Why AI Is Suddenly Decompiling Video Games

When a studio ships a video game, players do not receive the human-readable C or C++ source code.

The compiler strips away variable names, comments, and high-level structure, translating everything into raw machine instructions optimized for a specific console or CPU architecture.

Traditional modding works around the outside of that binary—swapping texture files, hooking memory addresses at runtime, or using scripting APIs exposed by the engine.

Decompilation goes all the way to the foundation: translating the compiled binary back into clean, human-readable source code. In strict "matching decompilation" projects (like the community decompilation of *Super Smash Bros. Melee*), the reconstructed C code must compile back into the exact byte-for-byte binary of the original retail disc. Once a game is decompiled, developers can port it natively to PC, run it at 120+ FPS, add widescreen rendering, or overhaul the physics engine.

Tools like the NSA's Ghidra already disassemble binaries and generate pseudo-C code, but raw decompiler output is notoriously cryptic—filled with unnamed pointers (`FUN_0041a2b0`), register offsets, and stripped data structures.

Human reverse engineers spend hundreds of hours reading assembly functions, inferring what a routine does from context, renaming variables, and testing whether their rewritten C function compiles to the same assembly.

That iterative loop—pattern recognition, hypothesis testing, and code translation—is remarkably well suited to agentic coding tools. Chris Lewis's 84-day decompilation of *Snowboard Kids* showed how pairing human reverse-engineering expertise with AI agents can compress years of repetitive function matching into months.

Recently, a GitHub repository called Reverse Engineer Anything (`morluto/rea`) went viral for connecting Ghidra to AI coding agents via Model Context Protocol (MCP).

To test whether REA actually lives up to the hype, I ran a controlled experiment on a compiled Chocolate Doom executable without giving either agent access to the original DOOM source code.

I gave two separate Claude Code agents the exact same mission: reverse engineer the binary to figure out how the BFG 9000 weapon actually calculates damage.

• Agent 1 used Reverse Engineer Anything (REA) connected to Ghidra.
• Agent 2 used plain Claude Code with only standard macOS command-line binary tools (`objdump`, `otool`, `nm`, and `strings`).

The BFG 9000 in DOOM is famous for having one of the weirdest, most misunderstood mechanics in gaming history—and both agents successfully recovered it from the compiled executable.

Most players assume the giant green plasma ball deals splash damage in a circle around where it explodes.

By tracing the projectile impact function (`A_BFGSpray`), both agents reconstructed the actual algorithm:

• When the green projectile hits a wall, the engine waits briefly and then fires 40 invisible hitscan tracer rays in a 90-degree cone.
• Crucially, those 40 rays do not originate from the explosion site—they originate from the player's current position, aimed in the direction the player was facing when the shot was originally fired.
• Each ray rolls pseudo-random damage between 49 and 87 points.

Plain Claude Code using local macOS disassembly tools actually finished faster on this unstripped binary, while REA + Ghidra provided structured decompiler views that become far more valuable when symbol tables are completely stripped.

To verify that the agents' behavioral reconstruction was concrete enough to build with, I fed each agent's technical spec into a second task: building a playable 3D "DOOM Kart" racing prototype in the Godot Engine (using open-source Freedoom sprites and Kenney's Racing Starter Kit).

Both prototypes implemented the reconstructed 40-ray cone blast as a kart power-up—letting you fire the projectile down the track and clear out rival karts caught inside the directional ray fan.

It is important to be precise about what this experiment proved—and what it did not.

Extracting the logic of a single weapon system from a desktop binary with symbol names intact is a behavioral reconstruction. It is vastly simpler than producing a byte-for-byte matching decompilation of an entire stripped console ROM.

Even so, lowering the barrier to behavioral reverse engineering has massive implications for software preservation, interoperability (like community bridges connecting *Minecraft* and *Elden Ring*), and software ownership—allowing users to inspect how abandonware or legacy binaries actually work under the hood.