Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is decompiling a dynamic link library considered unethical/illegal or blackhat?

If, for instance, the result of the decompile showed methods and literals that contain passwords that the application use, is simply viewing decompiled source code breaking into that code?

share|improve this question
2  
The term "hacking" is an overloaded term with different meanings. It is often associated with social or media attempts to get a reaction from non technical folks. On this site we prefer more accurate descriptions of the "actors" (or people & motivation) involved –  makerofthings7 Feb 6 '13 at 2:26
1  
Decompiling software is considered reverse engineering. –  josten Feb 6 '13 at 3:22
    
Edited to remove the connection to 'hacking' which is a word which carries so many different meanings it is almost useless in this context. –  Rory Alsop Feb 6 '13 at 9:11
    
"Is it illegal" is localized; law change state by state, country by country. "blackhat" is a term that has no objective meaning. "Ethical" can be subjective; if you're referring to a specific code of ethics, which one. Having said all that, the Digital Millenium Copyright Act makes it illegal to attempt to defeat any security implementation. –  Mark C. Wallace Feb 6 '13 at 10:25
    
Mark - the attempt of my edit was to make this possibly answerable. See the history for the previous version. If you can improve further I'd be grateful. –  Rory Alsop Feb 6 '13 at 13:00

3 Answers 3

Legality of reverse engineering depends on the country. As a rough summary:

  • In the USA, it is legal as long as the software was obtained legally, but if the license prohibits it explicitly (and most software licenses do) then it is a breach of the contract which the license constitutes -- thus "illegal", but a matter of civil law, not penal.

    The DMCA also has ramifications in the matter. The reason for which you do the reverse-engineering is important: if you do it in order to circumvent a system which deliberately controls access to copyrighted work, then the Law will smite you mightily.

  • In the European Union, reverse engineering is legal as long as it is for interoperability purposes, whatever the license may say on the subject. Reverse engineering does not give you the right to publish your findings, though.

As for ethics, well, these things are kind of arbitrary (which is not a problem) and not completely universal (which is a problem). Not all people follow the same moral conventions; moral relativists find it normal, but all other people consider that they are right and whoever does not comply to the same conventions is wrong. Also, it is not clear whether it is possible to have a clearcut stance on the morality of reverse engineering of software in abstracto; it really depends on the circumstances. Even DMCA recognizes a moving set of "exceptions", which, as of 2012, makes jailbreak legal for smartphones but not for tablets (in the USA). Now find a moral system which can make such a distinction.

(And the Lord said: "Thou shall not jailbreak your tablet, unless it is small enough to be considered a phone". Whaaat ?)

share|improve this answer

In many countries reverse engineering is illegal, and for much commercial code, the terms of use do not allow you to decompile or reverse engineer that code.

Check out your DLL terms of use (if possible) and check out the law in your country - you may be breaching regulations or terms, either of which can get you in trouble.

share|improve this answer
    
Even in the cases where it is legal what you can do with the information might be limited. For instance in the USA you are allowd to reverse engineer something, as a simple example the Stack Exchange software, depending on how you did it exactly would determine if its a clean white room implementation ( Ask Google about Dalvik ) and if your allowed to use your own implementation. –  Ramhound Feb 6 '13 at 12:15

Well. Yes I would say so.

Most of the time, when you download a program you agree not to Reverse Engineer it. Hence using it for something beyond its intended purpose. Which is what hacking is really. Kinda. In reality, things like binary exploitation, b/o's etc. are explicitly looking for a vulnerability. It's not like web app, where if you stumble upon a vulnerable page, it's kind of an Oopsy. Decompiling is going out of the way to find something wrong with the software.

share|improve this answer
1  
Please provide something to support your statements. You can agree all you want but in many countries the license does not take away your legal right to reverse white room engineer a technology. –  Ramhound Feb 6 '13 at 12:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.