What is reverse engineering? Meaning and legality

What does reverse engineering mean?

Forward engineering compared with reverse engineering

	Forward engineering	Reverse engineering
Starting point	Requirements and design	A finished product or program
Direction	Design to product	Product to design
Result	A new product	Knowledge of how the product works

Reverse engineering means taking something that already exists and working out how it was made, usually without the original drawings, documentation, or source code. People reverse engineer machines, electronic parts, file formats, network protocols, and software. The goal is knowledge: what the parts are, how they fit together, and why the product behaves the way it does.

Working backward from a finished product

The defining feature is direction. An engineer who reverse engineers a product begins with the finished object and moves step by step toward the design that must have produced it. That could mean measuring a spare part that is no longer made, or reading a program to see how it saves files.

The term is also written as back engineering. Both names describe the same idea.

How it differs from forward engineering

Normal product development is called forward engineering. A team writes requirements, draws up a design, and then builds and tests the product.

Reverse engineering flips that sequence. The product comes first, and the design is the output. That is why it is useful when the design was never shared, has been lost, or belongs to someone else.

Why companies reverse engineer products

Common reasons to reverse engineer

Reason	What gets studied	Example
Interoperability	Another company's interface	Building software that reads a competitor's file format
Security	Software and malware behavior	Finding a flaw, working out what a virus does
Lost designs	Legacy systems and old parts	Rebuilding documentation for a system nobody understands
Product comparison	Competitors' and your own products	Seeing how a rival cut part count

Most reverse engineering is done to connect, secure, maintain, or improve products, not to clone them. The four reasons in the table come up in almost every industry that builds hardware or software.

Making products work together

Interoperability is the classic reason. If you want your app to open another company's files or talk to its device, you need to know the format or protocol. When the other company does not publish that information, studying its product is often the only way to find out.

Security research and malware analysis

Security teams reverse engineer software to find vulnerabilities before attackers do. Most commercial software ships without source code, so analysts read the compiled program directly to spot unsafe code.

Malware analysis works the same way. Attackers rarely publish their code, so researchers take the malicious file apart to learn what it does, what it targets, and where it sends stolen data.

Recovering lost designs and legacy systems

Old systems often outlive their documentation. The original developers leave, the design files go missing, and nobody can say exactly how a critical program works.

Reverse engineering recovers that knowledge so the system can be maintained or replaced. In manufacturing, the same approach is used to recreate spare parts for machines whose makers no longer support them.

How reverse engineering works

Main techniques for hardware and software

Target	Technique	What you get
Hardware	Teardown, calipers, 3D scanning	Part dimensions and a CAD model
Software	Disassembler, decompiler	Assembly code or code close to the original source
Software	Static and dynamic analysis	Program structure and runtime behavior

The method depends on whether the target is a physical object or a program. Hardware is measured. Software is translated back into a form people can read and then studied.

Hardware: teardown, measurement, and CAD

Hardware reverse engineering starts with a teardown. Engineers take the product apart and measure each part, either by hand with calipers or with a 3D scanner that captures the whole shape. CT scanning can show the inside of a part without cutting it open.

The measurements are turned into a CAD model, a digital drawing that can be edited and used to make the part again. Once a model exists, engineers can reproduce the part, adapt it, or check it against their own design.

Software: disassemblers and decompilers

Software is harder to read because it ships as machine code. Developers write source code in a language people can read, and a compiler turns it into machine code, the low-level instructions a processor runs.

A disassembler converts machine code into assembly language, a readable list of those instructions. A decompiler goes a step further and rebuilds code that looks close to the original source. Ghidra and IDA Pro are well-known examples of tools that do both.

Reading the translated code without running it is called static analysis. Running the program and watching what it does, often in an isolated test machine, is called dynamic analysis. Analysts usually combine the two.

AI agents that run the analysis tools

AI coding agents can now operate reverse engineering tools for you. Connect an agent such as Claude Code to a disassembler or decompiler, describe the feature you want to understand, and the agent runs the analysis and explains how the program works, with the code it based its answer on.

This lowers the barrier for people who have never read assembly. One open-source example is covered in REA: AI Reverse Engineering MCP for Claude Code.

Is reverse engineering legal?

How US and EU law treat reverse engineering

Law	What it allows	Where the risk is
US trade secret law (18 U.S.C. § 1839)	Reverse engineering is not an improper means	Getting the product unlawfully
US DMCA (17 U.S.C. § 1201)	Breaking access controls only for interoperability	Breaking copy protection for other reasons
EU Software Directive (2009/24/EC)	Decompiling for interoperability, under conditions	Going beyond what interoperability needs
License terms	Depends on the contract	Breach of contract if the license forbids it

Reverse engineering is generally legal in the US and the EU when you obtained the product lawfully and your goal is understanding or interoperability. The limits come from copy protection rules and from contracts. The main laws are summarized as general information, not legal advice.

US trade secret law treats it as fair play

Under the federal Defend Trade Secrets Act, reverse engineering is not an improper way to learn a trade secret. The definitions section of the law, 18 U.S.C. § 1839, lists theft, bribery, misrepresentation, and espionage as improper means, and then says the term does not include reverse engineering or independent derivation.

In practice, a company that buys a product on the open market and figures out how it works has not used an improper means under that definition. The picture changes if the product was obtained by deception or through someone who owed a duty of secrecy.

The DMCA limits breaking copy protection

The Digital Millennium Copyright Act generally bans circumventing technical measures that control access to copyrighted works, and software is covered. Section 1201(f) carves out a narrow exception for interoperability.

The exception covers a person who has lawfully obtained the right to use a program. That person may get around its protection only to find and analyze the parts needed to make an independently created program work with it. Those parts must not already be readily available, and the work must not otherwise infringe copyright.

EU law allows decompiling for interoperability

In the European Union, a lawful user may decompile software without permission when that is the only way to get information needed for interoperability. The rule comes from Directive 2009/24/EC on the legal protection of computer programs. Its Article 6 sets three conditions:

• The person must have a right to use the program.
• The information must not already be readily available.
• The work must stay limited to the parts needed for interoperability.

Two other rules matter for everyday users. Article 5(3) lets anyone with a right to use a program observe, study, or test how it works. Article 8 says contract terms that try to override those rights are null and void.

License terms can still forbid it

Outside the EU rule above, many software licenses and online terms of service ban reverse engineering, and agreeing to them creates a contract. Breaking that contract is a separate problem from copyright or trade secret law.

AI services do this too. Anthropic's consumer terms, for example, bar users from decompiling, reverse engineering, or disassembling its services, except where the law prohibits that restriction. The same terms forbid using the services to build competing AI models, a practice explained in What is knowledge distillation? Smaller AI models.

How companies protect their software from analysis

Ways to make reverse engineering harder

Method	What it does
Obfuscation	Makes compiled code confusing to read without changing what it does
Encryption	Hides sensitive data or code until it is needed
License terms	Forbids reverse engineering by contract, within legal limits
Trade secret practices	Keeps know-how secret so trade secret law can protect it

No technique makes software impossible to reverse engineer, but technical and legal measures together make it slower and riskier. Companies usually layer both.

Obfuscating and encrypting your code

Obfuscation rewrites a program so it behaves the same but is much harder to read. Typical changes include renaming variables to meaningless strings and scrambling the order of operations. Encrypting sensitive data or parts of the code adds another layer, since an analyst sees only scrambled bytes until the program decrypts them.

Contracts and trade secret practices

A license that forbids reverse engineering gives you a contract claim if someone breaks it. In the EU, though, a clause that blocks decompilation for interoperability is void, so the contract cannot reach that far.

Trade secret protection also depends on keeping the know-how secret in practice. Under the US definition above, learning a secret by taking apart a lawfully bought product is not an improper means, so secrecy alone will not stop that.

Whether reverse engineering is legal depends on the use

Reverse engineering means working backward from a finished product or program to understand how it was built. It is used to make products work together, to find security flaws and analyze malware, and to recover designs that were lost.

Hardware is torn down, measured, and rebuilt as a CAD model. Software is turned back into readable code with disassemblers and decompilers, and AI agents can now run those tools.

In both the US and the EU, reverse engineering a product you obtained lawfully is generally allowed, and interoperability gets explicit protection. Breaking copy protection for other purposes, and ignoring a license that forbids reverse engineering, are where the legal risk lies.