Videos

Watch how it works.Eight short tutorials.

Each video walks through the checks with the real code, what the exploit gives an attacker, and how it is evaded. Captions are burned in; narration is synthetic. Pair them with the checks reference for the full detail.

Checks reference →

Tutorials

Start with why.Then go check by check.

Chapters (12)

iOS + Android · 4:32

Package overview

The whole package in one video: what it checks, how signals become a status, how to use it, how it compares, a live demo, and where it stops. Numbers and charts are generated from the package's own data.

22 signals by category and platform
From signals to status
API, install and requirements
Comparison and live iOS Simulator demo

Download MP4 ↓Transcript (.vtt) ↓

Chapters (10)

iOS + Android · 4:20

Why jailbreak and root?

The motives of owners and attackers, the pros and cons for the device owner, and how your app should respond when it cannot see intent.

Owner motives vs attacker motives
Pros and cons for the device owner
State is not intent
Proportionate response + server-side attestation

Download MP4 ↓Transcript (.vtt) ↓

Chapters (10)

iOS · 4:44

Detecting iOS jailbreaks

The four jailbreak signals, what each inspects, and what modern rootless jailbreaks do to them.

Paths, URL schemes, symlinks, writable system
Rootless blind spots
From signals to status

Download MP4 ↓Transcript (.vtt) ↓

Chapters (11)

Android · 5:13

Detecting Android root

Seven root-related signals, from the su binary to Magisk mounts and the bootloader, plus what the Magisk DenyList does on a real rooted phone.

Seven signals
Observed on a rooted OnePlus
The bootloader build setting

Download MP4 ↓Transcript (.vtt) ↓

Chapters (10)

iOS + Android · 4:48

Detecting tampered apps

The repackaging pipeline and the four opt-in tamper signals: signing certificate, installer, Team ID and encrypted binary.

Repackaging pipeline
Opt-in configuration
How each check is evaded

Download MP4 ↓Transcript (.vtt) ↓

Chapters (11)

iOS + Android · 5:06

Debuggers and emulators

How debuggers, the Android emulator and the iOS Simulator are detected, why they are context signals, and how to set the policy.

P_TRACED and the Debug API
Emulator fingerprinting
Policy settings
Live demo on the iOS Simulator
Real runs

Download MP4 ↓Transcript (.vtt) ↓

Chapters (7)

iOS + Android · 3:03

Hooking frameworks beyond Frida

Xposed and LSPosed on Android, and tweak loaders such as Substrate, libhooker and ellekit on iOS.

Maps, class loaders, call stack
Loaded-image needle list
How they are evaded

Download MP4 ↓Transcript (.vtt) ↓

Chapters (11)

iOS + Android · 5:02

What we do with Frida

How Frida is detected on Android and iOS, and how the example app embeds Frida Gadget to prove it on a stock iPhone.

Detection on both platforms
The opt-in Gadget build
Real device results

Download MP4 ↓Transcript (.vtt) ↓

Note

Code on screen is condensed from the native sources, and the maps and mount listings are illustrative. The checks reference is the source of truth. These are client-side risk indicators, so pair them with server-side attestation for high-value flows.