# Reverse Engineering (RE) Reverse engineering is working out how something was built, or how it works, from the finished artefact, without access to the original design documents or source code. In 1990, Chikofsky and Cross defined software reverse engineering for the IEEE as "the process of analyzing a subject system to identify the system's components and their interrelationships and to create representations of the system in another form or at a higher level of abstraction". The analysis doesn't change the system; changing it is re-engineering. "SRE" sometimes stands for software reverse engineering ([[Ghidra]] describes itself that way). In this vault, SRE usually means [[Site Reliability Engineering (SRE)]]. ## Domains - **Software**: two complementary approaches - *Static analysis* reads the program without running it: disassembly (machine code to assembly), decompilation (assembly to C-like pseudocode), strings, imports, file and section structure - *Dynamic analysis* runs it and watches: debuggers, breakpoints, system call and API tracing, memory inspection, network captures - *Protocols and file formats* are a common target too: capture the traffic or the files, then infer the structure from many samples - **Hardware**: tracing circuit boards, reading firmware out of chips, decapping and imaging integrated circuits - **Mechanical**: measuring or 3D-scanning a part to rebuild it. The Soviet Tupolev Tu-4 bomber was a copy of interned Boeing B-29s - **Biological**: systems biology uses the term for inferring gene regulatory networks from measurements ## Uses - **Interoperability**: making your software talk to someone else's. Samba reverse-engineered Windows file sharing, Wine the Windows API. In the vault: [[OpenRGB]] supports hundreds of proprietary lighting protocols, [[Mouser]] reverse-engineers vendor protocols to give users control of their own hardware, and rclone's Proton Drive backend relies on a reverse-engineered API ([[Proton Drive]]) - **Security**: malware analysis, vulnerability research, auditing closed-source software - **Legacy systems**: recovering the design of code whose authors and documentation are gone, before maintaining or replacing it. It's the expensive way to rebuild the [[Design Rationale]] nobody wrote down, one more cost of [[Technical debt]] - **Competitive analysis and research**: how a product or a model works from the outside. Archer Hume, for example, inferred the likely architecture of [[Jev]] from about 10,000 API calls - **Preservation**: keeping old games and software running after the vendor is gone ## Legal context (briefly) The rules depend on the country, the contract and the purpose. A few reference points: - **EU**: the Computer Programs Directive (2009/24/EC, replacing a 1991 directive) allows decompilation by a lawful user when it is indispensable to obtain the information needed for interoperability with an independently created program (Article 6) - **US**: section 1201(f) of the DMCA lets a person who lawfully obtained the right to use a program circumvent a protection measure for the sole purpose of achieving interoperability. Every three years, the Librarian of Congress can grant further exemptions to the anti-circumvention rule - **Case law**: in *Sega v. Accolade* (9th Cir., 1992), disassembling Sega Genesis games to learn how to make compatible cartridges was held to be fair use - **Contracts**: many licence agreements forbid reverse engineering, and in the US such terms can override what copyright law would otherwise allow **Clean-room design** is the classic way to reimplement something without copying it. One team studies the original and writes a specification; a lawyer checks it contains no copyrighted material; a second team that never saw the original implements it. Compaq and Columbia Data Products built IBM-compatible PC BIOSes this way, and Phoenix Technologies started licensing its clean-room BIOS in July 1984, which helped the PC clone market grow. Clean-room design protects against copyright claims, not patents. ## Tools - **Disassemblers and decompilers**: [[Ghidra]] (NSA, open source), IDA Pro (Hex-Rays), Binary Ninja (Vector 35), radare2 and Cutter (a GUI on top of Rizin, a radare2 fork) - **Debuggers**: x64dbg on Windows, GDB and LLDB elsewhere - **Network analysis**: Wireshark for capturing and dissecting protocols - **AI assistance**: MCP servers now let [[AI Agents]] drive these tools. [[REA (Reverse Engineer Anything)]] wraps Ghidra, IDA or Hopper and adds analyzers for Electron apps, APKs and websites. The output still needs checking; REA keeps the evidence behind each claim so a human can verify it ## References - Elliot J. Chikofsky and James H. Cross II, "Reverse Engineering and Design Recovery: A Taxonomy", IEEE Software 7(1), 1990 - Wikipedia, Reverse engineering: https://en.wikipedia.org/wiki/Reverse_engineering - Wikipedia, Clean-room design: https://en.wikipedia.org/wiki/Clean-room_design - Wikipedia, Sega v. Accolade: https://en.wikipedia.org/wiki/Sega_v._Accolade - Directive 2009/24/EC on the legal protection of computer programs: https://eur-lex.europa.eu/eli/dir/2009/24/oj - 17 U.S. Code § 1201 (DMCA anti-circumvention, including (f) Reverse engineering): https://www.law.cornell.edu/uscode/text/17/1201 - Ghidra: https://github.com/NationalSecurityAgency/ghidra - Cutter: https://github.com/rizinorg/cutter - Wikipedia, Interactive Disassembler (IDA): https://en.wikipedia.org/wiki/Interactive_Disassembler - Wikipedia, Binary Ninja: https://en.wikipedia.org/wiki/Binary_Ninja ## Related - [[Ghidra]] - [[REA (Reverse Engineer Anything)]] - [[Open Source]] - [[Design Rationale]] - [[Technical debt]] - [[OpenRGB]] - [[Mouser]] - [[Site Reliability Engineering (SRE)]] - [[IT Security (MoC)]]