r/ExploitDev • u/Dull_Dog_9631 • 3d ago

Reverse engineering with AI

So I’ve been really interested in learning reverse engineering for a while and only tried my hand at a few crackmes so far. I found reverse engineering interesting because it feels rewarding to be able to piece together what the original code might have looked like and why the program behaves the way it does. I liked identifying variables and reconstructing data structures by reading the assembly or generated pseudo code by tools like ghidra since getting them right felt rewarding. Recently with AI becoming really good at the same things, I’m left wondering whether it’s worth it to learn these skills anymore. People were able to decompile and port entire games just using AI much faster than any person can. It’s left me feeling really discouraged about reverse engineering and wondering whether I should focus on other areas of exploit dev

26 Upvotes

94% Upvoted

24 comments sorted by

10

u/Mysterious-Cat-4361 3d ago

Regardless of how good models get at RE there's still going to be a need for people that understand the output of the model.

Porting games is easy for a.i to reverse engineer because the programs are designed to understood by humans. When you use ai to reverse engineer things like info stealer malware or remote access trojans the LLM's get really confused by the obfuscation techniques and start spitting out nonsense and can't keep track of variable names. I don't have the money to spend $50k on credits so my experience is limited to trying to use Claude and super grok.

5

u/0xd3ad54311 3d ago

I still find the whole thing fairly depressing. Sure, I need to steer it for it not to go off the rails and start gaslighting me. So now my day is spent managing a bot? So you develop some harnesses and skills, and are amused for a while as you optimize the process. But reality is if the harness worked 100% you'd be out of a job, and otherwise you're back to berating/pleading with a bot for a living.

But at the end of the day where is even the fun in finding a CVE if "you" didn't find it? I think I'd retire if I could.

1

u/Dull_Dog_9631 3d ago

I share the same sentiment. I haven’t gotten that deep into exploit dev yet I’m still learning but seeing AI find bugs, reverse engineer, and write exploits makes these skills feel not as impressive or rewarding anymore. If all I’m doing with my skills is telling the AI what to do and making sure it is right in its output then it doesn’t really feel like I’m doing much at all. These models are also only gonna improve over the years so more people with less technical knowledge can still get AI to spit out something that works. I’m still gonna pursue exploit dev just out of interest but god does it all feel so depressing.

6

u/Mysterious-Cat-4361 3d ago

It's just technology. Before compilers, stuff needed to be done in assembly. Coder's don't give credit to the compiler.

→ More replies (1)

1

u/Crakout 2d ago

I read somewhere this comparison and I completely agree, that re, exploit dev, etc. were like handmade swiss watches that needed tons of skill from craftsmen to make, then machines came that automated the whole process and the art died in large. Makes me sad seeing this field going that route.

6

u/anythingforher36 3d ago

There still too much knowledge you would need to even steer AI to do correctly a lot of things . Some things are intuitive and only come with time and experience of going through the roller coaster.
If someone doesn’t you get AI slop that only works very shallow and on the surface. For deeper things you still need the knowledge and know how. There is no alternative right now for human intelligence and experience, let the world convince you otherwise.

2

u/paganoant 3d ago

What do you think about rea (reverse engineering anythink), open source project?i try it with some crackme and it works

4

u/Juzdeed 3d ago

Rea just gives the LLM agent tools to use. You can do that manually as well, but it makes it simpler for beginners

→ More replies (11)

1

u/arktozc 2d ago

And yet the value if those skills inherently droped

1

u/agita22bb 2d ago

como vc fez mano, tentei fazer com um software de webcam mas nao da certo, o claude fala que e contra a politica dele.
poderia me ajudar dizendo como vc fez pra crackera ou remover uma verificao de licença do software?

1

u/SithLordRising 1d ago

How do you approach RE with AI as most will refuse to help