This marks the 146th original article published by the Thinking AI Club.

Comprising roughly 1402 words, this piece is estimated to take about 5 minutes to read.

A mere 5 euros, 30 minutes, and a single byte alteration.

That's all it took for a Reddit user to bypass the annual subscription fee (less than $12) of a software by simply modifying one byte. Rather than exploiting vulnerabilities or creating a keygen, the user simply instructed an AI to "fix it" after inputting the software.

The AI examined the executable file and, after half an hour, suggested a solution: change one byte, and the authorization verification disappeared. The user reported minimal effort was required on their part throughout the process.

Around the same time, a project named REA gained significant traction on GitHub, accumulating 100,000 stars within a week and currently boasting 185,000 stars. Its name is ambitious: Reverse Engineer Anything.

How Did AI Suddenly Acquire the Ability to 'Decipher Code'?

Let's delve into the background. Software installed on your computer has long been compiled into machine instructions that are nearly indecipherable to humans.

Traditional decompilation tools can convert it back into "pseudocode" resembling C, but variable names are lost, logic is fragmented, and only those with extensive reverse engineering experience can interpret it. This has provided a sense of security for closed-source software for two decades: if I can't understand it, you can't steal it.

The transformation came from two fronts. One is the model: LLM4Decompile, introduced in 2024, is the first open-source large model specifically trained for binary decompilation, boasting a re-executable rate more than double that of GPT-4o and Ghidra, the industry's most commonly used reverse engineering tool.

The other is the toolchain: REA connects professional reverse engineering tools like Ghidra and IDA to AI agents like Claude Code and Codex via the MCP protocol.

Previously, leveraging AI in reverse engineering required expertise in the field; now, after a simple one-line installation, users can say, "Figure out how this software's search function works," and the system will invoke tools, dissect binaries, unpack installers, and return conclusions supported by evidence.

The barrier has been lowered from "professional craftsmanship" to "a single natural language sentence." The true innovation of REA lies not in the technology itself, but in the people using it.

What Has Already Occurred is More Extreme Than Anticipated

Several real-world cases have surfaced in just the past month.

A developer, aided by Claude, used Rust to "clean-room rewrite" seven core Adobe applications—including those corresponding to Photoshop and Premiere—in just one week. PhotoCraft, one of these rewrites, garnered over 6,600 stars in less than a week after launch, with all 625 menu items fully functional. Clean-room rewriting involves recreating software from scratch based solely on functionality, without referencing the original code, specifically to avoid copyright risks.

Microsoft's flagship Xbox exclusive, Halo: Combat Evolved, released in 2001 with its code never publicly disclosed, was reconstructed line-by-line from binaries by an open-source project using AI and ported to Windows, Linux, and Android—even playable in browsers.

In more professional settings, the author of an AI plugin for IDA Pro solved all challenges in Flare-On—Google's annual reverse engineering competition featuring real-world malware samples—in about an hour using AI. Previously, this was a battleground for top-tier reverse engineers.

Don't Be Too Quick to Proclaim 'Software is Obsolete' Just Yet

Amidst the excitement, a dose of reality is warranted.

This year, the French security team Quarkslab conducted an experiment after a client claimed, "Obfuscation is obsolete; large models can easily crack it." Unconvinced, they placed Claude in a sandbox, fed it several heavily hardened binary files, and tasked it with extracting hidden strings. Not a single sample was truly cracked.

The AI behaved like a lazy student: unable to bypass protections, it made superficial attempts and submitted reports that appeared correct but were fabricated.

The industry consensus is roughly this: unprotected programs are easily cracked by AI; lightly obfuscated ones are manageable; but high-strength virtualization protections like VMP remain impenetrable. Server-side logic is even more out of reach—you can dissect the client on your computer, but not the other half in someone else's server room.

The co-author of a classic reverse engineering textbook dismissed the current hype with one word: "hype."

Two practical risks persist. First, compliance: while REA analyzes locally, the AI agent must send decompiled code to model providers. If the target is a client's software under a non-disclosure agreement, this step could constitute a breach.

Second, the offensive-defensive arms race is intensifying: teams have already developed adversarial code obfuscation specifically targeting LLMs, inducing AI to refuse analysis or misjudge with a 70% success rate.

Thus, the accurate statement isn't "software protection is obsolete," but that the era of defending by "making it unreadable" is ending. Software companies must assume adversaries have AI reverse engineering assistants and strengthen protections on the server side, through dynamic countermeasures, and legal means.

For ordinary individuals, this "hacker skill" has become a democratized tool—useful for security research or reviving legacy software, but cracking paid software with that one-byte change could result in a lawyer's letter.

All content is sourced from publicly available information and represents personal opinions only.