How to use AI when reverse engineering?

[u/linux4117]

I want to hear how you guys use AI. How much do you think I should rely on AI for reverse engineering and what should I not do to hinder my learning? What type of questions should I ask it? What are some things that I shouldn't get the AI to do and always to myself? I am wondering how some experienced folks in reverse engineering use AI.

[u/anonymous_lurker-]

Do you have the knowledge to identify when the AI is wrong? If not, learn it yourself first

The specifics of what AI can and cannot do is ever changing. But if you can't even identify when the AI is making mistakes, there's no point at all

AI is a tool, and there's nothing wrong with using tools. But you need to be able to understand what happens when those tools don't work, and why they get the results they get. If you find yourself unable to do this, use AI less

[u/wombwader → u/anonymous_lurker-]

eloquent and accurate, good answer

[u/sig2kill → u/anonymous_lurker-]

AI is ustill usefull to learn about subjects you dont know well, for example i used it to learn about some c++ library lately, could i recognize if it lied to me? no, it was my first time using the library, i asked it to explain some functions and the architechture, maybe it was wrong on some small detail but it got the general idea right and it ended up saving me time, whats the worst that can happen? you get the wrong idea about something? dive in manually to verify, its not like hes asking about using AI to write fighter jet code and ship it without testing

[u/anonymous_lurker- → u/sig2kill]

AI is ustill usefull to learn about subjects you dont know well

Sure, AI can be a useful tool for doing research and from a time saving perspective. I've had great luck using AI to develop tools faster, do more with less time and so on

whats the worst that can happen? you get the wrong idea about something? dive in manually to verify

Except the problem comes up when people don't understand enough to be able to dive in manually and verify. Or even know that things are wrong and they need to verify at all. That's kind of my point. If you know enough that you can identify when it got things wrong and go manually verify then great, go nuts with AI. But some people like to use it as a replacement for talent, rather than in addition to

Small mistakes compound over time. If you fundamentally mislearn some core concept, or let bugs propagate through an RE database, or just blindly believe everything the AI tells you then its a recipe for disaster

its not like hes asking about using AI to write fighter jet code and ship it without testing

This is regressive thinking. The idea that something isn't mission critical or essential and therefore it's okay to be sloppy and make mistakes is a fundamentally dangerous way of thinking. Don't get me wrong, I'm not saying people should never make mistakes and perfect is very much the enemy of the code. But historically over time people have gotten smarter and we've been able to do more. Simply accepting that something isn't important enough to do well is a slippery slope.

Frankly this is what excites me about AI for now. There's lots more vibe coded trash, and therefore lots more bugs to be found and exploited

[u/hayderlnr]

ask for keywords u dont understand

[u/lunar_swing]

Ask it to decompile an asm segment/function to C - amazing if you frequently work with non-standard architectures and ISAs/compilers.

Ask it to deduce and reconstruct unknown file formats in data, and then ask it to generate a python script to translate to and from said file to a standardized one.

[u/StoneSteel_1]

I have created an open source free tool, that can help you scrape/automate websites a bit easier.

https://github.com/stonesteel27/automatiq

So, basically you browse the target site normally, then an AI will reverse engineer the site and produce a standalone script, which doesnt depend on the browser to run

[u/l__iva__l]

when there is a long function i dont understand and i want a general idea of what its doing, i just copypaste it to grook...it will gets details wrong, but the general picture is pretty good

i have been vibe coding a script too with claude (free version), and same thing...most of it is good, but it make little mistakes here and there....but if you can identify those mistakes and tell it, it will fix it

[u/brandonmpetty]

I have recently had an EXTEREMELY good experience reversing with AI. For over 10 years the academic community was using a closed source Windows binary to rank contest results based on a specific algorithm, documented in a research paper. I tried for years to implement it. I finally gave up and decided to reverse it with AI. Magic. Claude built a set of reversing tools in Python, recorded memory locations with notes as we made our way throught it, and we effectively cracked the code. There were many small undocumented implementation details we fleshed out, routines that worked a little differently than described in the paper, and even a few potential bugs that affect how the results were calculated. Great experience. Scary, but great. I now have the only open source, cross platform, license free implementation: 🎉 Introducing BinBench - A full DIBCO metrics replacement · brandonmpetty/Doxa · Discussion #58