  Reverse engineering is a complex process essential to software-security tasks
such as vulnerability discovery and malware analysis. Significant research and
engineering effort has gone into developing tools to support reverse engineers.
However, little work has been done to understand the way reverse engineers
think when analyzing programs, leaving tool developers to make interface design
decisions based only on intuition.
  This paper takes a first step toward a better understanding of reverse
engineers' processes, with the goal of producing insights for improving
interaction design for reverse engineering tools. We present the results of a
semi-structured, observational interview study of reverse engineers (N=16).
Each observation investigated the questions reverse engineers ask as they probe
a program, how they answer these questions, and the decisions they make
throughout the reverse engineering process. From the interview responses, we
distill a model of the reverse engineering process, divided into three phases:
overview, sub-component scanning, and focused experimentation. Each analysis
phase's results feed the next as reverse engineers' mental representations
become more concrete. We find that reverse engineers typically use static
methods in the first two phases, but dynamic methods in the final phase, with
experience playing large, but varying, roles in each phase. % and the role of
experience varies between phases. Based on these results, we provide five
interaction design guidelines for reverse engineering tools.
