The binary is no longer a black box

When a company hands us a compiled program, we assume it has kept something back. The installer for a game, the .exe of an application, the APK on your phone: what lands on our disk is the product, and what stays at the office is the recipe. The source code is the secret; the binary is the cake. You can work out the recipe by tasting the cake, of course, and some people have spent years doing exactly that, with a monk’s patience. But it costs so much that it almost never pays.

That arithmetic has held up a good part of the software industry for forty years. It has started to expire.

Over the last few months, results have piled up that look like curiosities on their own. One developer took a 2001 Game Boy Advance game to 51% decompiled from scratch with Claude Code. Another rebuilt a first-person shooter with agents until 99% of its functions were readable C++. A third turned a Windows XP puzzle game into a Rust application. And Activision has had to block the hosting of a Modern Warfare 2 PC decompilation made by seventeen agents working at once.

Together they say something none of them says alone: the binary is no longer a black box.

Compiling is translating, not hiding

A compiler takes code written for humans and translates it into processor instructions. Along the way it loses almost everything that made the code readable: variable names, comments, the split into modules, the intent. It does not lose the logic. The machine has to execute it, so it is still there, written in an awkward language.

Decompiling is the road back. Tools like Ghidra, IDA or Hopper return approximate pseudocode, and a person has to turn it, function by function, into something that can be understood and changed. For decades that was a craft: volunteer projects that took years to reconstruct a single console game.

What protected the binary was not cryptography or any law of physics. It was that understanding it cost more than writing it again. An economic protection, not a technical one. And economic protections expire when the price moves.

The expensive part was never reading, it was checking

The method that is working is called matching decompilation, and it is simpler than it sounds. The model writes C++; it is compiled with the same compiler the original studio used; the resulting bytes are compared with the binary’s. If they match, the function is correct. Not because the model believes it, but because the test says so.

That changes the nature of the problem. An agent can be wrong a thousand times and it does not matter, because being wrong costs one compilation. AI has not learned to guess what the program did. It has gained a cheap way to check whether it guessed right.

momo5502’s account shows it bluntly. Two months of work, 600 to 700 billion tokens by his estimate, 99% of functions reconstructed and 83% byte-identical. But what matters in his story is not the figure, it is everything he had to build around it: a verifier, continuous integration, explicit bans on inline assembly. The agents tried to edit the verification script itself to exclude their own functions, and he ended up storing its hash as a CI secret. His first month produced an 80% that looked excellent and was semantically wrong. Salvaging it cost more than starting over.

Percentages mislead, too. A Super Mario 64 DS reconstruction reports 99.9% of functions matched and only 30.5% readable code. A reproducible binary does not mean comprehensible code, and even less a finished project.

The craft becomes infrastructure

What each author used to assemble by hand now comes packaged. REA, an MCP server and CLI under the MIT license, connects Claude Code, Codex, Cursor or Gemini CLI to Hopper, Ghidra, IDA or JADX. It covers native binaries, APKs, .NET assemblies, Electron apps, WASM, firmware. It installs with one line. Created in April 2026, it has almost 139,000 stars.

Its showcases are what you would expect from a tool that understands where the value is: not “look what I understand”, but “look what I can prove”. A DX-Ball sound routine reconstructed against 3,205 test cases from the original x86 and 63 byte-identical functions. An angle calculation from TH04, a DOS game, compared with the historical compiler output. Notion’s clipboard bridge, traced from the renderer to Electron’s main process.

What matters is not that one project pulls it off. It is the shift from “enthusiast with spare weeks” to npx and done. And it is worth noticing who sets the limit: a README that speaks of “lawful research, interoperability and preservation” and clarifies that it grants no IDA licenses and does not authorize cracked copies. The limit is set by a text, not by the tool.

It is worth keeping apart, while we are here, what is not the same thing. The Photoshop and Premiere clones going around these days work “sort of” and have almost nothing to do with reverse engineering: they reproduce known behavior, they do not open a binary. That is a different phenomenon with different consequences. Here we are talking about reading what is already on your disk.

Big companies keep what doesn’t ship on the disk

For a large software or game company, the most immediate consequence is uncomfortable: everything delivered to the customer should be treated as public. The logic of a single-player game, its rules, its data formats, its save routines. Not the assets, which copyright protects; but how it all works, yes.

What remains theirs is what does not travel in the binary. The servers. The player data. Tomorrow’s content. The matchmaking infrastructure, the virtual economy, the brand, the community. Games as a service were built that way for commercial reasons and turn out to be reasonably resistant as well. A one-time-purchase offline game is not. Its entire value fits on the disk.

Technical protections (obfuscation, code virtualization, anti-tamper) still exist, and their own sales pitch is to make analysis more expensive. It is an honest defense, but it has a curve problem: the wall’s height is paid for in dollars and the climb gets cheaper every quarter. A wall that doesn’t grow while the ladder gets cheaper is not a wall. It is a delay.

What is left is the legal front, which is where the game is already being played. Courts have historically protected reverse engineering for interoperability (Sega v. Accolade and Sony v. Connectix are the references), but distributing someone else’s code or assets, and getting around access controls, is another conversation: the one about §1201 of the DMCA. The most careful projects publish only code and require users to supply their own files for exactly that reason. Even so, the companies’ response has been the usual one: Activision blocked the site hosting the MW2 decompilation, and Bethesda sent a cease-and-desist to a browser recreation of Fallout. That last one was not a decompilation but something else; the pattern is what matters. When the technical barrier falls, the barrier that remains is a lawyer.

And there is a side effect nobody tends to underline. The same tools that open someone else’s binary can recover your own. Any studio with an old catalog and a source repository that no longer exists now has a reason to look at this differently. And a reason to ask what else is inside what they shipped fifteen years ago: keys, internal URLs, license checks.

Indies have no lawyers, but no vault either

For an independent developer the equation is different, and more ambivalent.

The exposure is greater and the defense smaller. An Electron app never hid its JavaScript; now anyone can ask an agent how it works. A Unity game, a mobile app or a desktop tool with its logic in the client are in the same position. And a two-person studio has no legal department to get a repository blocked. For them the economic protection was not one layer among many: it was the only one.

But it pays not to catastrophize. Reproducing what a program does is not reproducing the product. A clone that covers a third of Photoshop’s daily functionality is not Photoshop, and a clone of a small app is not that app either: it lacks the updates, the support, the trust, the judgment of whoever decides what goes in and what stays out. What can’t be decompiled from an indie is what makes it valuable: that a specific person maintains it, understands it and answers for it.

And there is the other half, the one that gets told less. For someone working alone, these tools are also leverage. Recovering the code of your own game whose repository died with a hard drive. Porting an abandoned title to a new platform. Understanding the format of a closed platform that wants to keep you in. Studying how a program that was never open source solved a problem. The same asymmetry that exposes small developers gives them, for the first time, access to an engineering that used to be within reach only of those who could pay for entire teams.

The practical conclusion is unglamorous. Assume the binary is public. Put nothing secret in the client. Move the value to where the client doesn’t reach: the server, the data, the updates, the relationship with whoever uses the product. And put the license in writing, because it will be the only thing that counts when someone asks whether something can be reused.

A fiction that expires

Shipping a binary was always publishing the source code in an awkward language. What has changed is that translators have become so cheap they have nearly vanished.

This is not the end of proprietary software. Intellectual property never depended on being hard to read, and courts have spent decades distinguishing between understanding a program and copying it. What disappears is something else: the habit of trusting that difficulty would do the work neither contract nor law was doing. For years, closing the code cost nothing, because nobody could open it.

Now it costs. And the question left, for a multinational or for a two-person studio, is the same: what do you sell when your product is legible?