  Cybersecurity attacks on embedded devices for industrial control systems and
cyber-physical systems may cause catastrophic physical damage as well as
economic loss. This could be achieved by infecting device binaries with malware
that modifies the physical characteristics of the system operation. Mitigating
such attacks benefits from reverse engineering tools that recover sufficient
semantic knowledge in terms of mathematical equations of the implemented
algorithm. Conventional reverse engineering tools can decompile binaries to
low-level code, but offer little semantic insight. This paper proposes the
REMaQE automated framework for reverse engineering of math equations from
binary executables. Improving over state-of-the-art, REMaQE handles equation
parameters accessed via registers, the stack, global memory, or pointers, and
can reverse engineer object-oriented implementations such as C++ classes. Using
REMaQE, we discovered a bug in the Linux kernel thermal monitoring tool "tmon".
To evaluate REMaQE, we generate a dataset of 25,096 binaries with math
equations implemented in C and Simulink. REMaQE successfully recovers a
semantically matching equation for all 25,096 binaries. REMaQE executes in 0.48
seconds on average and in up to 2 seconds for complex equations. Real-time
execution enables integration in an interactive math-oriented reverse
engineering workflow.
