arXiv subjects

Andrew Case

Publications and source records attributed to Andrew Case.

5 recordsLinked to original sources

arXiv2026

What You See Is Not What You Execute: Memory-Based Runtime SBOM Generation for Supply Chain Security

Modern software development relies heavily on third-party components from public repositories, expanding the software supply chain attack surface. In response to these growing risks, federal initiatives have advanced the Software Bill of Materials (SBOM) as a standardized mechanism for improving transparency by describing software components, dependencies, and their relationships. However, SBOMs built from metadata or filesystem artifacts fail to capture the components loaded and executed at runtime, especially in dynamic ecosystems such as Python. Moreover, generating runtime SBOMs through instrumentation requires monitoring to be deployed in advance and the system to remain observable throughout execution. Such conditions are difficult to satisfy in production environments and incident-response scenarios. Volatile memory, in contrast, provides a reliable source for recovering the actual runtime state of a running application without requiring prior instrumentation. Therefore, this paper presents MEM-SBOM, the first memory forensics framework that generates SBOMs directly from the runtime state of Python applications. It recovers the modules from the interpreter's internal structures, resolves package versions, and analyzes bytecode to build dependency graphs and identify vulnerable functions. We implemented MEM-SBOM as a suite of Volatility 3 plugins and evaluated it against 51 real-world Python applications. It achieves 100% extraction accuracy, identifies Streamlit as the only application that calls the vulnerable routines of the tornado dependency, and recovers all runtime packages missed by existing SBOM tools, providing more accurate dependency graphs and better vulnerability assessment. These capabilities make MEM-SBOM a practical foundation for software supply chain security and incident response by providing a forensically sound runtime view of what is executed on a system.

cs.CR↗

arXiv2026

Memory Forensics Techniques for Automated Detection and Analysis of Go Malware

The Go programming language has become increasingly popular among malware developers due to its ability to produce statically linked, cross-platform executables that challenge traditional analysis techniques. These binaries embed a substantial runtime and compiler-generated metadata and are compiled with aggressive optimizations that discard type information for function parameters and local variables. Go's design further complicates analysis by representing strings as pointer-length pairs rather than null-terminated sequences, employing a caller-allocated stack model that obscures argument boundaries, and fragmenting program state across concurrent goroutines. Although existing static analysis and reverse engineering tools provide Go-specific support, they remain limited to compile-time artifacts and cannot recover runtime execution state and artifacts that persist solely in memory. To address this gap, we present the first memory forensics framework for runtime analysis of Go binaries. By parsing Go's internal structures, our framework reconstructs type and function metadata, recovers heap-allocated and static strings, and distinguishes application-level functions. Through ABI-aware backward analysis, it derives execution paths and argument values from call sites. To capture runtime state beyond what static analysis reveals, it analyzes goroutine stacks to identify actively executing functions and recover their runtime argument values. We implemented all capabilities as Volatility 3 plugins and evaluated them against malware seen in recent incidents, such as the BRICKSTORM backdoor, Obscura ransomware, and Pantegana RAT, as well as open-source samples for reproducibility. The framework successfully recovered C2 endpoints, persistence mechanisms, encryption keys, ransom notes, and execution state, including critical runtime artifacts that were absent from published threat intelligence.

cs.CR↗

arXiv2025

REx86: A Local Large Language Model for Assisting in x86 Assembly Reverse Engineering

Reverse engineering (RE) of x86 binaries is indispensable for malware and firmware analysis, but remains slow due to stripped metadata and adversarial obfuscation. Large Language Models (LLMs) offer potential for improving RE efficiency through automated comprehension and commenting, but cloud-hosted, closed-weight models pose privacy and security risks and cannot be used in closed-network facilities. We evaluate parameter-efficient fine-tuned local LLMs for assisting with x86 RE tasks in these settings. Eight open-weight models across the CodeLlama, Qwen2.5-Coder, and CodeGemma series are fine-tuned on a custom curated dataset of 5,981 x86 assembly examples. We evaluate them quantitatively and identify the fine-tuned Qwen2.5-Coder-7B as the top performer, which we name REx86. REx86 reduces test-set cross-entropy loss by 64.2% and improves semantic cosine similarity against ground truth by 20.3\% over its base model. In a limited user case study (n=43), REx86 significantly enhanced line-level code understanding (p = 0.031) and increased the correct-solve rate from 31% to 53% (p = 0.189), though the latter did not reach statistical significance. Qualitative analysis shows more accurate, concise comments with fewer hallucinations. REx86 delivers state-of-the-art assistance in x86 RE among local, open-weight LLMs. Our findings demonstrate the value of domain-specific fine-tuning, and highlight the need for more commented disassembly data to further enhance LLM performance in RE. REx86, its dataset, and LoRA adapters are publicly available at https://github.com/dlea8/REx86 and https://zenodo.org/records/15420461.

cs.CR↗

arXiv2022

A Reverse Engineering Education Needs Analysis Survey

This paper presents the results of a needs analysis survey for Reverse Engineering (RE). The need for reverse engineers in digital forensics, continues to grow as malware analysis becomes more complicated. The survey was created to investigate tools used in the cybersecurity industry, the methods for teaching RE and educational resources related to RE. Ninety-three (n=93) people responded to our 58 question survey. Participants did not respond to all survey questions as they were optional. The data showed that the majority of 24/71 (33.8%) responses either strongly agreed and 22/71 (30.99%) of responses somewhat agreed that there is a shortage in RE resources. Furthermore, a majority of 17/72 (23.61%) responses indicated that they strongly disagree and that 27/72 (37.5%) somewhat disagree to the statement that graduates are leaving college with adequate RE knowledge. When asked if there is a shortage of adequate RE candidates, the majority of 33/71 (46.48%) responses strongly agreed and 20/71 (28.17%) somewhat agreed. In order to determine if this was a result of the tools at their disposal, a series of questions in regards to the two most popular RE tools were also asked.

cs.CY↗

arXiv2020

Experimental characterization of a section of a spherically imploding plasma liner formed by merging hypersonic plasma jets

We report experimental results on merging of hypersonic plasma jets, which is the fundamental building block for forming spherically imploding plasma liners as a potential standoff compression driver for mangeto-inertial fusion. Jets are formed and launched by contoured-gap coaxial plasma guns mounted at the six spherical chamber. First, from experiments with two and three merging jets of four different species (N, Ar, Kr, Xe), we show that (1) density spatial non-uniformities can be large (with electron-density jumps ranging from 2.9 for N to 6.6 for Xe) when shocks form upon jet merging, but smaller (density jumps <2) when shocks do not form; (2) jet impurities (20% Ti in these experiments) can increase the level of density spatial non-uniformity by increasing the collisionality of jet merging; and (3) the liner Mach number can remain high (>10), as required for plasma liners to be an effective compression driver. Second, from experiments with six and seven merging jets using Ar, we present results with improved jet-to-jet balance of <2% across jets, including (1) evidence of substantially increased balance in the jet merging and symmetry of the liner structure, and (2) potentially favorable changes in the jet-merging morphology with the addition of the seventh jet. For both experiments, we present comparison between experimental and synthetic data from three-dimensional hydrodynamic codes.

physics.plasm-ph↗