抖音似乎抄的是你们的实现，而且没有按照Apache许可证做任何公开声明 about armariris HOT 6 CLOSED

光看binary不确定的啊 FLA本身ollvm也有

from armariris.

It's hard to distinguish from binary and disassemble result, maybe a modified version of ollvm and we have made several changes to ollvm version. Maybe we can blame them for not following the license derived from ollvm.

from armariris.

@yangwenbo 我说的是字符串加密的datadiv_decode不是FLA，这个只有OLLVM的某个PR和Armariris有

from armariris.

@GoSSIP-SJTU we are talking about the datadiv_decode variable, which only exists in one of OLLVM’s PR(A very buggy one!) and Armariris.
Considering how buggy the PR was, it’s at least very likely the one used by ByteDance is a slightly modified / direct copy-paste of Armariris

EDIT:
Yes, I'm fully aware that to precisely & accurately judge the origin would require some heavy disassemble/de-obfuscation of the aforementioned sample. But at least it's safe to say their implementation is at least related to yours to some certain degree

from armariris.

嗯，连用llvm.global_ctors 都完美符合Armariris的特征，实锤了

from armariris.

Actually that's a bad implementation.... I have reimplemented the feature such that the strings are re-encrypted after being used.

from armariris.