Device access should not decide how deep you go.
Root-level access, kernel visibility, and snapshots to move faster from crash to clarity. Return to the exact device state behind a finding and validate whether it is reproducible, exploitable, or worth going deeper.
Inspect below the app surface.
Kernel-level visibility shows what happened underneath the process. Attach a guest-kernel gdb stub whose breakpoints freeze the whole VM, unaffected by any app-level anti-debug.
- Guest-kernel gdb stub with nokaslr and vmlinux symbols
- On-device lldb for native stepping
- strace, ftrace / kprobes, and bpftrace with root
Turn crashes into validated paths.
A crash matters only when you can reproduce it. Snapshots return you to the same device state in minutes so you can branch into variations without rebuilding the setup.
- Snapshots and microsnapshots to capture crash state
- Branch test paths without losing the baseline
- Exploit-Research iOS mode with a writable filesystem
Trace execution as it unfolds.
Follow processes, system calls, and device interactions while behavior runs. Frida Stalker and Interceptor instrument userland; the kernel images open everything below it.
- Frida Stalker and Interceptor for userland tracing
- cuttlefish-debug and cuttlefish-debug-kernel images
- Research notes on debugger and kernel-patch limits in-repo
Use the tools you already trust.
Inspect filesystems, traffic, processes, and system activity with your own stack, and connect research workflows through the API and scripting.
- Frida, IDA Pro, Ghidra, Burp, Xcode, Android Studio
- Python and TypeScript SDKs and a scriptable CLI
- MCP for LLM-driven triage and exploration
Build beyond real devices.
Spin up a device, drive it, inspect it. Self-hosted on your own fleet or in the cloud, with the SDK, CLI, and MCP your team already works in.