Hook the app from the inside and watch it tell the truth.
Documentation describes how an app should handle a password, a key or a token. Instrumentation reads the value that was actually passed to the function. Mobexa attaches hooks to the running build, captures the real arguments at the moment of the call, and tests whether each defense engages when something tries to get past it.
The questions that only the live process can answer
These are the findings that survive a developer saying "but the code looks fine." Instrumentation does not read the code - it reads the call.
Cryptography as actually used
The real algorithm, mode, key length and IV passed to each crypto call. A correct library used incorrectly is one of the most common - and most invisible - mobile failures.
Where secrets actually rest
The exact values written to preferences, keystores and files, captured at the call site, so a token stored in plaintext is shown, not inferred.
Defenses under pressure
Root and emulator detection, anti-debug and tamper checks are invoked and challenged. A defense that can be hooked away in one line was never a defense.
Pinning that holds or folds
Certificate validation is exercised with an interception attempt. Mobexa records whether the channel broke as designed or quietly accepted the swap.
An honest boundary
Instrumentation is a test-environment technique, run against the artifact you submit inside Mobexa's controlled sandbox. It is not an agent embedded in your production app and it never touches your live users. Every hook that fires and every value it reads is written to the evidence record, so a result can be reviewed, reproduced and defended.
// hook fired on the real call, no app changes hook javax.crypto.Cipher.doFinal caller : com.example.vault.KeyService transform: "AES/ECB/PKCS5Padding" // ECB key.len : 16 source: hardcoded in.len : 48 out.len: 48 hook TrustManager.checkServerTrusted attempt : intercept-with-foreign-cert result : accepted // pinning bypassed => MASVS-CRYPTO-2, MASVS-NETWORK-1 raised
Evidence your engineers cannot wave away
A hooked call captures the caller, the method, the arguments and the outcome. That is not a heuristic to be debated - it is a recording of the app doing the thing. It maps to a MASVS control, carries a severity, and enters the same triage backlog as every other finding, so the conversation moves straight to the fix.
- Call-site evidence ties each finding to a precise method and caller.
- Bypass outcomes recorded as pass or fail, not as opinion.
- MASVS-mapped and routed into triage with full audit history.
Runtime instrumentation, answered plainly
What is the difference between dynamic analysis and runtime instrumentation?
Dynamic analysis watches the app from the outside - traffic, files, logs. Runtime instrumentation watches it from the inside, hooking individual methods to read the actual values passed to them. It is the difference between seeing that an encrypted request left the device and seeing which algorithm, key length and mode produced it.
Do you have to modify our app to instrument it?
No. Hooks attach to the running process; the build under test is the build you ship, unmodified and unrepackaged. That matters, because a security result is only meaningful if it describes the artifact your users actually install.
What can instrumentation prove that nothing else can?
Whether a defense truly fires. Apps routinely ship root detection, anti-tamper and certificate pinning that look correct in source and never engage at runtime. Instrumentation calls the defense, attempts the bypass, and records whether it held - turning a checkbox into evidence.
Is instrumentation safe to run against a production build?
It runs inside Mobexa's controlled environment against the artifact you submit, never against your live users or backend. The objective is to observe the app under test conditions, with every hook and result logged as evidence.
Find out whether your app's protections survive contact.
We will instrument one of your builds and report what the crypto, storage and anti-tamper calls actually do under test.