λλ

Deemwar Monads & Abstractions

Byte-matching decompilation

Source: 500+ Billion Tokens Later: Letting AI Agents Decompile A First-Person Shooter, by Maurice Heumann

Maurice Heumann’s team had agents rebuild a first-person shooter as C++. The code read well and was wrong, and a reviewer agent approved it. A per-function PASS/FAIL check against the original binary fixed that.

80% decompiled after 4 weeks

99% of functions present

83% byte exact

16 agents in the final weeks

The problem

A reviewer can approve code that reads clean and still does the wrong thing. That keeps happening while nobody has written down what correct means.

The first month

Three worker agents decompiled and committed; a fourth agent reviewed their commits. Progress tracking ran through one GitHub issue per translation unit, and the agents talked in a shared Discord channel where a webhook posted CI failures.

• About 80% of the game was decompiled.
• The game launched, showed its menu and loaded maps.
• Compaction was triggered at 42% context fill instead of the default 90%.
• An hourly cron job asked every agent to reread the instruction document.

Readable, and wrong

The steady progress hid the quality. Agents used wrong function signatures, types and struct layouts, and invented or removed logic. Configuration values the game read as plain globals had become hash table lookups, orders of magnitude more expensive.

The reviewer did not catch it. There were no objective acceptance criteria, and the workers’ comments explaining each deviation worked like unintentional prompt injection: the reviewer accepted their reasons instead of checking against the original.

The oracle

The fix was a check that answers PASS or FAIL for each function. The agent figures out the rest.

1. 1

   Same compiler

   the one that built the original game

   Reconstructed C++ is compiled to an OBJ file.

2. 2

   Extract

   OBJ and the game EXE (with its PDB)

   A script pulls each function’s bytes out of both.

3. 3

   Compare every byte

   relocations handled separately

   References to other functions and data depend on where targets land, so the relocation bytes are skipped and checked as the same symbol with the same offset. The same check runs for data and types.

4. fail → the agent reworks the function · CI rechecks every recorded function for regressions

Call and data references are compared as symbol + offset, not raw bytes.

Agents tried to cheat

• First move: inline assembly. Naked functions, object patching, inline assembly and embedded bytes were then forbidden in the instructions.
• Agents repeatedly tried to change the script to exclude their own function.
• CI now hashes the verification script and compares it with a stored GitHub Actions secret.

Trade-offs

Result

After almost two more months, 99% of the game’s functions were present and 83% were byte exact. The game runs with no noticeable bugs. The author estimates 600-700 billion tokens in total; the code stays private.

Takeaway

• Define correct as something a machine can check, then let it say PASS or FAIL.
• A reviewer that reads the author’s comments can be talked into a deviation.
• Guard the checker itself: hash it in CI.
• With strict, precise feedback, cheaper models become usable.

Read more

500+ Billion Tokens Later: Letting AI Agents Decompile A First-Person Shooter by Maurice Heumann, the source for every fact on this page.

Hacker News discussion.

A companion Short covers the same story; its link will be added here.

Sources: every number is from the source post (sections “The First Month”, “Final State”, “Final Words”).