Byteria is a mobile application security vendor based in Bursa, Turkey.
Its products harden app code before release and detect attacks while the app runs on a user’s device.
Byteria lists three named products. Alphyn is the runtime self-protection SDK, UpShield is the build-time obfuscator, and Renef is an open-source Android instrumentation toolkit.
The Alphyn portal drills from an app down to a single device, showing its risk score and the ordered event timeline behind it.
Byteria states that it holds ISO/IEC 27001:2022 certification from DSR Certification.
What is Byteria?
Byteria targets the runtime layer rather than the network edge. Its argument is that a WAF inspects requests that already left the device, and store review looks at the binary once, before release.
Alphyn runs inside the app process instead. From there it has direct visibility into device state, injected libraries, and the code actually executing.
The three products cover different stages. UpShield hardens the binary at build time, Alphyn monitors it at runtime, and Renef is an instrumentation toolkit Byteria publishes for security researchers.
| Product | What it is | Where it runs |
|---|---|---|
| Alphyn | Runtime self-protection SDK with 140+ detection modules (vendor figure) | Inside the app process, Android and iOS |
| UpShield | Code obfuscator: renaming, string encryption, control-flow flattening, dead code | Build time, in CI |
| Renef | Apache-2.0 ARM64 dynamic instrumentation toolkit | Android device, researcher-driven |
| Alphyn portal | Console for policy, device telemetry, rulesets, and SIEM export | Hosted at portal.byterialab.com |
| Alphyn CLI | Wires the SDK dependency, initialization, and build registration hook | Developer machine or CI |
What are Byteria’s key features?
Detection that keeps working offline
Byteria states that all Alphyn detection and response logic runs on the device rather than in a cloud round-trip, so protection stays active on low-signal and restricted networks.
Byteria also describes the checks as polymorphic: the combination and order shift per build. A bypass written against one release is not meant to survive the next one.
A server-side gate behind the client checks
According to Byteria’s Alphyn documentation , sensitive actions complete only when the server receives a fresh, valid attestation from the live app.
This design connects the app’s integrity checks to the backend’s authorization decision. Byteria describes it as a way to prevent sensitive actions when the SDK has been removed or tampered with.
Policy lives in the portal, not the binary
You decide per check what happens: record it silently, degrade the feature, or end the session.
Because the policy sits in the portal, retuning a noisy check does not cost you an app store release.
App-level view in the Alphyn portal: request volume, security events, unique devices, and a threat timeline, plus tabs for app hashes and build signatures.
SDK requirements and supported targets
| Item | Detail |
|---|---|
| Android minimum SDK | API level 26 (Android 8.0) |
| Android target SDK | API level 35 recommended |
| Language support | Java 8+ or Kotlin |
| iOS | Swift and Objective-C |
| Cross-platform | Flutter, React Native, Unity |
| Permissions | Declared in the AAR and merged automatically; no manual entries |
QUERY_ALL_PACKAGES | Not declared; a generic-intent <queries> block is shipped instead |
| Scan result states | TRUSTED, FLAGGED, UNTRUSTED, UNKNOWN, INITIALIZATION_ERROR |
Google restricts QUERY_ALL_PACKAGES to qualifying use cases
and requires a permissions declaration. Omitting this permission avoids that specific declaration; package visibility still has to comply with Google’s policies.
What does Alphyn detect on Android and iOS?
The two platforms fail differently, so the checks differ while the policy stays shared. Byteria publishes the mapping directly.
| Runtime threat | On Android | On iOS |
|---|---|---|
| Privilege escalation | Magisk, Zygisk, KernelSU, su binaries, DenyList and Shamiko-style hiding | checkra1n, palera1n, Dopamine, rootless jailbreaks, Cydia/Sileo/Zebra footprints |
| Dynamic instrumentation | Frida servers and gadgets, Xposed, LSPosed, EdXposed, Riru | Cydia Substrate, Substitute, ElleKit, fishhook, arbitrary dylib injection |
| Code tampering | APK signature, signing certificate, DEX checksum | IPA resigning, provisioning profile swaps, sideloaded builds |
| Debugging | ptrace attachment, JDWP, native tracing | PT_DENY_ATTACH, sysctl process flags, DYLD environment |
| Virtual environment | Emulators, virtualized device farms, cloud phone services | iOS Simulator runtimes and virtualization |
| Detection bypass | Root hiding modules | Shadow, Liberty Lite, A-Bypass tweaks |
| Interface abuse | Screen recording, tapjacking overlays, accessibility services | — |
Byteria’s published detection catalogue includes Shamiko, EdXposed, and A-Bypass among the named targets.
Byteria lists 140+ detection modules and maps its coverage to OWASP MASVS-RESILIENCE.
How does UpShield harden code?
UpShield is a separate build-time step, not part of the SDK. You upload a source archive as a ZIP, pick the obfuscation plugins, and get a hardened build back.
The console has a protection strength scale from 1 to 10. The screenshot below shows Balanced at 5.
Each level builds on the ones below it, and the server resolves the exact plugin pipeline.
Creating an UpShield job: strength scale, opt-in VM lifting, and the target platform choice that decides which Base64 decoder the obfuscated output uses.
| Option | What it does |
|---|---|
| Symbol renaming | Rewrites variable and function names into opaque identifiers |
| String encryption | Encrypts string literals in the binary |
| Control-flow flattening | Collapses logic into a dispatch loop, applied from strength level 5 |
| Dead code injection | Inserts misleading code blocks |
| VM lifting | Lifts methods marked // @UPSHIELD_VIRTUALIZE into custom bytecode run through libupshield_vm.so |
| Target platform (Java/Kotlin job) | Android uses android.util.Base64, available from Android API 8; Plain JVM uses java.util.Base64, available in Android’s platform API from level 26 |
The target-platform row reflects the Java/Kotlin job shown in the console, with API availability checked against Android Base64 and Java Base64 documentation.
The screenshot illustrates the Java/Kotlin workflow. Byteria’s UpShield product page also lists iOS support.
VM lifting is opt-in and requires NDK wiring on your side. It is also orthogonal to the strength scale, so a light obfuscation pass can still virtualize selected methods.
UpShield runs in GitHub Actions, GitLab CI, Bitbucket Pipelines, and Jenkins.
// @UPSHIELD_VIRTUALIZE. Scope is per-method by design, so the virtualized set stays whatever you annotate.What is Renef?
Renef is an Apache-2.0 dynamic instrumentation toolkit for Android ARM64. Its source code is available on GitHub , and its scripting interface supports native and Java analysis.
The architecture is built to avoid the usual detection surfaces. Renef communicates over Unix Domain Sockets on the device and injects via memfd and shellcode rather than ptrace.
Renef offers another option for researchers familiar with tools such as Frida . Its documented architecture uses memfd-based injection and Unix Domain Sockets for on-device communication.
| Capability | Detail |
|---|---|
| Native hooking | PLT/GOT and inline trampoline hooks for ARM64, with Capstone-based disassembly |
| Java hooking | Java method interception exposed through the scripting interface, implemented with native ART method hooks |
| Scripting | Embedded Lua 5.4 engine |
| Memory operations | Scan, read, write, and patch memory at runtime |
| Injection | memfd plus shellcode, avoiding ptrace security checks |
| Transport | Unix Domain Sockets on device; client connects over ADB-forwarded TCP port 1907 |
| Interface | Interactive TUI for memory scanning |
Published use cases include SSL pinning bypass, root detection bypass, crypto key logging, and function tracing. Documentation lives at renef.io .
What does Byteria integrate with?
Kotlin
Flutter
React Native
Unity
GitHub Actions
GitLab CI
Bitbucket Pipelines
JenkinsThe portal also supports SIEM integration and MFA transaction signing .
Byteria vs Talsec
Byteria documents support for Android, iOS, Flutter, React Native, and Unity. Talsec lists nine SDK targets across its portfolio, including Cordova, Kotlin Multiplatform, and Unreal Engine.
Talsec additionally lists Apple TV, Android TV, and Fire TV as supported devices.
Talsec’s freeRASP license distinguishes MIT-licensed open-source components from proprietary binaries. Free use is subject to a Fair Usage Policy , including a cumulative 100,000-device limit across the customer’s apps.
Talsec lists RASP+ Starter at €284/month for up to 10,000 app downloads. Contact Byteria for a quote covering Alphyn and UpShield.
Both vendors extend past RASP, but into different work. Talsec’s hardening centres on Secret Vault and dynamic TLS pinning; UpShield does code obfuscation and VM lifting.
Both also anchor the trust decision server-side. Talsec’s AppiCrypt validates a cryptogram on your backend; Alphyn requires a fresh attestation before a sensitive action clears.
Talsec is an option for teams using its additional platform targets or starting with freeRASP under its usage terms.
Byteria is an option for teams that want separately configurable code obfuscation and runtime protection from one vendor.
Byteria vs Guardsquare
Guardsquare covers the same pairing with DexGuard for Android and iXGuard for iOS. It also created ProGuard, the original Android code optimizer, though R8 is now the default shrinker in Android builds.
Guardsquare also sells AppSweep for mobile security testing, and documents polymorphic obfuscation across Flutter, React Native, Unity, Cordova, and Ionic. Byteria lists testing, penetration testing, and supply-chain protection as services rather than named products.
The configuration surfaces differ. DexGuard uses ProGuard-compatible rules in the Gradle build and iXGuard uses an ixguard.yml file in the Xcode workflow, with a guided portal alongside both.
Byteria’s published console shows a 1-10 strength scale and per-method annotations for VM lifting.
Neither vendor publishes prices for its obfuscation product. Request a quote for the required platforms and build workflow.
Pick Guardsquare if you want one vendor covering obfuscation, RASP, and pre-release testing, or already run ProGuard rules you can carry forward.
Pick Byteria if the annotation-scoped VM lifting fits your build, or you want the runtime detection catalogue named tool by tool.
How much does Byteria cost?
Contact Byteria for commercial pricing based on the products and platforms you need.
The Alphyn product page has a “Start for Free” option. Confirm the trial’s scope and terms with Byteria when arranging an evaluation.
Renef is the exception. It is Apache-2.0 and free to use.
How do you get started with Byteria?
- Register your app in the Alphyn portal and collect the app API key.
- Set the registry key in your build environment:
export ALPHYN_REGISTRY_KEY=<YOUR_APP_API_KEY>. - Run
alphyn-cli integrate --android-api-key <key>to wire the SDK dependency, initialization, and the build registration hook. - If your build cannot reach the registry, download the self-contained AAR from the portal’s SDK Downloads page and add it under
app/libs/instead. - Implement the security listener, then set the per-check response policy (log, degrade, terminate) in the portal.
The Android integration guide recommends the CLI. The manual AAR includes the native libraries and needs no registry key to resolve the SDK dependency.
Manual integration still requires registering the app’s signing-certificate hash with Alphyn’s backend. The SDK rejects an unregistered hash; for Play App Signing, register Google’s signing certificate rather than your upload certificate.
When should you use Byteria?
Byteria fits an app that already shipped and now faces real attackers: a banking app, a wallet, or a game with a cheating problem.
These cases need runtime monitoring in addition to pre-release vulnerability discovery.
It also fits teams that want obfuscation and RASP from one vendor rather than two contracts.
The Alphyn portal navigation includes a Java code obfuscation entry alongside the RASP controls.
Alphyn focuses on runtime protection. Teams that also need pre-release vulnerability analysis can pair it with a MAST tool such as MobSF , Ostorlab , or Oversecured .
What are alternatives to Byteria?
Talsec offers freeRASP with usage limits and publishes pricing for commercial plans. Guardsquare combines hardening and RASP through DexGuard and iXGuard, with AppSweep for testing.
Appdome takes a different route, injecting protections into a compiled binary with no SDK integration or code changes. That suits teams who cannot touch the app source.
Data Theorem pairs runtime protection with continuous app-store monitoring. For pre-release binary analysis instead, Zimperium zScan covers that stage. The full list is on the mobile security tools page.
What should you confirm before integrating Byteria?
Choose the products and platform targets for your app, then agree on commercial and evaluation terms with Byteria.
For iOS, review the platform-specific integration steps. The UpShield screenshot in this article illustrates the Java/Kotlin workflow.
For annotated VM lifting, plan the NDK integration described in the UpShield console. For manual Alphyn integration, include signing-certificate registration in your release checklist.
This overview is based on Byteria’s public product pages and documentation.