5 ms·
My own experience has been that "ghidra -> ask LLM to reason about ghidra decompilation" is very effective on all but the most highly obfuscated binaries. Burn
by stackghost 6mo ago
My own experience has been that "ghidra -> ask LLM to reason about ghidra decompilation" is very effective on all but the most highly obfuscated binaries.
Burning tokens by asking the LLM to compile, disassemble, compare assembly, recompile, repeat seems very wasteful and inefficient to me.
- mikestaas 6mo agoLaurieWired did a good episode about that kind of thing https://www.youtube.com/watch?v=u2vQapLAW88 https://www.youtube.com/watch?v=u2vQapLAW88
- kimixa 6mo agoThat matches my experience too - LLMs are very capable in "translating" between domains - one of the best experience I've had with LLMs is turning "decompiled" source into "human readable" source. I don't think that "Binary Only" closed-source isn't the defense against this that some people here seem to think it is.