Home

twinflame is a DEX/APK bytecode-level diffing engine for Android reverse engineers. It matches classes and methods across two builds by structure — surviving R8/ProGuard renaming — and emits a ranked, method-localized change report (added / removed / modified) plus a ProGuard mapping.txt to carry recovered names into your decompiler.

Repository: github.com/ankorio/twinflame · Install & quick start: README

User guide

• Using Twinflame — task-oriented guide: the use cases (version diff, sample kinship, name recovery, experimental family containment score, and persistent malware-family signatures via family build / match), reading the change report, feeding the mapping to jadx/retrace, and the prepare → packed .tfr record workflow (compare / migrate).
• Change Report Schema — the versioned JSON output format, for downstream tooling.

Internals

• How It Works — plain-language walkthrough of the pipeline (load → cluster → anchor → SimHash/LSH → accurate scoring → propagation → change classification), with diagrams.

Evaluation & benchmarks

• Evaluation Corpus — the corpora accuracy work is graded against: what each one grades, the persistent OSS build matrix, and the reproducible build recipes.
• Accuracy Benchmarks — precision/recall/F1 results, the benchmark scoreboard, and the measurement history behind each design decision.
• Obfuscation Profiles — the R8 strength axis (lax / optimize / strict) used to grade the matcher across obfuscation levels.

Wall-clock performance benchmarks (prepare/diff timings across the corpus) live in the repo at BENCHMARKS.md.