Reverse engineering, on autopilot.

Drop in an Android app, iOS app, Windows thick-client or firmware image. Kleydin's agents decompile, trace, test and validate it end to end, with no source code, no scripts and no babysitting. Every finding comes with proof.

Get early access See how findings are proved

One binary. Six layers, pulled apart.

Scroll to split the app into the layers the agents work through: manifest, bytecode, native libraries, assets, network calls and secrets. Drag to rotate it.

manifestpermissionsdex14,212 methods.solibcrypto_wrap.soassetsconfig.jsonnetwork38 endpointssecrets3 hardcoded keys

acme-bank-4.2.apk, exploded by layer

APKIPAEXE.NETFirmwareAndroid agentNative-lib agentNetwork agentSecrets agentDisproverAPKIPAEXE.NETFirmwareAndroid agentNative-lib agentNetwork agentSecrets agentDisproverAPKIPAEXE.NETFirmwareAndroid agentNative-lib agentNetwork agentSecrets agentDisproverAPKIPAEXE.NETFirmwareAndroid agentNative-lib agentNetwork agentSecrets agentDisprover

Why autonomous, and why now.

Manual reversing doesn't scale

One app can eat a week of a senior tester's time.

Generic AI scanners guess

And they flood reports with false positives.

Kleydin is autonomous and accountable

Agents do the work; evidence decides what ships.

Binary in, proven findings out.

01
Drop
APK, IPA, EXE/.NET or firmware. No source, no setup.
02
Autonomous teardown
Platform agents unpack, decompile, map every call path, endpoint and secret, and run targeted dynamic checks.
03
Disprove
A separate validation agent tries to break every finding. What survives is labeled Confirmed, Likely or Unverified.
04
Deliver
Report in your firm's template, a Burp attack kit, and an exportable API collection.

What “autonomous” means here.

Not a scanner with a chat window. Agents that run the teardown a senior reverser would, from first unpack to final check.

1
Plans its own analysis per platform
Each agent builds a plan for the target in front of it, not a fixed script.
2
Chooses and runs the tools
Decompilers, disassemblers, emulators and instrumentation, picked and driven by the agents.
3
Follows leads across native code, network and storage
A key in a native library leads to the request that uses it, and to where the response is stored.
4
Stops and asks a human only when evidence is ambiguous
Clear cases run to the end. Unclear ones come to you with the evidence attached.

Human-in-the-loop

By design: every step is logged and replayable.

SIMULATED OUTPUT

Watch an autonomous teardown.

Drop a file or run the sample. Everything runs in your browser: nothing is uploaded, and the output is simulated.

TARGET: ACME-BANK-4.2.APKIDLE

Drop an APK, IPA, EXE or firmware image

Runs client-side. Nothing leaves this page.

1Android agent
unpack apk · parse manifest · decompile dexQueued
2Native-lib agent
lift arm64 · recover crypto routinesQueued
3Network agent
enumerate endpoints · diff against docsQueued
4Secrets agent
entropy scan · validate candidate keysQueued
5Disprover
re-run every claim · reject what failsQueued

4 findings · 2 confirmed · 1 likely · 1 unverified

#FindingEvidenceVerdict

// assets/config.json: extracted at unpack
{ "region": "eu-west-1",
  "accessKeyId": "AKIA………7QF2",
  "secretAccessKey": "wJal………EKEY",
  "bucket": "acme-bank-receipts" }
// com/acme/bank/core/S3Uploader.java (decompiled)
private static AWSCredentials load() {
  JSONObject c = Assets.json("config.json");
  return new BasicAWSCredentials(c.get("accessKeyId"), c.get("secretAccessKey"));
}

CALL PATH

MainActivity.onCreate()
ReceiptSync.start()
S3Uploader.load()
assets/config.json

RE-RUNNABLE CHECK

check · aws-key-config · acme-bank-4.2.apk → key present, sts:GetCallerIdentity 200

// libcrypto_wrap.so :: Java_com_acme_bank_Signer_sign (lifted)
char *sign(char *body, char *ts) {
  char *k = xor_decode("\x3f\x11…", 32);   // static key
  char *msg = concat(ts, "\n", sha256(body));
  return b64(hmac_sha256(k, msg));
}
// header: X-Acme-Sig: <base64> ; X-Acme-Ts: <epoch ms>

CALL PATH

ApiClient.post()
Signer.sign() (JNI)
libcrypto_wrap.so!sign
X-Acme-Sig header

RE-RUNNABLE CHECK

attack kit · burp · acme-bank-4.2.apk → AcmeSigner.jar (re-signs edited traffic)

// com/acme/bank/net/Pinning.smali
.method static install(Lokhttp3/OkHttpClient$Builder;)V
  sget-boolean v0, Lcom/acme/bank/BuildConfig;->DEBUG_NET:Z
  if-eqz v0, :cond_pin
  return-void              // pinner never installed
  :cond_pin
  invoke-virtual {p0, v1}, …->certificatePinner(…)

CALL PATH

App.onCreate()
Net.buildClient()
Pinning.install()
BuildConfig.DEBUG_NET

RE-RUNNABLE CHECK

check · pin-bypass · emulator → flag settable via adb on rooted device only

<!-- AndroidManifest.xml -->
<activity android:name=".TransferActivity" android:exported="true">
  <intent-filter>
    <data android:scheme="acmebank" android:host="transfer"/>
  </intent-filter>
</activity>
// no session check seen on this entry path (static analysis)

CALL PATH

acmebank://transfer
TransferActivity.onCreate()
TransferViewModel.load()
no session guard found

RE-RUNNABLE CHECK

check · deeplink-auth · no device attached → needs a device to confirm

D The Disprover rejected 4 false positives before this list was shown.

Evidence, not guesses.

Every claim carries a verdict, and every verdict states exactly how far the proof goes.

Confirmed

Reproduced with a re-runnable check or confirmed dynamically on a device. Report it as fact.

Likely

Strong static evidence (decompiled code and a call path), but not yet dynamically confirmed.

Unverified

Flagged for a human to take further. Never reported as fact and never counted as a finding.

THE DISPROVER

One agent whose only job is to prove the others wrong.

It re-runs every claim against the binary. What fails is dropped before you see it: four false positives on the sample above.

A finding you cannot reproduce is a finding you cannot bill for.

Decompiled code for the exact routine
The full call path from entry point to sink
A check you can run again yourself

See how the evidence model works →

Eight parts, one teardown.

Platform agents

One purpose-built agent per platform, grounded in a curated knowledge base of internals, tooling and known weakness patterns.

Evidence on every finding

Decompiled code, the full call path and a re-runnable check ship with every claim. Nothing is asserted bare.

Disprover and validation

A separate agent tries to break each claim before you see it. What survives is labeled; what fails is dropped.

Relationship map

A BloodHound-style graph of endpoints, permissions, secrets, SDKs and the code paths that connect them.

Attack kit

The app's signing and encryption rebuilt as a working Burp extension that re-signs edited traffic.

Hidden API discovery

Endpoints the docs never mention, exported as a collection you can run against a test environment.

Ask the binary

Ask questions of the whole analysis in plain language. Every answer cites the exact code.

Reports in your template

Export to your firm's own template as DOCX, PDF or Markdown, with the evidence attached.

Follow a secret to the request that uses it.

Endpoints, permissions, secrets, SDKs and the code paths that connect them, in one map. Hover or focus a node to trace what it touches.

Code path / permission / endpoint Secret SDK / native lib── Traced relationship

Trust, built in.

Autonomy only works if you can check it. Here is how we are designing Kleydin to be held to account.

Evidence on every finding: decompiled code, call path and a re-runnable check
Every agent action will be logged, so a run can be reviewed step by step
Binaries will be analysed in isolated environments and deleted on request
Customer data will never be used to train models
Audit log for teams: planned
Benchmarks published at launch, misses included

Read our security approach →

Built to turn days of manual reversing into a report-ready result.

BUILT FOR

Pentest firms

Take the reversing hours out of fixed-price engagements.

Mobile security teams

Check every release build before it ships, not once a quarter.

Product security

See what your own app exposes, with evidence your engineers can act on.

Hand your next binary to Kleydin.

Kleydin is pre-launch. Join the list and you will hear from the founder when early access opens.

Get early access See pricing

Reverse engineering, on autopilot.

One binary. Six layers, pulled apart.

Why autonomous, and why now.

Manual reversing doesn't scale

Generic AI scanners guess

Kleydin is autonomous and accountable

Binary in, proven findings out.

Drop

Autonomous teardown

Disprove

Deliver

What “autonomous” means here.

Plans its own analysis per platform

Chooses and runs the tools

Follows leads across native code, network and storage

Stops and asks a human only when evidence is ambiguous

Watch an autonomous teardown.

Evidence, not guesses.

Confirmed

Likely

Unverified

Eight parts, one teardown.

Platform agents

Evidence on every finding

Disprover and validation

Relationship map

Attack kit

Hidden API discovery

Ask the binary

Reports in your template

Follow a secret to the request that uses it.

Trust, built in.

Pentest firms

Mobile security teams

Product security

Hand your next binary to Kleydin.