since GLM 5.2 (perhaps even earlier?) it has been remarkably easy to reverse engineer any closed protocol you want as long as you have a binary. previously, it required so much manual effort as to simply not be worth it 95% of the time.

now all you need is IDA or Ghidra MCP, a binary and some vague sloppy instructions.

some more recent models even started instrumenting a running binary (when possible) to enumerate the protocol without being explicitly instructed to, which is even better.

▲ Retr0id 6 hours ago | parent | next [-]

You don't even need an MCP, I just let the agent write scripts for headless ghidra. The MCPs are fragile and there isn't a whole lot of knowledge about how to use them in the training datasets, whereas there are plenty of ghidra scripts (and proper docs for the APIs).

▲ bri3d 5 hours ago | parent | next [-]

I agree! Don't give it away!

Seriously, though, the popular Ghidra MCP is really badly architected; it's way better to rearchitect it or just script Ghidra directly. With that said, Opus 5.5 seems to have been trained on CoT from the popular Ghidra MCP. This makes it work better, but also makes it even more inefficient if you modify the MCP without changing its name and shape significantly (it will try to make tool calls using the "mainline" format, then have to retry them when they fail).

Even with Opus 5.5, IMO it's better to just ditch the MCP and let the LLMs eat with bintools and headless Ghidra; with both GLM and Opus this produces significantly more efficient results than the popular MCP. On the other hand the IDA Pro MCP is much better architected and seems to be pretty good.

▲

cute_boi 4 hours ago | parent [-]

Will opus 5.5 even reverse engineer binaries? I get instant blocks when it sees word like decompile etc..

	▲	TeMPOraL 25 minutes ago \| parent \| next [-]
		Reversed an old video game pretty extensively for me. Got it running in 30 minutes, then patched some bugs, reversed the entire game logic VM and rendering pipeline, and we're now in process of expressing game logic as Lisp and upscaling assets for rendered that it already made to operate at 4x its hardcoded resolution... Starting point was literally original installer copied over from a CD, which I hold on to and dug up from an old hard drive, plus a short prompt asking to make it work. Installing Ghirda and developing a whole framework for patching the binary, as well as substituting DirectDraw with its own DLL shim, was Claude's own invention.
	▲	Retr0id 2 hours ago \| parent \| prev \| next [-]
		It depends on what you're reversing. It tends not to like DRM-shaped things or security-sensitive things (for a very vague definition of "security-sensitive"), but e.g. game engines are fine. (For the things it doesn't like, dropping down to Opus 4.8 or 4.6 usually works)
	▲	charcircuit an hour ago \| parent \| prev [-]
		Works fine for me. I didn't explicitly say decompile but it had no issue digging into executables to give me information on how it and various file formats were designed.

▲ teravor 6 hours ago | parent | prev [-]

    > there isn't a whole lot of knowledge about how to use them in the training datasets

if you include a SKILL.md for the MCP (or just dump it into the prompt) it's not a problem.

I don't use Ghidra but IDA Pro MCP works extremely well for me for all manner of tasks. for example, some software likes to call home for license checking (and I wish to run it with networking denied to it). it no longer does.

	▲	Retr0id 5 hours ago \| parent \| next [-]
		Sure, you can do that, but in my experience it's usually best to let agents do the things they already know how to do.
	▲	bri3d 5 hours ago \| parent \| prev [-]
		The IDA Pro MCP is substantially better than the most popular Ghidra MCP, for what it's worth.

▲ faithraven 6 hours ago | parent | prev | next [-]

Without admitting to anything, I was surprised by how little time it took to add support for the new protocol to the library. And I didn't even need an MCP server.

▲ thedougd 3 hours ago | parent | prev [-]

I've had good luck aiming for easier targets. Android APKs, Java, and .NET binaries are usually easy to reverse engineer with AI and without any advanced tooling.