Reverse engineering with coding agents: set it up overnight, wake up to source

moyix · x · 2026-09-27

A detailed workflow for delegating reverse engineering entirely to coding agents: spin up a fresh VM, tell the agent to clone, build and set up GhidraSQL (SQL-driven control of Ghidra's auto-analysis), fetch any adjacent tools, and point it at the target binary. By the next day the target is reversed back to source, or the original question answered — interop code, a bluetooth driver, a protocol, or finding backdoors.

Model strategy: start with the most permissive model (Opus 5.5), downgrade to Opus 5, then GPT family, then Grok, with DeepSeek Pro/Flash as the cheapest last resort. The author reports very satisfying success rates and never touches the UI. The quoted ghidrasql 0.0.7 release lets you control Ghidra analyzers via SQL (UPDATE programoptions, INSERT INTO analysispasses, DELETE to cancel).

Original post →

More from coding & agent

coding & agent channel →