4 ms·

10 years is far too pessimistic for this being a routine task, I think 2 years max. As you mentioned, you can already do this today by just giving GPT 5.5/Opus

10 years is far too pessimistic for this being a routine task, I think 2 years max. As you mentioned, you can already do this today by just giving GPT 5.5/Opus 4.8 an IDA/Ghidra tooling (a CLI or MCP, I have a custom CLI for it). You can start with the LLM going from the string anchors and renaming functions/globals, then when you have enough functions, the LLM can start working on typing - IDA has a very powerful typing API for HexRays-decompiled code, you can even type locals and it all persists in a DB. My custom IDA CLI is just a simple thing on top of IDA Python's integration + ida-domain + some higher-level helpers, and works as a daemon with workers, so a stale/bad request doesn't corrupt an IDA DB (an issue I had when I was using idasql). A bit offtopic, but: do you have any links to your efforts? I'm curious to see what other people do in this area.

swiftcoder 3mo ago
Have you published your IDA CLI anywhere? I'd be interested to see what that looks like
- Tiberium 3mo ago
  Not yet, unfortunately, but I might in the future. To be honest, it's nothing unique. I got inspired by https://github.com/allthingsida/idasql https://github.com/allthingsida/idasql which I initially used, but it had a lot of bugs, a big codebase size, and IDA's C++ API is really easy to misuse and corrupt a DB, so I had GPT 5.4/5.5 make a new one for itself based on IDA's Python SDK, which is official and doesn't need weird SQL hacks. Then recently I found https://github.com/bkerler/ida_rpc https://github.com/bkerler/ida_rpc which seems to be ~60% the same thing as the one I have, the only big difference is that I do not give any special commands to LLMs, they just have to write Python in scripts/inline heredocs to interact with IDA. This lets them do a lot more interesting things since they get a full programming language. This is an example of how LLMs work with idagent (`ida` is implicitly imported, ida.types, ida.comments is helper's own wrappers): https://paste.debian.net/hidden/cf46a122 https://paste.debian.net/hidden/cf46a122 More interesting example that was used to let the LLM/me track the rename progress for the initial function renames + gaps (code-looking like bytes that weren't inside of functions, IDA's autoanalysis missed some real functions). Although the game turned out to be small enough with only ~1500 real game functions that needed renames, which was done in ~10 hours of agent time total I think (I didn't parallelize with multiple agents). https://paste.debian.net/hidden/bf458b3a https://paste.debian.net/hidden/bf458b3a To be honest, you can probably have an agent vibecode a similar MVP tool to the one I have in about an hour-two :)

swiftcoder 3mo ago

Have you published your IDA CLI anywhere? I'd be interested to see what that looks like

Tiberium 3mo ago
Not yet, unfortunately, but I might in the future. To be honest, it's nothing unique. I got inspired by https://github.com/allthingsida/idasql https://github.com/allthingsida/idasql which I initially used, but it had a lot of bugs, a big codebase size, and IDA's C++ API is really easy to misuse and corrupt a DB, so I had GPT 5.4/5.5 make a new one for itself based on IDA's Python SDK, which is official and doesn't need weird SQL hacks. Then recently I found https://github.com/bkerler/ida_rpc https://github.com/bkerler/ida_rpc which seems to be ~60% the same thing as the one I have, the only big difference is that I do not give any special commands to LLMs, they just have to write Python in scripts/inline heredocs to interact with IDA. This lets them do a lot more interesting things since they get a full programming language. This is an example of how LLMs work with idagent (`ida` is implicitly imported, ida.types, ida.comments is helper's own wrappers): https://paste.debian.net/hidden/cf46a122 https://paste.debian.net/hidden/cf46a122 More interesting example that was used to let the LLM/me track the rename progress for the initial function renames + gaps (code-looking like bytes that weren't inside of functions, IDA's autoanalysis missed some real functions). Although the game turned out to be small enough with only ~1500 real game functions that needed renames, which was done in ~10 hours of agent time total I think (I didn't parallelize with multiple agents). https://paste.debian.net/hidden/bf458b3a https://paste.debian.net/hidden/bf458b3a To be honest, you can probably have an agent vibecode a similar MVP tool to the one I have in about an hour-two :)