Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How are you using LLMs for traversing decompiler output?

news.ycombinator.com

Post reply on HN
Print view View original

41–48 of 48 posts

Re: Ask HN: How are you using LLMs for traversing decompiler output?

#41

Post by apatheticonion »

Inspired by the work out there that reverse engineers game engines, I've always wanted to try my hand at reverse engineering to contribute to the world of game preservation.

Is it actually legal to decompile a game engine from executables/dll files, write new sources by making sense of the output and rewriting it such that it can be compiled targeting modern APIs?

I feel like that must be illegal

Re: Ask HN: How are you using LLMs for traversing decompiler output?

#43

Post by rgovostes »

The LLM4Decompile project (https://github.com/albertan017/LLM4Decompile) provides some open models for binary to C decompilation and Ghidra pseudocode refinement, along with some training sets.

RevEng.ai, linked a few times already, discusses their approach here: https://blog.reveng.ai/training-an-llm-to-decompile-assembly...

Re: Ask HN: How are you using LLMs for traversing decompiler output?

#44

Post by svilen_dobrev »

cpp? that's a preprocessor. u mean c++?

LLM won't help you much if u can't understand what it's talking about.

Manual way is, given ELF (linux executable format) somexe,

$ strings somexe

$ objdump -d somexe

$ objdump -s -j .ro data somexe

then look+ponder over the results.

and/or running ghidra (as mouse'd UI) over it.. which may help somewhat but not 100%

Have in mind, that objdump and ghidra have opposite ways of showing assembly transfer/multi-operand instructions - one has mov dest,target , other has mov target,dest - for same code.

no idea on (recent) windoze front. IDA ?

Re: Ask HN: How are you using LLMs for traversing decompiler output?

#45

Post by mahaloz »

I like using it for library function comments, variable name recovery, and sometimes types. The comments are usually hit or miss, but I find the variable names to be a bit better than auto-generated ones. I implement most of this in my decompiler plugin: https://github.com/mahaloz/DAILA; check it out if you are interested :).

Re: Ask HN: How are you using LLMs for traversing decompiler output?

#46

Post by menaerus »

userbinator wrote: post #42

Unfortunately LLMs are not good at precision and details, which is exactly what you need for the sort of analysis you're trying to do.

Right. Have a look at the paper above from Meta on how they fine-tuned the Code Llama with LLVM IR to beat the compiler in producing size-optimized binaries.

Re: Ask HN: How are you using LLMs for traversing decompiler output?

#47

Post by D4Ha »

mdaniel wrote: post #35
feznyng wrote: post #15

Earlier quoted context omitted.

Echoing IDA but its pricing is a huge PITA if you’re using it in a hobbyist capacity i.e. you don’t have an employer willing to pay for it. Could opt for the home version but that’s a yearly cost and you have to use their cloud decompiler. Ghidra’s your best bet if you want something FOSS and community-driven although not as great at decompilation.

Not only the pricing by itself, every story that I've heard about normal people trying to actually give them money is that they actually don't want to sell it to anyone other than big players That said, depending on ones needs they do actually offer a slimmed down IDA Free: https://hex-rays.com/ida-free I actually use AUR to more-or-less track its releases https://aur.archlinux.org/packages/ida-free

Hexrays used to be difficult to deal with if you want to purchase IDA Pro for the first time, due to their software getting leaked online.

They have eased the procedure to buy from them, but from time to time they'll ask you to fill out your info with national ID/passport (they say its because they don't want to sell their software to individuals under sanctions). This is despite them being based in Belgium (not the US).

For any serious work IDA Pro is highly suitable (the customization and scripting, loader examples and processor plugins...etc), on the other hand for side projects and basic security research Binary ninja and ghidra can go along way.

Re: Ask HN: How are you using LLMs for traversing decompiler output?

#48

Post by readyplayernull »

netsec_burn wrote: post #3

I made a site to use LLMs to help me with reverse engineering. The output is surprisingly readable, even with C++ classes. Let me know any feedback you might have: https://decompiler.zeroday.engineering/

This is great! With Ghidra I had to look for the corresponding libs of a very specific RiscV vendor, your SRE did it by itself. You should have your own HN thread in front page!
Post reply on HN