SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
The test program demonstrated that successful and rapid forward-to reverse-thrust transients can be performed without any significant engine operational limitations for fan blade pitch changes through either feather pitch or flat pitch. For through-feather-pitch operation with a flight inlet, fan stall problems were encountered, and a fan blade overshoot technique was used to establish reverse thrust.
The increasing penetration of renewable and distributed energy resources in distribution networks calls for real-time and distributed voltage control. As such, in this paper we investigate local Volt/VAR control with a general class of control functions, and show that the power system dynamics with non-incremental local voltage control can be seen as a distributed algorithm for solving a well-defined optimization problem (reverse engineering). The reverse engineering further reveals a fundamental limitation of the non-incremental voltage control: the convergence condition is restrictive and prevents better voltage regulation at equilibrium. This motivates us to design two incremental local voltage control schemes based on the subgradient and pseudo-gradient algorithms respectively for solving the same optimization problem (forward engineering). The new control schemes decouple the dynamical property from the equilibrium property, and have much less restrictive convergence conditions. This work presents another step towards developing a new foundation—network dynamics as optimization algorithms—for distributed real-time control and optimization of future power networks.
Today's software systems generally use obsolete technology, are not integrated properly with other software systems, and are difficult and costly to maintain. The discipline of reverse engineering is becoming prominent as organizations try to move their systems up to more modern and maintainable technology in a cost effective manner. The Johnson Space Center (JSC) created a significant set of tools to develop and maintain FORTRAN and C code during development of the space shuttle. This tool set forms the basis for an integrated environment to reengineer existing code into modern software engineering structures which are then easier and less costly to maintain and which allow a fairly straightforward translation into other target languages. The environment will support these structures and practices even in areas where the language definition and compilers do not enforce good software engineering. The knowledge and data captured using the reverse engineering tools is passed to standard forward engineering tools to redesign or perform major upgrades to software systems in a much more cost effective manner than using older technologies. The latest release of the environment was in Feb. 1992.
This paper describes our research in automating the reuse process through the use of application domain models. Application domain models are explicit formal representations of the application knowledge necessary to understand, specify, and generate application programs. Furthermore, they provide a unified repository for the operational structure, rules, policies, and constraints of a specific application area. In our approach, domain models are expressed in terms of a transaction-based meta-modeling language. This paper has described in detail the creation and maintenance of hierarchical structures. These structures are created through a process that includes reverse engineering of data models with supplementary enhancement from application experts. Source code is also reverse engineered but is not a major source of domain model instantiation at this time. In the second phase of the software synthesis process, program specifications are interactively synthesized from an instantiated domain model. These specifications are currently integrated into a manual programming process but will eventually be used to derive executable code with mechanically assisted transformations. This research is performed within the context of programming-in-the-large types of systems. Although our goals are ambitious, we are implementing the synthesis system in an incremental manner through which we can realize tangible results. The client/server architecture is capable of supporting 16 simultaneous X/Motif users and tens of thousands of attributes and classes. Domain models have been partially synthesized from five different application areas. As additional domain models are synthesized and additional knowledge is gathered, we will inevitably add to and modify our representation. However, our current experience indicates that it will scale and expand to meet our modeling needs.
This paper introduces a new method of information processing in digital systems, and discusses its potential benefits to computing and information security. The new method exploits glitches caused by delays in logic circuits for carrying and processing information. Glitch processing is hidden to conventional logic analyses and undetectable by traditional reverse engineering techniques. It enables the creation of new logic design methods that allow for an additional controllable "glitch logic" processing layer embedded into a conventional synchronous digital circuits as a hidden/covert information flow channel. The combination of synchronous logic with specific glitch logic design acting as an additional computing channel reduces the number of equivalent logic designs resulting from synthesis, thus implicitly reducing the possibility of modification and/or tampering with the design. The hidden information channel produced by the glitch logic can be used: 1) for covert computing/communication, 2) to prevent reverse engineering, tampering, and alteration of design, and 3) to act as a channel for information infiltration/exfiltration and propagation of viruses/spyware/Trojan horses.
An emerging trend in advanced manufacturing is printed electronics and sensors. The ability to print customized electronics and sensors integrated into functional packages is a growing need within a variety of growing markets such as smart manufacturing, internet of things (IoT), and the small satellite industry. Both Oak Ridge National Laboratory (ORNL) and the MITRE Corporation have seedling research efforts evaluating the potential for future printed electronic systems. High frequency, wide-bandwidth phased array antennas (i.e. >45 GHz) open the door to new applications. However, such sensors require currently prohibitively small feature sizes for commercial 3D printing technologies along with increasing challenges with connecting the driving electronics to such features. An additional finding with related advanced manufacturing challenges is the rapid production of 3D additive connectors for integration with commercial printed circuit boards (PCBs), primarily for advanced in-circuit inspection techniques. This work is developing additive manufacturing processes for producing connected and conductive fine scale 3D features. The primary focus was on aerosol-jet printing (AJP), which has a small minimum resolution (<50 µm) but is traditionally printed flat with small height/width aspect ratios <<1, and developing controls to enable fully 3D, high aspect ratio, and unsupported features. In Phase 1 of this effort, baselines of process performance were characterized, and test coupons produced for both ultra-high frequency antennas and microstructures to support reverse engineering of PCBs. In Phase 2, these efforts will be extended for system demonstration of ultra-high frequency antenna arrays, as well as reverse engineering circuitry for dense PCBs.
This paper describes the application of formal methods and object-oriented modeling to reverse engineering, in which formal specifications are developed for existing, or legacy, code. In this project, several layers of formal specifications were constructed for a portion of the NASA Space Shuttle Digital Auto Pilot (DAP), a software module that is used to control the position of the spacecraft through appropriate jet firings.
Research and business organizations are vulnerable to attack by malware, particularly advanced persistent threat malware tailored for a specific target. Malware identification is made more difficult because samples can be subtly altered to avoid detection by methods that check for an identical match to known code. Different versions of an original piece of malware form a malware family. And when new malicious software is identified, reverse engineers seek to identify its origin and purpose. Knowing whether new malware is from a known family or a previously unobserved family aids the efficiency of reverse engineers. Furthermore, this article presents a three-stage method to classify new malware into a family by comparing its similarity to existing static traces, and assigning it to the most similar family. First, a fast filtering method creates a shortlist of samples with some similarity to the new malware, using a simple bigram comparison of the instructions. The second stage takes the call graph view of the shortlisted static traces and uses simulated annealing to estimate the graph edit distance, a measure of dissimilarity between graphs. Finally, a random forest classifier combines the previous two results to predict the family to which a new sample belongs. Our paper also considers how to detect when malware is from a new family.
Yarrowia lipolytica , an oleaginous yeast, shows promise for industrial fermentation due to its robust acetyl-CoA flux and well-developed genetic engineering tools. However, its lack of an active xylose metabolism restricts the conversion of cellulosic sugars to valuable products. To address this, metabolic engineering, and adaptive laboratory evolution (ALE) were applied to the Y. lipolytica PO1f strain, resulting in an efficient xylose-assimilating strain (XEV). Whole-genome sequencing (WGS) of the XEV followed by reverse engineering revealed that the amplification of the heterologous oxidoreductase pathway and a mutation in the GTPase-activating protein gene (YALI0B12100g) might be the primary reasons for improved xylose assimilation in the XEV strain. When a sorghum hydrolysate was used, the XEV strain showed superior xylose consumption and lipid production compared to its parental strain (X123). This study advances our understanding of xylose metabolism in Y. lipolytica and proposes effective metabolic engineering strategies for optimizing lignocellulosic hydrolysates.
Modern vehicles contain a few controller area networks (CANs), which allow scores of on-board electronic control units (ECUs) to communicate messages critical to vehicle functions and driver safety. CAN provides a lightweight and reliable broadcast protocol but is bereft of security features. As evidenced by many recent research works, CAN exploits are possible both remotely and with direct access, fueling a growing CAN intrusion detection system (IDS) body of research. A challenge for pioneering vehicle-agnostic IDSs is that passenger vehicles' CAN message encodings are proprietary, defined and held secret by original equipment manufacturers (OEMs). Targeting detection of next-generation attacks, in which messages are sent from the expected ECU at the expected time but with malicious content, researchers are now seeking to leverage "CAN data models'', which predict future CAN messages and use prediction error to identify anomalous, hopefully malicious CAN messages. Yet, current works model CAN signals post-translation, i.e., after applying OEM-donated or reverse-engineered translations from raw data. We present initial IDS results testing deep neural networks used to predict CAN data at the bit level, targeting IDS capabilities that avoiding reverse engineering proprietary encodings. Our results suggest the method is promising for data with signals exhibiting dependence on previous or concurrent inputs.
This project details the design and analysis of a structure to replace the interface of the P-3B nadir port with an optimized interface for science installations. A new nadir port plug has been designed to replace the OEM (Original Equipment Manufacturer) plug (Lockheed PN 910169) currently used in Nadir ports 1 and 2 on the NASA P-3B aircraft. The plug consists of a milled frame that can be outfitted with customizable flat plates to meet a broad range of science needs. The frame slides into place using the existing P-3B rail system using a lever and tie-rod assembly. The seal interface will contact the Fuselage skin of the aircraft and consists of a bulb E-seal that is riveted around the perimeter of the frame. The flat plate (20 inches x 31 inches) provides a large profile that can be outfitted based on science mission goals and requirements to attach multiple instruments. This is a significant increase to the aircraft capability. Previously, the OEM plug had to be modified to hold very small plates, windows, or instruments limiting the use of the ports.There were several challenges for this project that included a constrained schedule, lack of historical references, and reverse engineering. The unusually tight schedule for design, manufacture, and install limited potential approaches. In addition, design of a new interface to replace the existing plug, on an aircraft designed in the 1960's by Lockheed for the Navy with little to no documentation, required substantial reverse engineering. In order to accomplish this, a suitable method to determine interface requirements with the aircraft had to be solved. After several iterations, the solution was to implement laser scanning techniques to scan the aircraft and the OEM plug and generate a 3D model to capture the design envelope. The structure is designed to maintain a positive margin of safety when subjected to the inertial, pressure, and aerodynamic load requirements for an external installation on the P-3B, as described in the Wallops' P-3B Design Requirements 548-RQMT-0001 Rev. A . A finite element model is created in FEMAP (Finite Element Modeling And Postprocessing) and is run through NX Nastran solver to analyze the structure. After several iterations of analysis, the structure was enveloped to hold 115 pounds evenly distributed on the plate.
Research efforts in large area graphene synthesis have been focused on increasing grain size. Here, it is shown that, beyond 1 μm grain size, grain boundary engineering determines the electronic properties of the monolayer. It is established by chemical vapor deposition experiments and first-principle calculations that there is a thermodynamic correlation between the vapor phase chemistry and carbon potential at grain boundaries and triple junctions. As a result, boundary formation can be controlled, and well-formed boundaries can be intentionally made defective, reversibly. In 100 µm long channels this aspect is demonstrated by reversibly changing room temperature electronic mobilities from 1000 to 20,000 cm2 V-1 s-1 . Water permeation experiments show that changes are localized to grain boundaries. Electron microscopy is further used to correlate the global vapor phase conditions and the boundary defect types. Such thermodynamic control is essential to enable consistent growth and control of two-dimensional layer properties over large areas.
The 3D Scanning Lab uses a number of technologies to capture 3D surface data. Those technologies are structured light scanning, discrete point measurement photogrammetry and Light Detecting and Ranging(LIDAR). Structured light is a non-contact optical technique used to capture as built surface geometries quickly and accurately. LIDAR is a laser scanning technique used to capture 3D surfaces. And photogrammetry uses a certified DSLR camera to measure discrete registered and non-registered points in 3D space. MSFC’s 3D Scanning Team uses 3D scanning to provide hardware inspections, reverse engineered CAD models, manufacturing/process development and digital assemblies. The inspection process compares the captured data to CAD, providing a color plot detailing the deviations of the scan data to the CAD model. Dimensional measurements and GD&T can also be interrogated. Inspection can provide scan-to-scan data comparisons which is ideal for assessing tested hardware, e.g. comparing data captured before and after hardware testing. Reverse engineering is used to develop CAD models from scan data. This is useful for heritage hardware studies, developing building or structural models and inputs for simulation studies and design efforts. The lab uses the 3D surface scan data to drive manufacturing/machining processes, termed match machining. This technique has been used to modify nozzles, injectors, additive manufactured parts, composite barrel sections, etc. Parts of an assembly can be scanned and assembled in a virtual environment providing an accurate 3D representation of the assembled hardware in its as-scanned state. This can provide detailed information of internal components that would otherwise not be accessible.
In industrial control systems (ICS), programmable logic controllers (PLCs) are used to automate physical processes such as nuclear plants and power grid stations, and are often subject to cyber attacks. As in conventional IT domain, the memory analysis of the PLCs can help answer important forensic questions about the attack, such as the presence of malicious firmware, injection of modified control logic (the program running on the PLC), and manipulation of I/O devices (e.g., sensors and actuators). Unlike conventional IT domain, PLCs have heterogeneous hardware architecture, proprietary firmware and control software, making it challenging to employ a unified framework for their memory forensics. For merely extracting artifacts of forensic importance, reverse-engineering the firmware is a tedious task, and the effort needs to be repeated for every PLC model. As a community, a step-wise approach to tackle this challenge is to analyze the memory of specific PLCs, and subsequently find a generic framework applicable to all PLCs. Our work is a step forward in this direction. By following a methodology that focuses on the functional layer of PLCs instead of reverse engineering the firmware, we analyze the digital forensic artifacts available in a common PLC, Allen-Bradley ControlLogix 1756-L61. Before diving into the memory dump, we analyze the PLC control software to create a list of important artifacts that are sure to exist in the PLC memory dump. The approach employs a setup where PLC control software RSLogix-5000 is connected to the PLC, and the memory dump can be obtained as and when needed. We create test cases that sequentially highlight each category of artifacts, followed by an examination of the resultant impact on memory. After attaining the listed artifacts, we employ conventional string and known data searches to extract interesting information present in this PLC's memory. The memory analysis profile, presented as a Python library and shared with the community, can help a forensic investigator to readily extract forensic artifacts from the same model's controller. The adopted approach may help researchers in creating memory profile of other PLCs, and ultimately formulating a generic PLC memory analysis framework.
Most reverse engineering approaches involve imaging or digitizing an object then creating a computerized reconstruction that can be integrated, in three dimensions, into a particular design environment. Rapid prototyping (RP) refers to the practical ability to build high-quality physical prototypes directly from computer aided design (CAD) files. Using rapid prototyping, full-scale models or patterns can be built using a variety of materials in a fraction of the time required by more traditional prototyping techniques (refs. 1 and 2). Many software packages have been developed and are being designed to tackle the reverse engineering and rapid prototyping issues just mentioned. For example, image processing and three-dimensional reconstruction visualization software such as Velocity2 (ref. 3) are being used to carry out the construction process of three-dimensional volume models and the subsequent generation of a stereolithography file that is suitable for CAD applications. Producing three-dimensional models of objects from computed tomography (CT) scans is becoming a valuable nondestructive evaluation methodology (ref. 4). Real components can be rendered and subjected to temperature and stress tests using structural engineering software codes. For this to be achieved, accurate high-resolution images have to be obtained via CT scans and then processed, converted into a traditional file format, and translated into finite element models. Prototyping a three-dimensional volume of a composite structure by reading in a series of two-dimensional images generated via CT and by using and integrating commercial software (e.g. Velocity2, MSC/PATRAN (ref. 5), and Hypermesh (ref. 6)) is being applied successfully at the NASA Glenn Research Center. The building process from structural modeling to the analysis level is outlined in reference 7. Subsequently, a stress analysis of a composite cooling panel under combined thermomechanical loading conditions was performed to validate this process.
Understanding the data structures employed by a program is important for reverse engineering activities and can improve the results of automated software analysis techniques. In a compiled binary, access to data structure fields and array indices defined in the source program are replaced by raw pointer arithmetic. We present a representation for capturing the essential details of how a program accesses memory regions, which we call a Memory Access Graph (MAG), and a static analysis for automatically extracting this information from a program binary. The static analysis to extract the MAGs from the program is straightforward and does not require sophisticated integer or pointer analysis. The MAGs are readily understood by reverse engineers; they are generally able to perceive the data structure definition corresponding to a MAG. We briefly discuss automatic extraction of structure definitions outlining some of the difficulties in doing so.
Over the past few decades, software has become ubiquitous as it has been integrated into nearly every aspect of society, including household appliances, consumer electronics, industrial control systems, public utilities, government operations, and military systems. Consequently, many critical national security questions can no longer be answered convincingly without understanding software, including its purpose, its capabilities, its flaws, its communication, or how it processes and stores data. As software continues to become larger, more complex, and more widespread, our ability to answer important mission questions and reason about software in a timely way is falling behind. Today, to achieve such understanding of third-party software, we rely predominantly on the ability of reverse engineering experts to manually answer each particular mission question for every software system of interest. This approach often requires heroic human effort that nevertheless fails to meet current mission needs and will never scale to meet future needs. The result is an emerging crisis: a massive and expanding gap between the national security need to answer mission questions about software and our ability to do so. Sandia National Laboratories has established the Rapid Analysis of Mission Software Systems (RAMSeS) effort, a collaborative long-term effort aimed at dramatically improving our nation’s ability to answer mission questions about third-party software by growing an ecosystem of tools that augment the human reverse engineer through automation, interoperability, and reuse. Focusing on static analysis of binary programs, we are attempting to identify reusable software analysis components that advance our ability to reason about software, to automate useful aspects of the software analysis process, and to integrate new methodologies and capabilities into a working ecosystem of tools and experts. We aim to integrate existing tools where possible, adapt tools when modest modifications will enable them to interoperate, and implement missing capability when necessary. Although we do hope to automate a growing set of analysis tasks, we will approach this goal incrementally by assisting the human in an ever-widening range of tasks.
A method for architecture discovery and analysis of implemented systems (AIS) is disclosed. The premise of the method is that architecture decisions are inspired and influenced by the external entities that the software system makes use of. Examples of such external entities are COTS components, frameworks, and ultimately even the programming language itself and its libraries. Traces of these architecture decisions can thus be found in the implemented software and is manifested in the way software systems use such external entities. While this fact is often ignored in contemporary reverse engineering methods, the AIS method actively leverages and makes use of the dependencies to external entities as a starting point for the architecture discovery. The AIS method is demonstrated using the NASA's Space Network Access System (SNAS). The results show that, with abundant evidence, the method offers reusable and repeatable guidelines for discovering the architecture and locating potential risks (e.g. low testability, decreased performance) that are hidden deep in the implementation. The analysis is conducted by using external dependencies to identify, classify and review a minimal set of key source code files. Given the benefits of analyzing external dependencies as a way to discover architectures, it is argued that external dependencies deserve to be treated as first-class citizens during reverse engineering. The current structure of a knowledge base of external entities and analysis questions with strategies for getting answers is also discussed.