Reverse Engineering Block Blast
Block Blast looks like a puzzle game. A decompile of the app suggests it's closer to a per-player ad pricing engine with a puzzle attached. Three tree-based models run on your phone, a bandit experiment tunes when you lose, and a rule decides your next three pieces based on what ad is sitting in memory.
The Problem It's Solving
The game is free and has no ad-free purchase, so revenue depends on rewarded and full-screen ads. Sensor Tower estimates put its ad revenue at roughly $127 million for January to May 2026, ahead of Candy Crush Saga at $81.1 million.
Ad value varies a lot per player (country, device, history), and the best moment to show a rewarded ad is right after a loss. Making that work needs per-player prediction, per-deal control of the pieces, and the ability to change both without shipping an app update.
How the System Is Built
The research is Ayo Omolewa's breakdown of Android 10.8.2 and iOS 7.4.9, using jadx and Ghidra. The store APK holds very little. Logic ships as "traits" (modules with variants called arms), and at launch the server tells the app which arm of which trait you get. His config named about 700 traits, selected 254, and 101 were fetched after install as XXTEA-encrypted, Brotli-compressed JavaScript. Two players can run different games, and the studio can change yours silently.
The Models
| Model | Size and inputs | What it decides |
|---|---|---|
| XGBoost regression (xgboost_regression_model111.json) | 59 trees, depth up to 8, 27 inputs (18 about ads) | finalEcpm: your estimated ad value |
| XGBoost classifier (predict_travel_difficulty_dead) | 500 trees, 52 inputs | Where in a level the lethal puzzle lands |
| LightGBM | 1,000 trees, 93 inputs | Whether you'll be less active tomorrow |
The ad value model. The inputs are mostly money-related: prices of ads loaded today and yesterday, country, phone model, RAM, install date, and how your first game went. The trees lean hardest on first score, latest ad price, RAM, phone model and country. The inference code is a plain loop: start each tree at the root, go left or right on a feature threshold (missing values follow a default direction), add the leaf weight to a running sum starting at the base score. Omolewa's port reproduces the game's outputs to the last decimal. Changing one input on a made-up US player on an iPhone 15 gives:
| Change | Ad value (eCPM) |
|---|---|
| Baseline (US, first score 1,000) | 25.48 |
| Brazil | 8.08 |
| India | 5.59 |
| First score 500 / 2,000 / 10,000 | 25.79 / 21.12 / 20.34 |
The same US baseline on Android scores 48.96. The output feeds other rules. One compares your rewarded and full-screen prices and, if rewarded is worth at least twice full-screen in the shipped version, grants an extra revive (which plays a rewarded ad). Others add a full-screen ad when your price is high or skip full-screen ads when you're worth almost nothing.
The "where do you lose" model. The game scores 12 candidate options (4 values of a sw_process setting times 3 difficulty levels) and keeps the argmax. Inputs are mostly about your history: current level, attempts, games finished this week, time since install. The winning sw_process maps to a stretch of the level (first 30%, 30 to 80%, last 20%). On reaching it, players who usually accept revives (above 75%) get an extra one, and from the fourth deal after that the game requests the lethal puzzle. Other rules read the same pick the opposite way and make the level easier when it lands on the fourth option.
The churn model. If the LightGBM score is 0.69 or higher, a pink revive button replaces the normal one and skips the ad, once a day. It leans on app age, high score, RAM and average score.
Server-side models. Rules also call models named for churn, LTV, revive-click and xDeepFM. Those weights never reach the phone, so the only visible part is the request. One call to /v1/ecpm_prediction sends 40 fields, including carrier, storage, hour of day and recent ad prices.
The Rules That Act on the Predictions
These are hand-written, not learned.
RewardHighValueAdHarvestTrait fires when you finished your last three rewarded ads, the ad currently loaded is worth at least 3.5 times your last one (read from AppLovin MAX eCPM), and you're 1,000 points past your high score (500 or 750 in other arms). It then requests generator ZHI_SI_TI. The generator picks two pieces that fit and one that doesn't, searches every order and placement including line clears, and keeps the set only if nothing works. The code labels the pieces "lethal puzzle" in Chinese.
PersonalMarginBreakTrait gives every deal a 20% chance of the same hand once you're 10% past your record. MultiClearBoostThenKillTrait sends your user ID to two server endpoints, and for the tiers labelled "not sensitive to being forced to die," waits for a big clear, then requests the lethal puzzle a few rounds later once the game reaches roughly your usual length. FastHandPunishTrait asks for hard pieces when your last six sets averaged under 4.2 seconds and you're past 93% of your high score. MaturityDevelopmentV2Trait scores habit, skill and ad history (10.98, 14.66 and 19.27 in the live test), and when the total (44.91) is under 65 it swaps hard puzzles for easy fills. AdPlusMinusStrategyTrait adds a random bonus of up to 10% of your high score after one type of revive.
MABXiBaiTrait is a six-arm experiment on how soon the lethal puzzle may be requested: never, or after 4, 6, 10, about 17 or 30 minutes. Per arm it logs whether you started a new game within 15 minutes and the share of revive offers you accepted.
Why This Is a Bigger Deal Than It Looks
The ML itself is cheap: tree ensembles walked in a loop over JSON, no GPU, runs on a low-end phone and offline. The engineering is the delivery layer. Server-assigned arms, encrypted hot-loaded JavaScript and per-player A/B tests make this a feature-flag platform with bandit tuning, which is why it can be changed daily. Because the lethal-puzzle rule needs a rewarded ad loaded, it can't fire offline or with a phone-wide DNS blocker, while ad-independent rules keep running.
Apple permits JavaScript updates that don't change what the app is. Whether this qualifies is Apple's call.
The usual caveat applies: this is one researcher's analysis. mobilegamer.biz reported no reply from Hungry Studio, and TechRadar noted that independent verification matters. The evidence bundles (decoded rules, test scripts, hashes) are public at Ayoships if you want to run the checks yourself.
Availability and Access
The game is on Google Play and iOS. The decryption key and the steps for getting past the apps' protection aren't published.
If a free puzzle game ships three on-device models and a bandit experiment, the real question for developers isn't whether consumer apps use ML. It's how much of their behavior now lives in a config server instead of the binary.
Follow for more coverage on MCP, agentic AI, and AI infrastructure.
Inspired to write this by @StompnWorldfan's video on YouTube: watch it here.
7 reactions
jadx: Dex to Java decompiler (50.9k stars)
What it does
All text below is quoted directly from the project README.
>jadx - Dex to Java decompiler
>Command-line and GUI tools for producing Java source code from Android Dex and APK files
>Please note that in most cases jadx can't decompile 100% of the code, so errors will occur. Check the Troubleshooting guide for workarounds.
Main features:
- decompile Dalvik bytecode to Java code from APK, dex, aab, apks, apkm, xapk and zip files
- also decompile Java bytecode (jar, class, aar) and smali files
- decode AndroidManifest.xml and other resources from resources.arsc
- deobfuscator included
jadx-gui features:
- view decompiled code with syntax highlighting
- jump to declaration
- find usage
- full-text search
- smali debugger, see the wiki page for setup and usage
Download:
>For jadx-<version>.zip, unpack it, go to the bin directory and run:
- jadx - command-line version
- jadx-gui - GUI version
>On Windows, run the .bat files with a double-click. For the Windows bundles, unpack and run jadx-gui-<version>.exe.
>Note: make sure you have 64-bit Java 11 or later installed (not needed for the with-jre bundle).
Repository
skylot/jadx
Repository stats
|Metric|Value|
|:-|:-|
|Stars|50,929|
|Forks|5,804|
|Last release|v1.5.6 (2026-07-10)|
|Languages|Java 92.2%, Smali 6.4%, Kotlin 1.1%|
|Contributors|164|
|AI contributor accounts (Claude / Codex / Cursor / Copilot)|Copilot (1 commit)|
|AI co-authored commits|Copilot: 1|
Main contributor
|Field|Value|
|:-|:-|
|GitHub|@skylot|
|Commits to this repo|1,996 (top contributor)|
|Followers|1,221|
|Public repos|4|
|On GitHub since|2009-08-23|
------------------------------------------------------------------------------------
Discover the best GitHub repos without the endless scrolling.
Get top repos organized by category (AI, DevOps, Databases & more), plus key takeaways from developers' most useful comments - all in one free, twice-weekly newsletter.
👉 Get the best repos & community insights - Free
3 points
REA Got 200,000 GitHub Stars. Did It Invent Anything? (Reverse Engineer Anything, Explained)
REA (Reverse Engineer Anything, github.com/morluto/rea) went from about 10,000 to more than 200,000 GitHub stars in less than a week. It is an MCP server that lets AI coding agents such as Claude Code, Codex and Cursor inspect programs without their source code. Our idea: REA did not invent a new reverse engineering method; it collected old tools and gave them to AI through one connection. We test that idea against REA's own README, its third-party notices and its workflow skill, and against older projects: Ghidra, IDA Pro, JADX, Frida, and the 2025 AI bridges GhidraMCP and ida-pro-mcp. We also show what REA did build itself: one setup for 15 agents, its own readers for some file types, and strict rules for evidence. Theory only: we did not install or run REA.
⏱️ Chapters
0:00 Intro
0:44 What is reverse engineering?
1:27 What REA says it does
2:04 Who does the actual work?
2:52 Was the AI connection new?
3:28 So what did REA build?
4:19 What it does not do
4:46 Why so many stars?
5:31 Our verdict on our own idea
6:07 Wrap-up
📰 Sources
- REA (morluto/rea): morluto/rea
- REA third-party notices: github.com/morluto/rea/blob/main/THIRD_PARTY_NOTI…
- REA workflow skill: github.com/morluto/rea/blob/main/.agents/skills/r…
- GhidraMCP (LaurieWired, Mar 2025): LaurieWired/GhidraMCP
- ida-pro-mcp (mrexodia, Mar 2025): mrexodia/ida-pro-mcp
- jadx-ai-mcp (zinja-coder, Apr 2025): zinja-coder/jadx-ai-mcp
- Ghidra (NSA): NationalSecurityAgency/ghidra
- JADX: skylot/jadx
- Frida: frida/frida
- Startup Fortune, Elroy Fernandes (Oct 9, 2026): startupfortune.com
Theory only: we did not install, run or test REA. Star counts and dates: GitHub API, read Oct 13, 2026 (the Oct 8 count is Startup Fortune's). REA is MIT-licensed; its README says it is for lawful research, education, interoperability, software preservation, and analysis of software you own or are authorized to examine.
Music: original. Narration: AI-generated voice; script and fact-checking reviewed by a human.
🔔 One Prompt Away: real Claude runs and AI tools, explained in plain words. Subscribe!
Independent channel, not affiliated with or endorsed by Anthropic, REA or any project shown. Claude is a trademark of Anthropic.
#REA #ReverseEngineering #MCP #ClaudeCode #Ghidra #AIagents #GitHub
1 like · 65 views
Mentions
INSANE NARRA! BETTER THAN PHP SENDING TO EVERY CONTRIBUTER ALSO REAL IMAGE skylot/jadx x.com t.co
Reverse Engineering Block Blast Block Blast looks like a puzzle game. A decompile of the app suggests it's closer to a per-player ad pricing engine with a puzzle attached. Three tree-based models run on your phone, a bandit experiment tunes when you lose, and a rule decides your next three pieces based on what ad is sitting in memory. The Problem It's Solving The game is free and has no ad-free purchase, so revenue depends on rewarded and full-screen ads. Sensor Tower estimates put its ad revenue at roughly $127 million for January to May 2026, ahead of Candy Crush Saga at $81.1 million. Ad value varies a lot per player (country, device, history), and the best moment to show a rewarded ad is right after a loss. Making that work needs per-player prediction, per-deal control of the pieces, and the ability to change both without shipping an app update. How the System Is Built The research is Ayo Omolewa's breakdown of Android 10.8.2 and iOS 7.4.9, using jadx and Ghidra. The store APK holds very little. Logic ships as "traits" (modules with variants called arms), and at launch the server tells the app which arm of which trait you get. His config named about 700 traits, selected 254, and 101 were fetched after install as XXTEA-encrypted, Brotli-compressed JavaScript. Two players can run different games, and the studio can change yours silently. The Models | Model | Size and inputs | What it decides | |---|---|---| | XGBoost regression (xgboost_regression_model111.json) | 59 trees, depth up to 8, 27 inputs (18 about ads) | finalEcpm: your estimated ad value | | XGBoost classifier (predict_travel_difficulty_dead) | 500 trees, 52 inputs | Where in a level the lethal puzzle lands | | LightGBM | 1,000 trees, 93 inputs | Whether you'll be less active tomorrow | The ad value model. The inputs are mostly money-related: prices of ads loaded today and yesterday, country, phone model, RAM, install date, and how your first game went. The trees lean hardest on first score, latest ad price, RAM, phone model and country. The inference code is a plain loop: start each tree at the root, go left or right on a feature threshold (missing values follow a default direction), add the leaf weight to a running sum starting at the base score. Omolewa's port reproduces the game's outputs to the last decimal. Changing one input on a made-up US player on an iPhone 15 gives: | Change | Ad value (eCPM) | |---|---| | Baseline (US, first score 1,000) | 25.48 | | Brazil | 8.08 | | India | 5.59 | | First score 500 / 2,000 / 10,000 | 25.79 / 21.12 / 20.34 | The same US baseline on Android scores 48.96. The output feeds other rules. One compares your rewarded and full-screen prices and, if rewarded is worth at least twice full-screen in the shipped version, grants an extra revive (which plays a rewarded ad). Others add a full-screen ad when your price is high or skip full-screen ads when you're worth almost nothing. The "where do you lose" model. The game scores 12 candidate options (4 values of a sw_process setting times 3 difficulty levels) and keeps the argmax. Inputs are mostly about your history: current level, attempts, games finished this week, time since install. The winning sw_process maps to a stretch of the level (first 30%, 30 to 80%, last 20%). On reaching it, players who usually accept revives (above 75%) get an extra one, and from the fourth deal after that the game requests the lethal puzzle. Other rules read the same pick the opposite way and make the level easier when it lands on the fourth option. The churn model. If the LightGBM score is 0.69 or higher, a pink revive button replaces the normal one and skips the ad, once a day. It leans on app age, high score, RAM and average score. Server-side models. Rules also call models named for churn, LTV, revive-click and xDeepFM. Those weights never reach the phone, so the only visible part is the request. One call to /v1/ecpm_prediction sends 40 fields, including carrier, storage, hour of day and recent ad prices. The Rules That Act on the Predictions These are hand-written, not learned. RewardHighValueAdHarvestTrait fires when you finished your last three rewarded ads, the ad currently loaded is worth at least 3.5 times your last one (read from AppLovin MAX eCPM), and you're 1,000 points past your high score (500 or 750 in other arms). It then requests generator ZHI_SI_TI. The generator picks two pieces that fit and one that doesn't, searches every order and placement including line clears, and keeps the set only if nothing works. The code labels the pieces "lethal puzzle" in Chinese. PersonalMarginBreakTrait gives every deal a 20% chance of the same hand once you're 10% past your record. MultiClearBoostThenKillTrait sends your user ID to two server endpoints, and for the tiers labelled "not sensitive to being forced to die," waits for a big clear, then requests the lethal puzzle a few rounds later once the game reaches roughly your usual length. FastHandPunishTrait asks for hard pieces when your last six sets averaged under 4.2 seconds and you're past 93% of your high score. MaturityDevelopmentV2Trait scores habit, skill and ad history (10.98, 14.66 and 19.27 in the live test), and when the total (44.91) is under 65 it swaps hard puzzles for easy fills. AdPlusMinusStrategyTrait adds a random bonus of up to 10% of your high score after one type of revive. MABXiBaiTrait is a six-arm experiment on how soon the lethal puzzle may be requested: never, or after 4, 6, 10, about 17 or 30 minutes. Per arm it logs whether you started a new game within 15 minutes and the share of revive offers you accepted. Why This Is a Bigger Deal Than It Looks The ML itself is cheap: tree ensembles walked in a loop over JSON, no GPU, runs on a low-end phone and offline. The engineering is the delivery layer. Server-assigned arms, encrypted hot-loaded JavaScript and per-player A/B tests make this a feature-flag platform with bandit tuning, which is why it can be changed daily. Because the lethal-puzzle rule needs a rewarded ad loaded, it can't fire offline or with a phone-wide DNS blocker, while ad-independent rules keep running. Apple permits JavaScript updates that don't change what the app is. Whether this qualifies is Apple's call. The usual caveat applies: this is one researcher's analysis. mobilegamer.biz reported no reply from Hungry Studio, and TechRadar noted that independent verification matters. The evidence bundles (decoded rules, test scripts, hashes) are public at Ayoships if you want to run the checks yourself. Availability and Access The game is on Google Play and iOS. The decryption key and the steps for getting past the apps' protection aren't published. If a free puzzle game ships three on-device models and a bandit experiment, the real question for developers isn't whether consumer apps use ML. It's how much of their behavior now lives in a config server instead of the binary. Follow for more coverage on MCP, agentic AI, and AI infrastructure. Inspired to write this by @StompnWorldfan's video on YouTube: watch it here.
Android APKの調査、bytecodeだけを読んで進めていませんか？ JADXはDEX/APKからJava風sourceを生成するCLIとGUI。manifestやresourceのdecode、full-text searchもできます。権限のあるapp packageの調査に使い、完全復元とは限らない点にも注意。 skylot/jadx
jadx: Dex to Java decompiler (50.9k stars) What it does All text below is quoted directly from the project README. >jadx - Dex to Java decompiler >Command-line and GUI tools for producing Java source code from Android Dex and APK files >Please note that in most cases jadx can't decompile 100% of the code, so errors will occur. Check the Troubleshooting guide for workarounds. Main features: - decompile Dalvik bytecode to Java code from APK, dex, aab, apks, apkm, xapk and zip files - also decompile Java bytecode (jar, class, aar) and smali files - decode AndroidManifest.xml and other resources from resources.arsc - deobfuscator included jadx-gui features: - view decompiled code with syntax highlighting - jump to declaration - find usage - full-text search - smali debugger, see the wiki page for setup and usage Download: >For jadx-<version>.zip, unpack it, go to the bin directory and run: - jadx - command-line version - jadx-gui - GUI version >On Windows, run the .bat files with a double-click. For the Windows bundles, unpack and run jadx-gui-<version>.exe. >Note: make sure you have 64-bit Java 11 or later installed (not needed for the with-jre bundle). Repository skylot/jadx Repository stats |Metric|Value| |:-|:-| |Stars|50,929| |Forks|5,804| |Last release|v1.5.6 (2026-07-10)| |Languages|Java 92.2%, Smali 6.4%, Kotlin 1.1%| |Contributors|164| |AI contributor accounts (Claude / Codex / Cursor / Copilot)|Copilot (1 commit)| |AI co-authored commits|Copilot: 1| Main contributor |Field|Value| |:-|:-| |GitHub|@skylot| |Commits to this repo|1,996 (top contributor)| |Followers|1,221| |Public repos|4| |On GitHub since|2009-08-23| ------------------------------------------------------------------------------------ Discover the best GitHub repos without the endless scrolling. Get top repos organized by category (AI, DevOps, Databases & more), plus key takeaways from developers' most useful comments - all in one free, twice-weekly newsletter. 👉 Get the best repos & community insights - Free
REA Got 200,000 GitHub Stars. Did It Invent Anything? (Reverse Engineer Anything, Explained) REA (Reverse Engineer Anything, github.com/morluto/rea) went from about 10,000 to more than 200,000 GitHub stars in less than a week. It is an MCP server that lets AI coding agents such as Claude Code, Codex and Cursor inspect programs without their source code. Our idea: REA did not invent a new reverse engineering method; it collected old tools and gave them to AI through one connection. We test that idea against REA's own README, its third-party notices and its workflow skill, and against older projects: Ghidra, IDA Pro, JADX, Frida, and the 2025 AI bridges GhidraMCP and ida-pro-mcp. We also show what REA did build itself: one setup for 15 agents, its own readers for some file types, and strict rules for evidence. Theory only: we did not install or run REA. ⏱️ Chapters 0:00 Intro 0:44 What is reverse engineering? 1:27 What REA says it does 2:04 Who does the actual work? 2:52 Was the AI connection new? 3:28 So what did REA build? 4:19 What it does not do 4:46 Why so many stars? 5:31 Our verdict on our own idea 6:07 Wrap-up 📰 Sources - REA (morluto/rea): morluto/rea - REA third-party notices: github.com/morluto/rea/blob/main/THIRD_PARTY_NOTI… - REA workflow skill: github.com/morluto/rea/blob/main/.agents/skills/r… - GhidraMCP (LaurieWired, Mar 2025): LaurieWired/GhidraMCP - ida-pro-mcp (mrexodia, Mar 2025): mrexodia/ida-pro-mcp - jadx-ai-mcp (zinja-coder, Apr 2025): zinja-coder/jadx-ai-mcp - Ghidra (NSA): NationalSecurityAgency/ghidra - JADX: skylot/jadx - Frida: frida/frida - Startup Fortune, Elroy Fernandes (Oct 9, 2026): startupfortune.com Theory only: we did not install, run or test REA. Star counts and dates: GitHub API, read Oct 13, 2026 (the Oct 8 count is Startup Fortune's). REA is MIT-licensed; its README says it is for lawful research, education, interoperability, software preservation, and analysis of software you own or are authorized to examine. Music: original. Narration: AI-generated voice; script and fact-checking reviewed by a human. 🔔 One Prompt Away: real Claude runs and AI tools, explained in plain words. Subscribe! Independent channel, not affiliated with or endorsed by Anthropic, REA or any project shown. Claude is a trademark of Anthropic. #REA #ReverseEngineering #MCP #ClaudeCode #Ghidra #AIagents #GitHub
who here cares about memory being wasted make it so either skylot/jadx doesn't use as much or make sm else that does everything jadx does