WHAT IS REVERSE ENGINEERING?

Reverse engineering, sometimes called back engineering, is a process in which software, machines, aircraft, architectural structures and other products are deconstructed to extract design information from them. Often, reverse engineering involves deconstructing individual components of larger products. The reverse engineering process enables you to determine how a part was designed so that you can recreate it. Companies often use this approach when purchasing a replacement part from an original equipment manufacturer (OEM) is not an option.

The reverse engineering process is named as such because it involves working backward through the original design process. However, you often have limited knowledge about the engineering methods that went into creating the product. Therefore, the challenge is to gain a working knowledge of the original design by disassembling the product piece-by-piece or layer-by-layer.

Companies often use reverse engineering on old electronic components, such as discontinued printed circuit boards (PCBs) and connecting cards. Frequently, the products in question will come from manufacturers that have since gone out of business. If the manufacturer is still in business, they might no longer offer the part. The firms often reverse engineer old electronics for the sake of continuity.

If an old piece of computer equipment had functions that have since been lost amid the subsequent changes in technology, reverse engineering allows manufacturers to rediscover these formulas and bring them up to date. Reverse engineering also enables you to develop components that bridge the new and the old, allowing users of older equipment to connect their devices to modern computing equipment.

In some cases, the only way to obtain the design of an original product is through reverse engineering. With some older products that have not been manufactured for 20 years or more, the original 2D drawings are no longer available. Often, there will be no way to contact the original manufacturer, as the company may no longer be in business.

Companies sometimes use reverse engineering to regain design data on their own long-discontinued products. For example, a small company that has been in businesses for more than 40 years may have manufactured numerous products before the days of computer-aided design and digital file storage. Consequently, these older products may be based on long-lost paper blueprints. Through reverse engineering, companies can regain their lost designs and create archives of their product legacy.

Even if the company still has their paper blueprints, they may want to create a digital version of them to make the plans easier to access and use. The business could use certain reverse engineering techniques to create this digital design file.

Among auto restoration specialists, reverse engineering is sometimes employed to recreate the designs of engines and auto body parts for older vehicles. Using reverse engineering to rebuild engines or recreate hard-to-find parts can make cars from the 1920s through the 1950s drivable again. Thanks to reverse engineering, you could bring a classic vehicle back to life and make it fully functional without changing the design of the car’s systems.

Reverse engineering requires a series of steps to gather precise information on a product’s dimensions. Once collected, you can store the data in digital archives. Often, engineers will enhance the design with new developments and innovations. Sometimes, they will replicate the original model exactly.

Reverse engineering is a process or method through the application of which one attempts to understand through deductive reasoning how a device, process, system, or piece of software accomplishes a task with very little insight into exactly how it does so

What is the purpose of reverse-engineering?

The purpose of reverse-engineering is to find out how an object or system works. There are a variety of reasons to do this. Reverse-engineering can be used to learn how something works and to recreate the object or to create a similar object with added enhancements.

Often the goal of reverse-engineering software or hardware is to find a way to create a similar product more inexpensively or because the original product is no longer available. Reverse-engineering in information technology is also used to address compatibility issues and make the hardware or software work with other hardware, software or operating systems that it wasn’t originally compatible with.

Apple’s Logic Pro software, which lets musicians compose, record, arrange, edit and mix music, is a good example. Logic Pro is only available for Mac devices, and it is relatively expensive. The program has several proprietary digital instruments. With a bit of investigation, a programmer could reverse-engineer those digital instruments, figure out how they work and customize them for use in Logic Pro or to make them interoperable with other music software that is compatible with Windows.

How does the reverse-engineering process work?

The reverse-engineering process is specific to the object on which its being performed. However, no matter the context, there are three general steps common to all reverse-engineering efforts. They include:

• Information extraction. The object being reverse-engineered is studied, information about its design is extracted and that information is examined to determine how the pieces fit together. In software reverse-engineering, this might require gathering source code and related design documents for study. It may also involve the use of tools, such as a disassembler to break apart the program into its constituent parts.
• Modeling. The collected information is abstracted into a conceptual model, with each piece of the model explaining its function in the overall structure. The purpose of this step is to take information specific to the original and abstract it into a general model that can be used to guide the design of new objects or systems. In software reverse-engineering this might take the form of a data flow diagram or a structure chart.
• Review. This involves reviewing the model and testing it in various scenarios to ensure it is a realistic abstraction of the original object or system. In software engineering this might take the form of softwae testing Once it is tested, the model can be implemented to reengineer the original object.

Software reverse-engineering involves the use of several tools. One tool is a hexadecimal dumper, which prints or displays the binary numbers of a program in hexadecimal. By knowing the bit patterns that represent the processor instructions as well as the instruction lengths, the reverse-engineer can identify portions of a program to see how they work.

Another software reverse-engineering tool is the disassembler. It reads the binary code and displays each executable instruction as text. A disassembler cannot tell the difference between an executable instruction and the data the program uses, so a debugger is used to prevent the disassembler from disassembling the data portions of a program. These tools might be used by a computer cracker and gain entry to a computer system or cause other harm.

Computer-aided design (CAD) is a reverse-engineering technique used to recreate a manufactured part when the original blueprint is no longer available. It involves producing 3D images of the part so it can be remanufactured. A coordinate measuring machine measures the part, and as it is measured, a 3D wire frame image is generated using CAD software and displayed on a monitor. After the measuring is complete, the wire frame image is dimensioned. Any part can be reverse-engineered using these methods.

REVERSE ENGINEERING TYPES

Reverse engineering (RE) can cover objects from as large as aircraft down to the smallest microchip, and the motivations have varied from the paranoia of the Cold War, through commercial piracy, to competitive intelligence, product verification, and courts of patent law. If we look back over the last few decades, reverse engineers around the world had a significant influence on the dissemination of technology. In the semiconductor industry, it provides complete process and materials characterization which include partial or whole die imaging, pattern recognition and extraction, circuit functionality, modeling, and creation of 3D renditions of specific circuits or the entire device. Reverse engineering broadly take several forms. Identify the four types of Reverse Engineering (RE) in semiconductor-based products and briefly explain each.

1. Product teardowns

This is the simplest type of RE in the electronics arena. The unit is simply disassembled, the boards and sub-assemblies are photographed, and the components are inventoried. Reverse engineers are only interested in what components are in the device at this level.

2. System Level Analysis

It analyzes the operations, functions, timing, signal paths, and interconnections of each electronic module. All components on the board are catalogued and then selectively removed. If the board is multi-layered, it can be delayered and imaged. The connections between all components are then identified and entered into the board schematic. Test cases are developed, and stimulus are created for operating the system in its functional modes. Signal generators, logic analyzers, and oscilloscopes are used to drive the system and collect the results. The signals and full system are then analyzed.

3. Process analysis

Process analysis of chips is straightforward in theory, since microanalytical tools have been around for some time. When performing process analysis, plan-view imaging gives limited process information, so the primary source of data is cross-sectional analysis, usually using SEM, TEM, and scanning capacitance microscopy (SCM). For details of the chemical composition, the most commonly used technique is energy dispersive x-ray analysis, although occasionally we use other methods such as secondary ion mass spectrometry or Auger analysis.

4. Circuit extraction

This process delayers the semiconductor component to a transistor level, then extract interconnections and components to create the schematics and equivalent netlists.

REVERSE ENGINEERING IN CYBER SECURITY

The detailed examination of a software product or web application to detect vulnerabilities or hidden features. Reverse engineering is the process of studying a finished program using special methods. Reverse engineering covers a broad range of areas, including decompiling and disassembling of executable files and libraries, and analysis of system data.

In the field of computer security, reverse engineering is used to study malware activity and create tools to neutralize it.

What is reverse engineering in cybersecurity?

The process of taking a piece of software or hardware and analyzing its functions and information flow so that its functionality and behavior can be understood. Malware is commonly reverse-engineered in cyber defense.

What is reverse engineering in malware analysis?

Reverse engineering malware involves disassembling (and sometimes decompiling) a software program. Through this process, binary instructions are converted to code mnemonics (or higher level constructs) so that engineers can look at what the program does and what systems it impacts.

REVERSE ENGINEERING PROCESSES

In order to reverse malware code, engineers will often use many tools. Below a small selection of the most important ones:

• Disassemblers (e.g. IDA Pro). A disassembler will take apart an application to produce assembly code. Decompilers also are available for converting binary code into native code, although they’re not available for all architectures.
• Debuggers (e.g. x64dbg, Windbg, GDB). Reversers use debuggers to manipulate the execution of a program in order to gain insights into what it is doing when it is running. They also let the engineer control certain aspects of the program while it is running, such as areas of the program’s memory. This allows for more insight into what the program is doing and how it is impacting a system or network.
• PE Viewers (e.g. CFF Explorer, PE Explorer). PE (for Windows Portable Executable file format) viewers extract important information from executables to provide dependency viewing for example.
• Network Analyzers (e.g. Wireshark). Network analyzers tell an engineer how a program is interacting with other machines, including what connections the program is making and what data it is attempting to send
• .

ADVANTAGES OF REVERSE ENGINEERING

Most people in the cybersecurity world picture reverse engineering in its black hat — when it is being used to steal data and intellectual property. But when it is in the hands of cybersecurity experts, reverse engineering dons the white hat of the hero.

Broadly speaking, reverse engineering is about looking at a program from the outside in — often by a third party that had no hand in writing the original code. It allows those who practice it to understand how a given program or system works when no source code is available. With reverse engineering, your team can accomplish several tasks related to cybersecurity: finding system vulnerabilities, researching malware and viruses, and analyzing the complexity of restoring core software algorithms that can further protect against theft.

Security experts can apply reverse engineering themselves to understand how hard it is to hack certain software. If it turns out to be a breeze, experts can provide recommendations on ways to complicate matters for a potential hacker. This technique can be especially useful for security software developers who work in a wide range of data formats and protocols, conduct lots of research for client issues, and ensure code’s compatibility with third-party software.

No doubt, reverse engineering is a powerful tool to keep in your cybersecurity tool belt, and the more familiar you are with its use cases, the better you will be able to deploy it.

The Challenge with Reverse Engineering Today

As malicious programs become more complex, it becomes increasingly likely that the disassembler fails somehow, or the decompiler produces obfuscated code. So, reversers need more time to understand the disassembled or decompiled code. And this is time during which the malware may be wreaking havoc on a network. Because of this, there has been an increasing focus on dynamic malware analysis. Dynamic malware analysis relies on a closed system (known as a sandbox), to launch the malicious program in a secure environment and simply watch to see what it does.

There are a lot of benefits to using a sandbox for dynamic analysis, but some downsides as well. For example, many of the more sophisticated malicious programs use evasion techniques to detect that they are in a sandbox.

When a sandbox is detected, the malware will refrain from demonstrating its true malicious nature. Advanced malware programs have a suite of tools they use to outsmart sandboxes and evade detection: they can delay their malicious activities, only act when a user is active, hide malicious code in areas where it will not be detected, along with a variety of other evasion techniques.

This means that reverse engineers cannot rely solely on dynamic techniques. At the same time, reverse engineering every new malware threat is unrealistic.

Drop your comment.