Analysis of Obfuscated Code with Program Slicing

Different program slicing methods are used for maintenance, reverse engineering, testing and debugging. Slicing algorithms can be classified as static slicing and dynamic slicing methods. In several applications the computation of dynamic slices is preferable, since it can produce more precise results. In this paper, we introduce a new forward global method for computing backward dynamic slices of C programs. In parallel to the program execution, the algorithm determines the dynamic slices for any program instruction. We also propose a solution for some problems specific to the C language (such as pointers and function calls). The main advantage of our algorithm is that it can be applied to real-size C programs, because its memory requirements are proportional to the number of different memory locations used by the program (which is in most cases far smaller than the size of the execution history which is, in fact, the absolute upper bound of our algorithm).

The reverse engineering process in development is widely used to carry out the reverse engineering process for the design of certain products, in this study the reverse engineering process on the palm oil lorry wheel is to improve the design as well as a combination of materials to increase the life of the lorry wheel product in the palm oil processing. The process of scanning the surface of the lorry wheel using camera and the reverse engineering process is carried out by measuring the precision of the lorry wheel by measuring using a precision measuring instrument, data obtained by measurement and reconstruction model. data obtained by measurement and reconstruction model using CAD software and CAE software used to analyze the CAD and CAE software are used to analyze the design results after the reverse engineering process. reverse engineering process. So, it is necessary to develop a reverse engineering system design that will be useful in terms of efficiency and service life of the lorry wheel, in the design of this lorry wheel uses CAD and CAM software to model the lorry wheels with simulation and analysis systems. The next process is to modify and remanufacture the lorry wheel model using machine tools so that the prototype of the manufacturing process can be tested. so that the prototype of the manufacturing process can be tested on the lorry to see the durability of the reverse engineering product. to see the durability of the reverse engineering product. The results of this research showed that the reverse engineering data can be interpolated for further CAE process

Program slicing is a source code extraction technique that can be used to support reverse engineering by automatically extracting executable subprograms that preserve some aspect of the original program's semantics. Although minimal slices are not generally computable, safe approximate algorithms can be used to good effect. However, the precision of such slicing algorithms is a major factor in determining the value of slicing for reverse engineering. Amorphous slicing has been proposed as a way of reducing the size of a slice. Amorphous slices preserve the aspect of semantic interest, but not the syntax that denotes it, making them generally smaller than their syntactically restricted counterparts. Amorphous slicing is suitable for many reverse engineering applications, since reverse engineering typically abandons the existing syntax to facilitate structural improvements. Previous work on amorphous slicing has not attempted to exploit its potential to apply loop-squashing transformations. This paper presents an algorithm for amorphous slicing of loops, which identifies induction variables, transformation rule templates and iteration-determining compile-time expressions. The algorithm uses these to squash certain loops into conditional assignments. The paper also presents an inductive proof of the rule templates and illustrates the application of the algorithm with a detailed example of loop squashing.

Program slicing is s method to extract the statements from the program which have an influence on the value of a variable at a paricular point of the program. Program slicing is applied for many applications, such as program degugging, program testing, program integration, parallel program execution, software metrics, reverse engineering, and software maintenance, etc. This paper is the study to create the exact slice in the presence of Object Reference State Graph to generate more exactly static analysis information of objects in the program of the presence of complicated data structure.

In this study we empirically investigate the adaptation of Test-Driven Development (TDD) practice into software Reverse Engineering (RE) process. We call this adaptation as Test-Driven Reverse Engineering (TDRE) process. We propose a two-layer prioritization process, which firstly prioritizes the already-implemented functionalities using the Cumulative Voting (CV) method and three prioritization criteria (importance, complexity and dependency), and secondly prioritizes test-cases for each prioritized functionality, using the same criteria. We conducted a case study in academia with students to empirically evaluate the usability and effectiveness of the prioritization process and the TDD adaptation into RE process. The results have shown that students with a good performance in testing had also good performance in designing UML class-diagrams. Moreover, the implementation of hierarchical test-cases for the already prioritized functionalities, improves code comprehension and redesigning in the RE process in terms of better total grades obtained.

Reverse engineering involves a great deal of effort in comprehension of the current implementation of a software system and the ways in which it differs from the original design. Automated support tools are critical to the success of such efforts. It is shown how program slicing techniques can be employed to assist in the comprehension of large software systems, through traditional slicing techniques at the statement level, and through a new technique, interface slicing, at the module level. >

The Reverse Engineering has started grabbing attention of every user in the process of program evaluation. Program slicing is a technique for understanding a program in terms of data and control dependencies. The main applications of program slicing include various software engineering activities such as program understanding, debugging, testing, program maintenance and complexity measurement. When the slicing technique gathers information on the data and control flow of the program taking into account an actual and specific execution(or set of executions) of it, then it is said to be dynamic, otherwise it is said to be static. The proposed tool presents a novel approach to the static analysis and dynamic analysis of attribute dependence. The notations are introduced with examples.

A Sustainable Reverse Engineering Process

The vehicle industry is quickly becoming more connected and growing. This growth is due to advancements in cyber physical systems (CPSs) that enhance the safety and automation in vehicle. The modern automobile consists of more than 70 electronic control units (ECUs) that communicate and interact with each other over automotive bus systems. Passenger comforts, infotainment features, and connectivity continue to progress through the growth and integration of Internet-of-Things (IoT) technologies. Common networks include the Controller Area Network (CAN), Local Interconnect Network (LIN), and FlexRay. However, the benefits of increased connectivity and features comes with the penalty of increased vulnerabilities. Security is lacking in preventing attacks on safety-critical control systems. I will explore the state of the art methods and approaches researchers have taken to identify threats and how to address them with intrusion detection. I discuss the development of a hybrid based intrusion detection approach that combines anomaly and signature based detection methods. Machine learning is a hot topic in security as it is a method of learning and classifying system behavior and can detect intrusions that alter normal behavior. In this paper, we discuss utilizing machine learning algorithms to assist in classifying CAN messages. I present work that focuses on the reverse engineering and classification of CAN messages. The problem is that even though CAN is standardized, the implementation may vary for different manufacturers and vehicle models. These implementations are kept secret, therefore CAN messages for every vehicle needs to be analyzed and reverse engineered in order to get information. Due to the lack of publicly available CAN specifications, attackers and researchers need to reverse engineer messages to pinpoint which messages will have the desired impact. The reverse engineering process is needed by researchers and hackers for all manufacturers and their respective vehicles to understand what the vehicle is doing and what each CAN message means. The knowledge of the specifications of CAN messages can improve the effectiveness of security mechanisms applied to CAN.

Reverse Engineering (RE) can be interpreted as procedures and processes in dismantling an object to find out the materials, working methods, or technology used so that the object can function properly. Design activities using the reverse engineering concept make it easier for students to understand product specifications, product advantages and disadvantages, product production processes and production cost estimates before designing new products. The laboratory is one place that can be used to carry out the reverse engineering process. The bulkhead reactor is an alternative to the stirred tank reactor with the aim that the resulting product is maximized both in terms of quantity and morphology or shape of the material. The benefit of disassembling this product is as a first step in understanding the concept of reverse engineering in the task of designing machines or tools. From the results of the study, it was found that the formation of struvite occurred at pH 9 using an air flow rate of 1 l/minute.

Numerous type of software piracy known today, have several prevention techniques which has been established against them. Although, different software piracy techniques have been established, but the choice of which one should be the best to develop any software is the challenge for most software developers. Consequently, example of the types of piracy in software development can be categorise as follows: cracks and serials, softlifting and hard disk loading, internet piracy and software forging, mischaneling, reverse engineering, and tampering. We have several types of prevention techniques which aimed to resolved piracy in software development, although the methods have been wrecked. In this work a critical analysis has been carryout on different software piracy techniques and a simple model software was designed using the best technique to validate the results of the analysis.

Domain Generation Algorithms (DGA) is a basic building block used in almost all modern malware. Malware researchers have attempted to tackle the DGA problem with various tools and techniques, with varying degrees of success. We present a complex solution to populate DGA feed using reversed DGAs, third-party feeds, and a smart DGA extraction and clustering based on emulation of a large number of samples. Smart DGA extraction requires no reverse engineering and works regardless of the DGA type or initialization vector, while enabling a cluster-based analysis. Our method also automatically allows analysis of the whole malware family, specific campaign, etc. We present our system and demonstrate its abilities on more than 20 malware families. This includes showing connections between different campaigns, as well as comparing results. Most importantly, we discuss how to utilize the outcome of the analysis to create smarter protections against similar malware.

Current reverse engineering technology is typically based on program analysis methods such as parsing and data flow analysis. As such, it is limited in what it can accomplish. Knowledge of the application domain containing a program can help overcome this limit and aid the comprehension process. The paper discusses the relationship of application domain analysis and reverse engineering. Two case studies are presented. The first describes how domain knowledge, expressed as an object-oriented framework, can aid the reverse engineering process for a well-understood domain. The second studies how reverse engineering can be used to build a domain model. Issues raised by the confluence of domain analysis and reverse engineering are discussed, and implications on future work in the area are suggested. >

The security of Industrial Control Systems (ICS) has been attracting increased attention over the past years, following the discovery of real threats targeting industrial environments. Despite this attention, automation of the reverse engineering process of ICS binaries for programmable logic controllers remains an open problem, mainly due to the use of proprietary compilers by ICS vendors. Such automation could be a double-edged sword; on the one hand it could accelerate digital forensic investigations and incident response actions, while on the other hand it could enable dynamic generation of malicious ICS payloads. In this work, we propose a structured methodology that automates the reverse engineering process for ICS binaries taking into account their unique domain-specific characteristics. We apply this methodology to develop the modular Industrial Control Systems Reverse Engineering Framework (ICSREF), and instantiate ICSREF modules for reversing binaries compiled with CODESYS, a widely used software stack and compiler for PLCs. To evaluate our framework we create a database of samples by collecting real PLC binaries from public code repositories, as well as developing binaries in-house. Our results demonstrate that ICSREF can successfully handle diverse PLC binaries from varied industry sectors, irrespective of the programming language used. Furthermore, we deploy ICSREF on a commercial smartphone which orchestrates and launches a completely automated process-aware attack against a chemical process testbed. This example of dynamic payload generation showcases how ICSREF can enable sophisticated attacks without any prior knowledge.

The complexity of the Regin malware underlines the importance of reverse engineering in modern incident response. The present study shows that such complexity can be overcome: substantial information about adversary tactics, techniques and procedures is obtained from reverse engineering. An introduction to the Regin development framework is provided along with instrumentation guidelines. Such instrumentation enables experimentation with malware modules. So analysis can derectly leverage malware’s own code without the need to program an analysis toolkit. As an application of the presented instrumentation, the underlying botnet architecture is analysed. Finally conclusions from different perspectives are provided: defense, attack and counter intelligence.