Two Nations, One Bridge: A Reverse-Engineering Teardown of Türkiye's and Korea's National Tax Signers

National tax portals stopped shipping Java applets and ActiveX years ago — but the problem they solved didn't go away, so each country rebuilt the same thing: a small native "local helper" that runs a loopback server and bridges the browser to a smart card or certificate. This talk is a reverse-engineering teardown of two such clients from two countries — Türkiye's GİB e-İmza Aracı and the Korean Hometax signing helper (DreamSecurity's MagicLine-class NX module) — compared purely as architecture, with no weaponized exploitation.

We decompile both, map the browser-to-native attack surface, and reconstruct — byte-for-byte from IL — the serialization wire format one of them speaks to its server peer. The throughline is how two national authorities independently arrived at the same design, and where their trust boundaries, framing, and update mechanisms diverge. Audience takeaways are reusable RE recipes for any localhost-bridge client, not country-specific bugs. Every artifact is structural; nothing here requires an un-patched product.