From Binary to Bounty: Reverse-Engineering Your First Game Using Local AI Agents
For decades, reverse engineering (RE) has been the exclusive domain of the "wizard class." To look at a compiled Windows executable and understand why a specific variable controls a weapon's fire rate required years of studying x86 assembly, mastering complex decompiler outputs, and developing an al
For decades, reverse engineering (RE) has been the exclusive domain of the "wizard class." To look at a compiled Windows executable and understand why a specific variable controls a weapon's fire rate required years of studying x86 assembly, mastering complex decompiler outputs, and developing an almost intuitive sense of memory addresses. It was a high-friction, high-barrier discipline.
That barrier is currently collapsing.
We are entering an era where the "black box" of compiled software is being cracked open not by human experts staring at hex dumps, but by agentic AI workflows. By combining powerful local Large Language Models (LLMs) with specialized reverse-engineering frameworks, we can now treat binary analysis as a collaborative investigation. In this guide, we will walk through a workflow to perform a "reversible weapon swap" in the classic shooter OpenTyrian, using local AI to bridge the gap between machine code and human intent.
The Goal: The Reversible Weapon Swap
Our objective is simple but technically significant: we want to modify the game logic so that the player's standard Pulse-Cannon is replaced by the Zica Laser.
To do this without access to the original source code, we must:
- Identify the data structures governing weapon types.
- Locate the specific memory addresses or logic gates that trigger the weapon selection.
- Write a patcher to redirect that logic.
Crucially, we aren't doing this by reading assembly. We are doing this by directing an AI agent to use professional-grade tools to find the "evidence trail" for us.
The Technical Stack: Building Your Agentic Lab
To run this workflow locally—ensuring your proprietary analysis stays off third-party servers—you need a specific stack of tools and significant hardware.
The Hardware Requirements
Running high-reasoning models with large context windows is resource-intensive. To avoid the "latency death spiral" where the model spills from VRAM to system RAM, aim for the following:
- GPU: A single high-end consumer card with 24–32 GB of VRAM (e.g., NVIDIA RTX 4090 or 5090).
- System RAM: 64 GB minimum.
- Storage: 30 GB of available SSD space for models and toolsets.
The Software Stack
- Target Software: OpenTyrian 2.1 (Note: The original 1995 DOS version is incompatible with this Windows-based workflow; you must use the OpenTyrian port).
- The Brain: Qwen3.8 27B running via Ollama. We chose this model because of its superior reasoning, coding proficiency, and ability to perform tool-calling.
- The Orchestrator: OpenCode, a coding agent designed to interact with external environments.
- The Bridge: REA (Reverse Engineer Anything), which allows the AI agent to command analysis tools.
- The Microscope: Ghidra, the industry-standard reverse engineering suite, which REA will run in a "headless" mode to feed data back to the agent.
Step 1: Configuring the Local Brain
Before starting the analysis, you must prepare your LLM. Reverse engineering involves massive amounts of data—thousands of lines of pseudocode and deconstructed functions. To prevent the model from "forgetting" the beginning of the file by the time it reaches the end, you need to manage your context window carefully.
While Qwen3.8 supports up to 256K tokens, a massive context window creates a massive VRAM footprint. If your VRAM is exceeded, Ollama will offload layers to your CPU, causing performance to plummet.
Pro-Tip: Managing Context via Ollama You should create a dedicated Ollama profile for these tasks. While the full instructions for creating high-context profiles are complex, the general rule is to scale your context window up until you hit the VRAM ceiling, then back off slightly to maintain speed. If you find the agent is losing its train of thought, you may need to fallback to a more conservative 32K context window to ensure stability.
Step 2: The Agentic Workflow in Action
Once your environment is live, you don't start by typing code. You start by giving the agent a mission. Using PowerShell on Windows 11, you initiate the OpenCode agent and point it toward the OpenTyrian.exe binary.
The Investigation Phase
The agent begins by using REA to trigger Ghidra. Instead of you manually navigating through a forest of assembly instructions, the agent performs the following loop:
- Scanning: The agent asks REA to run a search for strings or constants related to "weapon" or "cannon."
- Decompilation: Once a potential area of interest is found, the agent commands Ghidra to decompile the machine code into human-readable C-style pseudocode.
- Mapping: The agent reads the pseudocode, identifies the data structures (e.g., a
structthat defines weapon properties), and maps out how the game distinguishes between a Pulse-Cannon and a Zica Laser.
The Evidence Trail
The beauty of this method is that the AI provides an "evidence trail." If the agent claims that memory address 0x0045F120 controls the weapon type, it isn't just guessing; it is citing the pseudocode it just extracted from Ghidra. You, the human, act as the supervisor, verifying the logic as the agent presents its findings.
Step 3: Writing the Patcher
After the agent has successfully mapped the weapon logic, the final stage is the most rewarding: the modification.
The agent uses its coding capabilities to write a small, standalone patcher. This script doesn't rewrite the whole game; it simply targets the specific offsets identified during the analysis phase. It might instruct the game to jump to a different instruction set or overwrite a specific byte that toggles the weapon ID.
# Conceptual example of what the agent might generate
# to patch a specific offset in the OpenTyrian binary.
$filePath = "C:\Games\OpenTyrian\OpenTyrian.exe"
$offset = 0x0045F120 # The address identified by the AI
$newByte = [byte]0x05 # The ID for the Zica Laser
$bytes = [System.IO.File]::ReadAllBytes($filePath)
$bytes[$offset] = $newByte
[System.IO.File]::WriteAllBytes($filePath, $bytes)
Write-Host "Weapon swap patch applied successfully."The Democratization of Discovery
This workflow represents a fundamental shift in software analysis. We are moving away from the era of "expert-only" binary inspection and toward a model of "agentic investigation."
By using local models like Qwen3.8, we remove the privacy concerns of uploading sensitive binaries to the cloud, while the REA/Ghidra integration provides the "eyes" the LLM needs to see into the machine. You no longer need to be a master of assembly; you need to be a master of intent. You provide the goal, and the agent navigates the complexity.
While there are still hurdles—such as the massive VRAM requirements and the need for precise context management—the path is clear. The tools to deconstruct and reimagine software are no longer locked behind a decade of specialized study. They are sitting on your local drive, waiting for your command.
