There's no obscurity anymore. Best you can do is keep as much as possible server side. Curious if anyone has experimented with LLM's RE'ing obfuscated code. I suspect they handle it just fine.
> Curious if anyone has experimented with LLM's RE'ing obfuscated code.
Sort of, albeit I haven't checked with SotA obfuscation, I've seen GPT 6.1 Sol find a URL hidden under a xorpad + 2 layers of encryption, and I've seen Astra RE an AES whitebox.
More importantly, remember these game decomps (e.g. Pokémon)? Well, with minimal guidance and IDA MCP these new models are able to do this _and_ properly name all function/params/locals in a single day.
RE was arguably the first* task category to become completely solvable by LLMs on cybersecurity CTFs. This is exactly about obfuscated code, LLMs seem to have no problems with it now. The only probabilistic defense is to include tons of red herring so agent goes the wrong path and ends up in some tarpit like bruteforcing unrelated un-bruteforceable hashes.
* Cryptography category also went down fast but I think LLMs solved RE a bit faster. RE and crypto have in common that the task is completely local, but in classic RE tasks it is also usually ~obvious what you are supposed to do, you just need to do it - which agents do really well.
Such a click-baity name. Open challenge to anyone to use this framework and reverse engineer the internal APIs iPhone uses to talk to Siri or shortcuts or app Intents.
There's no obscurity anymore. Best you can do is keep as much as possible server side. Curious if anyone has experimented with LLM's RE'ing obfuscated code. I suspect they handle it just fine.
> Curious if anyone has experimented with LLM's RE'ing obfuscated code.
Sort of, albeit I haven't checked with SotA obfuscation, I've seen GPT 6.1 Sol find a URL hidden under a xorpad + 2 layers of encryption, and I've seen Astra RE an AES whitebox.
More importantly, remember these game decomps (e.g. Pokémon)? Well, with minimal guidance and IDA MCP these new models are able to do this _and_ properly name all function/params/locals in a single day.
RE was arguably the first* task category to become completely solvable by LLMs on cybersecurity CTFs. This is exactly about obfuscated code, LLMs seem to have no problems with it now. The only probabilistic defense is to include tons of red herring so agent goes the wrong path and ends up in some tarpit like bruteforcing unrelated un-bruteforceable hashes.
* Cryptography category also went down fast but I think LLMs solved RE a bit faster. RE and crypto have in common that the task is completely local, but in classic RE tasks it is also usually ~obvious what you are supposed to do, you just need to do it - which agents do really well.
Such a click-baity name. Open challenge to anyone to use this framework and reverse engineer the internal APIs iPhone uses to talk to Siri or shortcuts or app Intents.
just curious, why is that hard to do?
focus and expertise. apple lacks both when it comes to AI. maybe it is strategic, maybe it is stupid hubris - we will soon figure out.
in any case, they're bound to get disrupted
Meanwhile they haven’t had iOS jailbroken since iOS 17 four years ago
Eyy! Nice idea. I need to try to see how things work.
I dont know why Apple doesnt improve Siri. They have every resources on earth.
Steve had the vision …
It might reverse engineer them but that’s different from letting you use them
this is going to lead to a trend of all software running on vendor computers instead of users its the only viable way
How would that protect anything? "Hey claude, clone that shit"
And now, we have to use a web browser for all of our professional software. fun times.