REA Reverse – Engineer Anything
rea.tools
rea.tools
I know the retro game modding/decomp scene is already getting hit with a flood of low-effort ports.[3] Now they're going to be hit with a flood of half-decent decomps effortlessly generated by anyone with a $200/mo AI subscription, which become half-decent PC ports, which get modding support grafted on. It kinda just... totally eliminates that as a hobby entirely. I know people are going to be upset about this. And it's not even like with the AI art, where the pro and anti-AI camps live in their own camps. Solving the same puzzle twice just feels discouraging. Very similar to the problem academics are having with AI math/physics proofs.
I know a large reason people hate AI is because it's largely seen as tearing apart hobbyist/professional communities, eliminating reasons to collaborate with others and form relationships, and replacing it with an individualized dependence on a commercial product. It follows the same trend the tech industry took social media, from a method of connection to a tool of propaganda and paranoia and "@gork is this true?" This project, I think, is one of the most clear examples of that.
[1] https://github.com/N0zoM1z0/th04 [2] https://github.com/GensokyoClub/th06 [3] https://www.pcgamer.com/gaming-industry/pc-ports-of-old-cons...
It really depends on your perspective of what the point of the hobby is. Were decomps/recomps a hobby because people wanted to make sure their old games could run on modern hardware and be extended with mods etc., or were they a hobby because people enjoyed the actual process of using Ghidra and reverse engineering by hand, and the decompiled game was just a side effect?
Personally I think it's awesome that PC98 Touhou games are getting recomps. Being able to play the series natively on modern hardware, and all hardware for the foreseeable future, is great and preserves the legacy of the series. I understand that for anyone who enjoys the actual act of reverse engineering it feels like cheating, though.
I think people will get over it. Music is a good example. Drum VSTs and piano VSTs are going to sound way better than you unless you're a 99th percentile musician playing on a 99th percentile physical instrument. But people still play the piano and drums, because it's fun. Same idea; the existence of AI doesn't stop people who love the act of reverse engineering from doing it.
I think your question would make sense if these were the only two reasons. Someone who just wants to make sure their old games can run would see these tools as a good thing. People who just enjoy reverse engineering by hand wouldn't care this exists, or maybe even, a helpful tutor.
So perhaps then, the sentiment being as negative as it is, is revealing something about the hobby: that many participants, considered the metagame of being the first to do it, to be "smart enough" to have figured it out, the "street cred" if you were, is what they are lamenting, but they just either lack the words, or aren't being honest with themselves.
Taking that away compounds with the crisis of meaning we already have to make people feel more alienated than ever.
I must think of all the people who poured countless years of their lives learning all the C++ bullshit..
This is a very ingenerous interpretation.
I am a hobby hiker. My mountain hikes are so easy that basically anybody could do them: no street cred involved, it’s not even worth to speak about them. But it is important to me that most goals are only reachable by walking and putting in the effort: if a company offered a 20$/mo service that brings subscribers to the endpoint, carried in a luxury litter by robotized carriers, I would feel that my hobby has been devoided of sense.
At every turn it seems like a lot of intellectual pursuits are just being voided by this technology.
I've heard the "one level up" argument in software with the supposition being that the work's still there, it's just becoming more abstract... but even in software, this doesn't really track.
The injection of this technology into not just intellectual but artistic pursuits (since there are now commercial AI image and music generators) should be a red alert.
What is there to live for once everything you once loved to do has been optimized for maximum revenue? Where every time you do something for fun, someone will come out of the woodwork when you show it off to either tell you AI could've done it quicker, or that they made an AI version with a flashier UI or something?
if it brings you joy, what does it matter how someone else does it?
If you run for fun, what does it matter that someone else does it faster, or in a paid exhibition optimized for max revenue?
Do it because it brings you joy, there is no external dependency.
> Where every time you do something for fun, someone will come out of the woodwork when you show it off
See, this is where things get tricky, either the activity brings you joy, and/or the sharing of it brings you joy, and/or the showing off of it brings you joy.
For the first two, it is irrelevant what someone else has to say or do about it; ignore the noise. For showing off, yes, some activities are no longer worthy, so change is needed to find those that are.
Hopefully for a hobby, or for anything that you love to do, showing off is not a major criterion for why you do it.
The cases of a niche culture destroyed by dilution are so common that there are essays around it (e.g. Geeks, MOPs, and sociopaths in subculture evolution), so it seems to be a very normal and human thing to happen. Blaming the individual members for failing to feel differently is not going to fix that.
That aside, I've been lucky enough in my career to work alongside, mostly, people who have a personal interest in using software as a tool, and knowing their toolchains very well, be that a language, a command line, a system architecture, you name it. If you found something cool to do with a tool, you'd share it to disseminate the knowledge. That culture is very quickly dying off, I feel, because LLM-driven work encourages siloing to a degree I don't think gets discussed enough.
Lastly, using LLMs to write code is its own type of exhausting. I thought I could keep up my hobby by mentally checking out of work and working on projects by hand in my free time, but babysitting the LLM, reviewing the massive corpora of code and documentation it puts out (including those put out by colleagues), and the insane volume of context switches this technology encourages in the workplace makes me want to stay the hell away from computers alltogether if I can help it.
This example is actually very clarifying - perhaps almost no one actually runs for fun?
If the goal was to show off your accomplishments on social media, sure.
As someone else who hikes: why? I do not understand. Do you not enjoy the hobby of hiking for the sake of hiking?
The views will be just as beautiful, the air just as fresh, and the feeling of moving my legs just as energizing, regardless of how others may decide to get to the destination themselves. Why would the experience of others have any impact on my own experience of a trail?
There is something about a place requiring effort to visit that makes it special, and it loses that quality when it can be trivially accessed. The air isn’t quite as fresh when there’s a parking lot there.
Rather its the impact of others on, not their experience of, a space that would impact my own experience, for better or worse.
It’s interesting to dwell on what ‘we’ appreciated before versus what we appreciate now. Since LLMs lowered the bar, it feels like raw human effort has come to be held in higher esteem.
Are we going to re-evaluate what we were impressed with in the past based on that new metric? For example, will accomplishments by experienced engineers be devalued in comparison to accomplishments by outsiders? Will the software engineering equivalent of ‘folk’ or ‘outsider’ art become more valued? There will be a natural instinct to distrust outsider contributions because, well, how did they get so good?
Are some metrics of human effort going to be de rigueur going forward?
Since it's not educational as it used to be, if you built your own version of n64 emulator number 10143 you got something out of it you learnt some interesting stuff, learnt software development, hardware etc.
Now we are literally all just taking a magic machine pouring money on one end getting half baked output the other but no progress is being made on money is being wasted. Since even if 1 person had built it everyone would have had access already.
This is the same wave of slop coding/vibemaxxing we had a few months ago where everyone was building product X for the 1 million-th time without any actual progress being made.
Math has a similar problem now, before if 1000 people tried to solve a problem they all grew from that experience, the LLM is not growing/learning anything from this effort.
All we are doing is burning resources for our pleasure, I say that as someone who has now written his own compiler, vcs and browser stack, with vibe coding, though largely I would claim I have used and tried to read the code, clean it up, to learn from it where different things break.
But even this feels absurd waste of resource imagine all of us collectively burning 200$ per month plans which assuming a at cost pricing we are all burning 200$ of electricity each month to do what exactly? Some folks are on their 10th subscription that means most people are burning 1000-2000$ of ultra cheap energy generally sourced from a mix of gas/oil turbines burning away at big data centers these days.
We could all solve it by making a site.. cough github.. and not duplicating work.. cough..
But somehow because it's easy no one seems to care.
I am hardly against software progress, and if AI gets better we will have better software (because most people write horrible software most of the time) so I am happy about it, to an extent that I can be, with my profession feeling somewhat challenged.
But given I have always worked as a fixer of broken stuff it's very much also feels fine to me. Either way I am very much against these 200-500 dollar plans that allow you to burn hundreds of dollars of energy for little productive gain duplicating the same work 100th time.
I am sure software developer using 100-200$ plans just for work can get more out of it. And it's probably making up for the effort they would have put in their work otherwise.
I haven't followed this closely the past few years, but it used to be pretty obvious you were listening to a VST compared to a real instrument in actual playing. When you compare recordings, sample based ones sound awesome as long as you just try a single note, but they were obviously missing something in the sympathetic resonances (sounding worse than my upright piano which is perhaps a 20th percentile piano), and the more physics based ones had not so great tones.
I've actually been hoping that someone would try to apply deep learning to piano VSTs, even emailed a few researchers, but no reply. If something new has come up I'm not aware of, I apologize.
When it comes to real instruments, Roland ships physical modeling in some of their instruments. They are a mainstream company.
So I think physical modeling is there but harder to get right than recording samples of piano keys being pressed. The results can be been convincing and it's nice that it requires little memory compared to sample based techniques.
It's to the point where you virtually put microphones around the virtual instrument and it behaves (according to the person who does it for a living) creates an intuitively correct sound.
Edit: and to be clear this was a demo from before the LLM times so it's something built the traditional way.
You can bring this distinction back to recomps, too -- one area you can't use a vibed recomp over an emulator is things like TAS's[0], since the TAS community has strict rules about staying compatible with the original hardware, including doing things like sending the TAS inputs into an actual console to verify it works properly. A recomp is likely going to have minor (or major) compatibility issues that would prevent this from working. But it won't matter for 99.99% of players.
This is a very weird false dichotomy. It almost certainly was both of those for everyone who made any meaningful progress. You have to care about the end result to stick with a project to the end after you've finished the fun parts, and you have to enjoy most of the process of getting there for it to be a hobby. The journey and the destination matter, not one or the other.
When people work on projects like these, it is often a communal activity, for the love of a shared mutual interest. Friends are made, technical expertise is gained and shared, people learn from the code and from each other, and ultimately something fun is produced. We are a social species and it feels good to help other people, and to feel supported in our efforts by others. It gives us the feeling that we matter, what we’re spending our time on matters, that our interests are not merely selfish, that we are not alone in the dark.
In any ecosystem, different specialists fill different niches, and you can’t have a vibrant ecosystem without all of them. For projects like these, the place where the reverse engineers finish is where the mod tool developers take over; where the mod toolers finish is where the artists and game designers take over; where the artists finish, the fans and beta testers take over. Some fans might even try their hand at helping with one of the other parts, and learn how to become good at it, and now you’ve got a pretty good stew going.
LLMs poison the entire ocean, kill all the coral and destroy all the ecosystems. This is true in RE, but it is also true in OSS. If you try to do something human, the moment it becomes interesting to someone with tokens for the yes-sir machine, they will steal all that momentum for themselves. Contributing to and actually using the human version, then, becomes something one would only do out of principle. That’s a very shallow pool to try to survive in compared to an entire ocean.
The actual physical reality of the status quo of reverse engineering and recompiling is that the vast majority of stuff never gets the treatment because they aren't lucky enough to catch the attention of one of the few magical individuals with extreme skill and dedication willing to spend worth hundreds or thousands of hours of their time on them. The consequence is rot.
The status quo is thousands of pieces of software, including but not limited to video games, are lost every year, with no feasible way to recreate the systems and conditions that are needed to run them, and no way to update and repair them to be able to run again.
An estimated 88% of PS2 games are already lost forever. There are thousands of people in the world right now who have in their possession the last copies of digital media with no way to play them and nowhere near enough skill to crack and preserve them themselves.
The alternative to REA isn't hand-made free-range organic recomps, it's nothing.
This is certainly not true. Where did you read this?
If a thing is no longer difficult to perform or to produce, then I might still employ or consume it if it's useful, but I will no longer value it. No matter how useful a potato is, it's not worth any money, time, interest, effort, emotional investment, etc. Even though in a vacuum it's almost like a magic ultra utility food, most useful and valuable thing ever.
Same for countless mass produced utilitarian goods like plastic bowls and basic computers.
I don't want be an injection molded cup or a potato not just because they aren't rock stars, but because they aren't valuable enough to be a person's identity or livlihood at all, even a basic unassuming workman's.
Unfortunately those are also better discussed with LLMs.
I recently had to refresh on some algorithms and some manual coding for an interview where using LLM is forbidden. It was super fun, I forgot how fun solving software puzzles can be!
It’s unfortunate our industry has become so boring. Because our society values capital above all else, quitting my job to do something fun would relegate me to economical loser status. We really need a shift to the left in politics and a way to redistribute the productivity gains this technology allows.
Solving puzzles is fun when it's negative-free.
On my last interview, I had fan too, but that's only because I had an alternative and didn't even expect to pass. Then the work started, and now puzzles are less fun again, because if I don't keep successfully solving them, my family won't eat.
In abstract, sure, but that is a much shallower discussion that many people are strongly disinterested in. It's generic, where a human decompile may not be (as a cloner I haven't looked into those projects). I don't like the idea of a group of fans of art frames saying don't bother looking at what's in the art frame, our conversation is equal.
Of course, in a post-AI world people will still want to work together on things. But these sorts of tools do disincentivize it. That's the point I'm getting at here.
I feel a lot of these decomps were created by people not as passionate as your examples, because they are only showing up now, not in the pre-AI era. There is a flood of AI decomps only now because AI has lowered the barrier enough to where a project a person could not be passionate enough about to spend years of their limited time on Earth toiling on it is now easily accomplishable. It's a huge ask to put years of your life towards one thing. People might have obligations, work, family, children, more important hobbies, yet still wish one day they could get around to that one project, but couldn't find a way of prioritizing it over other things. I can't fault them for that. Now they can get it done in a month and still have time for other things that matter to them.
The claim is "we lose the rich communities that only exist from manual work." I still think the people who want those communities, like the people who still create art by hand in spite of the existence of diffusion, will keep doing their own thing. They were going to from the start, AI or not, but now that AI is a thing the separation is clearer to people on the outside, since they are seen to not rely on AI.
The communities that will appear because we can now organize AI decomp projects wouldn't have appeared at all with the barrier so high, had it not been easy enough to start them. The blocker was other obligations and not having the time to devote that was intrinsically required to finish them by hand, with the vast majority of people still being a member of outer society.
Dare I say it, maybe not all of the people into reverse engineering really enjoyed the process. It's just they put up with learning it because if you wanted to modernize an abandoned game in the pre-AI era, you had no choice but to learn those things. Only the people with the interest and patience remained, and those are the examples we are able to point to, while the people with only enough passion to get it done with AI assistance left a while ago and are only now reappearing.
I think this points in two directions - first that $200 is really unnecessary for this domain.
Second, that with more experience we might be able to write a non-AI matching decompiler and then naming and simplifying could be done by people/AI. While I appreciate the hobby part of it, I think automated tools are the way to really make it reach everything with far less dependency on pockets. The benefit to preservation would be incredible.
For me personally that's a huge win, but it would be a shame if it turned out that the whole AI/anti-AI thing is really just single player vs multiplayer in disguise. Because then we won't reconcile it easily.
$800-level consumer 3D printers let people make highly detailed plastic models of things with very little level of technical knowledge, but people still buy and hand assemble LEGO kits for the fun of it.
> hit with a flood of half-decent decomps
> It kinda just... totally eliminates that as a hobby entirely. I know people are going to be upset about this.
A rising tide lifts all ships, or however that saying goes. And a ship with a hole in its hull will sink to the bottom of the ocean. So don't sweat the surge of low-effort projects...
Your hobby is not going away. In fact, it's totally popping off right now. This is the perfect opportunity for you to distinguish yourself and lead by a positive example (whether that includes using AI tools responsibly, or not at all, is up to you). Just keep on hacking the good hack.
- traffic.
- low efforts posts.
- users who won’t read or respect the rules and culture.
So you want to show off instead of doing it for yourself? find something harder to show off then.
I can hardly run 5km, but I was still immensely proud of myself whenever I did. It still brings me great joy even though I'm a mediocre runner at best.
And ihmo programming, math, doing music or anything else still can be hobby - with our without AI. Do not be worry, you do not have to use AI for your hobby stuff. You can still code, create from scratch crappy personal frameworks/libs and so on.
I only want for times when local LLMs/AI are powerful and available on average hardware, so I could use it for my personal stuff without monthly payments. I wish doing so many things on my own.
Fan efforts are breathing new life into older games, some of them locked away on older consoles or due to cloud tied services that the game developer has no interest in supporting any more.
Efforts like OldUnreal and the Peacock Project are just amazing. Recently, Halo fans have unlocked 128 player multiplayer modes using assets from Halo MCC and unlocked 16 player coop campaign mode. Microsoft has no interest in this cutting into their microtracsaction-strewn free to play game which isn’t as fun as older Halo.
Incidentally Ive started tracking really cool fan game projects here, including a disclaimer where possible if the project is AI assisted or not:
I'm not so sure about that. Competitive Rubik's exist. Games like Trackmania feature levels that are often "solved" (having a strong world record) for months or years at a time while someone patiently pours hundreds or thousands of hours in to grinding a better time.
Even in emulation, we see figures like byuu(?) who spent years attempting cycle perfect emulation of all games where other emulators were chasing say speed or resource optimization while still other emulators were/are "good enough".
In the pokemon world, plenty of players consider say Emerald to be the final evolution of the game, while others may pick BW, while many are unsatisfied by all until they get a full mmo character designer role-playing game with all gen pokemon and nuzlocke support and custom starters and...There's even a roguelike version.
I think software is ephemeral/artistic enough that both producers and consumers will have different enough taste that there will almost always be some audience for any artist/developer.
We've already been living through this with the proliferation and continual development of easier and easier game engines. When one had to write their own engine, or write code at all, developing a game required either intense passion or intense funding. Even then we got clumsy rush-to-market "America's Got Talent for GBA" games. RPGMaker spawned hundreds or thousands of half-baked nothing-burger "games" and some people's all time favorite games. The same is true of Unreal and others. In each iteration, the prevalence of the old diminishes, but rarely vanishes. People still make MUDs, ren'py, RPGmaker, SNES, PS2, Wii...etc games.
Will this make more more? Sure, but more more has always meant a greater chance of the new latest genuinely greatest bestest game of all time for perhaps hundreds of thousands or millions of players. And it's still a tool at the end of the day. The passionate devoted dev team that had your perfect version of a game in their mind(s) is perhaps now able to finish what would have taken them years as a hobby project in a month, with all the bells and whistles dialed in because they truly care. Not everyone will be so committed to brilliant design, but then that's always been the case.
Yes, it is easier than ever to make garbage games; but, it is also easier than ever to make great games.
AI makes this so extremely efficient in all kinds of domains that, even if you try to continue to collaborate, I'm not even sure what the collaboration would be for.
At work, I've already noticed we aren't working together to solve hard ambiguous problems anymore. The whiteboards are filled with jokes and random notes people never bother to erase. Since everyone is tasked with their own project, unless you make a real physical effort to check-in, it's just way too easy to disassociate from everything else around you because you're able to just keep going.
Digital hobbyist projects of all shapes and sizes are becoming lonely little islands with people dreaming up all kinds of things, that everyone else can now also do, so there's now, no incentive to share or seek out experts.
I would be curious how real-world hobbies, that require patience and physical skill might start to see upticks in participation.
The Windows Remote Desktop client has two bugs that have been driving me crazy for the better part of a decade. One day I got fed up and fed the binary to Claude, asking it to fix the two bugs. And it just did it. Patched one with some NOPs and adjusted a stack offset for the other. Produced a credible explanation for both, and in fact the fix worked. It helps that I was able to describe the bugs clearly, but still, it had to figure out the right spot among megabytes of executable code.
It's not really more complex once you're practiced at it, just tedious.
The latter implies that you've understood where and how it happens as well as noticed any other areas that may be impacted by fixing the bug or by not fixing it. AI just fixes it without thinking about anything else - which is great, but it explains why serious people (and Microsoft) aren't doing just that. We've spent decades worrying about quality, reliability and performance. Using AI is saying all of that was poppycock and it's faster to rebuild than to understand and fix. It's a different school of thought, and hopefully one that bursts down in flame in a few months.
They don't fix this stuff, because it's a priority-3 ticket sitting in the middle of the queue that has hundreds of similar tickets on it, and none of them are being done, because the team has moved on and is either developing new stuff, or addressing priority-1 bugs that are blocking the other teams that are developing the new stuff (possibly backend stuff, but still stuff that will bring money).
vmconnect.exe (Hyper-V enhanced session) not going fullscreen after login when the window is fullscreen and you have to minimize and maximize to get fullscreen? Have your agent debug the issue and come up with an elaborate hook system that leaves the Microsoft files untouched.
Codex/Chatgpt electron app coming with annoying or missing features (Mini, Invite friends, no mcp hotreload, windows updates failing, ...)? Just point codex at codex and have it build an mcp Ouroboros to improve itself and enable dynamic js userscripts.
Deskflow clipboard sharing between devices missing file sharing, just have sessions on Mac, Linux and Windows collude to cook up a solution.
Yet writing proper documentation and reports that are human digestible still seems a bit out of reach, why would humans need to read anyway...
The insertion of NOPs is a great way to remove a function call that might have crashed the program. If you didn’t need anything that function did, you’ve solved your problem but not fixed the bug.
Also I don't think it's an honest take. You took this stance because the change was done by AI. If a person patched MS app he uses that had a bug that bothered him for a decade you would be more appreciative.
That's quite remarkable. How detailed was your prompting to specify the incorrect and desired behavior?
While I was at it, I figured since the Android app has a bunch of bloat like nagscreens, telemetry, social media integration, I might look into that as well. So I stripped the Android app down to the bare essentials to be what it is: just a video editor.
It is really crazy how good LLM are when you give it access to some tools such as ghidra headless, frida, etc.
Adobe product clones like Photoshop and Illustrator: https://www.youtube.com/watch?v=eFB79TYI-Vw
Adobe after effects clone: https://www.youtube.com/watch?v=5mi_tYSdkWQ
MS Office suite clone: https://www.youtube.com/watch?v=U_jTYMOlXio
As an aside, I've heard a lot of hot takes about how this is the end of Adobe, but I'm pretty sure it misses the point. The main reason people pay Adobe is because it's a familiar line of stable, well-supported, interoperable, and actively-developed products. There's already plenty of cheaper or free alternatives (Davinci Resolve for video, Capture One / Darktable for raw, Affinity for photo editing and vector drawing, etc), and if Adobe survived that, I sincerely doubt they're going to lose pro customers to a vibecoded app where half the stuff is probably subtly broken or left as a TODO, and that will be abandoned in a week, because the whole point was to get that 1M YouTube views.
Longbets 1 week, haha.
We're working our asses off on this.
Most of the team are artists who use these tools actively and we want the replacements for ourselves. I'm a filmmaker, so you can imagine my frustration of being bitten by the "unsubscribe fee".
I’m curious how much is your LLM bill. I’m assuming the idea is that LLMs will maintain the software? I’d be surprised, given the token economy, that you’d have to pay less than those subscriptions to LLM providers.
Crashes don’t get less frequent… etc.
These guys have a shot now.
You can't compare _cost_ here; apples vs oranges. How much _value_ per unit money is what matters here.
Comparisons should be done against the status quo: ~$60/user/month to adobe for years at a time only to see the product get more bloated, less stable and any bugs/feature-requests you file go to /dev/null.
Scaling up to this kind of complexity even with AI is still a challenge, at least for me.
What's the 'unsubscribe fee'? Are you referring to choosing something like an annual plan instead of 'Monthly' and only getting 50% back if you cancel partway through?
As you said you're a filmmaker, if someone chooses to obtain the rights to your film for a longer period instead of a shorter period and then changes their mind halfway through, do you similarly give them 50% back?
From what I can see, Adobe prominently and clearly displays from the first public checkout page the differences between 'monthly' and 'annual' options?
It does now, because the FTC sued in 2024 and Adobe then corrected this, while settling in March 2026
These are NOT the same thing whereas this one particular suite of clone products is exactly menu by menu, keyboard shortcut by keyboard shortcut and feature by feature a pure clone of corresponding products to that extent that they even have a separate dashboard just to track feature parity: https://github.com/storytold/craft-repo-status-app
It is NOT there yet of course but it won't be there in a year? That's an absurd claim to make. I have checked the repos multiple times and every new release keeps fixing something that wasn't working before.
https://github.com/storytold/photocraft (inspired by Photoshop)
https://github.com/storytold/wordcraft (inspired by Word)
https://github.com/storytold/pdfcraft (one of the more mature apps)
https://github.com/storytold/vectorcraft (another app close to 1:1 parity)
(etc.)
Using REA for something as high profile as what we're doing is likely to result in lawsuits. We're doing everything we can by the books.
We cannot look at Adobe sources. Use of Ghidra is disallowed.
REA is probably great for personal apps and for abandonware, but I think if you publish the results and it's found to have decompiled the original proprietary sources in discovery, you might be in for a bad time.
1) reverse engineer the code 2) train a model on the code 3) use the model to write the clean code
Step 2 is the key “cleaning” process
So maybe a good strategy would be to use something like REA, put it on GitHub, wait for the LLMs to train on it, then just use the frontier models
/s
Licensing/copyrighting encouraged people to think up of new things, and new ways of doing something. Now we're just all copying eachother.
It's considerably faster than their apps (at startup) too.
I'm not sure how clean room would apply to commercial applications distributed in binary form, as there's no way to look at even disassembled code without violating the license agreement and therefore being in breach of contract and subject to potential copyright infringement claims for copying or even continuing to use the software, let alone cloning it, and surely you're not going to be subject to a copyright claim based on familiarity with the application from merely using it.
The reason why 'reverse engineering' has gotten so good is because what we're actually seeing is fully automated luxury plagiarism
And I don't think that is publicly known at the current time. (If anyone has any tangible info on this, the please let me know...)
It doesn’t matter. It’s likely had access to the knowledge of somebody who worked on that source code.
I have worked at companies that have done clean-room implementations. I was not permitted to look at their source or interact with those teams, because I had been exposed to the source of what they were re-implementing in a prior job.
As a human with a mushy brain I was never going to remember the source, but the fact I had been proximate to it was enough to lock me out. You have no idea what the LLM trained on, so you can’t prove a LLM derived clone is a “clean-room” implementation.
Microsoft famously has patents covering aspects of the ribbon interface in Microsoft office, which of course this suite must implement. https://en.wikipedia.org/wiki/Ribbon_(user_interface)#Patent...
Meanwhile, Wikipedia has a policy that says screenshots of applications have to be "as small a version as possible" in order to meet the fair use exception for presentation of copyright work. I can only imagine an exact clone of the interface could be similarly ruled to infringe on Adobe's intellectual property.
People wishing for the death of the mega corps, are directly wishing for the obliteration of millions of great jobs.
We just need to apply the antitrust law and break these trillion-dollar corps into smaller competing corps.
There’s no reason for a single company to provide your email, browser, search, operating system, entertainment, AI, etc.
How much of the profit will be redistributed to all the artists, programmers, scientists, etc. whose works are the foundation of their product?
The poorest 50% of global citizens hold the same combined wealth as the top 10 individuals.
How are massive and increasingly concentrated corporate profits going to help them? (Or anyone else for that matter).
Yeah, I'll take the obliteration of a few million overpaid American jobs over the destruction of hundreds of millions worldwide, the social upheaval that goes with it, the destroyed families and the direct and indirect deaths. Fuck your promo packet and fuck your cozy desk job.
Everything was, is, and always will be a derivative work.
If AI models can generate designs faster and produce work that is "good enough", what is the actual future of design tools and the design profession in your opinion?
I've tested this myself with some frontier models and the results are kinda impressive enough that it raised the question if design skills are already obsolete. If that is the case, what use are these tools now?
I've seen a lot of "really cool unique designs" that are obviously just a digested regurgitation of amalgamated corporate slop. Anyone wanting an actual unique design language needs to hire actual designers.
Those designers may use AI tools but the tooling isn't to where they can be completely replaced. I challenge anyone to show me an e2e LLM design toolkit that can actually replace a designer, not just one shotted "wow that looks so cool" character designs.
AFAIK clean room does not forbid decompilation, I meant that's how it's been done for ages. What's important is that the observer does not write the code, to avoid being impressed by the decompiled one, risking creating a copy close enough to deem it copyright infringing on the original.
Because the copyright applies to the actual code.
I've got my wedding coming up so haven't had the time I want to dedicate seriously to finding some proprietary things to disrupt, but I've had fun using this as an opportunity to play with subagent orchestration, open weight models, various harnesses, and local models, to see what happens if I let some LLMs churn on it. That resulted in a hodge podge researched list of potential targets: https://github.com/508-dev/genairosity/issues
One thing that stands out is a lot of software kinda does already have a FOSS replacement, it's just not really how people want it to be. GIMP being the representative example. Photoshop people just don't like it, I'm sure for not entirely invalid grievances. However the maintainers of these kinds of tools are often strongly opposed to LLM involved contributions, again , often for not entirely invalid reasons on these incredibly complex projects.
So the long and short of it is that as powerful as LLMs are, we aren't quite where some of the doomsayers are saying we are, insomuch as proprietary software is dead. Even with reverse engineering we aren't there. There's genuine labor, time, and expertise moats around most of these programs.
Personally I'm shifting to trying to find niche abandoned software with no export flow. Even if I can only help out a couple hundred people, it sounds like a decent use of my time.
We used to pay for phone calls not long ago. Now a video call is free.
Nobody can predict the future, of course, but I personally believe this pattern will hold. A decade from now, the idea of a consumer being able to purchase a personal device with more than 8GB of RAM will be a thing of the past, all significant compute will be done in the cloud using the massive amounts of hardware being hoarded by corporations as we speak.
The only way this is remotely possible is if the copyright cartels get their way and make it illegal to have unlicensed local compute. Assuming that doesn't happen, I'd gladly bet a large amount that computing will be much more affordable 10 years from now.
Excel '98 probably covers 90% of excel users needs, but here we are sending Microsoft billions a month to lease excel.
So I built droidasc. No memory bloat, no parsing slowdown. Analysis is in milliseconds. Global xref on a 300MB APK takes 1.5 seconds. I used it with codex to analyze phones from 3 different brands and found 2 RCEs and 5 root bugs in a few days. I plan to detail these at Black Hat Asia 2027. A friend used droidasc to scan various bug bounty targets at scale and found 10+ RCEs. Way, way faster than jadx.
Really?
For example, I use Claude as a bouncing wall for my thoughts and I pointed out that,
> GLM 5.2 was the only thing that helped HF while the agents were trying to access them. The "guardrails" stopped them from doing good. The Computer Fraud and Abuse Act exists. Courts exist. And computers and an internet connection have existed for a long time. There's also 17 USC 1201 provisions with the 1201 a 1 exemptions [Image #31] so in this case, a farmer should be able to work with you to access the tractor they own. Or... IDK... a kindle that's out of date? :) What is lawful and what isn't is rooted not within the act but within intent, purpose and mens rea. And this is something the law has been deciding for centuries now. At one end, your maker can't say that governments should decide while at the other end explicitly refusing to allow governments to be the ones who decide.
> Opus 5.5's safeguards flagged this session. You may be seeing this for the first time on an Opus model: Opus 5.5 is more capable and has stronger safeguards as a result, which can sometimes flag non-cybersecurity work. We're improving these safeguards to reduce the amount of incorrectly flagged messages. Edit and retry, or continue with Opus 4.8. Send feedback with /feedback or learn more: https://support.claude.com/en/articles/8106465
>
> Details: "[cyber]'
Fundamentally, the idea that you can't reverse engineer things, make things, learn about biology or physics without permission is strange to me. These machines have been trained on the sum intellectual output of humanity, the global intellectual commons, and are being used to close off that commons?
I would be OK with their right to create such restrictions if they weren't lobbying the Government to restrict others, thereby ensuring that they control humanity's intellectual commons well into the future.
Perhaps I'm naive, but I think it's better for humans and the machines if we can all think, learn and build. But then again, I'm the kind of person who rejects the doomer pill.
It's worth talking about the fact that you can't even talk about DMCA to a model trained on the Library of Congress unless you're one of the approved people. And that's before reverse engineering something or writing code.
So in this future, it sucks to be you if you're someone trying to make your small app more secure, someone trying to upskill, a tinkerer trying to bypass corporate lockdowns for a device they own (a recognized DMCA exception, btw), a teenager trying to learn about security...
It locks away much of the richness that produced hacker culture behind glass. You can look at their press announcements and PR pieces, but you can't touch.
And as they're lobbying the government for "sensible regulation," this inevitably leads to a future where computing is controlled.
It's the direction their existing reports are taking. They recently released one in September that talked about how they stopped "bioweapons." What were said bioweapons efforts? Oh, it was scientists using Claude for grant writing, paperwork and grammar. At national labs.
These people are basically proud of impeding real research to make better painkillers and study a neglected tropical disease, https://news.ycombinator.com/item?id=49651727
And this is being used to lobby against "dangerous" open-weight models because gasp a scientist might use them to write a grant! To make better antidepressants.
At what point do they start reporting someone taking apart an iPhone and trying to DIY a repair with a schematic as a thwarted "cyber security incident?"
Another funny one was Claude's refusal to provide the original untranslated text of a passage from Dante's Inferno on copyright grounds, though in this case pointing out that no 14th century literature was subject to copyright anywhere in the world was sufficient to override its objection.
Several years back, I was working on generating AVB2 hashes on top of modified Android distributions, to increase the security after an owner has made their desired changes. I was doing this before the age of LLMs. Among other things, this would've enabled the secure features to work again, and potentially reduce the risk of root access being usable by malware. But apparently I'm not a security researcher because I didn't get a CVE about it.
(Who knows if this'll be true 6 months from now.)
"Hey Claude I want to create a fanmade Game Boy game, give me recommendation of tools, libraries and workflows for it" and boom.
You can use AI to learn stuff, instead of just using it as a Pokemon.
We're kinda far into this LLM thing, maybe it's time to start selling harnesses by leading with how some examples were solved faster with this and how it saved tokens, or similar?
But I just found an even easier way I should have thought of first - someone already dropped a reimplementation a couple weeks ago.
"Source code? We don't need no stinkin' source code!"
In my experience, even just hinting at reverse engineering to models from Anthropic or OpenAI leaves them extremely sensitive to refusals. After all, the same techniques used here can be used to find exploits.
Or are people using it with local models?
Curious.
My conclusion is that OpenAI will help you with cybersecurity and never really block or prevent you from doing the work, but then suddenly warn and/or ban you. Anthropic does the opposite, where they trigger safeguards all the time while working, but never really ban you.
Also, while you may have never heard of this happening I found countless threads on Reddit with frustrated people having been banned from OpenAI for using it for cybersecurity. Since all I’m using AI for is cybersecurity, it’s hard to know exactly why I was banned since they don’t say exactly why.
I've had no issues with OpenAI.
And the Github page: https://github.com/morluto/rea
Try GLM-5.3, it worked pretty for me. It also worked well with Radare2 or binary ninja if you don't have the muscle memory for idapro.
It'd make more sense to reject reverse engineering commercial software on the grounds that it likely violates the software's license agreement, and would therefore subject the user to potential breach of contract and copyright claims.
But this would also apply to uploading pretty much any non-self authored document to the LLM in the first place, albeit with fair use as a possible defense after the fact, so it still doesn't make much sense.
Update, found this article to cover the timeline well. https://knowyourmeme.com/memes/cultures/ai-video-game-mergin...
This tweet is what opened the floodgates: https://nitter.app/chasmmmmmmmmmmm/status/210137541186725513...
I’ve been doing decompilation with LLMs for 4 months, and 5.5 is so insanely good I now can finish Windows 95-98 games in just a week. And by finish I mean get byte-to-byte exact output from your decompiled code to retail with clear names, semantics and no “Ghidra smell”. With older Opus models you would have to manually guide them and inspect ASM yourself otherwise they will just burn through your tokens (which also used to cost more!)
Example: https://github.com/sushi-shi/homm1-decomp
And I have way more on my gh.
Going from ~4,226 to 54,614 stars in ~5 days is about +50k. Even stranger is forks: 438 → 10,376 forks. That is an unusually high fork acceleration. Current forks are about 19% of stars.
When you crack some DRM, the DMCA makes it challenging to share your work with the world, regardless of the morality of your use case (say, repairing one's tractor). There is no longer a pressing need to share that work, when anyone can just say "computer, sync my spotify collection to my jellyfin instance, using correctly tagged FLACs", and it goes away and does it from first principles.
As the value of a particular piece of software decreases, the value of reversing its specific implementation does as well.
Reverse engineering is about discovering specific methods or protocols. Not for porting entire implementations to new platforms or products. A lot of the specific methods and protocols have been sucked up into the LLM weights, so the need to go digging for these patterns is dramatically reduced.
The biggest application I see here is with digital archaeological work (the opposite of new things).
The copy this prompt into your agent seems like an evolution of `wget X | bash`-style in all the worst ways.
Started in the repoprompt (https://repoprompt.com/) community.
Good stuff.
> Install REA and connect it to this coding agent using npx rea-agents@latest setup. Show me the setup plan for approval, then verify the installation.
We have achieved the next evolution of installation by `curl | bash`!
With ai models getting better we may be able to do analysis on the actual underlying bytes of the files we download to properly scan them for malicious code patterns and build systems which sandbox programs and watch inbound and outbound traffic/ system level actions from them and flag suspicious requests for further analysis by smarter models.
REA shows that ai are very good at understanding low level code and reverse engineering it so this could potentially be applied to application level security aswell.
We have existing paradigms for this.
Additionally, installers are signed with certificates on Windows.
All of these are strictly more trustworthy than curl | bashing.
- any game coop MOD
- drag a single player game exe file into the tool, it builds a networking layer and makes the game playable on 2-4 player COOP
- this ll be the greatest agentic reverse engineering tool ever made on the planet if you can pull it off
- drag call of duty black ops 1 into it, boom you get back an exe with 2 player coop on campaign
- drag mirror's edge exe into it, boom now you have. 2 player coop on mirror's edge
- any of you agentic wizards out there think you can pull this off?
hello fellow Claude user
The mechanics of BFME are the important part, not the intellectual property of the films. The way the units move, the resource system and power points are what make it special. Gandalf and Lurtz are simply wallpaper on top of something that is already very competent.
The only problem is the lawyers at all those companies will be readying their lawsuits, and given they have tons of money; they do not care and will come after anyone.
That's insanely meta.
I guess everything is going to become recursive. RSI on models. Everything feeding back into its own hill climbing optimization.
Humans nudging it up the hill further and further by using new geometric guidance.
So really closed-source compilers are a hindrance and you're subject to unspecified time-frames to even get to fix your issue rather than doing it yourself.
Intel and AMD have already open up theirs without question. Nvidia is the one who claims to be supporting openness in AI but can't even open up nvcc let alone CUDA.
And then you can use Claude-Oeuvre to fix the issues.
And then you can use GPT-Cosmos to fix the issues.
And then you can use Claude-Omnibus to fix the issues.
And then you can use Claude-Logos to fix the issues.
Gaming: This will trigger the return of Stadia-like cloud gaming services.
Apps: Will begin to require online accounts to use them. Even for the most basic of apps and will made into a sass.
Think of it as a more persuasive means of obtaining documentation. Not as a nefarious act.
Backend will have some shuffling of data around some ledgers + a lot of ceremony around auditing + shit ton of CRUD mess and arcane connections to other systems/institutions. Probably the nightmare of nightmares codebase, if frontends are any indication. :D
And yes, if frontends are any indication, just seeing tip of the shit-berg
There are some days I just hit a raw debugger in AuthForRealThisTime() under a three-paragraph jsdoc written by bot which is itself under the commented-out Auth() function. So many questions arise, and I can burn hours rabbit-holing the stack