Devlog
Notes on reverse engineering, on what changes between Thyme releases, and on the parts of the engine that are interesting enough to write down.
-
360, Ijiami, NetEase Yidun, Naijia, Tencent Legu — an AI + garlic capability test
A beginner's writeup of driving garlic with an AI loop against five Android packers — 360, Ijiami, NetEase Yidun, Naijia and Tencent Legu. All six test cases passed, with the dex extraction and decryption done entirely by the model.
-
ARM static analysis engine internals, Part 4: IR design and application
The hard half of static analysis: recovering indirect jumps — switch/case, C++ vtables, function pointer arrays — and the IR behind it.
-
ARM static analysis engine internals, Part 3: Control flow construction basics
After disassembly comes control flow: finding ELF entries, recursive descent, noreturn functions, and the structures that break the walk.
-
ARM static analysis engine internals, Part 2: Implementing the disassembly engine
Turning that DSL into a static (mask, value) table ahead of time: decoding as a bitwise AND and a compare, plus operand extraction.
-
ARM static analysis engine internals, Part 1: Disassembly opcode table design
Why the ARM64 opcode table is shaped like a B-tree index — and the DSL instructions are described in, before any of it is code.