.NET Native AOT is compilation, not encryption
Check dynamic loading and reflection requirements before measuring whether native compilation changes analysis cost.
Published
Read entryTECHNICAL LOG · 2026-10
October 2026
A dated technical log, one entry a day, newest first. Entries for 2026-07-01 to 2026-10-11 are historical reviews written later and first published from 2026-10-12, not on the day they cover; each shows both the covered date and the real publication date. Later entries are published on their actual dates.
- Mon
windows · Guide windows · Guide .NET trimming and reflection: preserve behavior first
Trimming is a deployment optimization. Reflection dependencies and preservation annotations belong in protection regression tests.
Published
Read entryengineering · Guide Electron ASAR is an archive, not a code vault
Packaging JavaScript does not automatically remove readable logic. Review resources and process boundaries independently.
Published
Read entryios · Guide Why iOS protection requires a signing plan
Protection changes program contents. Signing, extensions, devices and distribution require independent validation.
Published
Read entrymacos · Guide macOS protection, notarization and Gatekeeper are separate checks
Notarization supports distribution trust, not an anti-reversing score. Modified apps need the complete delivery chain checked again.
Published
Read entrywindows · Guide Windows Authenticode: a valid signature is not algorithm secrecy
Check transformations, file signatures and installation separately. One passed check does not replace the rest.
Published
Read entryandroid · Guide APK protection and signing: preserve the update path
Upload keys, distribution signing and installed packages differ. Validate the transformed artifact through its intended channel.
Published
Read entryios · Guide App Attest: server trust versus offline logic protection
Server-validated requests and offline algorithm protection differ. App Attest is not a switch that makes a client unclonable.
Published
Read entryandroid · Guide Play Integrity and code obfuscation solve different problems
Integrity signals inform server decisions. They do not replace core-logic protection or offline compatibility tests.
Published
Read entryassessment · Guide Why anti-reversing assessment needs runtime evidence
Instrumentation observes running programs. State whether the evaluator has device and runtime access.
Published
Read entryassessment · Guide AI cloning risk: UI imitation is not logic recovery
Define what a clone must reproduce before evaluating protection. Screenshots, recovered code and a working substitute are different outcomes.
Published
Read entryengineering · Guide Protecting offline apps without promising irreversibility
Offline behavior runs on the client. Resilience measures must be evaluated against an attacker who can observe that execution.
Published
Read entryios · Guide An IPA already contains compiled code: why that is not secrecy
Compilation changes the representation. It does not remove observable behavior, resources or every clue to application logic.
Published
Read entryengineering · Guide Compiler protection versus wrappers: what to compare
Compare integration, coverage, reusable attacks and compatibility in one experiment instead of adopting a vendor's conclusion.
Published
Read entryengineering · Guide Evaluating O-MVLL: start with native code and toolchains
An open-source LLVM obfuscator is a candidate layer, not proof of compatibility with an arbitrary uploaded app.
Published
Read entryengineering · Guide Why LLVM obfuscation is a layer, not the whole defense
Control-flow and instruction transformations change representation. Functional replication must still be tested externally.
Published
Read entryandroid · Guide Android R8: establish the release baseline first
R8 provides release optimization and name minification. Enabling it is a baseline, not an AI-cloning acceptance test.
Published
Read entryandroid · Guide Broad keep rules: a compatibility fix can preserve clues
Reflection and dynamic behavior need careful keep rules. Preserving an entire package should not be the default fix.
Published
Read entryengineering · Guide Hardcoded secrets: string encryption is not the final answer
Protecting intellectual property and managing credentials are different jobs. Renaming or encoding is not secret management.
Published
Read entryengineering · Guide Flutter obfuscation: renamed symbols are not encrypted resources
Combine release obfuscation, private symbol retention and resource review. One build option cannot cover every protection goal.
Published
Read entry - Sun
assessment · Review Diaphora 3.4.3 adds IDA 9.5 beta support and a retrained matching model
On 2026-10-11 (UTC) the binary diffing tool Diaphora 3.4.3 shipped with IDA 9.5 beta support and a retrained matching model.
Historical technical review (written later) · Covers · First published
Read entry - Sat
engineering · Review Bun v1.4.3 tunes --compile bytecode executables and locks embedded exec flags
On 2026-10-10 (UTC) Bun v1.4.3 sped up --compile bytecode executables and made an embedded no-dynamic-code flag impossible to lower.
Historical technical review (written later) · Covers · First published
Read entry - Fri
ai · Review Paper examines the limits of query monitoring against distributed model extraction
On 2026-10-09 (UTC) an arXiv paper argued that distillation spread across many accounts is hard to detect reliably from queries alone.
Historical technical review (written later) · Covers · First published
Read entry - Thu
ai · Review SoK paper asks how reliable LLMs are at recovering source code from binaries
On 2026-10-08 (UTC) an arXiv SoK paper systematically evaluated how well LLMs recover source code from assembly and decompiler pseudo-C.
Historical technical review (written later) · Covers · First published
Read entry - Wed
engineering · Review Node.js 26.11.0 ships SEA vfsArchive: assets served from an embedded ZIP
On 2026-10-07 (UTC) Node.js 26.11.0 brought the SEA vfsArchive option, which embeds an unchanged ZIP of assets in the executable.
Historical technical review (written later) · Covers · First published
Read entry - Tue
engineering · Review LLVM 23.1.3: treating a point release as a verifiable toolchain change
On 2026-10-06 (UTC) LLVM 23.1.3 shipped with signatures and attestations but no fix list on its page, so upgrades need your own review.
Historical technical review (written later) · Covers · First published
Read entry - Mon
assessment · Review radare2 6.2.4 improves Swift and ARM64 analysis and hardens its parsers
On 2026-10-05 (UTC) radare2 6.2.4 improved Swift, Go and ARM64 analysis and fixed many file-format parser security issues.
Historical technical review (written later) · Covers · First published
Read entry - Sun
engineering · Review javascript-obfuscator 5.9.0 adds Pro API quota checks and machine-readable error codes
On 2026-10-04 (UTC) javascript-obfuscator 5.9.0 added quota queries and error codes to its cloud Pro API, a reminder that builds must fail closed.
Historical technical review (written later) · Covers · First published
Read entry - Sat
assessment · Review Frida 17.22.0 extends its Swift ApiResolver to Linux and Windows
On 2026-10-03 (UTC) Frida 17.22.0 added library builds and extended its Swift ApiResolver beyond Apple platforms to Linux and Windows.
Historical technical review (written later) · Covers · First published
Read entry - Fri
assessment · Review Frida 17.20.0 adds ImHex pattern language support to Frida.Compiler
On 2026-10-02 (UTC) Frida 17.20.0 added ImHex pattern language support, making reusable data-structure descriptions part of its toolchain.
Historical technical review (written later) · Covers · First published
Read entry - Thu
macos · Review Apple announces the original Developer ID Sub-CA expires on February 1, 2027
On 2026-10-01 Apple warned that the original Developer ID Sub-CA expires on 2027-02-01, after which affected .pkg installers will not install.
Historical technical review (written later) · Covers · First published
Read entry