Reverse Engineering Tools Research Articles

REMaQE: Reverse Engineering Math Equations from Executables

Cybersecurity attacks on embedded devices for industrial control systems and cyber-physical systems may cause catastrophic physical damage as well as economic loss. This could be achieved by infecting device binaries with malware that modifies the physical characteristics of the system operation. Mitigating such attacks benefits from reverse engineering tools that recover sufficient semantic knowledge in terms of mathematical equations of the implemented algorithm. Conventional reverse engineering tools can decompile binaries to low-level code, but offer little semantic insight. This paper proposes the REMaQE automated framework for reverse engineering of math equations from binary executables. Improving over state-of-the-art, REMaQE handles equation parameters accessed via registers, the stack, global memory, or pointers, and can reverse engineer equations from object-oriented implementations such as C++ classes. Using REMaQE, we discovered a bug in the Linux kernel thermal monitoring tool “tmon”. To evaluate REMaQE, we generate a dataset of 25,096 binaries with math equations implemented in C and Simulink. REMaQE successfully recovers a semantically matching equation for all 25,096 binaries. REMaQE executes in 0.48 seconds on average and in up to 2 seconds for complex equations. Real-time execution enables integration in an interactive math-oriented reverse engineering workflow.

Creating a common notation of the x86 processor software interface for automated disassembler construction

The subject of the study is the process of reverse engineering of programs in order to obtain their source code in low- or high-level languages for processors with x86 architecture, the software interface of which is developed by Intel and AMD. The object of the study is the technical specifications in the documentation produced by these companies. The intensity of updating documentation for processors is investigated and the need to develop technological approaches aimed at automated disassembler construction, taking into account regularly released and frequent updates of the processor software interface, is justified. The article presents a method for processing documentation in order to obtain a generalized, formalized and uniform specification of processor commands for further automated translation into the disassembler program code. The article presents two main results: the first is an analysis of the various options for describing commands presented in the Intel and AMD documentation, and a concise reduction of these descriptions to a monotonous form of representation; the second is a comprehensive syntactic analysis of machine code description notations and the form of representation of each command in assembly language. This, taking into account some additional details of the description of the commands, for example, the permissible operating mode of the processor when executing the command, made it possible to create a generalized description of the command for translating the description into the disassembler code. The results of the study include the identification of a number of errors in both the documentation texts and in the operation of existing industrial disassemblers, built, as shown by the analysis of their implementation, using manual coding. The identification of such errors in the existing reverse engineering tools is an indirect result of the author's research.

Detection of malicious PE files using synthesized DNA artifacts

The availability of sophisticated IT tools has provided computer system attackers with the capacity to develop dangerous metamorphic or polymorphic malware. Such malware presents behaviors similar to biological viruses enabling them to evade detection from conventional anti-malware methods. To circumvent this challenge, we carried out this research experiment to build and train machine learning models, and our proposed models achieved 99% & 99.6% accuracy in detecting and classifying PE-oriented malware. This excellent performance of our proposed models is undoubtedly a function of several factors but majorly on the synthesized DNA datasets (from our previous research works), which we used to train our proposed models. The synthesized DNA datasets are composed of salient features (dynamic and static) extracted from behaviors of nonmalicious programs (.exe, .dll, etc.) before and after infection by malware using reverse engineering and tracing tools. Then using a encoding algorithm and bioinformatics tools, we synthesized these features into a DNA-like representation (data sets) akin to the biological Deoxyribonucleic acid(DNA).

PREE: Heuristic builder for reverse engineering of network protocols in industrial control systems

Industrial control systems (ICS) play a critical role in the operation of our vital infrastructures. They consist of field sites and a control center, with programmable logic controllers (PLCs) used at field sites to control physical processes directly. These systems communicate with the control center using proprietary protocols for remote monitoring, control, and configuration. The ability to reverse engineer these protocols can improve digital forensics techniques for investigating ICS attacks. The existing methods for reversing ICS protocols are manual forensics, binary analysis, probabilistic methods, or predefined network traffic analysis tools. ICS protocols, designed to operate in industrial environments, exhibit overlapping functionality, like uploading/downloading control logic to a PLC, which results in shared standard fields, such as function code and PLC memory address. Our hypothesis is that knowledge of one ICS protocol can aid in reverse engineering other proprietary ICS protocols. The paper introduces a heuristic builder, PREE, which enables control engineers with ICS protocol knowledge to create heuristics for identifying fields in other ICS protocols. We test our hypothesis by creating seven heuristic variants using the rolling window, vertical window, and frequency table techniques. We evaluate our heuristics on six ICS protocols, i.e., Modbus TCP, UMAS, ENIP, Omron FINS, CLICK, and PCCC. The evaluation involves five PLCs from four vendors: Modicon M221, Allen Bradley 1400 and 1100, Omron CP1L, and AutomationDirect CLICK Koyo. Results show that PREE can effectively identify common fields in multiple protocols, such as function code, message type, message length, PLC memory address, data size, and session/transaction IDs. PREE outperforms existing reverse engineering tools like NetPlier, Netzob, and Discoverer in terms of accuracy, conciseness, completeness, and consistency. We also demonstrate PREE's applications in a vulnerability study on CLICK Koyo PLC and present SNORT rules for investigating various attacks on it.

Authorship Identification of Binary and Disassembled Codes Using NLP Methods

This article is part of a series aimed at determining the authorship of source codes. Analyzing binary code is a crucial aspect of cybersecurity, software development, and computer forensics, particularly in identifying malware authors. Any program is machine code, which can be disassembled using specialized tools and analyzed for authorship identification, similar to natural language text using Natural Language Processing methods. We propose an ensemble of fastText, support vector machine (SVM), and the authors’ hybrid neural network developed in previous works in this research. The improved methodology was evaluated using a dataset of source codes written in C and C++ languages collected from GitHub and Google Code Jam. The collected source codes were compiled into executable programs and then disassembled using reverse engineering tools. The average accuracy of author identification for disassembled codes using the improved methodology exceeds 0.90. Additionally, the methodology was tested on the source codes, achieving an average accuracy of 0.96 in simple cases and over 0.85 in complex cases. These results validate the effectiveness of the developed methodology and its applicability to solving cybersecurity challenges.

PREIUD: An Industrial Control Protocols Reverse Engineering Tool Based on Unsupervised Learning and Deep Neural Network Methods

The security of industrial control systems relies on the communication and data exchange capabilities provided by industrial control protocols, which can be complex, and may even use encryption. Reverse engineering these protocols has become an important topic in industrial security research. In this paper, we present PREIUD, a reverse engineering tool for industrial control protocols, based on unsupervised learning and deep neural network methods. The reverse process is divided into stages. First, we use the bootstrap voting expert algorithm to infer the keyword segment boundaries of the protocols, considering the symmetry properties. Then, we employ a bidirectional long short-term memory conditional random field with an attention mechanism to classify the protocols and extract their format and semantic features. We manually constructed data sample sets for six commonly used industrial protocols, and used them to train and test our model, comparing its performance to two advanced protocol reverse tools, MSERA and Discoverer. Our results showed that PREIUD achieved an average accuracy improvement of 7.4% compared to MSERA, and 15.4% compared to Discoverer, while also maintaining a balance between computational conciseness and efficiency. Our approach represents a significant advancement in the field of industrial control protocol reverse engineering, and we believe it has practical implications for securing industrial control systems.

Automatically Distilling Storyboard With Rich Features for Android Apps

Before developing a new mobile app, the development team usually endeavors painstaking efforts to review many existing apps with similar purposes. The review process is crucial in the sense that it reduces market risks and provides inspirations for app development. However, manual exploration of hundreds of existing apps by different roles (e.g., product manager, UI/UX designer, developer, and tester) can be ineffective. For example, it is difficult to completely explore all the functionalities of the app from different aspects including design, implementation, and testing in a short period of time. However, existing reverse engineering tools only provide basic features such as AndroidManifest.xml and Java source files for users. Following the conception of storyboard in movie production, we propose a system, named StoryDistiller, to automatically generate the storyboards for Android apps with rich features through reverse engineering, and assist different roles to review and analyze apps effectively and efficiently. Specifically, we (1) propose a hybrid method to extract a relatively complete Activity transition graph (ATG), that is, it first extracts the ATG of Android apps through static analysis method first, and further leverages dynamic component exploration to augment ATG; (2) extract the required inter-component communication (ICC) data of each target Activity by leveraging static data-flow analysis and renders UI pages dynamically by using app instrumentation together with the extracted required ICC data; (3) obtain rich features including comprehensive ATG with rendered UI pages, semantic activity names, corresponding logic and layout code, etc. (4) implement the storyboard visualization as a web service with the rendered UI pages and the corresponding rich features. Our experiments unveil that StoryDistiller is effective and indeed useful to assist app exploration and review. We also conduct a comprehensive comparison study to demonstrate better performance over IC3, Gator, Stoat, and StoryDroid.

Genetic manipulations in helminth parasites.

Screening of vaccine or drug target in parasitic helminth is hindered by lack of robust tool for functional studies of parasite protein which account for the availability of only a few anti-helminthic vaccines, diagnostic assay and slower pace of development of an anthelmintic drug. With the piling up of parasite transcriptomic and genomic data, in silico screening for possible vaccine/drug target could be validated by functional characterization of proteins by RNA interference or CRISPR/Cas9. These reverse genetic engineering tools have opened up a better avenue and opportunity for screening parasitic proteins in vitro as well as in vivo. RNA interference provides a technique for silencing targeted mRNA transcript for understanding a gene function in helminth as evidence by work in Caenorhabditis elegans. Recent genetic engineering tool, CRISPR/Cas9 allows knock-out/deletion of the desired gene in parasitic helminths and the other provision it provides in terms of gene knock-in/insertion in parasite genome is still to be explored in future. This manuscript discussed the work that has been carried out on RNAi and CRISPR/Cas9 for functional studies of helminth parasitic proteins.

Метод розроблення специфікацій та вимог в процесі реінжинірингу ІТ-проектів

In this study, the aim is to create and improve a methodology for synthesizing requirements and specifications for the re-engineering of IT projects with maximum efficiency and business orientation. The main task is to adapt outdated IT systems to the changing technical environment, in particular to cloud technologies and security system requirements. To achieve these goals, the proposed methodology uses the analysis of archaic systems, the reverse engineering method, expert surveys, documentation analysis, and black-box modeling. The application of these methods allows for the identification and revision of requirements and specifications, ensuring a high level of quality and efficiency in the process of re-engineering IT projects. The article further discusses the practical aspects of applying the methodology, prospects for further development, and the peculiarities of using various statistical methods in the process of improving re-engineering results. The operating principles of the method are described along with the main approaches and techniques that promote the analysis of existing IT systems, the synthesis of requirements and specifications, quality control, and successful project implementation. The individual components of the method include the collection of data about the existing system and the analysis of archaic systems to restore the definition of requirements. The use of the black-box model for testing the developed system is discussed, including the analysis of the obtained results, correction of requirements, and improvement of specifications. The methodology includes documentation analysis tools, reverse engineering, surveys and data visualization tools, as well as analytical techniques such as a formula for parallel testing, a formula for requirement traceability matrix, and a formula for forecasting requirements based on discrepancy rate analysis. As a result of implementing the IT project reengineering method, successful transition from old to new technologies can be achieved, the IT industry can be optimized, and conditions can be created for adaptation to modern technical environments, ensuring stability and reliability of the implemented reengineering projects. Based on the analysis of modern sources, previous experience, and conducted research, it can be asserted that the method for synthesizing specifications and requirements in the process of reengineering IT projects is of great importance and relevance for the modern development of information technology and business processes.

Droid-MCFG: Android malware detection system using manifest and control flow traces with multi-head temporal convolutional network

Android is the most popular mobile operating system, making it the main target of malware attacks. Machine learning-based attack detection techniques have recently emerged as promising methods that relies heavily on particular features to classify malware. Despite machine learning-based malware detectors having hundreds of features, attackers can use feature-related expertise to generate malware variants to avoid detection. Therefore, the Android security team must constantly develop novel features to detect suspicious attacks. This paper proposes a novel malware detection method called Droid-MCFG that combines the Android features of manifest and Control Flow Graph (CFG). First, reverse engineering tools are used to mine manifest files and Java source codes from Android Package Kit (APK). Second, to represent Android apps with elevated features, we develop a features selection method that retrieves API calls and API sequences from CFGs. The API calls and manifest information are then combined to produce digital fingerprints of Android app actions. Third, a transfer learning approach based on word2vec is developed to extract trained features from digital fingerprints. To thoroughly analyze the novel features, the word2vec is fine-tuned with random, static, and dynamic strategies. Finally, the multi-head Temporal Convolutional Network (TCN) is designed to identify malware based on fine-tuned features. The TCN employs casual convolutions and dilations due to its temporality and broad receptive fields, making it very responsive to API-call sequences and malware activities in the manifest file. The proposed method achieves a classification accuracy of 96.24% using the CICInvesAndMal2019 dataset.

Security Analysis on Blockchain-Powered Mobile APPs Connected with In-Vehicle Networks by Context-Based Reverse Engineering

The controller area network (CAN) bus for interconnection of electronic control units (ECUs) plays a highly important role in modern intelligent vehicles. To facilitate the CAN Bus accessing to vehicle control or diagnosis, a number of mobile APPs are designed and published by automobile manufacturers to support driving and vehicle-based social network, and some are realized through the in-vehicle infotainment (IVI) middleware. Blockchain technologies are also mature for automobiles to interact service information with the whole industry. Unfortunately, there is a serious threat of command leakage from these mobile APPs, and the reverse engineering (RE) can be exploited by hackers. Previous work has researched this threat by an automatic reverse engineering tool on both automotive android and IOS APPs. However, in such common tool, APP itself-related contexts, including the feature information of CAN Bus commands, vehicle application functions, and control diagnostic protocols, are overlooked, which might be utilized to promote the reverse engineering recall. In this paper, we propose a context-based reverse engineering approach to find deep hidden commands for further revealing security threats for blockchain-powered mobile automotive APPs. For the reverse engineering, we design a context model of four-order tensor to organize multidimensional contexts and establish a continuous updating mechanism. Based on the context model, we further develop two basic analysis algorithms, max-compute (A) and clustering (A), to perform the analysis of CAN Bus commands. Extensive experiments are conducted, and we evaluate it by two metrics, recovered ratio and correctness ratio. Experimental results and the case studied on the familiar APP Carly validate the effectiveness of our approach and reveal the threat of command leakage.

AmandaSystem: A new framework for static and dynamic Android malware analysis

The focus of a large amount of research on malware detection is currently working on proposing and improving neural network structures, but with the constant updates of Android, the proposed detection methods are more like a race against time. Through the analysis of these methods, we found that the basic processes of these detection methods are roughly the same, and these methods rely on professional reverse engineering tools for malware analysis and feature extraction. These tools generally have problems such as high time-space cost consumption, difficulty in achieving concurrent analysis of a large number of Apk, and the output results are not convenient for feature extraction. Is it possible to propose a general malware detection process implementation platform that optimizes each process of existing malware detection methods while being able to efficiently extract various features on malware datasets with a large number of APK? To solve this problem, we propose an automated platform, AmandaSystem, that highly integrates the various processes of deep learning-based malware detection methods. At the same time, the problem of over privilege due to the openness of Android system and thus the problem of excessive privileges has always required the accurate construction of mapping relationships between privileges and API calls, while the current methods based on function call graphs suffer from inefficiency and low accuracy. To solve this problem, we propose a new bottom-up static analysis method based on AmandaSystem to achieve an efficient and complete tool for mapping relationships between Android permissions and API calls, PerApTool. Finally, we conducted tests on three publicly available malware datasets, CICMalAnal2017, CIC-AAGM2017, and CIC-InvesAndMal2019, to evaluate the performance of AmandaSystem in terms of time efficiency of APK parsing, space occupancy, and comprehensiveness of extracted features, respectively, compared with existing methods were compared.

Optimal Covert Communication Techniques

Due to advancements in hacking and reverse engineering tools, threat against transfer of sensitive data or highly classified information is always at risk of being intercepted by an attacker. Covert communication outwits this malicious breach of privacy act better than cryptography as it camouflages secret information inside another innocent looking information, while cryptography shows scrambled information that might arouse attention of an attacker. However, the challenges in Steganography are the modification of carrier that causes some abnormalities, which are detectable and often the methods are not optimized. This paper presents an approach in Covert communication Chanel, which utilizes mathematical concept of combination to optimize time of transmission using sets of multiple transmitters, and receivers addresses where each abstractly represents a set of bits or characters combination without modifying the address. To minimize the number of physical address for use, a combination and permutation concept of virtual address generation from physical address is introduce. The paper in addition presents some technique like relationship and their application in both re-enforcing resistivity against Steganalysis and generating combinations. Furthermore, a concept of dynamical clockwise and anti-clockwise rotation of combination over addresses after every transmission is introduced to improve on resistivity against Steganalysis. A simple test was performed for demonstrating relay address, combination and permutation concepts. Based on test results and analysis, the method is effective as expected and it is quite easy to use as it can be implemented in different platforms without much difficulties.

Android Password Managers and Vault Applications: Data Storage Security Issues Identification

The data entrusted to a password manager / vault application is the most valuable asset for which such application is responsible to provide a secure long-term storage. To check to what degree the popular Android password managers / vault applications are protecting the long-term stored data entrusted to them, we analyze the data storage security of two of them, based on both the public and private knowledge about their implementations that are available from their official documentations, their source code or can be revealed by using advanced reverse engineering tools and techniques, including runtime analysis and debugging techniques. More specifically, we suggest a data storage security issues identification methodology and then we apply this methodology to conduct a digital investigation in a forensically sound manner. Based on the investigation results, a potential investigator will be able to read, reconstruct and forge some of the data which have been created by the legitimate user and entrusted to the examined password managers / vault applications. In addition to this, a potential investigator will also be able to change certain applications settings on behalf of the legitimate user. To confirm our findings and also to verify their applicability, we develop several different custom attacks against the examined applications. More precisely, we conduct simulative attacks against the latest versions of the examined applications in order to provide a proof of concept showing how the security of these applications can be breached by a potential attacker.

Forecasting of the efficiency of monoclonal therapy in the treatment of CoViD-19 induced by the Omicron variant of SARS-CoV2

On November 26, 2021, the World Health Organization (WHO) announced a new variant of concern of SARS-CoV2 called Omicron. This variant has biological–functional characteristics such as to make it much faster in the infectious process so as to show an even more intense spread. Although many data are currently incomplete, it is possible to identify, based on the viral biochemical characteristics, a possible therapy consisting of a monoclonal antibody called Sotrovimab. The model proposed here is based on the mathematical analysis of the dynamics of action of this monoclonal antibody and two cell populations: the immune memory cells and the infected cells. Indeed, a delay exists during the physiological immune response and the response induced by administration of Sotrovimab. This manuscript presents that delay in a novel manner. The model is developed with the aid of information based on the chemical kinetics. The machine learning tools have been used to satisfy the criteria designed by the dynamical analysis. Regression learner tools of Python are used as the reverse engineering tools for the understanding of the balance in the mathematical model, maintained by the parameters and their corresponding intervals and thresholds set by the dynamical analysis.

Survey on Reverse-Engineering Tools for Android Mobile Devices

With the presence of the Internet and the frequent use of mobile devices to send several transactions that involve personal and sensitive information, it becomes of great importance to consider the security aspects of mobile devices. And with the increasing use of mobile applications that are utilized for several purposes such as healthcare or banking, those applications have become an easy and attractive target for attackers who want to get access to mobile devices and obtain users’ sensitive information. Developing a secure application is very important; otherwise, attackers can easily exploit vulnerabilities in mobile applications which lead to serious security issues such as information leakage or injecting applications with malicious programs to access user data. In this paper, we survey the literature on application security on mobile devices, specifically mobile devices running on the Android platform, and exhibit security threats in the Android system. In addition, we study many reverse-engineering tools that are utilized to exploit vulnerabilities in applications. We demonstrate several reverse-engineering tools in terms of methodology, security holes that can be exploited, and how to use these tools to help in developing more secure applications.

Malware analysis: Reverse engineering tools using santuko linux

The mobile malware is scaling up in terms of numbers and in degree of sophistication. The analysis of mobile malware is challenging for several reasons e.g., mobile apps are context aware and use the device resources which can pose greater risks for their security. In this work, a novel approach for the analysis of mobile malware is explored. The mobile malware is analyzed buying the commercially available reverse engineering tools. The complete cycle of reverse engineering is narrated for a benchmark mobile malware which starts from apk file to java code. The reverse engineered code of malware is of huge importance for extracting the malware patterns especially from sophisticated malwares like spyware and Trojans. The results show that the tools can be used to extract the complete source code of the malware which can potentially be used for dynamic analysis.

QRev: migrating quantum code towards hybrid information systems

Quantum computing is now a reality, and its incomparable computational power has led companies to show a great interest in being able to work with quantum software in order to support part of their current and future business operations. However, the quantum computing paradigm differs significantly from its classical counterparts, which has brought about the need to revolutionise how the future software is designed, built, and operated in order to work with quantum computers. Since companies cannot discard all their current (and probably mission-critical) information systems, they must adapt their classical information systems to new specific quantum applications, thus evolving towards hybrid information systems. Unfortunately, there are no specific methods with which to deal with this challenge. We believe that reengineering, and more specifically, software modernisation using model-driven engineering principles, could be useful as regard migrating classical systems and existing quantum programs towards hybrid information systems. This paper, therefore, presents QRev, a reverse engineering tool that analyses quantum programs developed in Q# in order to identify its components and interrelationships, and then generates abstract models that can be used in software modernisation processes. The platform-independent models are generated according to the Knowledge Discovery Metamodel (KDM) standard. QRev is validated in a case study involving five quantum programs in order to demonstrate its effectiveness and scalability. The main implication of the study is that QRev can be used in order to attain KDM models, which can subsequently be employed to restructure or add new quantum functionality at a higher abstraction level, i.e. independently of the specific quantum technology.

A multi-sided market of personal data resource allocation: An empirical study of China’s car-hailing platform

The current rapid development of online car-hailing services creates a serious challenge to the existing paradigm of market governance and antitrust policy. However, the debate on the market structure of the car-hailing platform requires more empirical evidence to uncover its functions. This research adopts an interdisciplinary methodology based on computer science and economics, and including software reverse engineering tools applied to the interoperability of the terminal application and resource allocation model, to demonstrate the topological market structure of personal data resources allocation in China’s car-hailing industry. Within the discussion of the hybrid nature of technology and economy, the analysis results clearly show that China’s car-hailing platform services present a multi-sided market structure when seen from the perspective of personal data resource allocation. Personal data resource (PDR), that is considered an essential market resource, is applied as an asset transferred unhindered between platforms via the application programming interface, and thus, creating a new market allocation mechanism. The connection between the car-hailing platforms and social media platforms is an essential aspect of the market competition in the domain. As applications of online platforms increase in the global context, this research offers a new perspective in personal data resource allocation with implications for the governance of the platform economy.

Influence of pore-size distributions and pore-wall mechanics on the mechanical behavior of cellular solids like aerogels.

The pore-size distributions play a critical role in the determination of the properties of nanoporous cellular materials like aerogels. In this paper, we propose a micromechanical model, and by further designing artificial normal pore-size distributions, we inspect their effect on the macroscopic stress-strain curves. We show that the location of the mean pore size as well as the broadness of the distribution strongly affects the overall macroscopic behavior. Moreover, we also show that by using different damage criteria within the proposed model, the elastic, inelastic, and brittle nature of the macroscopic material can be captured. The damage criteria are based on the different modes of deformation in the pore walls, namely, elastic buckling, irreversible bending and brittle collapse under compression, and combined bending and stretching under tension. The proposed model approach serves as a reverse engineering tool to develop cellular solids with desired mechanical properties.