In this blog post, we’ll explore the meaning and characteristics of reverse engineering—a field within computer science—the basic knowledge needed to understand it, and how it’s applied in various fields such as hacking and security.
What is reverse engineering?
You’ve probably seen recent news stories about the Nonghyup (National Agricultural Cooperative Federation) being hacked, NateOn being hacked, or personal information being leaked. While reading such news, you might feel concerned about the risk of personal information leaks, but at the same time, you might have thought, “Well, as long as it doesn’t violate the law, I’d like to try something like that at least once.” This is because it seems like you could obtain the information you want without much effort. So, in this article, I’d like to explain a field directly related to that.
Living in modern society, almost everyone has used the internet at least once—in fact, there are probably very few people who haven’t used it at all in their lives. It may go without saying, but the internet has become an indispensable part of modern life. With so many people using the internet, various access permissions and management systems have become necessary, and consequently, the importance of security—as it is commonly referred to—has grown significantly. In other words, it’s about preventing anyone from stealing personal information or other data, or from accessing it without authorization. And in the process of circumventing or attacking these security measures, the concepts of “hacking” and “cracking” emerged. Although hacking and cracking differ in their specific meanings and purposes, they share the commonality of being related to techniques for accessing, analyzing, or modifying computer systems and information. Thus, in modern society, security, hacking, and cracking are closely intertwined with the internet. In this environment, reverse engineering is the technology that plays a crucial role in analyzing and understanding the internal structure and operating principles of systems and programs.
First, let’s explain what the field of reverse engineering is. Simply put, it is the technology of analyzing existing systems or products to identify their structure, operating principles, and design information. That is why it is called “reverse engineering” in Korean. In fact, even with this simple explanation, it may be difficult to fully understand because it’s hard to grasp exactly what information is being analyzed, where, and how. So, to explain it in more detail, it involves analyzing various data and operational processes within an existing system to infer the original design or implementation method, and based on this, understanding the system’s structure and functions.
Here, the term “system” refers to a “collection of necessary functions”; it covers a very broad range, from various basic programs to operating systems (OS), and includes the programs we commonly use. The functions of these programs are processed as machine-language instructions that a computer can execute. Typically, when we design and develop such programs, we use programming languages. A programming language, as the name suggests, is a language created for writing programs; languages like C and Java—which you’ve likely heard of at least once—are examples of programming languages. The source code written in this way is converted into a form executable by a computer through tools like compilers. Programs created in this way make up various components of different systems or, like an operating system, constitute the system itself.
The problem is that when we run these programs, we cannot directly view their internal source code. Even if we examine the execution information within the program, it is often difficult to understand what it means, so we usually end up simply using the program without delving deeper. Reverse engineering plays a crucial role precisely in this area. Specifically, one of the core tasks of reverse engineering is to analyze information such as machine code and assembly language that appears during program execution, and based on that information, to identify the program’s structure and operating principles or to infer a form that closely resembles the original source code. However, reverse engineering does not always mean fully restoring the entire original source code as it existed before compilation. In practice, it often involves inferring parts of the original code’s structure or functionality, or analyzing how a program operates. While these techniques are primarily related to computers, they are widely used in various fields, including software analysis, security research, ensuring compatibility, and error analysis.
What knowledge is required for reverse engineering?
Some people attempt reverse engineering simply because they’ve learned a programming language, without fully understanding what it entails. However, it is difficult to perform reverse engineering based solely on knowledge of a programming language. While there are many types of knowledge required for reverse engineering, I will introduce four key areas.
First, knowledge of assembly language. Assembly language is a low-level programming language that closely corresponds to the machine language instructions of a specific processor; you can think of it as being expressed in a way that is much easier for humans to understand than machine language. Of course, while it is easier than machine code, it is by no means simple when you actually look at it. The reason you need to know this language is that, as I will explain later, a disassembler program displays instructions expressed in machine code in a human-readable assembly language format. Therefore, assembly language can be considered one of the core areas of knowledge that is essential for performing reverse engineering. While you don’t need to master every detail of the syntax, you do need to understand the basic instructions, registers, and memory access methods related to the processor you intend to analyze.
Second, knowledge of programming languages. As explained earlier, this is because, in order to analyze a program’s behavior and infer its original programming structure, you must be able to understand how the program was written. You must understand not only the concept of simple functions but also the various functions and APIs (Application Programming Interfaces) used in the interaction between the operating system and the program. In particular, since an API is the interface a program uses to access the functions of the operating system or other software, understanding it helps you determine how the program under analysis connects to external functions.
Third, a general understanding of computer architecture is essential. While many people may wonder what this has to do with anything, to understand machine code and assembly language, one must also be familiar with the architecture of the computer on which those instructions are executed. Understanding the relationship between the CPU and memory is particularly important. This understanding is necessary to grasp the process by which a program processes instructions, stores data in memory, and retrieves it, as well as to visualize the program’s overall structure. However, a deep understanding of the computer’s overall architecture is only necessary when performing advanced reverse engineering; when analyzing simple programs, there is no need to study these topics in depth from the very beginning. Therefore, rather than trying to cover an overwhelming amount of material right away, it is better to acquire at least a basic understanding of the CPU, memory, registers, and the instruction execution process.
Fourth, perseverance and hands-on experience. It may sound funny, but reverse engineering isn’t something you can master just by knowing the theory; it requires a great deal of hands-on experience, so you must practice consistently to truly master it. And it’s difficult to gain that hands-on experience without perseverance. Furthermore, as you’ll see upon analysis, code that could be written in a single line in a programming language is expanded into multiple lines of instructions when viewed in assembly language, so perseverance is definitely needed to cope with that complexity.
What tools are available to assist with reverse engineering?
Most of the processes described above can actually be analyzed manually. Of course, as this explanation implies, there are limits to manual analysis, simply because the volume of code and instructions to be analyzed is overwhelming.
If done entirely by hand, one would have to interpret machine code into assembly language line by line; even if that were possible, the task would be extremely arduous because a single line of programming language code can correspond to multiple lines of assembly language instructions. Moreover, if the original program contains hundreds or more lines of code, it is very difficult to analyze the entire contents using human effort alone. That is why various programs exist to assist with reverse engineering. The most representative examples are debuggers and disassemblers.
First is the debugger. A debugger is a program used to track a program’s execution process and find errors; since it executes the target program’s instructions step by step while displaying detailed information at each stage, it is closely related to reverse engineering. In other words, because they allow you to observe the program’s execution process and internal state, they help you understand how the program works. Additionally, since you can execute the program by following its internal instructions, you can verify how data changes at specific points or analyze information that appears during execution. For this reason, debuggers are extremely important tools in reverse engineering. Representative debuggers include OllyDbg and WinDbg.
Second is the disassembler. This tool is related to more fundamental functions; it converts a program’s instructions, which are expressed in machine code, into assembly language and displays them. While this may seem like the simplest function, it is actually very important, as it is used to analyze a program’s executable file and understand its internal instruction structure. Since program developers sometimes apply various protection techniques rather than simply releasing the program as source code, it may be necessary to use a disassembler to analyze the internal instructions of the program. Although debuggers and disassemblers serve different roles, using them together allows you to examine both the static structure of the program and its actual execution process, which aids in analysis. Thanks to these capabilities, it can be easier to understand a program’s structure than when using a debugger alone; in some cases, static analysis using a disassembler alone can reveal a significant portion of the program. Therefore, a disassembler is also an indispensable tool for performing reverse engineering. IDA is a representative example of a disassembler and binary analysis tool.
Where is reverse engineering used?
While the previous section provided a general overview of how reverse engineering is performed, this section will explain its effects and implications. As mentioned at the very beginning, reverse engineering is closely related to the field of computer security, including hacking and security. This is only natural, since both hacking and security involve accessing and protecting information and systems, and reverse engineering is a technique for analyzing the internal structure and operational principles of programs and systems.
If you learn reverse engineering, you can analyze programs to understand what functions are being performed internally, and based on those results, you can implement similar functions or create programs that are compatible with existing systems. It can also be used to analyze how programs or web services process data. While this work is related to the fields of hacking and security, reverse engineering itself does not equate to hacking or cracking. Reverse engineering can be utilized for various legitimate purposes, such as security research, software analysis, and ensuring compatibility; in fact, it plays a crucial role in the process of analyzing security vulnerabilities and developing defense technologies.
Conversely, in the field of security, various protection techniques are applied to prevent attackers from analyzing a program’s internal structure. This process is called anti-reverse engineering. Understanding reverse engineering is necessary to comprehend and apply the various protection techniques designed to make programs difficult to analyze. Therefore, the more experience one has with reverse engineering, the better equipped they are to identify how attackers might analyze a program and to design security technologies to counter such threats. However, being skilled at reverse engineering does not necessarily make one a hacker or a security expert; in the actual field of security, a broad range of knowledge—including networks, operating systems, and cryptography—is also required.
Furthermore, computer viruses and malware are fields closely related to reverse engineering. This is because analyzing malware allows one to determine how a program infiltrates a system, what information it modifies or collects, and how it conceals its own behavior. In particular, for antivirus and security programs to detect and respond to malware, it is necessary to analyze the structure and behavior of the malware. Therefore, an understanding of reverse engineering plays a crucial role in the process of analyzing and defending against malware.
Is reverse engineering legal?
Because it is such a highly versatile technology, there is also controversy over whether it is legal or illegal. To start with the conclusion, the technique of reverse engineering itself is not universally illegal. It is, after all, a technique for analyzing programs and systems, and it does not necessarily serve malicious purposes. In fact, reverse engineering is used for legitimate purposes such as security research, ensuring software compatibility, error analysis, and malware analysis. However, the issue arises when, during the analysis process, one accesses another person’s program without permission, infringes on copyrights or contractual rights, or reproduces and distributes the results of the analysis without authorization. In particular, legal issues related to reverse engineering can vary depending on the purpose and method of the act, the terms of use of the program in question, the applicable laws, and the jurisdiction; therefore, one should not simply conclude that “reverse engineering is legal” or “it is illegal.” In the United States, the Digital Millennium Copyright Act (DMCA) contains provisions regarding the circumvention of technological protection measures, and it stipulates certain conditions and exceptions for reverse engineering, interoperability, and security research. Therefore, when actually analyzing a specific program or attempting to circumvent protection technologies, it is necessary to verify the laws of the relevant country and the program’s terms of use.
Although the content described so far may seem somewhat complex, it is, after all, merely basic and fragmentary. However, I believe that even with what has been explained so far, you should be able to understand to some extent how reverse engineering is related to hacking and security. If reading this article has made you want to learn more about reverse engineering, that’s great. However, as mentioned earlier, reverse engineering is by no means a simple task. To understand the internal structure of a program, you must acquire knowledge not only of programming languages but also of assembly language, computer architecture, operating systems, and more; above all, you must gain experience by analyzing actual programs. Still, I believe it’s enough if this article has at least helped satisfy your curiosity about what reverse engineering is and how it’s applied in fields such as hacking and security.
