Defeating AI-Assisted Reverse Engineering, or at Least Tryin...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: http://blog.quarkslab.com/defeating-ai-assisted-reverse-engineering-or-at-least-trying-to.html
• Blog Title: Defeating AI-Assisted Reverse Engineering, or at Least Trying To
• Suggested Section: Reversing > Reversing Tools & Basic Methods > Defeating MBA and Control-Flow Obfuscation, with a cross-reference from AI Security > AI-Assisted Reverse Engineering

🎯 Content Summary

Overview and security model. The post evaluates whether autonomous LLM coding agents can recover protected strings from stripped AArch64 binaries and uses the results to design anti-tampering protections resistant to AI-assisted reverse engineering. This is not a CVE or a claim of cryptographic secrecy: a self-contained binary necessarily contains the code, key material, and runtime state required to reconstruct its secrets. Obfuscation therefore acts as a cost multiplier rat...

🔧 Technical Details

Route around obfuscation through partial lifting or execution. When control-flow flattening, opaque predicates, MBA expressions, and dispatcher noise make whole-function analysis expensive, locate encrypted data and the smallest routines that reference it. Extract only the constants and transformations needed to reconstruct the output, translate them into Python, and execute them independently. If lifting is unprofitable, run the protected routine with Unicorn, QEMU, a debugger, Frida, or the authentic device. The attacker does not need to remove the protection if protected code can be executed or its final transformation reproduced.

Detect invariant mixed boolean-arithmetic expressions. For an expression such as result[i] = (((A[i] | (~x & 0xFF)) & C[i]) + ((x | B[i]) & D[i])) ^ E[i], extract tables A through E from sections such as .rodata using tools including objdum...

🤖 Agent Actions

Updated the HackTricks repository:

• Expanded src/reversing/reversing-tools-basic-methods/README.md with:
  • Partial lifting around flattened control flow.
  • Constant/invariant MBA detection.
  • Python byte-domain verification example.
  • Environment-bound decoder analysis.
  • Independent validation of automated extractors.
  • Numbered Quarkslab reference and citations.
• Added an AI-assisted reverse-engineering cross-reference in src/AI/README.md.
• Verified Markdown diff, Python syntax, internal link target, citation uniqueness, and forbidden-source absence.
• mdbook build was unavailable because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: http://blog.quarkslab.com/defeating-ai-assisted-reverse-engineering-or-at-least-trying-to.html

Content Categories: Based on the analysis, this content was categorized under "Reversing > Reversing Tools & Basic Methods > Defeating MBA and Control-Flow Obfuscation, with a cross-reference from AI Security > AI-Assisted Reverse Engineering".

Repository Maintenance:

• MD Files Formatting: 1029 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0