RESim Tool for Dynamic System Analysis and Reverse Engineering

RESim is a dynamic system analysis framework designed to help security researchers understand how programs execute, interact with system resources and process data across networked Linux environments. It uses full system simulation to observe software behavior without installing monitoring tools or injecting code into the target system.

Built on the Simics full system simulator, RESim recreates networked computers using detailed models of processors, peripheral devices, network interfaces and storage devices. The simulated machines run software loaded from images extracted from the physical systems being analyzed.

How RESim Supports Reverse Engineering

RESim helps researchers investigate Linux-based systems by tracking processes, the programs they execute and the data they consume. It identifies interactions with different data sources, including files, device interfaces and inter-process communication mechanisms.

Rather than relying on software installed inside the target environment, RESim observes the simulated system’s processor and memory state. This external analysis approach does not require shell access, software injection or detailed knowledge of the target kernel’s symbols.

Because the observation mechanisms operate outside the simulated system, they do not directly modify the target’s execution state. This makes RESim useful for examining software behavior while keeping the analysis environment separate from the application being investigated.

Interactive Debugging with IDA Pro and Ghidra

RESim provides interactive debugging capabilities through a custom plugin for IDA Pro. Plugins for the Ghidra Debugger are also available, allowing analysts to inspect individual programs during simulation.

Researchers can set breakpoints and pause execution when selected events occur. RESim also supports reverse-time debugging, allowing analysts to move the simulation backward to investigate earlier execution states. For example, it can locate the most recent modification of a particular memory address.

Other debugging capabilities include:

• Inspecting individual processes and their execution behavior.
• Pausing simulation when a specified process is scheduled to run.
• Examining and modifying memory contents or processor registers.
• Generating reloadable checkpoints at different execution stages.
• Continuing execution after making controlled changes to memory or registers.
• Dynamically modifying memory in response to system events, such as changing a password file entry when it is read by the su program.

Fuzzing Integration and Crash Analysis

RESim integrates with American Fuzzy Lop (AFL), a popular coverage-guided fuzzing tool. This integration allows fuzzed input to be delivered directly into an application’s read buffer, reducing the setup complexity associated with conventional fuzzing workflows.

When the fuzzing process discovers a crash, RESim can automatically replay and analyze the failure. Researchers can inspect the resulting system state and investigate the underlying cause, including memory corruption and execution-control corruption.

This combination of full system simulation, debugging and automated crash analysis makes RESim useful for vulnerability research and software behavior analysis.

Background and Project Resources

RESim builds on a software vetting and forensic analysis platform developed for the DARPA Cyber Grand Challenge. Its predecessor project, CGC Monitor, provides additional background on the underlying research and architecture.

Researchers interested in the project’s technical foundations can also explore the following resources:

• User documentation: Refer to the RESim User’s Guide for setup instructions and detailed usage information.
• Demonstration: Watch the RESim demonstration.
• Research paper: Read the paper describing the CGC Monitor work.
• Simics background: Explore Simics in the Cyber Grand Challenge.

Download RESim

RESim is intended for researchers and security professionals working on reverse engineering, vulnerability analysis, debugging and software testing in simulated Linux environments.

Download RESim from GitHub to explore the source code and project resources.

For related security research, see our guide to BurpSuite Secret Finder, a tool for discovering API keys and tokens.