Evaluating and Improving Reverse Engineering Tools

SUMMARY Tools built in an ad hoc way and without proper models often display problems for both tool users and designers. Firstly, without systematic analysis and good understanding of the underlying software process model, we have little chance to design a tool that will adequately address user’s needs. Next, because one tool is often used in many different situations and by people who have different working habits, tools should be flexible and allow a user to customise tools functionalities. Ad hoc built tools usually are not flexible enough, as possible variations in tool functions had not been incorporated into the tool architecture to make future customisations possible. Finally, ad hoc design practice does not lead to accumulating the tool design know-how, makes it difficult to repeat successful solutions and slows down the process of understanding and improving tool design methods. We applied conceptual modelling in design of tools for software maintenance to alleviate some of the above problems. In this paper, we describe a model-based method to designing reverse engineering tools. The design starts by modelling low level source program design models, higher level design models to be recovered and heuristic rules a reverse engineering tool uses to recover higher level designs from lower level designs. On one hand, conceptual models lead to better understanding of tool requirements. On the other hand, model-based approach leads to the design of a generic design abstractor, a component of a reverse engineering tool that evaluates reverse engineering heuristics. A generic design abstractor adds flexibility to reverse engineering tools in two ways: (1) we can customise the generic design abstractor to meet requirements of a reverse engineering project in hand and (2) a programmer (an end-user of a reverse engineering tool) can define new reverse engineering heuristics and tune in recovered designs.

To support program comprehension, maintenance, and evolution, metamodels are frequently used during program reverse engineering activities to describe and analyze constituents of a program and their relations. Reverse engineering tools often define their own metamodels according to the intended purposes and features. Although each metamodel has its own advantages, its limitations may be addressed by other metamodels. Existing works have evaluated and compared metamodels and tools, but none have considered all the possible characteristics and limitations to provide a comprehensive guideline for classifying, comparing, reusing, and extending program metamodels. To aid practitioners and researchers in classifying, comparing, reusing, and extending program metamodels and their corresponding reverse engineering tools according to the intended goals, we establish a conceptual framework with definitions of program metamodels and related concepts. Then this framework is used to provide a comprehensive taxonomy, named Program Metamodel TAxonomy (ProMeTA), which incorporates newly identified characteristics into those stated in previous works, which were identified via a systematic literature survey on program metamodels, while keeping the orthogonality of the entire taxonomy. Additionally, we validate the taxonomy in terms of its orthogonality and usefulness through the classification of popular metamodels.

all the unnecessary information of data structures and types is removed at the end of compilation. However, the high level information is extremely valuable and necessary for many fields such as debugging, reverse engineering, security etc. Without data structures information, reverse engineering is extremely hard to perform. Unfortunately, even the most advanced techniques and tools for reverse engineering are very weak in this part. Recently, several new solutions have been proposed and each has made some achievements. In this paper, we summarize challenges in this problem, then analyze three existing outstanding approaches, discuss their limitations and at last propose some possible directions to make further efforts.

Cybersecurity attacks on embedded devices for industrial control systems and cyber-physical systems may cause catastrophic physical damage as well as economic loss. This could be achieved by infecting device binaries with malware that modifies the physical characteristics of the system operation. Mitigating such attacks benefits from reverse engineering tools that recover sufficient semantic knowledge in terms of mathematical equations of the implemented algorithm. Conventional reverse engineering tools can decompile binaries to low-level code, but offer little semantic insight. This article proposes the REMaQE automated framework for reverse engineering of math equations from binary executables. Improving over state-of-the-art, REMaQE handles equation parameters accessed via registers, the stack, global memory, or pointers, and can reverse engineer equations from object-oriented implementations such as C++ classes. Using REMaQE, we discovered a bug in the Linux kernel thermal monitoring tool “tmon.” To evaluate REMaQE, we generate a dataset of 25,096 binaries with math equations implemented in C and Simulink. REMaQE successfully recovers a semantically matching equation for all 25,096 binaries. REMaQE executes in 0.48 seconds on average and in up to 2 seconds for complex equations. Real-time execution enables integration in an interactive math-oriented reverse engineering workflow.

Maintenance and evolution of complex software systems (such as large telecom embedded devices) involve activities such as reverse engineering (RE) and software visualization. Although several RE tools exist, we found their architecture hard to adapt to the domain specific requirements posed by our current practice in Nokia. We present an open architecture which allows easy prototyping of RE data exploration and visualization scenarios for a large range of domain models. We pay special attention to the visual and interactive requirements of the reverse engineering process. The article describes the basic architecture of our toolkit, compares it to the existing RE environments and present several visualizations taken from real cases.

Damage of runners and other components of hydro turbine by sediment erosion and cavitation erosion is an inevitable problem associated with hydropower established in a region with mountainous topology. The paper attempts to investigate the suitability and sustainability of the reverse engineering method for the design of the eroded Francis runner. This manufacturing technology is in a progressive phase of development in various parts of the world, so research scholars have been constantly working on the concept to increase the speed and efficiency of the method. The case investigation was conducted on Puwa-Khola 1HPP eroded Francis runner. The paper investigates reverse engineering design methodology of the eroded runner and discusses scope and limitation in the utilization of method at Hydropower sector. Also, the paper suggests suitable 3D scanning techniques, reverse engineering tools, and optimization methods for obtaining mathematically sound models without any hydraulic profile deviation between actual and reversed engineered model.

The subject of the study is the process of restoring destroyed or damaged components of aircraft equipment using reverse engineering (RE) methods, particularly in situations where design documentation is unavailable and the equipment requires urgent return to service. The aim is to justify the effectiveness of reverse engineering technologies for generating digital models and technical documentation under field conditions, as well as to systematize typical aircraft components based on their suitability for scanning and prototyping. The tasks include: identifying categories of aircraft object (AO) components that can be promptly restored on-site; analyzing types of damage for which RE methods are most appropriate; developing a classifier of AO components and assemblies based on their geometry, size, material, and restoration accuracy requirements; and formulating an algorithm for selecting optimal scanning and modeling methods. The methods used include structural and functional analysis of the geometry of typical aircraft parts, technical evaluation of the capabilities of optical and contact 3D scanning, generation of polygonal models, CAD modeling, mirror reproduction of paired elements, and systematization based on empirical observations and technical testing under mobile maintenance conditions. The following results were obtained: a detailed classifier of AO components and assemblies was developed, comprising 11 categories based on shape, presence of holes, rigidity, and structural complexity; typical damage types that can be repaired using RE methods were identified; the effectiveness of mirror scanning of symmetrical paired parts in the absence of original reference components was substantiated. Critical factors affecting scanning quality were established. Conclusions: the methodology presented in the article enables technically sound restoration of aircraft components using reverse engineering tools, even under field conditions, without the need for original design documentation. The proposed classifier facilitates rapid identification of the damaged part type and selection of suitable scanning and CAD modeling techniques. The method has proven effective for both aerodynamic elements and moving joints of the "shaft-in-hole" type, where a new compatible part can be created based on the less worn component.

Semantic Web systems provide open interfaces for end-users to access data via a powerful high-level query language, SPARQL. But users unfamiliar with either the details of SPARQL or properties of the target dataset may find it easier to query by example -- give examples of the information they want (or examples of both what they want and what they do not want) and let the system reverse engineer the desired query from the examples. This approach has been heavily used in the setting of relational databases. We provide here an investigation of the reverse engineering problem in the context of SPARQL. We first provide a theoretical study, formalising variants of the reverse engineering problem and giving tight bounds on its complexity. We next explain an implementation of a reverse engineering tool for positive examples. An experimental analysis of the tool shows that it scales well in the data size, number of examples, and in the size of the smallest query that fits the data. We also give evidence that reverse engineering tools can provide benefits on real-life datasets.

In this tutorial, the Ghidra software reverse engineering framework will be presented, its characteristics highlighted and its features to the hitherto industry standard in reverse engineering tools, IDA Pro - the interactive disassembler, compared against. This framework was released on March the 5th 2019, by the National Security Agency under the Apache v2 license and brought with it a powerful decompiler for many different architectures (X86 16/32/64, ARM/AARCH64, Java/DEX bytecode, ...), which will be presented and its underlying intermediate language p-code and the corresponding SLEIGH-format explained. Further, hands-on demonstrations will follow, including the aforementioned SLEIGH-format, the plugin-system and the standalone-mode, showcased on different reverse engineering tasks like binary diffing, code lifting, deobfuscation and patching.

Before performing software maintenance and evolution tasks, developers must expend significant effort to understand the design of the subject software system. Reverse engineering and reengineering tools can extract artifacts, such as class diagrams, from source code so that the effort expended on program comprehension can be greatly reduced. Choosing suitable and appropriate tools is itself a difficult process. Many metrics and benchmarks have been proposed to evaluate the quality of reengineering tools, but the process is still complicated and requires much human effort. Furthermore, ignored by most evaluation experiments and approaches is the understanding of differences and similarities of the output artifacts produced by different tools. This paper proposes a novel approach for tool evaluation making a direct comparison of the output artifacts of the chosen tools. We apply our methodology on class diagrams extracted from source code. We utilize a class matching model to automate the process. In this study, we use ten open-source programs as test cases and two open source reverse engineering tools Doxygen and StarUML. We evaluate the output of these two tools based on class matching given the same input. This approach, we believe, provides developers with good guidance in tool selection.

Knowing which associations are compositions is important in a tool for the reverse engineering of UML class diagrams. Firstly, recovery of composition relationships bridges the gap between design and code. Secondly, since composition relationships explicitly state a requirement that certain representations cannot be exposed, it is important to determine if this requirement is met by component code. Verifying that compositions are implemented properly may prevent serious program flaws due to representation exposure. We propose an implementation-level composition model based on ownership and a novel approach for identifying compositions in Java software. Our approach is based on static ownership inference; it is parameterized by class analysis and is designed to work on incomplete programs. We present empirical results from two instantiation of our approach. For one of these instantiations, on average 40% of the examined fields account for relationships that are identified as compositions. In addition, we present a precision evaluation which shows that the analysis achieves almost perfect precision--that is, it almost never misses composition relationships. The results indicate that precise identification of interclass relationships can be done with a simple and inexpensive analysis, and thus can be easily incorporated in reverse engineering tools that support iterative model-driven development.

Reverse engineering tools support software engineers in the process of analysing and understanding complex software systems during maintenance, re-engineering or re-architecturing. The functionality of such tools varies from editing and browsing capabilities to the generation of textual and graphical reports. There are several commercial reverse engineering tools on the market providing different capabilities and supporting specific source code languages. We evaluated four reverse engineering tools that analyse C source code: Refine/C, Imagix 4D, SNiFF+ and Rigi. We investigated the capabilities of these tools by applying them to a real-world embedded software system as a case study. We identified benefits and shortcomings of these tools and assessed their applicability for embedded software systems, their usability and their extensibility. © 1998 John Wiley & Sons, Ltd.

The usefulness of design patterns in forward engineering is already well-known and several tools provide support for their application in the development of software systems. While the role of design patterns in reverse engineering is still argued primarily due to their informal definition which leads to various possible implementations of each pattern. One of the most discussed aspects related to design patterns is about the need of their formalization according to the drawbacks this can represent. Formalization leads to the identification of the so-called sub-patterns, which are the recurring fundamental elements design patterns are composed of. In this paper we analyze the role sub-patterns play-in two reverse engineering tools: FUJABA and SPQR. Attention is focused on how sub-patterns are exploited to define and to detect design patterns. To emphasize the similarities and differences between the two approaches, the Composite Design Pattern is considered as example. © 2005 IEEE.

Language models are successfully applied to the problem of analysing crime descriptions from a police database with the purpose of prioritising suspects for an unsolved crime, given details of solved crimes. The frequency of terms in each description relates to the behaviour of the offender and this can be used to link crimes to a common offender. Language modelling uses Bayes' theorem and thus require a prior probability. Such a prior can be based on each offender's past propensity to offend, derived from historic data. Language modelling yields a probability of a document being relevant, which in this case is interpreted as the probability of a suspect being the culprit. Although the absolute value of the probability does not carry any direct applied implications, the study does show that the general likelihood of identification of the actual suspect does correspond to the relative values. Thus these probabilities can be used for more than just ranking suspects.

Reverse engineering [ is a field of technology which has been under rapid development for several recent years. Optic scanners are basic devices used as reverse engineering tools. Point cloud describes the shape of a scanned object. Automatic turntable is a device which enables a scanning process from different viewing angles. In the paper, the algorithm is described which has been used for determination of rotation axis of a turntable. The obtained axis constitutes the base for an aggregation of particular point clouds into single resultant common cloud describing the shape of the scanned object. Usability of this algorithm for precise scanning of mechanical parts was validated, precision of shape replication was also evaluated.