TECHNICAL LOG · 2026-07
A dated technical log, one entry a day, newest first. Entries for 2026-07-01 to 2026-10-11 are historical reviews written later and first published from 2026-10-12, not on the day they cover; each shows both the covered date and the real publication date. Later entries are published on their actual dates.
Two Android exploration papers (originally QRS 2024 and DSA 2023) were posted to arXiv that day, a reminder that client-side flows can be traversed systematically.
Historical technical review (written later) · Covers · First published
Read entryThe paper extracts and reproduces an agent system's harness through black-box interaction alone, showing AI products can be cloned without shipping code.
Historical technical review (written later) · Covers · First published
Read entryNode.js shipped security updates for 26.x, 24.x and 22.x fixing 11 CVEs, including a high-severity Permission Model path-matching flaw.
Historical technical review (written later) · Covers · First published
Read entrynpm began scanning new packages before they become installable and asked dual-use packages, including code-obfuscation tools, to declare contentPolicy and a DISCLOSURE file.
Historical technical review (written later) · Covers · First published
Read entryResearchers made a tampered strip propagate through the NixOS bootstrap by manipulating ELF binaries alone, showing post-build tools belong to the trust chain.
Historical technical review (written later) · Covers · First published
Read entrySemref combines LLM semantics with dependency analysis to improve architecture recovery, showing that understanding large code structures is getting cheaper.
Historical technical review (written later) · Covers · First published
Read entryPraxis identifies malicious behavior through a hypothesize-confirm-judge pipeline and reports fewer false positives on high-permission benign apps.
Historical technical review (written later) · Covers · First published
Read entryThe paper shows LLMs can produce PoCs from fixing commits before detailed reports exist, making the gap between fix and user adoption more critical.
Historical technical review (written later) · Covers · First published
Read entryThe paper uses an LLM to mark suspicious code and prioritize loop exits so KLEE reaches deeper bugs, a technique defenders can apply to their own code first.
Historical technical review (written later) · Covers · First published
Read entryA paper found evidence-grounded orchestration of small models can match or beat a single large model on detonation reports, though accuracy stayed modest.
Historical technical review (written later) · Covers · First published
Read entryThe Android blog showed Firebase AI Logic and hybrid inference with App Check against API abuse, while prompts still lived in client code.
Historical technical review (written later) · Covers · First published
Read entryApktool v3.0.3 fixed several resource-decoding issues, a reminder that APK resources are as visible as code.
Historical technical review (written later) · Covers · First published
Read entryILSpy 11.0 Preview 1 moved to Avalonia, decompiles more recent C# constructs and bounds several parsers against crafted input.
Historical technical review (written later) · Covers · First published
Read entryVersion 5.5.0 only reworked Pro API large uploads, but it is a reminder that cloud obfuscation sends your source outside your build environment.
Historical technical review (written later) · Covers · First published
Read entryFrida 17.16.0 (17 Jul 2026, UTC) fixed several arm64e and modern-iOS injection paths, a reminder that runtime instrumentation keeps pace with platform hardening.
Historical technical review (written later) · Covers · First published
Read entrySyft 1.48.0 added a macOS .app cataloger and Go binary symbol capture, and can find dependencies inside .NET single-file bundles.
Historical technical review (written later) · Covers · First published
Read entryAn arXiv study compared libart.so across Android 8 to 15 and found symbols heavily stripped but runtime memory structures largely unchanged.
Historical technical review (written later) · Covers · First published
Read entryAn arXiv paper shows binary content can mislead LLM reverse-engineering pipelines, and that authorization and provenance controls blocked it.
Historical technical review (written later) · Covers · First published
Read entryFrida 17.15.5 fixed Android and Darwin issues and hardened code patching, showing that dynamic analysis tools keep pace with platform changes.
Historical technical review (written later) · Covers · First published
Read entryLIEF 1.0.0 added memory-dump parsing, Mach-O FAT creation and a PE address behavior change; pipelines that depend on it should re-verify.
Historical technical review (written later) · Covers · First published
Read entryjadx 1.5.6 added call graphs and graph views and improved Kotlin enum and string-switch restoration, making decompiled output more readable.
Historical technical review (written later) · Covers · First published
Read entryTwo same-day patches fixed dropped arguments, unparsable output, a runtime slowdown and escaped strings being decoded.
Historical technical review (written later) · Covers · First published
Read entryGoogle updated its LLM leaderboard for Android development tasks, a sign that rebuilding an app from its visible behavior keeps getting cheaper.
Historical technical review (written later) · Covers · First published
Read entryAn arXiv paper evaluated neural decompilation of Dart AOT binaries by execution and found that removing semantic names sharply cut task coverage.
Historical technical review (written later) · Covers · First published
Read entryO-MVLL 1.9.1 fixed the 1.9.0 release, extended string encoding to Objective-C strings, and listed Xcode 26.5 and NDK r29 compatibility.
Historical technical review (written later) · Covers · First published
Read entryAn arXiv paper tested whether Java opcode k-gram birthmarks can catch LLM-paraphrased plagiarism; the authors report they remain effective.
Historical technical review (written later) · Covers · First published
Read entryA public dataset links Android apps to their third-party SDKs via static code signatures, showing that an app's dependency make-up is close to public information.
Historical technical review (written later) · Covers · First published
Read entryMandiant's GoReSym added struct field tag recovery, a reminder that shipped Go binaries carry far more metadata than a symbol table.
Historical technical review (written later) · Covers · First published
Read entry