Reverse engineering with coding agents: set it up overnight, wake up to source
moyix · x · 2026-09-27
A detailed workflow for delegating reverse engineering entirely to coding agents: spin up a fresh VM, tell the agent to clone, build and set up GhidraSQL (SQL-driven control of Ghidra's auto-analysis), fetch any adjacent tools, and point it at the target binary. By the next day the target is reversed back to source, or the original question answered — interop code, a bluetooth driver, a protocol, or finding backdoors.
Model strategy: start with the most permissive model (Opus 5.5), downgrade to Opus 5, then GPT family, then Grok, with DeepSeek Pro/Flash as the cheapest last resort. The author reports very satisfying success rates and never touches the UI. The quoted ghidrasql 0.0.7 release lets you control Ghidra analyzers via SQL (UPDATE programoptions, INSERT INTO analysispasses, DELETE to cancel).
More from coding & agent
- Sentry CEO breaks down his agent transcript UI: Slack icons, typed annotation cards, event-triggered turns — zeeg · 2026-09-27
- Sentry CEO shares agent transcript UI design: PR cards and external events as conversation turns — zeeg · 2026-09-27
- 100-Paper Review: Most Prompt-Injection Defenses Fail Against Adaptive Attacks — Ok-Lab-7347 · 2026-09-27
- Procedural Three.js Running Horse in One HTML File, via 67 Minutes of AI Thinking — Ok_Bag_7550 · 2026-09-27
- Motion design in pure code: Opus writes Canvas renderer and a Node synth soundtrack — mishig25 · 2026-09-27
- Antigravity Rewind: Open-Source One-Click Surgical Undo for Google Antigravity — Imbourass · 2026-09-27