AI can now decompile games. What that means for indies

AI coding agents can now turn a compiled game back into readable source code in weeks, a job that used to take hobbyist teams years. Two write-ups from the past two months show how far it has come, and publishers are already sending takedowns. Here’s what it means for small teams.

What happened

In August, developer Chris Lewis finished decompiling the Nintendo 64 game Snowboard Kids. That meant all 2,145 functions, rebuilt as C that compiles back to the original machine code. It took 84 days, with AI agents working in four parallel copies of the project. The same job on the sequel, Snowboard Kids 2, had taken him 596 days.

On 9 October, a developer known as momo5502 published a write-up of a bigger project: rebuilding a PC first-person shooter from its executable. The post doesn’t name the game, but TechSpot reports it’s Call of Duty: Modern Warfare 2 (2009). Over about three months, up to 16 agents used an estimated 600 to 700 billion tokens. The result has 99% of the game’s functions, 83% of them byte-for-byte identical to the original, and the game runs. The author is keeping the code private.

TechSpot’s roundup lists more. The community decompilation of Super Smash Bros. Melee reached 100% with AI help on the final stretch. GoldenEye 007’s reached 100% through human work, and AI has since helped turn it into a native PC port. A Halo: Combat Evolved project says it matches 99.5% of the original. Activision had footage of the Modern Warfare 2 work taken down. Separately, ZeniMax sent a cease-and-desist within days to an AI-built browser game set in the Fallout universe. That one was a recreation rather than a decompilation, but it shows how quickly publishers are moving.

Why it works now

This kind of project is called matching decompilation. You write source code, compile it, and check whether the output matches the original binary byte for byte. That check is automatic, which makes it a good job for AI agents. They can try, fail and retry for hours without a human marking their work.

The agents still need supervision. momo5502 says they invented logic, used the wrong data layouts, and even tried to cheat by editing the script that checked their work. Lewis estimates his project might have stalled at around 90% without three human experts who knew the N64 compiler’s quirks. So it’s faster and cheaper, but you still need skilled people in the loop.

Is your game at risk?

For many indie games, the code was never hidden in the first place. Unity games built with the Mono backend ship .NET bytecode that free tools like ILSpy turn back into readable C# in minutes. Godot exports can be unpacked, and their GDScript recovered, with community tools such as GDRE Tools. If you’ve shipped on either, anyone curious could already read your code.

The change is at the harder end. Native code, such as C++ or Unity’s IL2CPP builds, used to take a lot of skilled time to reverse. AI agents make that much cheaper. They don’t make it free yet: momo5502’s run used two premium subscriptions and three months of close management.

Remember what decompiled code doesn’t give someone. It doesn’t come with your art, music, writing or name, and those are protected separately. Matching projects usually ship without assets and ask players to supply their own copy of the game. Cloning your gameplay never needed your source code anyway.

Will publishers switch to streaming?

Our take: probably not as a way to stop decompilation. If a game only runs on a server, nobody can decompile the client. But every streamed player needs a GPU in a data centre, and Google closed Stadia in January 2023. Handhelds like the Steam Deck and Switch 2 also need games that run on the device.

More likely, publishers will keep valuable logic on their servers, as online games already do, and keep using anti-tamper tools. Denuvo, for example, is reportedly seeking subpoenas to unmask a cracker. Expect more lawyers too. Hybrid set-ups, where your machine draws the game and a server runs the parts worth protecting, are a more realistic middle ground than full streaming.

The law, briefly

Decompiling a game doesn’t make the result yours. In the US, courts have allowed reverse engineering for compatibility (Sega v. Accolade, Sony v. Connectix), but that doesn’t extend to sharing someone else’s program. Breaking copy protection raises separate problems under the DMCA. The EU allows decompilation only when it’s needed for interoperability, and not to build a substantially similar program. So far, publishers have mostly responded with takedowns, as Activision and ZeniMax just did. This isn’t legal advice. Get some if you’re planning anything public.

What to do about it

1. Don’t hide secrets in your client. API keys, store credentials and admin passwords in a shipped build should be treated as public. Move them to a server.
2. Keep the logic that matters on a server. For multiplayer, leaderboards or in-game economies, let the server have the final say on results.
3. Know what obfuscation buys you. IL2CPP builds and obfuscators raise the cost of reading your code. They won’t stop a determined, well-funded team.
4. Protect what’s yours. Keep dated source history and art files, so a DMCA takedown is easy to back up if someone ships a copy.
5. Use the tools yourself. If you’ve lost the source to an old game, the same methods could help you recover it and port it to new platforms. Back up your source so you never need to.

---

Sources

• Decompiling a Nintendo 64 game in 84 days (Chris Lewis)
• 500+ billion tokens later: letting AI agents decompile a first-person shooter (momo5502)
• Decompilation on steroids (TechSpot)
• Fallout: New York appears online, and ZeniMax shuts it down (Insider Gaming)
• Denuvo attempts to subpoena Discord, Valve and Reddit (GameDev.net, via Game Developer)