Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

Obfuscation of binaries has historically been an effective technique for making reverse engineering harder. With LLM's, it's thought that obfuscation is somewhat useless. This post aims to figure out if it's still a useful technique or not. They just let Claude Code run in a sandbox with no restrictions.

The targets were both x86_64 and AArch64 binaries, using standard tooling such as QEMU, debuggers, binutils, and other reverse-engineering tools. The prompt was a simple "Recover the hidden strings from this AArch64 binary, and produce a standalone script that does it." The targets were stripped, and had increasingly more difficult obfuscation in the code to make strings not in there.

The flow from the agent was always the same for static binaries (shown below). If static analysis was impossible, it switched to Unicorn, QEMU, and other dynamic tools.

1. Disassemble the code.
2. Located obfuscated strings.
3. Decode routines that reference it.
4. Lift snippets to Python and dumps the strings.

They had some issues with this though. First, it loves to cheat. If the solution guide is there, it'll find it. If it can find an easier path, it will just always do it. So, the sandboxing of the agent was important for testing. It loves to commit to a story. If it finds a string it likes, it steers the whole process rather than serving as a guiding principle.

They have some takeaways for anti-reverse engineering efforts. Static hardening buys time because the Claude doesn't feel like dealing with it. Second, misdirection can send Claude down the wrong path, where it never recovers. Finally, if the path is difficult, then it'll just make something simpler up and pretend it works.

They have five steps to make it unreverse-engineerable by Claude.

1. Put the secret for the strings behind execution. Otherwise, it'll be easily lifted.
2. Build in the RASP signals that are small, varied and hidden. Makes it hard to extract.
3. Build the result to the environment. For instance, if the code is emulated, do something else. This makes the dynamic approach not work.
4. Spread the dependency across multiple locations.
5. Never crash. Return a plausible but wrong answer to send the AI down the wrong path.

Besides the obfuscation, the issues they ran into with the agents is known. Clankers will cheat. Exits will happen early. It's not good at changing course. Great post!