Current reverse engineering setup*:
1) llama-server built with MTP support (just now merged into main)
2) unsloth qwen 3.6 35b a3b UD_Q4_K_XL MTP
3) Opencode with Superpowers and DCP
4) pyghidra-mcp
This allows for reverse engineering using Ghidra by prompting the LLM to do the heavy lifting. It will rapidly go through Ghidra-analysed functions and rename all the common ones, draw up the whole callpath, identify interfaces between secure and nonsecure areas etc. It's a complete game changer since while it's not doing anything I can't do myself the speed at which it's done is absolutely staggering compared to the manual labour.
I go from not knowing anything about the fw/flash I'm working on to have it completely broken down to where I can start looking for exploits in mere hours.
And yeah, the LLM aids in looking for those as well. So far my input to what exploits to look for is needed, but I can well see there being fine-trained or fully trained exploit-LLMs that would have that completely automated as well.
*) This is all running on a modern workstation where ~20GB of system RAM is needed in addition to the 16GB VRAM 5060Ti.
#EthicalHacking