Live data from Hacker News

TIL you can de-obfuscate code with ChatGPT

twitter.com

91–100 of 111 posts

Re: TIL you can de-obfuscate code with ChatGPT

#91

I have to say, I find all the comments dismissing ChatGPT hilarious. I read them in a funny grandpa voice. However, we should look past the insignificant details. The main achievement is that we now have a really capable unstructured text-to-computer interface. We can hook it up to anything and it will give us answers with whatever properties we desire, in whatever shape we can think of.

Just like Siri was about to revolutionize the world and it now is at best a shortcut to set a timer ?

Or like crypto was about to revolutionize the world in 2010 ?

Or maybe like we would have fully autonomous cars "in two years" in 2012 ?

I might be a pessimistic grandpa but it's not worse than a blind technophile

Re: TIL you can de-obfuscate code with ChatGPT

#92
post #17
post #12

Every commenter is jumping in asking “is it correct?” Even if it’s not 100%, if it’s at least reasonably close, it could be a tremendous force-multiplier against obfuscation for someone with some familiarity with roughly what the code is trying to do.

Correctness is a big deal here. This is a security context and we can assume that the obfuscators are active attackers against legible code, not just people passively hoping that their obfuscated code is obfuscated. If this becomes a popular technique, then code obfuscation tools will simply pivot to writing code that ChatGPT gets wrong when asked to unobfuscate it. I can't even imagine that would be a particularly h…

A counter-counter measure could be to re-obfuscate the code with a traditional obfuscator/minifier, stripping off all the clever misleading tricks and run ChatGPT on that.

Re: TIL you can de-obfuscate code with ChatGPT

#93
Fortunately, there's a good repository of obfuscated code.

https://www.ioccc.org

    int main(int b,char**i){long long n=B,a=I^n,r=(a/b&a)>>4,y=atoi(*++i),_=(((a^n/b)*(y>>T)|y>>S)&r)|(a^r);printf("%.8s\n",(char*)&_);}

If you want to get the same (or similar) results:

    curl https://api.openai.com/v1/completions \
      -H "Content-Type: application/json" \
      -H "Authorization: Bearer $OPENAI_API_KEY" \
      -d '{
      "model": "code-davinci-002",
      "prompt": "Deobfuscate the following C code:\n\nint main(int b,char**i){long long n=B,a=I^n,r=(a/b&a)>>4,y=atoi(*++i),_=(((a^n/b)*(y>>T)|y>>S)&r)|(a^r);printf(\"%.8s\\n\",(char*)&_);}",
      "temperature": 0,
      "max_tokens": 256,
      "top_p": 1,
      "frequency_penalty": 0,
      "presence_penalty": 0
    }'
That one loops on the response:

    The code is obfuscated with the following rules:

    * `B` is the value of `b`
    * `I` is the value of `i`
    * `T` is the value of `y`
    * `S` is the value of `_`

Changing to: "model": "text-davinci-003",

    int main(int b, char** i) {
        long long n = b, a = *i[0] ^ n, r = (a / b & a) >> 4, y = atoi(*++i), _ = (((a ^ n / b) * (y >> 8) | y >> 7) & r) | (a ^ r);
        printf("%.8s\n", (char*)&_);
    }
Which... isn't exactly helpful.

Asking it to explain it instead:

    This code is a C program that prints out a string. The program takes two parameters, b and i, and assigns them to variables n and a. Then the program performs various calculations on those variables and the parameters, such as shifting and bitwise operations. Finally, the program prints out the result of the calculations, which is stored in the variable _, as an 8-character string.

Re: TIL you can de-obfuscate code with ChatGPT

#94

Is it correct though? I’ve been toying around with ChatGPT for a few weeks now and I encountered a few situations in which ChatGPT was like 90% accurate at best. Things like suggesting snippets of configuration files or plugin research. It’s good to get an idea and get started somewhere, but I certainly cannot trust it blindly.

It has this really amazing and terrifying quality of being a really good bullshitter. I asked it an AWS question once and it gave me 4 very convincing sounding answers. I went to try it. 2 of them are complete bullshit as in as the commands don't even exist. The only good answer is the one I already had. It's in this uncanny valley of bullshitting. Can be quite dangerous in some situations, especially if one is lolled into trusting it.

Re: TIL you can de-obfuscate code with ChatGPT

#95

Is it correct though? I’ve been toying around with ChatGPT for a few weeks now and I encountered a few situations in which ChatGPT was like 90% accurate at best. Things like suggesting snippets of configuration files or plugin research. It’s good to get an idea and get started somewhere, but I certainly cannot trust it blindly.

Is it ready for production? Maybe not. Is it amazing and inevitably going to get better? Yes. Does it make a lot of human labor redunant in the very foreseeable future? Also yes.

Re: TIL you can de-obfuscate code with ChatGPT

#96

I have to say, I find all the comments dismissing ChatGPT hilarious. I read them in a funny grandpa voice. However, we should look past the insignificant details. The main achievement is that we now have a really capable unstructured text-to-computer interface. We can hook it up to anything and it will give us answers with whatever properties we desire, in whatever shape we can think of.

You've conflated the critical detail. No garbage-out is the critically significant problem with AI. Right now, ChatGPT is the ability to generate structured results from whatever format we can think of to whatever format we can think of. They may or may not be correct.

It is only a critically significant problem for some applications. People have already come up with a variety of potential solutions for this problem, for different classes of problems, including integration with Wolfram Alpha.

However, verifying results is and will always be important. Iterating on the prompts and alternative paths is also important.

But even as it is right now, it is very useful to a lot of people. Remember, a lot of people accepted self-driving cars that can drive themselves off roads and crash into trailers, even paid extra for it, while this is just text generation for now.

I see that it is going to transform everything. No technical revolution has ever been more readily apparent. We now have an interface to talk to computers that can translate unstructured raw language into other formats. This is the real innovation that will unlock the power of more specialized, more advanced models in the near future.

Re: TIL you can de-obfuscate code with ChatGPT

#97
post #91

I have to say, I find all the comments dismissing ChatGPT hilarious. I read them in a funny grandpa voice. However, we should look past the insignificant details. The main achievement is that we now have a really capable unstructured text-to-computer interface. We can hook it up to anything and it will give us answers with whatever properties we desire, in whatever shape we can think of.

Just like Siri was about to revolutionize the world and it now is at best a shortcut to set a timer ? Or like crypto was about to revolutionize the world in 2010 ? Or maybe like we would have fully autonomous cars "in two years" in 2012 ? I might be a pessimistic grandpa but it's not worse than a blind technophile

Okay, the bets are placed. Let's come back to this conversation in a year.

Re: TIL you can de-obfuscate code with ChatGPT

#98
post #72

Earlier quoted context omitted.

What I've been telling everyone is that you can not (should not) ask ChatGPT a question that you can not independently verify that answer to yourself. This is kind of what makes it good for generating code, because everything it generates can be pretty quickly verified and validated by another machine (interpreter/compiler). Makes it not so great for writing essays on books you didn't read, and especially for doing m…

For math, I'm kind of surprised that it can't recognize "this is math" and then handle that with normal calculations instead of the language model. I assume we'll see that before long.

I really want Wolfram|Alpha to be integrated into this... that'd be nice. Also if they could make W|A any faster than a glacier while there at it that'd be great.

Re: TIL you can de-obfuscate code with ChatGPT

#99
post #72

Is it correct though? I’ve been toying around with ChatGPT for a few weeks now and I encountered a few situations in which ChatGPT was like 90% accurate at best. Things like suggesting snippets of configuration files or plugin research. It’s good to get an idea and get started somewhere, but I certainly cannot trust it blindly.

What I've been telling everyone is that you can not (should not) ask ChatGPT a question that you can not independently verify that answer to yourself. This is kind of what makes it good for generating code, because everything it generates can be pretty quickly verified and validated by another machine (interpreter/compiler). Makes it not so great for writing essays on books you didn't read, and especially for doing m…

> everything it generates can be pretty quickly verified and validated by another machine

It can be verified in a sense that it builds, but that doesn't mean that it actually does what you asked it to do, or that it does it on all valid inputs. The worst bugs to track down are silent logic bugs.

Re: TIL you can de-obfuscate code with ChatGPT

#100

Is it correct though? I’ve been toying around with ChatGPT for a few weeks now and I encountered a few situations in which ChatGPT was like 90% accurate at best. Things like suggesting snippets of configuration files or plugin research. It’s good to get an idea and get started somewhere, but I certainly cannot trust it blindly.

It has this really amazing and terrifying quality of being a really good bullshitter. I asked it an AWS question once and it gave me 4 very convincing sounding answers. I went to try it. 2 of them are complete bullshit as in as the commands don't even exist. The only good answer is the one I already had. It's in this uncanny valley of bullshitting. Can be quite dangerous in some situations, especially if one is lolle…

I recognize what you are describing and I actually think that its predisposition to doing this has become worse in the past week or so.
Post reply on HN