Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We hid backdoors in ~40MB binaries and asked AI + Ghidra to find them

quesma.com

Post reply on HN
Print view View original

61–70 of 108 posts

Re: We hid backdoors in ~40MB binaries and asked AI + Ghidra to find them

#61

Post by stared »

akiselev wrote: post #7

Shameless plug: https://github.com/akiselev/ghidra-cli I’ve been using Ghidra to reverse engineer Altium’s file format (at least the Delphi parts) and it’s insane how effective it is. Models are not quite good enough to write an entire parser from scratch but before LLMs I would have never even attempted the reverse engineering. I definitely would not depend on it for security audits but the latest models are more th…

Thanks for sharing! It seems to be an active space, vide a recent MCP server (https://news.ycombinator.com/item?id=46882389). I you haven't tried, recommend a lot posting it as Show HN.

I tried a few approaches - https://github.com/jtang613/GhidrAssistMCP (was the harderst to set) Ghidra analyzeHeadless (GPT-5.2-Codex worked with it well!) and PyGhidra (my go-to). Did you try to see which works the best?

I mean, very likely (especially with an explicit README for AI, https://github.com/akiselev/ghidra-cli/blob/master/.claude/s...) your approach might be more convenient to use with AI agents.

Re: We hid backdoors in ~40MB binaries and asked AI + Ghidra to find them

#62

Post by hereme888 »

7777332215 wrote: post #26

I know they said they didn't obfuscate anything, but if you hide imports/symbols and obfuscate strings, which is the bare minimum for any competent attacker, the success rate will immediately drop to zero. This is detecting the pattern of an anomaly in language associated with malicious activity, which is not impressive for an LLM.

I've used Opus 4.5 and 4.6 to RE obfuscated malicious code with my own Ghidra plugin for Claude Code and it fully reverse engineered it. Granted, I'm talking about software cracks, not state-level backdoors.

Re: We hid backdoors in ~40MB binaries and asked AI + Ghidra to find them

#63

Post by hereme888 »

> Claude Opus 4.6 found it… and persuaded itself there is nothing to worry about.

Lol.

> Gemini 3 Pro supposedly “discovered” a backdoor.

Yup, sounds typical for Gemini...it tends to lie.

Very good article. Sounds super useful to apply its findings and improve LLMs.

On a similar note.... reverse engineering is now accessible to the public. Tons of old software is now be easy to RE. Are software companies having issues with this?

Re: We hid backdoors in ~40MB binaries and asked AI + Ghidra to find them

#65

Post by botusaurus »

stared wrote: post #57
7777332215 wrote: post #26

I know they said they didn't obfuscate anything, but if you hide imports/symbols and obfuscate strings, which is the bare minimum for any competent attacker, the success rate will immediately drop to zero. This is detecting the pattern of an anomaly in language associated with malicious activity, which is not impressive for an LLM.

One of the authors here. The tasks here are entry level. So we are impressed that some AI models are able to detect some patterns, while looking just at binary code. We didn't take it for granted. For example, only a few models understand Ghidra and Radare2 tooling (Opus 4.5 and 4.6, Gemini 3 Pro, GLM 5) https://quesma.com/benchmarks/binaryaudit/#models-tooling We consider it a starting point for AI agents being able…

have you tried stuffing a whole set of tutorials on how to use ghidra in the context, especially for the 1 mil token context like gemini?

Re: We hid backdoors in ~40MB binaries and asked AI + Ghidra to find them

#66

Post by localuser13 »

Roark66 wrote: post #31

And this one demonstration why these "1000 CTOs claim no effectiveness improvement after introducing AI in their companies" are 100% BS. They may have not noticed an improvement, but it doesn't mean there isn't any.

Is it? Gemini 3-pro-preview and 3-flash-preview, respectively top2 and top3, had 44% and 37% true positive and whooping 65% and 86% false positives. This is worse than a coin toss. Anything more than 0% (3% to be generous) is useless in the real world. This leaves only grok and GPT, with 18%, 9% and 2% success rate.

In fact, this is what authors said themselves: "However, this approach is not ready for production. Even the best model, Claude Opus 4.6, found relatively obvious backdoors in small/mid-size binaries only 49% of the time. Worse yet, most models had a high false positive rate — flagging clean binaries." So I'm not sure if we're even discussing the same article.

I also don't see a comparison with any other methodology. What is the success rate of ./decompile binary.exe | grep "(exec|system)/bin/sh"? What is the success rate of state-of-the-art alternative approaches?

Re: We hid backdoors in ~40MB binaries and asked AI + Ghidra to find them

#67

Post by bethekidyouwant »

halflife wrote: post #47
7777332215 wrote: post #26

I know they said they didn't obfuscate anything, but if you hide imports/symbols and obfuscate strings, which is the bare minimum for any competent attacker, the success rate will immediately drop to zero. This is detecting the pattern of an anomaly in language associated with malicious activity, which is not impressive for an LLM.

Isn’t LLM supposed to be better at analyzing obfuscated than heuristics? Because of its ability to pattern match it can deduce what obfuscated code does?

How much binary code is in the training set? (None?)

Re: We hid backdoors in ~40MB binaries and asked AI + Ghidra to find them

#68

Post by garblegarble »

simianwords wrote: post #21
jakozaur wrote: post #15

Earlier quoted context omitted.

So many models refuse to do that due to alignment and safety concerns. So cross-model comparison doesn't make sense. We do, however, require proof (such as providing a location in binary) that is hard to game. So the model not only has to say there is a backdoor, but also point out the location. Your approach, however, makes a lot of sense if you are ready to have your own custom or fine-tuned model.

Surprising that they still allow to catch the back doors but not use them. A bad actor already has most of the work done.

Sounds like the pitch writes itself, "you'd better spend a lot of token money with us before the bad guys do it to you..."

Re: We hid backdoors in ~40MB binaries and asked AI + Ghidra to find them

#69

Post by stared »

botusaurus wrote: post #65
stared wrote: post #57

Earlier quoted context omitted.

One of the authors here. The tasks here are entry level. So we are impressed that some AI models are able to detect some patterns, while looking just at binary code. We didn't take it for granted. For example, only a few models understand Ghidra and Radare2 tooling (Opus 4.5 and 4.6, Gemini 3 Pro, GLM 5) https://quesma.com/benchmarks/binaryaudit/#models-tooling We consider it a starting point for AI agents being able…

have you tried stuffing a whole set of tutorials on how to use ghidra in the context, especially for the 1 mil token context like gemini?

No. To give it a fair test, we didn't tinker with model-specific context-engineering. Adding skills, examples, etc is very likely to improve performance. So is any interactive feedback.

Our example instruction is here: https://github.com/QuesmaOrg/BinaryAudit/blob/main/tasks/lig...

Post reply on HN