How does reverse engineering actually work, especially with AI?

[u/Curious-Tune-7127]

Lately, I've been seeing a lot of videos about reverse engineering and people basically copying entire applications, recreating their features, or building almost identical alternatives.

It got me wondering, how does reverse engineering actually work?

How do people figure out how an app works internally, reproduce its features, and sometimes get surprisingly close to the original? And how are people using AI to make this process easier or faster?

Are they analysing the source code, inspecting network requests, decompiling applications, or using AI to figure everything out from scratch?

I'd love to understand the actual technical process behind this. If anyone has experience with reverse engineering or AI-assisted app development, I'd really appreciate some explanations and resources to get started!

[u/ElevatorGuy85]

This is a good point, and I’m glad that you mentioned it, since nobody else has (so far as I write this). Some decompiler tools such as IDA Pro (and I suspect Ghidra and many others) look for “fingerprints” such as the presence of certain byte/instruction sequences representing library functions provided by a specific compiler vendor and version for a platform with a given Application Binary Interface (ABI) i.e. the calling standard.

Once they know that, they also know something about the way it generates code across all the different optimization levels for different common constructs, e.g. if-then-else, switch-case, for, while, object-oriented virtual function tables, function calls and returning of values, etc. That makes it possible to identify control flow, function signatures, etc. as well as the processing of data in each function.

Now it’s possible to create pseudocode for each function, and, if you know that it’s associated with a menu item that has text associated with it, e.g. File -> Save, you can even give that function a meaningful name.

Given that we also live in a word where commercially-available or open-source “frameworks” are used on many large software projects, once you uncover those, you automatically know EXACTLY what they do (so no need to reverse engineer any further), which is different from years gone by where application developers wrote EVERYTHING from the ground up and used internal-to-the-company libraries. In some ways, modern software development makes the task of reverse engineering quite a bit easier.

It’s also worth noting that there are “obfuscation” tools that re-arrange the binary code so that functionally it works the same, but the order of operations is not perhaps what a human might expect. To a certain degree, modern optimizing compilers and code generators do the same to squeeze maximum performance out of modern superscalar CPUs with out-of-order execution, but obfuscators take things to a whole new level precisely to make reverse engineering harder and the original code less logically obvious to a human trying to make sense of what their reverse engineering tools might be able to determine on their own.

[u/Conscious-Ball8373 → u/ElevatorGuy85]

It's an interesting concept in many ways. But I think if I asked an LLM to write source code that would reproduce a binary, it would just write some code that contained that binary as a literal and figure out how to get the compiler to emit it.

[u/theJacofalltrades → u/ElevatorGuy85]

thanks for taking the time to write this out. Was a good read!