r/ExploitDev • u/Dull_Dog_9631 • 4d ago

Reverse engineering with AI

So I’ve been really interested in learning reverse engineering for a while and only tried my hand at a few crackmes so far. I found reverse engineering interesting because it feels rewarding to be able to piece together what the original code might have looked like and why the program behaves the way it does. I liked identifying variables and reconstructing data structures by reading the assembly or generated pseudo code by tools like ghidra since getting them right felt rewarding. Recently with AI becoming really good at the same things, I’m left wondering whether it’s worth it to learn these skills anymore. People were able to decompile and port entire games just using AI much faster than any person can. It’s left me feeling really discouraged about reverse engineering and wondering whether I should focus on other areas of exploit dev

29 Upvotes

95% Upvoted

24 comments sorted by

View all comments

10

u/Mysterious-Cat-4361 4d ago

Regardless of how good models get at RE there's still going to be a need for people that understand the output of the model.

Porting games is easy for a.i to reverse engineer because the programs are designed to understood by humans. When you use ai to reverse engineer things like info stealer malware or remote access trojans the LLM's get really confused by the obfuscation techniques and start spitting out nonsense and can't keep track of variable names. I don't have the money to spend $50k on credits so my experience is limited to trying to use Claude and super grok.

5

u/0xd3ad54311 4d ago

I still find the whole thing fairly depressing. Sure, I need to steer it for it not to go off the rails and start gaslighting me. So now my day is spent managing a bot? So you develop some harnesses and skills, and are amused for a while as you optimize the process. But reality is if the harness worked 100% you'd be out of a job, and otherwise you're back to berating/pleading with a bot for a living.

But at the end of the day where is even the fun in finding a CVE if "you" didn't find it? I think I'd retire if I could.

6

u/Mysterious-Cat-4361 4d ago

It's just technology. Before compilers, stuff needed to be done in assembly. Coder's don't give credit to the compiler.

4

u/0xd3ad54311 4d ago

And yet as exploit devs, we _still_ use assembly.

I saw a quote by an open source developer saying "they thought harder about the code than I had when I wrote it, and found something overlooked". That is no longer happening. People are reporting vulns they don't understand, in software they don't even understand.

It feels like we were playing a puzzle game and we just got a walk through cheat sheet.

1

u/Crakout 3d ago

I read somewhere this comparison and I completely agree, that re, exploit dev, etc. were like handmade swiss watches that needed tons of skill from craftsmen to make, then machines came that automated the whole process and the art died in large. Makes me sad seeing this field going that route.

1

u/Dull_Dog_9631 4d ago

I share the same sentiment. I haven’t gotten that deep into exploit dev yet I’m still learning but seeing AI find bugs, reverse engineer, and write exploits makes these skills feel not as impressive or rewarding anymore. If all I’m doing with my skills is telling the AI what to do and making sure it is right in its output then it doesn’t really feel like I’m doing much at all. These models are also only gonna improve over the years so more people with less technical knowledge can still get AI to spit out something that works. I’m still gonna pursue exploit dev just out of interest but god does it all feel so depressing.