Binary RE is unlikely ever to be fully automated due to both theoretical and practical limitations. Rice’s Theorem (Rice, 1954) implies that determining whether a program exhibits any non-trivial property is undecidable. In practice, modern binaries interleave code and data, employ aggressive compiler optimizations, and often include obfuscation techniques, all of which complicate disassembly and analysis. Even state-of-the-art tools, including those augmented by machine learning or large language models, introduce uncertainty starting with potentially ambiguous disassembly output in the first step and compounding uncertainty in subsequent steps. Human expertise is required to resolve these uncertainties and determine when an approximation is sufficient to meet analytic goals.

The difficulty is increased by ambiguity about what properties should be investigated. For example, an analyst may be asked whether a program contains a hidden trigger or backdoor. Such questions are challenging even with access to source code, as programs rarely come with detailed formal specifications. Determining the “correct” behavior of a binary thus becomes a matter of iterative hypothesis testing, where the analyst continually generates, refines, and discards explanations as new evidence emerges.

Finally, software itself represents an extreme case of engineered complexity. Programs are designed through layers of abstraction, modularization, and interface contracts to allow teams of developers to collaborate on systems far larger than any individual could comprehend in full (Crockford, 2008). During compilation, however, many of these organizing features are stripped away: identifiers are removed, comments discarded, data structures flattened, and high-level constructs translated into low-level instructions. For instance, a function originally named encrypt_data() may survive only as an anonymous address in the binary, leaving the analyst to reconstruct both its role and its relationship to other components. Without the scaffolding of source-level abstractions, the analyst must recreate organizational layers that the original developers used to manage complexity, making the task cognitively demanding and error-prone.

Cognitive Systems Engineering (CSE) provides a theoretical lens for studying how people interact with complex systems. Importantly, CSE is not a single method, but an approach that integrates multiple methods for analyzing the combined performance of humans and machines as a joint cognitive system (Hollnagel and Woods, 2005). Rather than focusing only on individual cognition or only on technology, CSE emphasizes how cognitive work is distributed across people, artifacts, and environments. For binary RE, this perspective highlights the importance of designing tools and workflows that reduce unnecessary cognitive burdens and enable analysts to allocate limited resources such as working memory more effectively. In this way, CSE provides a foundation for considering how immersive technologies might augment human reasoning in reverse engineering tasks.

This paper draws on terminology from cognitive science, human-computer interaction, and immersive analytics as analytic lenses for framing binary reverse engineering (RE) as a sensemaking activity grounded in human cognition. We use sensemaking to denote the iterative, abductive process by which analysts construct and revise explanations under uncertainty. We distinguish cognitive models, researcher-proposed representations of this process, from mental models, analysts’ internal task representations. Our use of immersive sensemaking follows prior work showing that spatial externalization can reduce memory demands and stabilize intermediate hypotheses. Accordingly, we draw on theories of external and embodied cognition to motivate immersive VR as a means of enabling spatial persistence, embodied interaction, and externalization of reasoning, rather than as a display technology alone. We reference cognitive load to characterize cognitive constraints in binary RE and to reason about how immersive affordances may mitigate extraneous demands.

The goal of the first part of our survey is to identify common elements of published cognitive models of sensemaking in binary RE (RQ1). We sought publications that present clear cognitive or mental models of the sensemaking process for unfamiliar binary programs. Our database searches used the following search over titles, abstracts, and key words (modified as needed to match syntax requirements of each search engine): ((binary OR executable) AND (“reverse engineering” OR “program comprehension” OR “program understanding”) AND (“mental model*” OR “cognitive model*” OR sensemaking)). These searches yielded a total of 73 unique publications, and after review, we found that six met the inclusion criterion: publications presenting cognitive or mental models of the sensemaking process in software understanding, with first preference given to publications specifically covering binary RE.

Next, we employed iterative backward (references) and forward (citations) snowballing starting with this core group of publications. This process revealed additional work in cognitive models for program understanding, not only for binary programs, but also select related work in the much larger and more mature body of knowledge covering source code understanding. Authors covering models of binary RE often referenced prior work in source-related program understanding to provide a foundation for their work, so we selectively included this foundational work to provide context. These publications are analyzed in Section 4.

Our second goal is to extract and explore the fundamental cognitive phenomena related to the identified cognitive model elements and to immersive experiences (RQ2). We took two approaches with this part of the survey. First, in order to provide context for fundamental cognitive concepts related to our scenario, we performed several targeted database searches of specific cognitive phenomena and summarized the results. In this way, Section 5 serves as a primer and as a bridge to the final survey section. Second, we performed additional targeted searches for publications discussing the identified phenomena in the specific context of software reverse engineering, which we summarize in the latter part of the section. Inclusion criteria: publications addressing fundamental cognitive concepts relevant to sensemaking (e.g., working memory, external cognition, or embodiment) and works that explore these concepts in the paradigm of software RE. These publications are analyzed in Section 5.

In this part of the survey, we sought publications that specifically discuss visual and/or immersive affordances for sensemaking for abstract analytic problems, using that criterion as our filter. Again, we combined database searches with snowballing. Using the search string (immersi* OR “virtual reality”) AND sensemaking we found 23 unique publications; eight met our inclusion criteria: publications discussing visualization or immersive affordances that support sensemaking in abstract analytic tasks, with emphasis on immersive VR and preference for those that explicitly apply to software RE. With that core group of papers, we reviewed additional publications identified through snowballing and included those that met the criteria. In this process, we found several papers meeting our criteria that specifically cover software engineering and RE, so we put them in their own subsection. These publications are analyzed in Section 6.

This study adopts a CSE-guided integrative synthesis rather than a systematic literature review. While this approach provides the flexibility needed to bridge several disciplinary domains, it also entails interpretive subjectivity. Our inclusion of source-level software RE and immersive analytics work introduces a degree of conceptual extrapolation, and we acknowledge the risk of overgeneralizing beyond binary RE. However, these decisions were made deliberately to capture theoretical and cognitive parallels relevant to our research questions.

Because the survey aimed to identify conceptual linkages rather than to produce a comprehensive inventory, our coverage is necessarily selective. Some potentially relevant studies may have been missed, particularly in rapidly evolving areas such as immersive analytics and cognitive augmentation. Nevertheless, by documenting our search process and inclusion logic, we aim to provide sufficient transparency for readers to assess the interpretive validity and boundary conditions of our conclusions.

Having established our approach and the rationale for our source selection, we now turn to examining published cognitive models that describe how analysts reason about unfamiliar binaries. This analysis forms the foundation for understanding the cognitive requirements of binary RE and sets the stage for linking these models to broader theories of cognition and immersion.

The mental model concept originated with Craik (1943), who asserted that humans build internal representations of the external world and use them to reason about why things happen and anticipate what might happen next. The research of Johnson-Laird (1983) in experimental psychology corroborated Craik’s claims by finding that people employ mental models in their working memory to perform reasoning (Preece et al., 2019). Cognitive models, as formal representations of mental models, can be particularly powerful because they combine elements of both the problem domain or task area and the characteristics of human cognition (Anderson and Lebiere, 1998).

To characterize how analysts mentally represent and reason about program structure, Shneiderman and Mayer (1979) developed an early cognitive model of how programmers build up an internal semantic representation of a program based on evidence discovered in a series of experiments they performed. They asserted that the model must describe common programming tasks (composition, comprehension, debugging, modification, and learning) in terms of cognitive structures that programmers form in their memories and cognitive processes to use and build that knowledge. Knowledge is categorized as semantic (general concepts independent of language) or syntactic (“precise, detailed, and arbitrary” details, primarily language-specific). They cast the task of RE as subtasks of debugging, modification, and learning in which the programmer uses syntactic knowledge to form a multi-level internal semantic representation of the program. Lower levels (e.g., sequences of operations) and higher levels (what the program does) can be formed independently, and this encoding process is similar to the chunking process of Miller (1956), where smaller chunks of statements join to form larger chunks. The internal semantic representation of the program is strongly retained and widely accessible. This work identifies hierarchical semantic abstraction as a foundational cognitive characteristic of program understanding and, by extension, binary RE sensemaking. Figure 2 illustrates their concept.

To explain how understanding evolves through hypothesis testing, Brooks (1983) introduced an iterative model in which comprehension proceeds through branching hypotheses that are confirmed or discarded. As a branch is found to be incorrect, the programmer cuts that branch and backtracks and may follow another higher-level branch or add a new one. This process is essentially abductive reasoning applied to code understanding, described by Weigand and Hartung (2012) as a process of making observations, forming hypotheses, creating mental models of code that support the hypotheses, and searching for information to prove or disprove the hypotheses. These models establish abductive iteration as a defining cognitive mechanism of sensemaking in RE, framing comprehension as a continuous cycle of hypothesis formation and revision.

Extending these concepts to low-level code, Zayour and Lethbridge (2000) conducted a cognitive analysis of RE performed on proprietary assembly-like language. They identified two primary cognitive difficulties of disorientation following recursions and disorientation in understanding the most relevant execution paths in the code. In response, they proposed two high-level cognitive design requirements. The first is to minimize how many artifacts the engineer needs to keep in working memory by maintaining visual proximity between artifacts; linking new and existing information with meaningful encoding or chunking; and facilitating backtracking in execution paths. The second is to minimize fading of working memory by reducing the time artifacts need to be maintained in working memory and minimizing the number of steps between artifact acquisition. They used their findings to drive implementation of a RE assistive process in their DynaSee tool, which performs several filtering steps on program execution (remove redundancies, detect patterns, rank code routines) before visualizing trace patterns. This study highlights working memory limitations and contextual reinstatement as key cognitive challenges in binary RE.

The Data-Frame Theory was established by Klein et al. (2007) in which a frame—an explanatory structure such as a story, map, script, or plan that relates entities to other entities—is simultaneously fitted to discovered data and also drives the discovery of further data. The frame provides a foundation for understanding until flaws are detected. Sensemaking happens when the frame is re-fitted to new evidence in response to those flaws, and it is enabled by abductive reasoning (Dudenhofer, 2019). The approach to modeling taken by Bryant et al. (2012) is to frame binary RE as a sensemaking task, in which the engineer develops a mental model or hypothesis about the situation and its constituent elements, and adapts that model through iterations of goal-directed information seeking. Through a process of cognitive task analysis and verbal protocol analysis, they identified nine sensemaking functions in binary RE and developed a state machine representing the process, represented in Figure 3. Within their model, Bryant et al. included both procedural and declarative knowledge. Procedural knowledge consists of stored patterns of interaction. They categorized the declarative, or factual, knowledge into twelve subdomains covering the fundamental training and experience needed by reverse engineers (programming, debugging, program loading and execution, instruction sets, etc.). Additional declarative knowledge comes from abstract and concrete causal relationships within the data, e.g., constraints on prior knowledge or predicates applied to constants. This model characterizes binary RE as a structured cycle of goal-directed information seeking guided by abductive sensemaking.

To facilitate and encourage collaboration through communication of information in analysts’ mental models, Tennor (2015) surveyed and analyzed cognitive aspects of binary RE and proposed that the binary RE community build vocabularies and ontologies. In this vein, Sisco et al. (2017) sought to mathematically formalize Bryant et al.’s concept of binary RE as a sensemaking task and developed a supporting ontology. They asserted that reverse engineers analyze programs using four foundational patterns: navigation (searching for items, e.g., beacons ² ); translation (determining how the code would be implemented in a higher-level language); experimentation (deducing how program values change over different flows); and elaboration (identifying and explaining the major components and properties of the program). Reverse engineers use these patterns to build knowledge as interrelated mental objects with various constraints on their relationships. Further, Sisco et al. (2017) proposed an ontology for representing this knowledge composed of ologs: category-based types, aspects, and facts; this representation allows commutation and a higher level of expressiveness than is supported by common alternatives such as Web Ontology Language (OWL) and Resource Description Framework (RDF). The team generated ologs for fundamental assembly instructions, program data, control flow, and operating system events, and used those ologs to formalize information flow in the experimentation pattern. Their work demonstrates how cognitive structures of binary RE can be computationally modeled to support reasoning and tool interoperability.

In a push toward building automated agents to assist with binary RE, Dudenhofer (2019) proposed the Cognitive Understanding of Reverse Engineering (CURE) model to capture sensemaking steps in binary RE. The model, shown in Figure 4, is founded on the iterative cycle of abductive reasoning and experimentation: form a hypothesis; explore to find information to prove or disprove a hypothesis; recognize cues in the code or related artifacts, e.g., beacons, and store them in working memory; use that information to refine the hypothesis or form the next hypothesis; and repeat the cycle. The model inspired an application, the CURE Assistant, which works with an existing binary RE framework to identify code snippets matching those in an extensible catalog of recipes and present possible program behaviors to the analyst. This contribution bridges cognitive modeling with applied system design, illustrating how abductive iteration and cue recognition can be embedded in computational aids.

Complementing this perspective, Votipka et al. (2020) presented a three-phase process model for binary RE: (1) Examining and executing the full program for an overview, then choosing focus areas; (2) Reviewing specific program slices chosen in the first phase, scanning for beacons and data and control flows, and generating specific hypotheses; and (3) Inspecting lines of assembly code and traces to test the hypotheses, as shown in Figure 5. They also identified several categories of beacons for use across the phases: APIs and strings across all phases; UI elements in the first phase; and constants, variable names, control flow structures, compiler optimizations, function prototypes, and program flow in the second and third phases. In developing this process, they identified one significant similarity between binary RE and source-code-based RE: mental simulation of code execution; and two primary differences between binary RE and source-code-based RE: binary RE involves more overview while source-code-based RE is more focused and pinpointed, and binary RE uses a more diverse set of beacons, common recognizable schema or patterns. Their work culminated in five guidelines for designing RE tools: (1) Match interaction with analysis phases; (2) Present input and output in the context of code; (3) Allow data transfer between static and dynamic contexts; (4) Allow selection of analysis methods; and (5) Support readability improvements. Their findings confirm that beacon-driven attention and iterative refinement are stable cognitive strategies across RE contexts.

Finally, Nyre-Yu et al. (2022) conducted a task analysis of static binary RE. They found evidence reinforcing previous findings that binary RE and source-code-based RE share similarities in cognitive processes: identifying goals and plans, creating hypotheses, and exploring to gather information. They asserted that analysts very commonly ask “where is this used in the code?“, “where is the method being called?“, “how can I get calling information?“, “where does this information/data go?“, “where is the data coming from?” and “what is the context of this vulnerability/code?” (Nyre-Yu et al., 2022). They also observed the revisiting of past states reported by Votipka et al. (2020), however, they did not find common patterns across participants. The team also identified repetitive actions that are targets for automation: accessing library function documentation and accessing the task definition. This study supports the generality of abductive sensemaking and the importance of contextual inquiry in RE cognition.

To further address RQ1, we examine how expertise modulates the shared cognitive structures identified above. Studies comparing novices and experts reveal how experience shapes sensemaking efficiency, abstraction level, and memory strategies.

Looking toward source-code-based RE again as a close analog of binary RE, Vessey (1985) studied experts and novices in a code comprehension and debugging task, observing that while both experts and novices employ breadth-first approaches, experts apply a system view that novices do not; novices also employ depth-first approaches while experts do not. Additionally, experts perform chunking effectively to proceed steadily through a program, while novices perform chunking much less effectively, resulting in jumping around within a program to understand it. A survey by Storey (2005) found that experts use more external memory aids (Détienne and Bott, 2001), and that novices focus mainly on objects while experts also consider functional relationships and algorithms. Siegmund et al. (2014) asserted there are two basic models of RE: top-down and bottom-up. Rather than distinguishing between “expert” and “novice,” they focused on level of domain knowledge. Analysts who have domain knowledge they can apply to the program use the top-down process and use beacons to form hypotheses. Otherwise, without domain knowledge, they use the bottom-up process to analyze the program line-by-line. These findings show that expertise in RE manifests as the ability to abstract, chunk, and navigate information hierarchically.

Cowley, (2014) conducted a job analysis to identify performance predictors for binary RE practitioners. In addition to situational (team and organizational) predictors, Cowley identified individual predictors for novices and experts. From those predictors, the author determined five milestones along the progression from novice to expert. Milestones to the intermediate level include (1) proficiency in relevant tools; (2) significant reduction in assistance needed to complete tasks; and (3) parity with experts in identification and employment of binary RE strategies. The final two milestones complete the transition to a true expert, including (4) organizational recognition through promotion; and (5) establishing a track record of solving binary RE problems without assistance. Their model delineates the developmental trajectory of expertise.

Finally, Mantovani et al. (2022) studied nearly 300 h of activity performed by 72 novice and expert reverse engineers performing a static analysis task. They observed that most often, novices move forward from main() and jump around between code blocks, visiting some more than once, while experts move both forward and backward from main() and move more linearly through code blocks. Additionally, experts are quicker to identify what they can ignore. Their observations further confirm that expert cognition in RE involves efficient selective attention, exploration up and down the hierarchy, and filtering irrelevant information.

The studies reviewed in this section address RQ1 by converging on several recurring characteristics of sensemaking in binary reverse engineering. Across cognitive and mental models, binary RE is consistently framed as an abductive, hypothesis-driven process supported by hierarchical mental representations that link low level syntactic detail to higher-level semantic intent. Analysts rely heavily on perceptual cues, external artifacts, and memory aids to manage uncertainty and cognitive load, with systematic differences observed between novices and experts in abstraction, navigation, and selective attention. These findings delineate the cognitive problem space of binary RE and establish the empirical basis for examining how underlying cognitive theory can explain (and potentially alleviate) the observed challenges, which we explore in the following section.

Cognition involves many specific and interdependent processes: Eysenck and Brysbaert, (2018) identified attention; perception; memory; learning; reading, speaking, and listening; and problem-solving, planning, reasoning, and decision-making; each with their own design implications. Norman, (1993) described cognition as multimodal—that there are many different types of thinking—and specifically addressed experiential cognition and reflective cognition. Experiential cognition is when a person is experiencing and responding to the environment without the need for significant mental effort (which also happens with extensive expertise), while reflective cognition happens when a person is putting substantial thought into considering and making decisions or forming new ideas. Norman further discussed both forms in relation to effective tools for enhancing one or the other, such that a tool designed to aid reflective thought is inappropriate for experiential cognition and vice versa (Norman, 1993). This distinction highlights the design challenge later addressed in Section 7: immersive systems must support both experiential (embodied) and reflective (analytical) modes of sensemaking without imposing extraneous cognitive transitions.

Cognition also occurs in varied places, times, and situations, and there is movement in the field toward understanding cognition in situ—rather than limiting the scope of reasoning about cognition to what occurs in the mind, considering how the environment can improve and affect cognition (Preece et al., 2019). This perspective of circumstance provides the conceptual bridge to immersive environments, where the environment itself can be designed as part of the cognitive system rather than merely its container.

External cognition, per Scaife and Rogers, (1996), concerns the cognitive interaction with external manifestations of knowledge in the environment, e.g., images, video, virtual reality, etc. The primary cognitive benefits of external cognitive activities include using external knowledge representations (e.g., notes and reminders) to reduce memory load; using computational tools (e.g., calculators) to make tasks easier; and annotating and reordering or restructuring external representations of knowledge (e.g., checking off to-do lists or arranging desktop icons) (Preece et al., 2019). In the context of binary RE, these mechanisms explain how spatially persistent visualizations or manipulable code artifacts in immersive VR can serve as external memory and reasoning supports.

In considering the impact of the environment on cognition, Gibson, (1977) coined the term affordance as a “specific combination of the properties of its substance and its surfaces” perceived in relation to the viewer. Norman further elaborated that an affordance is most importantly constrained by properties that indicate how something could be used: “When affordances are taken advantage of, the user knows what to do just by looking: no picture, label, or instruction needed.” (Norman, 1988). Affordances leverage internal cognition to enable the phenomena of external cognition and embodied cognition. These principles establish the foundation for mapping environmental structure to cognitive function, a key premise for immersive sensemaking systems developed in later sections.

Embodied cognition (van Gelder and Port, 1998), closely linked to dynamical systems theory, proposes that cognition happens in real time, with the brain simultaneously receiving input from, processing, and interacting within and with the nervous system, physical body, and external environment. In this theory, cognition is deeply impacted by sensorimotor interaction with the environment and is profoundly grounded in the ability to act (Glenberg et al., 2013). The Embodiment Thesis of Shapiro and Spaulding (2021) states: “Many features of cognition are embodied in that they are deeply dependent upon characteristics of the physical body of an agent, such that the agent’s beyond-the-brain body plays a significant causal role, or a physically constitutive role, in that agent’s cognitive processing.”

In line with the concept of the joint cognitive system of human and machine described earlier, Kirsh, (2013) made the case that tools are absorbed into the body schema and change how we think, that we think with not just our minds but also our bodies (enabled by kinesthetic perception), and that we even think with tools. Similarly, Hornecker et al. (2017) presented the position that our sensorimotor interactions with, and manipulation of, the world develop our capacity for abstract thought, starting with simple concepts such as in/out, over/under, up/down—that body and mind are inseparable even in the domain of abstract thought. Ale et al. (2022) suggested that embodied memory is a potentially rich research area, in which physical objects or locations serve as memory palaces; and that whole-body stimuli can expedite storage and retrieval of memory (e.g., using physical motion or aroma triggers to encode and store memories). This notion of embodied memory directly supports later design implications for spatial persistence in immersive VR, where physical arrangement becomes a mechanism for memory consolidation and recall.

External and embodied cognition frame how interaction with the environment through perception, movement, and manipulation constitutes part of the reasoning process. Within this study, they provide the theoretical justification for examining immersive VR affordances such as spatial organization, persistence, and embodied manipulation as cognitive extensions rather than visualization features.

While external and embodied cognition emphasize how cognition extends into the environment, Cognitive Load Theory (CLT) focuses on the limits of internal processing and gives indicators of how design can optimize it. CLT provides an analytic framework for identifying which aspects of immersive systems may reduce extraneous load or redistribute intrinsic and germane load during RE tasks.

CLT, per Sweller and Chandler, (1994), assumes that humans take in and process information through two main channels—through hearing and through visualizing. Further, only a finite amount of processing can occur in each channel at any point in time. The magnitude of the cognitive load depends not only on sheer number, but on how much interactivity occurs between elements. The ability to process this information is limited by working memory, but can be improved through employing a suitable schema with which to leverage long-term memory and reduce cognitive load. Cognitive load theory currently incorporates three categories: intrinsic load inherent in the cognitive task at hand; extraneous load caused by how information is presented; and germane load. Germane load represents the ability of our mind to connect what we are learning with long term memory, and linked to intrinsic, is the demand on our cognition of using or focusing working memory for intrinsic learning (Sweller et al., 2019). Paas et al. (2004) asserted that cognitive performance will degrade at either end of the load spectrum (underloading or overloading). For immersive system design, these categories inspire testable hypotheses about the impact of affordances of VR on the categories of cognitive load.

Hollender et al. (2010) surveyed 65 papers on cognitive load related to human-computer interaction. They cataloged methods to leverage phenomena to reduce extraneous cognitive load as follows. The worked example effect is from learning from studying solved sample problems. The split-attention effect is from presenting information from multiple visual sources in an integrated way to reduce load required to perform mental integration. The modality effect is from presenting multiple information sources through different modalities (e.g., visual and aural) to allow the inputs in each modality to be processed simultaneously. The redundancy effect is from reducing the level of redundant information presented in different modalities/sources, thereby reducing the load of reconciling the underlying concepts across the inputs from those modalities. They also reviewed methods to increase germane cognitive load and foster schemata development (most applicable in educational settings, and a way to increase the capacity of working memory): specifically introducing a variety of tasks; linking concrete information to abstract concepts; and self-explanation. Also, in an educational context, they reviewed methods to adjust intrinsic cognitive load via adjusting the sizes and quantity of information chunks presented over time. Each of these mechanisms has a direct analog in immersive environments, where information can be integrated across modalities and dynamically reorganized to balance cognitive load during complex analysis.

Having established key theoretical constructs, we next examine how they have been studied in relation to software and reverse engineering tasks to reveal how theory manifests in practice.

Helgesson and Runeson, (2021) studied cognitive load drivers in software engineering and proposed a set of perspectives with which to reason about these drivers. The Task perspective accounts for CLT’s intrinsic load, which results from the inherent cognitive intensity of software engineering. The Environment perspective accounts for CLT’s germane load, which results from constructing mental schemata for processes and tools, plus additional load from re-learning new processes and tools that are meant to replace old ones, but can set up competing mental schemata. The remaining perspectives comprise CLT’s extraneous load: Structural (e.g., technical debt); Information (e.g., poor/missing code documentation); Tool (e.g., friction from unintuitive, cumbersome, or unreliable tools), Communication (e.g., lack of communications amongst the development team), Interruption (the cognitive cost due to resumption lag), and Temporal (e.g., tracing a component’s change history in version control). This decomposition illustrates how the CLT framework can be used to classify challenges in RE workflows and identify targets of opportunity for improvement.

In observing how programmers comprehend code, Siegmund et al. (2014) took a novel approach by employing functional magnetic resonance imaging (fMRI) to find the brain regions activated during source-code-based RE. In a controlled study of 17 computer science undergraduates, designed to elicit bottom-up source code comprehension and minimize extrinsic cognitive load, they observed activation of five Brodmann areas (of 52 Brodmann areas associated with cognitive process) (Brodman, 2006) using fMRI. Those five areas are associated with division of attention, silent word reading, verbal/numerical working memory, and problem solving. Based on further analysis, Siegmund et al. theorized that bottom-up RE uses two areas for keeping values in mind, another area for analyzing words and symbols, and the remaining two areas for integrating statements and chunks. Their localization of working memory and problem-solving areas provides evidence supporting VR design strategies that externalize intermediate states of binary analysis in which VR spatially maps these cognitive subcomponents to persistent artifacts.

Smits, (2022) performed a study of reducing cognitive load in reverse engineering. Under the assumption that the complexity and volume of outputs from RE tools induces cognitive overload, Smits implemented two primary techniques for managing cognitive overload: (1) Information Filtering to remove extraneous information so as to reduce extraneous load; and (2) Information Organization to organize data in a manner familiar to the user to reduce germane load. The two techniques would therefore increase the capacity available for intrinsic load. The implementation focused on improving the common Control Flow Graph (CFG) visualization with the concept of the Proximity View: Simplify the view by removing most instructions, variables, and constants; keep only variables and constants that are arguments for function call nodes; and insert empty nodes to maintain the graph structure. A user study of 41 participants comparing this view to a traditional view demonstrated that subjects in the Proximity View group had statistically significant better performance in challenges solved, but took longer to solve them. This finding reinforces the theoretical expectation that reducing extraneous load through information filtering can enhance performance, aligning empirical evidence with CLT predictions and supporting immersive design approaches that simplify and spatially organize data.

These reviewed studies demonstrate that principles from external and embodied cognition and CLT are not merely conceptual but have measurable implications for software RE. These precedents validate their use as the theoretical foundation for deriving immersive design implications in Section 7.

The cognitive theories reviewed in this section address RQ2 by explaining why the characteristics identified in prior models of binary RE arise and persist. External cognition and embodied cognition provide a foundation for understanding how analysts distribute reasoning across internal mental processes and external representations, while concepts such as embodied memory and spatial persistence illuminate mechanisms for stabilizing intermediate hypotheses. CLT further characterizes the limits of working memory and identifies design strategies for reducing extraneous load without oversimplifying the task itself. These theories form the interpretive bridge between observed sensemaking behavior in binary RE and the potential of immersive systems to support that behavior, motivating the examination of immersive affordances and prior visualization work in the next section.

Virtual reality provides a uniquely embodied and spatial medium for analytic reasoning. Unlike 2D or semi-immersive displays, immersive VR allows the analyst to inhabit the data space, using movement and gesture to externalize thought processes that would otherwise remain internal. This property makes immersive VR particularly well suited to tasks, such as binary RE, that demand the coordination of multiple partial models held in working memory.

Immersion also affords egocentric spatial organization: analysts can arrange related code artifacts around their perceptual field, anchor hypotheses in persistent spatial locations, and use body-based reference frames to recall relationships. These capabilities extend cognitive offloading beyond what is possible on desktop systems.

However, immersive systems do not universally outperform traditional tools. Their advantages are most pronounced when spatial reasoning or representational flexibility is central to the task. In contrast, highly procedural or text-centric subtasks may favor conventional interfaces due to precision and familiarity. Thus, the value of immersive VR arises not from technological novelty but from cognitive fit in its ability to align external representation with the analyst’s reasoning process. In this way, immersive VR directly addresses RQ3 by providing a workspace that embodies the analyst’s mental model and extends the external cognition mechanisms described in Section 5.

To address RQ3, we first examine how spatial and embodied affordances of immersive environments support analytic reasoning and sensemaking. As described in Section 5, affordances are perceivable aspects of the environment that foster interaction and enable external and embodied cognition. Some common affordances of virtual, augmented, and mixed reality (VR, AR, MR) include immersive visual and aural displays; spatial interaction (motion tracking); gesture and voice recognition; haptic feedback; and additional emerging modalities.

A note on terminology: In this paper we discuss affordances and in particular, affordances in VR. We use the term “affordance” to refer to a perceivable aspect of the environment that fosters interaction and enables external and embodied cognition. “Affordance in VR” refers to an environmental feature available in the VR experience. Most of the features we have implemented so far are intrinsically 2D, such as code listing windows, but they can be created, sized, oriented, and placed arbitrarily in the 3D space by the user to carry out a task. This approach builds a foundation for evaluating the effects of external and embodied cognition and is the subject of active research in other use cases (Lisle et al., 2021).

One key feature of an immersive environment is an abundance of space. Although the work of Andrews et al. (2010) focused on the use of large two-dimensional displays, they proposed several benefits that working in a large spatial environment brings to the sensemaking process. They completed an observational study of participants performing well-known data analytic tasks using their desktop computing environment, which included a 32-megapixel display of approximately 100 inches by 31 inches. Generally, participants used the space to arrange and organize documents and applications in ways that reflected their relationships. The study showed evidence of a number of avenues to exploit for improving cognition by using a large spatial environment including persistence, context, physical navigation, presence of detail, memory refresh, situational awareness, and spatial semantics. These concepts are listed in full in the section summary, citing the authors, and will be further explored in Section 7. The findings by Andrews et al. endorse concepts we covered in Section 5 regarding external cognition and memory (augmenting working memory and structuring external knowledge representations) and embodied cognition (exploiting and extending the body schema).

Follow-up work in this area considered the effect of available space on sensemaking, but in immersive 3D. Lisle et al. performed observational studies (Lisle et al., 2020; Lisle et al., 2021) of users examining large sets of historical documents. Participants donned a VR headset to select, read, and organize 2D documents in a virtual room in support of performing analysis tasks as directed. The researchers identified three main organizational structures used by participants (semicircular, environmental, and planar). Participants demonstrated higher performance when they used labels and highlights, examples of external cognition, during task execution. Building on this line of work, Davidson et al. (2024) examined how professional intelligence analysts conduct multi-session sensemaking. They found that experts consistently constructed spatial structures such as timelines, clustered evidence groupings, scratch spaces, and ad hoc network representations to externalize hypotheses and incrementally refine mental models over time. While high-level organizational patterns mirrored those seen in novice users, professional analysts produced richer external artifacts and more deliberate spatial-to-report transformation paths, underscoring the role of immersive space as a cognitive workspace rather than a purely visual medium. Further, Derksen et al. (2025) conducted a user study comparing task performance (retrieving scatter plots) in virtual environments with varying levels of environmental features. They found that the time and effort users put into arranging the plots had a greater positive impact on performance than the richness of the virtual environment, suggesting that allowing users to organize their space supports spatial memory in immersive analytic tasks. These studies demonstrate that spatial arrangement itself is a cognitive resource: the act of organizing artifacts in 3D space strengthens memory and comprehension, directly answering RQ3 by showing how immersive affordances offload working memory and enable embodied reasoning.

Additional research in immersive sensemaking indicates that its benefits derive primarily from users’ ability to externalize and organize information in space rather than from immersion itself. Tong et al. (2025) found that task performance and comprehension were largely unaffected by display modality in a hybrid PC + VR environment, while user preference and workload were strongly influenced by how effectively users could arrange and interact with artifacts. Across conditions, spatial layouts and structured workflows served as external memory aids, with organization effort contributing more to sensemaking effectiveness than environmental richness. Yang et al. (2025) examined immersive support for the information foraging phase of sensemaking through the LITFORAGER system. Their observational study showed that spatial organization, clustering, and multimodal interaction enabled users to externalize hypotheses and manage cognitive load while iteratively transitioning between foraging and synthesis. These findings reinforce the view that immersive environments are most effective when they function as cognitive workspaces supporting externalized reasoning across the sensemaking loop.

In their hybrid survey/position paper, Moloney et al. (2018) consider the question of whether VR technology provides affordances for analyzing big data. Their survey covers 47 selected publications in the field of visual data mining, which employs visual cognition to augment algorithmic analysis by differentiating variables by mapping them to distinct graphic attributes to harness human visual perception and creativity. Starting with the Computer Aided Virtual Environment (CAVE) in 1992, they provide a timeline of advances through ‘VR 2.0’ and IA, and present future research challenges proposed by research teams. The authors perform an analysis of affordance theory in immersive VR as it exists in the literature and present a position on the shift from allocentric (attention focused externally) visual analytics—traditional visual analytics (Cui, 2019), which is performed using a 2D screen, even for 3D visualizations—to egocentric (attention focused internally) spatial coding and the affordance of VR. The key principles they identified include tuning the environment to human perception; using mimetic/naturalistic references; coordinating multiple modes of interaction; and aligning data selection with naturally-occurring distribution patterns.

Gračanin, (2018) makes the case that VR and MR technology can provide significant advantages in forming insights about complex data sets by leveraging the theory of affordances to increase embodied resources. The author proposes a framework for creating stimuli in an MR environment based on data from sensors and the user’s interactions with the system, which can reveal the most effective immersive and embodied stimuli through an iterative feedback process. Gračanin concludes that the immersion provided by VR may not be sufficient to fully leverage embodied cognition, and that the physical/real-world affordances provided by MR resolve that gap. Billinghurst et al. (2019) similarly have developed a VR system incorporating a feedback loop using sensor data to adapt the interaction. Their work has demonstrated that electroencephalogram (EEG) measurements can assess cognitive load in VR training tasks, and the simulations can be adapted based on those measures to benefit training transfer effects. In related research, Ahmadi et al. (2023) further refined the findings to pinpoint that power spectral density measurements of the EEG alpha band may reliably indicate cognitive load in moderate VR tasks. These works demonstrate that immersive affordances not only extend cognition but can also monitor and adapt to cognitive state, an important dimension of augmentation relevant to RQ3.

Batch et al. (2020) conducted an experiment to determine the effects of using IA for tasks in economic analysis. They used an iterative, human-centered approach with subject matter experts to extend the ImAxes tool (Cordeil et al., 2017), which provides embodied data axes in a VR environment. They employed a VR headset instead of AR due to better resolution and field of view. Some of their findings were surprises—e.g., fatigue was not a significant factor; no clear concerns about legibility; and participants with little gaming/VR experience used the tool effectively. Participants created egocentric presentation layouts, but did not appear to use the physical space to group similar views near each other, simply using the closest free space. Although this observation contradicted their hypothesis, the authors assert that what they did observe is consistent with the ‘sensemaking loop’ described by Pirolli and Card (2005): in the early bottom-up search for information when executing a task, retained information is left somewhat unstructured except to store it in a “shoebox” for later processing. These findings of Batch et al. corroborate those of Andrews et al. (2010) when employing large two-dimensional displays for sensemaking tasks. Ultimately, Batch et al. concluded that participants still did not fully use the three-dimensional space available in the environment beyond their immediate proximity, and speculate causes may include the small size of the physical space in which the study was conducted; ability to perform the techniques or gestures required to move the visualizations; and lack of automatic layout, indicating a need for constraints and organization frameworks.

Prather et al. (2020) surveyed 104 papers on cognitive augmentation using immersive technologies, specifically work employing biosensor-based measures of user cognitive capabilities in immersive and semi-immersive environments. The authors performed this survey to support their aim of designing and developing cross-reality (XR) systems where task parameters are adapted to optimize the user’s cognitive load, particular in ‘Industry 4.0’ use cases where machines carry out repetitive and increasingly complex tasks. These systems would perform as intelligent cognitive assistants to enhance human capabilities. Their survey found that existing research is predominantly in the health and rehabilitation domain rather than industrial engineering. Many efforts target affective/emotional wellness with an emphasis on short-term therapeutic tools rather than an enduring assistive system. Over one-third of papers described work in adapting the user experience based on physiological data (predominantly electroencephalography (EEG)), with a small but significant number of them applying Artificial Intelligence (AI) and Machine Learning (ML) to that data. The authors included no papers that directly addressed CLT, but several addressed mitigation of mental exertion.

Some recent experimental findings in research on immersive technology and cognitive load pinpoint where the technology is most and least effective. Frederiksen et al. (2020) performed a study of cognitive load in surgical training using immersive and non-immersive VR. The immersive VR method increased cognitive load significantly more than non-immersive VR in both nonstressor and stressor phases, which was attributed to extraneous cognitive load due to the high level of interaction with immersive VR elements. de Melo et al. (2020) sought to reduce cognitive load with a virtual embodied AI-based assistant that used a human-appearing avatar in the virtual world to provide guidance to participants in completing tasks. In a controlled experiment comparing the embodied assistant to voice-only assistant and no assistant, embodied assistants led to lower cognitive load than voice-only assistants and both were lower than no assistant. Albus et al. (2021) studied the effects of the signaling principle in VR learning environments. Per Mayer, (2005), using signals to direct a user to pay attention to specific information can create deeper understanding; this is the signaling principle. Compare this concept to beacons described earlier. In their study of a learning exercise with and without annotations (signals), Albus et al. found that the signals increased germane cognitive load, but did not reduce extraneous cognitive load, and did not result in significantly better deep understanding. Chen et al. (2022) performed a controlled experiment measuring engineering creativity in a secondary education setting, with and without VR. They found that while VR improved cognition, motivation, and the novelty and usefulness of the designs, it did not improve creative thinking. Additionally, VR improved extraneous and germane cognitive load, but had no effect on intrinsic load. These studies delineate the mechanisms by which immersive affordances enhance cognition by balancing engagement, organization, and load.

The emerging field of Immersive Analytics (IA) (Chandler et al., 2015; Dwyer et al., 2018) further realizes these principles. Ens et al. (2022) characterized the second generation of IA as grounded in spatial memory, proprioception, tangible interaction, and collaboration, calling for systematic comparison between immersive and non-immersive experiences. Their synthesis highlights that cognitive benefit derives from spatial and embodied interaction itself rather than display fidelity, reinforcing that the primary value of immersion is its alignment with human cognitive architecture.

To connect RQ3 to the specific problem domain, we next examine visualization research that applies immersive or spatial metaphors to software RE tasks, identifying which affordances demonstrably support cognition.

The bulk of prior work in this application area is aimed at the 2D desktop interaction metaphor, and we provide a few notable examples. Early work by Waguespack (1989) implemented visualizations to aid novice Pascal programmers, for example, representing data types as different shapes, and using a variety of visual representations to differentiate type declarations, variable instances, and literal values. Structures are represented as containers of constituent components. This work demonstrated the utility of chunking: collecting lower-level details in a single higher-level abstraction that can help understanding of a large problem, then providing the ability to decompose as necessary for detailed analysis. Conti et al. (2008) implemented a 2D application to visualize binary and data files as bitmaps; e.g., representing 1 byte per pixel with shading based on the byte’s value or presence in an address range. Rendering a binary file in that way, compared to viewing it in a hex editor, gives a view of the entire file at a glance at the expense of low-level details. The method complements the text-based viewer to quickly identify major segments in the file, recurring or unusual patterns, and so on. Grégio et al. (2012) demonstrated two 2D/pseudo-3D visualization methods of behavior of suspected malware: timeline plots and icons arranged in a spiral. Both methods display operating system actions taken by the code on objects (e.g., read file; terminate process; etc.) over a period of time in a single, compact view that complements traditional logs. The visualizations were particularly useful in identifying where two sample programs acted similarly, indicating shared code across different programs, or different revisions of the same program. These efforts collectively show that making abstract program structures visible enhances cognitive efficiency.

Considering a narrower application area, Wagner et al. (2015) surveyed a pool of 220 papers related to code visualization and identified 25 papers specifically about malware visualization systems. From those papers, they identified nine data providers behind those visualization systems. The data providers collect information about the suspected malware and provide it to the visualization systems—automated and manual applications that execute static and dynamic analysis techniques to collect data useful in profiling and classifying the malware. The visualization systems were binned into three broad groups: individual malware analysis, malware comparison, and malware summarization. Additionally, they were categorized based on well-established taxonomies from the visualization community: the type of provided data, visualization techniques used, mapping and representation space, temporal aspects, interactivity, and goal/action. They identified challenges in bridging between the three broad groups, integrating disparate data sources, characterizing and abstracting problems, improving expert interaction, and integrating analytical methods with the visualizations. By identifying the limits of 2D visual metaphors, this survey indirectly motivates the exploration of immersive alternatives as a means to overcome fragmentation in analysts’ mental representations.

Moving from 2D to immersive 3D contexts, a recent systematic literature review by Rojas-Stambuk et al. (2026) surveyed the use of extended reality across software development activities, analyzing 77 primary studies published between 1995 and early 2025. Their review shows that XR tools are predominantly applied to software comprehension and maintenance tasks through structural visualizations, while evaluation practices remain heterogeneous and often methodologically limited. While this work provides a broad task- and technology-oriented overview of XR in software engineering, it does not examine the cognitive processes underlying analyst sensemaking or how immersive affordances support reasoning, which is the focus of the present survey.

Elliott et al. (2015) explored the use of VR in software engineering to address problems in navigating and comprehending code. Their work builds upon prior research in how developers use the affordance of spatial memory in traditional 2D development environments, such as using scrollbar and tab positions as cues (Ko et al., 2006), or using an “infinitely”-scrollable document canvas (DeLine and Rowan, 2010; Bragdon et al., 2010). This work extends that concept to the affordances of VR applied to software development: spatial cognition, cues, and presence; manipulation and motion to improve perception and retention; and immediate feedback on the state of the system. With these affordances implemented in their RIFTSKETCH (live development) and IMMERSION (code review) tools, the authors provide a proof-of-concept and a vision of VR-based development in the future, though no formal user studies were conducted.

In a user study conducted by Dominic et al. (2022), 26 graduate students were tested on comprehending simple Java programs of the type that one may find in first-year programming course homework assignments. They compared the traditional desktop experience with a VR configuration entitled “VirtualDesk” using a headset and tracked keyboard and mouse that were mapped 1:1 to the real world. The study did not implement specific affordances of VR as proposed by Elliott et al. (2015), but instead compared the performance of RE using common 2D tools on a traditional desktop environment against using the same tools in VR. Their results show 75% of programs were comprehended correctly in the traditional desktop experience compared to 65% in VR. Additionally, their results from conducting the NASA Task Load Index (TLX) survey (Hart, 1986) showed significantly more task load—the demand or difficulty in performing a task—in VR. Finally, results of a survey of self-reported concentration and productivity showed that users in VR had lower levels of concentration and no significant difference in perceived productivity. These findings illustrate that without purposeful cognitive affordances, immersion can impose extraneous load, and underscore that immersion alone is insufficient; affordances must be purposefully aligned with the analyst’s reasoning process to yield cognitive benefit.

One rich facet of human-computer interface theory is the use of metaphors to influence the design of affordances. Lakoff, (1994) curated an extensive list of metaphors encountered in linguistics. Metaphors leverage common experiences amongst most users to facilitate understanding of new concepts. Many of these metaphors can apply to perception and cognition in interactive applications, e.g., “seeing is touching,” “the visual field is a container,” “theories are constructed objects,” etc., Averbukh et al. (2019) surveyed applications of VR for (high-level) program visualization and visual programming, and in particular, the metaphors employed in those applications. They reviewed the city, molecule, and heliocentric cosmic metaphors, asserting they share important qualities: “unlimited context, organization of inner structure, naturalness, and resistance to scaling,” and that these natural metaphors simplify spatial orientation and navigation in the VR world.

The city metaphor recurs in many VR-based visualization efforts. One early instance was by Fittkau et al. (2015), who implemented a VR experience to aid the RE process that uses the metaphor of a program as a city block: the buildings are classes and packages, and the execution trace is represented as straight-line “footpaths” between the buildings. Participants experienced the tool ExplorViz via immersive VR, using gestures to translate, rotate, zoom, and select. The experience was intended to provide analysts a novel tool while employing familiar metaphors. These participants rated the experience of answering basic comprehension questions with this tool as suitable for performing RE, and as an alternative, albeit needing adaptations, to a classic experience.

In another exploration using the city metaphor, Oberhauser and Lecon, (2017) employed immersive VR to aid RE by providing participants the ability to fly through a 3D representation of code in their tool Gamified Virtual Reality FlyThruCode (GVR-FTC). Two metaphors, “universe” and “terrestrial,” related the code components to familiar concepts, where packages/classes/dependencies were represented as solar systems/planets/light beams and cities/buildings/pipes respectively, and the scale of objects represented various metrics such as number of class methods. The team evaluated the tool using two games that motivated players to comprehend the dependency structure and modularization of a code project compared to a common text editor. Although their small sample precluded statistical claims, participants achieved higher comprehension in VR, reinforcing the link between spatial representation and understanding.

In a larger-scale experiment, Romano et al. (2019) compared the relative effectiveness of three tools on the task of source code RE. The baseline was a traditional integrated development environment (IDE) with extensions for code metrics and smells, which was compared to a city-metaphor-based virtual reality environment in both immersive (Code2City_VR) and non-immersive (Code2City) forms. This implementation of the city metaphor (Capece et al., 2017) creates a building (parallelepiped) for each class, where class properties are reflected in the size and color of the building. Romano et al. studied 42 participants solving RE tasks based on two large open-source Java projects. Both VR-based tools resulted in significantly better correctness in the completion of RE tasks than the IDE. Additionally, the time to complete the tasks was significantly shorted in the immersive environment than both the non-immersive VR and the IDE.

More recently, Hoff et al. (2022) performed a similar experiment for source code RE comparing their approach, Immersive Software Archaeology, with another VR method and an IDE. Their approach is focused on providing an overview, with multiple levels of abstraction, of a software system’s architecture. The higher levels of abstraction (architectural) were represented by solar system/planets/continents, and the lower levels (design) were represented by cities/building/floors. Their study of 54 participants demonstrated that their solution provided similar or better performance in tasks exercising accessing information and finding horizontal and vertical relationships in the system’s architecture. Further, this team implemented collaborative note-taking features in their immersive code analysis system (Hoff et al., 2024), adding shareable drawing, audio recording, and screenshot capabilities. An initial case study showed that participants found the system beneficial and they produced correct results.

Finally, we mention a variation of the city metaphor. Weninger et al. (2020) introduced the concept of Memory Cities to visualize how an application uses heap memory over time, rather than using it to visualize code. Objects on the heap are grouped and represented as buildings in a 3D visualization. Attributes such as color, opacity, area, and height represent various metrics of the heap, and the buildings evolve as the program executes. The authors describe how their tool helps users identify memory leaks in two use cases and plan user studies in the future.

These findings illustrate that immersive visualization transforms abstract program reasoning into a spatially embodied activity, thereby answering RQ3 in the specific context of RE.

The visualization and immersive analytics studies we reviewed in this section address RQ3 by demonstrating how spatial organization, embodied interaction, and adaptive feedback can augment sensemaking in complex analytic tasks. The evidence shows that immersive environments are most effective when they enable users to externalize reasoning, organize information spatially, and exploit bodily interaction as a cognitive resource, rather than when immersion is treated as an end in itself. At the same time, the literature highlights risks of increased extraneous cognitive load when immersive affordances are poorly aligned with task demands. These findings clarify which immersive mechanisms are most relevant to the cognitive requirements of binary RE and set the stage for synthesizing insights across reverse engineering, cognitive theory, and immersive analytics to inform design implications, which we present next.

Consider the findings of our literature survey partitioned into three groups matching the three previous sections:

Group A: characteristics of sensemaking/cognitive models of binary RE (RQ1)

Conceptual threads (also called strands in similar work) tie an individual cognitive model element from group A to a cognitive phenomenon in group B demonstrated by the model element, and then to a VR technique in group C that, when implemented in an immersive binary RE tool, could improve that phenomenon. Figure 6 provides an overview of these threads tying together the elements from each group. Element labels are abbreviated in this figure; Table 2 supplements Figure 6 to provides the full text and references for each element, recording the findings from Sections 4 through 6. We present the entire body of threads in the figure to illustrate just one snapshot of the many logical avenues of potential research this problem domain provides before we further narrow our focus in the next subsection.

These threads were established through an interpretive conceptual mapping process. This method draws from narrative and thematic synthesis traditions in qualitative research (e.g., Thomas and Harden, 2008), which emphasize identifying conceptual relationships rather than quantifying frequency or effect. Each thread represents a hypothesized cognitive linkage between an observed mechanism in binary RE, a theoretical construct, and an immersive affordance that could support it. This mapping process involved iterative review, annotation, and comparison of extracted concepts, guided by the logic of conceptual coherence (whether a theoretical construct could plausibly explain or enhance the cognitive process observed). While interpretive, this approach aligns with accepted practices in integrative review and design research, where synthesis aims not at replicability in the statistical sense but at theoretical transparency and explanatory depth. It provides a structured yet flexible means of linking diverse research into a coherent theoretical framework.

Each conceptual thread identified previously represents a proposed cognitive linkage connecting models of binary RE, cognitive theories, and immersive affordances. Following principles of affinity diagramming and thematic analysis commonly used in design research and qualitative synthesis, we iteratively compared and clustered these threads based on conceptual similarity and their relevance to cognitive mechanisms observed in reverse engineering. Because prior research on embodied immersion in binary RE is limited, we incorporated insights from adjacent domains, such as source-level software RE and software visualization, when their underlying cognitive processes were theoretically analogous. This section translates the synthesis findings into concrete design recommendations for immersive virtual reality environments supporting binary reverse engineering.

After several iterations of this process, the clusters settled into three distinct higher-order themes that characterize critical aspects of the process of binary RE where immersive environments may support analytic reasoning in this domain:

Enhancing abductive iteration (hypothesis loop).

These themes represent higher-order integrating constructs derived from iterative conceptual comparison rather than quantitative aggregation, which is consistent with recognized qualitative synthesis approaches in cognitive systems engineering and human–computer interaction.

Figure 7 depicts the three themes and the most closely related elements from groups A, B, and C. These three themes touch upon every element from group A, cognitive modeling of binary RE, which is important because we want to find the most effective ways to augment as many of the cognitive model elements as possible. Moving into the group B elements of cognitive theory, we are more selective in our areas of concentration. Finally, we derive a central set of VR affordances from group C on which we will focus our efforts in future work. We will examine each theme more closely in the remainder of this section.

Our analysis and synthesis of prior work across cognitive models of binary RE and cognitive theory revealed three integrative themes: enhancing abductive iteration, augmenting working memory, and supporting information organization and feature discovery. These themes provide a cognitive foundation for understanding how immersive environments can support the sensemaking processes central to binary RE. Each theme aligns elements of cognitive theory into a corresponding family of design strategies for VR, forming a coherent theoretical bridge between cognition and design.

From the perspective of abductive iteration, the link between reasoning and interaction is critical. Abductive reasoning describes the human tendency to iteratively form, test, and revise hypotheses when confronted with incomplete or ambiguous evidence. When embodied within VR, this cognitive cycle becomes a spatial and perceptual loop rather than a purely symbolic one: hypotheses can be made tangible, manipulated, and spatially organized to reflect the analyst’s evolving reasoning state. This translation of abductive cognition into embodied interaction illustrates how cognitive theory motivates concrete interface features such as spatial clustering, incremental formalism, and embodied assistance.

For working memory augmentation, cognitive theory provides direct guidance on how immersive systems can extend the mind’s limited capacity. External cognition and embodied memory suggest that reasoning is distributed between internal and external representations. Accordingly, persistence, multimodal feedback, and spatial metaphors in VR serve as cognitive aids that effectively offload short-term memory load. These affordances are rooted in well-established mechanisms of cognitive offloading and embodied recall.

The theme of information organization and feature discovery connects cognitive models of program understanding with theories of external representation and conceptual metaphor. Analysts mentally categorize artifacts according to function and meaning; VR enables these conceptual structures to be externalized as spatial organizations that mirror cognitive categories. Spatial semantics, signalling, and user-driven organization instantiate embodied and external cognition principles, supporting orientation and feature discovery through embodied structure rather than purely visual hierarchy.

Across all three themes, the design implications converge as follows: immersive systems should not only visualize information but also physically instantiate the cognitive processes of reasoning, remembering, and organizing. In this sense, VR becomes a medium for extending cognitive work, translating theoretical mechanisms into design affordances that can be empirically tested.

While this survey and synthesis paper offers a structured view of how immersive environments might augment binary RE, several limitations must be acknowledged.

Selection Bias: Search results depend on database coverage and keyword choices. Relevant studies using alternate terminology, particularly in cognitive psychology or human factors research, may have been missed. The synthesis therefore reflects the accessible portion of the literature rather than an exhaustive corpus.

We present our contributions as a conceptual model for future empirical work rather than a definitive account. This work does not cite any sources that have tested this novel model on human participants as we did not find any. The intention is to articulate a direction of inquiry that subsequent experimental studies can refine, extend, or challenge.

Despite these limitations, the synthesis provides a coherent vision for directing future inquiry. The three primary themes, enhancing abductive iteration, augmenting working memory, and supporting information organization, translate into tangible design and research opportunities. This section outlines recommendations for future research directions informed by the limitations and opportunities identified in this review.

Empirical studies can examine whether immersive spatial interaction measurably improves the process of binary RE. One approach is simply to perform a form of A/B testing to compare overall analyst performance between a traditional desktop environment and an immersive environment. A finer-grained approach would evaluate how strongly different VR design features correspond to specific cognitive mechanisms. One experiment could evaluate how spatially persistent arrangements of code artifacts affect reasoning (e.g., continuity and recall) to test predictions from cognitive load theory. Process-tracing or eye-tracking studies could measure how analysts engage in abductive iteration when goals and hypotheses are represented as manipulable spatial structures. Further experiments could assess whether user-organized visualizations in immersive spaces promote faster convergence on code understanding. These studies would establish an empirical foundation linking embodied interaction to measurable analytic performance.

Open questions in immersive analytics, such as how to balance visual complexity with cognitive clarity, or how spatial interaction influences inference, can be explored within the domain of binary RE. In this domain, real analytic reasoning offers a testbed for studying spatial cognition, attentional dynamics, and embodied goal/hypothesis formation. Integrating physiological or behavioral measures (e.g., workload, spatial memory performance) can further align these investigations with ongoing debates in cognitive systems engineering about adaptive, human-centered tool design.

Additionally, the framework proposed here offers practical heuristics that can guide collaborative tool development. Designers can integrate cognitive alignment as a central criterion, creating environments that mirror how analysts think, not just what they see. Cognitive scientists can use these systems to experimentally probe embodied reasoning, while visualization researchers refine how spatial metaphors convey semantic relationships. Such reciprocal collaboration can bridge disciplinary boundaries, converting theoretical constructs into validated, shareable design principles for immersive analytic systems.

Finally, subsequent to the initial development of this manuscript, we explored one concrete instantiation of the design principles synthesized here by integrating a large language model (LLM) as a visualization agent within an immersive binary reverse engineering environment. That conference study (Brown and Mulder, 2025) investigates the feasibility and limitations of LLM-driven generation of spatial program visualizations, complementing the present work’s broader theoretical synthesis.