Live data from Hacker News

TIL you can de-obfuscate code with ChatGPT

twitter.com

81–90 of 111 posts

Re: TIL you can de-obfuscate code with ChatGPT

#81

https://twitter.com/AlexAlexandrius/status/16178852870484254... So, all I've learned is that ChatGPT knows the obfuscated and de-obfuscated versions of code that it itself has generated.

I just tested it on a little snippet of my code obfuscated with https://obfuscator.io/ and it worked almost perfectly.

My original code:

  function resizeImage(img) {
   var maxHeight = 350;
   var ratio = 1;
   if(img.height > maxHeight) {
    ratio = maxHeight / img.height;
   } 
   
   var width = img.width * ratio
   var height = img.height * ratio;
   
   var canvas = document.createElement('canvas');
   canvas.height = height;
   canvas.width = width;
   var ctx = canvas.getContext('2d');
   ctx.drawImage(img, 0, 0, width, height);
   return canvas.toDataURL("image/jpeg", 0.8);
  }
ChatGPT's answer: https://i.imgur.com/5jgPMEd.png

Re: TIL you can de-obfuscate code with ChatGPT

#82
post #72

Earlier quoted context omitted.

What I've been telling everyone is that you can not (should not) ask ChatGPT a question that you can not independently verify that answer to yourself. This is kind of what makes it good for generating code, because everything it generates can be pretty quickly verified and validated by another machine (interpreter/compiler). Makes it not so great for writing essays on books you didn't read, and especially for doing m…

For math, I'm kind of surprised that it can't recognize "this is math" and then handle that with normal calculations instead of the language model. I assume we'll see that before long.

A good trick is to ask it to translate the request into commands of your choosing. Like ask it to generate python code to make the calculation for example. Another thing that works well is to turn it into a command extraction problem, give it examples of the kinds of commands you want, and build an interpreter for those commands.

I agree, we’re not far from that, or we’re there now.

Re: TIL you can de-obfuscate code with ChatGPT

#83
Wow, I wonder how many "bytes of state" ChatGPT must have internally to be able to do that transform. Or does it guess from certain sequences and just writes something plausible?

It would be interesting to test if it can solve "memory hard" problems, like repeated obfuscation or hashing, that would require large internal state. Then you could map how large the equivalent memory would be.

Re: TIL you can de-obfuscate code with ChatGPT

#84
post #72

Is it correct though? I’ve been toying around with ChatGPT for a few weeks now and I encountered a few situations in which ChatGPT was like 90% accurate at best. Things like suggesting snippets of configuration files or plugin research. It’s good to get an idea and get started somewhere, but I certainly cannot trust it blindly.

What I've been telling everyone is that you can not (should not) ask ChatGPT a question that you can not independently verify that answer to yourself. This is kind of what makes it good for generating code, because everything it generates can be pretty quickly verified and validated by another machine (interpreter/compiler). Makes it not so great for writing essays on books you didn't read, and especially for doing m…

I was kind of thinking about this.

Let's hypothetically assume we have some sort of AGI and we can ask it to write programs and text and nothing else.

Is there anyone on this planet who would think that they don't need to look at the generated code? I mean imagine a manager simply feeding in tickets and getting a finished application out without ever knowing how it was produced.

The application is business critical and any kind of mistake could ruin his business which puts the manager at complete mercy of the AI.

Now you might say that this happens with humans as well but when humans cause problems we let other humans review and test their code.

AI causes problems? Let's add more humans. Wait a minute...

Re: TIL you can de-obfuscate code with ChatGPT

#85
post #54
post #21

Earlier quoted context omitted.

the input was generated by chatgpt. and is non-functional. so, ROUGHLY, what is it trying to do?

I'm wondering why people are so quick to defend ChatGPT.

A lot of people are bought into the fantasy that AGI is just around the corner and don't understand that LLMs are a statistical model of words which possesses no reasoning ability.

Re: TIL you can de-obfuscate code with ChatGPT

#86

I have to say, I find all the comments dismissing ChatGPT hilarious. I read them in a funny grandpa voice. However, we should look past the insignificant details. The main achievement is that we now have a really capable unstructured text-to-computer interface. We can hook it up to anything and it will give us answers with whatever properties we desire, in whatever shape we can think of.

I know, all those frusty old grumpyboots who actually want the thing to return factually accurate answers and valid code. Just be happy with plausible sounding answers people. Sheesh!

People can be wrong and can sound quite plausible too.

The key is to verify... and that's true for AI and people too, though for sure that's not something people are used to do sadly.

Re: TIL you can de-obfuscate code with ChatGPT

#87

https://twitter.com/AlexAlexandrius/status/16178852870484254... So, all I've learned is that ChatGPT knows the obfuscated and de-obfuscated versions of code that it itself has generated.

I just tested it on a little snippet of my code obfuscated with https://obfuscator.io/ and it worked almost perfectly. My original code: function resizeImage(img) { var maxHeight = 350; var ratio = 1; if(img.height > maxHeight) { ratio = maxHeight / img.height; } var width = img.width * ratio var height = img.height * ratio; var canvas = document.createElement('canvas'); canvas.height = height; canvas.width = width;…

Interesting why it changes 350px to 600px.

Also interesting is how it's explanation of the deobfuscated code, although broadly correct in terms of goal, doesn't accurately describe the steps. Almost as if it's disregarding the code altogether and merely describing another implementation of "resizeImage".

Re: TIL you can de-obfuscate code with ChatGPT

#88
post #72

Is it correct though? I’ve been toying around with ChatGPT for a few weeks now and I encountered a few situations in which ChatGPT was like 90% accurate at best. Things like suggesting snippets of configuration files or plugin research. It’s good to get an idea and get started somewhere, but I certainly cannot trust it blindly.

What I've been telling everyone is that you can not (should not) ask ChatGPT a question that you can not independently verify that answer to yourself. This is kind of what makes it good for generating code, because everything it generates can be pretty quickly verified and validated by another machine (interpreter/compiler). Makes it not so great for writing essays on books you didn't read, and especially for doing m…

I'm leaning towards using it for things I already know exactly how to do -- including a very clear idea of the result. In these contexts, it can save some mental workload / time.

Re: TIL you can de-obfuscate code with ChatGPT

#89
post #12

Every commenter is jumping in asking “is it correct?” Even if it’s not 100%, if it’s at least reasonably close, it could be a tremendous force-multiplier against obfuscation for someone with some familiarity with roughly what the code is trying to do.

Imagine a Stack Overflow where 10% of all answers look correct, but are actually completely fictional (as in, not misunderstanding the question, providing outdated information etc., but completely making up terminology and solutions) – without any cues to tell you which is which.

Re: TIL you can de-obfuscate code with ChatGPT

#90
post #53

Is it correct though? I’ve been toying around with ChatGPT for a few weeks now and I encountered a few situations in which ChatGPT was like 90% accurate at best. Things like suggesting snippets of configuration files or plugin research. It’s good to get an idea and get started somewhere, but I certainly cannot trust it blindly.

90% accurate sounds impressive, and it is, but its still 100% incorrect almost always.

But does it follow the 80/20 rule ?

In this case, 80% of the answer for 20% of the effort ?

Post reply on HN