Check Point Research (CPR) successfully utilized a Generative AI tool to drastically reduce the time needed to reverse engineer a new, heavily obfuscated variant of the XLoader malware. The AI-powered approach enabled analysts to deconstruct the malware’s complex code in under two days, a task that was estimated to take more than a week using traditional manual methods.

The Challenge: A Complex XLoader macOS Variant

The investigation began when CPR encountered a new version of the XLoader malware, which was written in the C language and compiled for macOS. The primary challenge resided in the malware’s main function, a massive piece of code containing approximately 360 basic blocks and numerous obfuscated API calls. The primary objective for the researchers was to deobfuscate this function to understand the command-and-control (C2) communication protocol and ultimately help victims. Initial analysis projected that a full manual reverse engineering effort would require more than a week of dedicated work by a skilled researcher.

The Solution: AI as a Force Multiplier

To accelerate the process, CPR employed an in-house tool based on OpenAI’s GPT-4 model. The researcher fed snippets of the malware’s assembly code to the AI, which in turn provided high-level analysis and C-like pseudo-code. This iterative process allowed the human analyst to bypass the tedious, low-level work of deciphering individual instructions. The Generative AI successfully identified and explained critical components of the malware, including its string decryption routines and the logic used to resolve API functions. By handling the granular analysis, the AI acted as a force multiplier, freeing the researcher to focus on the overarching logic and strategic direction of the reverse engineering process. This collaboration reduced the total analysis time to less than two days, leading to the rapid development and release of a public decryption tool for those affected by XLoader.

Source: https://research.checkpoint.com/2025/generative-ai-for-reverse-engineering/