--- title: Time Travel Debugging with Codex | daily.dev description: A case study compares two Codex (GPT-5.4-Cyber) sessions solving the FLARE-ON 12 FlareAuthenticator reverse-engineering challenge - one using only static tools... canonical: https://daily.dev/posts/time-travel-debugging-with-codex-dq1fgslqy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Time Travel Debugging with Codex | daily.dev og:description: A case study compares two Codex (GPT-5.4-Cyber) sessions solving the FLARE-ON 12 FlareAuthenticator reverse-engineering challenge - one using only static tools... og:url: https://daily.dev/posts/time-travel-debugging-with-codex-dq1fgslqy og:image: https://api.daily.dev/og/posts/Dq1FGslqy.png og:image:alt: Time Travel Debugging with Codex og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Time Travel Debugging with Codex **[SpecterOps](https://daily.dev/sources/specterops)** · 9 min read · 0 upvotes · 0 comments ## Summary A case study compares two Codex (GPT-5.4-Cyber) sessions solving the FLARE-ON 12 FlareAuthenticator reverse-engineering challenge - one using only static tools like Ghidra and Frida, the other equipped with TTDObjectsPy, a Python/MCP wrapper around Microsoft's Time Travel Debugging (TTD) replay SDK. The static-only session produced a wrong flag after nearly 2 hours and 69.5M tokens, having inferred success from a forced code path and a screenshot. The TTD-enabled session found the real validation state by querying execution traces, extracted a digit-contribution table, solved it with OR-Tools CP-SAT, and recovered the correct flag in 50 minutes using 16.4M tokens. The piece argues that giving LLM agents queryable execution history reduces false-confidence reasoning in runtime-dependent reverse engineering, while noting TTD's operational overhead and that this is a single case study, not a benchmark. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does giving an AI agent access to Time Travel Debugging traces change its reverse engineering results compared to static analysis alone? In a head-to-head test on the FLARE-ON 12 FlareAuthenticator challenge, a Codex session using only Ghidra and Frida produced an incorrect flag after 1 hour 51 minutes and 69.5 million tokens, having inferred success from a forced code path. A second session using TTDObjectsPy to query recorded execution traces found the real validation state, extracted the digit logic, solved it with OR-Tools, and got the correct flag in 50 minutes using 16.4 million tokens. _daily.dev surfaces case studies like this for teams weighing AI-assisted reverse engineering tooling._ ### What is TTDObjectsPy and how does it let an LLM use Windows Time Travel Debugging traces? TTDObjectsPy is a Python wrapper built on Microsoft's documented NuGet SDK for Time Travel Debugging APIs, exposing TTD replay functionality as MCP tools and Python helpers an LLM agent like Codex can call directly. It lets the model open recorded execution traces, jump to specific points in time, inspect registers and memory, query which function received an argument, and trace which instruction wrote a given value. _Track emerging AI reverse-engineering tooling like this on daily.dev as it evolves._ ### How was the FLARE-ON 12 FlareAuthenticator challenge's validation logic hidden, and how was it defeated? The correct submit path was heavily control-flow-flattened, with the OK button handler comparing a runtime 64-bit state field at window+0x78 against the constant 0x0bc42d5779fec401, updated per keypress at offset +0x16b00. By capturing controlled digit traces, an agent extracted a 25-by-10 delta table and solved the sum constraint with OR-Tools CP-SAT to recover the passcode 4498291314891210521449296, yielding the flag s0m3t1mes_1t_do3s_not_m4ke_any_s3n5e@flare-on.com. _daily.dev keeps reverse engineers current on writeups like this covering flattened control-flow challenges._ ## Similar posts on daily.dev - [Medium](https://daily.dev/posts/medium-2fpzdrwe3) · Medium · 0 upvotes · 0 comments - [Reverse Engineering SimTower](https://daily.dev/posts/reverse-engineering-simtower-hsuy1zx6s) · Hacker News · 0 upvotes · 0 comments - [How to Hack Time, With C2PA](https://daily.dev/posts/how-to-hack-time-with-c2pa-mp4yajqwa) · Lobsters · 0 upvotes · 0 comments - [One Week of Building and Reviewing Code With LLM Agents](https://daily.dev/posts/one-week-of-building-and-reviewing-code-with-llm-agents-0bpygawo1) · RUBYLAND · 0 upvotes · 0 comments - [TDD inside the agent loop - theater or actual value?](https://daily.dev/posts/tdd-inside-the-agent-loop---theater-or-actual-value--mytwhkuys) · Martin Fowler · 1 upvotes · 1 comments --- Tags: [#malware](https://daily.dev/tags/malware), [#reverse-engineering](https://daily.dev/tags/reverse-engineering), [#openai-codex](https://daily.dev/tags/openai-codex) [View this post on daily.dev](https://daily.dev/posts/time-travel-debugging-with-codex-dq1fgslqy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Time Travel Debugging with Codex","url":"https://daily.dev/posts/time-travel-debugging-with-codex-dq1fgslqy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/time-travel-debugging-with-codex-dq1fgslqy"},"datePublished":"2026-08-23T12:16:31.492Z","dateModified":"2026-08-23T12:17:14.368Z","description":"A case study compares two Codex (GPT-5.4-Cyber) sessions solving the FLARE-ON 12 FlareAuthenticator reverse-engineering challenge - one using only static tools...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9fd22ec6d9e2d635a1f67b6fecce3ff4?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9fd22ec6d9e2d635a1f67b6fecce3ff4?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"SpecterOps","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"SpecterOps","logo":"https://media.daily.dev/image/upload/s--lR36Z4gn--/f_auto,q_auto/v1787487384/logos/specterops?_a=BAMAMicg0","url":"https://daily.dev/sources/specterops"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/time-travel-debugging-with-codex-dq1fgslqy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"malware,reverse-engineering,openai-codex","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"SpecterOps","item":"https://daily.dev/sources/specterops"},{"@type":"ListItem","position":3,"name":"Time Travel Debugging with Codex"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/time-travel-debugging-with-codex-dq1fgslqy#faq","mainEntity":[{"@type":"Question","name":"How does giving an AI agent access to Time Travel Debugging traces change its reverse engineering results compared to static analysis alone?","acceptedAnswer":{"@type":"Answer","text":"In a head-to-head test on the FLARE-ON 12 FlareAuthenticator challenge, a Codex session using only Ghidra and Frida produced an incorrect flag after 1 hour 51 minutes and 69.5 million tokens, having inferred success from a forced code path. A second session using TTDObjectsPy to query recorded execution traces found the real validation state, extracted the digit logic, solved it with OR-Tools, and got the correct flag in 50 minutes using 16.4 million tokens. daily.dev surfaces case studies like this for teams weighing AI-assisted reverse engineering tooling."}},{"@type":"Question","name":"What is TTDObjectsPy and how does it let an LLM use Windows Time Travel Debugging traces?","acceptedAnswer":{"@type":"Answer","text":"TTDObjectsPy is a Python wrapper built on Microsoft's documented NuGet SDK for Time Travel Debugging APIs, exposing TTD replay functionality as MCP tools and Python helpers an LLM agent like Codex can call directly. It lets the model open recorded execution traces, jump to specific points in time, inspect registers and memory, query which function received an argument, and trace which instruction wrote a given value. Track emerging AI reverse-engineering tooling like this on daily.dev as it evolves."}},{"@type":"Question","name":"How was the FLARE-ON 12 FlareAuthenticator challenge's validation logic hidden, and how was it defeated?","acceptedAnswer":{"@type":"Answer","text":"The correct submit path was heavily control-flow-flattened, with the OK button handler comparing a runtime 64-bit state field at window+0x78 against the constant 0x0bc42d5779fec401, updated per keypress at offset +0x16b00. By capturing controlled digit traces, an agent extracted a 25-by-10 delta table and solved the sum constraint with OR-Tools CP-SAT to recover the passcode 4498291314891210521449296, yielding the flag s0m3t1mes_1t_do3s_not_m4ke_any_s3n5e@flare-on.com. daily.dev keeps reverse engineers current on writeups like this covering flattened control-flow challenges."}}]} ```