Mobile Anti-Tamper & Resilience (L1→L5)

It is the OWASP Mobile Application Security Verification Standard category covering an app's self-protection: root and jailbreak detection, anti-hooking, anti-debugging, obfuscation and integrity verification. These controls make an app harder to tamper with and analyse, as opposed to the storage, crypto, auth and network categories that protect data.

Because it runs client-side on hardware the attacker fully controls. They can root the device, attach a debugger and observe the check, so any decision the app makes can be neutralised. Root detection is a resilience control that raises attacker cost; it is not an access control and cannot be a security boundary.

A graduated model used in this course: L1 root/jailbreak detection, L2 obfuscation and string hiding, L3 anti-hooking and anti-debugging, L4 integrity and signature verification, and L5 layered defences that combine the others. Each level adds friction and L5's strength comes from the layers interlocking.

Keep real security server-side, and use resilience only to raise the cost of mass abuse and to feed telemetry. Make checks diffuse rather than one central boolean, fail quietly and out of band rather than with an instant informative error, re-check continuously, and combine layers so defeating one trips another.

No. It is a conceptual, defender-focused course that explains how resilience controls work and how to build them well, using your own test apps and lab targets. You study resilience only on apps and devices you own or are explicitly authorised to assess; it does not hand you bypasses aimed at someone else's product.

Signal (the raw evidence such as an su file, a ptrace result or a signature hash), collection (the API that reads it), decision (comparing evidence to expectation into a boolean or score), and enforcement (exit, degrade or report). Each on-device stage is observable and patchable, which is why strong design moves the real decision to a server via attestation.