Document malware-family signatures (family build|match) for 0.4.0b1 Add UC5 to Using-Twinflame: build a persistent family signature from N samples and score unknowns/dumps against it — how the signature is built (k-of-N radius clustering, library exclusion), reading a match, and the obfuscation-drift / unpack-first / shared-packer caveats. Note score as the two-sample primitive that UC5 generalizes. Add the family row to the How-It-Works use-case table and mention it on Home.

ankorio committed Jul 14, 2026

Document packed .tfr records, compare/migrate, and experimental score - prepare now emits packed binary .tfr (~20x smaller than JSON); records are first-class diff inputs; compare alias + migrate for corpus upkeep. - Add UC4: experimental containment score (family ⊆ candidate), flagged WIP. - Fix the jadx deobfuscation-map invocation (--mappings-path + PROGUARD_FILE + invert=yes) and add the old-build side-by-side alignment recipe. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ankorio committed Jul 9, 2026

Import documentation from repo docs/ and eval/corpus Pages: Home, Using-Twinflame, How-It-Works, Change-Report-Schema, Evaluation-Corpus, Accuracy-Benchmarks, Obfuscation-Profiles, sidebar. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ankorio committed Jul 9, 2026

Initial Home page

ankorio committed Jul 9, 2026