Reverse engineering & API analysis
Reverse engineering web and on-chain systems
A lot of useful work is just figuring out how a system behaves from the outside: what it loads, what it calls, how the pieces fit. Three examples: rebuilding a marketing tracking setup from its live container, the pivots I put into reconkit to cluster related sites, and decoding on-chain router calldata for a trading engine.
Reconstructing a tracking container
Google Tag Manager publishes a container as a single JavaScript file at a known URL. It's minified and not meant to be read, but it's all there. I pulled the published container and worked through it to build a full tracking plan: every tag, what triggers it, and which vendor it reports to. The one I mapped was wiring up a major social-ad pixel and its server-side conversions API, a search-ad and analytics stack, a couple of short-video and social pixels, and a session-analytics vendor, across roughly a hundred conversion-related references and custom variables.
The reason to do it from the container is that the container is the ground truth. Marketing docs tell you what's supposed to fire. The container tells you what actually fires, including the tags nobody remembered adding.
Pivots: is this one site, or a network?
reconkit's intel pass is about linking sites that are trying to look unrelated. It pivots on signals a site leaks without meaning to: the analytics and ad IDs in the page, the hash of the favicon, and the certificate history. Two "different" funnels that share a tracking ID or serve a byte-identical favicon are usually the same operator, and clustering on those signals shows it. It's all passive, the same requests a browser makes loading the page, so it reads like normal traffic because it is.
def favicon_hash(...): ... # mmh3 hash of the favicon; matches reuse across sites
def tracking_id_pivot(...): ... # reverse-lookup analytics / ad IDs to co-hosted domains
def sourcemap_exposure(...):... # exposed .map files that leak original source
def grade_headers(...): ... # security-header posture, gradedDecoding what a contract call is really doing
On the on-chain side, I built a trading engine on Base that has to understand transactions it didn't create. That meant real reverse engineering: pulling verified ABIs and struct layouts from Sourcify, deriving liquidity-pool addresses with CREATE2 instead of trusting a lookup, and decoding the packed calldata of a Universal Router swap, which crams a sequence of commands and their inputs into one blob, into the actual list of operations so the engine can simulate it before acting. Same skill as reading a minified container: take an opaque artifact and work out what it means.
The tracking-container work used a publicly served file and my own or my employer's container. The pivots in reconkit are passive and browser-equivalent. The on-chain decoding is of public contract bytecode and calldata. None of it involved unauthorized access.