AI-Assisted Reverse Engineering

A language model reading your code is a new kind of attacker, and the honest picture is neither the marketing fear nor the dismissive shrug. AI is genuinely excellent at some reverse engineering tasks and genuinely stuck on others. This lesson draws the line, because knowing where it sits changes what your obfuscation actually needs to do.

What AI recovers almost instantly

The thing a language model is best at in the world is recognizing patterns in text and restoring meaning that was stripped from it. That is a devastating match for the cheaper obfuscation layers. Give a model code with scrambled names and it will read the logic, infer what each variable is for, and rename everything back to something sensible in seconds.

// scrambled names, given to a model
function z9(a, b) {
  let q = 0
  let k = 0
  while (k < a.length) {
    q = q + a[k] * b
    k = k + 1
  }
  return q
}

// the model's reconstruction: meaning restored
function weightedSum(values, weight) {
  let total = 0
  let index = 0
  while (index < values.length) {
    total = total + values[index] * weight
    index = index + 1
  }
  return total
}

Nothing was decrypted. The model simply read behaviour and supplied the human meaning that renaming had removed, which is exactly the skill renaming was trying to deny. For name and comment stripping, an AI is close to a perfect counter, and this is the real reason renaming alone is a weak static defense.

Where AI stalls

The same strength becomes a weakness the moment the code stops looking like familiar code. A model reasons from patterns it has seen. Heavy transformation removes those patterns on purpose.

• Flattened control flow gives the model a dispatcher and a pile of disconnected fragments, with the readable shape it relies on deliberately destroyed.
• Virtualization is the hardest case: the model sees an interpreter and a blob of custom bytecode, and to make sense of the program it would have to reverse the whole custom machine first, from patterns it has never seen.
• Genuinely novel, per-build structure denies the model its entire advantage, because there is no familiar prior to match against when every output is different.

Think of a brilliant translator who knows every human language fluently. Hand them a page in any real language and it is effortless. Hand them a page in a private code you invented this morning, with its own symbols and rules, and their fluency gives them nothing, because there is nothing familiar to draw on. Heavy obfuscation aims to be that made-up language, freshly invented for each build.

So a purely static AI attacker sits exactly where a purely static human attacker sits, only faster. It shreds the cheap layers and stalls on the expensive ones, especially virtualization and per-build novelty. Against an AI asked to read a heavily obfuscated file cold, with no ability to run it, layered static protection is genuinely strong, because the model has no familiar handholds and no way to execute the code to find out what it does.

AI plus a sandbox is just fast run-and-dump

The picture changes the moment the AI is allowed to run the code. Pair a model with an instrumented sandbox and it stops being a static reader and becomes a dynamic attacker: it runs the target, captures the memory and traces, and uses its pattern skill to interpret the dumped runtime state instead of the file. That is powerful, and it is also not new. It is the run-and-dump attack from the previous lesson, with a fast, tireless analyst attached to the output.

This is the clarifying point, and it is oddly reassuring. AI does not raise the ceiling; it lowers the floor. It makes the cheap attacks nearly instant and the interpretation of dumps much faster, so weak protection falls even faster than before. But it hits the exact same run-and-dump wall as any attacker, and it faces the same per-build cost. An AI still has to run each unique build and interpret each fresh dump, and a model that cracked one build has learned little that transfers to the next when the next is structurally novel. The defense that answers a human dynamic attacker, per-build uniqueness and virtualization, answers the AI one for precisely the same reason.

AI is a near-perfect counter to name and comment stripping and a weak one against virtualization and per-build novelty, because it reasons from familiar patterns and heavy transformation removes them. Paired with a sandbox it becomes a fast run-and-dump attacker, not a new kind of threat, and it hits the same ceiling and the same per-build cost as everyone else. Design for that, not for the headline.

Frequently asked questions