I Asked a Frontier LLM to Recover Secrets from My Decompiled Build
The clean way to protect application logic is to keep it on a server, out of reach. When it has to live in the client, anyone can pull apart and analyze the compiled app on their device. Obfuscation cannot make recovery impossible; it can only raise its cost. Making a secret unreadable in a decompiler leaves an awkward question: how hard is it to recover? That was the question I wanted to answer…
In an attempt to gauge the efficacy of his own build hardening techniques, a reporter enlisted the assistance of a frontier large language model (LLM) to investigate the contents of a decompiled application. The primary objective was to determine if an adversary could recover sensitive data, such as configuration values, from the compiled artifact without access to the master key that generates the decoding keys.
Upon executing the test, the reporter observed that the application utilized an XOR encoding scheme to safeguard the data. Each value was individually encrypted using a working key derived from a single 32-byte master key at runtime. Crucially, these working keys were never stored within the binary, adding an additional layer of complexity to the recovery process.
The encoded values within the binary appeared as numeric byte-array literals, resembling hashes, and lacked any recognizable strings. This made it challenging for an investigator with a basic understanding of the implementation to determine their purpose or significance. Furthermore, the derivation process deliberately avoided shared prefixes among related values, which would have otherwise provided useful context to an adversary attempting to make connections.
The reporter also implemented measures to decorrelate similar secrets, ensuring that identical-looking values did not necessarily share a common purpose. This was achieved by stripping shared prefixes during the derivation process, thereby making it more difficult for an investigator to cluster values and infer relationships.
To further bolster the security of his build, the reporter established an adversarial court comprised of three LLM agents operating in a structured manner. These agents took on distinct roles, such as code examination, network and data analysis, and library investigation, to collectively establish the capabilities of the artifact before drawing conclusions.
A prosecutor then argued for potential findings, while an advocate posed challenges to these interpretations, aiming to identify missing links or provide benign explanations.
Ultimately, the adversarial court process helped to highlight the tensions and uncertainties inherent in evaluating the security of a decompiled build. By distributing responsibilities among multiple agents, the reporter was able to create a more comprehensive and nuanced assessment of the effectiveness of his hardening techniques.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
