App wrapping

How it works

Take a finished binary, open it, rewrite it. A wrapping tool unpacks an IPA or an APK, inserts its own library, redirects the calls it cares about (file writes, clipboard, network, screenshot) toward that library, repacks everything and signs the result with your enterprise identity. On iOS that meant method swizzling against system frameworks; on Android, rewriting DEX bytecode or shimming the application class. The app ships out of your own channel, and on launch it asks for the wrapper's PIN before the original code runs.

Re-signing is the catch, and it's structural. Android identifies an app by package name plus certificate, so a wrapped app signed by you is a different app from the vendor's: Play updates stop reaching it, Play App Signing doesn't apply, and Play Integrity attestation fails because the signature hash no longer matches a known one. On iOS, repackaging required the Apple Developer Enterprise Program, which Apple tightened sharply in 2019 after several companies abused it to distribute apps to the public. Public store apps also forbid repackaging in their license terms, so in practice only your own apps and a handful of cooperating vendors could ever be wrapped.

The tools themselves were real products: MobileIron AppConnect, Citrix MDX, BlackBerry Dynamics, and Microsoft's Intune App Wrapping Tool, which still exists for line-of-business apps alongside the Intune App SDK. They worked. They just needed maintenance after every iOS and Android release, and the two to six weeks that took landed squarely in the window when your users had already updated their phones.

Why it matters for a fleet

If you inherited a wrapped app, you know the symptom: a crash that only happens on the current OS, the app vendor pointing at the wrapper, the wrapper vendor pointing at the app, and no stack trace either of them accepts. Add certificate pinning or an integrity check inside the app and the wrapper breaks it. Add a wrapper and the app's own crash reporting goes blind.

The replacement came from the operating systems. Apple's managed app state separates managed and unmanaged data, with managed open-in rules and a managed pasteboard boundary since iOS 15. Android Enterprise draws the same line with the work profile: a hard container the OS enforces, not a library you injected. Managed app configuration delivers settings at install time, per-app VPN routes only the traffic you choose, and selective wipe removes work data while leaving the phone alone. None of that requires touching the binary, and none of it breaks in September when a new OS ships.

How Appaloosa handles it

Appaloosa doesn't wrap apps, and that's a deliberate choice. Your internal APK or IPA is distributed exactly as you signed it, with no repackaging, so crash reports stay meaningful and integrity checks keep working. Control comes from the OS layer instead: managed install, work profile separation, managed app configuration, compliance policies and selective wipe. The approach is described on the Mobile Application Management page.