I’m an Android Reverse Engineer. AI Was Supposed to Replace Me. It Didn’t.

The Knife Hangs at Your Neck, But It Never Falls

Notes from an Android Reverse Engineer

At 2 a.m., Marcus turned his phone face down on the desk. The screen still glowed. Someone in the Slack channel had posted a screenshot: an AI had explained a chunk of OLLVM-obfuscated assembly in seconds and generated a Frida hook template. Replies underneath: “insane,” “we’re done,” “unemployed.”

Marcus did not reply. He flipped the phone over and read the pseudocode again. Registers jumped. Control flow looked like yarn a cat had played with. He was used to this. He worked alone until dawn, until his eyes ached and his stomach turned bitter. Antacids sat on the desk. The foil pack had three empty slots. The pothos beside the monitor had yellow leaf tips. He had forgotten to water it.

He first used AI on a Friday afternoon. A string decryption in an APK had blocked him for two days. Jason leaned over from the next desk. “Try throwing this at the model.” Marcus frowned. “It can understand this?” Jason copied the code, typed a few things, and the screen returned an explanation: a constant XORed multiple times, plus a guessed field name, device_fingerprint_salt.

Marcus stared at the field name. His fingers hovered over the keyboard for three seconds. He had never done this before, throwing an unredacted sample at an external tool. That day he did. He deleted a few irrelevant class names, made a toy project, fed it to the model, and asked, “Could this loop be a dispatcher after flattening?” The model returned an analysis. Two parts were nonsense. One part was right: the real branch was hidden behind the second case of the switch.

He saved the conversation. Before closing the window, he wrote a note to the model: “This is wrong, but the direction is usable.” It was the first time he had written a note to AI instead of closing it.

The knife hangs at your neck, but it never falls. He looked out the window. It was still dark. Steam rose from the diner on the corner, like fog that had not dispersed.

I
Over the next month, AI became a silent colleague in his workflow. He used it to read pseudocode, name variables, summarize, generate Frida templates, and write IDAPython scripts. Sometimes it was right. Sometimes it was nonsense. When it was right, he saved half a day. When it was nonsense, he spent half a day cleaning up. He no longer closed the window the moment he saw AI.

A protocol analysis for a connected-car app used a modified protobuf variant for server fields. He had traced it manually for two days and got stuck on the length field. Jason said, “Throw the captured packet and the pseudocode in together. Let it guess the structure.” He tried. The model gave a field table. Three fields were wrong. One field name and its order were right: timestamp_ms, vin, nonce. Following that order, he found the corresponding serialization function in memory.

That afternoon, he sent the result to David. David replied, “Solid.” Marcus leaned back. The bitterness in his stomach faded a little. He picked up the water bottle beside the pothos and poured half of it into the pot. Water leaked from the bottom and dripped onto the keyboard cover. He wiped it with a tissue. It did not come clean.

Jason had used AI to generate a Frida script that hooked five classes and printed parameters and return values. Marcus saw it on Jason’s screen. Jason said, “I’ll run it once and see which call chain is abnormal.” Marcus said, “Scripts run fast, but false positives are high.” His hand dragged Jason’s script into his own favorites. That night, he modified it, added a conditional breakpoint, and got a sample running that he had never dared to touch before.

He wrote a README for the script. First line: “Don’t trust the output directly. Look at the call stack first.” He opened a pull request. Jason reviewed it and left two comments. Marcus fixed one and argued about the other.

At the 9:30 stand-up, Karen, the client account manager, joined the call. She said the budget was cut in half and the timeline was cut in half. She asked if AI could improve efficiency. David did not answer immediately. He glanced at Marcus. Marcus looked down at his notebook. David said, “AI is a tool. It does not replace the person who verifies. It can let one person do the work of three. It cannot take the blame for you. Reverse engineering is verification work. Whoever verifies carries the responsibility.”

Marcus’s fingers stopped at the edge of his notebook. He remembered how he had first treated AI as an enemy, then as a tool, then as a colleague. David’s words lifted the knife an inch.

II
Marcus printed his resignation letter, folded it into thirds, and put it in his pocket. He was going to tell David that he wanted to take the Google PM certificate, switch to product management, or take a quieter job at a bank. He walked into David’s office. David was on the phone. The voice on the other end was loud: “The client’s app has been hit. Risk control was bypassed. Data is leaking.” David hung up and looked at Marcus. “You’re just in time. This sample. You and Jason look at it together. Locate the entry point first, then confirm whether it is supply chain.”

The resignation letter in Marcus’s pocket was damp with sweat from his fingers. He opened his mouth and said, “Okay.”

That night, he and Jason stayed in the meeting room until dawn. Jason used AI to run a static scan and listed suspicious third-party SDKs. Marcus manually followed the JNI layer and found a packed native library. He cross-checked the AI output with manual verification, ruled out two false positives, and locked onto a real entry point: a module disguised as an ad SDK, loaded when Application started.

The next day, Karen sent a message: “Final invoice today.” The client was on a retainer. Marcus looked at his phone, took the resignation letter out of his pocket, and stuffed it into the bottom drawer. Two boxes of antacids were in the drawer. One was unopened.

III
After the supply-chain sample, Marcus started taking on more core work. He relied more on his own judgment. He trusted others less. His problem was his own stubbornness.

Jason said, “This native library. I’ll have AI run symbol recovery, then you manually check.” Marcus said, “No need. I’ll do it myself.” Jason said, “You can’t finish it alone.” Marcus said, “I can.”

He traced it for two days. On the third day, he missed an anti-debugging thread. He was on call that week. When the sample ran on a real device, it triggered self-destruction and wiped the key memory. By the time he tried to reproduce it, the server had updated the version. The incident channel lit up. The data leakage window was extended by six hours. David did not scold him. He posted in Slack: “Next time, divide the work first.” David scheduled a postmortem for the next morning.

Marcus sat at his desk. His stomach cramped. He poured out the antacids and swallowed two pills dry. The pothos had another yellow leaf tip. He stared at the screen. His fingers hovered over the keyboard for a long time. He did not type. He put in for PTO, then cancelled it.

He remembered what he used to say: reverse engineering is a craft, and craftsmen do not ask for help. Now he knew: craftsmen ask for help too. AI could make up for his speed. It could not make up for his stubbornness.

IV
Jason came over with a sample. “This packer. AI says it might be a VMP variant. I ran it. The entry is after JNI_OnLoad.” Marcus did not look up. “AI says? Last time it said that field was nonce, and it turned out to be nonce_v2.” Jason said, “That’s why I’m asking you to look.” Marcus said, “I’ll do it myself.” Jason said, “You always do this.” Marcus said, “Do what?” Jason said, “You push everyone away, then stay up alone, and then something goes wrong.”

Marcus stood up. His chair slid back and hit the whiteboard. He said, “What do you know? You think AI can do the work for you? It doesn’t even know where it’s wrong.” Jason did not answer. He put the sample on Marcus’s desk and left.

Marcus sat down and looked at the sample. He did not open it. He opened LinkedIn and scrolled. Android reverse engineering positions were half of what they were last year. Some required AI toolchains. Some required risk-control countermeasures. Some required connected-car security. He locked his phone, then unlocked it. He took the resignation letter out of the drawer, read it, and put it back.

That night, he made a decision: change careers. He signed up for the Google PM certificate and bought two books: Inspired and SQL for Data Analysis. The books arrived. The plastic wrap stayed on. He sat on the sofa. The TV was on. He was not watching. Jason sent a message: “That sample. I figured it out. The entry is the third function after JNI_OnLoad. Do you want to see?” Marcus replied, “No need.”

V
He left the company. The reason was “personal development.” David did not try to keep him. He only said, “If you want to come back, anytime.” Marcus nodded and packed his things. He did not take the pothos. He did not take the keyboard cover. He took the antacids.

He stayed home for a month. He got up in the morning and made coffee. He drank Americano, no milk. He used to drink lattes. Later he found lattes too sweet and switched to Americano. Now he drank Americano with three ice cubes. Condensation formed on the outside of the cup and dripped onto the table. He wiped it with a tissue. It dripped again.

He scrolled LinkedIn until his fingers ached. He applied to a few jobs. Some scheduled interviews. Some read but did not reply. An interviewer asked him, “How do you see AI’s impact on reverse engineering?” He said, “AI is a tool. Verification still depends on people.” The interviewer nodded and said, “We’ll be in touch.” There was no follow-up.

He sat by the window and watched people walk by downstairs. The pothos was gone. The windowsill had an empty spot. He unwrapped SQL for Data Analysis and flipped two pages. The next day, two more pages. The third day, none.

He sent Jason a message: “That VMP variant. How did you finally locate it?” Jason replied, “AI ran symbol recovery. I manually verified the call stack. Do you want to see the script?” Marcus replied, “Yes.”

Jason sent a zip file. Marcus unzipped it, opened the script, and read it line by line. He saw a comment Jason had written: “Don’t trust the output directly. Look at the call stack first.” The same line he had written himself. He smiled. The corner of his mouth moved. No sound came out.

VI
Marcus sent Jason a message: “For this sample, after AI runs, which layers do I manually verify?” Jason replied, “Start with JNI_OnLoad, then Application’s attachBaseContext. AI listed five suspicious points. I verified three. Two left.” Marcus said, “I’ll take them.”

He opened IDA and loaded the sample. AI’s output was on the left. The pseudocode was on the right. He no longer treated AI as an enemy or a substitute. He treated it as a talkative intern who occasionally talked nonsense but could save him time. He verified one point, crossed it off. By the fourth, he found the entry.

He wrote the process into a document titled “Checklist for AI-Assisted Reverse Engineering.” First line: “AI can guess, but you have to run it.” Second line: “Don’t trace all threads alone.” Third line: “Divide the work first.”

He signed up for an online mobile security course. Every Wednesday night, he sat at his desk, wore headphones, and took notes. In his notes he drew call stacks, pasted Frida scripts, and wrote “to be verified.” He brought a pothos home from the old company and put it on the windowsill. The leaf tip was still yellow, but new leaves had grown.

He sent David a message: “David, I want to come back.” David replied, “There’s a position, but the direction will change. Mobile security red team. You in?” Marcus replied, “In.”

VII
Marcus sat at his new desk. On it were a pothos, a box of antacids, and a keyboard cover. He opened the terminal and ran Frida. Green text scrolled across the screen. Jason leaned over from the side: “This sample. AI says it might be supply chain.” Marcus said, “Then verify supply chain first. You run AI. I’ll manually look at JNI.”

Jason said, “Okay.” Marcus picked up his coffee. Americano, three ice cubes. Condensation formed on the outside of the cup and dripped onto the keyboard cover. He wiped it with a tissue. His phone lit up. Jason sent a message: “See you tomorrow.” Marcus replied, “See you tomorrow.”

The knife is still hanging. He opened IDA. The sample was waiting. He started with JNI_OnLoad.