REMaQE: Reverse Engineering Math Equations from Executables

SUMMARY Tools built in an ad hoc way and without proper models often display problems for both tool users and designers. Firstly, without systematic analysis and good understanding of the underlying software process model, we have little chance to design a tool that will adequately address user’s needs. Next, because one tool is often used in many different situations and by people who have different working habits, tools should be flexible and allow a user to customise tools functionalities. Ad hoc built tools usually are not flexible enough, as possible variations in tool functions had not been incorporated into the tool architecture to make future customisations possible. Finally, ad hoc design practice does not lead to accumulating the tool design know-how, makes it difficult to repeat successful solutions and slows down the process of understanding and improving tool design methods. We applied conceptual modelling in design of tools for software maintenance to alleviate some of the above problems. In this paper, we describe a model-based method to designing reverse engineering tools. The design starts by modelling low level source program design models, higher level design models to be recovered and heuristic rules a reverse engineering tool uses to recover higher level designs from lower level designs. On one hand, conceptual models lead to better understanding of tool requirements. On the other hand, model-based approach leads to the design of a generic design abstractor, a component of a reverse engineering tool that evaluates reverse engineering heuristics. A generic design abstractor adds flexibility to reverse engineering tools in two ways: (1) we can customise the generic design abstractor to meet requirements of a reverse engineering project in hand and (2) a programmer (an end-user of a reverse engineering tool) can define new reverse engineering heuristics and tune in recovered designs.

Developers tend to leave some important steps and actions (e.g. properly designing the system's architecture, code review and testing) out of the software development process, and use risky practices (e.g. the copy-paste technique) so that the software can be released as fast as possible. However, these practices may turn out to be critical from the viewpoint of maintainability of the software system. In such cases, a cost-effective solution might be to re-engineer the system. Re-engineering consists of two stages, namely reverse-engineering information from the current system and, based on this information, forward-engineering the system to a new form. In this way, successful re-engineering significantly depends on the reverse engineering phase. Therefore, it is vital to guarantee correctness, and to improve the results of the reverse engineering step. Otherwise, the re-engineering of the software system could fail due to the bad results of reverse engineering. The above issues motivated us to develop a method which extends and improves one of our reverse engineering tools, and to develop benchmarks and to perform experiments on evaluating and comparing reverse engineering tools.

To support program comprehension, maintenance, and evolution, metamodels are frequently used during program reverse engineering activities to describe and analyze constituents of a program and their relations. Reverse engineering tools often define their own metamodels according to the intended purposes and features. Although each metamodel has its own advantages, its limitations may be addressed by other metamodels. Existing works have evaluated and compared metamodels and tools, but none have considered all the possible characteristics and limitations to provide a comprehensive guideline for classifying, comparing, reusing, and extending program metamodels. To aid practitioners and researchers in classifying, comparing, reusing, and extending program metamodels and their corresponding reverse engineering tools according to the intended goals, we establish a conceptual framework with definitions of program metamodels and related concepts. Then this framework is used to provide a comprehensive taxonomy, named Program Metamodel TAxonomy (ProMeTA), which incorporates newly identified characteristics into those stated in previous works, which were identified via a systematic literature survey on program metamodels, while keeping the orthogonality of the entire taxonomy. Additionally, we validate the taxonomy in terms of its orthogonality and usefulness through the classification of popular metamodels.

all the unnecessary information of data structures and types is removed at the end of compilation. However, the high level information is extremely valuable and necessary for many fields such as debugging, reverse engineering, security etc. Without data structures information, reverse engineering is extremely hard to perform. Unfortunately, even the most advanced techniques and tools for reverse engineering are very weak in this part. Recently, several new solutions have been proposed and each has made some achievements. In this paper, we summarize challenges in this problem, then analyze three existing outstanding approaches, discuss their limitations and at last propose some possible directions to make further efforts.

Maintenance and evolution of complex software systems (such as large telecom embedded devices) involve activities such as reverse engineering (RE) and software visualization. Although several RE tools exist, we found their architecture hard to adapt to the domain specific requirements posed by our current practice in Nokia. We present an open architecture which allows easy prototyping of RE data exploration and visualization scenarios for a large range of domain models. We pay special attention to the visual and interactive requirements of the reverse engineering process. The article describes the basic architecture of our toolkit, compares it to the existing RE environments and present several visualizations taken from real cases.

Damage of runners and other components of hydro turbine by sediment erosion and cavitation erosion is an inevitable problem associated with hydropower established in a region with mountainous topology. The paper attempts to investigate the suitability and sustainability of the reverse engineering method for the design of the eroded Francis runner. This manufacturing technology is in a progressive phase of development in various parts of the world, so research scholars have been constantly working on the concept to increase the speed and efficiency of the method. The case investigation was conducted on Puwa-Khola 1HPP eroded Francis runner. The paper investigates reverse engineering design methodology of the eroded runner and discusses scope and limitation in the utilization of method at Hydropower sector. Also, the paper suggests suitable 3D scanning techniques, reverse engineering tools, and optimization methods for obtaining mathematically sound models without any hydraulic profile deviation between actual and reversed engineered model.

The subject of the study is the process of restoring destroyed or damaged components of aircraft equipment using reverse engineering (RE) methods, particularly in situations where design documentation is unavailable and the equipment requires urgent return to service. The aim is to justify the effectiveness of reverse engineering technologies for generating digital models and technical documentation under field conditions, as well as to systematize typical aircraft components based on their suitability for scanning and prototyping. The tasks include: identifying categories of aircraft object (AO) components that can be promptly restored on-site; analyzing types of damage for which RE methods are most appropriate; developing a classifier of AO components and assemblies based on their geometry, size, material, and restoration accuracy requirements; and formulating an algorithm for selecting optimal scanning and modeling methods. The methods used include structural and functional analysis of the geometry of typical aircraft parts, technical evaluation of the capabilities of optical and contact 3D scanning, generation of polygonal models, CAD modeling, mirror reproduction of paired elements, and systematization based on empirical observations and technical testing under mobile maintenance conditions. The following results were obtained: a detailed classifier of AO components and assemblies was developed, comprising 11 categories based on shape, presence of holes, rigidity, and structural complexity; typical damage types that can be repaired using RE methods were identified; the effectiveness of mirror scanning of symmetrical paired parts in the absence of original reference components was substantiated. Critical factors affecting scanning quality were established. Conclusions: the methodology presented in the article enables technically sound restoration of aircraft components using reverse engineering tools, even under field conditions, without the need for original design documentation. The proposed classifier facilitates rapid identification of the damaged part type and selection of suitable scanning and CAD modeling techniques. The method has proven effective for both aerodynamic elements and moving joints of the "shaft-in-hole" type, where a new compatible part can be created based on the less worn component.

In this tutorial, the Ghidra software reverse engineering framework will be presented, its characteristics highlighted and its features to the hitherto industry standard in reverse engineering tools, IDA Pro - the interactive disassembler, compared against. This framework was released on March the 5th 2019, by the National Security Agency under the Apache v2 license and brought with it a powerful decompiler for many different architectures (X86 16/32/64, ARM/AARCH64, Java/DEX bytecode, ...), which will be presented and its underlying intermediate language p-code and the corresponding SLEIGH-format explained. Further, hands-on demonstrations will follow, including the aforementioned SLEIGH-format, the plugin-system and the standalone-mode, showcased on different reverse engineering tasks like binary diffing, code lifting, deobfuscation and patching.

Reverse engineering complex proprietary software is a tedious and time consuming task. A fair amount of the overall effort is usually devoted to locating those software components which are responsible for the functionality of interest (e.g., a proprietary encryption algorithm). To aid this process, several tools, available in the public domain, can be used, implementing sophisticated algorithms for control-flow recovery, stack frame recovery, data type inference, decompilation etc. However, the important problem of decomposing a binary executable to its constituent object files (or compile-units) has not been, in our opinion, sufficiently studied. In this paper we present novel techniques for estimating the number, as well as the boundaries, of compile-units in binary executables. We present algorithms which recover information that improves the precision degree in reverse engineering tasks. In addition, our algorithms can be used to reduce the effort of locating, recovering and understanding specific functionalities of closed-source software. We evaluate our algorithms on the public DeepBinDiff ELF dataset, consisting of $$\approx$$ 2000 binaries, as well as two larger executables of GNU GDB, built for ARM and AArch64 and show that they consistently approach the ground-truth, with an average recovery precision close to 75%. Furthermore, we show how our research can aid in binary diffing applications, by comparing the recovered compile-unit structure of a pair of Microsoft Windows kernel images. We make our prototype implementation, written in Python and named REcover , publicly available for further evaluation by the reverse engineering community.

Semantic Web systems provide open interfaces for end-users to access data via a powerful high-level query language, SPARQL. But users unfamiliar with either the details of SPARQL or properties of the target dataset may find it easier to query by example -- give examples of the information they want (or examples of both what they want and what they do not want) and let the system reverse engineer the desired query from the examples. This approach has been heavily used in the setting of relational databases. We provide here an investigation of the reverse engineering problem in the context of SPARQL. We first provide a theoretical study, formalising variants of the reverse engineering problem and giving tight bounds on its complexity. We next explain an implementation of a reverse engineering tool for positive examples. An experimental analysis of the tool shows that it scales well in the data size, number of examples, and in the size of the smallest query that fits the data. We also give evidence that reverse engineering tools can provide benefits on real-life datasets.

The vehicle industry is quickly becoming more connected and growing. This growth is due to advancements in cyber physical systems (CPSs) that enhance the safety and automation in vehicle. The modern automobile consists of more than 70 electronic control units (ECUs) that communicate and interact with each other over automotive bus systems. Passenger comforts, infotainment features, and connectivity continue to progress through the growth and integration of Internet-of-Things (IoT) technologies. Common networks include the Controller Area Network (CAN), Local Interconnect Network (LIN), and FlexRay. However, the benefits of increased connectivity and features comes with the penalty of increased vulnerabilities. Security is lacking in preventing attacks on safety-critical control systems. I will explore the state of the art methods and approaches researchers have taken to identify threats and how to address them with intrusion detection. I discuss the development of a hybrid based intrusion detection approach that combines anomaly and signature based detection methods. Machine learning is a hot topic in security as it is a method of learning and classifying system behavior and can detect intrusions that alter normal behavior. In this paper, we discuss utilizing machine learning algorithms to assist in classifying CAN messages. I present work that focuses on the reverse engineering and classification of CAN messages. The problem is that even though CAN is standardized, the implementation may vary for different manufacturers and vehicle models. These implementations are kept secret, therefore CAN messages for every vehicle needs to be analyzed and reverse engineered in order to get information. Due to the lack of publicly available CAN specifications, attackers and researchers need to reverse engineer messages to pinpoint which messages will have the desired impact. The reverse engineering process is needed by researchers and hackers for all manufacturers and their respective vehicles to understand what the vehicle is doing and what each CAN message means. The knowledge of the specifications of CAN messages can improve the effectiveness of security mechanisms applied to CAN.

Abstract. In this study, a customized hinged ankle-foot orthosis (AFO) was de-signed by using reverse engineering and computer-aided design (CAD) tools.. For that, the following three steps were followed: first, obtain a digital replica of the foot, ankle and lower leg area to be covered by the AFO by using a 3D scan-ner; second, create the internal and external surfaces of the AFO in a reverse en-gineering software program; and third, create the design of the AFO in a CAD software program. These types of methods for creating AFOs are less labor in-tensive than traditional ones, and enable to create AFOs of different materials, in less time and with better fit and aesthetics. Keywords: Ankle-foot orthosis, customization, computer-aided design, reverse engineering, 3D scanner.

The usefulness of design patterns in forward engineering is already well-known and several tools provide support for their application in the development of software systems. While the role of design patterns in reverse engineering is still argued primarily due to their informal definition which leads to various possible implementations of each pattern. One of the most discussed aspects related to design patterns is about the need of their formalization according to the drawbacks this can represent. Formalization leads to the identification of the so-called sub-patterns, which are the recurring fundamental elements design patterns are composed of. In this paper we analyze the role sub-patterns play-in two reverse engineering tools: FUJABA and SPQR. Attention is focused on how sub-patterns are exploited to define and to detect design patterns. To emphasize the similarities and differences between the two approaches, the Composite Design Pattern is considered as example. © 2005 IEEE.

Language models are successfully applied to the problem of analysing crime descriptions from a police database with the purpose of prioritising suspects for an unsolved crime, given details of solved crimes. The frequency of terms in each description relates to the behaviour of the offender and this can be used to link crimes to a common offender. Language modelling uses Bayes' theorem and thus require a prior probability. Such a prior can be based on each offender's past propensity to offend, derived from historic data. Language modelling yields a probability of a document being relevant, which in this case is interpreted as the probability of a suspect being the culprit. Although the absolute value of the probability does not carry any direct applied implications, the study does show that the general likelihood of identification of the actual suspect does correspond to the relative values. Thus these probabilities can be used for more than just ranking suspects.

Reverse engineering [ is a field of technology which has been under rapid development for several recent years. Optic scanners are basic devices used as reverse engineering tools. Point cloud describes the shape of a scanned object. Automatic turntable is a device which enables a scanning process from different viewing angles. In the paper, the algorithm is described which has been used for determination of rotation axis of a turntable. The obtained axis constitutes the base for an aggregation of particular point clouds into single resultant common cloud describing the shape of the scanned object. Usability of this algorithm for precise scanning of mechanical parts was validated, precision of shape replication was also evaluated.