How to document a reverse engineering operation?

Question

Sometime I have to reverse engineer / disassemble some software/firmware/application, how can I keep track of the findings, the application flow I discovered and generally the details I need when I return to work on that project after some time (months)?

Often I have to analyze some kind of home-made encryption system and while I work on the project I can keep all the details I need in mind but if I pause the project for some time (ex. 1 month) when I return to work on it I have to relearn at least half of the details.

To sum up: I am searching for an easy, browsable, system to keep track of details of applications I disassemble to make them useful.

Answer 1

Reverse engineering is not quite mature at the moment. When I do it, I often do these things:

1. Give the important functions clear names.

2. Draw flow charts using some engineering software/tools with class structures.

3. The final weapon: rewrite the source code of the program (or a part of it) according to your analysis. The code is the best document.

You might need to read on software engineering to see how others keep track of things in huge software projects.

Answer 2

If you would like to get examples of thorough reverse engineering documentation examples, one of the moderators here has a website with fully reverse engineered malware analysis IDA Pro databases. Looking at how he approaches each function might prove to be a good framework.

http://www.msreverseengineering.com/blog/2014/6/23/baglew-thorough-idb

http://www.msreverseengineering.com/blog/2014/6/23/commwarriorb-thorough-idb-armc