reAnalyst: Scalable Annotation of Reverse Engineering Activities

TL;DR

reAnalyst is a scalable framework that automates the annotation of reverse engineering activities, enabling more efficient and comprehensive analysis of RE practices across various tools and data types.

Contribution

It introduces a semi-automated, tool-agnostic framework for annotating RE activities, improving data collection and analysis efficiency over traditional manual methods.

Findings

Successfully identifies RE activities from diverse screenshots

Validated with experimental data and survey feedback

Enhances understanding of reverse engineering techniques

Abstract

This paper introduces reAnalyst, a framework designed to facilitate the study of reverse engineering (RE) practices through the semi-automated annotation of RE activities across various RE tools. By integrating tool-agnostic data collection of screenshots, keystrokes, active processes, and other types of data during RE experiments with semi-automated data analysis and generation of annotations, reAnalyst aims to overcome the limitations of traditional RE studies that rely heavily on manual data collection and subjective analysis. The framework enables more efficient data analysis, which will in turn allow researchers to explore the effectiveness of protection techniques and strategies used by reverse engineers more comprehensively and efficiently. Experimental evaluations validate the framework's capability to identify RE activities from a diverse range of screenshots with varied complexities. Observations on past experiments with our framework as well as a survey among reverse engineers provide further evidence of the acceptability and practicality of our approach.