We're hiring! Join us and help create the future of ARM virtualization.

Security Research

Physical devices are limited. Your security research shouldn't be. Corellium's revolutionary cloud-based research environment combines high-fidelity virtual devices with powerful integrated tools, giving you unparalleled insight, efficiency, and control to accelerate your mobile security work.

See plans and pricing

Set up in no time. Spin up devices on demand and integrate seamlessly with your existing workflows.


Discover our built-in tools. Conveniently integrated tools let you analyze network traffic, explore system calls, load apps, and browse the filesystem.


Trust the technology you use. Our virtual devices run on ARM for accurate, reliable research.

Unparalleled insight and control

Use device controls to pause, snapshot, or clone devices
Instantly root or jailbreak devices
Easily view device console, file system, apps, https traffic, and system calls
Use device controls to pause, snapshot, or clone devices
Instantly root or jailbreak devices
Easily view device console, file system, apps, https traffic, and system calls

Choose your device

Select from a variety of models and versions.


  • Device Models: iPhone 6 through iPhone 12
  • OS Versions: iOS 10.3 through iOS 15


  • Device Models: Generic
  • OS Versions: Android 7 through 12
Choose your device

Device configuration features

  1. 01
    General device configuration features
    • Boot Arguments: Specify boot arguments that will be passed to the kernel when the device is started.
    • Kernel Slide: Set the randomization slide value used by iOS to relocate the iOS kernel during boot in order to randomize addresses located inside the kernel. 
    • Pointer Authentication Code: Corellium can simulate the behavior of PAC instructions in mobile processors. You have the option to turn this feature on or leave if off.
    • Specify Random Seed: You can optionally specify the 64 byte hex random seed provided by iBoot to the iOS kernel, which affects things like the dyld shared cache slide.  
    • Enable kalloc/kfree trace access via GDB
    • Enable keyboard passthrough from the web interface
  2. 02
    Kernel device configuration features
    • Enable or disable patches applied to the kernel to maximize developer convenience. Choose between Developer Kernel Patches, Stock Kernel Patches, and Completely Unpatched. 
    • Custom Kernel: Instead of the stock kernel, you can upload and use any compatible ARM kernel.
  3. 03
    Other device configuration features
    • Trust Cache: Even when non-jailbroken, you can modify the code directory hashes to allow certain binaries to run even if they are not signed by Apple.
    • Device Tree: You can specify a custom device tree instead of using a stock device tree. 
    • Custom Ramdisk: You can boot the device from a custom ramdisk instead of from NAND. 
    • Device IDs: We randomize unique device identifiers by default, but you can optionally chance them in the device configuration. 
  4. 04
    Other handy features
  5. 05
    Configurable Sensors for Android devices
    • Battery (Charge level, Health, Connection Type, Status)
    • Environment (Temperature, Light, Pressure, Humidity)
    • Location (Latitude, Longitude, Altitude, Time Offset)
    • Motion and Position (Acceleration, Gyroscope, Magnetic, Orientation)

Security research

  • Reduce setup time with instant access to the devices you need
  • Automate your workflows with robust APIs
  • Offload to the cloud to keep resources free on your local machine
  • Eliminate the need for recompiling by testing on ARM

Committed to supporting education and nonprofit initiatives

Whether you're looking to advance your trainings or working on a project that benefits society at large, we're excited to support your work with discounts that will fit your budget.

Reach out for details

What people are saying

There are now Go builders on http://build.golang.org for android/arm, android/arm64, darwin/arm64 (iOS) running on virtual @CorelliumHQ devices. Thanks to @steeve and @zenlyapp we might soon get rid of slow and unreliable physical test devices.
Go is now self hosted on iOS and Android. Meaning it doesn't need a host to compile and run programs on those platforms. What a fine job @eliasnaur and @CorelliumHQ.
Thank you @CorelliumHQ for supporting our training session with your iOS and Android virtual devices! It will be a huge help for our students at @typhooncon 10th June // Seoul "Offensive Mobile Reversing and Exploitation". For registration go to typhooncon.com/registration/
Just got my hands on @CorelliumHQ — saying that my mind is blown is an understatement. This is the future of iOS security research. (and my eternal fear of bootlooping my physical devices is gone!) Huge thanks to @cmwdotme and @chronic!
@CorelliumHQ is easily one of the most impressive platforms I've seen. Happy to share that students attending the @BlackHatEvents @MDSecLabs Mobile Training will get to play with this first hand! blackhat.com/us-18/training... #BHUSA
Live kernel debugging on a virtualised iOS 12.0! Having the ability to do this sort of thing with whichever iPhone/version you want is gonna greatly assist developers & researchers with future iOS kernel security research.
So much this. Craziest thing for me was just having it show up as a run destination in Xcode (oh yeah and it has ssh and cycript). Real iOS virtualization in the cloud is /awesome/. Nice work @cmwdotme and team!
Watching an online virtual iPhone 8 Plus installing a copy of iOS 11.4 in a browser is *wild*. Then proxying it to USB so you can build & run directly from Xcode? @cmwdotme's @CorelliumHQ is so freaking cool.

Frequently asked

What types of devices can I create?

Users can virtualize generic Android devices with AOSP versions 7 - 11, as well as a variety of iPhone, iPad, and iPod devices, from the iPhone 6 through the iPhone 12, with any supported version for the specified model from 10.3 through the latest.

What's the difference between "active" and "stored" devices?

Active devices are devices in the On state. They occupy both CPU cores and storage. When you turn a device Off, it becomes Stored. It will still occupy storage, but no longer occupy CPU cores. Monthly subscriptions provide a specified number of active device slots, and for each active device slot, you get 5 storage slots. Usage-based subscriptions are priced per hour per active device or per day per stored device.

Is my device data encrypted?

Yes, all virtual device data is encrypted at rest, with the keys only known to the main database and, temporarily, to the particular compute node responsible for running the virtual device when it is running.

Can you tell me more about device and account deletion?

When a virtual device is deleted, it is securely erased, and all device data is immediately erased in S3. Device metadata, such as the name of the device and the OS version, is stored in backups, which are regularly deleted. When a user deletes an account, all devices in that account are erased, and we only preserve analytics data restricted to account subscription and account deletion.

Latest NewsChecking Suspicious Links with Corellium

© Corellium 2021