Introduction to
reverse engineering
Tudor Gîrba
www.tudorgirba.com

Reference

Reverse engineering is analyzing a subject system to:
identify components and their relationships, and
create more abstract representations.
Chikofky & Cross, 90

Why reverse engineer?

In 1944, 3 B-29 had to land in Russia

Requirement: Copy everything fast!

Approach
disassemble
run
test

TU-4 Result:
105,000 pieces reassembled in 2 years

Why reverse engineer software systems?

1946

1956

1956

1956

1956 2006

1956 2006

1956 2006

1956 2006
?

Software is complex.
29% Succeeded
18% Failed
53% Challenged
The Standish Group, 2004

How large is your project?

How large is your project?
1’000’000 lines of code

How large is your project?
1’000’000 lines of code
* 2 = 2’000’000 seconds

How large is your project?
1’000’000 lines of code
* 2 = 2’000’000 seconds
/ 3600 = 560 hours

How large is your project?
1’000’000 lines of code
* 2 = 2’000’000 seconds
/ 3600 = 560 hours
/ 8 = 70 days

How large is your project?
1’000’000 lines of code
* 2 = 2’000’000 seconds
/ 3600 = 560 hours
/ 8 = 70 days
/ 20 = 3 months

How development happens
fo
rw
ar
d
en
gin
ee
rin
g
{ {
{ { { {
} { {
}
} actual development } }
} { } } }

Reengineering is needed to regain control
fo
rw
g
rin
ar
ee
d
gin
en
gin
en
ee
se
rin
erv
g
re
{ {
{ { { {
} { {
}
} program transformation } }
} { } } }

Reverse engineering is creating high level views
g
rin
ee
gin
en
se
erv
re
{ {
{ {
}
}
}
} { }

Legacy
a sum of money, or a specified article, given to
another by will;
anything handed down by an ancestor or predecessor.
Oxford English Dictionary

A legacy system is piece of software that
you have inherited, and
is valuable to you.

Reverse engineering is creating high level views
g
rin
ee
gin
en
se
erv
re
{ {
{ {
}
}
}
} { }

Setting direction
First contact
g
rin
ee
gin
Initial understanding
en
se
Detailed model capture
erv
re

What is a pattern?

Setting direction
g
First contact
rin
ee
gin
Initial understanding
en
se
er
Detailed model capture
v
re

You got to be careful
if you don't know
where you're going,
because you might not
get there.
Yogi Berra

Setting direction patterns
Set Where
direction to start
Agree Most valuable
on maxims first
Maintain Coordinate What not What
direction direction to do to do
Appoint Speak to the If it ain’t broke Fix problems
a navigator round table don’t fix it not symptoms
How to do
Keep it simple

Setting direction
First contact
g
rin
ee
gin
Initial understanding
en
se
er
Detailed model capture
v
re

First contact patterns
Talk with Talk with
developers users
Talk
Chat with Interview about it
maintainers during demo
Verify what Read Read about Compile
you hear the code the code the code
Read all code Skim Do a mock
in one hour documentation installation

Interview Chat
during demo with maintainers
What is the usage? What is the history?
Users complain Developers
Users are enthusiastic protect their job
Who to choose? What to ask?

Interview Chat
during demo with maintainers
What is the usage? What is the history?
Users complain Developers
Users are enthusiastic protect their job
Who to choose? What to ask?
Remember, they are all humans :)

What to ask a maintainer?
How long was your project going on?
Who worked on the project?
What was the most interesting bug you had to fix?
Why was the reengineering effort started?
How do you release?
How do you plan what to do?
How do you test?

Read all code in one hour

Read all code in one hour

Read all code in one hour
I took a course in speed reading and read “War and
Peace” in twenty minutes.
It’s about Russia.
Woody Allen

How large is your project?
1’000’000 lines of code
* 2 = 2’000’000 seconds
/ 3600 = 560 hours
/ 8 = 70 days
/ 20 = 3 months

Why read all code in one hour?

Setting direction
First contact
g
rin
ee
gin
Initial understanding
en
se
er
Detailed model capture
v
re

Initial understanding patterns
Top down
Recover
design
Speculate
about design
Iteration
Analyze Study
persistent data exceptional entities
Recover Identify
database problems
Bottom up

Identify exceptional entities

Speculate about design

Speculate about design
Layout Abstract
Item
Graph Node Edge

Setting direction
First contact
g
rin
ee
gin
Initial understanding
en
se
Detailed model capture
erv
re

Detailed model capture patterns
Tie code and
questions
Track your Expose
understanding design
Refactor
to understand
Expose Encode
collaborations assumptions
Step through Write tests
execution to understand
Expose
contracts Expose
evolution
Look for Learn from
the contracts the past

Why refactor? To understand

Write tests to understand
and to ensure later refactorings

Example:
Visualization does not guarantee understanding

Learn from the past

Setting direction
First contact
g
rin
ee
gin
Initial understanding
en
se
Detailed model capture
erv
re

Tudor Gîrba
www.tudorgirba.com
creativecommons.org/licenses/by/3.0/