3 ms·

Can confirm. Matching decompilation in particular (where you match the compiler along with your guess at source, compile, then compare assembly, repeating if it

Can confirm. Matching decompilation in particular (where you match the compiler along with your guess at source, compile, then compare assembly, repeating if it doesn't match) is very token-intensive, but it's now very viable: https://news.ycombinator.com/item?id=46080498 https://news.ycombinator.com/item?id=46080498 Of course LLMs see a lot more source-assembly pairs than even skilled reverse engineers, so this makes sense. Any area where you can get unlimited training data is one we expect to see top-tier performance from LLMs. (also, hi Thomas!)

stackghost 6mo ago
My own experience has been that "ghidra -> ask LLM to reason about ghidra decompilation" is very effective on all but the most highly obfuscated binaries. Burning tokens by asking the LLM to compile, disassemble, compare assembly, recompile, repeat seems very wasteful and inefficient to me.
- mikestaas 6mo ago
  LaurieWired did a good episode about that kind of thing https://www.youtube.com/watch?v=u2vQapLAW88 https://www.youtube.com/watch?v=u2vQapLAW88
- kimixa 6mo ago
  That matches my experience too - LLMs are very capable in "translating" between domains - one of the best experience I've had with LLMs is turning "decompiled" source into "human readable" source. I don't think that "Binary Only" closed-source isn't the defense against this that some people here seem to think it is.
echelon 6mo ago
Has anyone used an LLM to deobfuscate compiled Javascript?
- bitexploder 6mo ago
  Yep. They are good at it.
- saagarjha 6mo ago
  I've used it for hobby efforts on Electron/React Native (Hermes bytecode) apps and it seems to work reasonably well
- heeen2 6mo ago
  yes, but it requires some nudging if you don't want to waste tokens. it will happily grep and sed through massive javascript bundles but if you tell it to first create tooling like babel scripts to format, it will be much quicker.
  - echelon 6mo ago
    > but if you tell it to first create tooling like babel scripts to format, it will be much quicker. Can you expand on this? Is that existing tooling for deminification?
    - heeen2 5mo ago
      for me it was custom scripts looking for data in minified bundles and refactoring for easier protocol reverse engineering, e.g. https://github.com/echtzeit-solutions/monsgeek-akko-linux/blob/master/driver_extract/refactor-bundle.js https://github.com/echtzeit-solutions/monsgeek-akko-linux/bl...
- lelanthran 6mo ago
  > Has anyone used an LLM to deobfuscate compiled Javascript? Seems like a waste of money; wouldn't it be better to extract the AST deterministically, write it out and only then ask an LLM to change those auto-generated symbol names with meaningful names?

stackghost 6mo ago

My own experience has been that "ghidra -> ask LLM to reason about ghidra decompilation" is very effective on all but the most highly obfuscated binaries. Burning tokens by asking the LLM to compile, disassemble, compare assembly, recompile, repeat seems very wasteful and inefficient to me.

mikestaas 6mo ago
LaurieWired did a good episode about that kind of thing https://www.youtube.com/watch?v=u2vQapLAW88 https://www.youtube.com/watch?v=u2vQapLAW88
kimixa 6mo ago
That matches my experience too - LLMs are very capable in "translating" between domains - one of the best experience I've had with LLMs is turning "decompiled" source into "human readable" source. I don't think that "Binary Only" closed-source isn't the defense against this that some people here seem to think it is.

echelon 6mo ago

Has anyone used an LLM to deobfuscate compiled Javascript?

bitexploder 6mo ago
Yep. They are good at it.
saagarjha 6mo ago
I've used it for hobby efforts on Electron/React Native (Hermes bytecode) apps and it seems to work reasonably well
heeen2 6mo ago
yes, but it requires some nudging if you don't want to waste tokens. it will happily grep and sed through massive javascript bundles but if you tell it to first create tooling like babel scripts to format, it will be much quicker.
- echelon 6mo ago
  > but if you tell it to first create tooling like babel scripts to format, it will be much quicker. Can you expand on this? Is that existing tooling for deminification?
  - heeen2 5mo ago
    for me it was custom scripts looking for data in minified bundles and refactoring for easier protocol reverse engineering, e.g. https://github.com/echtzeit-solutions/monsgeek-akko-linux/blob/master/driver_extract/refactor-bundle.js https://github.com/echtzeit-solutions/monsgeek-akko-linux/bl...
lelanthran 6mo ago
> Has anyone used an LLM to deobfuscate compiled Javascript? Seems like a waste of money; wouldn't it be better to extract the AST deterministically, write it out and only then ask an LLM to change those auto-generated symbol names with meaningful names?