No description available.

This thesis investigates the automation of forensic analysis in identifying and categorising forensically interestingchanges across different versions of chat applications on Android platforms. The focus is primarily on thedifferentiation of Android Package Kit (APK) using reverse-engineering techniques to reconstruct the originalsource code and comparing the source code from two different versions of the APK. Given the rapid evolutionof chat applications and their frequent updates, it is crucial for forensic investigators to understand thesechanges to maintain the integrity of legal investigations.The research introduces a comprehensive framework leveraging the open-source tools, Ghidra and BinDiff, toautomate the decompilation and differential analysis of APK files. This approach not only makes forensicanalysis less complicated but also ensures that investigators can keep pace with the continuous updates in chatapplications.Tests on the system are conducted on various versions of the Signal chat application. These tests aim todemonstrate the proposed tool in capturing significant changes between APK versions, such as alterations inlogging mechanisms, database interactions, and the use of encryption and cypher libraries.The results confirm that the integration of Ghidra and BinDiff provides a solution for automated forensicanalysis, facilitating the identification of changes and categorisation of methods based on their forensicrelevance. The study shows that the tool can pinpoint modifications and structural changes, which are essentialfor forensic investigations.

No description available.

No description available.

<p>System emulation and firmware re-hosting are popular techniques to answer various security and performance related questions, such as, does a firmware contain security vulnerabilities or meet timing requirements when run on a specific hardware platform. While this motivation for emulation and binary analysis has previously been explored and reported, starting to work or research in the field is difficult. Further, doing the actual firmware re-hosting for various Instruction Set Architectures(ISA) is usually time consuming and difficult, and at times may seem impossible. To this end, I provide a comprehensive guide for the practitioner or system emulation researcher, along with various tools that work for a large number of ISAs, reducing the challenges of getting re-hosting working or porting previous work for new architectures. I layout the common challenges faced during firmware re-hosting and explain successive steps and survey common tools to overcome these challenges. I provide emulation classification techniques on five different axes, including emulator methods, system type, fidelity, emulator purpose, and control. These classifications and comparison criteria enable the practitioner to determine the appropriate tool for emulation. I use these classifications to categorize popular works in the field and present 28 common challenges faced when creating, emulating and analyzing a system, from obtaining firmware to post emulation analysis. I then introduce a HALucinator [1 ]/QEMU [2 ] tracer tool named HQTracer, a binary function matching tool PMatch, and GHALdra, an emulator that works for more than 30 different ISAs and enables High Level Emulation.</p>