Static analysis
Reading the artifact when source is not available: decompilation, cross references and control flow across Mach-O and Dex.
- Ghidra
- IDA
- jadx
- radare2 / rizin
Tools I use on mobile and binary targets, grouped by purpose.
Reading the artifact when source is not available: decompilation, cross references and control flow across Mach-O and Dex.
Watching and changing behavior at runtime: hooking, tracing, debugger attachment and stepping past client-side checks on a rooted or jailbroken device.
Intercepting what the app actually sends and inspecting it at packet level, including how it behaves under TLS pinning.
Build, deploy and packaging chain on both platforms: device provisioning, APK decoding and repacking, and static triage of a build before any of the above.
Available for backend architectures, custom web & mobile apps, mobile security and reverse engineering work, and AI agent systems development.