Skip to content

Mobile Scan Prerequisites

Overview

Ostorlab performs static, dynamic and behavioral analysis of mobile applications. These capabilities use a large spectrum of engines, tools and techniques to work around production app constraints and evaluate their security.

Dynamic analysis runs the app in an instrumented sandbox to track how it interacts with the network, the file system, the keychain and APIs. See Detection.

We generally recommend testing applications with the full spectrum of protections enabled to validate the impact of these protections, as well as disabling them to compare if any additional findings were reported and missed because of these protections.

Supported App Formats

You can upload Android, iOS and HarmonyOS app files. The iOS file must be a non-encrypted IPA.

Platform Upload formats Notes
Android .apk, .aab Choose Android App in New Scan.
iOS .ipa Choose iOS App. The IPA must be non-encrypted.
HarmonyOS .apk, .aab, .rpk, .app, .hap Choose HarmonyOS App.

For the upload steps, see Scan a Mobile Application from a File. The full list of asset types is in Multi Asset Supported Asset Types.

You can also add an SBOM or a lock file to extend dependency detection. See Scans with SBOM or Lockfile for the supported files.

Source code is scanned separately, from a Git repository or an uploaded archive (.zip, .tar.gz, .tgz, .7z). See Source Code Scanning.

Store and TestFlight Scans

You can select a published app from its store, or give the public link of an iOS TestFlight build.

From a store:

  • Select PlayStore for Android, AppStore for iOS, or AppGallery for HarmonyOS.
  • Search for the app by its name, package name, bundle name or bundle ID.
  • If the app is only available in some countries, pick one in the Country menu.

See Scan a Mobile Application from the Store.

From TestFlight:

  • Select iOS TestFlight and enter the TestFlight public URL.

See Scan iOS Mobile Application using TestFlight.

Framework Support

Support depends on the framework and the type of analysis. See Platform Support for the full table.

  • Xamarin: static, dynamic, behavioral and backend analysis are supported; analysis environment support is not.
  • Framework7: dynamic, behavioral and backend analysis, plus analysis environment support, are available; static analysis is not.
  • Apache Weex: dynamic, behavioral and backend analysis, plus analysis environment support, are available; static analysis is not.

Protection Mechanisms That Affect Testing

1. Obfuscation

Code obfuscation transforms readable source code into a functionally equivalent but difficult-to-understand version, making reverse engineering more challenging.

Impact on Testing: Code obfuscation renders stack traces difficult to read by developers to know where to apply fixes.

2. TLS Pinning

Certificate pinning validates that the app only communicates with legitimate servers by hardcoding the expected server's certificate or public key.

Impact on Testing: May prevent traffic interception.

3. Runtime Protection

Runtime protection mechanisms detect and prevent tampering, debugging, or instrumentation attempts while the application is running.

Impact on Testing: Prevents instrumentation or patching of the application for dynamic analysis.

4. Prevention of Developer Mode

Detection and blocking of developer settings, USB debugging, and debug connections that could be used for application analysis.

Impact on Testing: Prevents use of debug protocols for application instrumentation.

5. Disabling Screenshot

Security feature that prevents capturing screenshots of application screens.

Impact on Testing: Prevents taking screenshots and might slightly hinder automated exploration and crawling of the application.

  1. Run with all protections enabled
  2. Run with developer mode detection disabled (if applicable)
  3. Run with all protections disabled

Compare the results of the three runs to see whether the protections hid any findings.

To measure how well the protections themselves hold up, run a Mobile Shielding Scan. It checks obfuscation, anti-tampering, anti-debugging, and root and jailbreak detection, and runs the app in rooted or jailbroken environments for the last check. It measures protections and is not a vulnerability scan. A Mobile Deep Agentic Scan runs the same checks along with its vulnerability testing. See Scan Types Comparison.

Known Limitations