Where the interior of the phone gets read for the first time.
What the Foundry studies.
The Foundry studies modern mobile operating systems, examines advanced technique, and develops ways of reading platform behavior at the lowest layers still legible from outside a vendor.
Some findings become new VANTAGE capability. Others are published as field notes or given as talks, so the wider defensive community can work from the same map.
- 01Operating-system interiors
- 02Kernel and system execution paths
- 03Vulnerability classes and exploitation technique
- 04Reverse engineering of advanced actors and mobile malware
- 05System-level detection method
Sextant
Object-aware kernel reading.
Sextant is a live kernel memory reading and debugging instrument built inside the Foundry. It walks kernel structures on running systems or from captured images, so advanced technique can be observed at the object level rather than guessed at from raw bytes.
- 01Kernel object reading (tasks, ports, processes, threads)
- 02Memory interpretation and zone mapping
- 03Kernel integrity checks against expected state
- 04Controlled kernel modification where write primitives exist (research use only)
- 05Snapshot and offline dump reading
- 06Command line, scripting, and plugin surface
For people the advanced actors have already found.
The Foundry can, on occasion, take on inspections for organizations that believe they are the target of advanced mobile activity. Capacity is limited; a case being worked is never guaranteed.
- — Advanced mobile malware
- — Handset behavior that will not explain itself
- — Anomalies at the operating-system layer
- — Devices believed to be compromised
- — Residue that looks like exploitation
Occasional readings, in service of research.
Examples
malware samples, suspicious packages, iOS sysdiagnose bundles, Android bugreports, crash logs, forensic or diagnostic datasets.
Do not send classified material or anything you are not cleared to share.
- — A reading is never guaranteed
- — Submissions may inform ongoing research
- — Send only what you may lawfully share
- — Strip sensitive identifiers where you can