RE was arguably the first* task category to become completely solvable by LLMs on cybersecurity CTFs. This is exactly about obfuscated code, LLMs seem to have no problems with it now. The only probabilistic defense is to include tons of red herring so agent goes the wrong path and ends up in some tarpit like bruteforcing unrelated un-bruteforceable hashes.
* Cryptography category also went down fast but I think LLMs solved RE a bit faster. RE and crypto have in common that the task is completely local, but in classic RE tasks it is also usually ~obvious what you are supposed to do, you just need to do it - which agents do really well.
Obscurity is kept by banning decompilation in EULAs. Can’t block black box reimplementation though (At least in EU), and that’s often good enough.
Obfuscation is no obstacle at all in my experience.
Are decompilation bans found to be widely enforceable or legal in most jurisdictions?
Genuine question; I do not know much about this area.
> Curious if anyone has experimented with LLM's RE'ing obfuscated code.
Sort of, albeit I haven't checked with SotA obfuscation, I've seen GPT 6.1 Sol find a URL hidden under a xorpad + 2 layers of encryption, and I've seen Astra RE an AES whitebox.
More importantly, remember these game decomps (e.g. Pokémon)? Well, with minimal guidance and IDA MCP these new models are able to do this _and_ properly name all function/params/locals in a single day.
today i read that for new game studios, the possibility of going stream only (like amazon luna) instead of downloadable is a probable future if they want to prevent piracy.
isn't this what google stadia was supposed to do and failed?