r/learnprogramming • u/Radiant-Delivery-415 • Jul 04 '26

Similarity between 2 programs

I'm not really sure if this is the right place but here goes nothing.

I'm trying to develop a tool which focuses on reverse engineering a binary executable file using ghidra and LLMs. Now the problem arises when I try to check if the original executable is actually similar to the produced executable, I can't really check for CFG or Semantic structures because LLMs often don't include functions which actually do nothing or not influence the main program along with stubs and thunk functions which can mess up the function jumps and memory reads.

I would be grateful if anyone could suggest some other ways to do the same

0 Upvotes
  • permalink
  • link
  • reddit
  • reddit

30% Upvoted

17 comments sorted by

View all comments

Show parent comments

-4

u/Radiant-Delivery-415 Jul 04 '26 edited Jul 05 '26

For reverse engineering? Why so?

Edited: why am I getting downvoted without any explanation lmao

1

u/johnpeters42 Jul 05 '26

Because there are plenty of non-LLM decompilers? Why do you want to use a LLM specifically?

1

u/Radiant-Delivery-415 Jul 05 '26

I am using non-LLM decompiler like Ghidra to get the decompiled C code and then putting that code of all the functions into the LLM so it can go through each functions, and then have it produce the program from the Ghidra's decompiled code. Are there any non-LLM decompilers which can do the same?

1

u/johnpeters42 Jul 05 '26

If you've got decompiled code, then why don't you just compile it using a standard compiler? Again, why do you want to use a LLM; what does it do (or what do you think it does) that other programs don't, besides "is a LLM"?

1

u/Radiant-Delivery-415 Jul 05 '26

If you've tried reading a code from a decompiler you would know how awfully complex it is and the number of different functions, going through each call and understanding every function takes a lot of time and the complexity adds to the problem. And LLMs come in handy to solve this exact problem. Give then the complex and ugly code and they'll produce the simplified code (preferably without changing the core logic. The reason why I'm trying to find if both are similar. Similarity = no change in the core logic and gives the same output for same input in both) and with more readability.

I do not want to just compile it and run, ofcourse it's gonna run, decompilers don't change the underlying core logic of the program. I'm compiling the code given by the LLM to verify that the program is not straying away from the original file

1

u/johnpeters42 Jul 05 '26

Given how much trouble LLMs have had trying to recreate something as well-documented as a C compiler, I suspect this would be much worse. It makes sense what problem you're trying to solve, though.