>The reverse-engineering of the actual shipped binary (for instance, the ARM code lifted to LLVM) seems like a safer analysis target. Reverse engineering binar

>The reverse-engineering of the actual shipped binary (for instance, the ARM code lifted to LLVM) seems like a safer analysis target. Reverse engineering binaries is only permitted under the DMCA for the purpose of interoperability, AFAIK.[1] If so, that would make reverse engineering to verify stated security claims illegal in the United States. I'll just assume I'm wrong here for the sake of argument though. Reverse engineering sounds much less friendly than providing actual source code. It's much easier for me to compare changes from version to version with source control, commit comments, and diffs. Then all I need is a reproducible build to verify that the output matches the binary being shipped. Do you have some reverse engineering tools you would suggest? Obviously the one's I'm familiar with are not as good as yours. Links to those would be greatly appreciated. [1]https://www.eff.org/issues/coders/reverse-engineering-faq https://www.eff.org/issues/coders/reverse-engineering-faq