Reverse Engineering and Vulnerability Research

Reverse Engineering

Critical processes may run software whose source code you have never seen. An agent installed on every computer or an unsupported system are examples. Our reverse engineering experts extract what these programs actually do from the compiled code. Your procurement and detection decisions are then evidence-based.

Discuss Scope All Service Areas

Reverse Engineering

The difference between a vendor's claim and what the software actually does is visible only in the compiled code. Which data is sent to which server is found in the code, not the documentation. ISO/IEC 27001:2022 defines management of information security in the ICT supply chain as a separate control (Annex A 5.21).

The need

When organizations need it

When you need to know what data a closed-source agent installed on every computer actually collects.
When you need to know what malware found in an incident does.
When an unsupported system with an undocumented protocol must be connected to a new system.
Before your mobile app's code protection and integrity checks go live.

Questions

What this work answers

Which servers does our closed-source software connect to and what data does it send?
What does this malware do and where else should we look for it?
How resilient are our product's code protection and license checks?
How does this undocumented protocol work and does it have vulnerabilities?

Reverse Engineering

What we do

Software and Binary Reverse Engineering

We determine from compiled code what software without source code connects to and what data it collects.
Firmware Reverse Engineering

We analyze how authentication and update checks work in device firmware and identify undocumented services.
Protocol and File Format Analysis

We analyze undocumented protocols and data formats and produce a specification for integration and security testing.
Mobile Application Reverse Engineering

We search iOS and Android packages for embedded keys and hidden functions. We test the robustness of device integrity checks.
Malware Reverse Engineering

We analyze what a malware sample does and how it persists. We create detection rules to search other systems.
Code Protection and Anti-Tamper Resilience

We test how long obfuscation and license checks withstand attempts to bypass them.
Cryptographic Implementation Review in Binaries

We look for cryptographic implementation errors in compiled code. Hard-coded keys and weak random number generation are typical examples.

Scope

Scope is defined by the version to be examined and the question to be answered. This may involve finding a data flow, testing a protection, or fully analyzing a malware sample.

How we work

We first run the software in a controlled environment and observe its behavior. Then we trace each observed behavior to its source in the compiled code. This reveals functions that run only on certain dates or commands.

Deliverables

What you receive

An analysis showing each behavior with its location in the compiled code. For malware, indicators suitable for detection rules. For product protection, which protection was bypassed, how, and with what effort.

NoteAnalysis is performed only on software and devices you own or have written permission to examine.