available_for_work
Hi, I'm Shahzaib

Android Reverse Engineer

Android Reverse Engineer — I dissect APKs, extract private APIs, defeat SSL pinning & obfuscation, and rebuild the crypto. Frida · Jadx · Ghidra · IDA Pro · Burp Suite · Python.
View RésuméHire MeIslamabad, Pakistan
SA
apkators@dss:~

➜ whoami

shahzaib_ali — android reverse engineer @ DSS

➜ cat ./toolchain

frida · jadx · ghidra · ida-pro · burpsuite · apktool · python

➜ status

[ ONLINE ] available for freelance & contract work

0+
Years Experience
0+
APKs Reverse Engineered
0+
Private APIs Extracted
0.0★
Client Rating
01.

About

I'm a Reverse Engineer based in Islamabad with 5+ years dismantling Android applications for a living. My day-to-day is static & dynamic analysis — pulling apart obfuscated APKs in Jadx/Ghidra/IDA Pro, instrumenting live processes with Frida, and intercepting traffic through Burp Suite to recover hidden REST/GraphQL endpoints, signature algorithms and encryption schemes. I've reverse engineered 60+ apps, extracted APIs from platforms like TikTok, Snapchat, SnackVideo, YouTube, WhatsApp & LinkedIn, and rebuilt their private request-signing logic in clean Python. Currently a Reverse Engineer at DSS (Defence Solution & System), and a Level 2 / 5.0★ freelancer trusted by 38+ clients worldwide.

02.

Capabilities

API Extraction & Reconstruction

Recover hidden REST/GraphQL/gRPC endpoints from any app and rebuild the exact request-signing logic in clean Python wrappers.

SSL Pinning & MITM Bypass

Universal Frida & Objection scripts to defeat certificate pinning, root and emulator detection for full traffic visibility.

Deobfuscation & Static Analysis

Untangle obfuscated bytecode and native libraries in Jadx, Ghidra and IDA Pro to map an app's real behaviour.

Frida Dynamic Instrumentation

Hook, trace and rewrite methods at runtime to expose parameters, keys and control flow while the app runs.

Encryption / Decryption Reversing

Reverse custom AES/RSA layers, HMAC signatures and token schemes — then reproduce them programmatically.

Signature & Token Generation

Replicate device attestation, anti-bot signatures and auth tokens for reliable, automated API access.

Python Automation & Wrappers

Turn reversed protocols into fast, maintainable Python libraries, bots and integration-ready SDKs.

Mobile App Security Assessment

Audit Android apps for weak crypto, insecure storage and exposed secrets — with actionable remediation.

03.

Experience

D

DSS — Defence Solution & System
Full-time

2021 - Present
Android Reverse Engineer
Reverse engineered 60+ Android apps end-to-end. Extracted and reconstructed private APIs from major platforms (TikTok, SnackVideo, Snapchat, YouTube, WhatsApp, LinkedIn and more). Implemented hidden request-signing algorithms and encryption/decryption schemes in code, built Frida instrumentation and SSL-unpinning tooling, and automated everything in Python. Daily driver of Apktool, Jadx, Burp Suite, IDA Pro, Ghidra and Postman.
F

Freelance — Fiverr & Upwork
Level 2
5.0★

2021 - Present
Reverse Engineering & Mobile Consultant
Level 2 Seller with a 5.0★ rating across 38+ reviews. Deliver APK reverse engineering, API extraction, MITM/SSL-pinning bypass and mobile app consultation to clients across the US, EU and Asia. Average response time: 1 hour.
K

Keswa Techsol

2020 - 2021
Android Developer
Built native Android apps with REST API integration, modern architecture (MVVM), Flask-based backends and Firebase. This dev foundation is exactly what makes tearing apps apart second nature.
04.

Arsenal

Reverse Engineering
APK / Smali
API Extraction
Frida
Jadx
Ghidra
IDA Pro
Burp Suite
SSL Unpinning / MITM
Apktool
Encryption / Decryption
Anti-Debug Bypass
Root / Emulator Detection Bypass
Native (JNI / .so)
Protobuf
Xposed / LSPosed
Retrofit / OkHttp
Python Automation
Postman
Java
Kotlin
Ethical Hacking
05.

Selected Work

A look at the kind of reverse-engineering I ship. Client work is confidential — these are anonymized case studies.

~/re/social-api-extraction-suite
$ frida -U -f com.target.app -l hook.js
[+] hooked NativeSign.gen()
[+] X-Signature recovered ✓

Social API Extraction Suite

Confidential · Ongoing

Reversed the private request-signing algorithms of major social platforms (TikTok, Snapchat, SnackVideo, YouTube) and rebuilt them as clean, well-tested Python wrappers — signatures, tokens and pagination fully replicated for reliable automated access.

Frida
Jadx
Python
Protobuf
Signature Reversing
OkHttp
~/re/universal-ssl-unpinning-toolkit
$ objection -g com.target explore
(target) # android sslpinning disable
[+] pinning bypassed ✓

Universal SSL-Unpinning Toolkit

Confidential

A drop-in Frida/Objection toolkit that defeats certificate pinning, root and emulator detection across the vast majority of Android apps — giving full MITM visibility in Burp Suite within seconds.

Frida
Objection
Burp Suite
MITM
Anti-Detect
~/re/apk-crypto-native-reversal
// recovered key schedule
key = HKDF(deviceId, salt)
cipher = AES_GCM(key, iv)  // ✓ matches app

APK Crypto & Native Reversal

Confidential

Reverse engineered custom AES/RSA layers and .so native libraries in Ghidra & IDA Pro, recovering keys and HMAC schemes hidden deep in JNI code, then reproduced the full encrypt/decrypt flow in code.

Ghidra
IDA Pro
JNI / .so
AES / RSA
C / Python
~/re/anti-bot-signature-generator
$ python gen_sig.py --device pixel8
{ "x-argus": "…", "x-gorgon": "…" } ✓

Anti-Bot Signature Generator

Confidential

Replicated device attestation and anti-bot signatures so client automation could pass server-side integrity checks — turning a hard-blocked endpoint into a stable, scriptable API.

Frida
Smali
Attestation
Python
Reverse Eng.
06.

Education & Certs

U

University of the Punjab

2017 - 2021
Bachelor of Computer Science (CGPA 3.80 / 4.00)
P

Punjab College

2015 - 2017
Intermediate in Computer Science (ICS)
U

Udemy

2023
Android Reverse Engineering & Malware Analysis
U

Udemy

2022
Frida & Dynamic Instrumentation for Mobile
S

Soft Solutions

2017
Object Oriented Programming (C++)
07.

Client Reviews

5.0★38+ reviewsLevel 2 Seller

“Fast and professional. Not a lot of gigs can do what he did for me — will hire again soon when needed.”

K

katie_progroup

🇺🇸 United States · Fiverr

“I hired him for a software project and he delivered exceptional results. The application was bug-free, completed ahead of schedule, and built with great attention to detail. Communication and professionalism made the process smooth, and the final product exceeded expectations. Highly recommend!”

R

romenberman

🇮🇳 India · Repeat Client · Fiverr

“Shahzaib consistently delivers impactful reverse-engineering solutions with strong technical expertise and a collaborative approach. His problem-solving and commitment to quality make him a standout on the team.”

JZ

Jahan Zaib

Team Lead · DSS (Defence Solution & System)

08.

Contact

contact.sh

Let's crack it open

Got an APK to reverse, an API to extract, or security to test? Send a clear, direct brief and I'll reply within the hour. No unsolicited offers, please.

apkators@gmail.comLinkedIn
LinkedIn