AI cloning risk: UI imitation is not logic recovery
Define what a clone must reproduce before evaluating protection. Screenshots, recovered code and a working substitute are different outcomes.
Published:
Read articleTHE BUILDER'S JOURNAL
Technical journal
AI reverse engineering, app protection and developer practice. One topic a day to explore the limits of protection.
A 20-day reading plan
One a day · All availableThe dates below are suggested reading dates, not publication dates. These 20 launch guides were first published on 2026-10-12 and are all available now. New articles appear under their actual publication dates.
- Day 1 · Suggested reading
assessment · Guide - Day 2 · Suggested reading
engineering · Guide Protecting offline apps without promising irreversibility
Offline behavior runs on the client. Resilience measures must be evaluated against an attacker who can observe that execution.
Published:
Read article - Day 3 · Suggested reading
ios · Guide An IPA already contains compiled code: why that is not secrecy
Compilation changes the representation. It does not remove observable behavior, resources or every clue to application logic.
Published:
Read article - Day 4 · Suggested reading
engineering · Guide Compiler protection versus wrappers: what to compare
Compare integration, coverage, reusable attacks and compatibility in one experiment instead of adopting a vendor's conclusion.
Published:
Read article - Day 5 · Suggested reading
engineering · Guide Evaluating O-MVLL: start with native code and toolchains
An open-source LLVM obfuscator is a candidate layer, not proof of compatibility with an arbitrary uploaded app.
Published:
Read article - Day 6 · Suggested reading
engineering · Guide Why LLVM obfuscation is a layer, not the whole defense
Control-flow and instruction transformations change representation. Functional replication must still be tested externally.
Published:
Read article - Day 7 · Suggested reading
android · Guide Android R8: establish the release baseline first
R8 provides release optimization and name minification. Enabling it is a baseline, not an AI-cloning acceptance test.
Published:
Read article - Day 8 · Suggested reading
android · Guide Broad keep rules: a compatibility fix can preserve clues
Reflection and dynamic behavior need careful keep rules. Preserving an entire package should not be the default fix.
Published:
Read article - Day 9 · Suggested reading
engineering · Guide Hardcoded secrets: string encryption is not the final answer
Protecting intellectual property and managing credentials are different jobs. Renaming or encoding is not secret management.
Published:
Read article - Day 10 · Suggested reading
engineering · Guide Flutter obfuscation: renamed symbols are not encrypted resources
Combine release obfuscation, private symbol retention and resource review. One build option cannot cover every protection goal.
Published:
Read article - Day 11 · Suggested reading
windows · Guide .NET Native AOT is compilation, not encryption
Check dynamic loading and reflection requirements before measuring whether native compilation changes analysis cost.
Published:
Read article - Day 12 · Suggested reading
windows · Guide .NET trimming and reflection: preserve behavior first
Trimming is a deployment optimization. Reflection dependencies and preservation annotations belong in protection regression tests.
Published:
Read article - Day 13 · Suggested reading
engineering · Guide Electron ASAR is an archive, not a code vault
Packaging JavaScript does not automatically remove readable logic. Review resources and process boundaries independently.
Published:
Read article - Day 14 · Suggested reading
ios · Guide Why iOS protection requires a signing plan
Protection changes program contents. Signing, extensions, devices and distribution require independent validation.
Published:
Read article - Day 15 · Suggested reading
macos · Guide macOS protection, notarization and Gatekeeper are separate checks
Notarization supports distribution trust, not an anti-reversing score. Modified apps need the complete delivery chain checked again.
Published:
Read article - Day 16 · Suggested reading
windows · Guide Windows Authenticode: a valid signature is not algorithm secrecy
Check transformations, file signatures and installation separately. One passed check does not replace the rest.
Published:
Read article - Day 17 · Suggested reading
android · Guide APK protection and signing: preserve the update path
Upload keys, distribution signing and installed packages differ. Validate the transformed artifact through its intended channel.
Published:
Read article - Day 18 · Suggested reading
ios · Guide App Attest: server trust versus offline logic protection
Server-validated requests and offline algorithm protection differ. App Attest is not a switch that makes a client unclonable.
Published:
Read article - Day 19 · Suggested reading
android · Guide Play Integrity and code obfuscation solve different problems
Integrity signals inform server decisions. They do not replace core-logic protection or offline compatibility tests.
Published:
Read article - Day 20 · Suggested reading
assessment · Guide Why anti-reversing assessment needs runtime evidence
Instrumentation observes running programs. State whether the evaluator has device and runtime access.
Published:
Read article