Black Hat USA 2025 | Clue-Driven Reverse Engineering by LLM in Real-World Malware Analysis

IDA Pro feat. MCP (Model Context Protocol) is truly amazing! Through interactive chat windows, LLM can automatically complete reverse engineering tasks and even assist in generating malware analysis reports. At first glance, this technology seems to offer malware analysts the ability to "clock out early." But is this truly the case? Not quite! Malware analysis is not a CTF competition, the adversaries certainly won't reveal the correct answer. In the absence of ground truth, analysts must meticulously trace every step performed by the LLM, deeply understanding why the LLM reached a particular conclusion. Moreover, LLMs' generative nature tends to prioritize producing outputs whenever possible, even when lacking sufficient information, resulting in reasonable yet incorrect answers. In complex programs with highly interdependent functions, incorrect answers can snowball into catastrophic mistakes, ultimately leading to entirely inaccurate reverse engineering results. Therefore, blindly relying on LLM output is unreliable. Analysts often need to spend even more time verifying and correcting these outputs to ensure accuracy and reliability. To address these challenges in LLMs in automated malware analysis, we propose a clue-driven reverse engineering framework. By generating high-quality clues, such as API information and magic constants, in decompiled code. Then, devising analysis strategies based on these clues, our framework effectively reduces the errors generated by LLMs in uncertain situations and significantly improves the accuracy and stability of the results. Additionally, we designed validation mechanisms by integrating entropy-based evaluation methods with attention tracking technology to ensure that LLM outputs are based on reliable clues, preventing the further propagation of errors. This study demonstrates the potential of combining clue generation, clue-driven analysis strategies, and stabilization mechanisms to deliver novel, efficient technical solutions for malware analysis. By: Tien-Chih Lin | Research Team Lead, CyCraft Technology Wei Chieh Chao | Senior Cybersecurity Researcher, CyCraft Technology Zhao-Min Chen | Cybersecurity Researcher, CyCraft Technology Presentation Materials Available at: https://ift.tt/Lm5WafA

source https://www.youtube.com/watch?v=Ofo2RRaqVwU