Visual Reverse Engineering of Binary and Data Files

摘要: The analysis of computer files poses a difficult problem for security researchers seeking to detect and analyze malicious content, software developers stress testing file formats their products, other understand the behavior structure undocumented formats. Traditional tools, including hex editors, disassemblers debuggers, while powerful, constrain primarily text based approaches. In this paper, we present design principles which support meaningful investigation when there is little or no knowledge underlying format, but are flexible enough allow integration additional semantic information, available. We also results from implementation visual reverse engineering system on our analysis. validate efficacy both with case studies depicting use cases where editor would be limited value. Our indicate that approaches help analysts rapidly identify files, unfamiliar structures, gain insights inform complement current suite tools currently in use.