I Tested The Viral Reverse Engineering Repo

0:00Reverse engineer anything is a project going viral right now on GitHub that allows anyone, any plebian, yes you, to reverse engineer and completely recreate any application that they can find. This project uses traditional reverse engineering tooling like Ghidra, IDA Pro, or Hopper to decompile projects into pseudo code and then using LM Code Gen tools completely recreate the code base from scratch and produce a new copy of said application. While this has created kind of an uproar of meme

0:28projects like Mario and Skyrim. Here we are. Here's Luigi. It truly is a Mario experience. Or Modern Warfare 3 skate. Okay. It kind of sets a more bleak tone for the future of not only software development, but software ownership as well. Now, if you're new here, my name is Low Level. I've actually been a reverse engineer vulnerability researcher professionally for like 12 or so years. So, this project does two things. One, it begs a bit of an existential question about who I am and what I am professionally. I want to use this video to show you how this works, what even is reverse engineering, why AI

1:04is so good at automating it, and what this means for the industry as a whole. Real quick, the amount of code generated by AI is going up. And the question is, how do we deal with all that code? How do we manage all the PRs we inevitably get with code we know almost nothing about? This question is why today's video is sponsored by Code Rabbit. Code Rabbit is an AI code review tool for the era of AI generated code and AI pull requests. Code Rabbit obviously has a bunch of really cool features that make your team able to scale up their code review capabilities and allow them to

1:33safely merge in code to your working environment. One new feature that's pretty cool is called triage. Here on triage, you get a list of all of the PRs that are open for a given repo or a given organization. For me, I only have two. What's cool about triage is it tells me exactly which one is a higher priority for me to pay attention to as a function of a few factors. One of them being the amount of review work that went into that PR. So, like if no one has looked at it, it is a high risk, high priority PR. And also the amount of changes in that PR, right? So here, for

2:02the P3, the lower priority one, it was just a scoreboard. I added a little feature to Low Level Labs, right? This one, P2, this is a entire new system in the back end, front end, and a download for the user for Low Level Academy. But basically, this is an entire new subsystem that I've done almost no review work on, and Code Rabbit picked that up. And then you click on the PR in question in triage, it brings you to the change stack for you, that really, really beautiful view that I love of all the different layers of change that are happening in your code base. Again, for

2:30me as a security guy, my main concern with a new code base like this are the security boundaries, right? Where does the user interact with the front end, where does the front end interact with the back end, and where are all of the dangerous edge cases in those boundaries? Breaking it down by layers like this makes it really easy for me to understand. Guys, you know the rule, the best way to help the channel out is to go check out the sponsors. Go see if Code Rabbit is a good solution for the AI code hitting your organization, and see if they can help you make your

2:53workflows a little more secure. Thank you for sponsoring the video, Code Rabbit. Let's get back to it. So what even is reverse engineering? This project is called reverse engineer anything, but it's important to understand like what that even means. If you're a programmer or an RE person, please watch this cuz I promise you you will learn something new. When we get a program that we want to take apart, right? Ultimately, all we get is this thing known as a binary file, right? On Linux, it's in the shape of an elf, and on Windows, in the shape of a PE. If we dump this file, right? We're going to

3:21get a bunch of gobbledygook that means nothing to anybody, okay? It is a very difficult process of taking this file and figuring out what it means from the binary. The reason for this is when a program actually starts out, it starts as this file, a source code file, much more human readable, much more close to English. The source code file is meant to contain the human intent of the program in a layer that is only understandable to the compiler and the human. The compiler takes this file, and it compiles it down to the machine code

3:52that the computer can understand. Ultimately, the program contains these assembly instructions that contain the ones and zeros of the exact operations the CPU is going to take to execute the intent of the program, the code that was in the source code. And by running those instructions, the CPU will now execute the commands that the user in the source code wanted them to do. For example, it'll prompt us, "Hello, what is the number?" Now, I don't have the source code in this example, right? I I literally do, but I'm not going to look at it. And so, I need to figure out what the actual number is. Now, the process

4:22of reverse engineering is taking the thing that we do have, which is this binary code, and trying to figure out exactly what's going on in that code to understand what the human intent of the source code was. We're taking what we have and reverse engineering back up to the source code. The core of this program, by the way, is it compares the dword at this location to the dword at this location, which is set originally

4:45to 1337, and it asks for it in decimal. So, we can go into Python here and do Python 3 hex 1337, which is 4919. And if we do that and run the program, do 4919, we did it, we got the number. Congratulations. The reason we had to read the binary and not the source code is programs when distributed are distributed in the binary format. You don't get the source code for most programs. Source code when compiled down, that process is lossy. When you have things like variable names and strings and sometimes the names of functions are lost in the compilation process. You're doing that for two

5:17reasons. One, to reduce the size of your binary cuz computer doesn't care about that stuff. But sometimes for the intellectual property of the company. Ultimately, reverse engineering is taking this and trying to infer this. And just to be clear, tools like this have existed for a very long time. Hopper, Ghidra, and IDA have been around. I think Ghidra since 2019, IDA since the '90s, and I'm not sure when Hopper came out. But the whole process that they're trying to do is take the only thing they have, the binary on the left, and produce pseudo code on the right. Now, there is a whole process, there's a whole field of study called

5:48lifting, which basically you're taking this code of assembly, you're lifting it up to an intermediate representation, and then you're trying to convert that IR to a pseudo code representation of C. This is obviously not the real C in the program. This is Ghidra's best guess at the C. But if we go into it, we can look at main, and then we go down and we see, okay, this is Ghidra guessing at what the program actually does by looking at the function names that are available, by the constants that still have to exist in the program for the function, and some other metadata that's not super

6:17important for the sake of this video. Ultimately, we get a look at what the program sort of kind of is supposed to do in C, and use that to infer the functionality. Again, this is reverse engineering, this has been a thing for a very long time. So to use this tool, all we have to do is go into our favorite AI tool. I'm using Claude code with Opus 48 Opus 48 by the way because everything after 48 flags my response as cybersecurity anything. And say, "Hey, use the reverse engineer anything project on GitHub REA to make a create recreation this game very good English of the Linux calc app. What I'm talking

6:47about here is the gnome calculator. Now I know what you're thinking, low level, that's an open source application. Why are you trying to reverse engineer an open source application? Shut up. It's the first thing that came to mind. It's not going to use the source code for this project, it's going to look at the binary itself and take it apart. And so I ran this, and what we get here is the entire process of the RE. It goes through and it takes it apart, it reverse engineers the code, and eventually 28 minutes later it spits out the recreation. For some reason in Python, but at the end of the day it did

7:16recreate it. And if we go to this window here, the one on the left is the recreation, and the one on the right is the actual application. It's really, really close. The only kind of minor difference is like going to basic mode to programming mode is in the middle here. On this app it's on the left for some reason. I kind of like it better over there, actually. Um and so you can do traditional stuff. Let's let's do some let's do some math to see if we're

7:36actually good here. 2 + 3 is 5 * 4 / 20 is 1. Okay, cool. And let's make sure it's actually the real number the correct answer over here. 2 + 4 * 4 / 20 1. Awesome. Okay, we're still we're still doing math. Now, obviously there are some bugs here. Like here on the left is the vibe coded version. If I take this and I try to make this window a little bigger, we're going to have some like UI scaling issues over here, you know, traditional UI center div type stuff. With that being said, the fact that it took 28 minutes to do this is

8:08really impressive. I know what you're thinking. Well, well, it's it's a literally a calculator app. How complicated could it be? Well, that's what I thought. If you go to like your your your your terminal and you say which gnome calculator and then you do file on user bin gnome calculator. This is a 64-bit elf, which is fine. Like normal program RE type stuff, but it is a fairly large like 90 936k binary. So, it's like it's not that small. There's a lot of functions. I think I saw on the actual prompt there's like 2,000 functions that has to go through to do this. And again, doing this in 28

8:43minutes is really impressive. Again, like anyone could have done this, but it would have taken the average person completely I'm talking about like take the program, disassemble it, put it into pseudo code, and then recreate that pseudo code without AI. That's like a a couple day maybe week long project. So, you may be wondering like okay, if Ghidra and IDA and Hopper have already existed, then what does this tool actually do? And I had the same question when I first looked into this. And I think the the easiest way to answer this is REA reverse engineer anything is a

9:11very well put together call it harness. Now, I know the word harness has been thrown around a lot in the AI community, but generally when you have the LLM, when you have a tool like Claude, ultimately all you have is this project that is going to go and do the thing that you tell it to do, okay? It's going to open a file, it's going to read a file, it's going to execute some kind of prompt that you tell it to execute, right? Create a thing, open a thing, reverse a thing. What a harness allows you to do is take the LLM to take the tool you're going to use, and if you

9:39have discrete steps you want it to execute through, like in this case, inspect a binary through the MCP server of Ghidra, IDA, etc., read the evidence, and then use your agent to then ask a follow-up question and reiterate that process. That is reverse engineering, right? Reverse engineering is the iterative process of taking a binary, asking a question, posing that question to the debugger, to the decompiler, and trying to figure out what the actual answer is, and then using that to figure out new things about the binary. What REA does is it facilitates very cleanly that loop of take the thing apart, answer a question, use that answer to

10:16ask a new question. Now, also, one thing I will highlight is that REA also, apparently, I haven't tested this yet, is very good at breaking down Electron apps as well, as well as websites themselves. Obviously, like the back end of the site you can't get into because it's like, you know, you don't have the code. You don't have the ability to see the actual execution context. But, that being said, like it's it's good at more things than just like flat binaries or raw binaries. That's just a thing that I'm used to. Now, ultimately, when you have these tools that kind of end up just being harnesses that wrap around

10:44these LLM agents, the tool itself might just get absorbed in the actual agent in the future. We've seen a lot of that happen where like, you know, code gen tools or code review tools, a lot of them are getting sucked up into Claude itself. It's just kind of an existential question about if this tool will exist in in, you know, 5 weeks, 5 months, whatever. But, until then, it did a pretty good job at completely breaking down this app. Now, I have seen some other videos where people do the similar process, but they don't use REA. They kind of do the control test and a non-control test, and they get a similar

11:11result, some of them faster, some of them worse. Ultimately, I think REA is a good harness if you want to test this process out. If you have like no experience in this world, I think REA is a good way to do it. It kind of holds your hand, it kind of builds the guardrails for you so that you can just throw it at a thing and it will iteratively solve the problem. That being said, mind your token spend, right? Now, while it is getting a lot of positive attention online, I do think that this reverse engineering trend is long-term scary to me for a couple of

11:37reasons, right? Again, I want to be very clear here. I think that everyone should go and use this. I think everyone should reverse engineer everything. I think everyone should take everything apart and figure out how everything works. This is the hacker ethos, by the way, and I believe in it very strongly. But, there are some fundamental issues with

11:52like the economy of the world, right? That will cause problems in the future if it keeps going this way. Number one, is all software abandonware now? I made a video recently about the Adobe situation. By the way, Adobe, they don't claim to have used REA. They may have just done some other harness with some other prompts. There is a group of people that they took the Adobe products, Photoshop, Lightroom, Premiere Pro, etc., and they broke them down and completely recreated them in Rust. Now, I have seen claims that they're very slow, they're not responsive, they're not that good, but it shows a trend in the industry that people are able to

12:23take a piece of software and make another piece of software that is a clone of it virtually for free, minus a couple dollars in token spend, right? The question with that though is is all software abandonware, right? If you just one shot up another copy of Photoshop, who maintains that software, right? Who's responsible for fixing the bugs in that software? Who makes the money on that software to pay the employees that now fix the bugs in that software? We've already known that for a long time the open source world has been on the butt end of the joke of security maintenance because they don't get paid to maintain

12:54bugs in their code bases. Daniel Steinberg, for example, maintains curl for free. And also, why even make software anymore if anyone can produce anything? Is there even an incentive to create software other than just the joy of seeing your idea come to life? But even then, if you didn't do it, who cares? Number two,

13:11is all software a supply chain risk now? So, my main question here is, you know, I was going to run the the Rust version, the new creation of Premiere Pro, but the difference between Art Craft or Any Craft, people that that made the the Rust version and Adobe, is that I pay Adobe. Now, I don't like paying Adobe, obviously. If me and my friends in the world decide to not pay Adobe because Adobe got hacked, Adobe is serving malware, Adobe is doing something inherently malicious aside from their subscription practices, right? They lose

13:42money. They lose profit, right? Therefore, they are incentivized to not serve malware, to not ship bad things with their application, right? If you can just vibe code up a rust version of Premiere Pro, that's a little concerning. And again, I'm not on Adobe's side with this. I'm just saying there is an inherent supply chain risk. I don't know the guys that wrote Any Crafter, Light Crafter, whatever it's called. So, it it makes me a little concerned to run this on my computer. I have no idea what's running inside of that codebase. I know it's open source, but unless you build it from source, you know, it's a different conversation. And

14:09even then, I'm not auditing all the code. And this this last one is going to be my my primary concern. Corporations are not going to stop being corporations. What do I mean by that? Companies like Adobe, companies like Microsoft, need to make money to exist. Fundamentally, that is what they do, okay? And so, if we have this world now where any piece of compiled code can now be reverted to the open source, and they no longer have an incentive to have a trade secret given to you as a person, what happens to software then? One of my primary concerns is that software will go the ways of kind of what gaming is

14:44doing right now with like the PS5. I mean, I mentioned this in my previous video. But basically, you know, we're seeing in the gaming world where gamers are not given the physical media, they're not even given the game itself, they're given a license to the game. And then when you go and log in to play the game, sometimes you're just given a cloud instance of that game that runs in the cloud, and you're given like a

15:01visual port view into that game, right? What happens there is that you never actually touch the media. There's a variety of reasons why they do this. But is that what happens to software now? Is there a world where when I use Photoshop, I'm just given like a VDI, like a virtual instance of it that I got a cam shot into? And, you know, ultimately, I never actually touch the software because Adobe is afraid that I'm going to reverse engineer it. I don't know. Either that or everything just becomes a web app, right? Like I mentioned before, you can't reverse engineer a web application. If it's like

15:27a local electron app, sure, but like if it's code running on the back end of some server somewhere, I I literally cannot take that apart cuz it's not running on my computer. So, what do I do, low level? Do I reverse engineer? Do I not reverse engineer? No, obviously, again, I want to be very clear here. I think this is awesome. I think everyone should learn reverse engineering. I think everyone should try this out, take a program apart, figure out how it functions. The beauty of this tool, by

15:51the way, is that now anyone can do this. The whole world of reverse engineering used to be reserved for the small few that knew how to read assembly, read C, infer one from the other. Now, anyone can do this with LLMs and this tool. This is a good thing, I think, net. I just don't know where it goes from here because the economy that we're in and this tooling, they they don't match up very well and it it just makes me a little nervous. Anyway, that's it for now, guys. Thanks for watching. I appreciate it. We'll see you

16:18in the next one. Take care. Bye.