ReverserAI: Secure Practices for Running Local Large Language Models to Assist Reverse Engineering

ReverserAI is a Binary Ninja plugin based on local large language models (LLMs). It aims to automatically generate semantic names for decompiled functions offline on consumer-grade hardware. It addresses the data leakage risk associated with cloud AI services in reverse engineering, explores new possibilities for AI-assisted reverse engineering, and provides security researchers with a privacy-safe automated auxiliary tool.

Reverse engineering relies on manual experience. Analysts need to process large amounts of assembly/decompiled code, which is time-consuming and error-prone. While cloud LLMs can understand code, uploading sensitive binary files (such as proprietary algorithms or malware) poses data leakage risks. ReverserAI was developed to resolve this contradiction using local offline LLMs.

The core features of ReverserAI include:

1. Offline Operation: All LLM inference is completed locally on CPU/GPU to ensure data privacy. The default model (mistral-7b-instruct-v0.2.Q4_K_M.gguf, approximately 5GB) is automatically downloaded on first launch, and manual model replacement is supported.
2. Automatic Function Naming: Infers semantics from decompilation output—for example, renaming sub_401000 to encrypt_user_data—to accelerate analysis and unify naming conventions.
3. Combination of Static Analysis and AI: Provides static analysis context such as call graphs and data flows to improve the accuracy of AI suggestions.

Hardware Requirements:

• Minimum: 16GB RAM + 12 CPU threads, query time takes 20-30 seconds
• Recommended: GPU devices like Apple Silicon, query time takes 2-5 seconds

Model Support:

• Mistral-7B-Instruct: Approximately 5GB RAM, suitable for fast tasks with lower output quality
• Mixtral-8x7B-Instruct: Approximately 25GB RAM, suitable for complex analysis and requires high-end hardware

Key Parameters: use_mmap (memory mapping), n_threads (CPU threads), n_gpu_layers (GPU layers), seed (fixed seed).

ReverserAI can be invoked via the Binary Ninja UI (Plugins→ReverserAI→"Rename All Functions") or command line. Processing time depends on the total number of functions. AI suggestions are displayed in the log window, and analysts can review and accept or reject them. Advanced users can adjust parameters via the gpt_function_namer.py script.

Limitations:

1. Local LLM performance is not as good as cloud models like ChatGPT-4
2. High computational resource requirements
3. The author has limited ML expertise, so there may be more optimal methods

Future Directions: Expand to IDA/Ghidra platforms; add features like encryption algorithm recognition and vulnerability detection; integrate more static analysis techniques to enhance context understanding.

ReverserAI provides security researchers with AI-assisted capabilities under privacy protection, eliminating concerns about uploading sensitive data to the cloud. It is suitable for individuals and small teams. It serves as a reference for AI applications in the security field, demonstrating technical boundaries and future directions.