Software Reengineering

By

Dr. Junaid Akram

Assistant Professor, Department of Computer Science COMSATS (Lahore)

1
 Reverse Engineering
Concepts and Methods

2
J.A COMSATS Uni
Difference Between Forward Engineering and Reverse Engineering

3
 Advantages of Reverse Engineering

4
J.A COMSATS Uni
Reverse Engineering
• “Reverse engineering is the process of analyzing a subject system to identify
the system’s components and their interrelationships and create
representations of the system in another form or at a higher level of
abstraction”
By – Chikofsky and Cross (1990).

• In reverse engineering, the requirements and the essential design, structure

and content of the legacy system must be recaptured.
• The effectiveness of this process will affect the success of the reengineering
project.
• Reverse engineering does not involve changes to the system or the creation
of a new system.
• It is the process of examination without changing its overall functionality.
5
Reverse Engineering Objectives
• Cope with complexity;
• Have a better understanding of big and complex systems,
• Automatic techniques provide a way to extract relevant information and
leave out low-level details.
• Generate alternative views;
• Reverse engineering tools provide different views of the systems,
• It enables the designers to analyze the system from different angles.
• Recover lost information;
• Changes made to the system are often undocumented – this enlarges the
gap between the design and the implementation,
• Reverse engineering techniques retrieve the lost information.
6
 Cont..

• Detect side effects;

• Reverse engineering can help detect problems due to the effect some
changes may have on the system before they result in the failure of the
system.
• Synthesize higher abstractions;
• Extract high-level abstract views of the system.
• Facilitate reuse;
• Reverse engineering can help detect candidate system components that can
be reused.

7
J.A COMSATS Uni
 Relationship Between Reengineering And Reverse Engineering. From Reference 6. © 1990 IEEE

8
J.A COMSATS Uni
Factors Necessitating the Need for Reverse Engineering

• The original programmers have left the organization.

• The language of implementation has become obsolete, and the
system needs to be migrated to a newer one.
• There is insufficient documentation of the system.
• The company acquired the system as part of a larger acquisition and
lacks access to the source code.
• The system requires adaptations and/or enhancements.
• The software does not operate as expected
9
Reverse engineering applied problem areas:
• redocumenting programs • transforming binary code into source code

• identifying reusable assets • redesigning user interfaces

• discovering design architectures
• parallelizing largely sequential programs
• recovering design patterns
• translating a program to another language
• building traceability between code and
• migrating data
documentation

• finding objects in procedural programs • extracting business rules

• deriving conceptual data models • auditing security and vulnerability

• detecting duplications and clones and

• cleaning up code smells • extracting protocols of network applications

• aspect-oriented software development

• computing change impact 10

 Reverse Engineering Process

• The reverse engineering process, begins by extracting the requirements

and detailed design information from the source code

• A requirements document is created and a high level design abstraction

is extracted and expressed using data-flow and control-flow diagrams.

• The recovered design is reviewed for consistency and correctness.

11
J.A COMSATS Uni
Reverse Engineering Procedure

12
Reverse Engineering Procedure
• Collect information:
• Collect all the possibly available information about the program.
• The sources of information include design documents, documentation for system
calls and external routines and source code.
• Personnel experienced with the software should also be identified.

• Examine information:
• Thoroughly review the collected information.
• This step allows the people working on the recovery to become familiar with the
system and its existing components.
• A plan for dissecting the program and recording the recovered information can be
formulated during this stage.

13
J.A COMSATS Uni
Cont..
• Extract the structure:
• Identify the structure of the program and use this to create a set of structure charts.
• Every node in the structure chart corresponds to a particular routine called in the
program.
• Hence, the chart makes a record of the calling hierarchy of the program.
• For each edge in the chart, the data passed and returned by a node must be recorded.

• Record functionality:
• For every node in the structure chart, record the processing done in the program routine
corresponding to that node.
• A Program Description Language (PDL) can be used to show the functionality of program
routines.
• For system and library routines the functionality can be described in English or in a more
formal notation.

14
Cont..
• Record data-flow:
• The recovered program structure and PDL can be analyzed to identify data
transformations in the software.
• These transformation steps show the data processing done in the program.
• This information is used to develop a set of hierarchical data flow diagrams that
model the software.

• Record control-flow:
• Identify the high-level control structure of the program and use control-flow
diagrams to record it.
• This refers to high-level control that affects the overall operation of the software,
not to low-level processing control.

15
Cont..
• Review recovered design:
• Review the recovered design for consistency with available information
and correctness. Identify any missing item of information and attempt to
locate it.
• Review the design to verify that it correctly represents the program.

• Generate documentation:
• The final step is to generate complete design documentation.
• Information explaining the purpose of the program, program-overview,
history and so on will need to be recorded.
• This information will most probably not be contained in the source code
and must be recovered from other sources.

16
 Reverse Engineering Tools

17
J.A COMSATS Uni
 Reverse Engineering
(Android Applications)

18
J.A COMSATS Uni
Terminologies

19
Android Application Build Process

20
 Cont..

21
J.A COMSATS Uni
Tools
(Re-Java)
1: APK EDITOR STUDIO – Free, Open source &
Cross-platform APK editor

23
2: jadx –
Dex to Java
decompiler

24
3: GDA – Android Reversing Tool

25
4: JD-GUI – Displays Java sources from CLASS files

26
 DroidMD : Android Malware Detection Main Architecture
Using Reverse Engineering

DroidMD: an efficient and scalable Android malware detection approach at source code level
Published Online:July 9, 2021pp 299-321https://doi.org/10.1504/IJICS.2021.116310 27
J.A COMSATS Uni
 Obfuscated Code in Reverse Engineering

Obfuscated code is identifiable by a token-base code clone detection technique

Published Online:November 21, 2022pp 254-273https://doi.org/10.1504/IJICS.2022.127132 28
J.A COMSATS Uni
 Obfuscation

29
J.A COMSATS Uni
Obfuscated Code Generation Through Proguard

30
 Obfuscated
Fragments
Retrieved
Against Five
Subject Systems

J.A COMSATS Uni

 Android Reverse Engineering Tools

• APKtool: A powerful tool for reverse engineering APK files. It can decode application
resources to their nearly original form and rebuild them after making code modifications.
• JADX: This is a command-line and graphical tool that can decompile DEX (Dalvik
Executable) files and convert them to readable Java source code
• Dex2jar and JD-GUI: dex2jar is a tool used to convert DEX files to java JAR files and then
using JD-GUI, which is a Java decompiler that can be used to view the Java source code
• Radare2 (also known as "r2"): This is a free and open-source reverse engineering
framework that can analyze, modify, and decompile Android applications.
• Strings: A simple utility that extracts and displays printable strings from a binary file. It can
pull strings from Android APK files and be a valuable tool for reverse-engineering Android
applications.

32
J.A COMSATS Uni
A curated list of awesome Android Reverse Engineering
training, resources, and tools.

33
• https://github.com/user1342/Awesome-Android-Reverse-Engineering
 Thanks for your attention!

Any Question?

Email me on : [email protected] 34