Thyme 发布 AI 逆向工程 IDE，支持 APK 与 ARM 反汇编

Thyme — Native reverse-engineering IDE for macOS, Linux & Windows.

APK · DEX · JAR/WAR · IPA · dylib
A64 · A32 · T32
.dmg · .msi · .deb · AppImage

Open an APK and get Java back, with the symbols the compiler left behind. Open a .so and get ARM disassembly — A64, A32 or T32 — with basic blocks and control-flow graphs. Both land in one DuckDB workspace, so the call graph is a table you can run SQL against rather than a picture you have to squint at. The decompiler is linked in-process — there is no subprocess, no scratch directory, and nothing leaves the machine.

Download 49 USD one-time 490 USD one-time

Features

Java decompilation, in-process

Integrates the Garlic Java/Dex decompiler for rapid decompilation of JVM and Dalvik code, source code at github.

ARM disassembly — A64, A32 and T32

Supports static disassembly analysis for ARM A64, A32, and T32 instruction sets.

Call graph you can query

Supports call graph queries across Java, Dalvik, and native libraries, enabling seamless call graph tracing between Java and native code within APKs.

Control-flow graphs

Basic blocks with the assembly inline, edges coloured by kind, jump-to-address from the entry point table, and export to Graphviz .dot.

Hex and smali views

Drop to the byte level or to smali when the decompiler's output is not the truth you need.

Native library extraction

Pull every .so out of an APK and treat each as a project in its own right. A bare library is not a lesser project for having no Java in it.

Phone mirror

A bundled screen mirror with a GPU colour-conversion path, so a 1080×2400 device does not cost a core to watch.

MCP server

thyme --mcp speaks the Model Context Protocol over stdio, so an agent can drive the analysis. It reaches the running IDE over a unix socket or named pipe — not a network port.

AI providers, in one panel

Keep the credentials for the AI CLIs you already use in one place, and launch one against the open project.

Screenshots

Thyme with a real project open — an APK, its native libraries, and the call graph underneath. Use the arrows to page through them.

Java decompilation A class decompiled back to Java, with its method list beside the source.
Decompiled class Open a compiled class and read it as source — JVM, DEX and JAR alike.
Disassembly A64 mnemonics beside the address and the raw bytes, for the function selected in the tree.
Call graph Method cross-references for the open class — who calls it, and what it calls next.
Cross-references Walk the calls out of a native library, function by function.
Control-flow graph Basic blocks and the edges between them, computed from the disassembly.
Analysis report What a run produced — class, method, call-graph and string counts — and the report it writes.
AI console Drive an AI CLI against the open project, in a panel beside the code.
Phone mirror Mirror an attached device — screen, logcat, shell and files in one panel.
Terminal A real shell over the open project, beside the graph you are working on.

Supported inputs

Format	What you get	Status
APK	Java decompilation, native libraries, manifest metadata	stable
DEX / JAR	Java decompilation, call graph	stable
IPA	Archive browsing, Mach-O payloads	stable
ELF64 `.so`	A64 disassembly, CFG, cross-references	stable
ELF32 `.so`	A32 / T32 disassembly, CFG	stable
Mach-O `.dylib`	A64 disassembly, CFG, cross-references	stable
Mach-O	Other Mach-O — executables, bundles	partial

FAQ

What exactly does a licence unlock?

The Analysis pass: the workspace database, the SQL-queryable call graph, and native library analysis. Everything else — opening APK, DEX, JAR and IPA files, Java decompilation, ARM disassembly (A64, A32 and T32), hex and smali views, control-flow graphs and the phone mirror — runs without one.

Is the licence checked online?

When the licence server is reachable, yes: Thyme posts the licence to it and caches the answer locally. That is what lets a licence be revoked, and it is the only thing the app ever sends anywhere. The request contains the licence text and nothing else — no file names, no binary contents, no telemetry.

Does it work offline?

Yes. The licence is a plain text file, and the app holds the matching public key. With no network it verifies the signature locally and starts. ~/.garlic/license is the file, and it is the same file the garlic command-line tool reads, so one licence covers both.

Is my APK or binary uploaded anywhere?

No. Analysis runs entirely on your machine. The MCP server talks over a unix socket or a named pipe rather than a network port, and the only outbound request the app makes is the licence check above.

What happens after 0.1.0?

A one-time licence covers every 0.x release and the features listed above. If a future major version changes what the licence unlocks, existing licences keep working for the version they were bought on.

Pricing

Free

forever

Open APK, DEX, JAR and IPA. Java decompilation, ARM disassembly (A64, A32, T32), hex and smali views, call graph, CFG. No account, no key.

Open APK, DEX, JAR, IPA
Java decompilation
A64 / A32 / T32 disassembly, CFG
Hex and smali views
Phone mirror

Download

30-day trial of the Analysis pass on first run, no account needed.

Pro

one-time

$49

Everything in Free, plus the Analysis pass: the workspace database, the SQL-queryable call graph, and native library analysis.

Everything in Free
The Analysis pass — workspace database
SQL-queryable Java call graph
Native library analysis
All 0.x updates

buy now →

One-time payment, handled by Stripe. Delivered on screen and by email.

Enterprise

one-time

$490

The same licence as Pro, priced for organisations that need it on paper. One-time and perpetual, with the same terms.

Everything in Pro
The same licence file — no per-seat terms
One-time, perpetual
All 0.x updates

buy now →

One-time payment, handled by Stripe. Delivered on screen and by email.

Try it on something you already have open.

Free to download. The Analysis pass needs a licence, and there is a 30-day trial on first run.

Download See pricing