Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We hid backdoors in ~40MB binaries and asked AI + Ghidra to find them

quesma.com

Post reply on HN
Print view View original

101–108 of 108 posts

Re: We hid backdoors in ~40MB binaries and asked AI + Ghidra to find them

#101

Post by Aeolun »

akiselev wrote: post #7

Shameless plug: https://github.com/akiselev/ghidra-cli I’ve been using Ghidra to reverse engineer Altium’s file format (at least the Delphi parts) and it’s insane how effective it is. Models are not quite good enough to write an entire parser from scratch but before LLMs I would have never even attempted the reverse engineering. I definitely would not depend on it for security audits but the latest models are more th…

> Models are not quite good enough to write an entire parser from scratch

In my experience models are really good at this? Not one shot, but writing decoders/encoders is entirely possible.

Re: We hid backdoors in ~40MB binaries and asked AI + Ghidra to find them

#102

Post by AlexeyBelov »

celeryd wrote: post #92
mbh159 wrote: post #88

The methodology debate in this thread is the most important part. The commenter who says "add obfuscation and success drops to zero" is right but that's also the wrong approach imo. The experiment isn't claiming AI can defeat a competent attacker. It's asking whether AI agents can replicate what a skilled (RE) specialist does on an unobfuscated binary. That's a legitimate, deployable use case (internal audit, code re…

Why does that matter? Being oblivious to obfuscated binaries is like failing the captcha test. Let's say instead of reversing, the job was to pick apples. Let's say an AI can pick all the apples in an orchard in normal weather conditions, but add overcast skies and success drops to zero. Is this, in your opinion, still a skilled apple picking specialist?

You're replying to an LLM

Re: We hid backdoors in ~40MB binaries and asked AI + Ghidra to find them

#103

Post by akiselev »

Aeolun wrote: post #101
akiselev wrote: post #7

Shameless plug: https://github.com/akiselev/ghidra-cli I’ve been using Ghidra to reverse engineer Altium’s file format (at least the Delphi parts) and it’s insane how effective it is. Models are not quite good enough to write an entire parser from scratch but before LLMs I would have never even attempted the reverse engineering. I definitely would not depend on it for security audits but the latest models are more th…

> Models are not quite good enough to write an entire parser from scratch In my experience models are really good at this? Not one shot, but writing decoders/encoders is entirely possible.

They can oneshot relatively simple parsers/encoders/decoders with a proper spec, but it’s a completely different ballgame when you’re trying to parse a very domain knowledge heavy file format (like the format electronics CAD) with decades of backwards compatible cruft spread among hundreds of megabytes of decompiled Delphi and C# dlls (millions of lines).

The low level parts (OLE container, streams and blocks) are easy but the domain specific stuff like deserializing to typed structs is much harder.

Re: We hid backdoors in ~40MB binaries and asked AI + Ghidra to find them

#104

Post by hilbert42 »

What this tells me is that the era of code obfuscation through compilation is likely coming to an end. If anyone is able to reverse-engineer a program it'll have huge ramifications for the industry.

This won't be welcomed by software developers who benefit from obfuscation but consumers could benefit. For example, AI could alter a program to remove or add features to suit users' requirements.

Imagine being able to instruct AI to comb through Windows 11 and remove all telemetry and Copilot code and restore local accounts.

I'd be very pleased with an AI agent tnat would do that.

Re: We hid backdoors in ~40MB binaries and asked AI + Ghidra to find them

#105

Post by anamexis »

decidu0us9034 wrote: post #87
anamexis wrote: post #73

Earlier quoted context omitted.

Why, though? That would make sense if you were just trying to do a comparative analysis of different agent's ability to use specific tools without context, but if your thesis is: > However, [the approach of using AI agents for malware detection] is not ready for production. Then the methodology does not support that. It's "the approach of using AI agents for malware detection with next to zero documentation or guidan…

All the docs are already in its training data, wouldn't that just pollute the context? I think giving a model better/non-free tooling would help as mentioned. binja code mode can be useful but you definitely need to give these models a lot of babysitting and encouragement and their limitations shine with large binaries or functions. But sometimes if you have a lot to go through and just need some starting point to tr…

> All the docs are already in its training data, wouldn't that just pollute the context?

No - there is a reason that coding agents are constantly looking up docs from the web, even though they were presumably trained on that data. Having this information directly in context results in much higher fidelity than relying on the information embedded in the model.

Re: We hid backdoors in ~40MB binaries and asked AI + Ghidra to find them

#106

Post by mbh159 »

celeryd wrote: post #92
mbh159 wrote: post #88

The methodology debate in this thread is the most important part. The commenter who says "add obfuscation and success drops to zero" is right but that's also the wrong approach imo. The experiment isn't claiming AI can defeat a competent attacker. It's asking whether AI agents can replicate what a skilled (RE) specialist does on an unobfuscated binary. That's a legitimate, deployable use case (internal audit, code re…

Why does that matter? Being oblivious to obfuscated binaries is like failing the captcha test. Let's say instead of reversing, the job was to pick apples. Let's say an AI can pick all the apples in an orchard in normal weather conditions, but add overcast skies and success drops to zero. Is this, in your opinion, still a skilled apple picking specialist?

I'm not a deep security expert but I'm assuming the skill of the agents will continue to get better, so not saying there AI's can do to this task as reliably as humans. There's likely utility for non-adversarial triage/internal audit with human review. However with better ai apple pickers during sunny conditions you need less human pickers during night conditions. I think measuring the progress of the said apple picking is what's interesting.

Re: We hid backdoors in ~40MB binaries and asked AI + Ghidra to find them

#107

Post by stared »

magicmicah85 wrote: post #22

GPT is impressive with a consistent 0% false positive rate across models, yet its ability to detect is as high as 18%. Meanwhile Claude Opus 4.6 is able to detect up to 46% of backdoors, but has a 22% false positive rate. It would be interesting to have an experiment where these models are able to test exploiting but their alignment may not allow that to happen. Perhaps combining models together can lead to that kind…

Rerun it for "high" and "xhigh" effort settings, and GPT-5.2-Codex still get 0% false positive, while getting at the level of other best models for localization of backdoors: https://quesma.com/benchmarks/binaryaudit/

Re: We hid backdoors in ~40MB binaries and asked AI + Ghidra to find them

#108

Post by stared »

Tiberium wrote: post #14

I highly doubt some of those results, GPT 5.2/+codex is incredible for cyber security and CTFs, and 5.3 Codex (not on API yet) even moreso. There is absolutely no way it's below Deepseek or Haiku. Seems like a harness issue, or they tested those models at none/low reasoning?

I rerun it for GPT-5.2-Codex, for high and xhigh.

Finally, it matches my experience, and it is actually good (as good as the best models for localization, still impressive 0% false positive rate): https://quesma.com/benchmarks/binaryaudit/

Will rerun it on GPT-5.3-Codex shortly, as API is out (yet, the effort does not work correctly, and for "medium" it is very low).

Post reply on HN