Bytecode Truth, Not Source is a deep technical exploration of why smart-contract source code cannot be trusted as the ground truth for security. This repository shows how compiler optimizations, hidden assembly, proxies, and unreachable logic make verified Solidity misleading, and why only EVM bytecode reveals actual on-chain behavior.

Fast, CLI-first static analysis tool for JVM class and JAR files. Designed for coding agents.

bytecode analysis and manipulation (not) framework

SSLBPS is an Android security research project for analyzing APK structure, manifests, Smali code, certificate trust models, and mobile security controls. Built for educational analysis, defensive research, software auditing, and reverse‑engineering learning. Perfect for understanding app architecture, code review, and secure development practices

Unified JPF documentation generator that consolidates jpf-autodoc-options and jpf-autodoc-types into a single modern tool with multi-format output and archive support.

Artifact bundle (datasets + analysis code) for the EMSE paper on smart contract upgradeability: event-derived version lineages, classification utilities, and reproducible notebooks.

High-accuracy unused dependency auditor for any project — Maven, Gradle, Flutter, Angular, React & more. ASM bytecode analysis, multi-module support, framework-aware safety net. Built with Java 21 & Clean Architecture.

Small, fast, honest

Smart contract risk scoring API with x402 payments