartcube alg trainer to dril your algs like a pro! 🎉

Cubedex is a Progressive Web Application (PWA) that connects to your Gan smartcube using Bluetooth.

🧩 Try it out now: https://t.co/IFNN7BrviY
#cubing #speedcubing #GANcube #CubeDex

[IOActive, Inc @IOActive]

Check out Pau Oliva's, Senior Security Consultant at IOActive, talk on retro game emulation at @BarcelonaBsides tomorrow, 30 May! Pau's talk kicks off at 1pm.

[BSides Barcelona @BarcelonaBsides]

Please welcome @pof from @IOActive to our lineup. He will dive deep into the fascinating world of retro game emulation, explaining techniques to hack emulators to enhance classic games with modern features.

Tickets 👉https://t.co/ISPbWFpSYe
#BSidesBCN24

[Pau Oliva @pof]

@double_somer Hello! Athena Cup was awesome and we had a lot of fun, thanks for the warm welcome and for fighting with us, it was a pleasure to play wit you and all the other Osaka players 🙏 Hopefully we can fight with our main characters very soon! 🥊

[Pau Oliva @pof]

@vsnikaiten @Mattsun_Ken @Kan_Sho_NPO yes, Yogaboy is organizing teams 👍👍👍

[Pau Oliva @pof]

@vsnikaiten @Mattsun_Ken @Kan_Sho_NPO こんにちは👋 あなたとチームを組めることをとても嬉しく思います！🥊

Hello 👋 I will be super grateful to team with you! 🥊

[Pau Oliva @pof]

@_EL_KOZUKIODEN @MikadoCenter @RickiTTT @yogaboy2X @sete_kitt @vins2X @Marcade18 por supuesto que si 🤜🤛🕹️

[Krzysztof Okupski @exminium]

New blog on exploring AMD Platform Secure Boot including common misconfigurations and implementation issues. Enjoy the read at https://t.co/TvrSs2LBwZ #AMD #Firmware

[Mobile Hacker @androidmalware2]

BLE spam but for adult toys

Using Flipper Zero or nRF Connect app, it is possible to send Bluetooth LE advertisement packets (without being paired) to adult toys in vicinity and make them all vibrate.
It is also possible to start Denial of Pleasure by continuously broadcasting the stop packet
https://t.co/NoDKchFQKg by @whid_ninja

[Maddie Stone @maddiestone]

I just enabled MTE on my new Pixel 8!! 😁🔥

Check out Mark's blog on how to enable MTE on the Pixel 8 and Pixel 8 Pro: https://t.co/dVoguAns9g

[Seth Jenkins @__sethJenkins]

https://t.co/OzXAC1tC3g
just derestricted. Potential untrusted_app -> kernel r/w 😬 Fix is not on any end-user devices AFAIK but fixes are in OEM's hands.

[Maddie Stone @maddiestone]

💫 Here are my slides from my @BSidesCbr Keynote: "When Exploits Aren't Binary" 💫

https://t.co/TNRqmXFDux

[Seth Jenkins @__sethJenkins]

I just released a blog post on an Android ITW exploit chain: https://t.co/s0YZJ3maYo

A big thanks to Google TAG and the other members of Project Zero who participated in the creation of this blog post and analysis of the chain!

[Mishaal Rahman @MishaalRahman]

Android 14 blocks downgrading apps through the 'adb install'/'pm install' shell commands, unless the app is marked as debuggable.

Previously, the May 2023 security release included a patch that only blocked downgrading system apps to a version older than the one preloaded on the system image.

However, starting in Android 14 Beta 5.2, this applies to all apps, as shown below. I can confirm this was only introduced in a 5.X release, as I was able to downgrade both the WhatsApp and Reddit apps using the '-d' flag on Android 14 Beta 5 but was no longer able to do so after updating to Android 14 Beta 5.3.
According to one tipster, they first saw this behavior in Beta 5.2, which is why I'm saying it's Beta 5.2+. Also, since the One UI 6 beta is based on the latest Android 14 source code, it is also affected by this change.

Now in order to downgrade a non-system app, you'll need to either fully uninstall the app and then install the older version afterward or be sure always manually install the app using the --enable-rollback flag so you can use Android's built-in rollback manager feature.

This change has its benefits, of course. Older versions of apps can have security issues or just not use the latest security/Android feature. Plus, generally it's not recommended to downgrade an app without clearing its data, as it can cause issues with mismatched settings/databases. That's why it makes sense why this restriction doesn't apply to apps marked debuggable, so that developers can continue to downgrade apps for testing purposes.

(Thanks to @Fasten_M and Moshe E for the tip!)