Exploit and payload research
Connect delivery to behavior.
Study the exploits and payloads used in targeted spyware, including threats such as Pegasus. Connect delivery to processing and execution.
- Input
- Behavior
- Execution
Cyber weapons. Exposed.
BELDRIN is a research phone running full iOS emulation, with physical iPhone behavior and working Apple services. It supports the discreet investigation of targeted digital threats in sensitive environments, so security teams can examine covert activity, establish the facts and inform a measured response.
Built to capture. Ready to investigate.
Physical iPhone behavior and working Apple services create a connected environment for capturing covert attacks. Preserve the exploit and examine its execution inside the device.
Device behavior supports payload capture and investigation. Conceptual research device illustration.
Connected. Like an iPhone.
Bluetooth, physical SIM and eSIM, baseband and Apple services stay within reach of the investigation, because an attack may use any of them.
Proximity activity. Bluetooth support brings a proximity-based attack surface into the research environment, so activity from nearby devices can be studied.
Cellular identity. Physical SIM and eSIM support give the research phone a cellular identity for connected investigations.
Cellular functionality. Baseband support brings cellular functionality into the environment used to capture and investigate attacks.
Connected to the ecosystem. Working Apple services keep the research phone connected to the ecosystem targeted payloads may use.
Select a connection to explore the research phone.
Where a payload can arrive.
A message. A nearby transfer. An incoming call. Follow each one past the familiar interface, into BELDRIN’s capture and research environment.
iMessage. A message and its attachment reach iOS. Follow delivery and processing inside the research phone.
AirDrop. Nearby transfer activity reaches the research phone. BELDRIN connects the incoming event to the processing behind it.
FaceTime. A call request reaches the research phone. Observe the incoming activity and examine the execution context available for research.
- Arrive
- Process
- Observe
Illustrative delivery paths and captured events.
Covert delivery. Under observation.
Field Relay accompanies senior officials, diplomats and executives, collecting supported radio signals around them and forwarding that activity to the BELDRIN research phone in real time.
Captured payloads and execution traces support investigations into targeted espionage, including suspected state-sponsored attacks. Security teams can examine the delivery, preserve the evidence and prepare a response.
Two devices. One investigation.
- Observe the surroundings
- Relay to the research phone
- Inspect the relayed activity
Activity around the individual
Field Relay collects supported signals
Relayed to BELDRIN for investigation
Supported radio connections only.
Their weapon. Your evidence.
From cyber weapon to evidence.
Move from a suspicious delivery to the payload and its behavior. Examine the captured activity in BELDRIN and follow the execution behind the attack.
Incoming payloadResearch session
Illustrative scenario. No recorded attack data.
See where it executed.
Follow a captured event into its execution context. Inspect kernel instructions, thread state and register changes, with the delivery context kept alongside the trace.
Representative trace. Synthetic addresses and instructions.
Instruction timeline
- Read header+12.486 ms
- Size check+12.488 ms
- Bounds branch+12.490 ms
- Resolve body+12.492 ms
- Read descriptors+12.494 ms
- Advance cursor+12.496 ms
- Count check+12.498 ms
- Continue IPC+12.500 ms
Disassemblymach_msg_trap_send
- 08a3c100 ldr w1, [x0, #0x4] message size
- 08a3c104 cmp w1, #0x1c minimum complex header
- 08a3c108 b.lo 0xfffffff008a3c160 not taken
- 08a3c10c add x2, x0, #0x18 body pointer
- 08a3c110 ldr w3, [x2] descriptor count
- 08a3c114 add x2, x2, #0x4 descriptor data
- 08a3c118 cmp w3, #0x8 fixture capacity
- 08a3c11c b.hi 0xfffffff008a3c160 not taken
- 08a3c120 ldr w1, [x2] next field
- 08a3c124 add x2, x2, #0x10 advance descriptor
Read header. Read the preserved message size.
Registers
- pc
- 0xfffffff008a3c100
- x0
- 0xffffffe1a44bc800
- x1
- 0x0000000000000000
- x2
- 0x0000000000000000
- x3
- 0x0000000000000000
Call stack
- 0mach_msg_trap_send
- 1mach_msg2_trap
- 2mach_syscall
Investigation use casesResearch and assessment of observed activity.
The weapon. The target. The evidence.
Counter-espionage
Investigate suspected targeting.
Investigate suspected espionage against senior officials, diplomats and executives, including possible state-sponsored targeting. Connect delivery, captured payloads and execution context to establish what happened and inform the response.
- Individual
- Observed activity
- Evidence
Reverse engineering
Follow what the payload does.
Move from a captured payload to its execution context, then inspect the code path and kernel activity behind the attack.
- Captured payload
- Code path
- Kernel
Illustrative research workflows and analyst assessment.
One device. Every perspective.
From the first signal to kernel execution.
Investigate the cyber weapons behind targeted espionage, from their delivery in the field to execution inside the device.
-
Capture
Payload capture
A connected research environment for examining payloads aimed at real people.
-
Connect
Native connections
Bluetooth, physical SIM, eSIM, baseband and working Apple services.
-
Bring it in
Field Relay
Bring supported radio activity from the person’s surroundings into a controlled investigation.
-
Inspect
Kernel view
A debugger-like environment for examining where captured activity executed.
Take a closer look
See BELDRIN in action.
Discuss your counter-espionage requirements, and we’ll take you through BELDRIN.
Contact