I have had an influx of these game decomps on my Instagram recently and was wondering why so many were appearing out of nowhere. Shortly after that influx, the open-sourcing Adobe Suit thing happened and again its on my feed. Most of these projects use AI to make it easier to decomply these things and understand why it was used but I am a bit worried about the implications. As in, will these decomps actually be stable? Will they be maintained? Will companies start lobbying for AI laws harder now, in a way it benefits them and not us?
I personally stay away from AI due to the many issues AI brings but I am a fan of people fighting big companies but is this the way to do it?
For older games, where source code may not exist anymore and modding and preservation are severely hampered by this lack of source code, I can see the use of AI to build reverse engineered source code as a useful tool. For modern or brand new games, it seems like an irresponsible use of the tool. And there will be all kinds of legal issues surrounding the posting of the reverse engineered code online.
I can also see this as having some utility for checking if closed source applications are borrowing code from open source projects without proper attribution and/or following of the open source license. I would think that commercial projects would see this as an especially scary prospect as they begin to incorporate AI into their development pipelines. Could GPL’d or Copy Left source code work its way into the closed source project and end up opening the company up to liability? If so, this sort of reverse engineering may be the only way that is discovered. Which, may mean that this sort of analysis has a very useful purpose. Though again, posting the resultant code online seems kinda sketchy.
As another tangent, I’ve personally used AI reverse engineering for examining malware. I’ve run across samples in my work which I could deobfuscate and reverse engineer by hand. But that will take considerable time (hours at minimum, days on the outside). During a security investigation, time is often a luxury we don’t have. Being able to use an AI agent with access to REMNux and the REMNux MCP can cut hours to days off the initial analysis. Sure, there are always issues with hallucinations and the agent just failing at its analysis (I’ve already seen both). But, it can give a first pass at something very fast. That may mean IoCs and TTPs we can hunt on quickly to validate scope and containment.
AI is a tool, it’s going to be used for things both good and bad. And it’s going to take us a while to sort out the details and safeguards around it as we go.