Alphyn is a Runtime Application Self-Protection SDK that ships inside your app. It detects rooted and jailbroken devices, Frida and hooking frameworks, debuggers, emulators and repackaged builds, then responds on the device while the attack is still running.
The same checks, the same policy and the same dashboard for your Android and iOS builds.
No new infrastructure
Protection runs in the app process. Nothing to deploy at the network edge, nothing to re-architect.
Response on the device
Log, degrade or terminate the session the moment a runtime threat is confirmed, offline included.
Runtime protection that lives inside the app
Runtime Application Self-Protection is security that ships as part of the app binary rather than in front of it. A mobile RASP SDK sees what the app sees: the process it runs in, the device it was installed on, and the code that is actually executing. That is the only vantage point from which a rooted phone, an injected hooking library or a patched build is visible at all.
Perimeter tooling never gets that view. A WAF inspects requests that already left a compromised device, and a store review happens once, long before an attacker ever touches the binary. Once your APK or IPA is on someone else's hardware, they own the runtime. Android RASP and iOS RASP exist to make that runtime observable and defensible.
What each layer can actually see
WAF or API gateway
A request that already left a device you do not control
App store review
One snapshot of the binary, taken once, before release
Mobile RASP
The live process, the device state and the code executing right now
The runtime attacks it is built for
Dynamic instrumentation
Frida, Xposed and LSPosed attach to a live process and rewrite function behavior in memory. Nothing on the network ever sees it.
Rooting and jailbreaking
Magisk on Android, palera1n and Dopamine on iOS strip away the OS sandbox guarantees your app quietly depends on.
Repackaging and resigning
An attacker decompiles the APK or IPA, patches one check, signs it again and republishes it on a third-party store.
Debugger attachment
A live debugger steps through your logic, reads secrets straight out of memory and flips branches at will.
Emulators and device farms
Emulators, simulators and cloud phones let a single operator drive thousands of scripted fake sessions.
Traffic interception
Pinning bypass tooling drops a proxy between your app and your API, turning encrypted calls back into cleartext.
Android RASP and iOS RASP, from one SDK
The two platforms fail in different ways, so they get different checks. What stays identical is the policy you write, the telemetry you receive and the console you read it in.
Android
Android mobile RASP
Android gives attackers an open toolchain: a rootable OS, a decompilable APK and a mature ecosystem of instrumentation frameworks. Android RASP closes that gap from inside the process, on every device your app installs onto.
Magisk, Zygisk, KernelSU and su binaries, including the DenyList and Shamiko style modules built to hide from ordinary checks.
02
Hooking framework detection
Frida servers and gadgets, Xposed, LSPosed, EdXposed and Riru injected into your process at runtime.
03
Repackaging and integrity
APK signature, signing certificate and DEX checksum verification catch patched, cloned and republished builds.
04
Emulator and cloud phone
Android emulators, virtualized device farms and cloud phone services used to script abuse at scale.
05
Debugger and tracing
ptrace attachment, JDWP debuggers and native tracing against the running process.
06
Overlay and screen capture
Screen recording, tapjacking overlays and accessibility services driving the interface on the user's behalf.
iOS
iOS mobile RASP
iOS is harder to reach and far more valuable when reached. Rootless jailbreaks, sideloading and purpose-built bypass tweaks mean App Store review is a starting point, not a guarantee. iOS RASP verifies the environment every time the app runs.
checkra1n, palera1n, Dopamine and rootless jailbreaks, along with the Cydia, Sileo and Zebra footprints they leave behind.
02
Hooking and injection
Cydia Substrate, Substitute, ElleKit, fishhook and arbitrary dylib injection into your application process.
03
Resigning and integrity
IPA resigning, provisioning profile swaps and sideloaded builds distributed well outside the App Store.
04
Simulator and virtualization
iOS Simulator runtimes and virtualized environments used to automate against your app.
05
Anti-debug and anti-trace
ptrace PT_DENY_ATTACH, sysctl process flags and the DYLD environment attackers use to attach LLDB.
06
Bypass tweak detection
Shadow, Liberty Lite, A-Bypass and the other tweaks written for the sole purpose of defeating jailbreak checks.
The same threat, two different runtimes
A single policy covers both platforms, but the signals underneath are platform-native. This is what each check actually looks at.
The same threat, two different runtimes
Runtime threat
On Android
On iOS
Privilege escalation
Magisk, KernelSU
palera1n, Dopamine
Dynamic instrumentation
Frida, LSPosed
Frida, ElleKit
Code tampering
APK signature
IPA resigning
Debugging
ptrace, JDWP
PT_DENY_ATTACH, sysctl
Virtual environment
Emulators, cloud phones
Simulator
Traffic interception
Pinning bypass
Pinning bypass
Detection bypass
Root hiding modules
Bypass tweaks
Every check is polymorphic: the combination and the order shift per build, so a bypass written against one release does not survive the next one.
In the app this sprint, not this quarter
Mobile RASP only earns its place if shipping it is boring. Alphyn adds one dependency, keeps the policy out of your release cycle and sends everything it sees to a console your team already has.
STEP 01
Add the SDK
One Gradle dependency for Android, one Swift Package or CocoaPod for iOS. No architectural change and no rewrite of your existing code.
STEP 02
Choose the response
Decide per check what happens: record it silently, degrade the feature, or end the session. Policy lives in the portal, so tuning it never costs you a store release.
STEP 03
Watch it live
Every detection lands in the Alphyn portal with device, OS version, geography and check context, so you see the attack while it is still running.
Native and cross-platform
Kotlin and Java on Android, Swift and Objective-C on iOS, plus Flutter, React Native and Unity builds through the same SDK.
Kotlin
Swift
Objective-C
Flutter
React Native
Unity
Mobile RASP questions, answered
The questions security and mobile teams ask us most often before they integrate.
Mobile RASP, short for Runtime Application Self-Protection, is security that runs inside your Android or iOS app rather than in front of it. Because it executes in the same process as your code, it can see the device state, the libraries loaded into memory and the integrity of the binary itself, then respond in real time when something is wrong.
How does Android RASP differ from iOS RASP?
The threats rhyme but the signals do not. Android RASP looks for Magisk, Zygisk and KernelSU root, Xposed and LSPosed hooking, APK signature tampering and emulators. iOS RASP looks for palera1n and Dopamine jailbreaks, Cydia Substrate and ElleKit injection, IPA resigning and PT_DENY_ATTACH debugger attachment. Alphyn ships both sets behind one policy and one dashboard.
Does mobile RASP detect Frida?
Yes. Frida is the single most common dynamic instrumentation tool on both platforms, and Alphyn detects the frida-server, injected gadgets and the memory artifacts that instrumentation leaves in the process. Detection is layered on purpose, so defeating one indicator is not enough to run undetected.
Will RASP slow my app down?
No meaningfully. The SDK is built for a mobile power and memory budget: checks are scheduled rather than run in a hot loop, and the heavy correlation work happens in the portal rather than on the handset. Startup impact stays in the low milliseconds.
Does mobile RASP replace code obfuscation?
It does not, and the two are strongest together. Obfuscation raises the cost of reading and modifying your binary statically, while RASP handles what happens once the app is running on a device you do not control. Byteria pairs Alphyn RASP with UpShield hardening for exactly that reason.
Can it protect Flutter, React Native and Unity apps?
Yes. Cross-platform apps still run inside a native Android or iOS process, which is exactly where the SDK operates. Flutter, React Native and Unity builds get the same root, jailbreak, hooking, integrity and debugger coverage as fully native apps.
What happens when a threat is detected?
That is your call, per check. The response can be a silent telemetry event, a degraded experience that blocks only the sensitive flow, or immediate session termination. Because the policy is configured in the portal, you can tighten it after launch without shipping a new build.
