Understanding how reverse engineers make sense of programs from assembly language representations
Robert F. Mills, Adam R. Bryant · 2012
This dissertation presents a theory of how reverse engineers make sense of executable programs. The theory describes the process of sensemaking in reverse engineering as a goal-directed planning-based search activity, in which the reverse engineer interacts with an executable program using reverse engineering tools in order to construct a mental model and working understanding of the functionality of the program. This theory is developed through a case study, semi-structured interviews with expert reverse engineers, and observations of reverse engineers performing a reverse engineering task. The theory of sensemaking in reverse engineering is a step toward building autonomy into analysis tools so they will be able to discovery vulnerabilities in complex software-based systems and analyze executable programs to determine whether those programs contain undocumented malicious functionality and should not be trusted.