/REVERSE-ENGINEERING · 2026-09-01

An offset oracle: recovering optimized-away structs from a stripped binary

The decompiler guesses at struct boundaries. We can stop guessing — by letting the code itself confirm each field offset through micro-execution. A fully reproducible method, ~90 lines of Python.

1 · A target we know the answer to

2 · The oracle: instrument every read

3 · Turning touches into a layout

4 · Why micro-execution beats static inference

5 · Using it in anger

Enable JavaScript to read the full method, code, and figures.