Mobile Sandboxing Platform

Build beyond
real devices.

Secure, isolated iOS and Android environments for testing, research, and automation. Spawn a device, drive it, inspect it, on your own fleet or in the cloud.

Launch console Explore the platform

Built for

Red TeamsAppSecDevice LabsVR TeamsCTIPlatform QA

fleet · consolelive

ios-vr-01iOS 17.4Exploit

cf-mask-07AOSP 14Masked

avd-ci-22Android 13Rooted

e2b-build-3LinuxCloud

34%

CPU

61%

Memory

128

devices live

device & cloud backends

iOS + Android

real OS, not simulators

< 15s

to a booted device

SDK · CLI · MCP

drive it from anywhere

The platform

Three primitives, one normalized surface.

Nodes, providers, and instrumentation compose into a cloud-style console and API for virtual mobile devices.

Nodes

Any host (Linux, macOS, Windows) becomes a node with a one-line installer. The agent binds loopback and is never exposed; remote nodes open an outbound tunnel, so there are no inbound ports to secure.

Providers

iOS VMs, iOS simulators, Android AVDs, masked Cuttlefish, and cloud sandboxes all normalize to one sandbox shape. The console and SDK never branch on node-vs-cloud, so adding a backend is a single registry entry.

Instrumentation

Frida, hosted traffic capture, raw adb, VNC/H.264/WebRTC screen, on-device lldb, and a guest-kernel gdb stub — all relayed same-origin through the control plane with per-feature access control and a full audit trail.

Devices

Every device you need, on demand.

iOS virtual devices, Android AVDs, masked AOSP that passes for real hardware, and cloud sandboxes to scale the rest.

iOSvphone

Real iOS, not a simulator.

iOS 15 – 18

Full iOS guests on Apple silicon, booted from real firmware
Stock, Jailbroken, and Exploit-Research security modes
Root shell, writable filesystem, Sileo/TrollStore in JB mode
VNC screen, file browser, IPA sideload

provisioned~ 14s to boot

Solutions

One platform, four jobs.

Mobile App Pentesting

Launch controlled iOS and Android environments on demand, with the low-level access physical devices make painful. Intercept traffic, hook runtime, and drive hardened apps without managing hardware.

Mobile App DevOps

Spin up iOS and Android sandboxes from your own code and CI. Golden images, snapshots, and templates make provisioning reproducible and near-instant, and cloud sandboxes scale the Linux steps without nodes.

Vulnerability Research

Root-level access, kernel visibility, and snapshots to move faster from crash to clarity. Return to the exact device state behind a finding and validate whether it is reproducible, exploitable, or worth going deeper.

Malware Analysis

Detonate evasive, RASP-aware samples without exposing real devices or production systems. Observe what a sample changes, stores, accesses, and communicates, then throw the device away.

Instrumentation

See what the app actually does.

Hook the live process, intercept every byte, and drop below the app surface, all relayed same-origin with per-feature access control.

Frida inject & stream

frida · pinning-bypass.jslive

[hook] SSL_CTX_set_verify → 0 (disabled)

[send] {"pinning":"bypassed"}

[hook] NSURLSession.dataTask intercepted

[stalker] 0x1004c21a0 libnative.so

[hook] getClassLoader spoofed

[send] strings → 37 captured

[hook] SSL_CTX_set_verify → 0 (disabled)

[send] {"pinning":"bypassed"}

[hook] NSURLSession.dataTask intercepted

[stalker] 0x1004c21a0 libnative.so

[hook] getClassLoader spoofed

[send] strings → 37 captured

Hosted traffic capture

traffic · mitmproxylive

200 POST api.target.app/v3/auth · 412ms · tls1.3

GET cdn.target.app/config.json · 88ms

200 POST api.target.app/track · pinned · bypassed

401 GET api.target.app/me · 120ms

WS rt.target.app/socket · upgrade 101

200 POST api.target.app/v3/refresh · jwt

200 POST api.target.app/v3/auth · 412ms · tls1.3

GET cdn.target.app/config.json · 88ms

200 POST api.target.app/track · pinned · bypassed

401 GET api.target.app/me · 120ms

WS rt.target.app/socket · upgrade 101

200 POST api.target.app/v3/refresh · jwt

Guest-kernel gdb

gdb · vmlinuxlive

$ orchard gdb vr --vmlinux ./vmlinux

Remote debugging using :1234

Reading symbols from vmlinux...

Breakpoint 1, do_filp_open () at fs/namei.c:3714

3714 filename = getname(pathname);

(gdb) info registers

x0 0x0000007fb3c4e080 x1 0x0000007fb3c4e100

↻ whole VM frozen · anti-debug bypassed

Developers

A device is a line of code.

The same selector drives a device from the Python and TypeScript SDKs, the CLI, and an MCP server that puts a phone in front of an LLM agent.

Streaming channels for logs, shell, screen, and mitm flows
Scoped API keys restricted to a device or tag
Wire it into GitHub Actions, GitLab, Jenkins, or CircleCI

Developer docs

pentest.py

from orchard_sdk import Orchard
oc = Orchard(api_key="orc_...")
# spawn a masked Android device on the fleet
dev = oc.sandboxes.create(platform="android", image="cuttlefish", tag="pentest")
dev.wait_until("running")
# intercept TLS through your own Burp over a reverse tunnel
dev.proxy.tunnel(to="127.0.0.1:8080")
# bypass SSL pinning with a Frida script, stream the hooks back
for msg in dev.frida.stream(script="pinning-bypass.js"):
    print(msg["payload"])

Self-hosted end to end

Control plane, console, and your own nodes in your own infrastructure. Air-gapped installs supported.

Compromised-by-design safety

Agents bind loopback, nodes network-isolate, and every device is disposable per session.

Snapshots & templates

Capture a device state, clone fresh copies, and return to a known baseline in seconds.