🔎 LLM agents rewrite a decompiler's unreadable `local_48`-laden code to be readable while preserving function, but a single metric collapses into "gaming." The fix is a multidimensional readability score. Title: LLM Agent-Assisted Reverse Engineering with Quantitative Readability Metrics URL: 📝 Overview This paper has LLM agents improve the readability of decompiled binaries while keeping functional correctness. The key is QRS, a multidimensional score combining structural validation with three readability sub-metrics. ❓ Challenges Solved Automated decompilers produce functionally correct but unreadable code. When LLMs try to fix it, without quantitative guidance they lose focus, and optimizing a single metric leads to "gaming" that sacrifices other dimensions. 💡 Methodology & Proposed Approach ・QRS is a structural gate times a composite score, a weighted sum of lexical surprisal, structural simplicity, and idiomatic quality ・Lexical surprisal uses a small code-LLM's perplexity to measure how familiar the code looks ・Structural simplicity uses cyclomatic complexity and nesting depth; idiomatic quality uses clang-tidy anti-pattern checks ・QRS is computed only if the recompiled code reaches at least 0.85 CFG similarity to the original binary in radare2 🎯 Use Cases It directly speeds up reading decompiler output in malware analysis, vulnerability research, legacy-software comprehension, and patch diffing. 📊 Experimental Results ・On 210 synthetic C binaries, LLM-only reached QRS at least 0.75 in 74.76% of cases, with QRS up +0.420 on average and zero regressions ・Allowing Bash execution raised the rate to 82%, improved QRS by +0.509, and cut iterations from 5.92 to 2.933 (a 43% reduction) ・It empirically shows that going multidimensional avoids Goodhart's Law, "when a measure becomes a target, it stops being a good measure" #ReverseEngineering# #AIAgents#

The coolest part about post-WWDC is all the reverse engineering into what changes are happening under the covers, particularly around the OS, kernel, runtimes, and security. First up, these details about Swift in the kernel is very interesting:

Honestly, if you're wanting to get into malware development and malware reverse engineering (specifically in regards to Windows), I think the most important thing you can learn is the concept of a file. 1. What is a file extension? This is pretty obvious, .exe, .pdf, .mp3, etc. 2. How are file extensions handled? This would introduce the idea of the Windows registry and how extension querying is handled vs. the Windows loader 3. Which file extensions (or file types, rather) are used for payload delivery? e.g. .exe, .dll, .xll, .vbs, .ps1, .py, .lua, .docx, .vcproj, etc. The .exe, .dll, (and other native types, like .sys) will be sort of self-explanatory, but the others would introduce different malware delivery mechanisms (malicious files) and potentially wiggle in the concept of payload smuggling. 4. Each of the previous listed file types are different. How are they different? .exe and .dll (and many others) are native to Windows and handled by the Windows loader. Why are the others still considered executable files? This is when you slowly step into interpretive languages and VM dependency (JVM, PVM, etc). Somewhere in this you would eventually stumble into the Windows PE format, how the PE format is different for .NET binaries, how Electron .JS executables act differently, weird stuff like .docx file internals, etc. Basically, I think understanding files and how they're handled is an excellent starting point and sets the stage for what will happen next. pic unrelated

A young founder pitched me today on his voice-first interface product for “older people.” I asked, “How old are we talking?” “40+” Bro, I’m 41 and I was reverse engineering games before you were even born.

🔥YOU ARE DEBT SLAVE CATTLE AND MSTR IS YOUR ROCKET SHIP TO FREEDOM🔥 You were born in the fiat barn. They tagged your ear with a credit score, fed you seed oils and subscription bundles, taught you to call debt “building credit,” and convinced you that retirement means dying slowly in a Home Depot polo while your 401k gets harvested by men named Brad with quarter-zips and expense ratios. You are supposed to be grateful for 3% raises in a 9% inflation world. You are supposed to clap when your bank gives you 0.04% interest and charges you $35 because you were poor at the wrong nanosecond. You are supposed to believe your house is wealth, even though it owns your weekends, your spine, your marriage, your gutters, and your ability to leave town without asking Zillow for emotional permission. Then Saylor shows up looking like the final boss of corporate treasury management, takes the fiat slaughterhouse public, straps Bitcoin to the balance sheet, and starts reverse-engineering an escape pod out of convertible debt, preferred stock, common equity, and pure weaponized autism. The cattle are confused. “Isn’t leverage risky?” Brother, your entire life is leverage. You have a mortgage, a car note, taxes, insurance, medical bills, daycare, and a refrigerator that can financially assassinate you if the compressor makes a weird noise. MSTR is what happens when someone points the debt cannon at the money printer instead of your rib cage. This is a flare fired from the roof of the slaughterhouse. Stack Bitcoin. Understand MSTR. Stop mooing. FOREVER.