A local model and radare2: a decompilation loop

The trick that made this useful was not the model. It was closing the loop.

Instead of pasting disassembly into a chat window, I let the model emit r2 commands — pdf @ sym.func, axt, iz — and fed the output straight back. It stops being a one-shot guess and becomes an investigation: the model asks who calls this function, reads the answer, and revises.

Two guardrails matter. The command set is an allowlist — the model never runs arbitrary shell. And every step is logged, so a wrong turn is a thing you can read back rather than a mystery. With those in place, a local 8B model on a laptop does an hour of naming in a few minutes, and you spend your hour on the part that actually needed a human.