Ghidra 101
Ghidra 101 is a collection of tutorials and example programs given to summer interns, intended as an initial introduction to using Ghidra and reverse engineering binaries.
Mast, RyanA [Lawrence Livermore National Laborator↗
SEARCH · Engineering Papers
Results for “reverse engineering”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Nanoparticle self-assemblies with modern complexity
Thanks to decades of tireless efforts, nanoparticle assemblies have reached at an extremely high level of controllability, sophistication, and complexity, with new insights provided by integration with graph theory, cutting-edge characterization, and machine learning (ML)-based computation and modeling, as well as with ever-diversifying applications in energy, catalysis, biomedicine, optics, electronics, magnetics, organic biosynthesis, and quantum technology. Nanoparticle assemblies can be crystalline, known as superlattices or supracrystals. Their assembly entails a transition from disorder—dispersed nanoparticles—to order, which can be achieved through classical nucleation pathways or nonclassical pathways via prenucleation precursors or particle aggregation. Further, the periodic lattices allow facile manipulations of electrons, phonons, photons, and even spins, leading to advanced device components and metamaterials. Meanwhile, aperiodic assemblies out of nanoparticles, such as gels, networks, and amorphous solids, also start to attract attentions. Despite the loss of periodicity, symmetry-lowering or symmetry-breaking three-dimensional (3D) structures emerge with unique properties, such as chiroptical activity, topological mechanical strength, and quantum entanglement. Real-space imaging such as electron microscopy and X-ray based tomography methods are utilized to characterize these complex structures, while mathematical tools such as graph theories are in need to describe such complex structures. This issue aims to provide a timely review of the efforts in this greatly broadened materials design space including experiment, simulation, theory, and applications. Nine top experts (and their teams) from four countries deliver six review papers, summarizing fundamental mechanistic understandings of nanoparticle assemblies, highlighted with the developments of state-of-the-art in situ characterization tools and ML-assisted reverse engineering, and newly emergent applications of nanoarchitectures.
36 MATERIALS SCIENCE↗
Notes on Eulerian Magnetohydrodynamics
A brief description of the MHD equations used in the eulerian AMR code BABBO is presented. The description of the MHD equations has been presented many times in the literature so only a very brief description is given in this report. Of particular importance is the description of the calculation of the plasma load impedance and inductance, which is much less frequently described in the literature and is presented in section 6. In addition, along with an accurate calculation of the plasma load impedance and induction, the circuit calculation used to introduce the external current drive is of particular importance and is presented in section 7. In section 8 a procedure is presented to calculate the current drive of a Marx bank by reverse engineering a machine voltage source, which can then be used to drive varying plasma loads.
70 PLASMA PHYSICS AND FUSION TECHNOLOGY↗
QED with the electron as a very small black-hole-like object
We pursue a simple semi-classical particle-based picture of QED in which the electron is assumed to contain a point massless and chargeless core that interacts with the electromagnetic vacuum in ways that are not dissimilar to the manner in which small black holes may interact with photons. Modifications are made to obtain known properties of the electron including the presence of rest energy, Lamb shift, magnetic moments (both free and bound), charge, Larmor emission, and vacuum polarization. The present study does not provide proofs but is rather an attempt to reverse-engineer the photon-electron and black-hole-electron interaction properties needed to match experimental observations. The ease by which many QED observables can be reproduced suggests further study of the presented framework may be warranted. Future detailed analysis of the exchange of long wavelength Hawking radiation between a pair of small black holes will be of particular interest.
72 PHYSICS OF ELEMENTARY PARTICLES AND FIELDS↗
IBM Open Science Price - SWAP Gate Challenge
On November 30, 2020, IBM announced an open science price competition aimed at improving the fidelity of a SWAP gate on their 7 qubit Quantum system named ”Casablanca”. The details of the SWAP gate problem was outlined in a Jupyter notebook, which utilizes the IBM developed open source package Qiskit. The participants were allowed to work in teams with up to five people and restricted to only use open source software in solving the problem. Their results were due on April 16, 2021. Our approach to solving the SWAP gate challenge is based on the quantum optimal control techniques implemented in our open source packages Juqbox.jl and Quandary. The results from the optimal control approach is only as good as the accuracy in the description of the quantum system dynamics, characterized by a Hamiltonian model that was provided by IBM. Based on the calibrated control pulses IBM provide for the standard gate set, we developed a reverse engineering approach to calibrate our computational model. Techniques were developed to translate between Qiskit’s pulse representation and the B-spline formulation used in Juqbox and Quandary. The fidelity of the optimized pulse sequences were estimated using Qiskit’s randomized bench marking techniques.
71 CLASSICAL AND QUANTUM MECHANICS, GENERAL PHYSIC↗
Exploring Explicit Uncertainty for Binary Analysis (EUBA)
Reverse engineering (RE) analysts struggle to address critical questions about the safety of binary code accurately and promptly, and their supporting program analysis tools are simply wrong sometimes. The analysis tools have to approximate in order to provide any information at all, but this means that they introduce uncertainty into their results. And those uncertainties chain from analysis to analysis. We hypothesize that exposing sources, impacts, and control of uncertainty to human binary analysts will allow the analysts to approach their hardest problems with high-powered analytic techniques that they know when to trust. Combining expertise in binary analysis algorithms, human cognition, uncertainty quantification, verification and validation, and visualization, we pursue research that should benefit binary software analysis efforts across the board. We find a strong analogy between RE and exploratory data analysis (EDA); we begin to characterize sources and types of uncertainty found in practice in RE (both in the process and in supporting analyses); we explore a domain-specific focus on uncertainty in pointer analysis, showing that more precise models do help analysts answer small information flow questions faster and more accurately; and we test a general population with domain-general sudoku problems, showing that adding "knobs" to an analysis does not significantly slow down performance. This document describes our explorations in uncertainty in binary analysis.
97 MATHEMATICS AND COMPUTING↗
Demo 5: RapidClave Technology Demonstrations – Round II (Task 2)
The purpose of this project task was to make automotive composite part manufacturing more cost competitive for low volume production and thereby drive composite application innovation. The strategy was to incorporate low-cost preforming, snap cure resins, and RapidClave® processing to create an alternative to conventional automotive composite manufacturing based on SMC. The program used RapidClave® technology from Globe Machine Manufacturing, fast-curing (“snap cure”) epoxy resins from Hexion, and conformable/stretchable glass fiber reinforcement mats produced by Owens Corning for rapid preforming. O’Gara Armoring retrofits vehicles to meet special security needs, such as larger doors to facilitate easier entry into the vehicle. O’Gara has a variety of custom vehicles in need of custom doors that require affordable tooling to produce approximately 100 ship sets/year. The project focused on a composite door panel application provided by O’Gara that is currently made by manual chopped fiber spray-up processing. UDRI reverse-engineered the current composite door panel and created tooling for use in the RapidClave®. UDRI designed an improved composite door using MultiMat fiberglass reinforcement from Owens Corning. UDRI made snap cure resin films from Hexion resin. Finally, UDRI conducted molding trials to compare autoclave processing with RapidClave® processing. The technical goals of the project were to reduce tooling cost by 50% as compared to SMC compression molding and to reduce cycle time by 50% compared to current manual spray-up process. The approach to reduce tool costs is based on use of single sided tooling for use at 100 psi, as compared to matched metal SMC tooling. An added benefit realized from the program is that the Owens Corning mat provided more uniform thickness and improved performance. Tensile and flexural strengths and moduli were increased by at least 50%. This task also demonstrated a 75% decrease in cycle time. O’Gara is evaluating the technology demonstrated in this project for some of their current production. Additionally, there are new products O’Gara is pursuing which require higher production rates than their current products. O’Gara has identified these new products as good candidates for the RapidClave® technology. The cost advantages demonstrated by this project would then lead to significant economic development. In conclusion, this task successfully combined the RapidClave® technology from Globe with a snap cure epoxy resin film system from Hexion and preform material from Owens Corning. Further research is needed to better map the technical limits such as cycle time of these technologies. Additionally, the technology should be extended in terms of size and shape to include large parts outside of automotive applications, such as a small aircraft fuselage.
36 MATERIALS SCIENCE↗
Scalable Binary Application Analysis - Enhancing Vulnerability Analyses via Automated Patch Diffing [Poster]
TITANS CCD Open House Poster presenting summer intern work completed on an automated patch diffing pipeline, targeted for reverse engineers and vulnerability researchers.
97 MATHEMATICS AND COMPUTING↗
Firmware Tampering Detection in Heavy-Duty Vehicles through J1939 CAN Analysis
Modern heavy-duty vehicles rely on complex networks of Electronic Control Units (ECUs) that communicate using the J1939 protocol. While this system makes it easier to update and configure vehicle components, it also opens the door to serious cybersecurity risks if not properly secured. This work investigates the potential for firmware tampering through the J1939 communication protocol, which enables ECU configuration and reprogramming over the Controller Area Network (CAN) bus. By monitoring CAN traffic during legitimate maintenance operations and reverse-engineering OEM diagnostic software, we identified common and proprietary J1939 message identifiers, authentication patterns, and vulnerabilities within Unified Diagnostic Services (UDS). These findings demonstrate that inadequate authentication mechanisms can allow malicious actors to alter ECU firmware or disable safety functions, posing severe operational and safety risks. Our analysis contributes to the development of vehicle intrusion detection systems capable of recognizing abnormal reprogramming activity and future firmware fingerprinting methods to verify software integrity across ECUs. This work highlights the importance of standardizing secure firmware authentication across manufacturers to strengthen cyber resilience in heavy-duty vehicle systems.
33 ADVANCED PROPULSION SYSTEMS↗
Evaluating the Performance of Random Forest and Iterative Random Forest Based Methods when Applied to Gene Expression Data
Gene-to-gene networks, such as Gene Regulatory Networks (GRN) and Predictive Expression Networks (PEN) capture relationships between genes and are beneficial for use in downstream biological analyses. There exists multiple network inference tools to produce these gene-to-gene networks from matrices of gene expression data. Random Forest-Leave One Out Prediction (RF-LOOP) is a method that has been shown to be efficient at producing these gene-to-gene networks, frequently known as GEne Network Inference with Ensemble of trees (GENIE3). Here we validate that iterative Random Forest-Leave One Out Prediction (iRF-LOOP) produces higher quality networks than GENIE3. We use both synthetic and empirical networks from the Dialogue for Reverse Engineering Assessment and Methods (DREAM) Challenges by Sage Bionetworks, as well as two additional empirical networks created from Arabidopsis thaliana and Populus trichocarpa expression data.
iRF-Loop, expression network, Populus Trichocarpa↗
Detecting CAN Masquerade Attacks with Signal Clustering Similarity
Vehicular Controller Area Networks (CANs) are susceptible to cyber attacks of different levels of sophistication. Fabrication attacks are the easiest to administer—an adversary simply sends (extra) frames on a CAN—but also the easiest to detect because they disrupt frame frequency. To overcome time-based detection methods, adversaries must administer masquerade attacks by sending frames in lieu of (and therefore at the expected time of) benign frames but with malicious payloads. Research efforts have proven that CAN attacks, and masquerade attacks in particular, can affect vehicle functionality. Examples include causing unintended acceleration, deactivation of vehicle’s brakes, as well as steering the vehicle. We hypothesize that masquerade attacks modify the nuanced correlations of CAN signal time series and how they cluster together. Therefore, changes in cluster assignments should indicate anomalous behavior. We confirm this hypothesis by leveraging our previously developed capability for reverse engineering CAN signals (i.e., CAN-D [Controller Area Network Decoder]) and focus on advancing the state of the art for detecting masquerade attacks by analyzing time series extracted from raw CAN frames. Specifically, we demonstrate that masquerade attacks can be detected by computing time series clustering similarity using hierarchical clustering on the vehicle’s CAN signals (time series) and comparing the clustering similarity across CAN captures with and without attacks. We test our approach in a previously collected CAN dataset with masquerade attacks (i.e., the ROAD dataset) and develop a forensic tool as a proof of concept to demonstrate the potential of the proposed approach for detecting CAN masquerade attacks.
Moriano Salazar, Pablo↗
Fort Saint Vrain Fuel Handling Tool Modernization- Intern Poster
This poster presents the modernization of a crane tool for handling spent nuclear fuel from Fort St. Vrain, involving some reverse engineering and structural analysis.
12 - MGMT OF RADIOACTIVE AND NON-RADIOACTIVE WASTE↗
Assessing Energy Infrastructure Devices for Vulnerabilities
Industrial control systems prove to be vital to the health and security of the nation in our critical infrastructure. Critical infrastructure includes the most foundational systems to support modern civilization which includes water and wastewater systems, communications, and the electricity we use to name a few sectors. However, these devices' overall composition remains largely unknown and are untested from a cyber security perspective. As part of the Cyber Testing for Resilient Industrial Control Systems (CyTRICS) program, I analyzed one such energy infrastructure device to better understand how it functions, what hardware and software components are present within it, and assess it for security vulnerabilities. To achieve this, I reverse engineered binary files using Ghidra to understand system functionality and learned more about how to collaborate with other researchers on a shared Ghidra project. I learned more about how web sockets function and how to interact with them through Python to test if they are secure or not. This work led me to assess possible vulnerabilities in this device and provide a better understanding of its composition and function, which are essential to INL's mission of securing our nation's energy infrastructure.
99 - GENERAL AND MISCELLANEOUS↗
Architectural Algorithmic and Systems Engineering Issues for Reversible Computing.
Abstract not provided.
Frank, Michael P↗
Priority Research Challenges in the Physics and Engineering of Classical Reversible Computing Systems.
Abstract not provided.
Frank, Michael P↗
Ultrasound Interim cyber-physical research evaluation
Recent events have presented Medical Practitioners with concerns about safety and privacy implications associated with GE’s VScan MIot Ultrasound Device. Concerns relate to the devices potential risk to broadcast location data that can pose serious risks to device users and patients. This report was commission in collaboration with Augusta University to determine if device concerns pose real threat to operators and patients. In effort to ensure all potential threat vectors are targeted, the initial step was to analyze the supply chain. Here the devices are CT scanned to look for any hardware anomalies that could present threat vectors to users of these devices. (See SRNL-STI-2024-00225 for detailed analysis). No anomalies were found associated with the hardware utilized within the GE VScan Air.
42 ENGINEERING↗
Elucidating the structural properties and reversible regional texture effect of GdB 6 under high pressure
As hard and refractory materials with high chemical resistance and mechanical strength, lanthanide hexaborides (LnB 6 ) have attracted much attention. Among the family of LnB 6 , gadolinium hexaboride (GdB 6 ) occupies a special position due to the half-filled 4f shell of Gd. Here, using in situ synchrotron radiation angle-dispersive X-ray diffraction in a diamond anvil cell at room temperature, the structural stability and compression behavior of GdB 6 are investigated extensively, GdB 6 is observed to be structurally stable up to 73 GPa, and the bulk modulus of 177 GPa is obtained under hydrostatic compression. In this paper, an interesting observation of pressure-induced spotty diffraction rings of GdB6 is reported, its formation mechanism can be well described by the reversible regional texture effect, which highlights the rearrangement of crystal grains under high pressure. The rearrangement mechanism has been well explained by investigating the pressure dependence of full width at half maximum, macro-differential stress and grain size. Collective grain rotation behavior motivated by stress difference is critical for the rearrangement process, the strong isotropy and strong stability of GdB 6 structure also provide necessary conditions for high-pressure grain rotation behavior. These results will help to promote the understanding of high-pressure structural properties of GdB 6 , and provide novel insights on the high-pressure grain behavior in hard materials with strong isotropy and three-dimensional skeleton constituted of strong covalent bonds.
36 MATERIALS SCIENCE↗
Stimulated Raman Scattering Microscopy: Real-Time In-Situ Physical and Chemical Characterization of Reverse Osmosis Desalination Membrane Scaling
We introduce a stimulated Raman scattering (SRS) methodology designed for rapid, real-time, and in situ monitoring of RO membrane scaling adapted for bench-scale desalination flow cells. The methodology can provide new insights into membrane scaling dynamics by offering time-resolved reflection imaging of inorganic crystal growth, coupled with chemical identification from Raman spectral data. These capabilities allow for direct local measurement of the membrane surface area covered by different scalants as well as an approximation of the scalant volume using three-dimensional, integrated Raman intensity. The 2D and 3D SRS results obtained from CaSO 4 scaling experiments are compared to and are in reasonable agreement with those provided by confocal microscopy. The real-time physical and chemical characterization capabilities presented here could be extended to study combinations of inorganic, organic, and biological fouling. Overall, the SRS methodology represents an advancement in real-time sensing of membrane fouling that offers the potential for improved operation, lower cost, and more resilient RO membrane systems for sustainable water management.
42 ENGINEERING↗