Interactive function identification decreasing the effort of reverse engineering

Fatih Kilic; Hannes Laner; Claudia Eckert

doi:10.1007/978-3-319-38898-4_27

Interactive function identification decreasing the effort of reverse engineering

Fatih Kilic, Hannes Laner, Claudia Eckert

Informatics 20 - Chair of IT Security

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

Abstract

Today’s software is growing in size and complexity. Consequently analysing closed-source binaries becomes time-consuming and labour-intensive. In the common use case, the analyst is only interested in specific functions of the given application. Identifying the relevant functions is difficult since no related meta information is given. In this paper we present a framework which speeds up the reverse-engineering process using interactive function identification. We use the benefits of Dynamic Binary Instrumentation as base to collect the executed function calls. We support the analyst in filtering the relevant functions for specific functionality. Our approach is divided into three process steps. Realtime data gathering, user defined information processing/filtering and graphical representation. We show a significant speed up in the reverse engineering process using our framework. We reduce the number of executed functions to be viewed by the analyst more than 90% and due to visual components we help the analyst pre-selecting the functions on an abstract level.

Original language	English
Title of host publication	Information Security and Cryptology - 11th International Conference, Inscrypt 2015, Revised Selected Papers
Editors	Dongdai Lin, Xiao Feng Wang, Moti Yung
Publisher	Springer Verlag
Pages	468-487
Number of pages	20
ISBN (Print)	9783319388977
DOIs	https://doi.org/10.1007/978-3-319-38898-4_27
State	Published - 2016
Event	11th International Conference on Information Security and Cryptology, Inscrypt 2015 - Beijing, China Duration: 1 Nov 2015 → 3 Nov 2015

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	9589
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	11th International Conference on Information Security and Cryptology, Inscrypt 2015
Country/Territory	China
City	Beijing
Period	1/11/15 → 3/11/15

Keywords

IP protection
Information visualisation
Reverse engineering
Security

Access to Document

10.1007/978-3-319-38898-4_27

Cite this

Kilic, F., Laner, H., & Eckert, C. (2016). Interactive function identification decreasing the effort of reverse engineering. In D. Lin, X. F. Wang, & M. Yung (Eds.), Information Security and Cryptology - 11th International Conference, Inscrypt 2015, Revised Selected Papers (pp. 468-487). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 9589). Springer Verlag. https://doi.org/10.1007/978-3-319-38898-4_27

Kilic, Fatih ; Laner, Hannes ; Eckert, Claudia. / Interactive function identification decreasing the effort of reverse engineering. Information Security and Cryptology - 11th International Conference, Inscrypt 2015, Revised Selected Papers. editor / Dongdai Lin ; Xiao Feng Wang ; Moti Yung. Springer Verlag, 2016. pp. 468-487 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{7a905ddb9d0f4309a1caa0d241d88b31,

title = "Interactive function identification decreasing the effort of reverse engineering",

abstract = "Today{\textquoteright}s software is growing in size and complexity. Consequently analysing closed-source binaries becomes time-consuming and labour-intensive. In the common use case, the analyst is only interested in specific functions of the given application. Identifying the relevant functions is difficult since no related meta information is given. In this paper we present a framework which speeds up the reverse-engineering process using interactive function identification. We use the benefits of Dynamic Binary Instrumentation as base to collect the executed function calls. We support the analyst in filtering the relevant functions for specific functionality. Our approach is divided into three process steps. Realtime data gathering, user defined information processing/filtering and graphical representation. We show a significant speed up in the reverse engineering process using our framework. We reduce the number of executed functions to be viewed by the analyst more than 90% and due to visual components we help the analyst pre-selecting the functions on an abstract level.",

keywords = "IP protection, Information visualisation, Reverse engineering, Security",

author = "Fatih Kilic and Hannes Laner and Claudia Eckert",

note = "Publisher Copyright: {\textcopyright} Springer International Publishing Switzerland 2016.; 11th International Conference on Information Security and Cryptology, Inscrypt 2015 ; Conference date: 01-11-2015 Through 03-11-2015",

year = "2016",

doi = "10.1007/978-3-319-38898-4_27",

language = "English",

isbn = "9783319388977",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer Verlag",

pages = "468--487",

editor = "Dongdai Lin and Wang, {Xiao Feng} and Moti Yung",

booktitle = "Information Security and Cryptology - 11th International Conference, Inscrypt 2015, Revised Selected Papers",

}

Kilic, F, Laner, H & Eckert, C 2016, Interactive function identification decreasing the effort of reverse engineering. in D Lin, XF Wang & M Yung (eds), Information Security and Cryptology - 11th International Conference, Inscrypt 2015, Revised Selected Papers. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 9589, Springer Verlag, pp. 468-487, 11th International Conference on Information Security and Cryptology, Inscrypt 2015, Beijing, China, 1/11/15. https://doi.org/10.1007/978-3-319-38898-4_27

Interactive function identification decreasing the effort of reverse engineering. / Kilic, Fatih; Laner, Hannes; Eckert, Claudia.
Information Security and Cryptology - 11th International Conference, Inscrypt 2015, Revised Selected Papers. ed. / Dongdai Lin; Xiao Feng Wang; Moti Yung. Springer Verlag, 2016. p. 468-487 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 9589).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Interactive function identification decreasing the effort of reverse engineering

AU - Kilic, Fatih

AU - Laner, Hannes

AU - Eckert, Claudia

N1 - Publisher Copyright: © Springer International Publishing Switzerland 2016.

PY - 2016

Y1 - 2016

N2 - Today’s software is growing in size and complexity. Consequently analysing closed-source binaries becomes time-consuming and labour-intensive. In the common use case, the analyst is only interested in specific functions of the given application. Identifying the relevant functions is difficult since no related meta information is given. In this paper we present a framework which speeds up the reverse-engineering process using interactive function identification. We use the benefits of Dynamic Binary Instrumentation as base to collect the executed function calls. We support the analyst in filtering the relevant functions for specific functionality. Our approach is divided into three process steps. Realtime data gathering, user defined information processing/filtering and graphical representation. We show a significant speed up in the reverse engineering process using our framework. We reduce the number of executed functions to be viewed by the analyst more than 90% and due to visual components we help the analyst pre-selecting the functions on an abstract level.

AB - Today’s software is growing in size and complexity. Consequently analysing closed-source binaries becomes time-consuming and labour-intensive. In the common use case, the analyst is only interested in specific functions of the given application. Identifying the relevant functions is difficult since no related meta information is given. In this paper we present a framework which speeds up the reverse-engineering process using interactive function identification. We use the benefits of Dynamic Binary Instrumentation as base to collect the executed function calls. We support the analyst in filtering the relevant functions for specific functionality. Our approach is divided into three process steps. Realtime data gathering, user defined information processing/filtering and graphical representation. We show a significant speed up in the reverse engineering process using our framework. We reduce the number of executed functions to be viewed by the analyst more than 90% and due to visual components we help the analyst pre-selecting the functions on an abstract level.

KW - IP protection

KW - Information visualisation

KW - Reverse engineering

KW - Security

UR - http://www.scopus.com/inward/record.url?scp=84969246395&partnerID=8YFLogxK

U2 - 10.1007/978-3-319-38898-4_27

DO - 10.1007/978-3-319-38898-4_27

M3 - Conference contribution

AN - SCOPUS:84969246395

SN - 9783319388977

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 468

EP - 487

BT - Information Security and Cryptology - 11th International Conference, Inscrypt 2015, Revised Selected Papers

A2 - Lin, Dongdai

A2 - Wang, Xiao Feng

A2 - Yung, Moti

PB - Springer Verlag

T2 - 11th International Conference on Information Security and Cryptology, Inscrypt 2015

Y2 - 1 November 2015 through 3 November 2015

ER -

Kilic F, Laner H, Eckert C. Interactive function identification decreasing the effort of reverse engineering. In Lin D, Wang XF, Yung M, editors, Information Security and Cryptology - 11th International Conference, Inscrypt 2015, Revised Selected Papers. Springer Verlag. 2016. p. 468-487. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-319-38898-4_27

Interactive function identification decreasing the effort of reverse engineering

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this