- Reverse engineering is the methodology
for acquiring architectural information
about anything originally created by someone else.
Reverse engineering has been around
since long before computers or modern technology.
So nowadays, reverse engineering is not only used
to steal or counterfeit technology
and reverse cryptographic algorithms,
but it's also used to perform malware analysis
and cybersecurity forensics by the good guys as well, right?
So reverse engineering can even be useful
to software developers to discover how to interpret
with you know, undocumented or partially documented software
or even to develop computing software, right?
So which in some cases actually may be illegal, right?
So the use of reverse engineering is to actually
steal somebody else's intellectual property.
It's definitely, definitely illegal.
Reverse engineering can be used for exploit development
to locate vulnerabilities in a system
and then compromise such system.
But it's also used to reverse engineer malware, right?
To see how malware actually is behaving, right?
So security researchers and forensics experts
can actually trace every step that malware takes
and assess the damage that actually it could cause, right?
The expected rate of infection as well is another thing
that they actually measure and how it could be removed
from the infected systems, right?
Reverse engineering also help how, you know,
finding out how to potentially proactively
defend against, you know such a malware
and such threats, right?
So malware analysis extends to identifying
that the malware is present on a given system
and studying the malware to understand how it functions.
Doing that can reveal the purpose of the malware
and even the author of the malware, in some cases, right?
So because in some, you know, scenarios
you can determine, you know, if a specific technique
is actually being used, whether it's actually an amateur
or perhaps, you know, a more sophisticated developer
and, you know, in some cases, you know,
folks with a lot of resources, like in the case of, you know
fairly large crime organizations
and also nation states, right?
So there are two additional uses
for reverse engineering, right?
One is to reverse cryptographic algorithms
and that's actually used to decrypt data.
And the second one is to reverse DRM, right?
Or Digital Rights Management solutions.
And that's where the threat actors
use DRM reverse engineering techniques
to steal things like music, movies, books,
and any other contents actually protected by DRM solutions.
Now, there are many tools available
to perform reverse engineering, right?
So I'm including a few here.
The first example is system-monitoring tools
which are tools that actually sniff, monitor, explore
and otherwise actually expose
the program being reversed, right?
The next ones are actually disassemblers, right?
So these are tools that take a program's executable binary
as input, and then generate textual files
that contain the assembly language code
for the entire programs or parts of the program, right?
So then we also have debuggers, right?
And debuggers allow reverse engineers
to observe the program while it's actually running, right?
And they're actually able to set what we call break points.
And then, you know,
that allows them to have the ability to trace, you know
throughout the code to actually, you know,
use these debuggers to step through the disassembled code
and watch the system as it runs in the, you know,
as it runs actually the program
one instruction at a time, right?
And then we also have decomcompilers, right?
So programs actually that take an executable binary file
and then attempts to produce readable
high-level language code from, you know, those executables.