Next Generation Software Reverse Engineering Tools

New tools are needed to perform vulnerability assessments of software protection techniques currently being developed in response to the DoD Anti-Tamper (AT) / Software Protection Initiative. As evident in the commercial sector, after a new technique is developed for protecting intellectual property resident within software, a counter measure around that technique is subsequently developed and widely distributed through the Internet. This leads to a never-ending cycle of constantly improving the protection in order to stay in front of the reverse engineering community. HBGary proposes that an automated runtime disassembly engine can overcome most obfuscation techniques because it will run actual program instructions and will not have to deal with interpreting complex code. So long as the test tool can achieve near 100% code coverage, it is expected to be able to reverse engineer the whole program. Exhaustive execution of all possible control flow paths is achieved with a technique described as Automated Flow Resolution. Executed code is disassembled during runtime and ultimately recovers program instructions, control flows, and data registries.