{
  "id": 5717135,
  "title": "Reverse Engineering Undocumented Architectures: LLM-Driven Opcode Table Extraction vs. Legacy Tooling Constraints",
  "url": "https://urgent.news/2026/09/05/reverse-engineering-undocumented-architectures-llm-driven-opcode",
  "topic": "ai",
  "section": "AI",
  "published": "2026-09-05T04:14:12.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/ddupard/reverse-engineering-undocumented-architectures-llm-driven-opcode-table-extraction-vs-legacy-20kb"
  },
  "original_language": "en",
  "account": "When trying to create a custom disassembler for an unknown CPU architecture, the toughest part isn’t writing the decoding loop. The biggest hurdle is getting a structured, machine-readable opcode-to-instruction table. Most existing tools struggle with this task. Ghidra’s instruction definitions are tightly integrated into its SLAgh engine, which isn’t designed for easy data export. Standalone disassemblers like dis51 store opcode maps directly within their compiled code, making it difficult to extract them. And manufacturer datasheets often provide opcode tables in fragmented formats, requiring hours of manual work.\n\nTo address this issue, researchers have developed an alternative method using a Large Language Model (LLM) to reconstruct and export a complete opcode lookup table. The process begins with a raw binary image of the target architecture’s ROM file. The LLM, specifically Gemini in this case, takes this binary input and generates a semicolon-delimited CSV-like structure containing the opcode length, hexadecimal bytes, the disassembled assembly instruction, and a generic instruction pattern. This output is then processed to deduplicate entries based on common patterns, ensuring a clean and usable lookup table.\n\nThe deduplicated table is imported into a lightweight linear sweep disassembler, which sequentially scans the binary image. Each byte read is interpreted as an opcode index, and the corresponding disassembled instruction is retrieved from the LLM-generated table. This approach bypasses the need for complex parsing of existing tooling or manual data entry, allowing for rapid extraction of opcode tables from undocumented architectures and powering a robust disassembly process.",
  "summary": "Executive Summary When building a custom disassembler for an undocumented, legacy, or modified CPU architecture, the primary challenge is not writing the decoding loop, but obtaining a structured, machine-readable opcode-to-instruction mapping table . While one might expect to extract these tables from existing reverse-engineering frameworks like Ghidra, doing so is surprisingly difficult.…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}