Reverse Engineering Tools Research Articles

ProMeTA: a taxonomy for program metamodels in program reverse engineering

To support program comprehension, maintenance, and evolution, metamodels are frequently used during program reverse engineering activities to describe and analyze constituents of a program and their relations. Reverse engineering tools often define their own metamodels according to the intended purposes and features. Although each metamodel has its own advantages, its limitations may be addressed by other metamodels. Existing works have evaluated and compared metamodels and tools, but none have considered all the possible characteristics and limitations to provide a comprehensive guideline for classifying, comparing, reusing, and extending program metamodels. To aid practitioners and researchers in classifying, comparing, reusing, and extending program metamodels and their corresponding reverse engineering tools according to the intended goals, we establish a conceptual framework with definitions of program metamodels and related concepts. We confirmed that any reverse engineering activity can be clearly described as a pattern based on the framework from the viewpoint of program metamodels. Then the framework is used to provide a comprehensive taxonomy, named Program Metamodel TAxonomy (ProMeTA), which incorporates newly identified characteristics into those stated in previous works, which were identified via a systematic literature review (SLR) on program metamodels, while keeping the orthogonality of the entire taxonomy. Additionally, we validate the taxonomy in terms of its orthogonality and usefulness through the classification of popular metamodels.

Software System Package Dependencies and Visualization of Internal Structure

<span>This manuscript discusses the visualization methods of software systems architecture with composition of reverse engineering tools and restoration of software systems architecture. The visualization methods and analysis of dependencies in software packages are written in Java</span><em><span lang="AR-SA" dir="RTL">.</span></em><span> To use this performance graph</span><em></em><span>it needs to describe the relationships between classes inside the analyzed packages and between classes of different packages. In the manuscript also described the possibility of tools to provide the infrastructure for subsequent detection and error correction design in software systems and its refactoring.</span>

Spear and Shield: Evolution of Integrated Circuit Camouflaging

Intellectual property (IP) protection is one of the hardcore problems in hardware security. Semiconductor industry still lacks effective and proactive defense to shield IPs from reverse engineering (RE) based attacks. Integrated circuit (IC) camouflaging technique fills this gap by replacing some conventional logic gates in the IPs with specially designed logic cells (called camouflaged gates) without changing the functions of the IPs. The camouflaged gates can perform different logic functions while maintaining an identical look to RE attackers, thus preventing them from obtaining the layout information of the IP directly from RE tools. Since it was first proposed in 2012, circuit camouflaging has become one of the hottest research topics in hardware security focusing on two fundamental problems. How to choose the types of camouflaged gates and decide where to insert them in order to simultaneously minimize the performance overhead and optimize the RE complexity? How can an attacker de-camouflage a camouflaged circuit and complete the RE attack? In this article, we review the evolution of circuit camouflaging through this spear and shield race. First, we introduce the design methods of four different kinds of camouflaged cells based on true/dummy contacts, static random access memory (SRAM), doping, and emerging devices, respectively. Then we elaborate four representative de-camouflaging attacks: brute force attack, IC testing based attack, satisfiability-based (SAT-based) attack, and the circuit partition based attack, and the corresponding countermeasures: clique-based camouflaging, CamoPerturb, AND-tree camouflaging, and equivalent class based camouflaging, respectively. We argue that the current research efforts should be on reducing overhead introduced by circuit camouflaging and defeating de-camouflaging attacks. We point out that exploring features of emerging devices could be a promising direction. Finally, as a complement to circuit camouflaging, we conclude with a brief review of other state-of-the-art IP protection techniques.

A Survey of Automatic Protocol Reverse Engineering Approaches, Methods, and Tools on the Inputs and Outputs View

A network protocol defines rules that control communications between two or more machines on the Internet, whereas Automatic Protocol Reverse Engineering (APRE) defines the way of extracting the structure of a network protocol without accessing its specifications. Enough knowledge on undocumented protocols is essential for security purposes, network policy implementation, and management of network resources. This paper reviews and analyzes a total of 39 approaches, methods, and tools towards Protocol Reverse Engineering (PRE) and classifies them into four divisions, approaches that reverse engineer protocol finite state machines, protocol formats, and both protocol finite state machines and protocol formats to approaches that focus directly on neither reverse engineering protocol formats nor protocol finite state machines. The efficiency of all approaches’ outputs based on their selected inputs is analyzed in general along with appropriate reverse engineering inputs format. Additionally, we present discussion and extended classification in terms of automated to manual approaches, known and novel categories of reverse engineered protocols, and a literature of reverse engineered protocols in relation to the seven layers’ OSI (Open Systems Interconnection) model.

A Comparison of Android Reverse Engineering Tools via Program Behaviors Validation Based on Intermediate Languages Transformation

In Android, performing a program analysis directly on an executable source is usually inconvenient. Therefore, a reverse engineering technique has been adapted to enable a user to perform a program analysis on a textual form of the executable source which is represented by an intermediate language (IL). For Android, Smali, Jasmin, and Jimple ILs have been introduced to represent applications executable Dalvik bytecode in a human-readable form. To use these ILs, we downloaded three of the most popular Android reversing tools, including Apktool , dex2jar , and Soot , which perform transformation of the executable source into Smali, Jasmin, and Jimple ILs, respectively. However, the main concern here is that inaccurate transformation of the executable source may severely degrade the program analysis performance, and obscure the results. To the best of our knowledge, it is still unknown which tool most accurately performs a transformation of the executable source so that the re-assembled Android applications can be executed, and their original behaviors remain intact. Therefore, in this paper, we conduct an experiment to identify the tool which most accurately performs the transformation. We designed a statistical event-based comparative scheme, and conducted a comprehensive empirical study on a set of 1,300 Android applications. Using the designed scheme, we compare Apktool , dex2jar , and Soot via random-event-based and statistical tests to determine the tool which allows the re-assembled applications to be executed, and evaluate how closely they preserve their original behaviors. Our experimental results show that Apktool , using Smali IL, perform the most accurate transformation of the executable source since the applications, which are assembled from Smali, exhibit their behaviours closest to the original ones.

Reverse engineering modeling methods and tools: a survey

ABSTRACTReverse Engineering (RE) is a long-term goal of engineering and computer science; it aims at the reconstruction of CAD models from measured data by means of 3D mathematical surfaces and geometrical features representing the geometry of a physical part. In the last two decades, reviews and surveys have occasionally covered this topic, but a systematic dissertation of modeling methods from a mechanical engineering point of view is still missing. The purpose of this paper is to fill this gap; starting from a general description of the overall RE framework (acquisition, segmentation, classification, fitting), both an up-to-date survey and a categorization of available modeling techniques and tools working on 3D data are provided. The main aspects of various strategies are discussed as well, in order to highlight strengths and weaknesses characterizing different approaches. Moreover, an overview of commercial software for RE is presented, considering both dedicated solutions and packages supplied as ad...

Identifying Classes in Legacy JavaScript Code

JavaScript is the most popular programming language for the Web. Although the language is prototype-based, developers can emulate class-based abstractions in JavaScript to master the increasing complexity of their applications. Identifying classes in legacy JavaScript code can support these developers at least in the following activities: (i) program comprehension; (ii) migration to the new JavaScript syntax that supports classes; and (iii) implementation of supporting tools, including IDEs with class-based views and reverse engineering tools. In this paper, we propose a strategy to detect class-based abstractions in the source code of legacy JavaScript systems. We report on a large and in-depth study to understand how class emulation is employed, using a dataset of 918 JavaScript applications available on GitHub. We found that almost 70% of the JavaScript systems we study make some usage of classes. We also performed a field study with the main developers of 60 popular JavaScript systems in order to validate our findings. The overall results range from 97% to 100% for precision, from 70% to 89% for recall, and from 82% to 94% for F-score.

Ranking Novel Regulatory Genes in Gene Expression Profiles using NetExpress.

Understanding gene regulation by identifying gene products and determining their roles in regulatory networks is a complex process. A common computational method is to reverse engineer a regulatory network from gene expression profile, and sanitize the network using known information about the genes, their interactions and other properties to filter out unlikely interactors. Unfortunately, due to limited resources most gene expression studies have a limited and small number of time points, and most reverse engineering tools are unable to handle large numbers of genes. Both of these factors play significant roles in influencing the accuracy of the process. In this paper, we present a new gene ranking algorithm from gene expression profiles with a small number of time points so that the most relevant genes can be selected for reverse engineering. We also present a graphical interface called NetExpress, which adopts this algorithm and allows users to set control parameters to effect the desired outcome, and visualize the analysis for iterative fine tuning.

State of the art of network protocol reverse engineering tools

Communication protocols enable structured information exchanges between different entities. A description, at different levels of detail, is necessary for many applications, such as interoperability or security audits. When such a description is not available, one can resort to protocol reverse engineering to infer the format of exchanged messages or a model of the protocol. During the past 12 years, several tools have been developed in order to automate, entirely or partially, the protocol inference process. Each of those tools has been developed with a specific application goal for the inferred model, leading to specific needs, and thus different strengths and limitations. After identifying key challenges, the paper presents a survey of protocol reverse engineering tools developed in the last decade. We consider tools focusing on the inference of the format of individual messages or of the grammar of sequences of messages. Finally, we propose a classification of these tools according to different criteria, that is aimed at providing relevant insights about the techniques used by each of these tools and comparatively to other tools, for the classification of messages, the inference of their format or of the grammar of the protocol. This classification also permits to identify technical areas that are not sufficiently explored so far and that require further development in the future.

Metabolomic Profiling as a Possible Reverse Engineering Tool for Estimating Processing Conditions of Dry-Cured Hams.

Dry-cured hams are popular among consumers. To increase the attractiveness of the product, objective analytical methods and algorithms to evaluate the relationship between observable properties and consumer acceptability are required. In this study, metabolomics, which is used for quantitative profiling of hundreds of small molecules, was applied to 12 kinds of dry-cured hams from Japan and Europe. In total, 203 charged metabolites, including amino acids, organic acids, nucleotides, and peptides, were successfully identified and quantified. Metabolite profiles were compared for the samples with different countries of origin and processing methods (e.g., smoking or use of a starter culture). Principal component analysis of the metabolite profiles with sensory properties revealed significant correlations for redness, homogeneity, and fat whiteness. This approach could be used to design new ham products by objective evaluation of various features.

Empirical analysis of anti-reversing schemes for protecting mobile codes in the internet-of-things

Java-based Android apps are primarily composed of managed code. Managed codes can be easily modified; therefore many static prevention techniques are applied. However, static prevention techniques can be immobilised by dynamic reverse engineering tools. Reverse engineering tools for such managed code operate using QEMU-based emulator methods. Among the many anti-reversing techniques to detect tampering of the application, schemes that terminate the application when an emulator has been detected are being used. In this paper, we compare and analyse the characteristics of the various schemes used to detect emulator-based reverse engineering tools and report experimental results on the effectiveness of the methods in question.

Empirical analysis of anti-reversing schemes for protecting mobile codes in the internet-of-things

Java-based Android apps are primarily composed of managed code. Managed codes can be easily modified; therefore many static prevention techniques are applied. However, static prevention techniques can be immobilised by dynamic reverse engineering tools. Reverse engineering tools for such managed code operate using QEMU-based emulator methods. Among the many anti-reversing techniques to detect tampering of the application, schemes that terminate the application when an emulator has been detected are being used. In this paper, we compare and analyse the characteristics of the various schemes used to detect emulator-based reverse engineering tools and report experimental results on the effectiveness of the methods in question.

Critical evaluation of reverse engineering tool Imagix 4D!

IntroductionThe comprehension of legacy codes is difficult to understand. Various commercial reengineering tools are available that have unique working styles, and are equipped with their inherent capabilities and shortcomings. The focus of the available tools is in visualizing static behavior not the dynamic one. Therefore, it is difficult for people who work in software product maintenance, code understanding reengineering/reverse engineering. Consequently, the need for a comprehensive reengineering/reverse engineering tool arises. We found the usage of Imagix 4D to be good as it generates the maximum pictorial representations in the form of flow charts, flow graphs, class diagrams, metrics and, to a partial extent, dynamic visualizations.Case description and evolutionWe evaluated Imagix 4D with the help of a case study involving a few samples of source code. The behavior of the tool was analyzed on multiple small codes and a large code gcc C parser. Large code evaluation was performed to uncover dead code, unstructured code, and the effect of not including required files at preprocessing level. The utility of Imagix 4D to prepare decision density and complexity metrics for a large code was found to be useful in getting to know how much reengineering is required. At the outset, Imagix 4D offered limitations in dynamic visualizations, flow chart separation (large code) and parsing loops.ConclusionThe outcome of evaluation will eventually help in upgrading Imagix 4D and posed a need of full featured tools in the area of software reengineering/reverse engineering. It will also help the research community, especially those who are interested in the realm of software reengineering tool building.

IP protection through gate-level netlist security enhancement

In modern Integrated Circuits (IC) design flow, from specification to chip fabrication, various security threats are emergent. These range from malicious modifications in the design, to the Electronic Design Automation (EDA) tools, during layout or fabrication, or to the packaging. Of particular concern are modifications made to third-party IP cores and commercial off-the-shelf (COTS) chips where no Register Transfer Level (RTL) code or golden models are available. While chip level reverse engineering techniques can help rebuild circuit gate-level netlist from fabricated chips, there still lacks a netlist reverse engineering tool which can recover the full functionality of the rebuilt netlist. Toward this direction, we develop a tool, named Reverse Engineering Finite State Machine (REFSM), that helps end-users reconstruct a high-level description of the control logic from a flattened netlist. We demonstrate that REFSM effectively recovers circuit control logic from netlists with varying degrees of complexity. Experimental results also show that the REFSM can easily identify malicious logic from a flattened (or even obfuscated) netlist. Supported by REFSM, another tool, called Reverse Engineering Hardware Obfuscation for Protection (REHOP), is developed to enhance gate-level netlist security without learning the RTL code.

Reverse engineering approach for precise measurement of the physical attributes related to the geometric features of agricultural products

The irregular shape of most agricultural products complicates their physical and engineering analysis. Therefore, precise description of the irregular product geometric surface form/shape is significant for any related analyses used in both product quality evaluation and design of agricultural machinery systems. This study describes a reverse engineering application procedure for precise description of the physical attributes related to geometric features (size, shape, volume etc.) of the agricultural products under consideration. In the study, a three-dimensional (3D) laser scanner has been utilised and 3D digital model data of the selected sample agricultural product (Pecan Fruit) processed in the virtual environment through 3D scanner software and 3D parametric solid modelling design software has been collected. After 3D solid models were created, some of the physical attributes related to geometric features of the agricultural products were measured precisely and realistic virtual 3D computer aided design (CAD) data was provided for deeper rheological investigation such as structural deformation, fluid dynamics (flow) and heat transfer analyses of the products by means of computer aided engineering (CAE) techniques. Finally, a comparative deformation simulation case study was concluded. This study contributes to further research into the development of agricultural machinery and equipment through the utilisation of reverse engineering and CAD tools.

A NOVEL APPROACH FOR CUSTOMIZED PROSTHETIC SOCKET DESIGN

The manufacturing of limb prosthesis socket that is comfortable for the amputee depends greatly on prosthetic practitioner’s knowledge of socket biomechanics and skill. It involves multistage manual corrections depending upon the clinical condition of the patient’s residual limb which may be affected by shrinkage or possible damage of plaster of paris (PoP) mold. The current work describes a novel process simplified through digitization, it integrates conventional PoP processes, reverse engineering (RE), and additive manufacturing (AM) technologies to design and develop a socket. The stereolithography (STL) file generated from the scan data was modeled on a fused deposition modeling (FDM) based AM. Its fitment was assessed with the help of INSPECTPLUS and GEOMAGIC reverse engineering tools. This approach takes the guess work out of prosthetic practitioner’s job, ensures better fitment, and shortens the total fabrication time leading to improved patient satisfaction. The proposed method is a part of the ongoing research and it will offer maximum comfort on demand to the patients through digitization.

EXACT: A tool for comprehending VBA-based Excel spreadsheet applications

Spreadsheet applications are widely adopted by millions of end users from several application domains and provide strategic support to many business, scientific, industrial, and organizational processes. These applications are usually developed by rapid application development processes, exploiting host scripting languages allowing the basic spreadsheets to provide complex functionality, business rules, and user interfaces. Several factors complicate the comprehension of these applications because they are usually developed and maintained by end users without specific software engineering skills, grow over time, are not adequately documented, and do not present explicit separation between data, business logic, and user interface layers. This paper presents a reverse engineering tool intended to support the comprehension of Excel spreadsheet applications developed using the Visual Basic for Application programming language. The tool has been implemented as an add-in that extends the Excel working environment by providing analysis and visualization features. It is able to extract information about the elements composing the analyzed Excel spreadsheet application, the functionality it exposes through its user interface, and the dependencies among its cells. This information is provided by means of interactive views. The validity of the tool has been assessed by a qualitative case study performed with professional end users from an automotive industrial domain. Copyright © 2016 John Wiley & Sons, Ltd.

Modelo Ontológico para Contextos de uso de Herramientas de Ingeniería Inversa

An ontological model to select the most appropriate reverse engineering tools for a specific context of use is presented. The ontological model was developed using the methodology of Stanford University, established by Noy and McGuinness and was validated with 38 reverse engineering tools. The ontology was implemented with the Protege tool and 32 determinant characteristics were identified to describe the contexts of use of reverse engineering tools, discriminating those conditions that are necessary and desired for each context of use. It is concluded that the proposed ontological model facilitates the selection of reverse engineering tools for a particular context of use and contributes to lowering the costs of software maintenance, by reducing efforts and optimizing processes.

A Survey of Automatic Protocol Reverse Engineering Tools

Computer network protocols define the rules in which two entities communicate over a network of unique hosts. Many protocol specifications are unknown, unavailable, or minimally documented, which prevents thorough analysis of the protocol for security purposes. For example, modern botnets often use undocumented and unique application-layer communication protocols to maintain command and control over numerous distributed hosts. Inferring the specification of closed protocols has numerous advantages, such as intelligent deep packet inspection, enhanced intrusion detection system algorithms for communications, and integration with legacy software packages. The multitude of closed protocols coupled with existing time-intensive reverse engineering methodologies has spawned investigation into automated approaches for reverse engineering of closed protocols. This article summarizes and organizes previously presented automatic protocol reverse engineering tools by approach. Approaches that focus on reverse engineering the finite state machine of a target protocol are separated from those that focus on reverse engineering the protocol format.

Obtaining and Visualization of the Topological Functioning Model from the UML Model

Abstract A domain model can provide compact information about its corresponding software system for business people. If the software system exists without its domain model and documentation it is time-consuming to understand its behavior and structure only from the code. Reverse Engineering (RE) tools can be used for obtaining behavior and structure of the software system from source code. After that the domain model can be created. A short overview and an example of obtaining the domain model, Topological Functioning Model (TFM), from source code are provided in the paper. Positive and negative effects of the process of TFM backward derivation are also discussed.