16

Is decompiling a dynamic link library considered unethical/illegal or blackhat?

If, for instance, the result of the decompile showed methods and literals that contain passwords that the application use, is simply viewing decompiled source code breaking into that code?

Rory Alsop
  • 61,367
  • 12
  • 115
  • 320
Lock
  • 261
  • 1
  • 2
  • 4
  • 2
    The term "hacking" is an overloaded term [with different meanings](http://security.stackexchange.com/q/12794/396). It is often associated with social or media attempts to get a reaction from non technical folks. On this site we prefer more accurate descriptions of the "actors" (or people & motivation) involved – makerofthings7 Feb 06 '13 at 02:26
  • Edited to remove the connection to 'hacking' which is a word which carries so many different meanings it is almost useless in this context. – Rory Alsop Feb 06 '13 at 09:11
  • "Is it illegal" is localized; law change state by state, country by country. "blackhat" is a term that has no objective meaning. "Ethical" can be subjective; if you're referring to a specific code of ethics, which one. Having said all that, the Digital Millenium Copyright Act makes it illegal to attempt to defeat any security implementation. – MCW Feb 06 '13 at 10:25
  • Mark - the attempt of my edit was to make this possibly answerable. See the history for the previous version. If you can improve further I'd be grateful. – Rory Alsop Feb 06 '13 at 13:00
  • And the DMCA is just one regulation. In some countries, the law explicitly permits reverse engineering, even if the terms might make it sound otherwise :-) – Rory Alsop Feb 06 '13 at 13:01

4 Answers4

20

Legality of reverse engineering depends on the country. As a rough summary:

  • In the USA, it is legal as long as the software was obtained legally, but if the license prohibits it explicitly (and most software licenses do) then it is a breach of the contract which the license constitutes -- thus "illegal", but a matter of civil law, not penal.

    The DMCA also has ramifications in the matter. The reason for which you do the reverse-engineering is important: if you do it in order to circumvent a system which deliberately controls access to copyrighted work, then the Law will smite you mightily.

  • In the European Union, reverse engineering is legal as long as it is for interoperability purposes, whatever the license may say on the subject. Reverse engineering does not give you the right to publish your findings, though.

As for ethics, well, these things are kind of arbitrary (which is not a problem) and not completely universal (which is a problem). Not all people follow the same moral conventions; moral relativists find it normal, but all other people consider that they are right and whoever does not comply to the same conventions is wrong. Also, it is not clear whether it is possible to have a clearcut stance on the morality of reverse engineering of software in abstracto; it really depends on the circumstances. Even DMCA recognizes a moving set of "exceptions", which, as of 2012, makes jailbreak legal for smartphones but not for tablets (in the USA). Now find a moral system which can make such a distinction.

(And the Lord said: "Thou shall not jailbreak your tablet, unless it is small enough to be considered a phone". Whaaat ?)

Thomas Pornin
  • 320,799
  • 57
  • 780
  • 949
  • Tablets are now legal but still like your joke. http://www.theverge.com/platform/amp/2015/10/27/9622066/jailbreak-unlocked-tablet-smart-tvs-dmca-exemption-library-of-congress] – William Mar 03 '18 at 21:54
  • Not sure if it depends on country. It also appears in applications EULA, so it seems universal. see EULA of whatsapp for example: https://www.whatsapp.com/legal/#terms-of-service (search decompile) – ransh Jan 16 '19 at 20:59
3

In many countries reverse engineering is illegal, and for much commercial code, the terms of use do not allow you to decompile or reverse engineer that code.

Check out your DLL terms of use (if possible) and check out the law in your country - you may be breaching regulations or terms, either of which can get you in trouble.

Rory Alsop
  • 61,367
  • 12
  • 115
  • 320
  • Even in the cases where it is legal what you can do with the information might be limited. For instance in the USA you are allowd to reverse engineer something, as a simple example the Stack Exchange software, depending on how you did it exactly would determine if its a clean white room implementation ( Ask Google about Dalvik ) and if your allowed to use your own implementation. – Ramhound Feb 06 '13 at 12:15
-2

It is your right to decompile any software your purchase or freeware you download as long as you do not redistribute it or sell it to third parties. It is also legal to talk about your discoveries. You need to read between the lines of a software contracts that is written for the interests of the big corporations. As an example, if you purchase a car you can remove any piece you don't want as long as you do not compromise road safety. When you purchase the right to use a product it is yours to play with in any way you want as long as you do not cause damage to others by doing so. In the software business you pay for a license to use it however you are the one that pays the rent and you can twist such piece of software to fit your needs. If you want to remove pieces of it to make it faster it is your choice, if you want to remove the access key or learn how it works you can do so as long as you are doing it with a paid copy. As far as intellectual property rights, it is the same story when you buy a book and you just read the part of the book that you like, you could tear off any page you don't like and you are not braking the law. Intoit-SRA allows anyone to play with it.

-2

Well. Yes I would say so.

Most of the time, when you download a program you agree not to Reverse Engineer it. Hence using it for something beyond its intended purpose. Which is what hacking is really. Kinda. In reality, things like binary exploitation, b/o's etc. are explicitly looking for a vulnerability. It's not like web app, where if you stumble upon a vulnerable page, it's kind of an Oopsy. Decompiling is going out of the way to find something wrong with the software.

  • 2
    Please provide something to support your statements. You can agree all you want but in many countries the license does not take away your legal right to reverse `white room` engineer a technology. – Ramhound Feb 06 '13 at 12:17