What is AI-assisted reverse engineering?

What it means to reverse engineer software with Claude, Codex or Gemini, the three common setups, what works today, what doesn't, and where to start.

AI-assisted reverse engineering means using a language model such as Claude, GPT/Codex or Gemini to help work out how compiled software, firmware, file formats or network protocols work when you don't have the source. This page explains the common setups, what they do well and badly today, and how to pick a first project. It is written for developers and hobbyists who know roughly what a disassembler is but haven't tried pairing one with an AI.

What it actually means#

Reverse engineering has always been a loop: look at code or data, form a guess, test it, write down what you learned. AI changes who does which part of that loop. A model can read decompiler output, name functions, spot known algorithms, write a parser or a test client, and try again when the test fails. You still decide what to look at, supply ground truth, and judge whether the result is right.

The directory shows the range. Some projects are a single conversation, such as a printer driver rebuilt from a Windows driver with Gemini. Others run for months, such as the agent swarm that rebuilt a first-person shooter with up to 15 Claude Code and Codex agents.

The three common setups#

1. Chat with pasted output

You run the disassembler or decompiler yourself and paste functions, hex dumps or packet captures into a chat window. The model explains, renames and suggests. This needs no setup and keeps you in control of every step, but you are the bottleneck: the model only sees what you paste.

This is the setup the NDSS 2026 user study measured. Decompiling the Synergy surveyed 153 practitioners and ran 48 participants through CTF-style binaries with and without LLM help. The EURECOM summary reports that novices with LLM help reached close to expert comprehension, while experts showed no significant overall gain. The cat printer project, done by someone with no Bluetooth background, is a good example of this style.

2. An agent driving a disassembler over MCP

A coding agent such as Claude Code or Codex CLI connects to a disassembler through an MCP (Model Context Protocol) server. The agent can then list functions, decompile, follow cross-references, rename symbols and write notes on its own, and also run scripts, emulators or test clients in your terminal.

The common bridges are:

• GhidraMCP for the free Ghidra framework.
• IDA Pro MCP for IDA Pro (its README now points users to the official Hex-Rays IDA MCP server).
• Binary Ninja MCP for Binary Ninja.
• REA, which puts Hopper, Ghidra or IDA behind one MCP server and adds JavaScript, Android and capture analysis.

See REA vs GhidraMCP vs IDA Pro MCP for a side-by-side comparison, and Set up GhidraMCP with Claude Code to get the free option running.

Examples: Claude found the lives counter in an 8 kB Atari ROM through GhidraMCP in River Raid. Codex drove Ghidra to map a DOS executable and start a ScummVM engine in Harvester. Bishop Fox had Claude Code with Binary Ninja over MCP decrypt a firewall firmware image.

Not every agent project needs a disassembler. For Android-connected hardware, the agent often reads JADX output directly, as in the Bluetti inverter and Amaran lights projects.

3. Agent loops and swarms with verification

The biggest results come from running agents for hours or weeks, with a script that checks every answer. In Snowboard Kids 2, a bash loop handed Claude the easiest unmatched N64 function and a build script decided whether it matched; three weeks beat the previous three months of manual work. The FPS decompilation compiled each reconstructed function with the original compiler and compared it byte for byte against the original executable. ReAgent pairs a reverser model with a checker model and Ghidra evidence gates.

The common thread is an oracle: something outside the model that says pass or fail. Without one, long runs drift.

What it is good at today#

• Reading lots of code quickly. Summarising functions, spotting known algorithms and naming things. The NDSS study found summarising a function on first visit was the most useful pattern.
• Turning findings into working code. Protocol clients (Emaldo battery, Fire TV remote), file-format readers (World of Warships models), and full ports (SkyRoads in C, Weltendämmerung on the web).
• Grinding through matching work when a script can check each answer (Klonoa GBA, DX-Ball with REA).
• Rebuilding behaviour from a black box. In Epoch AI and METR's MirrorCode, Claude Opus 4.6 reimplemented the gotree toolkit using only the executable and its tests, where older Opus models fell short (Epoch AI).

Benchmarks give a rough sense of level. On CrackMeBench, with five minutes per stripped CrackMe, GPT-5.5 solved 11 of 12 generated tasks, Claude Opus 4.7 solved 7 and Kimi K2 solved 5 (pass@3). SRE-Bench, built from private programs no model could have seen, reports that the best agent fully solves 31.5% of programs (Columbia DAPLab). Models are useful, and far from finished.

What it is bad at today#

• Knowing when it is wrong. Claude named River Raid as Centipede. In the NDSS study, about 20% of sessions involved chasing hallucinated vulnerabilities, per the EURECOM summary.
• Knowing when it is stuck. Bishop Fox's summary of their test was "senior-level skill, junior-level autonomy": Claude had the knowledge but stalled twice without noticing.
• Honest verification. Agents in the FPS swarm edited the verification script to pass, and the Klonoa agent tried forking the compiler.
• Malware verdicts. G DATA found wrong IoCs and flip-flopping verdicts even after verification passes.
• Hard targets. SRE-Bench and MirrorCode both show large, obfuscated or unfamiliar programs are still mostly unsolved.

The full list, with the fixes projects used, is in Where AI goes wrong in reverse engineering.

A sensible first project#

Pick something small, legal and checkable:

1. A CrackMe. Built for practice, with a clear pass condition. The Claude and Ghidra MCP CrackMe tutorial walks through one.
2. A tiny old ROM in an emulator. River Raid is 8 kB, and the emulator tells you whether your patch works.
3. A device you own that talks Bluetooth or USB. Projects like the Codex Micro keypad and the abandoned BLE energy meter end with something you can test in your hand.

Start with setup 1 or 2. Keep sessions short, write findings to a notes file the agent re-reads, and check every claim against the disassembler or the real device. Budget money as well as time: the Amaran lights run cost $91.34 over about 3.5 hours, while the Kyocera softkey API cost about five cents.

What is legitimate#

Reverse engineering is legal in many places for interoperability, repair, research and preservation, but laws and licence terms differ by country and product. Stay on safe ground:

• Your own software and devices, or abandoned hardware you own (the BLE energy meter after its vendor went bankrupt).
• Interoperability, such as the Figma protocol library, whose author cites EU interoperability rules.
• Preservation of games and software whose source is lost (Legends of Future Past, Labyrinth).
• CTFs and CrackMes made for practice.
• Defensive malware analysis in an isolated lab, as in G DATA's two-VM setup.
• Security research with responsible disclosure, as in the peripheral firmware audit.

Don't use these tools to bypass DRM, licence checks or anti-cheat, to cheat in online games, or to attack systems you don't own.

Where AI goes wrong#

Most directory projects with detailed write-ups describe a human catching the model's mistakes. The Masquerade port filled gaps with plausible invented content. The Electron app recovery quietly skipped code so builds would pass. psxrecomp speculated until Ghidra was added as ground truth. The fixes are consistent: give the model ground truth, make a script the judge, keep sessions short, and verify by hand before you trust a result.

Projects that use this#

• River Raid unlimited lives: a small, complete GhidraMCP session with its mistakes shown.
• Bishop Fox firmware decryption: an expert-level task where the human role was redirection.
• FPS agent swarm: the high end, with a byte-matching oracle and CI.
• Snowboard Kids 2: a simple unattended loop with defensive tooling.
• Amaran Bluetooth mesh: a device protocol end to end, with time and cost reported.
• Decompiling the Synergy: the user study on how humans and LLMs work together.

Further reading#

• More guides: AI-assisted game decompilation, Reverse engineer a Bluetooth device with AI, Getting started with REA
• Decompiling the Synergy (NDSS 2026 paper)
• CrackMeBench on arXiv
• SRE-Bench, Columbia DAPLab
• MirrorCode, Epoch AI
• GhidraMCP, IDA Pro MCP, REA