XRef demo: decompiled pseudocode may not match machine code
Understand this story
Security researcher alex09x used XRef 0.4.0 to demonstrate a workflow that traces from a serialized field name to the writing function, and used it to show that pseudocode generated by a decompiler may not match the machine instructions: in one historical reproduction, the pseudocode literally read as returning 99, while the machine code actually evaluated to 4. The demo uses synthetic C and assembly programs containing 2000 decoy functions, and states that offset matching alone yields a large number of plausible-looking wrong answers, and that the real function must be verified instruction by instruction in combination with the call site. The author states that the demo was produced on November 5, 2026, and that the commands and output are reused in the article without being re-run; the workflow does not attach to a live process, nor does it observe writes at runtime. The author states that this is a method demonstration, not a benchmark.
AI overview based on source reports · Updated 12 min ago
Coverage timeline
Follow the coverage to explore different perspectives.
- Hacker News AIReverse Engineering with AI: Your Decompiler Can Lie to You
A walkthrough using XRef 0.4.0 on a synthetic stripped C/assembly program shows how serialized field names can be traced to offsets and candidate writer functions, but that 2,000 uncalled decoy functions write the same offsets and earn the same 40-point write score as the real function, which only ranks first via a 10-point call-graph bonus from sharing main as a caller. The article stresses checking every conclusion against machine instructions and call sites, distinguishing addresses from loaded values, and treating an access range as not a struct declaration. It also notes that a historical XRef reproducer produced pseudo-C returning 99 where the machine code returns 4, and that empty or truncated results must report coverage limits rather than be read as proof.
Activity for this story
Not enough continuous observations to show a trend yet.