It is becoming f*cking dangerous: you can now reverse-engineer old games and binaries with Claude. Sonnet 5.5 maps the code, Opus 5.5 rebuilds the logic, and Fable 5.1 hunts for what Opus got wrong
1. Compile a tiny C lab so you already know the right answer
2. Drop the evidence contract into CLAUDE.md
3. Open the binary in Ghidra and save the decompiled functions to evidence/
4. Run Sonnet 5.5: a function map with addresses and confidence for every row
5. Hand the map to Opus 5.5: a plain-English spec plus two competing readings
6. Test every claim: the loop Claude calls “CRC32” turns out to be FNV-1a
7. Call Fable 5.1 only when Opus stalls: it finds the 3 weakest points in the spec
A pass costs $0.30 on Sonnet and $1.50 on Fable, and every claim is tagged OBSERVED, INFERRED or UNKNOWN with an address or a test behind it
Turn Claude into a reverse engineer that proves what it says before you build on it
Grab all 3 prompts in the article below
THIS IS AN ABSOLUTE GOLDMINE FOR REVERSE ENGINEERING
the Claude reversing setup almost nobody is running yet.
The idea: Sonnet 5.5 maps the binary, Opus 5.5 rebuilds the hard logic, and Fable 5.1 only steps in to stress-test a theory that already passed its tests.
No guess gets into the spec, because every claim needs an address, an xref or a test log behind it first.
You start with a tiny lab binary where the answer is already known:
cc -O2 -o samples/record samples/record.c
here’s who does what:
→ Sonnet 5.5 ($2/$10) writes function_map.md with address, role, evidence and confidence
→ Opus 5.5 ($4/$20) turns the tricky functions into spec.md with 2 competing readings
→ Fable 5.1 ($10/$50) looks for the 3 ways that spec could be wrong
→ the tests check everything against the original binary
Fable only gets called in three cases:
→ Opus left two readings open
→ a long chain of functions that depend on each other
→ a high-stakes review before you build on top of it
100K input + 10K output costs about $0.30 on Sonnet, $0.60 on Opus and $1.50 on Fable. Most people spend their Fable budget on listing strings.
The rule that matters most: reference behavior comes from the original binary, so the model never grades its own code.
the full tree
CLAUDE.md holds the evidence contract (OBSERVED / INFERRED / UNKNOWN)
Sonnet 5.5 builds the function map
Opus 5.5 writes the spec, 2 alternatives and the minimum tests
the tests run against the original binary
Fable 5.1 reviews only once Opus’s theory is tested
Sonnet 5.5 turns the proven spec into code
paste the tree and this prompt into Claude Code ↓
“Set up a reverse engineering workflow based on this tree:
Create CLAUDE.md. Every claim follows CLAIM | EVIDENCE | CONFIDENCE | HOW TO VERIFY and is tagged OBSERVED, INFERRED or UNKNOWN.
On Sonnet 5.5, inventory [BINARY] and write notes/function_map.md with ADDRESS | NAME | PROPOSED_ROLE | EVIDENCE | CONFIDENCE. Keep every original name.
On Opus 5.5, reconstruct [FUNCTION] into notes/spec.md with two alternative interpretations and the minimum tests that separate them.
Run the tests against the original binary and save every result in evidence/.
Only if both readings survive, hand the spec to Fable 5.1 and ask for the 3 highest-impact ways it could be wrong.
Show me the function map first. Nothing gets reconstructed until I say go.”
save it, you’ll need it later.