When the source isn't available
Apps, binaries, firmware and APIs don't always come with documentation. Sometimes the vendor is gone, the original developer left no notes, or you need to know exactly what a piece of software is doing before you trust it. That's the work we do.
We take software apart methodically — static analysis, runtime instrumentation and network capture — and turn the findings into a plain-English report: what it does, how it communicates, where it is weak, and what to change. Every claim is backed by evidence you can inspect.
What we reverse engineer
Authorised analysis of software you own or have permission to test
Android app analysis
APK teardown, manifest and permission review, decompilation, resource extraction and tracking of what an app actually sends. Useful for due diligence, legacy handover and privacy checks.
iOS app analysis
IPA and Mach-O inspection on test builds and your own devices: class and API usage, embedded frameworks, storage behaviour and network traffic. Authorised builds only.
Binary & firmware teardown
Native desktop binaries, shared libraries, embedded firmware images and device dumps. Strings, structure, call flow and configuration recovered into usable documentation.
Protocol & API analysis
Undocumented APIs and wire protocols decoded from captures and client behaviour: request/response schemas, authentication flow, encoding and edge cases — documented well enough to build against.
Interoperability & data recovery
Getting your data out of a closed app or making two systems talk. File formats, local databases, sync logic and export paths recovered without needing the vendor's cooperation.
Security review of your own app
Hardcoded secrets, insecure storage, exported components, weak crypto, certificate handling, backend trust issues and data leakage. Practical findings with fixes, not a scanner printout.
Malware & suspicious software triage
Analysis and behaviour reporting on a suspicious file, app or installer — what it does, what it contacts, what it persists. We analyse and report; we don't author malicious code.
Legacy system documentation
An old internal tool nobody understands, with the original author long gone. We reconstruct the behaviour and produce documentation so it can be maintained, replaced or migrated safely.
How the work runs
Slow where it matters, scripted where it doesn't
1. Scope & authorisation
We confirm in writing what is being analysed, who owns it and what the output will be used for. No authorisation, no work. NDAs are welcome and often necessary.
2. Static analysis
Unpacking, decompilation, resource and configuration review, string and reference mapping. We establish the structure before touching runtime behaviour.
3. Dynamic analysis
Running the software in a controlled environment with instrumentation and traffic capture to confirm what static analysis suggested — and to find what it missed.
4. Evidence & report
A written report with reproducible evidence, severity ratings, affected components and remediation guidance. We walk you through it on a call and answer follow-up questions.
What you receive
Findings you can hand to a developer, a lawyer or a board
A written report
Scope, method, findings and evidence, written for humans. Technical detail in appendices for the engineers who need it.
Reproducible evidence
Captures, decompiled excerpts, hashes and command logs — enough for another analyst to verify the same result.
Remediation guidance
Specific fixes, ordered by risk and effort. Where useful, we quote the implementation work separately.
Authorisation and ethics
We work only on software you own, software you have written permission to analyse, or your own devices and accounts. Before starting, we agree the scope in writing.
- We do: security reviews, interoperability work, data recovery, legacy documentation, malware triage, due-diligence analysis and authorised research.
- We don't: bypass DRM or licensing to enable piracy, access accounts or systems without permission, steal source code or data, build malware, or help circumvent a platform's security for unauthorised use.
- Sensitive work: handled privately, under NDA where required, with findings delivered only to the commissioning party.
If you're unsure whether your intended use is permitted, describe the situation on a call. We'll tell you honestly what we can and can't do.
The toolchain
We use established, well-understood tools rather than a single push-button scanner — and we write custom tooling where the standard tools stop.
Android: jadx, apktool, Frida, adb · iOS: LLDB, Frida, class-dump, otool · Native: Ghidra, rizin, IDA-compatible workflows · Network: mitmproxy, Wireshark · Plus: our own analysis and evidence tooling.
Related work: competitor teardowns from public sources and custom app development — the same understanding, applied to building something new.
Need to know what something is doing?
Describe the app, binary or protocol you need understood, and what you're trying to achieve. We'll tell you what's feasible, what it takes, and what it will cost.
Request an analysis