RE-mind: a first look inside the mind of a reverse engineer

Mantovani, Alessandro; Aonzo, Simone; Fratantonio, Yanick; Balzarotti, Davide
USENIX 2022, 31st USENIX Security Symposium, 10-12 August 2022, Boston, MA, USA

When a human activity requires a lot of expertise and very specialized cognitive skills that are poorly understood by the general population, it is often considered ‘an art.’ Different activities in the security domain have fallen in this category, such as exploitation, hacking, and the main focus of this paper: binary reverse engineering (RE). However, while experts in many areas (ranging from chess players to computer programmers) have been studied by scientists to understand their mental models and capture what is special about their behavior, the ‘art’ of understanding binary code and solving reverse engineering puzzles remains to date a black box. In this paper, we present a measurement of the different strategies adopted by expert and beginner reverse engineers while approaching the analysis of x86 (dis)assembly code, a typical static RE task. We do that by performing an exploratory analysis of data collected over 16,325 minutes of RE activity of two unknown binaries from 72 participants with different experience levels: 39 novices and 33 experts.


Type:
Conference
City:
Boston
Date:
2022-08-09
Department:
Digital Security
Eurecom Ref:
6700
Copyright:
Copyright Usenix. Personal use of this material is permitted. The definitive version of this paper was published in USENIX 2022, 31st USENIX Security Symposium, 10-12 August 2022, Boston, MA, USA and is available at :

PERMALINK : https://www.eurecom.fr/publication/6700