Malware analysts are integrating LLMs into their reversing workflows today, in real casework. The MCP integrations for IDA Pro, Ghidra, radare2, and Binary Ninja already exist and are publicly available, and analysts are using them to rename functions, triage samples, and hunt for vulnerabilities. Adoption has outpaced any measured account of where these tools are reliable and where they are not. There is also a cost problem that gets little attention: running an agent against a single sample can burn an enormous number of tokens, much of it spent having the model rediscover the same things on every binary. This session addresses both. We built an agentic malware analysis framework, tested it across multiple models and real samples scored against ground truth, and we are bringing the numbers along with the workflows.
The framework connects LLMs directly to disassemblers and decompilers through MCP, and wraps that with per-language skills for the malware families analysts actually encounter: C and C++, C#, Go, and Android. Each skill encodes what the runtime looks like, how the decompiler tends to mangle that specific target, which structures and metadata are worth recovering first, and what the model can safely ignore. The Go skill carries knowledge of the pclntab and the runtime's calling conventions. The C# skill assumes IL and metadata tables rather than native code. The Android skill separates the DEX, the native libraries, and the manifest, and knows where behavior usually hides. The skills exist for efficiency. Without them, the model relearns the same Go runtime layout on every sample and pays the same token cost to reach the same conclusion. With them, that context is supplied once and the model spends its budget on the sample.
The framework runs inside Docker containers orchestrated through an ADK agent loop. Three concrete reasons make this matter. Isolation keeps live malware analysis off the host. Reproducibility means the same container, skill, and sample produce similar starting conditions every time, which is what makes any claim about model performance meaningful. Disposability means that when an agent corrupts its own analysis state, and it will, you tear the container down and start clean rather than nursing a polluted session. The ADK loop is what lets the agent act on its own: pulling function lists, following cross-references, reading decompiled output, and issuing disassembler commands. It is also where most of the interesting failures show up when the agent is not constrained.
Function renaming and summarization on stripped binaries holds up well, but only when functions are fed with surrounding call context rather than dumped in bulk. Behavioral triage, the question of what a sample does and where to look first, is faster through the agent than manual function-list review, and the benefit is largest for less experienced analysts. Pattern matching across a binary is reliable when you specify the class of issue to look for. The per-language work also pays off on Go and Rust samples, where traditional C and C++ oriented decompilers produce walls of indistinguishable functions and the LLM-assisted workflow often cuts through what the tooling alone cannot.
The failures matter as much as the wins. Crypto identification is where the models are most confidently wrong, mapping anything stream-cipher-shaped onto whatever algorithm they saw most in training. Deobfuscation of any serious protection scheme breaks down quickly. CVE matching is the most consequential failure, because a fabricated CVE number reads with the same authority as a real one, and an analyst who puts it into a threat report has introduced an error that is hard to catch later and can misdirect incident response. Scope drift shows up throughout: left unconstrained, the agent will decide on its own that you wanted detection rules when you asked for unpacker analysis. We show each of these failure modes on screen with the actual model output.
The core of the session is a direct comparison, the same model and the same sample, run two ways. First pass is a minimal prompt with the agent left to default behavior. Second pass, we drive, selecting which functions to examine, supplying context through the right per-language skill, and constraining the output format. The model does not get smarter between passes. We get more deliberate about how we use it, and the output diverges sharply. That is the thesis as a demo rather than a claim: the analyst is the captain and the model is the crew, and analysis quality tracks almost entirely with how well it is steered. We walk the comparison side by side on real samples, and ship the demo binaries and both prompt sets with the talk.
Attendees leave learning how to do a full setup: the Docker containers, the ADK agent scaffolding, the per-language skills for C and C++, C#, Go, and Android, and the prompt templates that worked alongside the ones that did not. They can install it, run the same comparisons we ran, and extend the evaluation to their own samples and analysis tasks. They also leave with a calibrated sense of which tasks are safe to hand to an agent, which require careful steering, and which should never be trusted without manual verification. Additionally, we will open source our framework the day of the talk.
ResearchersLenin Alevski MX·Asher Davila MX
Presented at
Malware Village — DEF CON 2026