Local LLMs for Air-Gapped Reverse Engineers

What it does

ReverserAI is a Binary Ninja plugin that feeds decompiler output to a locally-hosted large language model—by default a quantized Mistral variant—to suggest semantically meaningful function names. It runs entirely offline, aiming to keep reverse engineering workflows inside the air gap while still using modern AI. The current release focuses almost exclusively on this automatic renaming task.

The interesting bit

Instead of hurling raw assembly at an LLM and hoping for magic, the tool uses static analysis context such as external API calls, strings, and symbols to narrow the scope and improve suggestions. It is essentially an experiment in pairing traditional program analysis with consumer-grade local inference to see where the two disciplines actually help each other.

Key highlights

• Runs fully offline on local CPU or GPU, with explicit support for Apple silicon acceleration.
• Ships with a modular architecture separating generic LLM logic from Binary Ninja-specific glue, though only Binary Ninja is supported today.
• Context-aware renaming prioritizes functions where static analysis can provide useful hints, avoiding blind guesses.
• Targets consumer hardware: roughly 16 GB of RAM and 12 CPU threads for CPU-only mode, or a GPU for faster per-query turnaround.
• The author openly flags the project as a proof of concept with limited ML expertise, framing it as a stable baseline rather than a finished product.

Caveats

• Currently limited to function renaming; broader code explanation, bug detection, and IDA/Ghidra support are listed as future work but not implemented.
• Queries can take 20–30 seconds on CPU-bound consumer hardware, or 2–5 seconds on GPU-accelerated setups like Apple silicon—hardly instant at scale.
• The author notes that local LLMs do not match cloud-based counterparts such as ChatGPT4 in performance or capability, so expectations should be calibrated accordingly.

Verdict

Worth a look if you reverse engineer binaries in sensitive environments and want a low-risk way to experiment with AI-assisted naming. Skip it if you need immediate, cloud-grade analysis speed or deep semantic decompilation beyond function headers.