Breaking

Kong, an open-source tool, automates stripped-binary analysis with LLMs

July 5, 2026 at 12:01 EDT

AI Agents
Security
Open Source

Developer Amruth Niranjan has released "Kong: The Agentic Reverse Engineer," an open-source tool that combines Ghidra with LLMs to autonomously reverse engineer stripped binaries. Its hallmark is a single command that automates everything from triage to recovering function names and types.

Open Source · Kong

An "Agentic Reverse Engineer" That Cracks Stripped Binaries with LLMs

Built on Ghidra, Kong recovers function names, types and structures from executables whose symbols were removed — then carries through to deobfuscation. In its showcase, it dissected the liblzma binary carrying the notorious XZ Utils backdoor.

15 min

Full analysis time

$6.63

Total LLM cost (Opus-class)

5 / 5

Backdoor functions found (90–95%)

The liblzma benchmark, drawn to scale

Of 396 total functions, 355 were analyzed — and 308 (87%) rated high-confidence (≥80%).

396

Total
functions

355

Analyzed
(90%)

308

High confidence
≥80% (87%)

The Pipeline

Triage

→

Analyze

→

Cleanup

→

Synthesis

→

Export

Ghidra builds call graphs, cross-references and string references; the LLM is applied bottom-up along dependency order. A semantic synthesis step unifies names and structures globally, then writes results back into Ghidra's database.

Accuracy by target architecture

HIGH

x86 / x86-64 (C / C++)

MEDIUM

Go / Rust

LOWER

MIPS / PowerPC

Received Favorably

A new option for supply-chain attack detection
Automates large-scale binary analysis
Fully autonomous pipeline + global semantic synthesis

Noted Limits

Costs rise on large binaries
Low-confidence functions need manual review
Generality of deobfuscation still to be validated

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.