From Static Analysis to Dynamic Debugging: Reverse Engineering in the Agent Era

If one day someone asked you to reverse-engineer an application, an app, or a website, what would you do?

Two years ago, I probably would have been completely at a loss—or, at the very least, I would have run into problem after problem. I might have thrown the whole thing into an AI chat box and asked it to help me find a direction. Honestly, that approach was incredibly inefficient, and it was easy to miss important details.

But now we have real AI in the form of agents—or, more specifically, Coding Agents—and that changes everything.

Finding the Right Toolchain#

So how exactly do we use an Agent to carry out reverse-engineering work? The answer is actually quite simple: the most important thing is to give the Agent the right hands and feet for the job.

Most Coding Agents today support two common ways of extending their capabilities: Skills and MCP. For reverse engineering, however, MCP is generally the better fit.

I mainly use two MCP servers. The first is designed for local applications and integrates with IDA Pro: IDA Pro MCP¹. The second is for web reverse engineering: Chrome DevTools MCP².

Once the appropriate MCP server is connected, you can get started very quickly.

As for the Agent Harness, I personally recommend ZCode, mainly because its MCP management is relatively straightforward and easy to understand.

For models, as of this writing, I recommend Zhipu’s GLM-5.3-Flash and DeepSeek-V4.1-Flash. First, both perform quite well and are capable at reverse-engineering tasks. Second, they offer good output speed and relatively less restrictive safety guardrails. Together, these qualities make the reverse-engineering workflow feel smooth and help the models produce useful deliverables.

One warning, though: avoid using Codex or Claude Code for reverse engineering. Here I am mainly referring to GPT-family and Claude-family models. Both families tend to have stricter safety guardrails, especially Codex; in serious cases, an account could potentially be suspended.

Getting Started with Reverse Engineering#

Once the tools are connected, we can finally start the actual reverse-engineering work. In most cases, the most important thing is knowing exactly what we are trying to reverse-engineer.

For local software, we can use IDA Pro to decompile it. Suppose, for example, that we want to reverse-engineer its database layer. We can give the model the relevant fields, table schemas, and every useful clue we can find. With that context, the model is much more likely to perform well.

If the target is a website, the process is even simpler. Connect Chrome DevTools MCP, let the model capture and inspect network traffic, and then analyze the JavaScript code. This makes it possible to investigate the site’s interfaces and endpoints much more clearly.³

Conclusion#

Although Agents have dramatically lowered the barrier to reverse engineering, we still need to follow the applicable laws and regulations. Reverse-engineering work should remain within a reasonable, lawful, and explicitly authorized scope. Do not use these techniques for illegal activity.

Toolchain Reference#

The tools mentioned in this article are organized below into three categories: models, MCP servers, and Agent Harnesses. Model performance and availability may change across versions, platforms, and time; the assessments in this table are based primarily on my own experience.