I need to reverse a binary made years ago, and I have zero experience with cpp, so I think it would be a good experiment to get an LLM to help me in any way
Ask HN: How are you using LLMs for traversing decompiler output?
1–10 of 48 posts
Re: Ask HN: How are you using LLMs for traversing decompiler output?
#2Binary Ninja has an AI integration called side kick, it has a free trial but I'm not sure it can be used in the free web version. [1]
In my experience, the off the shelf LLMs (e.g. ChatGPT) do a pretty poor job with assembly, they can not reason about the stack or stack frames well.
I think your job will be the same with or without AI. Figuring out the data structures and data types a function is operating on and naming variables.
What are you reverse engineering for? For example, getting a full compilable decompilation has different goals than finding vulnerabilities or patching a bug.
Re: Ask HN: How are you using LLMs for traversing decompiler output?
#3I made a site to use LLMs to help me with reverse engineering. The output is surprisingly readable, even with C++ classes. Let me know any feedback you might have: https://decompiler.zeroday.engineering/
Re: Ask HN: How are you using LLMs for traversing decompiler output?
#4Highly recommend it. I reversed an app with o1 Pro Mode and the analysis of the obfuscated C# code matched up accurately with what I eventually discovered by manually reversing.
Re: Ask HN: How are you using LLMs for traversing decompiler output?
#5Binary Ninja has an AI integration called side kick, it has a free trial but I'm not sure it can be used in the free web version. [1] In my experience, the off the shelf LLMs (e.g. ChatGPT) do a pretty poor job with assembly, they can not reason about the stack or stack frames well. I think your job will be the same with or without AI. Figuring out the data structures and data types a function is operating on and nam…
This is what I gather from reverse engineering material I've read and groups I've been around. Hidden state, hidden data structures, hidden automations all abound, and there simply isn't enough detail in the assembler itself to bridge the hardware's internal conceptualization and processes.
Re: Ask HN: How are you using LLMs for traversing decompiler output?
#6Interesting. Wouldn't this actually be a deterministic problem based on graph analysis. Id have thought LLMs would have been more effective taking the out out some graph recognizer and then identifying what those higher level constructs map to?
Re: Ask HN: How are you using LLMs for traversing decompiler output?
#7Binary Ninja has an AI integration called side kick, it has a free trial but I'm not sure it can be used in the free web version. [1] In my experience, the off the shelf LLMs (e.g. ChatGPT) do a pretty poor job with assembly, they can not reason about the stack or stack frames well. I think your job will be the same with or without AI. Figuring out the data structures and data types a function is operating on and nam…
Out of curiosity, what would you say the current state of the art is for full compilable decompilation? This is something I have a vague interest in but I'm not involved enough in the space to be on top of the latest and greatest tooling.
Re: Ask HN: How are you using LLMs for traversing decompiler output?
#8Interesting. Wouldn't this actually be a deterministic problem based on graph analysis. Id have thought LLMs would have been more effective taking the out out some graph recognizer and then identifying what those higher level constructs map to?
Deterministic maybe, but surely undecidable in the general case since you need whole program analysis to understand, for example, the purpose of a memory location. ML may help approximate this undecidable problem.
Re: Ask HN: How are you using LLMs for traversing decompiler output?
#9Binary Ninja has an AI integration called side kick, it has a free trial but I'm not sure it can be used in the free web version. [1] In my experience, the off the shelf LLMs (e.g. ChatGPT) do a pretty poor job with assembly, they can not reason about the stack or stack frames well. I think your job will be the same with or without AI. Figuring out the data structures and data types a function is operating on and nam…
Out of curiosity, what would you say the current state of the art is for full compilable decompilation? This is something I have a vague interest in but I'm not involved enough in the space to be on top of the latest and greatest tooling.
Looking at an individual function, IDA hex-rays output is often recompilable as-is (or with minor modifications), but it won't necessarily be idiomatic, especially if you don't have symbol information.
Re: Ask HN: How are you using LLMs for traversing decompiler output?
#10Highly recommend it. I reversed an app with o1 Pro Mode and the analysis of the obfuscated C# code matched up accurately with what I eventually discovered by manually reversing.
Reverse engineering C# is extremely different from C++ binaries.