Mobile security is where the two halves of this work meet: taking an Android or iOS build apart with Frida and Ghidra, and writing the runtime checks that have to survive the same treatment. The sections below cover reverse engineering, protection mechanisms and malware analysis.
The other side of the same work: RASP-style runtime checks, root and jailbreak detection, hook and tamper detection, integrity and signature verification, and the obfuscation and anti-debugging that make all of it expensive to remove. Client-side checks slow an attacker down rather than stopping one, and they are designed that way.
Turning an artifact back into behavior: APK, Dex and Smali on one side, Mach-O on the other. Static analysis to find the check that matters, dynamic instrumentation to confirm it, and a written result another engineer can reproduce from the same evidence.
Reading what a sample does rather than what it claims: droppers and loaders, overlay and accessibility abuse, and the fraud flows built on top of them. The output is a detection or a hardening change, not a report that ends in adjectives.
Frida harnesses and scripts that attach to a running app, step past certificate pinning and client-side gates, and let a test observe real behavior on a rooted or jailbroken device instead of guessing from the disassembly.
Kernel and network level engineering with eBPF, TUN stacks and raw sockets, plus authorized assessment: threat modeling, reverse engineering and reports that carry reproducible evidence instead of adjectives.
Reading the artifact when source is not available: decompilation, cross references and control flow across Mach-O and Dex.
Watching and changing behavior at runtime: hooking, tracing, debugger attachment and stepping past client-side checks on a rooted or jailbroken device.
Intercepting what the app actually sends and inspecting it at packet level, including how it behaves under TLS pinning.
Static and dynamic methods for finding what a client trusts, proving it, and closing it.
Mobile clients and the instrumentation used to inspect them.
Available for backend architectures, custom web & mobile apps, mobile security and reverse engineering work, and AI agent systems development.