  Cybersecurity attacks against industrial control systems and cyber-physical
systems can cause catastrophic real-world damage by infecting device binaries
with malware. Mitigating such attacks can benefit from reverse engineering
tools that recover sufficient semantic knowledge in terms of mathematical
operations in the code. Conventional reverse engineering tools can decompile
binaries to low-level code, but offer little semantic insight. This paper
proposes REMaQE, an automated framework for reverse engineering of math
equations from binary executables. REMaQE uses symbolic execution for dynamic
analysis of the binary to extract the relevant semantic knowledge of the
implemented algorithms. REMaQE provides an automatic parameter analysis pass
which also leverages symbolic execution to identify input, output, and constant
parameters of the implemented math equations. REMaQE automatically handles
parameters accessed via registers, the stack, global memory, or pointers, and
supports reverse engineering of object-oriented implementations such as C++
classes. REMaQE uses an algebraic simplification method which allows it to
scale to complex conditional equations with ease. These features make REMaQE
stand out over existing reverse engineering approaches for math equations. On a
dataset of randomly generated math equations compiled to binaries from C and
Simulink implementations, REMaQE accurately recovers a semantically matching
equation for 97.53% of the models. For complex equations with more operations,
accuracy stays consistently over 94%. REMaQE executes in 0.25 seconds on
average and in 1.3 seconds for more complex equations. This real-time execution
speed enables a smooth integration in an interactive mathematics-oriented
reverse engineering workflow.

Cryptography and Security