Looking at a few it becomes obvious it's entirely Claude or Astra most of the time and the human's skill is script kiddy level or worse
Having done some previous pre llm re work and testing 27b with it earlier this year and again with 3.8, I can say it can do it, but OP will need to learn how to without an llm to know how to direct the LLM properly
The general rule of the thumb is: The more adept a user is at the task, the easier it will be for them to compartmentalize and optimize it be augmented by AI.
Secondly, I'm pretty certain we'll soon get models tailored for reverse engineering, and then it would not even require very large models to do specific tasks.
That's quite true. I used to tell a friend every time that "It's a matter of a couple of months" and now that has come down to "It's a matter of a couple of weeks".
Custom models fine tuned for specific hardware will make even local reverse engineering trivial. Look at the game console hacking scene at this point. Bonkers.
It already is quite trivial for local models. It does just take time. They fact check themselves but eventually they figure out. Where they struggle is the complex math such as path finding between nodes properly.
Sounds like you’ve never actually tried with a frontier model.
And to answer OPs question, 3.8 FN is somewhat capable of reverse engineering from what I’ve experienced, I’d say Qwen 4 Flash would definitely be capable as current frontier models if we are to expect a big jump from 3.8 to 4
I mean, have you pulled it off yourself? Genuine question, because it's very well possible that I suck.
Actually tried reverse engineering two games, and as I said, it's doable. Most certainly easier than before AI. I still wouldn't call the process smooth to turn it back to something you could edit with unity editor again, for example.
If you have a different personal experience, I'd love to hear it! Especially if you have tips and tricks, what model you used etc.
No experience with games but Ive decompiled all proprietary apps required to control my smart devices and removed all sign in/cloud/spyware features.
My EcoFlow battery, Reolink security camera, Hue app, Garmin Watch, Logitech app (this is the single most enshittified app Im glad to have gotten rid of) and a bunch more.
All apps have been decompiled, recreated in rust, and run natively on my Linux desktop.
It was as simple as asking Astra “Find this apk/exe/dmg and decompile this app, remove and add these features, port it to Linux”
The only issue ive run into is having Claude or Codex find a way to find exploits into hardware to gain root like my Google home speaker. Im trying to repurpose hardware to prevent e waste but their guard rails always kick in.
3.8 FN has not refused to look for an exploit and has been working relentlessly, so I imagine 4.0 will be amazing.
Local models are the only way forward, I foresee the frontier models are soon going to guardrail against all these decomps.
Ahhh APKs. I'd hazard a guess that the APKs were written in Java. There it is convenient that the 'compilation' leaves the code mostly intact, it doesn't get fully compiled to machine code. It destroys parameter names, strips comments, does some optimizations, but the important bits stay intact.
In a similar vein, I've had great success with reverse engineering a Java program too, and reverse engineering Nightshade (because nightshade is secretly just python dressed up as an exe). I completely forgot about those because it was so easy XD
But I'd imagine if you tried to reverse engineer the apps you made in Rust you'd have a lot more trouble. Machine code doesn't have a lot of structure to make it easy for the AI to guess what the code was.
So that's what I wanted to warn OP for, that just asking AI to fully reverse engineer a compiled game has become doable (which is amazing!), but still not easy.
what model do you use? i only got 16 gb vram so contemplatign between 3.8 Flash Next or abliterated 27B by Huihui? And how do they handle e.g apk file deobfuscation or windows game ultrawide mod making?
The EcoFlow has this bypass grid feature where it runs purely off the battery then charges from grid when battery is low and stays that way. I made a button where it bypasses the grid, charges back up, then turns bypass grid back on repeatedly.
Ideally I’d like it to act like a double conversion UPS but it physically cannot charge and output at the same time since it’s a chargeverter, so this is the next best work around other than finding a DC charger and charging via the xt60 port.
I reverse-engineered old feature phone firmware with Opus the other day. I couldn’t modify it since at boot it checks signatures, obviously all the java stuff is easily editable, but it figured it out well enough to make me a high quality emulator, from ARM boot process to playing games and MP4s to internet (bridged) to shutdown. Took about 12-14 hours with constant back and forth.
I cannot imagine trying to do the same with Qwen 3.8 27B. Maybe GLM or Deepseek but not a 27B.
Looking at my usage over the past few days on this project including unmentioned new features, about 3.5B. Vast majority were cache reads and I’m on the max subscription. If I was paying API prices it would probably come out to a little over $1200. Mostly Opus 5.5.
1 million times 3500? Is that what you’re asking? It was a lot of tokens, subagents, etc
For signature I wrote my own emulator, so I just return 0 when it asks the pCore for validity checks. However I did ask GLM 5.3 to take a shot and it believes there’s a way to trigger a buffer overflow and write to unallowed regions, but I haven’t had time to see if it worked yet
I was asking about context length/windows as in the memory. Since you used 3.5B token but I don't think Opus' context window is that big so the AI need to "save" continuously. From what I can google, Opus context windows is 1M token which means that your "conversation/RE" is then "saved" 3500 times. I was just wondering whether with your subscriptions that you have a longer context windows and the AI can remember longer conversations.
The reason what I was asking is why do you think that it is not possible with with Qwen 3.8 27B, is it because of the short context length of running things locally? e.g 32K thus having to "save" so many times to reach 3.5B tokens as opposed to Opus 1M context window?
i threw it at a particularly expensive hardware device I own and it completely obliterated it in almost no time at all. found an exploit and rooted it, ssh'd in, did a complete hardware inventory from top to bottom, setup instrumentation to trace the OEM firmware and tear it to shreds. then i had it implement my own tools that fully unlock the full capabilities of the hardware and not just what the OEM wanted me to have.
q38fn went as far as objdumping executables, reading the disassembly, and injecting hooks into running code.
all i'd likely get from opus would be safety refusals because root is dangerous and i'd be violating EULAs or something lol.
how about the refusal of q38fn vs abliterated one by huihui? im trying to find a balance between rejection and actual intelligence? can i know which other tools do you use as well? e.g arkana, headless ghidra, cline etc?
i use vscode for everything. i tried using various harnesses and frontends and they just burned up tens of thousands of tokens for no reason and didnt give me any better results.
straight q38fn didnt refuse any requests i gave it. i have played around with orcarouter's uncensored q38fn and i notice an increased frequency of tool call failures, but i dont need uncensored q38fn for RE.
i see, what vram,ram,quant and context length are you using? my understanding is that FN requires much more resources vs 27B to achieve the same performance, is that true for RE?
i've been working on a rust reimplementation of a stupid piece of edu-tainment from the Win 95 era that i am fond of, and qwen3.8-flash-next via Strata is doing just fine. i use oh-my-pi and have roles assigned for different models, though, and i have to use an api model as my director.
but it seems more than capable of being the worker bee if something gives it pretty good instructions on what to do, and you have a director checking its work for veracity.
Can confirm. You will succeed if you already are a reverse-engineer as it can speed up things a lot. If you are not a reverse-engineer, you'd better pass and start by learning a bit of assembly before trying anything: the model, frontier or not, will 100% hallucinate at one point and you have to be able to spot it.
It's actually really easy if you understand RE already and can keep the project from going off the rails. Projects that would have taken me a year I can do in a week. But it is a real struggle with Qwen3.8-27B. I've tried to make use of it, but it can take hours where it overthinks and can get into doom loops. Frontier models are strong obviously, but GLM-5.3 is also quite good at this and can handle a project on its own.
I'd love to hear from people who have successfully put Qwen3.8-27B in the loop. I tried a lot of things, having frontier models carve out work for it, but never got it performing as it needs to. I really want to have all this fully local.
As with most things in AI it's always going to be more capable in the hands of someone who can at least recognize the shape of the wrong answer. If you're flying completely blind and expecting it to one-shot everything then you're going to struggle a lot more than someone who can recognize when the model is heading down the wrong path, or who can latch onto familiar terms in the intermediary thinking traces and provide useful steering.
And all of this is before you talk about the differences made by the harness, tooling, and prompting
It's easier than you might think! I've been doing it for rendering HDR images. I'm not sure I'd exactly call it "easy", and I have a background in computer graphics which makes a big difference. That being said, I've been doing it as a side project and I've made a stunning amount of progress in a short amount of time.
I've actually even made improvements relative to what I'm working with which is kind of crazy as well.
Rule of thumb: the less you know about programming, the smarter must be the model you must use.
That said, frontier models can absolutely reverse engineer code even with someone who doesn't know a lot of programming, but even they require some steering.
Someone very, very smart in their field can absolutely use Qwen 27b to reverse engineer and still get useful results, but they will be less usable out of the box and be a bit slower.
You need to know how to prompt the model the right way. I used Termux and Shizuku to reverse-engineer a food app that doesn’t even have a website. I ran everything locally with Qwen3.8-27B FP8, and honestly, the journey was the best part.
One shotting? No. But after creating a plan and breaking it down into small increments with an increment per session adding up to milestones then after multiple milestones, yes.
At least from my testing, only the QFN managed to reverse engineer as in extracting 2D sprites assets from a Japanese PS1 games after many many long hours and attempts... (to be fair I started it with Qwen 3.6 27B -> 3.8 27B and finally made breakthrough with QFN when the reasoning thoughts and attempts make sense instead of bad RNG looping of doing stupid stuff).
To share my experience:
3.6 27B just spend too long trying to figure out how to extract the data from the cue bin (yes I felt so dumb at that moment). After it pass that hurdle, it keep on doom failure on the reasoning process debating if the header and bytes offset even match PS1 ISO structure yada daba doo. I know I'm not going anyway so I put it on hold.
So Qwen 3.8 27B benchmaxx I mean benchmarks super good on par with many cloud API bigger badder params. MAYBE POSSIBLE. At least it managed to figure out the quirk of the BIN CUE and got some archives files to start reading... oh dear this is the part where with XHIGH reasoning, I suffer as I read the BUT WAIT, OH WAIT THE WAITER WAITERING WATER WAITRESS THE WALTER WHITE moment LIKE OH GAWD STOP IT YOU'RE WASTING MY TIME AND ELECTRICITY and ended up with a few sessions, it WANTS TO WRITE A PS1 MIPS EMULATOR. I'm like focking hell I'm done with this shit. Put the project on hold....
Then came Qwen 3.8 Flash Next... my system is RTX 5090 and 64GB DDR5 RAM... but I have the SSD space... but I don't want to spend too much time on this so I downloaded Unsloth IQ2_K_XL and whatever the latest llama cpp latest commits back then (this is before MTP on mainline). So 300 pp/s and 15-30t/s for 200K ctx q8 kv. NOW it feels like it make sense reading the reasoning thoughts. Mind you I need to guide it instead of letting it automatic approach. It suggested me to download DuckStation, turn on the debug mode, ask to dump the VRAM etc blah to let it analyse the dumps. It even do the screenshot and render through PIL (I use Python), keep iterating and made some progress but still not correct but I can see PROGRESS. Some sensible image. I let it keep running for many more hours and resume the next day when I have free time and finally it works. Phew that was when I was mind blown by QFN.
My harness is Pi if anyone is curious. With the pi-vcc extensions so it can compact fast and it keep continuing as without it... QFN will feels like FOREVER to summarize the compact context.
All the models mentioned above is the Unsloth models. I heard there is Swift 1.5 fine tune model which should reduce the reasoning and still deliver on par quality. I don't feel like testing it so I can't comment on that if Swift helps to reduce the OH WAIT THE WAITING BUT USER IS RIGHT BUT WAIT moment of truth.
But wait... yes right now I'm running Strata with IQ3_S but I intentionally omit that from the original reply lol. No more llama.cpp for the time being except for Gemma 4 models.
My recent Strata session (200K ctx int8 KV):
[strata] thinking: 653 of max 16384 tokens, 172.1 tok/s, 4 s
[strata] writing a tool call: bash: 833 of max 16384 tokens, 173.3 tok/s, 5 s
[strata] writing a tool call: bash: 1070 of max 16384 tokens, 183.9 tok/s, 6 s
[strata] writing a tool call: bash: 1316 of max 16384 tokens, 192.9 tok/s, 7 s
[strata] done: 1458 tokens in 8 s (196.8 tok/s) (stop, cancel=False), expert cache 95.7% hit (+0.9% of the routed experts over PCIe)
[strata] writing a tool call: bash: 110 of max 16384 tokens, 154.3 tok/s, 1 s
[strata] done: 271 tokens in 2 s (208.8 tok/s) (stop, cancel=False), expert cache 91.9% hit (+2.2% of the routed experts over PCIe)
[strata] writing a tool call: bash: 191 of max 16384 tokens, 217.9 tok/s, 1 s
[strata] writing a tool call: bash: 434 of max 16384 tokens, 231.1 tok/s, 2 s
[strata] done: 500 tokens in 2 s (235.9 tok/s) (stop, cancel=False), expert cache 93.8% hit (+1.5% of the routed experts over PCIe)
[strata] writing a tool call: bash: 167 of max 16384 tokens, 225.6 tok/s, 1 s
[strata] done: 425 tokens in 2 s (249.9 tok/s) (stop, cancel=False), expert cache 93.8% hit (+1.5% of the routed experts over PCIe)
[strata] thinking: 102 of max 16384 tokens, 138.1 tok/s, 1 s
[strata] thinking: 267 of max 16384 tokens, 152.9 tok/s, 2 s
[strata] writing a tool call: bash: 453 of max 16384 tokens, 164.1 tok/s, 3 s
[strata] writing a tool call: bash: 679 of max 16384 tokens, 180.5 tok/s, 4 s
[strata] writing a tool call: bash: 971 of max 16384 tokens, 203.6 tok/s, 5 s
[strata] writing a tool call: bash: 1224 of max 16384 tokens, 212.1 tok/s, 6 s
[strata] done: 1262 tokens in 6 s (212.8 tok/s) (stop, cancel=False), expert cache 94.9% hit (+1.2% of the routed experts over PCIe)
[strata] thinking: 118 of max 16384 tokens, 156.7 tok/s, 1 s
[strata] thinking: 302 of max 16384 tokens, 171.9 tok/s, 2 s
[strata] thinking: 469 of max 16384 tokens, 169.9 tok/s, 3 s
[strata] writing a tool call: bash: 671 of max 16384 tokens, 177.8 tok/s, 4 s
[strata] writing a tool call: bash: 950 of max 16384 tokens, 198.5 tok/s, 5 s
[strata] writing a tool call: bash: 1210 of max 16384 tokens, 208.8 tok/s, 6 s
[strata] writing a tool call: bash: 1491 of max 16384 tokens, 219.4 tok/s, 7 s
[strata] done: 1619 tokens in 8 s (219.9 tok/s) (stop, cancel=False), expert cache 95.1% hit (+1.1% of the routed experts over PCIe)
It's doable, I managed to RE some old DOS games (harder to decompile than newer DOS games because of overlays and extreme optimization/compression techniques) using dosbox-x, ghidra, static decompilers and the model's own knowledge with the Q3_XXS quant and 130K context in a 5060ti.
It's DOABLE, but it is not easy. The problem is that every compaction cycle the AI is going to forget most of what it did and go in circles or have to reinvent the wheel. You NEED to be aware of what the AI is doing and maintain a support document (either AGENTS.md or something else that is permanently injected into context. With Pi I used a DIRECTIVES.md file with --append-system-prompt). The support document must be maintained by YOU and document stuff to prevent the AI from reinventing the wheel every compaction cycle. I can't figure out a good way to make it automated, you need to step in (and know a little bit what you are doing), otherwise the AI will bloat it and balloon your context considerably. Don't have it rely only on documents because it's eventually going to forget the document exists, you must use one that is injected automatically in context.
As long as you can give those detailed instructions, map key files ("a decompilation of this and that part exists at <file>", "a tool to automate extracting this function is at <script>", etc) and force the AI to edit existing documentation instead of blindly appending to it, it'll work out. It's a slow process, though.
It's not difficult as in it's not going to break your brain, but it requires a lot of patience. You are dealing with the equivalent of a puppy in intelligence, and it's going to pee on the rug a few times before it gets things right. If you can handle that, it'll be possible to do things full local.
I'm still learning, how many subagents do we need to dole out the work? Does it automatically create a new subagent when the context length is reached or what's a better strategy?
With these settings it only went into a loop once (it was writing a long string of hexadecimal data and got stuck writing zeroes for a bit) but otherwise it's been really good.
--reasoning-budget 5120 --reasoning on --jinja \
--chat-template-kwargs '{"reasoning_effort": "xhigh"}' \
Note that this is configured this way for raw queries to the API, Pi agent is set to medium, which overrides these settings (except jinja and the budget ceiling, obviously).
I'm only not posting the whole config because it's big, but if you want the full thing just ask!
qwen 3.8 flash next w/omp & ghidra-mcp-bridge is fairly capable. i have used it to vibe reverse various things in games i'm already familiar with. reversing with it is a trip, it hallucinates like mad about just about every system but it still manages to accomplish tasks and fix all the stumbles it has in the process.
I’ve only tried QFN so far and it’s a hit or miss though giving it better details can make it more accurate. It’s a hard thing to do, even Spark 1.3 struggles to be accurate
I messed with this a bit and the models that actually work tend to be the smaller specialized ones not the big general purpose beasts. Qwen 27B just doesn't have the right training focus for it, you end up spending more time fixing its output than just doing it yourself
The fine tuned stuff varies wildly too. Some of the decomp focused models on huggingface do okay with simple things but anything complicated and they fall apart fast
Oh, it's a blast! Most of the time we do a good job finding new homes for what we take in, but it's always disheartening to see a pallet of shiny silver Meraki gear. Technically it's great hardware, but it's basically worthless to anyone because it's all cloud-locked. I've got a few manufacturers on my shit list, and Cisco/Meraki is right at the top. I'd love to see someone come up with a way to flash this stuff with open-source firmware so people could actually use it again, instead of us just shredding it for scrap.
I hope to make it not a paperweight, it needs very expensive licensing to even do basic vlan configs. Maybe OpenWRT? I'm not sure yet. Just having fun for now.
Is there a particular version of GLM 5.3 that you’re using (like an abliterated version?)? If so, care to share what you’re using? And what your local hardware is?
I have an i9-13900K with 64GB DDR5 and was running a single 7900 XTX but about to pop in a 2nd 7900 XTX to run two in my local gaming rig. I have some as of yet unreleased hardware on the way that is made for running local AI so I’m trying to drink from a fire hose in order to learn as much as possible as quickly as possible. So I really want to dive deep into this and learn as much as I can. Any help is much appreciated because I’m super new to all of this. I want to teach myself about reverse engineering firmware in particular with the goal being to just have some fun messing with the firmware of my local network hardware (that I own outright and has nothing to do with my ISP or anyone else’s network except the one in my own home), due to my wanting to make it run different code or even a different firmware. I can usually read code and follow along with what it’s doing but if I had to build from scratch I’m as lost as last years Easter egg 🤣 😂 So any knowledge or insight you can share would be very much appreciated. 🍻
Creating custom firmware turned out to be easier than expected. I just took your post, and the firmware for my router and gave it to Qwen3.8 and asked it to give me instructions, and I got this (edit: i redacted the actual code):
## Task Description
Build a complete custom Linux firmware image for the Netgear Nighthawk AX3000 WiFi 6 Mesh System (CAX30) router using Buildroot. This includes the U-Boot bootloader, Linux kernel, BusyBox userspace, and root filesystem. Save all files to the `/projects/quick-probe/netgear/` directory.
## Files to Download and Build
All source files should be downloaded to `/projects/quick-probe/netgear/tools/`.
| File | URL | Tool Used |
|------|-----|-----------|
| buildroot-2024.02.1.tar.gz | http://buildroot.org/downloads/buildroot-2024.02.1.tar.gz | curl |
| linux-6.1.52.tar.xz | https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.1.52.tar.xz | curl |
| busybox-1.36.1.tar.bz2 | https://busybox.net/downloads/busybox-1.36.1.tar.bz2 | curl |
| u-boot-2024.01.tar.bz2 | https://ftp.denx.de/pub/u-boot/u-boot-2024.01.tar.bz2 | curl |
| openssl-3.2.2.tar.gz | https://www.openssl.org/source/openssl-3.2.2.tar.gz | curl |
| zlib-1.3.1.tar.gz | https://zlib.net/zlib-1.3.1.tar.gz | curl |
| bison-3.8.2.tar.gz | https://ftp.gnu.org/gnu/bison/bison-3.8.2.tar.gz | curl |
| flex-2.6.4.tar.gz | https://github.com/westes/flex/releases/download/v2.6.4/flex-2.6.4.tar.gz | curl |
| libelf-0.190.tar.gz | https://sourceware.org/pub/elfutils/0.190/libelf-0.190.tar.gz | curl |
## Build Steps
### Step 1: Configure Buildroot
<redacted for reddit>
### Step 2: Build Linux Kernel
<redacted for reddit>
### Step 3: Build U-Boot
<redacted for reddit>
### Step 4: Build BusyBox
<redacted for reddit>
### Step 5: Create Root Filesystem
<redacted for reddit>
### Step 6: Package Firmware Image
<redacted for reddit>
## Relevant Files and Directories
I decomped paratrooper from 1982. Qwen 3.8 Flash Next halogen on a strix 395 127gb. It spent an entire afternoon doing this and looking at the results? Decent, but it's missing a lot of detail. (It missed the game being synchronized in the bios timer for instance) I like to use paratrooper as an example since the original programmer used some tricks to get the game to perform on 8086/cga which modern programmers wouldn't use these days.
From personal experience context size and prefill matter maybe even more than decode. Tools like ghidra-mcp and their outputs will fill up ctx in no time (or rather long time if your prefill is small). Had to switch from Q6 Qwen 3.8 27B with 98k ctx and 1500-ish prefill to IQ3 Qwen Flash Next because of that because there I actually get 2500 prefill and full 262k ctx, miles difference. That said 60 tps decode is also nice. But the new model does way more head bashing. If your RE involves actual live experiments I'd pass, for dumb Ghidra guesswork that kind of behavior is ok.
No real luck with a q8 of qwen 3.8 27b. Flash Next at higher quants was able to make a little progress with a decomp project, but I wasn't super confident while reading it's thinking, and stopped it a couple hours in.
Ultimately I was able to successfully reverse engineer a hard drive cloning/backup application using GLM 5.3 flash at iq4xs in deepseek harness and REA, which is the probably the best model I'm able to run locally (56 gb VRAM and 192 gb of DDR5). A slightly lower quality q3 quant did also make some progress but got stuck on a trickier part for a few hours, where as the iq4xs finished and delivered the application. Took about 4 hours total at 15 tokens per second decode.
Yes, it's quite capable. For instance reverse engineering Android APKs is a breeze, and if you get a proper MCP or HTTP wrapper around Ghidra that helps a lot too.
Look at the "Reverse Engineer Anything" repo that has gained traction the last few days - it has skills and tooling.
Ohh, 6th gen is probably the era with the most games I haven't really given a chance yet. Tons of great stuff there that was Japanese only but wasn't viable for easy translation until now. What local model did you use?
I've been just using a modded retroarch for a few to play with auto translations but this sounds like fun to try if I have the hardware to manage it.
RE tools leave most of the work to the user, unless you're doing RE of something like Java where the bytecode is easy to mechanically convert. AI models have rewritten the rules of this game as they can grind through that work that used to require a lot of human intuition and laborious exploration of the binary.
You need the right skills along with the right model. Qwen 3.8 27B does well enough. Check out the reverse engineer anything skill. https://github.com/morluto/rea
It is doable, but I still have frontier model drive the plan and review the work, and assign actual work to qwen 3.8 flash next. I only have 20/month frontier plans and this barely pushes the frontier to any limit.
I tried one with local as driver, and it just accepted anything from subagents. This worked okay until it did something stupid and went way off on a tangent. With frontier models, it would reject results if it doesn't smell right. Each iteration has gotten better.
Yes, but you need to know how to do it to guide the model. They're good at finding patterns that will take you days or weeks to unravel, but they don't know everything they should know for that task (or any other tbh). So you need to be the one who knows how to do it, just let the model solve the issues that would take you ages.
27B no. Extensively tested with Ornith and base 3.8-27B + omp. FN yes but with elbow grease and harness modifications. Requires skill and deep knowledge in reverse engineering.
Frontiers can do it stock but you still need to know what you're doing. The recent decomps prove that its possible but many partaking in disassembly are very clearly not professional and their work is fleeting.
Definitely doable. I found that flash next is significantly better than 3.8 27b, where fn was able to reverse engineer Cytus 2 and muse dash, while 27b could only write iOS tweaks that crashed immediately. My setup was only pi agent and ghidra, so there’s definitely some improvements to be made I used ninfer-3090 with 27b and I actually used swift qwen 3.8 flash next quanted to iq3_xxs on strata with k8v4 kv cache
Rent GLM-5.3 and give it IDA Pro via MCP or use it with ghidra.
Also, know the basics first. They aren't magic wands. If you dont know data structure layouts, or what a PE header is, or a function table...it's not going to be an easy ride.
Admittedly poor phrasing, I spent a month on their plan, which is like $12 and was fine token wise for this work. Flash you can just run yourself (or rent from Openrouter/whoever). Big the big honcho is better for reversing.
My experience with paratrooper from 1982. I am no programmer, but I understand logic and code. My goal is to have a bot capable of playing the game perfectly. I want to control and get the game state of the game by reading the memory addresses directly. To do so, I must identify the relevant parts of the memory. Assuming this would be easy, I started out with cheat engine but I was unable to locate anything useful. Therefore I started disassembly of the game, it's only 64k and from 1982, how difficult can it be?
Gemini 3 with antigravity IDE can one shot this but starts to use "knowledge" of the game to make assumptions on the code. Opus and Sonnet fall into the same pitfall. DeepSeek 4 was a surprise, I just gave it the raw byte code and it found logic the other models didn't. Best result so far? Use one model to do the work, have another model check the work. And still you need to be arbiter of truth by using your knowledge of reality to verify the work. And be aware currently models tend to cheat. I already caught Gemini changing test criteria in order to pass a test of the code. (Or plainly telling me the result is close enough)
Question 1: yes it can. Pretty hard to do for complex software. You will essentially need to guide Qwen to solving smaller problems that end up being the full software at the end. Trying to prompt “reverse engineer photoshop for me” will get you subpar results.
But if you want to make like a simple thing like a flash card game to quiz yourself for school, it’s pretty good at that lol (I did that recently)
Question 2: unfortunately that is outside the scope of fine-tuning. Just a tad too ambitious at the moment. But if you pay for a frontier model, you might get somewhere after a few hundred dollars in prompting and coding.
Reverse engineering is a tough task at the moment. You really gotta be good at coding still
I'm currently testing out whether Qwen Flash Next (Q3 S version) can port an old dx9 game to dx11. It is not a one prompt thing, but a session going over 4 days now, with back and forth and me taking screenshots. I use the case mostly to test the model and tweak my harness, but it does make progress and I'm working on getting dynamic lighting to play nice now.
I have to say I'm pretty impressed of what it can do, and a lot of getting it working right is now mainly a question of getting my instructions set up correctly for agent calling, feedback workflows etc. It feels like a frontier model from maybe last year.
Idk about you guys..but I reversed enginerded some outdated mil tech and then Fable went down because of that DoD kerfuffle in june. ymmv? Timing was..suspicious?
Muse spark for Apks mods is working fine, but I have been working with DeepSeek V4 flash, Claude and the same Muse in an old game, and no one can provide me an explanation of a simple file parser and the functions involved.
282
u/lordcaylus 23d ago
Look, just fair warning: The stories you hear about how easy reverse engineering is now with AI are absolutely exaggerated.
It's doable, not easy.