Bytecode Truth, Not Source is a deep technical exploration of why smart-contract source code cannot be trusted as the ground truth for security. This repository shows how compiler optimizations, hidden assembly, proxies, and unreachable logic make verified Solidity misleading, and why only EVM bytecode reveals actual on-chain behavior.

Fast, CLI-first static analysis tool for JVM class and JAR files. Designed for coding agents.

Find where a Minecraft plugin jar breaks on Folia. Bytecode scanner with rules derived from Folia's own source, off-region taint analysis, and SARIF output for CI.

bytecode analysis and manipulation (not) framework

SSLBPS is an Android security research project for analyzing APK structure, manifests, Smali code, certificate trust models, and mobile security controls. Built for educational analysis, defensive research, software auditing, and reverse‑engineering learning. Perfect for understanding app architecture, code review, and secure development practices

Find Minecraft plugin code that breaks on newer server versions, by reading the compiled jar

Показывает, что из твоих плагинов сломается при переходе на Minecraft 26.x — до обновления, а не после. Читает байткод, не запуская чужой код. 23 правила, режим CLI без сервера. Paper 1.21+, GPL-3.0.

Unified JPF documentation generator that consolidates jpf-autodoc-options and jpf-autodoc-types into a single modern tool with multi-format output and archive support.

Artifact bundle (datasets + analysis code) for the EMSE paper on smart contract upgradeability: event-derived version lineages, classification utilities, and reproducible notebooks.

Patch that makes MAIAN (2018 suicidal/prodigal/greedy contract scanner) work on modern EVM bytecode: adds SHL/SHR/SAR, PUSH0, CHAINID and other post-2018 opcodes. MIT.

Small, fast, honest

🪞 Order-book depth the protocol itself will not let you withdraw — a resting quote even its own funder cannot cancel. Built on Somnia × DreamDEX.

Smart contract risk scoring API with x402 payments

Modular security toolkit for Pharos Network — skill inspection, contract introspection & address intelligence for AI agents on Pharos Pacific Mainnet.

High-accuracy unused dependency auditor for any project — Maven, Gradle, Flutter, Angular, React & more. ASM bytecode analysis, multi-module support, framework-aware safety net. Built with Java 21 & Clean Architecture.