Is reverse engineering an application the same as decompiling it?
What is the core difference between reverse engineering an application and decompiling an application.
asked Apr 5, 2013 at 11:01
Add a comment
|
3 Answers
Decompilation is just one method of reverse engineering.
From the decompilation description:
Decompiling is the process of analyzing an executable or object code binary and outputting source code in a programming language such as C. The process involves translating a file from a low level of abstraction to a higher level of abstraction.
Decompilation is usually carried out using a decompiler.
From Wikipedia's article on reverse engineering:
Reverse engineering is the process of discovering the technological principles of a device, object, or system through analysis of its structure, function, and operation.
Software can be reverse engineered and decompiled. A lot of other things (such as hardware, door locks) can be reverse engineered but not decompiled, because their software/firmware is written in low level languages without a higher-level representation, or, more radically, they don't have any firmware in the first place.
Reverse engineer is more general: you want to understand, in your own terms, what a binary does. E.g. this could lead to a description of what it does, maybe with a simulation of what (part of it) does. Decompile is to produce source code that (when compiled) gives you back the "same" binary, which is a much harder task in general.
Reverse Engineering is a broader term, of which, decompilation is simply one--albeit powerful--tool. Decompilation is a form of static analysis which is investigating a program by not running it. Don't forget that reverse engineering can also mean taking apart the device that's running a program. Some of my favorite exploits have dealt with using the property of some kinds of memories to continue holding values after the machine has been shut off.
A small, non-exhaustive list of techniques for reverse engineering:
Static Analysis Techniques
String analysis --> Using a program like "strings" to discover any readable text in the binary. On non-packed files, this can often tip you off as to what platform the binary was compiled in. If the binary was compiled with symbols, you can even get access to variable names that the author had used, which can help in subsequent analysis.
Decompilation --> Cruder techniques might include unix tools like objdump, cracking open the binary in a hex editor, etc.
Dynamic Analysis
Fuzz Testing --> Throwing multiple kinds of (possibly) invalid data to see how the application responds
Debugging --> Coupled with Fuzz testing above will let you see how the application is actually working on the level of registers && assembly. (If using GDB or ollydbg.)
"Eavesdropping" on circuits or radiation emitted by a device--> It's exotic, but it's real.
Summary So decompilation is just one tool in the much broader kit of "reverse engineering."
