Using LLMs as a reverse engineering sidekick

This research article demonstrates how LLMs (local and cloud) can be integrated with MCP servers and disassemblers (IDA Pro/Ghidra) to assist malware analysis workflows; it presents setup instructions, prompt engineering examples, and a comparative analysis of a known IcedID sample to evaluate local vs. cloud model effectiveness, and it includes detection guidance and IOCs such as a file hash, Snort SIDs, and ClamAV detections.