What is Reverse Engineering?
Reverse engineering is the process of taking a computer program (a function, module, library, etc.) that has already been compiled into an object code form and analyzing or decompiling it to get the source code that was used to generate the object code. Reverse engineering is necessary when one desires to understand how a particular piece of software works. Reverse engineering is governed by the law of one piece of software for all purposes.
Why is Reverse Engineering Necessary?
The reason that one may need to reverse engineer a computer program is usually because the author of the program has hidden useful features, or there are bugs in the code, or one needs to work on software with older versions for which no source code exists. This section will provide an introduction to reverse engineering so that by the conclusion of this section you will be able to answer questions like “what is reverse engineering”, “why do people reverse engineer”, and “how do I know if my favorite game uses reverse engineering”.
Examples of software programs reverse engineered?
Programs whose source codes have been released as open-source software include:
Python C/C++/Java Python for Windows CE Python for Blackberry 10 .Net Framework Apache HTTPd Bash Linux kernel. The Nametags mod for Minecraft is an example of a mod that has been reverse-engineered. The Internet Archive’s MAME project was formed to support the reverse engineering of arcade video games, particularly those no longer protected by copyright. OpenSSH servers and clients have also been reverse-engineered in this manner.
Types of reverse engineering?
Each method of reverse engineering software may use one or more methods below to achieve its task.
- The first type of reverse engineering often uses tools that are external to the system, such as debuggers and binary editors. This allows observation of each step in the execution process and gives insights into what the program does internally at each step, but limits analysis to the final product without changing it. The first type is known as binary level reverse engineering.
- The second type of reverse engineering is to alter the machine code of a program to observe the internal data structures and how they operate. This method is known as assembly language level reverse engineering. The second type is binary-to-source reverse engineering.
- The third type of reverse engineering takes advantage of features in a program’s source code, such as symbols, opcodes, and debugging information, to gain further insights into its operation after compiling it with debug information installed. This process is known as source-level reverse engineering. Most programmers reverse engineer software using this method if they do not have access to the source code or if it does not contain any bugs which need fixing. The third type is known as the source to source reverse engineering.
- The fourth type of reverse engineering takes advantage of the fact that most programming languages are Turing complete. This means that you can execute any program on a virtual machine (such as the Java Virtual Machine) and get an output equal to the original program. Doing this for different versions of the same program will allow you to see how it evolved by comparing outputs. This process is known as execution tracing or just execution timing analysis, and may also be accomplished via decompilation. The fourth type is known as execution trace reverse engineering or just trace level reverse engineering.
- The fifth type is known as source-independent reverse engineering or just flat reverse engineering. In this case, the reverse engineer does not alter the source code of the program in any way, but simply observes it. The fifth type is known as flat-level reverse engineering.
- The sixth type is known as binary-to-binary reverse engineering. This process consists of transforming one binary format into another using a bytecode decompiler or any other assembly language to produce the instruction set architecture (ISA) for the new target system. The sixth type is known as byte-code to byte-code reverse engineering.
- The seventh type of reverse engineering is known as static analysis. This process allows looking at the compiled object code (called assembler) without actually executing it. A static analyzer can detect bugs in the program, determine which sections of code are not used, and find ways to optimize the program’s performance by reorganizing the structure of its internal data. The seventh type is known as static level reverse engineering or just static reverse engineering (SRE).
- The eighth method is known as dynamic analysis. This method allows an outsider to observe the interaction of a program’s components and is usually done without executing the program. The eighth type is known as dynamic level reverse engineering (DLE).
- The ninth type of reverse engineering is known as virtual machine-level reverse engineering. This is less well understood, and it may be used in the context of any one of the other types since it can depend on any one or more of them.
Why do people reverse engineer software?
As an application developer, you may wish to use a free tool to analyze your code development process and make changes to improve efficiency and reduce debugging time. You may also wish to analyze some other software that you find useful, some of which are proprietary. You might then wish to modify that software so that it functions better for your applications.
Some people might reverse engineer software because they are curious about how things work, or simply enjoy it as a hobby. Many hackers use reverse engineering as one of the first methods of obtaining knowledge on how their favorite programming languages work or on how they work. The Internet provides many resources for learning more about the inner workings of various programs and devices, and some people may take advantage of this information to solve computer problems more easily. Reverse engineering is often used in acts of hacking. For example, one may need to understand how a common piece of software works to “crack” it, or how to gain access to an internet server or network by taking advantage of errors in the server’s software.