Reverse Engineering with AI: Your Decompiler Can Lie to You
Year: 2026
Type: article
Abstract: An engineering article by Alexander Panasenko on using XRef, his open-source native binary analyzer, to answer a narrow reverse-engineering question in a stripped executable: which code changes the values associated with a set of serialized keys? This is the manuscript-style PDF edition of "Reverse Engineering with AI: Your Decompiler Can Lie to You", originally published at prod.codes on 6 November 2026. The 12-page PDF edition was prepared on 6 November 2026 and contains the complete article text, eleven code listings, three diagrams and clickable source links. The article follows an evidence chain from key strings to call sites, input-relative field offsets and ranked candidate writer functions, and then checks the selected candidate against its instructions, pseudo-C and callers. It distinguishes an address calculation from a loaded value, an observed access range from a struct declaration, and matching offsets from type evidence. In the public example, 2,000 uncalled decoy functions write the same offsets as the real writer; the article explains, from the XRef 0.4.0 scoring code, why the real function ranks first (a shared caller with the serializer) and why ranking still does not replace instruction checks. It also discusses root-pointer filters, explicit coverage and truncation flags, safe index reuse, a historical pseudo-C flag-calculation bug (issue 117, fixed before 0.4.0) in which the pseudo-C read literally returns 99 where the machine code returns 4, and a seven-step workflow an AI agent can follow. The walkthrough reuses an existing public recording made with the published XRef 0.4.0 Linux executable on 5 November 2026 (recording commit 2f01e7ba8d9ccfab08f055cce3119e95dd1504bb). The input is a synthetic generated C and x86-64 assembly program built with GCC 13.3.0 and stripped. No new run was made for the article. It demonstrates a method; it does not report a new benchmark, a comparative accuracy study, production measurements or results on real-world Rust applications. This deposit is a technical note and PDF edition of an already-published engineering article. It is not a journal or conference publication and has not undergone external scholarly peer review. It is separate from the XRef software archive (10.5281/zenodo.23968336). Alexander Panasenko is the author of XRef. No additional author, institutional affiliation, funder or journal acceptance is asserted. Original article: Reverse Engineering with AI: Your Decompiler Can Lie to You. Public recording: field-synthetic walkthrough. Project website: xrefcode.com. Source code: github.com/alex09x/xref. Author profile: Alexander Panasenko. The article/PDF license is separate from the MIT OR Apache-2.0 license of the XRef software.
Author: Panasenko, Alexander
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7225465320