@df_forensics profile picture
Dataflow Forensics @df_forensics
Joined October 2022
  • Tweets 14
  • Following 3
  • Followers 613
Photos and videos
Apple open-sourced Darwin's #XZone allocator in libmalloc-792 late last year. #DFF Co-Founder & CTO Jonathan Levin (@Morpheus______) breaks it all down, expanded from his book Disarming Code: type isolation, the xzm_malloc() path, and walking the heap with memento(j). df-f.com/blog/darwin-libsyst… #DFFenders Blog

Darwin: libsystem_malloc .dylib and XZone

Darwin’s new allocator, XZone, is now part of libmalloc and in open source. In this post, we are providing an analysis of XZone that is an expanded version of an excerpt from Jonathan Levin’s book...

df-f.com
28
132
7,730
New site. Same mission. Check out df-f.com And we're hiring! If you're passionate about security forensics and mobile threat detection, explore careers with us df-f.com/careers #DFF #DFFIND #DFFENDERS #hiring #JoinDFF

Dataflow Forensics | Mobile Threat Detection for Government

Dataflow Forensics builds consent-based mobile threat detection systems for government and national security organizations. Flagship product DFFIND detects threats outside the mobile OS sandbox.

df-f.com
10
44
3,695
SPTM - The Last Bits: Concluding our deep and pioneering research into #SPTM and #GXF df-f.com/blog/sptm4 #DFF #DFFENDERS

SPTM - The Last Bits

The next iteration of DFF’s SPTM deep dive. This post aims to broaden the discussion and fill in the full picture of SPTM.

df-f.com
30
97
13,760
Dataflow Forensics retweeted
sparkey@iBSparkes
15 Oct 2025
Our newest @dfsec_com blog post is live, thanks to @tomitokics from @df_forensics for putting this together :-) blog.dfsec.com/ios/2025/10/1…

Depicting an iOS Vulnerability

Dataflow Security blog

blog.dfsec.com
1
40
166
36,867
Another guaranteed bestseller by our own Co-Founder and CTO
J@Morpheus______
13 May 2025
"DisARMing" code - an exploration into systems programming, #debugging & #reverseEngineering on #Linux/#Android/#Darwin and #Aarch64! 510 pages #book in COLOR(!) NewDebuggingBook.com/ for details, because there's more to detail than the margins of a Twitter message can hold.
4
25
2,068
Apple alerted iPhone users in 117 countries about spyware attacks, but many impacted users received no notification. DFFIND provides government agencies with a fast, scalable way to inspect devices simultaneously. Reach out: business@df-f.com #DFF
1
2
44
17,276
Our latest blog post: Tracing Back to the Source | #SPTM Round 3 #TXM #iOS #macOS #DFF df-f.com/blog/sptm3

Tracing Back to the Source | SPTM Round 3

Our goal at DFF is to reveal any threats on mobile devices, and that requires us to keep up to date with every single version of Android and iOS, including the beta and "Developer Preview" phases....

df-f.com
2
51
113
22,653
'tis the Season - the latest #DFF blog post unpacking insights about anticipated releases of new Apple OS versions. df-f.com/blog/tistheseason

‘tis the Season

Another year, another set of *OS updates. Apple has released the initial beta versions of iOS/iPadOS/tvOS 18, macOS 10.20 (="15"), watchOS 10, and VisionOS 2. Security researchers and reverse...

df-f.com
16
57
12,194
Dataflow Forensics retweeted
POC_Crew
@POC_Crew
7 Mar 2024
[Zer0Con2024] SPONSOR Thank you @df_forensics for sponsoring the con! Looking forward to meeting you all soon "Leveraging 0-days to detect the most sophisticated cyber-attacks on mobile devices." #Zer0Con2024
5
15
3,816
Will macOS merge with iOS? #iOS #macOS #DFF #DFFENDERS #Debugging df-f.com/blog/macosandiosmer…

Will macOS and iOS merge?

Our goal at DFF is to reveal any threats on mobile devices, and that requires us to keep up to date with every single version of Android and iOS, including the beta and "Developer Preview" phases....

df-f.com
3
14
67
13,803
Our in-depth exploration of #SPTM and #TXM continues df-f.com/blog/ios-17round2

iOS 17: New Version, New Acronyms | Round 2

Our goal at DFF is to reveal any threats on mobile devices, and that requires us to keep up to date with every single version of Android and iOS, including the beta and "Developer Preview" phases....

df-f.com
2
29
87
19,028
Our very first blog post: “iOS 17, new version, new acronyms” #iOS17 #DFF #sptm #txm df-f.com/blog/ios17

iOS 17: New Version, New Acronyms

Our goal at DFF is to reveal any threats on mobile devices, and that requires us to keep up to date with every single version of Android and iOS, including the beta and "Developer Preview" phases....

df-f.com
50
158
40,557
Load more