On inserting program understanding technology into the software change process

SUMMARY Tools built in an ad hoc way and without proper models often display problems for both tool users and designers. Firstly, without systematic analysis and good understanding of the underlying software process model, we have little chance to design a tool that will adequately address user’s needs. Next, because one tool is often used in many different situations and by people who have different working habits, tools should be flexible and allow a user to customise tools functionalities. Ad hoc built tools usually are not flexible enough, as possible variations in tool functions had not been incorporated into the tool architecture to make future customisations possible. Finally, ad hoc design practice does not lead to accumulating the tool design know-how, makes it difficult to repeat successful solutions and slows down the process of understanding and improving tool design methods. We applied conceptual modelling in design of tools for software maintenance to alleviate some of the above problems. In this paper, we describe a model-based method to designing reverse engineering tools. The design starts by modelling low level source program design models, higher level design models to be recovered and heuristic rules a reverse engineering tool uses to recover higher level designs from lower level designs. On one hand, conceptual models lead to better understanding of tool requirements. On the other hand, model-based approach leads to the design of a generic design abstractor, a component of a reverse engineering tool that evaluates reverse engineering heuristics. A generic design abstractor adds flexibility to reverse engineering tools in two ways: (1) we can customise the generic design abstractor to meet requirements of a reverse engineering project in hand and (2) a programmer (an end-user of a reverse engineering tool) can define new reverse engineering heuristics and tune in recovered designs.

Reverse engineering tools support software engineers in the process of analysing and understanding complex software systems during maintenance, re-engineering or re-architecturing. The functionality of such tools varies from editing and browsing capabilities to the generation of textual and graphical reports. There are several commercial reverse engineering tools on the market providing different capabilities and supporting specific source code languages. We evaluated four reverse engineering tools that analyse C source code: Refine/C, Imagix 4D, SNiFF+ and Rigi. We investigated the capabilities of these tools by applying them to a real-world embedded software system as a case study. We identified benefits and shortcomings of these tools and assessed their applicability for embedded software systems, their usability and their extensibility. © 1998 John Wiley & Sons, Ltd.

Developers tend to leave some important steps and actions (e.g. properly designing the system's architecture, code review and testing) out of the software development process, and use risky practices (e.g. the copy-paste technique) so that the software can be released as fast as possible. However, these practices may turn out to be critical from the viewpoint of maintainability of the software system. In such cases, a cost-effective solution might be to re-engineer the system. Re-engineering consists of two stages, namely reverse-engineering information from the current system and, based on this information, forward-engineering the system to a new form. In this way, successful re-engineering significantly depends on the reverse engineering phase. Therefore, it is vital to guarantee correctness, and to improve the results of the reverse engineering step. Otherwise, the re-engineering of the software system could fail due to the bad results of reverse engineering. The above issues motivated us to develop a method which extends and improves one of our reverse engineering tools, and to develop benchmarks and to perform experiments on evaluating and comparing reverse engineering tools.

To support program comprehension, maintenance, and evolution, metamodels are frequently used during program reverse engineering activities to describe and analyze constituents of a program and their relations. Reverse engineering tools often define their own metamodels according to the intended purposes and features. Although each metamodel has its own advantages, its limitations may be addressed by other metamodels. Existing works have evaluated and compared metamodels and tools, but none have considered all the possible characteristics and limitations to provide a comprehensive guideline for classifying, comparing, reusing, and extending program metamodels. To aid practitioners and researchers in classifying, comparing, reusing, and extending program metamodels and their corresponding reverse engineering tools according to the intended goals, we establish a conceptual framework with definitions of program metamodels and related concepts. Then this framework is used to provide a comprehensive taxonomy, named Program Metamodel TAxonomy (ProMeTA), which incorporates newly identified characteristics into those stated in previous works, which were identified via a systematic literature survey on program metamodels, while keeping the orthogonality of the entire taxonomy. Additionally, we validate the taxonomy in terms of its orthogonality and usefulness through the classification of popular metamodels.

We propose a technique for analysis of impact of design changes using dynamic slicing of UML models. For a software architecture specified using UML, we first transform a given model into a graph representation which we have named Model Dependency Graph (MDG). MDG combines information available in the interaction model along with the relevant information available in class model into an integrated model. For a given slicing criterion, our slicing algorithm traverses the constructed MDG to identify the relevant model elements forming the dynamic slice. We use these slices to identify the model changes, and their impact. Our impact analysis methodology is based on using the difference between the dynamic slices computed before and after changes are made to the model. Our methodology's novelty lies in performing impact analysis based on a graph metamodel as against independently processing separate UML models.

When modifying a cyber-physical system, the consequences of changes need to be understood beforehand to adequately assess risks and costs. Model-based change impact analysis is key for estimating the impact of a change before actually modifying the system. Existing change impact analysis approaches apply very similar algorithms for change propagation to instances of domain-specific metamodels. However, they lack fundamental concepts for domain-spanning change impact analysis. In this paper, we propose a generic methodology for domain-spanning change impact analysis to address limitations of existing approaches. Evaluation results show the relevancy and comprehensives of the methodology for several domains.

all the unnecessary information of data structures and types is removed at the end of compilation. However, the high level information is extremely valuable and necessary for many fields such as debugging, reverse engineering, security etc. Without data structures information, reverse engineering is extremely hard to perform. Unfortunately, even the most advanced techniques and tools for reverse engineering are very weak in this part. Recently, several new solutions have been proposed and each has made some achievements. In this paper, we summarize challenges in this problem, then analyze three existing outstanding approaches, discuss their limitations and at last propose some possible directions to make further efforts.

Before performing software maintenance and evolution tasks, developers must expend significant effort to understand the design of the subject software system. Reverse engineering and reengineering tools can extract artifacts, such as class diagrams, from source code so that the effort expended on program comprehension can be greatly reduced. Choosing suitable and appropriate tools is itself a difficult process. Many metrics and benchmarks have been proposed to evaluate the quality of reengineering tools, but the process is still complicated and requires much human effort. Furthermore, ignored by most evaluation experiments and approaches is the understanding of differences and similarities of the output artifacts produced by different tools. This paper proposes a novel approach for tool evaluation making a direct comparison of the output artifacts of the chosen tools. We apply our methodology on class diagrams extracted from source code. We utilize a class matching model to automate the process. In this study, we use ten open-source programs as test cases and two open source reverse engineering tools Doxygen and StarUML. We evaluate the output of these two tools based on class matching given the same input. This approach, we believe, provides developers with good guidance in tool selection.

Cybersecurity attacks on embedded devices for industrial control systems and cyber-physical systems may cause catastrophic physical damage as well as economic loss. This could be achieved by infecting device binaries with malware that modifies the physical characteristics of the system operation. Mitigating such attacks benefits from reverse engineering tools that recover sufficient semantic knowledge in terms of mathematical equations of the implemented algorithm. Conventional reverse engineering tools can decompile binaries to low-level code, but offer little semantic insight. This article proposes the REMaQE automated framework for reverse engineering of math equations from binary executables. Improving over state-of-the-art, REMaQE handles equation parameters accessed via registers, the stack, global memory, or pointers, and can reverse engineer equations from object-oriented implementations such as C++ classes. Using REMaQE, we discovered a bug in the Linux kernel thermal monitoring tool “tmon.” To evaluate REMaQE, we generate a dataset of 25,096 binaries with math equations implemented in C and Simulink. REMaQE successfully recovers a semantically matching equation for all 25,096 binaries. REMaQE executes in 0.48 seconds on average and in up to 2 seconds for complex equations. Real-time execution enables integration in an interactive math-oriented reverse engineering workflow.

Knowing which associations are compositions is important in a tool for the reverse engineering of UML class diagrams. Firstly, recovery of composition relationships bridges the gap between design and code. Secondly, since composition relationships explicitly state a requirement that certain representations cannot be exposed, it is important to determine if this requirement is met by component code. Verifying that compositions are implemented properly may prevent serious program flaws due to representation exposure. We propose an implementation-level composition model based on ownership and a novel approach for identifying compositions in Java software. Our approach is based on static ownership inference; it is parameterized by class analysis and is designed to work on incomplete programs. We present empirical results from two instantiation of our approach. For one of these instantiations, on average 40% of the examined fields account for relationships that are identified as compositions. In addition, we present a precision evaluation which shows that the analysis achieves almost perfect precision--that is, it almost never misses composition relationships. The results indicate that precise identification of interclass relationships can be done with a simple and inexpensive analysis, and thus can be easily incorporated in reverse engineering tools that support iterative model-driven development.

Damage of runners and other components of hydro turbine by sediment erosion and cavitation erosion is an inevitable problem associated with hydropower established in a region with mountainous topology. The paper attempts to investigate the suitability and sustainability of the reverse engineering method for the design of the eroded Francis runner. This manufacturing technology is in a progressive phase of development in various parts of the world, so research scholars have been constantly working on the concept to increase the speed and efficiency of the method. The case investigation was conducted on Puwa-Khola 1HPP eroded Francis runner. The paper investigates reverse engineering design methodology of the eroded runner and discusses scope and limitation in the utilization of method at Hydropower sector. Also, the paper suggests suitable 3D scanning techniques, reverse engineering tools, and optimization methods for obtaining mathematically sound models without any hydraulic profile deviation between actual and reversed engineered model.

The subject of the study is the process of restoring destroyed or damaged components of aircraft equipment using reverse engineering (RE) methods, particularly in situations where design documentation is unavailable and the equipment requires urgent return to service. The aim is to justify the effectiveness of reverse engineering technologies for generating digital models and technical documentation under field conditions, as well as to systematize typical aircraft components based on their suitability for scanning and prototyping. The tasks include: identifying categories of aircraft object (AO) components that can be promptly restored on-site; analyzing types of damage for which RE methods are most appropriate; developing a classifier of AO components and assemblies based on their geometry, size, material, and restoration accuracy requirements; and formulating an algorithm for selecting optimal scanning and modeling methods. The methods used include structural and functional analysis of the geometry of typical aircraft parts, technical evaluation of the capabilities of optical and contact 3D scanning, generation of polygonal models, CAD modeling, mirror reproduction of paired elements, and systematization based on empirical observations and technical testing under mobile maintenance conditions. The following results were obtained: a detailed classifier of AO components and assemblies was developed, comprising 11 categories based on shape, presence of holes, rigidity, and structural complexity; typical damage types that can be repaired using RE methods were identified; the effectiveness of mirror scanning of symmetrical paired parts in the absence of original reference components was substantiated. Critical factors affecting scanning quality were established. Conclusions: the methodology presented in the article enables technically sound restoration of aircraft components using reverse engineering tools, even under field conditions, without the need for original design documentation. The proposed classifier facilitates rapid identification of the damaged part type and selection of suitable scanning and CAD modeling techniques. The method has proven effective for both aerodynamic elements and moving joints of the "shaft-in-hole" type, where a new compatible part can be created based on the less worn component.

Semantic Web systems provide open interfaces for end-users to access data via a powerful high-level query language, SPARQL. But users unfamiliar with either the details of SPARQL or properties of the target dataset may find it easier to query by example -- give examples of the information they want (or examples of both what they want and what they do not want) and let the system reverse engineer the desired query from the examples. This approach has been heavily used in the setting of relational databases. We provide here an investigation of the reverse engineering problem in the context of SPARQL. We first provide a theoretical study, formalising variants of the reverse engineering problem and giving tight bounds on its complexity. We next explain an implementation of a reverse engineering tool for positive examples. An experimental analysis of the tool shows that it scales well in the data size, number of examples, and in the size of the smallest query that fits the data. We also give evidence that reverse engineering tools can provide benefits on real-life datasets.

In this tutorial, the Ghidra software reverse engineering framework will be presented, its characteristics highlighted and its features to the hitherto industry standard in reverse engineering tools, IDA Pro - the interactive disassembler, compared against. This framework was released on March the 5th 2019, by the National Security Agency under the Apache v2 license and brought with it a powerful decompiler for many different architectures (X86 16/32/64, ARM/AARCH64, Java/DEX bytecode, ...), which will be presented and its underlying intermediate language p-code and the corresponding SLEIGH-format explained. Further, hands-on demonstrations will follow, including the aforementioned SLEIGH-format, the plugin-system and the standalone-mode, showcased on different reverse engineering tasks like binary diffing, code lifting, deobfuscation and patching.

Maintenance and evolution of complex software systems (such as large telecom embedded devices) involve activities such as reverse engineering (RE) and software visualization. Although several RE tools exist, we found their architecture hard to adapt to the domain specific requirements posed by our current practice in Nokia. We present an open architecture which allows easy prototyping of RE data exploration and visualization scenarios for a large range of domain models. We pay special attention to the visual and interactive requirements of the reverse engineering process. The article describes the basic architecture of our toolkit, compares it to the existing RE environments and present several visualizations taken from real cases.