Analyze suspicious samples in isolation.
Detonate evasive, RASP-aware samples without exposing real devices or production systems. Observe what a sample changes, stores, accesses, and communicates, then throw the device away.
Disposable, isolated, by design.
Run a sample in a device that is destroyed per session. Node agents bind loopback and nodes can be network-isolated, so a compromised guest reaches nothing it should not.
- Node or cloud sandboxes, torn down after each run
- Loopback-only agents and network-isolated nodes
- Snapshot before you detonate, restore after
Watch it talk.
Full traffic capture surfaces C2 and exfil, and live logs and metrics show the device react. Preserve the flows and indicators for later analysis.
- Hosted mitmproxy flows plus a reverse tunnel
- Live logs, CPU / memory / battery, and storage deltas
- Keep artifacts and indicators of compromise
Unpack native payloads.
Evasive samples hide in native code. Frida, lldb, and a guest-kernel gdb stub let you unpack and trace them even when the sample fights back.
- Frida and lldb for userland unpacking
- Kernel gdb for behavior below the app layer
- describe-ui and screen to watch what it does
Beat anti-analysis.
Many samples refuse to run where they can tell they are watched. Masked devices and native-arm stealth AVDs make them detonate as if on a real phone, and the MCP loop can drive triage with an LLM.
- Device masking and native-arm stealth AVDs
- MCP loop for LLM-automated triage at scale
- Deploy in cloud, on internal servers, or air-gapped
Build beyond real devices.
Spin up a device, drive it, inspect it. Self-hosted on your own fleet or in the cloud, with the SDK, CLI, and MCP your team already works in.