Offensive Mobile Reversing and Exploitation (On-demand)

This course offers an in-depth exploration of the internal architectures of Android and iOS operating systems. You'll get an insight into the various platform-specific features, inter-process communication mechanisms, and other unique exploit mitigations. By reviewing the XNU kernel for iOS, and the Android Open Source Project (AOSP) codebase for Android, you'll develop reverse-engineering skills to analyze proprietary security aspects of both systems. The curriculum includes detailed walkthroughs of the jailbreaking and rooting processes, supplemented by case studies of real-world exploits on both platform.

Target audience

This course is for penetration testers, mobile developers or anyone keen to learn mobile OS Internals, and wants to get started in Mobile OS exploitation, or research. Level Intermediate / Advanced-

Prerequisites

To successfully participate in this course, attendees should possess the following:

  • Basic working knowledge of iOS and Android platforms
  • Basic Linux skills and command-line proficiency
  • Understanding of fundamental programming concepts and looping structures in at least one higher-level language (Java, Kotlin, Objective-C, Swift, C, C++, or similar)
  • Basic ARM/AARCH64 binary assembly and exploitation knowledge is recommended, but not required

 

 Se alle kurs innen dette fagområdet

 

Course content:

Key Objectives

  • Get an understanding of the latest ARM64 instruction set
  • Learn the internals of Mobile Kernels along with several Kernel security mitigations
  • Understand some of the latest exploit mitigations (PAC, CoreTrust, PPL, SPTM/TXM, RKP, MTE, SELinux,  etc)
  • Get an intro to common bug categories like UaF, Heap overflow, PUaF etc
  • Learn about Exploit Primitives and the different steps performed to build Stronger primitives
  • Understanding how Rooting and Jailbreaks work
  • Learn about the platform IPC mechanism like Mach Messaging and Binder
  • Reverse engineer iOS and Android binaries (Apps and system binaries)
  • Understand the different Post Exploitation techniques in an Exploit chain
  • Learn how Mobile malwares work, and how to reverse engineer them
  • Understand in depth how Code Signing and Sandboxing works in iOS and Android
  • Understand how to Reverse Engineer Malwares on Mobile Devices
  • Learn how to debug userland and system binaries
  • Learn about filesystem of an iOS and Android device
  • Learn how to customize and build Mobile OS and Kernel for Vulnerability Research
  • Learn how to symbolicate the iOS and Android kernel
  • Learn using Case Study of Public Exploits
  • Learn how to extract and decrypt boot images, kernel etc for iOS & Android devices
  • Perform patch diffing on iOS updates to spot security-relevant code changes
  • Extract and prepare binaries, then use key tools for analysis
  • Reverse engineer and trace Android JNI bindings, including RegisterNatives
  • Use tools like JNINinja, Frida, and Medusa to hook and monitor JNI methods at runtime
  • Build a functional JVM environment and AFL++ Frida-mode to fuzz JNI bindings and validate crashes
  • Become a Offensive Mobile Security Expert (OMSE)

 

01 Course Preview

  • Offensive Mobile Reversing and Exploitation - Trailer (08:24)

02 Welcome to the Course

  • Getting Started
  • Ethical Use Note
  • Ask the Instructors

03 Setting up your Environment

  • About this Module
  • Glossary
  • Choosing Device vs. Corellium (07:42)
  • Installing Necessary Tools on Computer (06:01)
  • List of Tools for your Computer
  • Introduction to Corellium (06:25)
  • Jailbreaking Your Device (10:11)
  • About Jailbreaks
  • Installing Tools on Device & Installation Process (09:12)
  • List of Tools for Device
  • Quiz 3.1
  • Homework

04 iOS OS and Filesystem

  • About this Module
  • Glossary
  • Mobile Operating System Concepts (18:24)
  • Virtual Memory Management Resources
  • Intro To iOS Filesystem (15:11)
  • Daemon, Agents, and File Handles (06:51)
  • Filesystem monitoring on iOS (04:34)
  • Important Files on an iOS device
  • Quiz 4.1
  • Homework

05 ARM Assembly and Exploitation

  • About this Module
  • Glossary
  • Introduction to ARM Common Instructions (17:43)
  • ARM Calling Convention (03:51)
  • ARM64 instruction set quick reference
  • Reversing a Simple ARM64 Binary (19:18)
  • AArch Exception Levels (02:07)
  • Proprietary System Registers (03:33)
  • Quiz 5.1
  • Heap Overflow Challenge (04:11)
  • Heap Overflow Solution (09:30)
  • Use-After-Free (UAF) Challenge (03:25)
  • UAF Challenge Solution (07:48)
  • ROP Challenge Discussion (02:57)
  • ROP Solution (24:28)
  • Script for Rop Solution
  • Quiz 5.2
  • Homework
  • Quick Feedback Form

06 Debugging Tools and Setup

  • About this Module
  • Glossary
  • Introduction to LLDB (02:17)
  • Setting Up the Debug Server (09:37)
  • LLDB Basic Usage (09:51)
  • Memory Patching with LLDB (12:49)
  • lldb usage quick cheat sheet
  • Quiz 6.1
  • Homework

07 Introduction to iOS Reverse Engineering

  • About this Module
  • Glossary
  • Reverse Engineering using Hopper (08:32)
  • Reverse Engineering using Ghidra (07:47)
  • Intro To r2 (07:45)
  • Reversing Hello World in Objective-C (08:38)
  • Reversing Hello World in Swift (07:42)
  • Importing iOS Types in Reversing Tool (09:35)
  • Quiz 7.1
  • Homework

08 Mach-O Binary Format

  • About this Module
  • Glossary
  • Universal Binaries Magic Numbers (04:41)
  • Mach-O Binary Format (13:13)
  • Custom Mach-O Binaries (05:03)
  • The PageZero Segment (04:12)
  • Quiz 8.1
  • Homework

09 iOS Kernel and ipsw Analysis

  • About this Module
  • Glossary
  • Inside an IPSW File (16:51)
  • XNU Kernel (11:47)
  • Extracting Kernel Cache Kexts (06:41)
  • Identifying Syscalls and Mach Traps (03:54)
  • Identifying MIG Calls (06:51)
  • Symbolicating the iOS Kernel (11:31)
  • Quiz 9.1
  • Symbolicating with Disarm (06:12)
  • Symbolication with ipsw (03:59)
  • Deciphering Kernel Panics (16:25)
  • Symbolication of Kernel Panics (03:30)
  • IPSW Diffing (07:47)
  • dyld Shared Cache Analysis (07:21)
  • Device Tree (06:28)
  • References
  • Quiz 9.2
  • Homework

10 Code Signing Explained

  • About this Module
  • Glossary
  • Analyzing Code Signatures (08:15)
  • Entitlements Explained (11:16)
  • Sign Binary with Entitlements (06:20)
  • Trust Cache (07:07)
  • Launch Constraints (10:37)
  • Libmis.dylib (02:44)
  • References
  • Quiz 10.1
  • Homework

11 Sandboxing in iOS

  • About this Module
  • Glossary
  • Sandboxing Explained (11:26)
  • Dumping Sandbox Profiles (23:13)
  • Hardened Sandbox Profiles (05:39)
  • Platform Sandbox Profile (02:53)
  • References
  • Quiz 11.1
  • Homework

12 Analyzing Proprietary Security Mitigations

  • About this Module
  • Glossary
  • Analyzing Proprietary Security Mitigations (00:29)
  • Reversing the Lockdown Mode (29:35)
  • SAD Feng Shui (03:13)
  • Probabilistic Guard Zalloc (03:39)
  • Privileged Access Never (PAN) (02:20)
  • Quiz 12.1
  • Signed System Volume (SSV) (03:28)
  • Blastdoor (03:35)
  • Page Protection Layer (PPL) (03:44)
  • SPTM-TXM (05:40)
  • Pointer Authentication Codes (PAC) (10:46)
  • Zone-Kalloc Type (09:54)
  • References
  • Quiz 12.2
  • Homework

13 Memory Integrity Enforcement

  • About this Module
  • Glossary Module 13
  • Understanding Memory Integrity Enforcement (EMTE) (17:55)
  • Address Sanitizer vs MIE
  • Finding the IRG/STG Instructions (05:09)
  • Analyzing MIE Crash Logs (03:13)
  • Checking Apps for MIE Implementation (02:58)
  • Quiz 13.1
  • Homework

14 iOS IPC

  • About this Module
  • Glossary
  • Mach Messaging Introduction (13:12)
  • mach_msg2 (11:11)
  • Debugging Mach Msg2 (05:51)
  • XPC (10:12)
  • References
  • Quiz 14.1
  • Homework

15 iOS Exploitation Concepts

  • About this Module
  • Glossary
  • Exploit Primitives (01:57)
  • PUaf Primitive and Multi-Level Paging (09:17)
  • Reference Counting (03:00)
  • Compiling Dopamine Jailbreak (12:37)
  • Compiling kfd Projects (15:38)
  • Calculating Offsets and Symbols Dynamically (13:56)
  • References
  • Quiz 15.1
  • Homework

16 Exploitation Case Studies

  • About this Module
  • Glossary
  • Case Study: CVE-2023-23536 (41:46)
  • Physpuppet in Action (10:42)
  • Setting up the Freed Pages to be used (13:15)
  • Quiz 16.1
  • Building a Kernel r/w primitive (35:01)
  • Getting a Better Kernel r/w primitive (10:22)
  • Impact of Signed Data Pointers (04:48)
  • Operation Triangulation PPL Bypass Case Study (28:58)
  • Quiz 16.2
  • References
  • Homework

17 Jailbreaking Steps

  • About this Module
  • Glossary
  • Elevating Privileges (05:33)
  • Remounting Preboot Partition (03:29)
  • Injecting Base Bin Binaries into Trust Cache (03:54)
  • Bootstraps (03:35)
  • Bypassing Code Signing (02:47)
  • References
  • Quiz 17.1
  • Homework

18 Malware Analysis

  • About this Module
  • Glossary
  • Intro to Malware Analysis (15:28)
  • Where to Download Malware (04:17)
  • References
  • Quiz 18.1
  • Homework

19 Patch Diffing in iOS

  • About this Module
  • Glossary
  • Intro to Patch Diffing (12:10)
  • Getting the Required Binaries (20:48)
  • Extracting Binaries One Liner
  • Patch Diffing Tools & Techniques (26:27)
  • Quiz 19.1
  • Case Study: CVE 2025-24201 WebKit OOB r/w (10:13)
  • Case Study: CVE 2025-24203 XNU Page Zeroing Bug (12:29)
  • Case Study: 2025-24200 USB Restricted Mode Bypass (31:03)
  • Case Study: 2025-43200 iMessage Logical Bug (12:56)
  • Case Study: 2025-31201 RPAC PAC Bypass (19:59)
  • References
  • Quiz 19.2
  • Homework

20 Introduction to Android

  • About this Module
  • Glossary
  • Overview of Android Ecosystem and Architecture (04:25)
  • Introduction to Android Components (04:14)
  • Setting Up Android Emulator
  • Understanding Android Debug Bridge (ADB) (05:37)
  • Extract APK using Third Party Sources & Automated Techniques (07:12)
  • Extract APK manually using ADB (02:56)
  • Handling Split APK in Android (13:04)
  • Quiz 20.1
  • Homework

21 Setting up Research Devices

  • About this Module
  • Glossary
  • Compile AOSP from scratch - Part I (13:09)
  • Compile AOSP from scratch - Part II (05:06)
  • Setting up Host machine to run Compiled Custom AOSP Images (11:53)
  • Compiling Custom Kernels for Physical Devices & Exploitation (20:20)
  • Setting up Physical Devices for Security Research (14:52)
  • Rooting Android Physical Devices (08:33)
  • Rooting Android Emulators (11:01)
  • Quiz 21.1
  • Homework

22 AOSP Source Tree Walkthrough

  • About this Module
  • Glossary
  • AOSP Source Tree Walkthrough 1 (art, bionic, bootable, build, cts, dalvik, developer, development, device, external) (25:16)
  • AOSP Source Tree Walkthrough 2 (framework, activitymanager) (05:26)
  • AOSP Source Tree Walkthrough 3 (packagemanager) (04:46)
  • AOSP Source Tree Walkthrough 4 (av, native) (01:55)
  • AOSP Source Tree Walkthrough 5 (hardware, kernel, libcore, libnativehelper, packages, sdk, system, test, tools, trust) (06:29)
  • Quiz 22.1
  • Homework

23 Boot Sequence

  • About this Module
  • Glossary
  • Demystifying Android Boot Sequence (21:05)
  • Quiz 23.1
  • Homework

24 Android Zygote and JVM

  • About this Module
  • Glossary
  • Introduction to Zygote in Android (01:30)
  • Android Zygote Deepdive (15:39)
  • Quiz 24.1
  • Homework

25 Understanding Android GKI

  • About this Module
  • Glossary
  • Demystifying Android GKI (05:05)
  • Quiz 25.1
  • Homework

26 Android OS File System

  • About this Module
  • Glossary
  • File System Monitoring on Android (09:09)
  • Android Sandbox and Filesystem Explained
  • Quiz 26.1
  • Homework
  • Share Your Feedback

27 ARM64 Architecture and Assembly

  • About this Module
  • Glossary
  • ARM64 Calling Convention (03:06)
  • Understanding ARM64 Registers - Part 1 (04:53)
  • Understanding ARM64 Registers - Part 2 (04:24)
  • Understanding ARM64 Registers - Part 3 (03:11)
  • Understanding ARM64 Architecture (02:46)
  • Walkthrough of ARM64 Instructions - Part 1 (06:50)
  • Walkthrough of ARM64 Instructions - Part 2 (02:50)
  • Quiz 27.1
  • Homework

28 Android Development Support

  • About this Module
  • Glossary
  • Introduction To Android Studio and Building Android Code (06:47)
  • Quiz 28.1
  • Homework

29 Android Reverse Engineering

  • About this Module
  • Glossary
  • Introduction to Android Application Reversing (10:02)
  • Apktool Deep dive (07:43)
  • Smali Bytecode DeepDive (18:11)
  • Quiz 29.1
  • Reverse Engineering Android APK (27:25)
  • Application Patching and Re-signing on Android (13:20)
  • Quiz 29.2
  • Android Accessibility Services & Malwares (36:01)
  • Quiz 29.3
  • Deepdive into Common Android Obfuscation Techniques (14:22)
  • Reverse Engineering Obfuscated Android APK (18:31)
  • Quiz 29.4
  • Homework

30 Crash Analysis on Android

  • About this Module
  • Glossary
  • Introduction to Android Crash Logs (01:10)
  • JVM Exception Stack Trace in Android (01:02)
  • Practical Analysis of Exception Stack Trace Logs (08:10)
  • Introduction to ANR Dumps in Android (01:36)
  • Practical Analysis of ANR Dumps in Android (09:04)
  • Tombstone Files on Android (03:46)
  • Practical Analysis of Tombstone files (14:56)
  • Symbolicating Crashes using ndk-stack and addr2line (12:49)
  • Quiz 30.1
  • Homework

31 SELinux in Android

  • About this Module
  • Glossary
  • Deep Dive into Android SELinux and Security Domains (04:58)
  • Understanding SELinux Policy Language and .te Files (04:02)
  • Interacting with SELinux Policy File (13:43)
  • Quiz 31.1
  • Homework

32 Package Manager Service and Internals

  • About this Module
  • Glossary
  • Introduction to Preferred Packages in Android (01:04)
  • Android System-Level Preferred Packages (03:13)
  • Deep Dive into Android User-specified Defaults and Preferred-Packages (18:29)
  • PackageManagerService Deepdive (08:03)
  • Internals of packages.xml inside PackageManagerService in Android (09:48)
  • Internals of packages.list inside PackageManagerService in Android (05:13)
  • Quiz 32.1
  • Homework

33 Binder IPC

  • About this Module
  • Glossary
  • Introduction to Inter-process communication and Android Binder IPC (09:38)
  • Understanding Android Binder IPC (09:47)
  • Binder Framework Concepts (08:57)
  • Binder Framework Concepts - Extended (13:54)
  • Deep Dive Binder Inter-process Communication Flow (07:42)
  • Quiz 33.1
  • Homework

34 Debugging Tools and Techniques

  • About this Module
  • Glossary
  • Introduction to LLDB on Android (02:59)
  • LLDB Process Debugging (11:41)
  • LLDB Commands Deepdive & Application Debugging using LLDB (32:35)
  • Quiz 34.1
  • Homework

35 Live Debugging and Code Injection

  • About this Module
  • Glossary
  • Live Debugging and Patching Code using Jadx-Gui (09:06)
  • Dynamic Linking in Android & Code Injection using LD_PRELOAD (15:42)
  • Tracing Native Android Library Code (06:10)
  • Quiz 35.1
  • Homework

36 Exploiting run-as

  • About this Module
  • Glossary
  • Technical Implications of Leaving Applications Debuggable (09:05)
  • Using run-as to Exploit Debuggable Applications (08:24)
  • Understanding CVE-2024-0044 (12:52)
  • Reading Sandbox Data of Android applications exploiting CVE-2024-0044 (16:56)
  • Reading Sandbox Data of Privapps exploiting CVE-2024-0044 (16:06)
  • Quiz 36.1
  • Homework

37 Android Firmware Analysis

  • About this Module
  • Glossary
  • Extracting Android Boot Images and Firmware Files (04:02)
  • Extract and Decrypt Boot Images for OnePlus and Oppo Firmwares (03:07)
  • Extract Android Kernel from Boot Image (02:51)
  • Symbolicating the Android Kernel (12:31)
  • Quiz 37.1
  • Homework

38 Compiling Exploits and Porting

  • About this Module
  • Glossary
  • Cross Compile Native Code and Exploits for Android Platform (07:07)
  • Porting Android Exploits Across Devices (28:05)
  • Quiz 38.1
  • Homework

39 Privilege Escalation Techniques

  • About this Module
  • Glossary
  • Deepdive Task_Struct and Cred in Privilege Escalation (20:24)
  • Analyzing Android Kernel Data Structures (13:23)
  • How to Escalate Privileges on Android (08:19)
  • Quiz 39.1
  • Homework

40 Memory Allocators and Protection

  • About this Module
  • Glossary
  • Limitations and Attacks on Traditional Android Allocators like dlmalloc & jemalloc (20:48)
  • Deepdive into Scudo Chunk Headers (08:34)
  • Purpose of Checksum Field in Scudo Chunk (01:36)
  • Checksum Setup and Verification in Scudo Chunk Header (04:58)
  • Quiz 40.1
  • Homework

41 KDP and RKP Security Mechanisms

  • About this Module
  • Glossary
  • Introduction to Samsung KDP and RKP (06:50)
  • Enhanced Reference Counting and Safeguards in RKP (09:11)
  • KDP and RKP Security Mechanism Explained Part 1 (09:23)
  • KDP and RKP Security Mechanism Explained Part 2 (08:33)
  • Concluding KDP and RKP Security (01:02)
  • Quiz 41.1
  • Homework

42 Memory Tagging and Protection

  • About this Module
  • Glossary
  • Enabling Memory Tagging on Android Devices (05:51)
  • MTE in Action Detecting UAF (09:10)
  • Quiz 42.1
  • Homework

43 CVE-2023-26083: Kernel Pointer Leakage in Mali GPU's Timeline Stream Message Buffers

  • About this Module
  • Glossary
  • Introduction to CVE-2023-26083 (02:51)
  • Background of Mali GPU (05:51)
  • Internals of Mali GPU Driver and Context (13:13)
  • Understanding the Role of Timeline Streams and Vulnerability deep dive (18:19)
  • Walkthrough of PoC code to Exploit CVE-2023-26083 (12:18)
  • Exploiting CVE-2023-26083 using PoC (03:46)
  • Quiz 43.1
  • Homework

44 JNI Reversing and Native Fuzzing

  • About this Module
  • Glossary
  • Fuzzing - What we'll cover (01:10)
  • JNI Fundamentals (07:13)
  • Reversing JNI Functions Exposed to Java (14:20)
  • Beautifying JNI Code and Retyping (14:20)
  • Reversing JNI RegisterNatives (14:25)
  • Intro to Finding & Tracing JNI Bindings (05:48)
  • Finding & Tracing JNI Bindings using JNINinja (20:56)
  • Finding & Tracing JNI Bindings using Frida (08:49)
  • Quiz 44.1
  • Hooking and Tracing JNI methods at Runtime (13:04)
  • Exploring JNI Signatures using Medusa (08:41)
  • Overcoming Fuzz restrictions using functional JVM Environment (18:50)
  • Building AFL++ Frida-mode for Android (15:04)
  • Fuzzing using AFL Frida Mode (25:25)
  • Validating crashes in AFL Frida Mode (09:44)
  • Custom Object-based JNI binding Fuzzing (30:55)
  • Quiz 44.2
  • Homework
  • Share Your Feedback

45 OMSE Mock Exam

  • OMSE Mock Exam

46 Offensive Mobile Security Expert (OMSE) Exam

  • OMSE Exam details
  • Next steps
  • Schedule Exam
  • Certificate of Completion

Certification

This course leads to the OMSE (Offensive Mobile Security Expert) certification delivered by 8KSec. The exam is included in the course. 

 

FAQ – Offensive Mobile Reversing and Exploitation (On-Demand)

How much does the course cost?
The course costs NOK 17,500 excluding VAT. Norwegian VAT of 25% applies, bringing the total price to NOK 21,875 including VAT. The OMSE certification exam is included.

How is the course delivered?
The course is delivered as self-paced, on-demand e-learning through 8kSec Academy. Participants can access recorded lessons, practical exercises and assessments, allowing them to study according to their own schedule.

How long does the course take?
The course includes approximately 36 hours of video content across 214 videos. The estimated completion time is 5–8 months, depending on previous experience and study pace.

How long will I have access to the course?
Participants receive 365 days of access after purchase. This provides time to complete the lessons, work through the labs and prepare for certification.

Who should attend this course?
The course is designed for security professionals and developers who want to understand Android and iOS operating system internals and develop advanced mobile security research skills.

  • Penetration testers and ethical hackers
  • Mobile security researchers
  • Reverse engineers
  • iOS and Android developers
  • Vulnerability researchers
  • Security engineers
  • Professionals interested in mobile operating system exploitation

What prerequisites are required?
Participants should have basic working knowledge of Android and iOS, Linux command-line skills, and an understanding of programming concepts in a language such as Java, Kotlin, Swift, Objective-C, C or C++.

Do I need previous experience with ARM64 assembly?
Basic knowledge of ARM or AARCH64 assembly and exploitation concepts is recommended but not required. The course includes dedicated training in ARM64 architecture, instruction sets and exploitation fundamentals.

What will I learn during the course?
You will gain practical knowledge of Android and iOS internals, reverse engineering and mobile exploitation techniques. After completing the course, you will be able to:

  • Understand Android and iOS operating system architectures
  • Analyse ARM64 instructions and mobile binary formats
  • Reverse engineer mobile applications, system binaries and kernel components
  • Investigate mobile security mitigations and their limitations
  • Understand rooting and jailbreaking techniques
  • Analyse inter-process communication mechanisms such as Mach Messaging and Android Binder
  • Debug mobile applications, services and kernel components
  • Analyse mobile malware and security vulnerabilities
  • Investigate exploit primitives and publicly documented exploitation techniques
  • Perform mobile firmware analysis, patch diffing and vulnerability research

Is the course hands-on?
Yes. The course includes practical labs, technical demonstrations, reverse-engineering exercises, debugging activities and exploitation case studies involving Android and iOS environments.

Which topics are covered?
The course covers a broad range of advanced mobile security topics, including:

  • iOS and Android operating system internals
  • ARM64 assembly and exploitation fundamentals
  • Mach-O binaries, APK analysis and reverse engineering
  • iOS XNU kernel and Android kernel architecture
  • Code signing, sandboxing and privilege separation
  • Mobile exploit mitigations including PAC, PPL, SPTM/TXM, SELinux and MTE
  • Kernel debugging, crash analysis and symbolication
  • Rooting, jailbreaking and privilege escalation concepts
  • Mach Messaging, XPC and Android Binder IPC
  • Mobile malware analysis and reverse engineering
  • Firmware extraction, kernel analysis and patch diffing
  • JNI reverse engineering and native fuzzing
  • Mobile vulnerability research and public exploit case studies

Does the course cover both Android and iOS?
Yes. The programme combines advanced Android and iOS security topics. Participants explore both platforms' internals, reverse-engineering techniques, security architectures and exploitation mechanisms.

Is this a mobile application security course?
Not primarily. The course focuses on operating system internals, vulnerability research, reverse engineering and exploitation rather than conventional mobile application penetration testing.

Which tools are covered?
The training includes tools and technologies such as Ghidra, Hopper, LLDB, Frida, Medusa, JNINinja, Apktool, Android Debug Bridge (ADB), JADX and AFL++ Frida-mode.

What equipment do I need?
Participants need a laptop with at least 8 GB RAM, 40 GB of available storage and administrative access. For iOS labs, a physical jailbroken device running iOS 16 or later, or a suitable virtualized environment such as Corellium, is required. For Android labs, a rooted device running Android 12 or later, or a suitable emulator or virtualized environment, is required.

What language is the course delivered in?
The video instruction is in English. Subtitles are available in English, German, Spanish, French, Arabic and Japanese.

Does the course prepare me for certification?
Yes. The course prepares participants for the Offensive Mobile Security Expert (OMSE) certification from 8kSec Academy. The certification assesses advanced mobile security skills involving operating system internals, reverse engineering and exploitation.

Is the certification exam included?
Yes. One attempt at the Offensive Mobile Security Expert (OMSE) certification exam is included in the course price.

How is the certification exam structured?
The OMSE exam is a 48-hour practical assessment designed to evaluate advanced mobile security knowledge and hands-on skills. Participants must successfully complete the assessment to earn the certification.

Will I receive a certificate of completion?
Yes. The training includes a certificate of course completion. The OMSE professional certification is awarded separately after successfully passing the certification exam.

Can the course be purchased for a team or organisation?
Yes. The training provider offers group enrolment options, including group pricing and optional tools for monitoring learner progress. Organisations can enquire about training access for multiple employees.

What makes this course valuable?
The course goes beyond traditional application security testing to explore how Android and iOS work internally and how vulnerabilities arise in operating systems, kernels and low-level components. It combines advanced reverse engineering, exploitation concepts and hands-on research to develop specialist mobile security expertise.