It's also good as picking up patterns which are common enough, but may not be known to everyone. For example I couldn't tell that some function was doing CRC via a lookup table - but Claude knew.
One day I was using ghidra to decompile something to find out how it works, and the LLM helped a lot. It was a game changer in refactoring of the decompiled assembly-that-looked-like-c language.
Comments
I know you probably don’t want an LLM in your decompiler, but assigning meaningful names could be a good task for an LLM.
There’s some prior art on this [0] [1], and it’s worked decently well for me on obfuscated JS.
[0]: https://thejunkland.com/blog/using-llms-to-reverse-javascrip...
[1]: https://github.com/jehna/humanify/blob/main/README.md#exampl...
It's also good as picking up patterns which are common enough, but may not be known to everyone. For example I couldn't tell that some function was doing CRC via a lookup table - but Claude knew.
Often googling the first few entries of such tables will show CRC implementations. Same for SHA hash constants…
The tables depend on the CRC parameters and in my case there would be no Google hits - a unique setup was used.
That'd make sense if the jar is obfuscated. Java preserves method and class names by default.
One day I was using ghidra to decompile something to find out how it works, and the LLM helped a lot. It was a game changer in refactoring of the decompiled assembly-that-looked-like-c language.