Reverse engineering is the analysis of software or hardware to understand how it works without access to its source code or design documents.
How reverse engineering works
Analysts usually combine two approaches:
- Static analysis – examining a binary without running it. Disassemblers and decompilers such as IDA Pro, Ghidra (released as open source by the NSA in 2019) and Binary Ninja turn machine code back into readable assembly or pseudo-C.
- Dynamic analysis – running the program under a debugger (x64dbg, WinDbg, GDB) or in an instrumented environment and watching memory, API calls and network traffic.
Hardware reverse engineering adds tools such as logic analysers and firmware extraction from flash chips.
Why reverse engineering matters for security
- Malware analysis – researchers take malware apart to understand its capabilities, extract indicators and write detections. Malware authors fight back with obfuscation, packers and anti-debugging tricks.
- Vulnerability research – finding bugs in closed-source products, often rewarded through bug bounty programs.
- Patch diffing – comparing a program before and after a security update reveals the fixed flaw. Attackers use the same technique to build an exploit for unpatched systems within days, which is why fast patching matters.
- Interoperability and auditing – checking what a device or app really does with user data.
Legal and ethical aspects
Reverse engineering for security research and interoperability is permitted in many jurisdictions, but licence agreements and copyright laws (such as the US DMCA) set limits. Researchers usually follow coordinated disclosure when they find vulnerabilities.
Synonyms:
software reverse engineering
