Study description

You are invited to participate in a scientific study conducted by researchers at EURECOM. The purpose of this study is to understand how people analyze and solve software reverse-engineering challenges using static analysis.

During the study, you will be asked to examine a set of purpose-built binary challenges and identify the correct answer or flag. You may use static reverse-engineering tools such as IDA Pro, Ghidra, or Binary Ninja.

You must not execute the challenge binaries or use dynamic-analysis techniques. In particular, debugging, emulation, sandbox execution, instrumentation, and runtime monitoring are not permitted. The challenge files should only be opened and inspected using static-analysis tools.

Participation is voluntary. You may stop participating at any time without giving a reason and without any negative consequences. Participation, refusal to participate, or withdrawal will not affect your grades, employment, academic evaluation, or relationship with EURECOM.

You must be at least 18 years old to participate.

What data we collect

We collect only the data necessary to conduct and evaluate the study:

• Your email address.
• Your chosen pseudonymous username.
• Your submitted answers and challenge results.
• The sequence and timing of actions performed on the study platform, such as opening a challenge, submitting an answer, and completing a challenge.
• Technical information strictly necessary to maintain your authenticated session, such as a session identifier.

Your email address is collected for account registration and administration, study-related communications, and the management of withdrawal or data-access requests. It will not be included in the research dataset used for analysis.

We do not monitor your computer or collect information about activities performed outside the study platform. We do not collect your screen contents, keystrokes, local files, running processes, network traffic, or information about the tools installed or used on your computer.

We do not retain IP addresses or use them as research data.

You may choose a pseudonymous username that does not reveal your identity. However, because the research team collects your email address and may be able to associate it with your study account, the collected data must be considered personal and pseudonymous rather than anonymous.

Please do not include your real name or other identifying information in your username or submitted answers.

Why we collect the data

The data are collected exclusively for scientific research and for administering your participation in the study.

The research data will be used to study how participants approach static reverse-engineering tasks, whether they identify the intended solution, and how different challenge characteristics affect the analysis process.

Your email address will be used only for account administration, essential study communications, and responding to requests concerning your participation or personal data.

EURECOM is the data controller for this study.

Subject to confirmation by EURECOM’s Data Protection Officer, the legal basis for processing your personal data is your consent under Article 6(1)(a) of the General Data Protection Regulation—GDPR.

Participation consent and consent to the processing of personal data are collected separately.

How we use and report the data

Study results will be reported only in aggregate or appropriately anonymized form. Publications and presentations may include statistics such as completion rates, analysis times, and the proportion of participants who submitted particular answers.

We will not publish your email address, username, registration information, or individual action history. We will not attempt to identify you from the research data beyond what is necessary to administer the study and respond to your requests.

Individual results will not be communicated to teachers, employers, supervisors, or other participants. The data will not be used to evaluate your academic or professional performance.

No automated decision producing legal or similarly significant effects will be made about you.

Who can access the data

Access to participant-level data will be limited to authorized members of the EURECOM research team who require access for this study.

Email addresses and other account information will be stored separately from the research dataset whenever technically feasible. Researchers analyzing the study results will use pseudonymous participant identifiers rather than email addresses.

The data will not be sold or used for advertising, commercial profiling, or unrelated purposes.

Data retention

Email addresses, account information, and pseudonymous research data will be retained for one year after the final publication arising from the study.

At the end of this period, email addresses and other identifying information will be securely deleted. Research data will either be securely deleted or irreversibly anonymized.

Irreversibly anonymized research results may be retained for scientific verification and reproducibility because they can no longer be associated with an identifiable participant.

Data security

The data will be stored on access-controlled systems approved by EURECOM. Access will be restricted to authorized researchers. Appropriate technical and organizational safeguards will be used to protect the data against unauthorized access, alteration, loss, or disclosure.

Email addresses and other account information that could directly identify participants will be stored separately from the research dataset whenever technically feasible. The research dataset will use pseudonymous identifiers instead of email addresses.

Your rights

Under the GDPR, and subject to the conditions established by applicable law, you may request:

• Access to your personal data.
• Correction of inaccurate data.
• Deletion of your data.
• Restriction of processing.
• A copy of the data that you provided in a portable format.
• Withdrawal of your consent.

You may withdraw from the study and withdraw your consent at any time without giving a reason. Withdrawal will not affect the lawfulness of processing performed before your request.

To request withdrawal or exercise your data-protection rights, contact the principal investigator using the email address associated with your study account. You may also provide your pseudonymous username or participant identifier.

Once the research data have been irreversibly anonymized, it may no longer be possible to identify and remove your individual records.

Contacts

Principal investigator

Simone Aonzo EURECOM Email: simone.aonzo@eurecom.fr

You also have the right to lodge a complaint with the French data-protection authority, the Commission nationale de l’informatique et des libertés—CNIL.