Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How are you using LLMs for traversing decompiler output?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 48 posts

Re: Ask HN: How are you using LLMs for traversing decompiler output?

#31

Post by spectre9 »

r00t- wrote: post #29
carom wrote: post #19

Earlier quoted context omitted.

Most decompilers do not strive for recompilability. [1] I believe there are (or were) some academic projects that aimed for recompilation as a core feature, but it is a hard problem. On the commercial side, IDA / HexRays [2] is very strong for C-like decompilation. If you're looking at Go, Rust, or even C++ it is going to be a little bit more messy. As other commenters have said, you'll work function-by-function and…

Meta has a foundation model trained on LLVM IR: https://ai.meta.com/research/publications/meta-large-languag...

lol ok, now we’re getting into pure-nonsense territory

Re: Ask HN: How are you using LLMs for traversing decompiler output?

#32

Post by [deleted] »

avg_dev wrote: post #30
latexr wrote: post #28

Earlier quoted context omitted.

The domain makes it look like “Revenge AI”. Terrible name. Not as risqué as some others¹ but not as fun or memorable either. ¹ https://www.snopes.com/fact-check/domain-thing/

i don't think so (that it is a terrible name); it's a pretty common term https://www.urbandictionary.com/define.php?term=reveng

[deleted]

Re: Ask HN: How are you using LLMs for traversing decompiler output?

#34

Post by olalonde »

latexr wrote: post #28
JosephRedfern wrote: post #21

These guys are building foundational models for this purpose: https://reveng.ai/ . The results are quite compelling, and they have plugins for your favourite reverse engineering tools.

The domain makes it look like “Revenge AI”. Terrible name. Not as risqué as some others¹ but not as fun or memorable either. ¹ https://www.snopes.com/fact-check/domain-thing/

I was about to comment that the domain was quite clever...

Re: Ask HN: How are you using LLMs for traversing decompiler output?

#35

Post by mdaniel »

feznyng wrote: post #15
aidanhs wrote: post #7

Earlier quoted context omitted.

Out of curiosity, what would you say the current state of the art is for full compilable decompilation? This is something I have a vague interest in but I'm not involved enough in the space to be on top of the latest and greatest tooling.

Echoing IDA but its pricing is a huge PITA if you’re using it in a hobbyist capacity i.e. you don’t have an employer willing to pay for it. Could opt for the home version but that’s a yearly cost and you have to use their cloud decompiler. Ghidra’s your best bet if you want something FOSS and community-driven although not as great at decompilation.

Not only the pricing by itself, every story that I've heard about normal people trying to actually give them money is that they actually don't want to sell it to anyone other than big players

That said, depending on ones needs they do actually offer a slimmed down IDA Free: https://hex-rays.com/ida-free

I actually use AUR to more-or-less track its releases https://aur.archlinux.org/packages/ida-free

Re: Ask HN: How are you using LLMs for traversing decompiler output?

#36

Post by michaeltlewis »

spectre9 wrote: post #31
r00t- wrote: post #29

Earlier quoted context omitted.

Meta has a foundation model trained on LLVM IR: https://ai.meta.com/research/publications/meta-large-languag...

lol ok, now we’re getting into pure-nonsense territory

It's not clear to me why that is so. An LLM trained on IR for the purpose of compilation is not quite what we're looking for here but it is in the same territory.

Re: Ask HN: How are you using LLMs for traversing decompiler output?

#37

Post by uncomplexity_ »

__alexander wrote: post #24

Do you have experience reverse engineering? If not, LLMs are not going to help much. LLMs are useful for aiding the analysis but they don’t do the analysis.

Yea this one. If you have solid fundamentals these LLMs are really handy in assisting and never leading.

For example I have a minified javascript file, way obfuscated. I can paste the code and make it break down the initial structure. And then I tell it which parts to focus on and which parts to dig in deeper.

Re: Ask HN: How are you using LLMs for traversing decompiler output?

#38

Post by mdaniel »

netsec_burn wrote: post #23
btown wrote: post #12

Earlier quoted context omitted.

What kind of file should be uploaded?

The allowed types are a bit misleading. Any binary is accepted, any architecture. You can upload shared objects, ELF executables, PE binaries, etc. I like to give it bomb executables (reverse engineering challenges) to test it.

> Any binary is accepted, any architecture.

One should be careful tossing around the word "any" in relation to executable formats, for there are seemingly an unbounded number of them: https://github.com/1Password/onepassword-sdk-go/blob/v0.1.5/...

Up to you, but currently your polling endpoint just has a boolean, which is likely super easy to cook on the server side but also leads the user left wondering "uh, is this thing on?" in ways that any kind of percentage might not. IOW, how long, exactly, should any sane person wait for it to be {"status":true}?

Also, you have your ELB misconfigured because trying to upload a binary that is takes more than 30 seconds to upload causes the actual POST to puke. I'm sure that's great for hello-world.exe but is absolutely hilarious for any real binary

Re: Ask HN: How are you using LLMs for traversing decompiler output?

#39

Post by mxmilkiib »

olalonde wrote: post #34
latexr wrote: post #28

Earlier quoted context omitted.

The domain makes it look like “Revenge AI”. Terrible name. Not as risqué as some others¹ but not as fun or memorable either. ¹ https://www.snopes.com/fact-check/domain-thing/

I was about to comment that the domain was quite clever...

oooh, it's Rev Eng checks tfa
Post reply on HN