Expert-Led Security Research
APK & Website Reverse Engineering. Down to the native layer.
Packers, obfuscation, native libraries, anti-tamper — taken apart and tested, not scanned. We also cover Web3 smart contracts, IoT firmware, and automotive ECU systems, backed by 45assigned CVEs across APAC's most critical infrastructure.
Singapore-based. Scope and fixed fee agreed in writing before work begins — 50% on signing, 50% within 30 days of delivery. Engagements run 5–10 business days against the agreed scope.
We reply within one business day. Mutual NDA before any scoping call — we sign yours or ours.
45
Assigned CVEs
16
MITRE-assigned automotive
31/ 48h
Vulnerabilities in one sprint
10.0
Peak CVSS severity
Scoped per target, not per seat. Engagements are procurement-led: NDA, scope letter and a signed rules-of-engagement precede any testing. Findings ship with reproduction steps, working PoC, and a disclosure path your counsel can review.
Latest research recordVerified
escar Europe 2026 — automotive disclosure set
17 zero-days across 9 vehicle-platform projects, 16 of them MITRE-assigned. Presented with full reproduction detail and vendor-coordinated timelines.
Zero-days
17
Projects
9
01
One principal architect owns the engagement end to end — no junior handoff, no offshore triage.
02
A proprietary security LLM triages against a 50M-line analysis corpus before manual exploitation begins.
03
Findings ship with reproduction steps, working PoC, and a disclosure plan your counsel can review.
Feng NingSecurity Researcher & Founder, Innora.ai
Independent security researcher with 45 assigned CVEs across automotive, IoT, and AI systems. Author of the Hyperlane ISM analysis, ERC-4337 paymaster drain research, and the Kelp DAO LayerZero forensic report.
Engagements are led personally by Feng Ning and run on Innora's own tooling — a domain-specialized security LLM and a 50M+ line analysis corpus — the same pipeline behind the published CVE record. This is a principal-led practice, not a body shop: capacity is deliberately limited so every engagement gets that depth.
$50K – $800K
Per target
5 – 10 days
Delivery
MASVS L1 + L2
Coverage
50% / 50%
Payment
APK & Web Reverse Engineering and Security Assessment
Full-depth reverse engineering and adversarial security assessment of a single Android application or website, aligned with OWASP MASVS and MASTG. Static plus dynamic analysis combining AI-assisted decompilation, unpacking and deobfuscation with runtime instrumentation and backend API testing.
Engagements are priced per target from $50,000 to $800,000 USD, delivered in 5–10 business days. Scope and final fee are confirmed in writing before work begins.
- OWASP MASVS & MASTG compliance audit
- Static analysis: decompilation, taint analysis
- Packer / obfuscation unpacking & native .so + JNI reverse engineering
- Dynamic analysis: runtime hooks, traffic interception
- Anti-tamper, root & emulator detection bypass validation
- Proprietary protocol & cryptographic scheme reconstruction
- Insecure data storage & key material exposure
- Certificate pinning & SSL/TLS misconfiguration
- Deeplink & WebView attack surface
- Backend API authentication & authorization testing
Methodology
Manual expert review of every automated finding — no unvalidated tool output ships in the report
OWASP MASVS L1 + L2 and MASTG coverage
Unpacking, deobfuscation and native code analysis
Frida runtime instrumentation against production builds
Backend API authorization and business-logic testing
Data handling review (PDPA / GDPR)
Scope and fee fixed in writing before work begins
Reverse Engineering & Security Assessment
Per single APK or website
$50,000 – $800,000
5 – 10 business days
50% on signing · 50% on delivery
Per single target. Final fee is quoted after scoping — hardening (packing, obfuscation, native code), backend API surface and required testing depth set placement in the range.
Turnaround5–10 business days
Payment terms50% signing / 50% delivery
Unit of scopeOne target
Delivered byPrincipal architect
Deliverables
- CVSS-scored report with reproducible PoC for every Critical and High
- Annotated decompilation and analysis artefacts
- Proprietary protocol and cryptographic scheme reconstruction
- Backend API authorization and business-logic findings
- Data privacy review (PDPA / GDPR) + two fix-verification rounds
Published reverse-engineering research
Independent analyses of production applications, published in full. These were not client engagements — the methodology and the evidence are public so you can evaluate both before you commission anything.
Arxan / Digital.ai string encryptionCommercial obfuscation
72.7% decryption rate
Complete mathematical reverse engineering of a commercial-grade obfuscator: Mersenne Twister PRNG recovery, 3-plane Unicode dispatch, 18 operator identities.
Read full analysis →Alipay APK signing chainCryptographic analysis
15 PoC attacks
MD5/RSA-1024 signing certificate still in production use; 28 RSA private keys recovered from public certificate data via Batch GCD.
Read full analysis →Banking app TLS pinning bypassRuntime instrumentation
Full MITM
Trust-all TrustManager reached through Frida instrumentation, defeating certificate validation on a production banking application.
Read full analysis →Packed app memory forensicsAnti-detection bypass
DEX recovery
Recovering decrypted code from hardened, packed applications that defeat conventional static analysis and gadget injection.
Read full analysis →What the Report Looks Like
Redacted sampleINNORA SECURITY AUDIT REPORT· Smart Contract · [REDACTED PROTOCOL] · v1.0
2 Critical · 3 High · 4 MediumISR-001Critical · CVSS 9.8Reentrancy in withdraw() — full TVL drainPatched
ISR-002Critical · CVSS 9.1Unchecked return value in cross-chain bridge callPatched
ISR-003High · CVSS 8.4Missing slippage check enables sandwich attackPatched
ISR-004High · CVSS 7.8Access control bypass via delegatecall proxyPatched
ISR-001 · Foundry PoC (Critical — included for every Critical/High finding)
function test_ISR001_ReentrancyDrain() public {
AttackerContract attacker = new AttackerContract(address(vault));
vm.deal(address(attacker), 1 ether);
attacker.attack();
// [REDACTED] — full exploit withheld until patch confirmed
assertGt(attacker.profit(), 0, "drain confirmed");
}Illustrative sample. Real reports include full Foundry PoCs, remediation guidance, and a fix-verification round. Protocol name redacted per NDA.
Independent research, published in full
All work below is independent research conducted on our own initiative — not client engagements. Client findings are confidential and never published. Every methodology claim on this page is backed by public evidence you can read and reproduce before you commission anything.
AutomotiveIndependent
escar Europe 2026 automotive disclosure set
17 zero-days across 9 vehicle-platform projects, 16 of them MITRE-assigned CVEs, with vendor-coordinated timelines.
17 / 16
0-days / CVEs
Reverse EngineeringIndependent
Arxan / Digital.ai string encryption
Complete mathematical reverse engineering of a commercial-grade obfuscator, recovering protected string constants at a 72.7% decryption rate across the sample set.
72.7%
decrypted
Mobile / APKIndependent
Alipay APK signing analysis
Study of the application signing and integrity chain, documented with 15 proof-of-concept attack scenarios against the verification path.
15
PoC attacks
Web3Independent
Kelp DAO · Hyperlane · ERC-4337
Protocol-level analyses of a liquid-restaking system, a cross-chain messaging layer, and the account-abstraction standard — $292M+ at-risk reviewed.
4
analyses
How Much Does APK & Website Reverse Engineering Cost in Singapore?
Reverse engineering and security assessment of a single APK or website is priced from $50,000 to $800,000 USD per target, delivered in 5–10 business days. Placement in the range is driven by hardening (packing, obfuscation, native code), backend API surface, and the depth of adversarial testing required. Web3 smart contract, IoT firmware, and automotive ECU engagements run $20,000 to $500,000 on the same delivery window. Every fee is fixed in writing before work begins — 50% on signing, 50% within 30 days of delivery — aligned with MAS TRM guidelines for Singapore-based teams.
APK / Website RE
$50K – $800K
5–10 business days
Web3 Smart Contract
$20K – $500K
5–10 business days
IoT / Automotive ECU
$20K – $500K
5–10 business days
Method
Every engagement runs the same five steps. Scope and fixed fee are agreed in writing before any work begins.
01
Scope & NDA
Send your target and scope. We reply within one business day and hold a scoping call under mutual NDA, then issue a written proposal with fixed fee and delivery date.
02
Signing milestone
50% is invoiced on signing to reserve your delivery window. Work begins immediately — no long sales cycle.
03
Teardown & review
AI-assisted teardown across the full attack surface, with manual expert review of every finding — no unvalidated tool output ships.
04
Report & PoC
Full report within 5–10 business days: reproducible PoC for every Critical and High, plus one fix-verification round after your patch cycle.
05
Closing milestone
The remaining 50% is due within 30 days of delivery — wire or USDC. Client findings stay confidential and are never published without consent.
FAQ
How much does an APK or website reverse engineering assessment cost?
APK and website reverse engineering and security assessments are priced from $50,000 to $800,000 USD per single target. Placement within the range depends on hardening (packing, obfuscation, native code), backend API surface, and the depth of adversarial testing required. Scope and final fee are confirmed in writing before work begins, and delivery is 5–10 business days.
How much does a smart contract audit cost in Singapore?
Smart contract audits at Innora start at $20,000 USD for focused EVM/Solidity reviews and range to $500,000 for large multi-contract DeFi systems. Fees are fixed per engagement and confirmed in writing before work begins.
How long does a security audit take?
All engagements are delivered in 5–10 business days. APK and website reverse engineering assessments, IoT firmware audits, automotive ECU audits, and Web3 smart contract audits all run on this window — the exact date is confirmed before work begins. Full-platform IoT and multi-ECU vehicle programs are scoped individually.
Do I pay before or after?
Engagements are billed in two milestones: 50% on signing to reserve the delivery window, and 50% within 30 days of final report delivery. Payment by wire transfer or USDC. Milestone terms can be adapted for enterprise procurement on request.
What if you find nothing?
A clean result is a valid and valuable outcome. You receive a full scope-coverage attestation documenting every component, function and attack class reviewed, the methodology applied, and the residual risk we could not rule out under the agreed scope — the artefact your board, your regulator or your insurer will actually ask for. Fees are fixed against scope and effort, not against findings; paying per finding creates an incentive we will not accept.
Do you cover both Web3 and hardware/firmware targets?
Yes. The practice operates across Android APK and web applications, Web3 smart contracts, IoT/embedded firmware, and automotive ECUs (ISO 21434). Each domain has a dedicated methodology and AI-assisted toolchain.
How do I start?
Submit your target and scope through innora.ai/contact, or email security@innora.ai. We reply within one business day to schedule a scoping call under mutual NDA. A written proposal follows with the fixed fee, workplan, deliverable schedule and delivery date.
Do you sign NDAs?
A mutual NDA is executed before any scoping call and before we receive any binary, repository or firmware image. We accept client-paper NDAs and master service agreements, and can work under your standard vendor terms.
How do you handle our code and data?
Client material is treated as confidential under mutual NDA and used only for your engagement. Specific handling, storage and retention terms are agreed in the engagement contract and can be aligned to your own vendor security requirements before signing. We do not hold ISO 27001 or SOC 2 certification today and do not claim to.
Can you work with our procurement and legal process?
Yes. Engagements are contracted under a written statement of work covering scope, deliverables, milestones, confidentiality, liability and termination. We can execute on your paper, support vendor onboarding and third-party risk questionnaires, and accommodate purchase orders and standard net terms. Invoicing is in USD by wire transfer; USDC settlement is available on request.
Do you publish findings from our engagement?
No. Findings in your systems are your confidential information. We do not publish them, disclose them to MITRE, or reference them in our own research without your written consent. The published research on this site is independent work on public and open-source targets, conducted separately from client engagements. Where you want a CVE coordinated for a third-party component, we can manage that at your direction.
Does a smart contract audit satisfy MAS TRM requirements in Singapore?
Innora.ai audit reports map each finding to MAS TRM adversarial testing obligations and produce CVSS-scored, PoC-verified evidence ready for regulatory examination. Singapore-based, with direct MAS TRM context for fintech and CII operators.
Singapore · APAC Security Hub
Ready to secure your project?
APK, website, Web3, IoT or automotive — send us the target and the questions you need answered. We reply within one business day and schedule a scoping call under mutual NDA. A written proposal with fixed fee, workplan and deliverable schedule follows.
security@innora.ai · innora.ai/audit · @Innora_sg
Engagements are contracted under a written statement of work covering scope, deliverables, milestones, confidentiality, liability and termination. We can execute on your paper and support vendor onboarding and third-party risk review.