Reverse Engineering Undocumented Architectures: LLM-Driven Opcode Table Extraction vs. Legacy Tooling Constraints

When trying to create a custom disassembler for an unknown CPU architecture, the toughest part isn’t writing the decoding loop. The biggest hurdle is getting a structured, machine-readable opcode-to-instruction table. Most existing tools struggle with this task. Ghidra’s instruction definitions are tightly integrated into its SLAgh engine, which isn’t designed for easy data export.

Standalone disassemblers like dis51 store opcode maps directly within their compiled code, making it difficult to extract them. And manufacturer datasheets often provide opcode tables in fragmented formats, requiring hours of manual work.

To address this issue, researchers have developed an alternative method using a Large Language Model (LLM) to reconstruct and export a complete opcode lookup table. The process begins with a raw binary image of the target architecture’s ROM file. The LLM, specifically Gemini in this case, takes this binary input and generates a semicolon-delimited CSV-like structure containing the opcode length, hexadecimal bytes, the disassembled assembly instruction, and a generic instruction pattern.

This output is then processed to deduplicate entries based on common patterns, ensuring a clean and usable lookup table.

The deduplicated table is imported into a lightweight linear sweep disassembler, which sequentially scans the binary image. Each byte read is interpreted as an opcode index, and the corresponding disassembled instruction is retrieved from the LLM-generated table. This approach bypasses the need for complex parsing of existing tooling or manual data entry, allowing for rapid extraction of opcode tables from undocumented architectures and powering a robust disassembly process.