Reverify checks AI claims on a binary file against its actual bytes: Reveneau

Why it mattersReverse engineering has been the workflow AI is worst at, because a wrong offset or invented struct is expensive to catch later; a tool-grounded verifier gives an agent a check it cannot trick.

Reverify, an open-source toolkit that pairs a language model with a deterministic reverse-engineering toolchain and uses the toolchain as the judge, was created on 31 August and has 662 stars and 134 forks on GitHub. It is MIT-licensed, written in pure Python, and published on PyPI as reverify. The latest release is v0.4.0.

The problem the project is aimed at

Reverify's README states the failure mode directly: language models are good at reading source and unreliable at reverse engineering, and will confidently invent offsets, sizes and behaviour when asked to reconstruct a struct or an algorithm from a binary. The author calls this the single biggest obstacle to real RE with AI. The design response is that the model proposes claims about a binary, and a deterministic toolkit disassembles, pattern-matches or emulates to check each claim against the actual bytes.

How the verification loop works

Every claim comes back as VERIFIED, REFUTED, INCONCLUSIVE, OBSERVED or INVALIDATED, with the bytes the tools observed attached as evidence. Claim kinds include typed reads (u16_at, u32_at, u64_at, with the verifier translating between file offsets, RVA and VA), pattern_present, string_present, instructions (a mnemonic sequence, optionally with operands), emulate_result (run a hex-encoded routine and assert on the register state), import_present, export_present and schema-less Protobuf and TLV dissection. Claims can declare depends_on so a refuted root invalidates the claims built on it, and observe: true reads a value rather than asserting one.

The README points out that "every claim verified" is easy to reach, since a model can assert that a PE file starts with MZ. So each result carries a weight: zero for restating the fact sheet the model already saw, for duplicates, and for repeats of the tools' own prior output; otherwise a surprisal tier by kind and specificity. A reconstruction is only marked grounded when nothing is refuted and the verified weight reaches a configurable minimum, which the README frames as the CORE refinement of FActScore applied to binaries.

How it is distributed

The toolkit is available three ways. As a CLI (reverify auto, reverify verify, reverify reconstruct, reverify disasm, reverify pattern-scan, reverify emulate, reverify gen-hook for Frida interceptors, and a handful more). As a Python package with a pure-standard-library core, upgraded in place to capstone, unicorn and lief with reverify[full]. And as an MCP server (reverify/mcp_server.py), which the README says lets Claude Code or Cursor use the tools directly and have their own hypotheses judged by the re_verify_claim tool before they are reported.

The interesting choice is treating the tools, rather than the model, as the final authority. Reverse engineering, malware triage, native crash triage and interoperability work all depend on details the model cannot see, and a wrong reconstruction that is presented confidently costs hours to undo later. Making the verifier the judge of what an agent is allowed to claim, and refusing credit for restatements of the input, gives a working RE loop a stop condition that does not depend on the model's own confidence.

The scope caveat is important: the README states Reverify is for authorized RE only, and the value of this class of tool depends on whether teams take the license constraint seriously. Three days and 662 stars is early, so treat it as a promising design worth trying rather than a proven one, and read the security notes before using it on anything sensitive.

Source

2akouwu/reverify on GitHub

This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.