It has nothing to do with LLMs, but Ghidra is a wonderful tool.
Ask HN: How are you using LLMs for traversing decompiler output?
11–20 of 48 posts
Re: Ask HN: How are you using LLMs for traversing decompiler output?
#12I made a site to use LLMs to help me with reverse engineering. The output is surprisingly readable, even with C++ classes. Let me know any feedback you might have: https://decompiler.zeroday.engineering/
What kind of file should be uploaded?
Re: Ask HN: How are you using LLMs for traversing decompiler output?
#13I've only played a with this, but it was impressive.
Re: Ask HN: How are you using LLMs for traversing decompiler output?
#14You could use the LLM to help you write utility scripts for whatever disassembler you’re using e.g. python for IDA. That might work better than feeding it raw assembly.
Game RE communities also have all sorts of neat utilities for decompiling large cpp binaries. Skyrim’s community is pretty active with ghidra/ida.
Guessing you’re not lucky enough to have a PDB?
Re: Ask HN: How are you using LLMs for traversing decompiler output?
#15Binary Ninja has an AI integration called side kick, it has a free trial but I'm not sure it can be used in the free web version. [1] In my experience, the off the shelf LLMs (e.g. ChatGPT) do a pretty poor job with assembly, they can not reason about the stack or stack frames well. I think your job will be the same with or without AI. Figuring out the data structures and data types a function is operating on and nam…
Out of curiosity, what would you say the current state of the art is for full compilable decompilation? This is something I have a vague interest in but I'm not involved enough in the space to be on top of the latest and greatest tooling.
Echoing IDA but its pricing is a huge PITA if you’re using it in a hobbyist capacity i.e. you don’t have an employer willing to pay for it. Could opt for the home version but that’s a yearly cost and you have to use their cloud decompiler. Ghidra’s your best bet if you want something FOSS and community-driven although not as great at decompilation.
Re: Ask HN: How are you using LLMs for traversing decompiler output?
#16Re: Ask HN: How are you using LLMs for traversing decompiler output?
#17You could use the LLM to help you write utility scripts for whatever disassembler you’re using e.g. python for IDA. That might work better than feeding it raw assembly. Game RE communities also have all sorts of neat utilities for decompiling large cpp binaries. Skyrim’s community is pretty active with ghidra/ida. Guessing you’re not lucky enough to have a PDB?
PDB?
Re: Ask HN: How are you using LLMs for traversing decompiler output?
#18Have you tried Ghidra yet? If you still have your debug symbols, then it can do a really good job.
Re: Ask HN: How are you using LLMs for traversing decompiler output?
#19Binary Ninja has an AI integration called side kick, it has a free trial but I'm not sure it can be used in the free web version. [1] In my experience, the off the shelf LLMs (e.g. ChatGPT) do a pretty poor job with assembly, they can not reason about the stack or stack frames well. I think your job will be the same with or without AI. Figuring out the data structures and data types a function is operating on and nam…
Out of curiosity, what would you say the current state of the art is for full compilable decompilation? This is something I have a vague interest in but I'm not involved enough in the space to be on top of the latest and greatest tooling.
Most decompilers do not strive for recompilability. [1] I believe there are (or were) some academic projects that aimed for recompilation as a core feature, but it is a hard problem.
On the commercial side, IDA / HexRays [2] is very strong for C-like decompilation. If you're looking at Go, Rust, or even C++ it is going to be a little bit more messy. As other commenters have said, you'll work function-by-function and it is expensive, though the free version does have decompilation (F5) for x86 and x64 (IIRC).
Binary Ninja [3] (no affiliation) is the coolest IMO, they have multiple intermediate representations they lift the assembly through. So you get like assembly -> low level IL -> medium level IL -> high level IL. There are also SSA forms (static single assignment) that can aid in programmatic analyses. The high level IL is very readable but makes no effort to be compilable as a programming language. That being said, Binary Ninja has implemented different "views" on the HLIL so you can show it as pseudo-C, Rust, etc. There is a free online version and the commercial version is cheaper than IDA but still expensive. Good Python API, good UI.
Ghidra [4] is the RE framework released by NSA. It is free and open source. It supports a ton of niche architectures. This is what most people use. I think the UI is awful, personally. It has a decompiler, the results are OK. They have an intermediate representation (P-Code) and plugins are in Java (since it is written in Java). I haven't worked much with it.
Most online decompilations you see for old games are likely using Ghidra, some might be using IDA. This is largely a manual process of doing a function at a time and building up the mental map of the program and how things interact.
Also worth mentioning are lifters. There were a few projects that aimed to lift assembly to LLVM IR (compiler framework's intermediate representation), with the idea being that then all your analyses could be written over LLVM IR as a lingua franca. Since it is in LLVM IR, it would be also recompilable and retargetable. [5][6]
1. https://reverseengineering.stackexchange.com/questions/2603/...
2. https://hex-rays.com/ida-free
Re: Ask HN: How are you using LLMs for traversing decompiler output?
#20You could use the LLM to help you write utility scripts for whatever disassembler you’re using e.g. python for IDA. That might work better than feeding it raw assembly. Game RE communities also have all sorts of neat utilities for decompiling large cpp binaries. Skyrim’s community is pretty active with ghidra/ida. Guessing you’re not lucky enough to have a PDB?
PDB?
Program database file - only relevant if the binary is Windows. But that makes decomp an order of magnitude easier. I’d be surprised if OP had one though.