Declarative Demand-Driven Reverse Engineering

interactively, via a GUI or CLI) in a variety of ways.For example, a reverse engineer looking for a time bomb may first search for calls to the system's time function, and then walk backwards to understand whether each call is associated with legitimate or malicious behavior.In doing so, the RE may need to reason about, e.g., indirect control flow, or even identify the time function (in a stripped binary).Because REs are expert users, and often skilled programmers, RE tools provide programmatic interfaces that enable REs to systematize reasoning tasks via extensions.A broad range of popular extensions exist for several tools which perform such tasks as loading the results of static analyses [7], [8], interacting with debuggers [9], and identifying common cryptographic-relevant code [10].In this paper, we argue that deductive databases (e.g., Datalog) serve as a natural abstraction boundary between RE tools and logical inference tasks over binaries.We envision a future in which a reverse engineer interactively explores a binary using an RE tool while simultaneously querying arbitrarilycomplex logical properties written in a terse declarative style.We call this Declarative Demand-Driven Reverse Engineering (henceforth D 3 RE).In D 3 RE, an RE interacts with a deductive database by giving inputs (e.g., the currently highlighted address) to a rule-based deductive inference system written in a declarative language such as Datalog.Rules inductively compute relations over facts about the binary.As an example, consider a relation direct call ∈ Addr × Addr which relates callsite addresses (offsets within the binary) to procedure invocation target addresses.In our vision, D 3 RE allows REs to interactively compute with and visualize the results of queries over these deductive rules.We see D 3 RE as a natural extension of several observations about the state of the start.First, many existing RE tools assemble databases to index various properties (e.g., addresses, symbols, etc...) of binaries for quick exploration.Deductive databases further allow REs to write arbitrary logical queries which are computed maximally efficiently via, e.g., compilation to relational algebra kernels as done in Soufflé.Deductive databases have also enabled several recent advances in binary analysis demonstrating both efficiency and robustness over conventional techniques.For example, the Datalogbased disassembler ddisasm achieves both faster and moreprecise disassembly than other state-of-the-art disassemblers, and OOAnalyzer uses Prolog to enable declarative recovery of classes from compiled C++ code.In this short paper we describe our progress in implementing a prototype tool, d3re, which we are building to realize the Abstract-Binary reverse engineering is a challenging task because it often necessitates reasoning using both domain-specific knowledge (e.g., understanding entrypoint idioms common to an ABI) and logical inference (e.g., reconstructing interprocedural control flow).To help perform these tasks, reverse engineers often use toolkits (such as IDA Pro or Ghidra) that allow them to interactively explicate properties of binaries.We argue that deductive databases serve as a natural abstraction for interfacing between visualization-based binary analysis tools and highperformance logical inference engines that compute facts about binaries.In this paper, we present a vision for the future in which reverse engineers use a visualization-based tool to understand binaries while simultaneously querying a logical-inference engine to perform arbitrarily-complex deductive inference tasks.We call our vision declarative demand-driven reverse engineering (D 3 RE for short), and sketch a formal semantics whose goal is to mediate interaction between a logical-inference engine (such Soufflé) and a reverse engineering tool.We describe a prototype tool, d3re, which are using to explore the D 3 RE vision.While still a prototype, we have used d3re to reimplement several common querying tasks on binaries.Our evaluation demonstrates that d3re enables both better performance and more succinct implementation of these common RE tasks.