Automatic Reverse Engineering Research Articles

Security Analysis on Blockchain-Powered Mobile APPs Connected with In-Vehicle Networks by Context-Based Reverse Engineering

The controller area network (CAN) bus for interconnection of electronic control units (ECUs) plays a highly important role in modern intelligent vehicles. To facilitate the CAN Bus accessing to vehicle control or diagnosis, a number of mobile APPs are designed and published by automobile manufacturers to support driving and vehicle-based social network, and some are realized through the in-vehicle infotainment (IVI) middleware. Blockchain technologies are also mature for automobiles to interact service information with the whole industry. Unfortunately, there is a serious threat of command leakage from these mobile APPs, and the reverse engineering (RE) can be exploited by hackers. Previous work has researched this threat by an automatic reverse engineering tool on both automotive android and IOS APPs. However, in such common tool, APP itself-related contexts, including the feature information of CAN Bus commands, vehicle application functions, and control diagnostic protocols, are overlooked, which might be utilized to promote the reverse engineering recall. In this paper, we propose a context-based reverse engineering approach to find deep hidden commands for further revealing security threats for blockchain-powered mobile automotive APPs. For the reverse engineering, we design a context model of four-order tensor to organize multidimensional contexts and establish a continuous updating mechanism. Based on the context model, we further develop two basic analysis algorithms, max-compute (A) and clustering (A), to perform the analysis of CAN Bus commands. Extensive experiments are conducted, and we evaluate it by two metrics, recovered ratio and correctness ratio. Experimental results and the case studied on the familiar APP Carly validate the effectiveness of our approach and reveal the threat of command leakage.

Automatic Reverse Engineering of Script Engine Binaries for Building Script API Tracers

Script languages are designed to be easy-to-use and require low learning costs. These features provide attackers options to choose a script language for developing their malicious scripts. This diversity of choice in the attacker side unexpectedly imposes a significant cost on the preparation for analysis tools in the defense side. That is, we have to prepare for multiple script languages to analyze malicious scripts written in them. We call this unbalanced cost for script languages asymmetry problem . To solve this problem, we propose a method for automatically detecting the hook and tap points in a script engine binary that is essential for building a script Application Programming Interface (API) tracer. Our method allows us to reduce the cost of reverse engineering of a script engine binary, which is the largest portion of the development of a script API tracer, and build a script API tracer for a script language with minimum manual intervention. This advantage results in solving the asymmetry problem. The experimental results showed that our method generated the script API tracers for the three script languages popular among attackers (Visual Basic for Applications (VBA), Microsoft Visual Basic Scripting Edition (VBScript), and PowerShell). The results also demonstrated that these script API tracers successfully analyzed real-world malicious scripts.

Attribution of Gradient Based Adversarial Attacks for Reverse Engineering of Deceptions

Machine Learning (ML) algorithms are susceptible to adversarial attacks and deception both during training and deployment. Automatic reverse engineering of the toolchains behind these adversarial machine learning attacks will aid in recovering the tools and processes used in these attacks. In this paper, we present two techniques that support automated identification and attribution of adversarial ML attack toolchains using Co-occurrence Pixel statistics and Laplacian Residuals. Our experiments show that the proposed techniques can identify parameters used to generate adversarial samples. To the best of our knowledge, this is the first approach to attribute gradient based adversarial attacks and estimate their parameters. Source code and data is available at: <ext-link ext-link-type="url" xlink:href="https://github.com/michael-goebel/ei_red">https://github.com/michael-goebel/ei_red</ext-link>.

READ: Reverse Engineering of Automotive Data Frames

Security analytics and forensics applied to in-vehicle networks are growing research areas that gained relevance after recent reports of cyber-attacks against unmodified licensed vehicles. However, the application of security analytics algorithms and tools to the automotive domain is hindered by the lack of public specifications about proprietary data exchanged over in-vehicle networks. Since the controller area network (CAN) bus is the de-facto standard for the interconnection of automotive electronic control units, the lack of public specifications for CAN messages is a key issue. This paper strives to solve this problem by proposing READ: a novel algorithm for the automatic Reverse Engineering of Automotive Data frames. READ has been designed to analyze traffic traces containing unknown CAN bus messages in order to automatically identify and label different types of signals encoded in the payload of their data frames. Experimental results based on CAN traffic gathered from a licensed unmodified vehicle and validated against its complete formal specifications demonstrate that the proposed algorithm can extract and classify more than twice the signals with respect to the previous related work. Moreover, the execution time of signal extraction and classification is reduced by two orders of magnitude. Applications of READ to CAN messages generated by real vehicles demonstrate its usefulness in the analysis of CAN traffic.

Target function location based on code coverage analysis

How to locate the target function faster and more accurately is a key problem of Automatic Reverse-Engineering of Software Programs. In order to solve this problem, a target function location method based on code coverage analysis is proposed. Firstly, it obtains function call information of the program and calculate the suspicious rate of each function. And then a stability factor is proposed to reduce the noise functions. Finally, the target function is successfully located. The experimental results show the method proposed has linear time complexity. For software programs with million function calls, it can accurately locate the target function within several minutes, the performance and accuracy are greately improved compared to the contrast methods.

A direct method to solve optimal knots of B-spline curves: An application for non-uniform B-spline curves fitting.

B-spline functions are widely used in many industrial applications such as computer graphic representations, computer aided design, computer aided manufacturing, computer numerical control, etc. Recently, there exist some demands, e.g. in reverse engineering (RE) area, to employ B-spline curves for non-trivial cases that include curves with discontinuous points, cusps or turning points from the sampled data. The most challenging task in these cases is in the identification of the number of knots and their respective locations in non-uniform space in the most efficient computational cost. This paper presents a new strategy for fitting any forms of curve by B-spline functions via local algorithm. A new two-step method for fast knot calculation is proposed. In the first step, the data is split using a bisecting method with predetermined allowable error to obtain coarse knots. Secondly, the knots are optimized, for both locations and continuity levels, by employing a non-linear least squares technique. The B-spline function is, therefore, obtained by solving the ordinary least squares problem. The performance of the proposed method is validated by using various numerical experimental data, with and without simulated noise, which were generated by a B-spline function and deterministic parametric functions. This paper also discusses the benchmarking of the proposed method to the existing methods in literature. The proposed method is shown to be able to reconstruct B-spline functions from sampled data within acceptable tolerance. It is also shown that, the proposed method can be applied for fitting any types of curves ranging from smooth ones to discontinuous ones. In addition, the method does not require excessive computational cost, which allows it to be used in automatic reverse engineering applications.

Automatic Reverse Engineering of Private Flight Control Protocols of UAVs

The increasing use of civil unmanned aerial vehicles (UAVs) has the potential to threaten public safety and privacy. Therefore, airspace administrators urgently need an effective method to regulate UAVs. Understanding the meaning and format of UAV flight control commands by automatic protocol reverse-engineering techniques is highly beneficial to UAV regulation. To improve our understanding of the meaning and format of UAV flight control commands, this paper proposes a method to automatically analyze the private flight control protocols of UAVs. First, we classify flight control commands collected from a binary network trace into clusters; then, we analyze the meaning of flight control commands by the accumulated error of each cluster; next, we extract the binary format of commands and infer field semantics in these commands; and finally, we infer the location of the check field in command and the generator polynomial matrix. The proposed approach is validated via experiments on a widely used consumer UAV.

Toward a Timetabling Qt Application Modernization

Nowadays, we note that there is a big change in technologies. To track these changes, the evolution of software development practices is required. MDE provides modernization techniques that can quickly follow these changes. We adopt this approach in order to modernize the legacy Qt timetabling application user interfaces. We conducted an automatic reverse engineering of Qt interfaces in order to have as output RIA interfaces. This automatic process reproduces user interfaces with a modern representation and retains data related to graphical components namely properties, position and actions. To illustrate this approach, let us consider FET as our legacy Qt timetabling application.

ADM-Based Migration from JAVA Swing to RIA Applications

Companies are investing a lot of resources and effort for migrating their legacy applications and adapting them with the rapid technological changes. For this reason, the authors are interested in the modernization of desktop applications developed in Java Swing to Web 2.0 applications. Therefore, an ADM approach is applied in order to develop a tool named FlexMigration allowing automatic reverse engineering of Swing GUI to obtain a RIA GUI. The usefulness of this tool is the automation of the migration process with the extraction of the actions encapsulated in possible anonymous classes. As an illustration, they present along this paper a reengineering of a small legacy chat application. The authors explain its migration process to generate a similar Flex Graphical User Interface.

A taint based approach for automatic reverse engineering of gray-box file formats

File format vulnerabilities have been highlighted in recent years, and the performance of fuzzing tests relies heavily on the knowledge of target formats. In this paper, we present systematic algorithms and methods to automatically reverse engineer input file formats. The methodology employs dynamic taint analysis to reveal implicit relational information between input file and binary procedures, which is used for the measurement of correlations among data bytes, format segmentation and data type inference. We have implemented a prototype, and its general tests on 10 well-published binary formats yielded an average of over 85 % successful identification rate, while more detailed structural information was unveiled beyond coarse granular format analysis. Besides, a practical pseudo-fuzzing evaluation method is discussed in accordance with real-world demands on security analysis, and the evaluation results demonstrated the practical effectiveness of our system.

Research on the Automatic Method of Reverse Engineering System in Innovation Design

The idea of Automatic Reverse Engineering was brought forward, which reduced the requirements of modeling experience, constructed surface more efficient and especially got a more accuracy model. Its main idea was converting triangular meshes which could be easily got automatically and could express arbitrarily complex models into quadrilateral meshes.The concept of reverse engineering, reverse design process and reverse analysis were introduced in this paper, which has been used in teaching practice of mechanical design specialized curriculum, the students will be guided to apply the automatic method of reverse design to the innovation design of product by motorcycle as an example.

Gene regulatory networks reconstruction from time series datasets using genetic programming: a comparison between tree-based and graph-based approaches

Genetic programming researchers have shown a growing interest in the study of gene regulatory networks in the last few years. Our team has also contributed to the field, by defining two systems for the automatic reverse engineering of gene regulatory networks called GRNGen and GeNet. In this paper, we revise this work by describing in detail the two approaches and empirically comparing them. The results we report, and in particular the fact that GeNet can be used on large networks while GRNGen cannot, encourage us to pursue the study of GeNet in the future. We conclude the paper by discussing the main research directions that we are planning to investigate to improve GeNet.

Position-based automatic reverse engineering of network protocols

Automatic protocol reverse engineering is a process of extracting protocol message formats and protocol state machine without access to the specification of target protocol. Protocol reverse engineering is useful for addressing many problems of network management and security, such as network management, honey-pot systems, intrusion detection, Botnet detection and prevention, and so on. Currently, protocol reverse engineering is mainly a manual and painstaking process which is time-consuming and error-prone. In this paper, we present a novel approach for automatic reverse engineering application-layer network protocols. We extract protocol keywords from network traces based on their support rates and variances of positions, reconstruct message formats, and infer protocol state machines. We implement our approach in a prototype system called AutoReEngine and evaluate it over four text-based protocols (HTTP, POP3, SMTP and FTP) and two binary protocols (DNS and NetBIOS). The results show that our AutoReEngine outperforms the existing algorithms.

Automatic Reverse Engineering Based on Reconstructing Measurement Data in 3D-Lattice

Reverse engineering systems are used to construct mathematical models of physical models such as clay model based on measurement data. In this study, we proposed a reverse engineering method which can construct high quality surface data automatically. This method consists of the following steps; The first globally and regionally smooths measured data based on the target shape by fitting quadric surface to measurement data. The second defines quadric surfaces and converts measurement points into 3D lattice points to obtain uniform measurement data density. As the positions of measurement data are converted from coordinate values into 3D lattice points, it is easier to find neighboring points and clarify neighboring relations between surfaces. The third acquires segment measurement data based on maximum curvatures and normals at each point. The last defines NURBS surfaces for each segment using the least square method to average positional errors. In order to validate the effectiveness of the proposed method, we developed a reverse engineering system and constructed mathematical models through basic experiments using clay car model measurement data.

On the evaluation of the Bunch search-based software modularization algorithm

The first part of this paper describes an automatic reverse engineering process to infer subsystem abstractions that are useful for a variety of software maintenance activities. This process is based on clustering the graph representing the modules and module-level dependencies found in the source code into abstract structures not in the source code called subsystems. The clustering process uses evolutionary algorithms to search through the enormous set of possible graph partitions, and is guided by a fitness function designed to measure the quality of individual graph partitions. The second part of this paper focuses on evaluating the results produced by our clustering technique. Our previous research has shown through both qualitative and quantitative studies that our clustering technique produces good results quickly and consistently. In this part of the paper we study the underlying structure of the search space of several open source systems. We also report on some interesting findings our analysis uncovered by comparing random graphs to graphs representing real software systems.

Automated feature-based registration for reverse engineering of human models

In order to reconstruct a full 3D human model in reverse engineering (RE), a 3D scanner needs to be placed arbitrarily around the target model to capture all part of the scanned surface. Then, acquired multiple scans must be registered and merged since each scanned data set taken from different position is just given in its own local co-ordinate system. The goal of the registration is to create a single model by aligning all individual scans. It usually consists of two sub-steps: rough and fine registration. The fine registration process can only be performed after an initial position is approximated through the rough registration. Hence an automated rough registration process is crucial to realize a completely automatic RE system. In this paper an automated rough registration method for aligning multiple scans of complex human face is presented. The proposed method automatically aligns the meshes of different scans with the information of features that are extracted from the estimated principal curvatures of triangular meshes of the human face. Then the roughly aligned scanned data sets are further precisely enhanced with a fine registration step with the recently popular Iterative Closest Point (ICP) algorithm. Some typical examples are presented and discussed to validate the proposed system.