Xusheng Li

Overview

About I am a software developer at Vector 35 Inc., where I am one of the core developers of Binary Ninja and lead the development of its debugger, including its Time-Travel Debugging (TTD) integration.

News

Blog 2 months ago
Bringing Chinese Chess Master III: Jiangzu Back to Life
简体中文版 Chinese Chess Master III: Jiangzu (象棋大師 III將族) was a popular DOS Xiangqi game. Its developer's historical company profile claims 200,000 copies sold. I played a number of games against it when I was yong and won most of them. I'm an international Xi
Read more
Report
Blog 2 months ago
Rebuilding a Lost iOS Game: From Screenshots to Reverse Engineering to AI
My wife used to play an iOS puzzle game called Block Crush Blitz . When we wanted to install it on a new iPad in march 2026, we found that it was no longer available in the App Store. She liked the game, and it did not look too complicated to recreate. So
Read more
Report
Blog 2 months ago
Windows Age APIs Can Expose Your Date of Birth to Apps
TL;DR Windows' new age API is supposed to give an app only your age range The current implementation first obtains your date of birth, then calculates the range inside the requesting app's process The requesting process can intercept the token or DOB h2 i
Read more
Report
Blog 2 months ago
Bring Your Own Trusted Caller (BYOTC): A New Way to Exploit Vulnerable Windows Drivers (Part 1)
Bring Your Own Vulnerable Driver (BYOVD) is a familiar Windows attack technique: an attacker loads a legitimate, signed driver and abuses a flaw in it to gain kernel-level capabilities. Microsoft maintains a a href="https://learn.microsoft.com/en-us/windo
Read more
Report
Blog 2 months ago
How Zoom Detects Google Meet Without Microphone Access
TL;DR Zoom can notice that Google Meet, Teams, Slack, and other applications may be in a meeting and offer to start My Notes On macOS, Zoom monitors Control Center's sensor-indicators log stream The messages contain records such as mic Google Chrome (com.
Read more
Report
Blog 3 months ago
Microsoft Teams Can Detect Recording Apps and Notify Other Participants
TL;DR Teams has a feature that can detect third-party recording and AI note-taking applications during a meeting On Windows and macOS, it enumerates running processes every 30 seconds and compares their names with a classification table The local user see
Read more
Report
Blog 3 months ago
How Windows UCPD Grew from a 29 KB Registry Filter into a 196 KB Policy Engine
TL;DR I collected 38 UCPD.sys binaries representing 24 versions UCPD first shipped in August 2023, seven months before its public discovery It grew from a 29 KB browser-association filter into a 196 KB registry and process policy engine Later versions add
Read more
Report
Blog 3 months ago
Microsoft Paint and Photos Embed Server-Issued GUIDs as Invisible Watermarks in Locally-Generated Images
TL;DR Microsoft Paint supports both local and cloud image generation Paint and Photos also ship local AI models The two apps send the prompt to a remote server for moderation The server returns a GUID along with the moderated prompt The GUID is embedded i
Read more
Report
Blog 3 months ago
Windows' Performance Optimizer Is More Capable Than It Needs to Be
Earlier this month, a post on X went viral by claiming Microsoft had quietly slipped a spy into Windows 11: MICROSOFT ADDED A NEW BACKGROUND SERVICE TO YOUR PC IN WINDOWS 11. It is called Windows Health and Optimized Experiences. It starts automatically e
Read more
Report
Blog 3 months ago
How Sogou Browser Rewrites Search Affiliate Codes
I recently poked at Sogou Browser (version 13.9.6121.400 ) out of curiosity and found that it rewrites hundreds of affiliate codes in Baidu or Sogou search URLs. Specifically, there is a list of search affiliate codes hardcoded in the binary, and when one
Read more
Report
Show more news