Sync wiki to 0.4.0b1 code state - How It Works: token hash is MurmurHash3 x86_32 (replaced BLAKE2b), note the optional bit-identical twinflame_rs native accelerator - Change Report Schema: document v3 ('library' dictionary-evidence field) and dictionary-based origin demotion - Using Twinflame: post-loader-rework performance numbers (BENCHMARKS.md), --libsigs/--assignment/--normalize flags, androguard log-silencing tip - Evaluation Corpus / Accuracy Benchmarks: perf half of the pending benchmark note is done; annotate pre-rework Telegram timings Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ankorio committed Jul 15, 2026

Document malware-family signatures (family build|match) for 0.4.0b1 Add UC5 to Using-Twinflame: build a persistent family signature from N samples and score unknowns/dumps against it — how the signature is built (k-of-N radius clustering, library exclusion), reading a match, and the obfuscation-drift / unpack-first / shared-packer caveats. Note score as the two-sample primitive that UC5 generalizes. Add the family row to the How-It-Works use-case table and mention it on Home.

ankorio committed Jul 14, 2026

Document packed .tfr records, compare/migrate, and experimental score - prepare now emits packed binary .tfr (~20x smaller than JSON); records are first-class diff inputs; compare alias + migrate for corpus upkeep. - Add UC4: experimental containment score (family ⊆ candidate), flagged WIP. - Fix the jadx deobfuscation-map invocation (--mappings-path + PROGUARD_FILE + invert=yes) and add the old-build side-by-side alignment recipe. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ankorio committed Jul 9, 2026

Import documentation from repo docs/ and eval/corpus Pages: Home, Using-Twinflame, How-It-Works, Change-Report-Schema, Evaluation-Corpus, Accuracy-Benchmarks, Obfuscation-Profiles, sidebar. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ankorio committed Jul 9, 2026