mahaloz

4 ms·

1.
by mahaloz 2mo ago
I would call any traditional decompiler deterministic, though these can rely on probabilistic models to infer how to undo these optimizations. A talk I did on this at Reverse Con (clipped to the important part): https://youtu.be&
2.
by mahaloz 2mo ago
Answered above, but the gist is people have tried: https://decompilation.wiki/fundamentals/neural-decompilation... , and yet general LLMs from Anthropic and OpenAI appear to match or beat all of these works :(
3.
by mahaloz 2mo ago
Interesting. A lot of data shows IDA Pro is significantly better than Ghidra: https://decbench.com/ Based on today's results, IDA Pro is ahead by 15 percentage points, which would mean, statistically, IDA Pro will reco
4.
by mahaloz 2mo ago
Creator here! Since I saw some questions below, I'd like to clarify some things. Kuna is originally Ghidra ported to Rust, but it has changed quite a bit since. The results shown in the screenshot on the site are not a feature in Ghidr
5.
Kuna: Decompiler Development in the Age of Coding Agents(noelo.org)
3 points by mahaloz 2mo ago|1 comments
6.
by mahaloz 2mo ago
Thoughts and reasons behind developing a decompiler by learning from other decompilers.
7.
Decompile binaries to Rust, not C(twitter.com)
4 points by mahaloz 5mo ago|0 comments
8.
by mahaloz 8mo ago
Since we’re talking about decompilers, might as well mention the community around the research area: http://decompilation.wiki/ As well as the research history (slated to be updated in a few days): https://mahalo
9.
Do LLMs Help Humans Reverse Engineer Software?(twitter.com)
1 points by mahaloz 9mo ago|1 comments
10.
by mahaloz 9mo ago
A summary of our human study at NDSS 2026 on humans (of different skill levels) using LLMs to reverse-engineer. Paper link: https://www.zionbasque.com/files/papers/dec-synergy-study.pd... Challenges code: https:&
11.
by mahaloz 2y ago
I love this use case! Do you have any public links acknowledging/mentioning/showing this use case? Including it in the Applications portion of the Dec Wiki would be great.
12.
by mahaloz 2y ago
I agree with many other sentiments here that if it can replace decompilers, then surely it can replace compilers... which feels unlikely soon. So far, I've seen four end-to-end binary-to-code AI approaches, and none have had convincing
13.
by mahaloz 2y ago
Welp, that's a really sad typo... I've made a post-publication edit to the article now, but my shame is immortalized in Git: https://github.com/mahaloz/mahaloz.re/commit/90b760f53ef51b7...
14.
by mahaloz 2y ago
I like using it for library function comments, variable name recovery, and sometimes types. The comments are usually hit or miss, but I find the variable names to be a bit better than auto-generated ones. I implement most of this in my deco
15.
by mahaloz 2y ago
Would you be able to specify what section? Some sections are more sparse than others, but each page should at least have a few citations. In general, there is about 80+ decompilation projects (decompilers) referenced in the wiki.
16.
The Decompilation Wiki: categorized knowledge on decompilation(decompilation.wiki)
56 points by mahaloz 2y ago|2 comments
17.
by mahaloz 3y ago
As others have said, the standardization of metrics is still something debated, but at the same time, this space has been explored by various top-tier papers that your paper did not cite. For example, DREAM [1], evaluated using the classic
18.
by mahaloz 3y ago
It’s always cool to see different approaches in this area, but I worry its benchmarks are meaningless without a comparison of non-AI based approaches (like IDA Pro). It would be interesting to see how this model holds up on metrics from pre
19.
by mahaloz 3y ago
Oh my gosh, that is really bad. That's my bad. The code snippet has been corrected to have the correct variable names. Thanks for the find :)
20.
by mahaloz 3y ago
That's awesome! That's exactly how modern decompilers deal with a special type of goto occurrence. They reduce gotos (or completely eliminate them) by introducing a `while(true)` loop, followed by corresponding `continue` and `bre
21.
Synchronizing Ida, Ghidra, and Binja with BinSync(github.com)
3 points by mahaloz 4y ago|1 comments
22.
by mahaloz 4y ago
For a while now I've worked as the founder and lead of the BinSync team to make a plugin suite that unifies the many decompilers we use today. There is still much more to do, but it's in a state that is usable. Try it out :). I wo
23.
by mahaloz 4y ago
Well, uh, no one is working on it yet hehe. When I'm aware someone is working on something, I try to have them PR as soon as possible so a running Draft PR show's everyone it's locked. If you don't seen a draft PR, it me
24.
Simple bugs still exist in Netgear routers (WAN-Side One-Click)(mahaloz.re)
2 points by mahaloz 4y ago|2 comments
25.
by mahaloz 4y ago
A extremely trivial command injection that existed in Netgear routers up until last December. Shown to be WAN-side exploitable with a attacker-controlled website.
26.
by mahaloz 4y ago
Ayyy I know this article is about the actual thesis, but it’s super cool to see Hawaiian on a top article title here. Although I don’t believe it was coined by a Native Hawaiian, it’s still fun to see Hawaiian make its way into science!
27.
Show HN: Interactive symbols from your decompiler to your debugger(github.com)
2 points by mahaloz 4y ago|0 comments
28.
by mahaloz 4y ago
Wow this was actually just the code reference I was looking for to extend decomp2dbg into Ghidra. I had seen ida2dwarf before, but not this sleek Python approach to it. It does still seem though that you need to run this script after every
29.
by mahaloz 4y ago
Ty for the shoutout <3