Как научить AI понимать ассемблер: Декомпилятор с ChatGPT 5.2 и IR лифтингом

__int64 sub_401A50()
{
  __int64 v0;
  __int64 v1;
  
  v0 = sub_401B20(2LL, 1LL, 0LL);
  if ( v0 < 0 )
    return 0xFFFFFFFFLL;
  v1 = v0;
  *(_WORD *)(v0 + 2) = sub_402C10(0x1F90u);
  *(_DWORD *)(v1 + 4) = sub_402D50("192.168.1.100");
  if ( (unsigned int)sub_401C30(v1, v0, 16LL) < 0 )
  {
    sub_401D40(v1);
    return 0xFFFFFFFFLL;
  }
  return (unsigned int)v1;
}

from capstone import *

# Байты из .text секции
code = b"\x55\x48\x89\xe5\x48\x83\xec\x10"

# Инициализация дизассемблера
md = Cs(CS_ARCH_X86, CS_MODE_64)

# Дизассемблирование
for insn in md.disasm(code, 0x400000):
    print(f"0x{insn.address:x}: {insn.mnemonic} {insn.op_str}")

int function_400000(int arg1) {
    int var_4;
    
    var_4 = arg1;
    
    if (var_4 <= 0) {
        return 0;
    }
    
    return 1;
}

{
  "model": "gpt-5.2",
  "messages": [
    {
      "role": "system",
      "content": "You are expert reverse engineer. Analyze decompiled code and suggest meaningful variable names based on usage patterns. Output JSON only."
    },
    {
      "role": "user",
      "content": "Function:\n```c\nint func_401000() {\n  int v1 = socket(2, 1, 0);\n  if (v1 < 0) return -1;\n  struct v2;\n  v2.v3 = 2;\n  v2.v4 = htons(8080);\n  connect(v1, &v2, 16);\n}\n```\nContext:\n- API calls: socket, htons, connect\n- Constants: 2 (AF_INET), 1 (SOCK_STREAM), 8080 (port)\n\nProvide variable renames in JSON."
    }
  ],
  "temperature": 0.2
}

{
  "function_name": "connect_to_server",
  "function_purpose": "Establishes TCP connection to remote server on port 8080",
  "renames": [
    {
      "original": "v1",
      "suggested": "socket_fd",
      "reasoning": "File descriptor returned by socket() call",
      "confidence": 0.98
    },
    {
      "original": "v2",
      "suggested": "server_addr",
      "reasoning": "sockaddr_in structure for server address",
      "confidence": 0.95
    },
    {
      "original": "v3",
      "suggested": "sin_family",
      "reasoning": "Address family field (AF_INET = 2)",
      "confidence": 0.99
    },
    {
      "original": "v4",
      "suggested": "sin_port",
      "reasoning": "Port number field (8080 in network byte order)",
      "confidence": 0.97
    }
  ]
}

import requests
import json

class AIDecompiler:
    def __init__(self, api_key, model="gpt-5.2"):
        self.api_key = api_key
        self.model = model
        self.cache = {}
    
    def analyze_function(self, pseudocode, context):
        # Проверяем кэш
        cache_key = hashlib.sha256(pseudocode.encode()).hexdigest()
        if cache_key in self.cache:
            return self.cache[cache_key]
        
        # Формируем промпт
        prompt = self.build_prompt(pseudocode, context)
        
        # API запрос
        response = requests.post(
            "https://api.openai.com/v1/chat/completions",
            headers={
                "Authorization": f"Bearer {self.api_key}",
                "Content-Type": "application/json"
            },
            json={
                "model": self.model,
                "messages": [
                    {"role": "system", "content": self.get_system_prompt()},
                    {"role": "user", "content": prompt}
                ],
                "temperature": 0.2,
                "response_format": {"type": "json_object"}
            }
        )
        
        result = response.json()
        analysis = json.loads(result['choices'][0]['message']['content'])
        
        # Сохраняем в кэш
        self.cache[cache_key] = analysis
        return analysis
    
    def build_prompt(self, code, ctx):
        return f"""Analyze this decompiled function:

```c
{code}
```

Context:
- API calls: {', '.join(ctx.get('apis', []))}
- Strings: {', '.join(ctx.get('strings', []))}
- Constants: {', '.join(map(str, ctx.get('numbers', [])))}

Provide JSON with function_name, purpose, and variable renames."""
    
    def get_system_prompt(self):
        return "You are an expert reverse engineer. Analyze code and suggest meaningful names based on usage patterns. Output JSON only."

from concurrent.futures import ThreadPoolExecutor

def analyze_all_functions(functions, ai_client):
    results = {}
    
    with ThreadPoolExecutor(max_workers=8) as executor:
        futures = {}
        
        for func in functions:
            future = executor.submit(
                ai_client.analyze_function,
                func.pseudocode,
                func.context
            )
            futures[future] = func
        
        for future in futures:
            func = futures[future]
            try:
                result = future.result()
                results[func.address] = result
            except Exception as e:
                print(f"Failed to analyze {func.name}: {e}")
    
    return results

WS2_32.dll: socket, connect, send, recv, closesocket
WININET.dll: HttpOpenRequestA, HttpSendRequestA
ADVAPI32.dll: CryptEncrypt, CryptDecrypt

__int64 sub_401A50() {
  __int64 v0 = sub_401B20(2LL, 1LL, 0LL);
  // ... 20 строк непонятного кода
}

// C2 Communication Handler
// Connects to hardcoded server and establishes encrypted channel
int connect_to_c2_server() {
  int socket_fd = socket(AF_INET, SOCK_STREAM, 0);
  struct sockaddr_in c2_server;
  
  c2_server.sin_family = AF_INET;
  c2_server.sin_port = htons(8080);
  c2_server.sin_addr.s_addr = inet_addr("192.168.1.100");
  
  if (connect(socket_fd, &c2_server, sizeof(c2_server)) == 0) {
    return socket_fd;
  }
  return -1;
}