iOS Reverse Engineering Consulting
mitmproxy, Frida, and binary analysis for lawful, defensible use cases: compatibility with your own product, recovery of a legacy codebase you've inherited, integration with a vendor that has no API.
- protocol discovery via mitmproxy and runtime instrumentation via Frida
- binary analysis for Swift and Objective-C iOS apps
- scoped, lawful reverse-engineering for compatibility, research, or personal use
Related work
How I accidentally became PureGym's unofficial Apple Wallet developer
Tired of fumbling with the PureGym app for 47 seconds every morning, I reverse-engineered their API to build an Apple Wallet pass that gets me in with a quick wrist scan. Along the way, I discovered their bizarre security theatre: QR codes that expire every minute while my ancient 8-digit PIN lives forever.
Read the article →
Debunked the "iOS is secure by default" myth in 90 minutes. Walked through real pentesting techniques, tools, and war stories from the security trenches.
The second part of a thorough introduction into iOS Security, from various pentesting techniques, to possible flaws to use-cases and tools.
In this talk we will briefly cover all layers of iOS security architecture, delve into secrets of Secure Enclave and discuss the most common mistakes and vulnerabilities to prevent them from happening in the future, as well as have a sneak peek into penetration testing done right.
An overview of various techniques of penetration testing as well as some theory on iOS security. Just because securing is harder than developing.
What clients say
"Vadim was instrumental to the success Epsy enjoyed on iOS, taking it from an idea on a Miro board to the highest rated and most downloaded app of its kind on the store."
James C. · Mobile Engineering Lead, Epsy
"We had a strict deadline, and Vadim managed to complete the job in time. He gave us meaningful feedback and suggested better approaches, not trying to blindly stick to our specification."
Founder · Pre-seed streaming service
"I can say with confidence that it will be difficult to find a better developer. Vadim is achievement-oriented, highly organized, with very good communication skills."
Alex Z. · Co-Founder, eda.so
Common engagements
Integrate with a vendor that won't ship an API
I scope the work to your own product or internal tooling, document the legal rationale before touching code, then reverse the protocol with mitmproxy and Frida. 1–3 weeks to a working client. The deliverable includes a change-detection harness so the integration tells you when the vendor's protocol has moved.
Assess your app's defence posture
Your app is being reverse-engineered in the wild. I review the threat model, recommend hardening measures, and hand over practical defences you can roll out.
Understand your own legacy codebase
Inherited an iOS codebase with a dead backend? I reverse-engineer your own app to tell you what it was doing.
Areas I cover
Pricing
Architecture reviews, hiring help, second opinions on that thing that's been bugging you.
Available nowFeatures, MVPs, migrations, firefighting. Minimum 5 days.
Available nowPriority support: review agency code, join architecture calls, catch problems before they ship.
Questions
What work won't you take?
Cloning a competitor's product. Bypassing license enforcement. Anything that would embarrass both of us if it appeared on the front page of a newspaper.
Is reverse-engineering legal?
Jurisdiction-dependent and use-case-dependent. I take work where the use case is clearly defensible: you own the device or software, you're building compatibility for your own product, you're doing coordinated security research, internal tooling, or clearly personal use.
Do you do bug bounty / coordinated disclosure work?
Yes, with clear scope, responsible disclosure terms, and an agreement that any writeup is coordinated with the vendor.
How do I get a quote?
Two paths. If you need speed, send me a detailed brief and I'll quote from it (usually within 48 hours). If you'd rather talk first, book a free 30-minute scoping call and I'll quote after. Most clients who pick the brief path land on the call anyway once we get into the specifics, but the door is open either way.
How quickly can you start?
Advisory calls can happen within days. For project work, I typically need 1-2 weeks notice to clear the calendar, though I keep some buffer for urgent firefighting. Check the availability badges above for current openings.
Do you work with early-stage startups?
Yes, from pre-seed to Series C and beyond. For very early teams, the advisory tier often makes more sense than project work: you get architecture guidance without committing to a large engagement before you've validated the product.
What's included in the day rate?
Everything: code, architecture decisions, code review, documentation, async Slack availability during working hours. No surprise add-ons. I bill for time spent working on your project, not for "thinking about it in the shower."
How do you handle timezone differences?
Currently in Vancouver (PST) with full overlap for North American teams. For UK and Europe, I'm online by their afternoon. For Gulf or APAC, we'd agree on overlap hours and handle the rest async. I've worked with teams from San Francisco to Dubai.
Where I've worked CV · LinkedIn
Need to reverse-engineer an iOS app or API?
Describe what you're working on, or book a free 30-min scoping call. I reply within 48 hours.
work@drobinin.com Book a free call →