iOS Reverse Engineering Consulting
mitmproxy, Frida, and binary analysis for lawful, defensible use cases: compatibility with your own product, recovery of a legacy codebase you've inherited, integration with a vendor that has no API.
- protocol discovery via mitmproxy and runtime instrumentation via Frida
- binary analysis for Swift and Objective-C iOS apps
- scoped, lawful reverse-engineering for compatibility, research, or personal use
What clients say
"Vadim was instrumental to the success Epsy enjoyed on iOS, taking it from an idea on a Miro board to the highest rated and most downloaded app of its kind on the store."
James C. · Mobile Engineering Lead, Epsy
"We had a strict deadline, and Vadim managed to complete the job in time. He gave us meaningful feedback and suggested better approaches, not trying to blindly stick to our specification."
Founder · Pre-seed streaming service
"I can say with confidence that it will be difficult to find a better developer. Vadim is achievement-oriented, highly organized, with very good communication skills."
Alex Z. · Co-Founder, eda.so
Related work
How I accidentally became PureGym's unofficial Apple Wallet developer
Tired of fumbling with the PureGym app for 47 seconds every morning, I reverse-engineered their API to build an Apple Wallet pass that gets me in with a quick wrist scan. Along the way, I discovered their bizarre security theatre: QR codes that expire every minute while my ancient 8-digit PIN lives forever.
Debunked the "iOS is secure by default" myth in 90 minutes. Walked through real pentesting techniques, tools, and war stories from the security trenches.
The second part of a thorough introduction into iOS Security, from various pentesting techniques, to possible flaws to use-cases and tools.
In this talk we will briefly cover all layers of iOS security architecture, delve into secrets of Secure Enclave and discuss the most common mistakes and vulnerabilities to prevent them from happening in the future, as well as have a sneak peek into penetration testing done right.
An overview of various techniques of penetration testing as well as some theory on iOS security. Just because securing is harder than developing.
Common engagements
Integrate with a vendor that won't ship an API
I scope the work to your own product or internal tooling, document the legal rationale before touching code, then reverse the protocol with mitmproxy and Frida. 1-3 weeks to a working client. I also hand over a change-detection script you run on CI to spot vendor-side protocol changes before they break your integration.
Assess your app's defence posture
Your app is being reverse-engineered in the wild. I review the threat model, recommend hardening measures, and hand over practical defences you can roll out.
Understand your own legacy codebase
Inherited an iOS codebase with a dead backend? I reverse-engineer your own app to tell you what it was doing.
Pricing
Architecture reviews, hiring help, second opinions on that thing that's been bugging you.
Available nowFeatures, MVPs, migrations, firefighting. Minimum 5 days.
Available nowPriority support: review agency code, join architecture calls, catch problems before they ship.
Questions
What work won't you take?
Cloning a competitor's product. Bypassing license enforcement. Anything that would embarrass both of us if it appeared on the front page of a newspaper.
Is reverse-engineering legal?
Jurisdiction-dependent and use-case-dependent. I take work where the use case is clearly defensible: you own the device or software, you're building compatibility for your own product, you're doing coordinated security research, internal tooling, or clearly personal use.
Do you do bug bounty / coordinated disclosure work?
Yes, with clear scope, responsible disclosure terms, and an agreement that any writeup is coordinated with the vendor.
Can you reverse-engineer our own app if we lost the source?
Yes, this is one of the clearest legal use cases. Inherited codebase with a dead backend, acquired product with missing documentation, SDK you own but the original author left. I reverse the binary, document the logic it ran in production, and hand back a readable reconstruction.
How quickly can you start?
Advisory calls can happen within days. For project work, I typically need 1-2 weeks notice to clear the calendar, though I keep some buffer for urgent firefighting. Check the availability badges above for current openings.
Do you work with early-stage startups?
Yes, from pre-seed to Series C and beyond. For very early teams, the advisory tier often makes more sense than project work: you get architecture guidance without committing to a large engagement before you've validated the product.
What's included in the day rate?
Everything: code, architecture decisions, code review, documentation, async Slack availability during working hours. No surprise add-ons. I bill for time spent working on your project, not for "thinking about it in the shower."
We're in a different timezone. Will that slow things down?
I'm currently in Vancouver (PST), with full overlap for North American teams. For UK and Europe, I'm online by their afternoon. For Gulf or APAC, we'd agree on overlap hours and handle the rest async. I've worked with teams from San Francisco to Dubai.
Areas I cover
Where I've worked CV · LinkedIn
Need to reverse-engineer an iOS app or API?
Tell me what you're working on. I reply within 48 hours.
work@drobinin.com