Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TIL you can de-obfuscate code with ChatGPT

twitter.com

Post reply on HN
Print view View original

11–20 of 111 posts

Re: TIL you can de-obfuscate code with ChatGPT

#12

Post by teeray »

Every commenter is jumping in asking “is it correct?” Even if it’s not 100%, if it’s at least reasonably close, it could be a tremendous force-multiplier against obfuscation for someone with some familiarity with roughly what the code is trying to do.

Re: TIL you can de-obfuscate code with ChatGPT

#13

Post by Jeema101 »

crizzlenizzle wrote: post #4

Is it correct though? I’ve been toying around with ChatGPT for a few weeks now and I encountered a few situations in which ChatGPT was like 90% accurate at best. Things like suggesting snippets of configuration files or plugin research. It’s good to get an idea and get started somewhere, but I certainly cannot trust it blindly.

Don't think so. There's clearly the beginning of a while loop near the top of the obfuscated version. There's no loops at all in the 'de-obfuscated' version.

Re: TIL you can de-obfuscate code with ChatGPT

#16

Post by bobkazamakis »

Jeema101 wrote: post #13
crizzlenizzle wrote: post #4

Is it correct though? I’ve been toying around with ChatGPT for a few weeks now and I encountered a few situations in which ChatGPT was like 90% accurate at best. Things like suggesting snippets of configuration files or plugin research. It’s good to get an idea and get started somewhere, but I certainly cannot trust it blindly.

Don't think so. There's clearly the beginning of a while loop near the top of the obfuscated version. There's no loops at all in the 'de-obfuscated' version.

That's not generally a good enough indicator; plenty of obfuscation involves loops that otherwise aren't hit.

Re: TIL you can de-obfuscate code with ChatGPT

#17

Post by jerf »

teeray wrote: post #12

Every commenter is jumping in asking “is it correct?” Even if it’s not 100%, if it’s at least reasonably close, it could be a tremendous force-multiplier against obfuscation for someone with some familiarity with roughly what the code is trying to do.

Correctness is a big deal here. This is a security context and we can assume that the obfuscators are active attackers against legible code, not just people passively hoping that their obfuscated code is obfuscated. If this becomes a popular technique, then code obfuscation tools will simply pivot to writing code that ChatGPT gets wrong when asked to unobfuscate it.

I can't even imagine that would be a particularly hard thing to do, especially if it isn't correct even before actively attacking ChatGPT! Fooling it even harder won't be terribly difficult. This is advantage attacker overall.

I imagine it would be as easy as using some cognitively loaded, but wrong, terms as variable names instead of short letters and numbers. Ask ChatGPT "please unobfuscate this network code" and get back a substring search algorithm because the network code was written with a dozen variants on "haystack" and "needle" for variable names, for instance.

ChatGPT being actively wrong would be a step back for such deobfuscators then, not a positive at all.

Re: TIL you can de-obfuscate code with ChatGPT

#20

Post by enjoytheview »

bobkazamakis wrote: post #16
Jeema101 wrote: post #13

Earlier quoted context omitted.

Don't think so. There's clearly the beginning of a while loop near the top of the obfuscated version. There's no loops at all in the 'de-obfuscated' version.

That's not generally a good enough indicator; plenty of obfuscation involves loops that otherwise aren't hit.

Yeah, pretty sure that loop is to modify the lookup table for strings in runtime so you can't just statically replace it in the code, it's not strong obfuscation but in a properly deobfuscated code that loop wouldn't exist
Post reply on HN