Viewing profile — mahaloz

I would call any traditional decompiler deterministic, though these can rely on probabilistic models to infer how to undo these optimizations. A talk I did on this at Reverse Con (…

Answered above, but the gist is people have tried: https://decompilation.wiki/fundamentals/neural-decompilation... , and yet general LLMs from Anthropic and OpenAI appear to match …

Interesting. A lot of data shows IDA Pro is significantly better than Ghidra: https://decbench.com/ Based on today's results, IDA Pro is ahead by 15 percentage points, which would …

Creator here! Since I saw some questions below, I'd like to clarify some things. Kuna is originally Ghidra ported to Rust, but it has changed quite a bit since. The results shown i…

Thoughts and reasons behind developing a decompiler by learning from other decompilers.

Since we’re talking about decompilers, might as well mention the community around the research area: http://decompilation.wiki/ As well as the research history (slated to be update…

A summary of our human study at NDSS 2026 on humans (of different skill levels) using LLMs to reverse-engineer. Paper link: https://www.zionbasque.com/files/papers/dec-synergy-stud…

I love this use case! Do you have any public links acknowledging/mentioning/showing this use case? Including it in the Applications portion of the Dec Wiki would be great.

I agree with many other sentiments here that if it can replace decompilers, then surely it can replace compilers... which feels unlikely soon. So far, I've seen four end-to-end bin…

Welp, that's a really sad typo... I've made a post-publication edit to the article now, but my shame is immortalized in Git: https://github.com/mahaloz/mahaloz.re/commit/90b760f53e…

I like using it for library function comments, variable name recovery, and sometimes types. The comments are usually hit or miss, but I find the variable names to be a bit better t…

Would you be able to specify what section? Some sections are more sparse than others, but each page should at least have a few citations. In general, there is about 80+ decompilati…

As others have said, the standardization of metrics is still something debated, but at the same time, this space has been explored by various top-tier papers that your paper did no…

It’s always cool to see different approaches in this area, but I worry its benchmarks are meaningless without a comparison of non-AI based approaches (like IDA Pro). It would be in…

Oh my gosh, that is really bad. That's my bad. The code snippet has been corrected to have the correct variable names. Thanks for the find :)

That's awesome! That's exactly how modern decompilers deal with a special type of goto occurrence. They reduce gotos (or completely eliminate them) by introducing a `while(true)` l…

For a while now I've worked as the founder and lead of the BinSync team to make a plugin suite that unifies the many decompilers we use today. There is still much more to do, but i…

Well, uh, no one is working on it yet hehe. When I'm aware someone is working on something, I try to have them PR as soon as possible so a running Draft PR show's everyone it's loc…

A extremely trivial command injection that existed in Netgear routers up until last December. Shown to be WAN-side exploitable with a attacker-controlled website.