Matt Coley @mattcoley.bsky.social · 04/10/2026GitEmber isn't JavaFX. They rewrote it to Swing 6 months ago when making 3.0. www.reddit.com/r/JavaFX/com... 100
Matt Coley @mattcoley.bsky.social · 05/09/2026And here's a significantly more complex example. This one does have specific handling for dynamic reference encryption, but the string encryption is still backed by the same transformers shown in the first video. More details in the "alt" annotation btw here and in the prior video. 011
Matt Coley @mattcoley.bsky.social · 05/09/2026Been a bit since I've posted, but I've been working on improving Recaf's deobfuscation capabilities. Here's a recent sample I was sent getting cleaned up. 111
Matt Coley @mattcoley.bsky.social · 01/04/2026The syntax for Dalvik bytecode is mostly done. We need to reconstruct our model from the AST in the assembler library, then clean up some syntax-highlighting in the front end. 000
Matt Coley @mattcoley.bsky.social · 01/04/2026Reworked how Recaf handles Android content. We still don't have full assembler support but major strides in everything else have been made. 110
Reposted by Matt Coleyleewyatt.bsky.social @leewyatt.bsky.social · 25/03/2026CarouselFX isn't just for image slideshows — it can also drive full app navigation with nested carousels, sidebar routing, and page lifecycle animations. 122
Reposted by Matt ColeyDirk Lemmermann @dlemmermann.bsky.social · 24/03/2026I created a website dedicated to #GemsFX, my primary open source project for #JavaFX custom controls. You can find it at gemsfx.dlsc.com. #ui #ux #java #javafxgemsfx.dlsc.comGemsFX — JavaFX Custom Controls & UtilitiesGemsFX is a rich collection of custom JavaFX controls and utilities. Explore date pickers, search fields, paging, tree views, notifications and more. 0148
Reposted by Matt ColeyGluon @gluonhq.bsky.social · 17/03/2026JavaFX 26 is available! Featuring the new macOS Metal pipeline and a Headless platform prototype. Read all about it here: gluonhq.com/javafx-26-is... #Java #JavaFXgluonhq.comJavaFX 26 is Now Available - GluonJavaFX 26 is Now Available We are pleased to announce the official release of JavaFX 26. This milestone marks another significant step forward for the ecosystem, delivering a robust suite of new featu... 0219
Matt Coley @mattcoley.bsky.social · 18/03/2026If you're up front about it cool, no problem. Especially if it works and its used as a base to build off. The whole "human in the loop" thing. The people like this aren't the common ones really publicizing what they've generated. Instead its the annoying AI hype type with ego problems. 000
Matt Coley @mattcoley.bsky.social · 18/03/2026The worst part about AI slop isn't the output. Its the people who generate it. Sure, maybe the code does what its supposed to. But "look at this awesome thing I made" is off putting. A project manager doesn't make the projects they manage. The developers do. Similarly, 'you' didn't make the thing. 101
Reposted by Matt ColeyFoojay, the Friends Of OpenJDK @foojay.io · 18/02/2026Testing Java on BeagleBoards with ARM and RISC-V processors. @frankdelporte.be shows how these single-board computers handle Java applications. foojay.io/today/first-... #Java #ARM #RISCV #BeagleBoardfoojay.ioFirst Test of Java on BeagleBoards (ARM and RISC-V)foojay is the place for all OpenJDK Update Release Information. Learn More. 033
Matt Coley @mattcoley.bsky.social · 11/02/2026The people tackling "real unsolved problems" aren't accrediting AI/LLMs with any success they have. A fancy auto-complete isn't a detail worth discussing in such cases, because without it they'd still solve the problem, maybe just a bit slower.media.tenor.coma cartoon man says that 's the neat part in front of stairsALT: a cartoon man says that 's the neat part in front of stairs 000
Matt Coley @mattcoley.bsky.social · 06/02/2026I remember that thread on twitter 😂 I used to have a circular indicator when waiting on the decompiler to finish in Recaf but swapped it out for something else. Reintroduced the circle indicator in the project summary screen while it was generating content. 010
Reposted by Matt Coleyleewyatt.bsky.social @leewyatt.bsky.social · 22/01/2026JavaFX is missing a native Switch control — every major UI framework has one except JavaFX. I've implemented a SwitchButton with full theme support. Hope to contribute to OpenJFX. Thanks @dlemmermann.bsky.social for his help! github.com/leewyatt/Swi... #JavaFX 132
Reposted by Matt ColeyJohannes Bechberger @mostlynerdless.de · 09/01/2026OpenJDK is faster than GraalVM* It's around twice as fast in one particular area. Read more in my latest tiny blog post at mostlynerdless.de/blog/2026/01...mostlynerdless.deOpenJDK is faster than GraalVM Java* - Mostly nerdlessOpenJDK is faster than GraalVM in some instances, but maybe it's not important? Discover more in this short blog post. 194
Matt Coley @mattcoley.bsky.social · 09/01/2026Looking at the skin impl for the control, it looks like intended usage of RotateTransition. So based on this and the GC root information, I'm inclined to say its a problem of the transition. This is on JavaFX 23.0.2 - Don't see any memory leak notes in 24/25 releases for this case. 000
Matt Coley @mattcoley.bsky.social · 09/01/2026So I debugged where that rotate transition was coming from that is caching the node... Its a neat little component I use from AtlantaFX, RingProgressIndicator with the value set to INDETERMINATE_PROGRESS. If I don't use it, or reset the progress value, then the leak goes away... 100
Matt Coley @mattcoley.bsky.social · 08/01/2026I *could* play wack-a-mole and null out references when the UI elements are removed, but it feels weird having to manually wire up logic to free this if the node is no longer part of the scene graph. There's got to be a more efficient route, right? 100
Matt Coley @mattcoley.bsky.social · 08/01/2026Any #JavaFX people experience removed nodes being stuck around in memory after they've been removed from the scene graph? If I have a node that has a ~500 MB byte array, and then I remove it, I should be able to expect that to be freeable right? Heap dump GC root for reference 221
Reposted by Matt ColeyRomain Thomas (@rh0main) @rh0main.bsky.social · 05/01/2026I reverse engineered DexProtector, the security solution protecting applications like Revolut and other banking apps. From custom ELF loaders to vtable hooking, here is an insight into how these protections work and their limitations. www.romainthomas.fr/post/26-01-d...romainthomas.frA Glimpse Into DexProtector | Romain ThomasThis blog post provides a high-level overview of DexProtector's security features and their limitations 13412
Reposted by Matt ColeyBrice Dutheil @bricedutheil.bsky.social · 28/12/2025As an old and somewhat inactive Mockito maintainer I'd like to congratulate Tim for these past years keeping the light on the Mockito project. He his now stepping down. Thank you Tim. github.com/mockito/mock...github.comStepping down as maintainer after 10 years · Issue #3777 · mockito/mockitoIn March 2026, I will be Mockito maintainer for 10 years (nearly a third of my whole life). Looking ahead, I decided that a decade milestone is a good moment to pass on maintainership to other folk... 0175
Reposted by Matt ColeySean Barrett @nothings.bsky.social · 30/10/2025I spent about two days learning and implementing atmosphere rendering for planetary views from space. The tutorials and other sources I found on it were prettty lacking in implementation details but I got there in the end. Too late now, but does anyone have any recommends? Should I write an article? 5553
Reposted by Matt ColeyFrank Delporte @frankdelporte.be · 30/10/2025I interviewed @mattcoley.bsky.social about #Recaf and his #JavaFX libraries. But unexpectedly, I got a deep-dive course on #Java byte code, obfuscated code, and how JARs can be (ab)used to hide their real code...! www.youtube.com/watch?v=6NIJ... More info: webtechie.be/post/2025-10...youtube.comMatt Coley, diving into byte code and JARs with Recaf and JavaFX libraries (#22)YouTube video by Frank Delporte 0103
Matt Coley @mattcoley.bsky.social · 24/10/2025www.youtube.com/watch?v=l4Pc...youtube.comJavaFX Flowless Bug: Stylesheets on Scene ＞ Stylesheets on NodeYouTube video by Matt Coley 010
Matt Coley @mattcoley.bsky.social · 24/10/2025If you're using the JavaFX "Flowless" library for virtualized controls and are observing sluggish performance, do not add stylesheets to the Virtualized Node. Add them to the Scene. I observed an immediate 10x performance boost by doing this. 163
Matt Coley @mattcoley.bsky.social · 24/09/2025The good news is, they reverted that 404 -> 403 option, and *some* of our projects updated to use Artifactory first instead of last. 010
Matt Coley @mattcoley.bsky.social · 24/09/2025Artifactory: IT was instructed to prevent crawling, so one thing they did was change Artifactory replying 404 for missing artifacts to replying with 403 (like all other urls on other services they ran) Result: 403 kills gradle builds, so nobody used artifactory and if they did, they put it last. 110
Matt Coley @mattcoley.bsky.social · 24/09/2025I love reading these articles and thinking "Yup, that's us on the job. We're part of the industrial inefficiency complex" Artifactory set up but nobody uses it? 👍 CI jobs with zero caching? 👍 + they can recursively spawn other jobs? 👍 + they can trigger from simple "fix typo" commits? 👍 130
Matt Coley @mattcoley.bsky.social · 08/09/2025Now Recaf 4X can inline return values of simple static methods (like a xor string decryption call in this case) 010
Matt Coley @mattcoley.bsky.social · 20/08/2025Recaf's interactive deobfuscation window now lets you specify how many passes to run. For some obfuscation patterns that can't be one-shot in one linear pass (opaque control flow leading to more opaque control flow repeated N times) increasing the pass count to N+1 reduces it completely. 011
Reposted by Matt ColeyJohan Vos @johanvos.bsky.social · 28/07/2025JavaFX now has a Headless platform. bugs.openjdk.org/browse/JDK-8... is now Resolved! Pfew, that took me 1 year, 5 months and 29 days. Goodnight! #JavaFX #Javabugs.openjdk.orgLoading... 0238
Reposted by Matt ColeyMike Stabile @mikestabile.bsky.social · 11/07/2025Australia's decision to require age/identity verification, including facial scans, in order to do a Google search is dystopian. We're watching the death of an open, anonymous internet, and the gradual takeover of information online by the state — under the guise of protecting children.abc.net.auAustralia is quietly rolling out age checks for search engines like GoogleJust as Australians are adjusting to the idea of having their ages checked for social media, age assurance rules are being applied to search engines and many other corners of the internet. 371178650
Matt Coley @mattcoley.bsky.social · 05/07/2025And from my last 🧵 here's the sample that had attributes lying about their lengths being patched automatically (amongst many other tricks). 000
Matt Coley @mattcoley.bsky.social · 05/07/2025Updates to how some of the transformers work has cleaned up the output on most obfuscated samples I have. Here's a demo on a Minecraft server plugin getting optimized back to almost perfectly legible source. 110
Matt Coley @mattcoley.bsky.social · 04/07/2025Anyways, Recaf will soon support loading these classes so you don't have to go through any of this pain like I did. 000
Matt Coley @mattcoley.bsky.social · 04/07/2025The exact line in the Hotspot class file parser responsible for supporting this can be found here: github.com/openjdk/jdk/... The code is so old it predates OpenJDK's git history. No, not moving to GitHub. Git. This code has been around since before they migrated to using VCS/Git. At least 18 y/o. 110
Matt Coley @mattcoley.bsky.social · 03/07/2025Here's the reported length in the attribute vs a hex viewer annotated with the relevant locations showing the discrepancy. 100
Matt Coley @mattcoley.bsky.social · 03/07/2025The sample here reports the Code attribute has 163 bytes. But if you read the attribute fully (with spec complaint parsing) then you see that it actually is 189 bytes. The trick here is for any Code attribute on a method, you shift your read buffer index to the actually red position. 100
Matt Coley @mattcoley.bsky.social · 03/07/2025Honestly, fuck Hotspot sometimes. A method body can just *lie* about how long its data is. Obviously nobody who makes a class parser is going to be keen on this until they see it in the wild. Does the spec say anything about this? Of course not! 100
Reposted by Matt ColeyTim Blazytko @mrphrazer.bsky.social · 27/06/2025The slides from our @reconmtl.bsky.social talk, "Breaking Mixed Boolean-Arithmetic Obfuscation in Real-World Applications" (CC @nicolo.dev ), are now online! Slides: synthesis.to/presentation... Plugin: github.com/mrphrazer/ob... 0105
Matt Coley @mattcoley.bsky.social · 22/06/2025We're in the annoying/grift phase of AI hyped slop. You can toss something together, put it up on vercel, and paint the sleek "AI powered" marketing over the site, to make yourself a low-investment high return product. This "success" furthers the AI hyped slop bubble and encourages others to cash in 020
Matt Coley @mattcoley.bsky.social · 22/06/2025And most often, people don't care either. A lot of people using AI for code-gen are making low-stakes applications. Nobody cares if there's a security hole in a personal program, or if its a bit slow. When your app is simple and doable with common tech stacks it can get a fair portion done for you. 110
Reposted by Matt ColeyJohan Vos @johanvos.bsky.social · 21/06/2025Getting tired of the "AI can generate code much faster than you" slogan. Most often, the problem is not generating code. The hard part is understanding the code. What is it doing, how and why? And is that what you expect it to do? 291
Reposted by Matt ColeyJohan Vos @johanvos.bsky.social · 05/06/2025Headless JavaFX platform passes almost all tests, with remaining failures being understood. Time to bring this to the next step: mail.openjdk.org/pipermail/op... 053
Matt Coley @mattcoley.bsky.social · 20/06/2025If something terrible pops out at YOU feel free to open an issue. I have some scattered TODO comments but mostly for things that don't immediately affect my use cases (and thus I am putting off fixing until later) 000
Matt Coley @mattcoley.bsky.social · 20/06/2025github.com/Col-E/BentoFX I probably will make more drastic changes somewhere down the line, but everything that irked me with the prior implementations is solved. So until I stumble upon something else that bugs me... Anyways, if nothing terrible pops out at me, I may call this 1.0.0github.comGitHub - Col-E/BentoFX: A docking system for JavaFXA docking system for JavaFX. Contribute to Col-E/BentoFX development by creating an account on GitHub. 100
Matt Coley @mattcoley.bsky.social · 20/06/2025Alright, I rewrote my #JavaFX docking framework, BentoFX, from scratch (again) after incorporating it into multiple projects and learning what the pain points were with the existing architecture. Here's what Bento looks like in practice: 131
