Engineering notes, releases, and thinking on static and dynamic Android security analysis.
A per-site WIN/MATCH/LOSE scorecard for Android TLS cert-unpinning, measured on a non-root moto e40 (API 30). Real class and method descriptors, real A/B flow counts, including the rows where we lose to Frida.
Read more →A from-scratch x86-64 and AArch64 inline detour engine in Rust, with its dependency list closed to exactly iced-x86 and thiserror. How BlockEncoder re-encodes relocated prologues, and the one instruction window we can't close.
Read more →Forcing checkForRoot() to 0 on an unrooted phone makes the hook "work" while proving nothing, because the device would answer "not rooted" anyway. The fix is a roughly 700-byte stub APK that makes the anti-tamper bypass real.
Read more →A post-mortem of Rutken's "mechanical intelligence" program: a typed evidence graph meant to derive what an analyst notices, with no model, no embedding, no learned scorer. 755,842 claims produced, and what went wrong.
Read more →To return-spoof a framework getter like Settings.Secure.getString you need the (dex_pc, return_register) coordinate, but that is a property of the compiled artifact and varies per OEM ROM. Here is how we read it instead of guessing.
Read more →Frida is great, and it's free in Rutken. But hardened apps detect it and kill themselves. Here's the in-house engine we built for the targets that fight back: no-repack, anti-tamper, on real hardware.
Read more →A complete, practical guide to Android APK security analysis in 2026: static analysis, software composition analysis, dynamic analysis with Frida, TLS unpinning, and correlating SAST and DAST findings. Every static step is free.
Read more →How taking an APK apart actually goes: the tool-by-tool human workflow versus one correlated pass, with a side-by-side flowchart.
Read more →Why speed is a feature and not a footnote, and why static and dynamic analysis belong in one engine instead of two tools you switch between.
Read more →