I am also doing a lot of reverse enginering work for fun and profit. I agree with most parts, except android. While reversing Android apps, usually they are ob

I am also doing a lot of reverse enginering work for fun and profit. I agree with most parts, except android. While reversing Android apps, usually they are obfuscated ( I think it is included in the standard build process ), but when you are start to be familier with objective C (or swift) binaries there are really straight forward, with a nice disassembler and script, in my experience much faster. Request signing, certificate pinning etc are not actually target at reverse engineers, more like to snoopers, replay attackers etc. Also I agree with 4 totally, there is no point there, you should do your security on server side, instead of client side. (Except games I guess, which they can ban players etc, making it a cat and mouse game there can work pretty good actually) Much harder targets, like obfuscated c++, or VMs (bytecode interpreters etc) usually helps with #4, but still then, it just slows down. (This slow down combined with regular changes in protection is basically targeted to make reverse engineers to give up)