Mobile platforms are among the hardest targets in security research, and among the most valuable. This track builds the specific knowledge each platform demands — Apple’s layered protections on one side, the Binder and privileged service surface on the other.
The iOS side is taught as a sequence rather than as a single course, because the three capabilities it delivers are different skills. Courses 1 and 2 are a complete programme on their own: they produce a researcher who can find a defect and report it, which is a whole professional outcome and the one most employers are buying. Exploitation is a separate body of knowledge, so it stands as course 3 and declares course 2 as its entry requirement — a student who starts at exploitation can follow a chain and cannot find one.
The two platforms certify separately. A researcher who specialises in iOS should be able to prove it without also sitting an Android exam, and the reverse.
The same platforms feature heavily in our own work; our research articles include a full study of macOS and iOS internals for vulnerability research, and the iOS series that begins with iOS Security Research (part 01).
Students coming from the reverse engineering track will find this track a natural extension, though it is not a formal prerequisite.
Recommended Order
5 courses · 210 hoursPlatform internals, reverse engineering and exploitation on the two mobile platforms that matter. ARM64 Assembly and Reverse Engineering comes first — both platforms assume you can read ARM64 disassembly, and the iOS sequence assumes it item by item. The three iOS courses are strictly sequential: each one's entry requirement is the course before it. Android Security Research is independent of that sequence and can be taken at any point after ARM64.
ARM64 Assembly and Reverse Engineering
Reading ARM64 code you have never seen before, including an Apple binary with its signed function openings and authenticated calls. Covers the execution model and the call standard, the instruction set organised by what it does, the system and exception-raising instructions that kernel code is full of, and the arm64e dialect. Ends in an unfamiliar function read to a written verdict.
iOS Security Research 1
Reading the system. Build the laboratory, obtain and symbolicate the kernelcache, and read any kernel subsystem to a conclusion — the privileged machine, XNU and the Mach and BSD layers, the kernel heap, and the driver surface. Ends in an attack surface map whose reachability claims are measured rather than assumed.
iOS Security Research 2
Finding and proving a defect. The research cycle and the condition for stopping, the bug classes recognised by their shape in compiled code, the instruments and how each one lies, and the reproducer with both of its controls. Ends in a finding document a vendor can act on — or a negative result with its coverage stated, which is taught as a finding of a different kind.
iOS Security Research 3
From primitive to chain. Converting a defect into a primitive, grooming the heap, building a kernel read and write, and the modern wall: pointer authentication and the four avenues around it, the monitor, data-only attacks, and two published chains taken apart stage by stage. Ends in a working primitive chain against a pinned build.
Android Security Research
Practical techniques for security research on Android devices. Covers Android architecture, security and memory management, then the Binder, storage and connectivity stacks, followed by static and dynamic analysis work.
Certification
- Blackstorm iOS Security Research — after iOS Security Research 1, 2 and 3
- Blackstorm Android Security Research — after Android Security Research
Dates and enrolment
Scheduled dates for every course in this track are listed on the training page, together with format, payment and enrolment details.