Reverse engineer binaries with a lead model directing small local workers

A team put DeepSeek V4.1 Flash in charge of four Qwen3.5-9B workers that rewrote every function of two compiled C programs in Python, for $3 to $3.60 a run, but slower than DeepSeek alone.

Done withCustom agent· Oct 27, 2026

What they did

The posters wanted to know whether small open models can do reverse engineering if a bigger model organises them. They built a minimal ipython harness with DeepSeek V4.1 Flash as the lead: it disassembled each binary, named functions, recovered signatures and memory layout, and posted tasks with hints to a shared board. Four Qwen3.5-9B workers each took a task and rewrote one function in Python. A diff_test oracle ran about 600 cases through the original function and the rewrite, comparing return values and every byte of state, and workers could only submit at a 100% match. The lead was allowed to edit the workers' prompts and tools. The targets were two small C programs they had generated with Claude Code and compiled; the team only saw the binaries. DeepSeek also ran each job alone as a baseline.

How it went

Both runs recovered every function: 38 of 38 for a logo animation and 56 of 56 for a space shooter. The team cost $2.97 and 86 minutes on the first, against $0.87 and 14 minutes solo, and $3.60 and 100 minutes on the second, against $3.28 and 54 minutes over four solo launches. About 40% of functions were escalated back to the lead. On the shooter the lead rewrote the workers' instructions three times, adding house rules, fixes for unsigned comparisons and argument counts, and finally a lookup tool it wrote so workers could query signatures and offsets.

Worth knowing

The authors call it two data points, not proof. The binaries were not stripped, so function names made the lead's mapping much easier than on real software, and the programs were small and AI-generated. On jobs this size the coordination was pure overhead. A commenter asked how bad worker output is kept out of shared state; the oracle gate is the answer here.

Try it

With Custom agent· 7 parts to fill in

You are the lead in a team that reverse engineers [path to a binary I own]. Disassemble it, name the functions, and recover signatures and memory layout. Post one task per function to [a shared task board or file] with hints. Hand each task to [number] smaller worker models running [local model]. A rewrite in [target language] is accepted only when [a test oracle that runs the original and the rewrite on the same inputs and compares outputs and state] passes 100%. If workers keep making the same mistake, update their instructions or give them a tool. Escalate a function to yourself after [number] failed attempts. Stop when every function passes and report cost, time and how many were escalated.

Square brackets are the parts to fill in. The prompt is ours; the story is theirs.

Where they said it

Related