Veriferium 0.1.0 · beta
Docs Request access
Mobile application security · scan orchestration
Veriferium · 0.1.0 · beta
§ 00  ·  Thesis

Verify the build.
Project the evidence.
Sign the report.

Veriferium runs static, dynamic, and network analysis against your mobile builds — iOS and Android — and correlates the findings into one pipeline. Every report leaves the system through a single, report-safe projection profile: claim, evidence, caveat, signed off.

// fig. 1

The Veriferium pipeline

A signed build enters once. Three analyzers run in parallel. Findings correlate. A single profile projects what leaves.

.apk .ipa build artifact // 01 Static ast · manifest // 02 Dynamic frida · ui driving // 03 Network capture · taint // correlate Attack graph + taint summary boundary projection .json developer .pdf audit .sarif ci .md · .html narrative .csv · .gdpr tabular ↳ raw & sealed internal vault
Analyzers
3/ correlated
Static · dynamic · network
Plugins
67+
Generated metadata inventory
Export formats
7
JSON · HTML · PDF · MD · CSV · GDPR · SARIF
Standards
Mapped
OWASP MASVS · NIST SSDF · CWE · GDPR
Platforms
iOS / Android
Real and emulated devices
§ 01 — Pipeline

One pipeline,
three vantage points.

Most mobile security tooling forces you to wire static, dynamic, and network analysis together yourself — if it even runs them at all. Veriferium orchestrates all three against the same build, in the same scan, and lands their findings in the same graph. That’s how a manifest permission, a runtime hook, and an outbound request become one attack chain instead of three open tabs.

§ 02 — Analyzers

Three analyzers,
built to disagree.

A finding that survives static analysis, gets re-confirmed by runtime instrumentation, and lines up with a real network request is a finding worth surfacing. The rest get caveated, ranked, or held back.

// 01 — Static
Static analysis

AST and manifest correlation across iOS and Android, with hardcoded-secret detection, permission graphing, and binary inspection.

fig. — manifest, AST, finding
  • iOS + Android binary & source
  • Secrets, certificates, taint sources
  • Permission & capability mapping
  • 67 generated plugins
// 02 — Dynamic
Dynamic analysis

Real runtime instrumentation: hand-authored Frida hooks, policy-gated UI driving, and operator-grade manual sessions.

fig. — device, hook, policy, event
  • Frida hook runtime with full inventory
  • UI driving v2 (UIAutomator + scripted)
  • Manual driving over auth’d WebRTC
  • Provider-check: fail-closed, no-network
// 03 — Network
Network analysis

Hosts, endpoints, taint flows. We capture what flows out of the app and what flows back — then summarize it without leaking it.

fig. — source · transform · sink
  • TLS / pinning · host inventory
  • Endpoint taxonomy & counts
  • Source → sink taint summaries
  • Bodies stay inside the boundary
§ 03 — Evidence

A boundary between
what we see and what we say.

Veriferium’s analyzers see authorization headers, request bodies, runtime memory, and proof payloads. Reports don’t. Every export passes through one projection profile that surfaces findings, summarizes evidence, and seals raw material behind an audited vault. Same discipline applies to API responses, UI, and SARIF.

// raw surface · internalvault · audit-gated

What the analyzers see.

Internally, Veriferium captures the full picture — headers, bodies, proof code, taint values — and seals it into an encrypted vault with audit and retention policy.

raw.surface · scan a1f3·c920SEALED
authorization Bearer eyJhbGciOiJIUzI1Ni…
request.body  {"pin":"4417","ssn":"…"}
response.body {"token":"sk_live_…"}
proof.payload 0x9a44…5f1e (48 KB)
taint.values  pii.phone → http.body.write
device.log    ContentResolver.query providers.contacts
↳ Never exits the vault. Audit-gated, encrypted at rest.
// projected surface · normal exportsprofile · report-safe

What every report contains.

Externally, every consumer — PDF, SARIF, an API client — reads the same projection: claim, evidence reference, plain-language caveat. No raw bodies, no proof code.

projection.surface · scan a1f3·c920VALIDATED
network.summary 12 hosts · 38 endpointsmetadata
request.body  █████████redacted
response.body █████████redacted
finding.342  CWE-89 / SQLi candidatesurfaced
proof.ref    vault://0x9a44…sealed
taint.flow   source → transform → sinksummary
↳ Validated by report-safe language. Allowed phrasing only.
§ 04 — UI driving

Drive the app like a user.
With a policy that never blinks.

UI Driving v2 turns a real device session into a deterministic, auditable test — whether your operator is tapping the screen by hand or replaying a scripted flow. Every action passes a default-deny policy before it touches the device.

Manual sessions over authenticated WebRTC.

Operators connect to a live device through an authenticated WebRTC session. Coordinates map browser-to-device, gestures pass through the policy gate, and a clean-up path releases provider resources on stop or failure.

// transport
WebRTC + WS
Authenticated, owner-routed, ICE-restartable.
// gating
Default deny
All actions policy-checked before dispatch.
// scripts
Dry-run preflight
Compile + preflight a flow before it ever runs.
// session logOK
+ tap (212, 488) → "Sign in"
+ input "acme@user"
+ input •••••••
· policy allow / signed-in
+ swipe (204, 612) → (204, 220)
· flow preflight passed
+ capture state @ t+12.4s
// 7 actions · 0 denied · 0 errors
§ 05 — Attack graphs

Findings that
explain themselves.

Every cross-finding chain is built as a verifiable attack graph: which static source enables which runtime hook which writes to which network sink. Each node carries its own evidence and projection state.

Anatomy of a verifiable chain.

A storyboard, not a CSV. Each step is a finding with its own analyzer provenance, evidence reference, and caveats. Path-source limits are surfaced rather than hidden — you can always see where the graph ends.

verifiedcross-analyzertaint-backedcaveated
§ 06 — Reports

Seven export formats.
One projection profile.

Whether a finding leaves the system as a PDF for an auditor, a SARIF file for CI, or a JSON bundle for an engineer, it passes through the same projection. Allowed phrasing is validated automatically. SARIF is forced through the safe profile for CI consumption.

Veriferium — Scan Report a1f3 · c920 · 0.1.0 · beta
Buildcom.acme.banking 14.2.0 (8841)
ProfileStandard · Android
Findings42 surfaced · 11 elevated · 6 chained
Hosts12 hosts · 38 endpoints (metadata)
Profile validationPASS — 0 raw fields permitted
// findings · top 5
01 Cleartext URL · CWE-319 CHAIN
02 PII in network log · pii.phone → sink CHAIN
03 SQLi candidate · CWE-89 SURFACED
04 Improper TLS pinning · com.acme/api SURFACED
05 Hardcoded API key · vault://0x9a44… SEALED
// evidence sample
request.body█████████ redacted
proof.payloadvault://0x9a44… sealed
↳ excerpt · projected · validated

Format coverage.

Pick the surface that fits your audience. Every format is generated from the same projection — there’s no “raw mode.”

.json JSON developer · gated bundle
.html HTML stakeholder
.pdf PDF audit-grade
.md Markdown narrative
.csv CSV tabular summary
.json GDPR subject disclosure
.sarif SARIF ci · forced safe profile
  + webhook stream to your stack
§ 07 — Standards

Mapped to the standards
your auditors already trust.

Findings, evidence references, and projection metadata are mapped to industry standards to support your assessment workflow — a traceability matrix instead of a screenshot. Coverage is reported qualitatively; Veriferium maps evidence rather than asserting formal compliance.

Code
Standard
Focus
Findings coverage
MASVS
OWASP MASVS v2.0
Mobile application security verification
Mapped
MASTG
OWASP MASTG
Mobile application testing guide
Mapped
SSDF
NIST SSDF 1.1
Secure software development framework
Partial
800-218
NIST SP 800-218
Software supply chain
Partial
CWE
CWE Top 25
Common weakness enumeration
Mapped
GDPR
GDPR · Subject disclosure
PII flow surfacing & export
Surfaced
PCI
PCI MPoC v1.0
Mobile payments on COTS
Evidence mapping

Bring a build.
Leave with a report you can sign.

Onboarding is gated. We’ll ask what you scan, where it runs, and which report profile you need before turning anything on.