21
133
u/Background-Wafer-548 1d ago edited 1d ago
Jokes aside, there might actually be some merit in reverse engineering open source binaries to verify that they do indeed correspond to the source. Especially ones that take ages to compile yourself.
Edit: I concede you'd be hard-pressed to find any situation where compiling yourself with a beefy cloud instance isn't going to be considerably cheaper. Maybe if you're dealing with some mystery binary that doesn't exhibit the version anywhere and which can't just be replaced with newer versions due to breaking changes.
Edit2: With respect to hashes, there's precedent for those being compromised.
17
u/soyuz-1 1d ago
How would you check? Its not like you get the same source out of decompiling that it was before compiling.
7
u/Background-Wafer-548 1d ago
I mean, you could ask Claude to check functional equivalence.
7
u/wontgetfooledaga1n 1d ago
Why not just compile it yourself? Decompiling would take so much longer
0
u/Background-Wafer-548 1d ago
Hardware constraints for larger projects. Although you could of course rent a beefy EC2 instance.
5
u/wontgetfooledaga1n 1d ago
Decompiling would take similar amounts of hardware if not more though.
1
u/Theron3206 1d ago
Decompiling probably takes longer than the initial compile. AI comparison of function will take orders of magnitudes longer.
2
57
u/stumblinbear 1d ago
It would be so much faster to just compile it yourself. And cost less money. By orders of magnitude on both counts
9
u/Hexcede 1d ago edited 1d ago
This isn't compilation it's source reversal. Compiling from source doesn't usually produce the same hash. Are the people in this thread competing in a missing the point competition that I wasn't invited to or something?
1
u/stumblinbear 1d ago
Reproducible builds are absolutely a thing, though it usually needs some specific configuration to be done to be reliable
1
u/Hexcede 11h ago
Yeah my point wasn't really that reproducible builds don't exist just that it's more complicated than it's being made out to be. "Just compile from source and check the hash" only works if the project is being built in a reproducible way in the first place, and I also don't really think verifying builds is the intent. I think it's much more about how good or bad it is at reverse engineering in a way that's relatively checkable.
1
u/pimp-bangin 1d ago
It doesn't have to produce the same hash. It just has to produce identical or near-identical code. If the hash is different it's most likely because there is some embedded environment info which could be normalized so that you get the same output (e.g. timestamps, username, etc). But the code itself should be identical (assuming you're using identical compiler builds and flags)
1
u/Robot-Zombie-RHCC 1d ago
true. but at least doing this (assuming it's real) would give us an unbiased peek into the quality of the ai-decompiling.
-8
u/Background-Wafer-548 1d ago
If you have the requisite hardware, yes. Building Android, for example, requires at least 64GB RAM and 400GB of free disk space (the latter of course easier to meet).
→ More replies (3)11
u/stumblinbear 1d ago
So rent a cloud box for $5. Still costs less than the tokens
→ More replies (5)14
u/somethingLethal 1d ago
This is why developers ship binaries with SHA-256 hash digests. No need to decompile anything and you can cryptographically verify the binary you are about to run is built with the source code the developer made.
Digital signatures for the win!
4
u/danielv123 1d ago
You can't verify it's built with that source code. All you can verify is that the binary is the same one the developer wanted you to get. Allows you to sort out mitm attacks or corrupted downloads.
3
u/somethingLethal 1d ago
Steps:
1. Download source code
2. Download hash digest
3. Build binary from source code
4. Calculate SHA of freshly produced binary
5. Compare that to the hash the developer uploaded.This is verifying “it is built with that source code”
5
u/Hexcede 1d ago
Building from source code doesn't usually produce the same binary on a different machine. Metadata, compiler versions, and differing configurations can cause differences, etc. So it's way more complicated than this.
3
u/somethingLethal 1d ago
That’s been a solved engineering problem for a long time.
Embedded tool chains, path stripping, and timestamp pinning are examples of what’s been done to address these areas and have been included in compiler defaults in most modern languages that compile.
1
u/Hexcede 11h ago
I get that it's feasible to solve, my point isn't that you can't do it. My point is more that it's just not really as simple as it's being made out to be.
The software still has to be compiled in a reproducible way. It may be the default in lots of compilers and languages, but it's still only the default. Compiler versions are still a concern, optimizations make things muddy, and it's relatively opaque, so it's not really very easy to know that the build is properly reproducible even though you can make a reproducible build. And you don't really tend to have the source code to most software because most software isn't open source.
So I don't really imagine the point of this would be something like "let's verify that Linux is really what it says it is" as if anybody is really questioning it or anything like that. Linux is just a good demonstration because it's open source and comparison to the source is possible.
Like, the product here is still just the source code and we already have the original. So it's obvious to me that the point isn't meant to be like "wow look at this practical use case, we got source code for this already open source project!" it's more like "how good might it be at reverse engineering, actually?" in a way that's itself relatively checkable/interpretable.
That is how I interpreted this.
4
u/Puzzleheaded-Mud7240 1d ago
Fucking crazy you even need to explain this
2
u/danielv123 19h ago
The crazy part is people believe this is how it works. It doesn't.
Most builds aren't reproducible. There is a reason we rely on code signing to prove provenance today. It does not prove anything about the source code that was built, but about who built it.
This also tells you how often people actually check the certificates/checksums when it isn't automated: Apparently never, or you guys would have realized when your checksums didn't match.
1
u/Puzzleheaded-Mud7240 10h ago
Of course this only works if the build is reproducible. Nobody is claiming otherwise. You are saying that reproducible builds can’t verify that a binary corresponds to the published source code because most builds aren’t reproducible which is a pretty strange argument. That’s literally what reproducible builds are for.
1
u/No_Oil_6152 10h ago
For a reproducible build you'd need the same compiler, same command line args, same DLL versions (if statically linking)
I dont think its that straightforward.
If you get the original make file - great. If not, you'll have fun messing with optimisation levels, static linking or not, WIN32_LEAN_AND_MEAN #defines etc...
1
u/Puzzleheaded-Mud7240 9h ago
Yep, that’s how reproducible builds work. You just listed some of the requirements. This isn’t exactly uncommon either, for example, big majority of Debian Bookworm and Trixie packages pass reproducibility tests.
1
u/No_Oil_6152 9h ago
Ok I can't speak for Debian but pretty sure Windows wont be so straightforward.
→ More replies2
u/mycocoon 1d ago
To be fair it depends on the compile flags but I think the main argument from the hype train is "no AI involved it must suck"
2
u/rogueone0631 1d ago
The compiler flags are usually preset in the Makefile, so if people are changing it it’s their own doing.
But yeah different versions of the same compiler will have small variations, which can be reviewed with specific tools for those who care. Usually the project producing hashes should point the versions they’re using as well, architecture used etc.
1
1
u/danielv123 1d ago
That generally doesn't work, right? Even for famous stuff like the debian repos it's still not possible for all packages https://wiki.debian.org/ReproducibleBuilds?pow_referer=
1
u/somethingLethal 1d ago
This is standard practice for almost all major software distributions. Mobile app stores for example ask developers to sign their builds so they can perform this exact verification.
For the Debian angle you were chasing, here is a recent article I found on how to actually sign and validate a .deb file: https://www.ibm.com/docs/es/linux-on-systems?topic=instructions-verify-rpm-deb-package
1
u/danielv123 20h ago
That is not at all what your link says and not at all what certificates do. Actually, a package signed with a certificate is guaranteed to not be reproducible, that's the entire point.
When signing your software, you add some extra bytes that can easily be verified, but are impossible to add without the private key. None of your consumers have the private key, so they won't be able to do a valid build.
This means it's possible to guarantee a build is coming from you and not some third party, because it's impossible for a third party to make an official build.
Notice how none of the instructions on that page included compiling the software so you could check that it was the same.
1
u/Business-Weekend-537 1d ago
Has there ever been a man in the middle attack where someone provides a phony hash digest that matches the bad source code binary?
Or in general do people who make malware not get that elaborate?
2
u/somethingLethal 1d ago edited 1d ago
The only hash digest you can have that matches the source code, is the valid hash digest itself. No other hash can also match. If even 1 bit in the source code changes, the hash digest changes.
This security control doesn’t protect from man in the middle. Instead, it’s a means of verifying the integrity of the content provided. In this case, a binary you run.
With this security control we can say: “the build I am running 100% matches what the developer built, when they compiled from the source code they had at the time they calculated the hash”
Malware in this area is tricky because it’s not an easy answer. Here is the gist: malware usually requires the user to run something they accept or are phished into accepting. This isn’t always true, however. The reason you are asked: “are you sure you want to run this?” Is most likely because the operating system can’t verify the author and it’s usually because the binary isn’t signed.
1
u/Business-Weekend-537 1d ago
Right, but what I’m saying is do sites with bad malware ever show a hash digest that matches what the malware will output when a hash is run.
So that someone thinks it’s more legitimate.
Ex: serving a page with fake Linux, and there’s a hash digest that matches the fake Linux. So an unscrupulous user may think- oh this has a hash digest that matches so it is therefore legit.
Even though both the software and the hash digest are illegitimate, they line up with each other.
1
u/somethingLethal 1d ago
Oh yes, absolutely. But here is the threat model / vector for how:
- Victim is a developer who creates npm packages
- Victim gets phished and victims email is compromised
- Attacker resets victims GitHub password
- Attacker adds malicious code to victims package repo
- The victims repos CICD signs and deploys the new version with the updated hash, including the malicious source (typically post install scripts)
- Users consume said package update with new hash and no knowledge of the underlying malware.
Note: this is rare. Hopefully 4 is caught with code review but not all open source packages have they level of software maturity.
1
u/Business-Weekend-537 1d ago
Got it, thanks for outlining how it happens. I was concerned because I’m a novice and was worried I might download something fake that looks legit.
2
u/somethingLethal 1d ago
Interestingly enough, a few years ago exactly what I’m describing happened to the codecov package. When it came out, I commented on the post with the solution, here: https://www.reddit.com/r/programming/s/wKcygcMPqL
You can see the bash is validating the shas of the codecov binary BEFORE installing it.
1
u/FlameOfIgnis 1d ago
Independent reproducible builds are a thing, so people can independently build from the source and verify its the same binary. After that, hash is enough. Also, SLSA
1
10
u/chcampb 1d ago
Genuinely curious if they can use decompilation of nvidia binaries in order to understand GPU behavior, then use that understanding to patch Linux
I don't think the behavior itself is protected, it's a statement of fact, as long as they aren't using the decompilation itself to generate code or using any patented techniques.
2
u/FlameOfIgnis 1d ago
There is already an open kernel module repository for a few years now, although the firmware and userspace driver is still closed source. Nouveau has open userspace drivers, and afaik some of the firware although there are still proprietary blobs in the firmware.
I don't know man, I think at this point god himself could swoop down from the heavens and still couldn't fix Nvidia's issues
1
u/chcampb 1d ago
That is what I am saying, binary blobs aren't closed anymore from a "what needs to be done" perspective.
2
u/FlameOfIgnis 1d ago
I know a lot of people are very new to the reverse engineering scene, but I've been doing it for a decade, I was there the day Ghidra was open sourced and I've been using Ghidra MCP since pretty much Opus 4.6 era to do what people have been hyping for the last week to do with REA.
I can promise you it's not as straightforward as you think and binary blobs are exactly as closed as they were before. Compilation and decompilation are not bijective and a lot of information is lost during compilation. Decompilation doesn't just give you a clean and understandable source code that you can also freely edit and recompile.
2
u/porkminer 1d ago
Ghidra is amazing. Decomp can be incredibly complex and obtuse so I get why people want to use AI for it. That being said, ghidra is amazing. All this AI decomp stuff is just LLM tooling for ghidra so you can offload the tedious part. I've only done decompilation as a curiosity so I have no need for it, just ghidra is enough by itself.
6
u/kkingsbe 1d ago
That’s what hashes are for… this is a solved problem lol
5
u/Background-Wafer-548 1d ago
Just today, an incident was published where both binaries and hashes were compromised: https://thehackernews.com/2026/10/hackers-hijack-five-ovhcloud-cli.html
It's no substitute for compiling yourself.
2
6
u/jventura1110 1d ago
Why? It would be so much faster and cheaper to compile yourself and then check the hash?
Plus, reverse engineering would produce entirely different code than the source.
2
u/phylter99 1d ago
Fully verifiable executables are something people have been chasing for a while. That is, a way to verify that specific source produced a specific executable. While I’d hope there’s a better way, I’m not sure this is entirely a bad thought.
2
u/Dornith 1d ago
How do you prove that the "decompiled" version actually corresponds to the original?
I promise you the original Linux source code is in the training dataset, probably multiple times over. It's entirely possible that once the pattern of "this is a Linux kennel" is established it will just output what it expects a decompiled Linux kennel to look like.
1
u/Background-Wafer-548 1d ago
Agreed, that's definitely a possibility. I suppose you could only really prove a negative, i.e. that it does not correspond if it doesn't, and substantiating how.
1
u/Fit-Stress3300 1d ago
There are some deep technical mathematics that can be used to prove a binary fully represents source code.
1
u/Dornith 1d ago
Wouldn't it be easier to do that math on the actual source code rather than the LLM's recreation of it?
1
u/Fit-Stress3300 1d ago
As far as I remember from my compiler classes, this problem is not absolutely provable, it is a NP Complete class of problem.
1
u/Dornith 1d ago
That doesn't make sense though.
If the original source code is too difficult to verify that the binary matches, then any accurate recreation of the source code will have the same problem.
So either you end up with a "decompiled" version of the binary that you know doesn't actually reflect the binary and is therefore worthless, or you get a "decompiled" version of the binary that may or may not reflect.
There's is no situation in which you get a decompiled program that you know is correct. At best, you can prove the LLM fucked up.
1
u/Fit-Stress3300 1d ago
The code doesn't need to be that complicated to have trillions upon trillions of states. So you can't run an exhaustive search over all that space.
I'm not a expert. This is just what I remember from classes I barely passed 20 years ago.
1
1
u/skilliard7 7h ago
You can achieve the same thing with a signature/hash or just recompiling from source yourself
1
1
u/golfstreamer 1d ago
This seems like a really bad solution to a problem that has better solutions.
0
u/Odd-Government8896 1d ago
Because you dont understand what they are saying. They are talking about using the source as an evaluation data set to evaluate how well a coding agent is able to reverse engineer something.
2
u/golfstreamer 1d ago
Well if it's a test of reverse engineering capabilities that's good. But the way it read makes it sound like he was suggesting a security check to verify the correspondence between the binary and the source code.
1
u/somekindatog 1d ago
Tell me you don't know what signatures are without telling me you don't know what signatures are
1
u/PositiveInfluence69 1d ago
Lots of binary compilations happening on local devices without ecc ram.
1
u/Seeker_Of_Knowledge2 22h ago
It is just that the LLM is bound to have oprn source in the training data which mean it is biased to some extent
1
u/tuborgwarrior 18h ago
The best usecase is checking if they are compliant. The EU will have a field day with all these large tech companies spying.
71
u/Macaroon-Guilty 1d ago
I thought linux was open source
142
u/Macaroon-Guilty 1d ago
Right, yea I get it...
45
14
5
26
u/sordimin 1d ago
When Windows?
13
u/donicatrumpinsky 1d ago
Well I'm sitting on the can right now. I can take a picture of my turd if you want. Basically the same as the Windows source code, just way more streamlined and optimized.
2
8
u/StandardIssueDonkey 1d ago
I read this as an adorable puppy crying at a rain stormed Window. It's been a long day for me. But thank you.
4
u/slayer991 1d ago
if they could do that for Windows and strip out all the telemetry and co-pilot crap, I'd consider using it again.
2
u/AssociationShoddy785 22h ago
Tbf you can already debloat and remove a lot, including copilot. There are tutorials on youtube
2
u/slayer991 22h ago
I'm well aware and have done so on my wife's machine. It shouldn't be necessary.
1
u/Dinokauris 19h ago
Even Microsoft has already abandoned Windows on the server side, they run Linux on their Azure Cloud Servers, so they are making most of their revenue on Linux platform. They have a Linux distro of their own (Azure Linux). Maybe they will download this reverse engineered Linux source and build a consumer version of it, "Windows Linux".
19
u/Key_Instruction3373 1d ago
Isnt Linux Open source?
17
14
u/WhiteBat_8416 1d ago
nope. very closed source
Linus is a secret Apple agent
6
6
0
6
11
u/mattk404 1d ago
Next they just need to implement fully in rust.
3
u/stefan_lago 1d ago
I'd prefer a Python port....🤠
1
u/mattk404 1d ago
Of the Linux/OS kernel!? I love me my Python (primary language) but no interpreter is getting ring 0 😊
1
7
u/mxldevs 8h ago
Finally, an open source version of Linux!
1
u/burtonmadness 2h ago
I'm a (not a) lawyer for a now defunct company "Novell" and would be very interested in seeing whether there is any copied source code in "this Linux" SysV clone.... /s
9
u/Obvious_Tree3605 1d ago
This is huge. We’ve reached AGI. The singularity is here. Time to ban all open weight models and bomb their labs.
2
4
3
2
2
2
u/Machine2024 1d ago
Notice the number is only output tokens . So the real number is ×100 that considering cache tokens at 95% and input at 4%
2
2
3
u/Both-Chemical9747 1d ago
- Linux is open source, what more can you do with it?
- That page is the official linux kernel page that has been there for ages.
9
5
4
u/howtoliveplease 1d ago
Are you trolling? 😂 Linux is open source. No reverse engineering required.
1
3
3
u/Huge_Leader_6605 20h ago
Are you familiar with the concept of a joke?
2
2
2
u/jshmoe866 1d ago
This is hilarious marketing lol
1
u/Both-Chemical9747 1d ago
wdym?
3
2
1
2
2
1
1
0
1
1
1
u/infinitefailandlearn 5m ago
In a weird reverse psychology way, this joke could easily be used as a scam. Click link and fake the website. People would fall for it.
1
u/Realistic_BigAwesome 1d ago
Hmm... low key want to try to reverse engineer windows 10 now... and make an alternative to the godforsaken hellhole that is 11.
1
1
1
1
1
1
1
1
1
1
u/Zedo_TheOnly_One 1d ago
Real question, would it be possible to decompile windows and make a fully debloated version? I read somewhere that it's basically impossible and I know nothing about kernels.
1
1
1
1
1
u/reddit-tracking 18h ago
Common sense seems to have left the chat
Would it not have been smarter and more valuable to:
1) Turn things into clean-room data
2) rewrite the whole thing in rust
------
yall are going to laugh at me if you see this, but I kinda did this with FBSD
Why?!
I wanted to redo the scheduler and completely remove polling and buffers for HFT workloads
Slightly work related and slightly academic
1
1
1
u/AlexRaven0491 13h ago
the fact that this comment section isn't 100% filled with joke responses to this obvious satirical post, shows me everything I need to know about AI enthusiast communities.
1
u/Man-on-rock 1d ago
just don't type kernal.org like just did ... haha
2
1
1
u/Machine2024 1d ago
What a waste of tokens . At least do something fun
Why not one try the reverse engineering thing with app ?
Add the missing features to mac os and make open source and runs windows app maybe ?
Merge window with mac 🤣
1
0
u/Nuggyfresh 1d ago
I'm glad that AI can reverse engineer things, and I use Claude daily (and love it) but I just don't get it.
This is something that confuses me about AI regularly: it can do impressive things, but reverse engineering Linux doesn't help anybody. Solving obscure math problems doesn't help anybody!
I get that Claude is a great programmer, and I get that he can write a paper, or identify a tree. But these specifically leading-edge aspects of AI that gobble a trillion tokens need to start producing meaningful advances.
I'm not saying they need to make a room temp super conductor or whatever. But give us something.
-1
0
151
u/Jeoh 1d ago
They even got the version history. Incredible.