Reverse engineering - what is it and is it legal? (2024)

Reverse engineering - what is it and is it legal?

2024-01-11

Reverse engineering, also known as back engineering, is the process of analyzing or deconstructing an existing product, system or software in order to understand its operation, structure or the design on which it is based. The main goal of such engineering is to gain knowledge about how a given product or technology was made, and often also about the principle on which its operation is based. This often occurs in situations where sources of information about these subjects are difficult to access or unavailable, as is the case for many innovative products. The goal is also to estimate the cost incurred to produce a given product.

Where is reverse engineering applied?
Advantages of reverse engineering
Reverse engineering and law
Practical applications of reverse engineering
Security through reverse engineering

It should be kept in mind that reverse engineering has specific ethical aspects, particularly if it is used to analyze software or systems without their owner’s consent (and situations like this are all too frequent). In many countries’ jurisdictions, unauthorized reverse engineering may breach copyrights or intellectual property rights, which is why its application raises many concerns or even objections of other countries. A rather widely known example here is the People’s Republic of China, where copyrights are treated with a high degree of disregard, which has applied reverse engineering and continues to do so, although on a slightly smaller scale, to construct counterparts to studied products originating from USA or Europe. But we will write more broadly about this a bit further on.

Reverse engineering finds applications in a multitude of diverse fields. Nevertheless, several domains where its presence is particularly perceptible can be indicated:

Software: as part of reverse engineering, programmers analyze existing applications or systems in order to understand how the whole software or individual algorithms work. Such analysis proves to be useful in fixing bugs, updating software or creating new solutions compliant with existing ones.
Electronics: reverse engineering is based on analysis of circuits in order to reproduce their schematics and principle of operation, and of course, this includes identifying components and electronic systems. The effects of such work may be useful in repairs, improvements, or when designing other, similar devices.
Mechanical engineering and technology: in this field, engineers reverse the process of creating physical products in order to better understand their structure, operation and production processes. This is sometimes helpful in improving designs, “borrowing” solutions or surmounting technical problems.
Information security: in this field, reverse engineering can be applied to analyze software in search of vulnerabilities, threats or malware. This helps experts to secure systems against attacks and to identify gaps in their security.
Competing products: companies dealing with production regularly use reverse engineering to analyze competing products, in order to understand their features, design or technology. This often helps them to adapt their own products or services to market requirements.

As an interesting fact, reverse engineering can also be applied in intelligence operations conducted by the intelligence agencies of most developed countries. Militaries of both eastern- and western-bloc countries regularly applied reverse engineering during the Cold War, particularly the former Soviet Union, which meticulously copied every American device or machine (aircraft, vehicles, weapons) if it fell into the hands of Soviet intelligence.

Possibilities afforded by reverse engineering

Reverse engineering offers many different possibilities and applications in various fields. The primary and fundamental capability it provides is a thorough understanding of the operation of existing products, systems or software. Even if this is analysis of competing technologies, in consequence, this leads to – or at least, should lead to - optimal utilization of existing solutions. Analysis based on reverse engineering can also help with identifying potential areas for improvement. The knowledge acquired may serve for developing new product versions or expanding their functionalities – the “so-called “upgrading” is very often the effect of precisely such analysis. Reverse engineering is also extremely useful in the process of diagnosing and repairing malfunctions in mechanical, electronic or software systems. It makes it possible to identify the sources of problems and introduce the required fixes. Meanwhile, in the field of information security, reverse engineering enables, among other things, analysis of malware, which leads to the development of effective means of protection against cyberattacks. Reverse engineering can also help with migration or adaptation of software to new environments or platforms. It offers the possibility of understanding the dependencies and structure of code, facilitating its transfer to new systems.

Is reverse engineering legal?

The answer to the question posed in this way is not unambiguous, as the law concerning reverse engineering differs significantly depending on the jurisdiction and context. In certain cases (countries), reverse engineering can be legal and serve as an important tool for research, development and innovation. In other cases, it can infringe on copyrights, intellectual property or license agreements. In the European Union, reverse engineering is permitted – under the verdict of the Court of Justice issued in 2012 – for creating computer programs with operation analogous to the original program. In that verdict, the Court of Justice ruled that the functionality of software is not protected by copyrights within the territory of the EU, which opened the door to research and testing of original programs so as to reproduce (not copy) their behavior in another program. Unfortunately, there isn’t enough space here to analyze this issue more in-depth in the context of individual legal systems of the most developed economies of the world, which is why only several of its most important aspects are discussed in the points below.

Owner’s consent: Reverse engineering is usually legal if it is performed on products, systems or software to which the person or company conducting analysis has the legal right to access (purchased it) or the owner’s consent. This means that if, for example, some natural person or company buys given software and wishes to understand how it works, they may have the right to conduct reverse engineering for educational (training) or personal purposes. However, in the case of such engineering for further commercial purposes, the right of access arising from legal purchase of the product is insufficient as a rule – the consent of the creator or owner of rights is required.
Contractual restrictions: Many license agreements may contain a clause which prohibits or restricts reverse engineering in specific countries. In such cases, a breach of contract may lead to legal consequences. One exception, however, may be consent issued on an individual basis by the creator of or owner of rights to the product.
Protection of intellectual property: Reverse engineering may infringe upon copyrights or other intellectual property rights if it is used to copy, reproduce or distribute protected material without the owner’s consent. Many legal systems consider such cases as a crime (e.g. piracy).
Research purposes: In certain jurisdictions, reverse engineering may be legal if it is conducted for scientific, research, critical or educational purposes (EU). In such cases, an exception from the restrictions of copyright laws may exist. This is typically defined in the license agreement itself, but sometimes, legal regulations in a given jurisdiction also define such exceptions in a top-down manner, meaning that potential license restrictions are not binding in that jurisdiction.
Information security: In certain cases, reverse engineering may be used for purposes related to information security, such as analysis of malware or identification of vulnerabilities. Many jurisdictions have laws regulating such activities, and this is becoming an increasingly common situation.

As can be seen, the issue of the legality of reverse engineering may be rather complicated. In modern democracies, it is best to abide by the laws binding within the given country and respect intellectual property rights, while accounting for the provisions of license agreements. If laws and contractual provisions are mutually contradictory, and justified doubts as to the legality of reverse engineering arise in a given case, it is always worth consulting a lawyer or expert in the given field, who has been operating in the given legal system for long enough to have the appropriate experience.

Examples of reverse engineering

The list of examples where reverse engineering is used is long, however there is a certain catalog of the most common cases where it is applied, the essence of which is presented in the points below.

Analysis of malware: Cybersecurity researchers can reverse engineer malware in order to understand how it works, identify vulnerabilities and develop tools to protect against attacks.
Recovery of source code: In the case of loss of access to the source code of a program or application, reverse engineering can help to reconstruct the code in part or entirety, making it easier to continue work on the project.
Updating of legacy software: Reverse engineering can be applied for analysis of older applications or systems for the purpose of introducing the required updates, adjusting them to new platforms, communication/control methods or fixing bugs.
Competition research: Enterprises may conduct reverse engineering of competing products in order to understand their features, functions or production processes. This may help in adapting the given enterprise’s own products to market requirements and expectations.
Analysis of communication protocols: Reverse engineering can be used to understand and analyze communication protocols used in IT systems or electronic devices.
Hardware reconstruction: Reverse engineering may help in understanding the structure and functions of complicated electronic or mechanical equipment, which may facilitate the process of repairs and modifications.
Compliance with regulations: Companies may perform (order) reverse engineering to make sure that their (or competing!) products or systems are compliant with binding regulations and standards.
Creating emulations or virtualizations: Reverse engineering can be used to create emulations or virtual environments, which is useful when testing software on different platforms.
Scientific research: In technical sciences, reverse engineering can be used to research new technologies, analyze the properties of materials, or explore scientific problems in the most general terms.

What can counteract reverse engineering?

There are various methods of counteracting reverse engineering, particularly when it comes to software or systems that one wishes to secure against analysis by unauthorized parties. Manufacturers use many solutions and strategies, including those listed below.

Optimizing compilers - during compilation of source code, one may use optimizing compilers that change the structure of the code to make it more difficult to understand.
Code obfuscation - obfuscation is a technique involving modification of source code to make it more difficult to understand while simultaneously maintaining unchanged functionality. Similarly as in the previous point, this may make work difficult for people attempting to perform reverse engineering.
Anti-debugging mechanisms - to counteract reverse engineering, one may introduce mechanisms detecting debugging attempts and disabling start-up into the code. They make analysis with the use of debugging tools difficult, and hence also reverse engineering.
Encryption - encrypting critical fragments of source code or data may significantly impede reverse engineering. However, at the same time, encryption may also introduce additional complexity in the software’s (application’s) implementation and performance, so this solution requires certain compromises to be made.
Distribution of functions on server - in many cases, certain functions of software can be situated “externally”, i.e. on a server, while the client only uses the interface. This makes it much more difficult to learn the entire logic of an application’s operation and conduct effective reverse engineering.
Hardware-based security - in certain cases, security components are built into the hardware as additional and specialized security systems or modules. They can effectively help to protect against reverse engineering.

It is worth noting, however, that none of the above strategies is absolutely fail-safe, and the level of difficulty of reverse engineering may vary substantially depending on the complexity of the software, system or product. Many manufacturers are aware that an excessive amount of safeguards may adversely impact the performance and usefulness of their product, which is why they don't apply them, accepting the elevated risk of effective reverse engineering on their products.