Reverse Engineering with AI: Your Decompiler Can Lie to You

A walkthrough using XRef 0.4.0 on a synthetic stripped C/assembly program shows how serialized field names can be traced to offsets and candidate writer functions, but that 2,000 uncalled decoy functions write the same offsets and earn the same 40-point write score as the real function, which only ranks first via a 10-point call-graph bonus from sharing main as a caller. The article stresses checking every conclusion against machine instructions and call sites, distinguishing addresses from loaded values, and treating an access range as not a struct declaration. It also notes that a historical XRef reproducer produced pseudo-C returning 99 where the machine code returns 4, and that empty or truncated results must report coverage limits rather than be read as proof.