7 ms·

Coder's Rights Project – Reverse Engineering FAQ

112 points by jcr 12y ago

lstor 12y ago
In Norway, we have an un-waverable right by law to reverse engineer computer systems for learning purposes. They are described in Åndsverkloven §§ 39h and 39i. Roughly translated excerpts: § 39h Whoever has the right to use a computer program, can copy, change and work on the program to the extent necessary in order to utilize the program in accordance with its purpose, including in order to correct errors in the program. Whoever has the right to use a copy of a computer program can, during such reading, screen display, running, transfer or storage of the program that the user has the right to do, monitor, examine or probe the working of the program in order to determine the ideas and principles on which the individual parts of the program is based. [This right is un-waverable] § 39i You are allowed to produce a copy of a computer program's code and translate the form of the code, when this is a prerequisite in order to produce the information necessary to achieve functional interaction between a self-developed program and other programs, if a) the actions are performed by a person who has the right to use a copy of a computer program, or acting on behalf of someone who do, b) the information is not already easily accessible, and c) the actions are limited to the parts of the original program necessary to achieve functional interaction. [A few limitations on utilization of the information] These rights are un-waverable.
- gpvos 12y ago
  Nice. The only problem I can see with this (I'm not a lawyer) is that I hope 39i.c is interpreted broadly - e.g., some tools disassemble an entire executable when you only need to look at a part.
  - lstor 12y ago
    I don't know for sure, but anything else would surprise me, really.
- userbinator 12y ago
  It seems countries in Northern Europe have some of the most liberal laws on RE - I wonder if the fact that the demoscene (which originated from software cracking culture) being quite established in that area is related in any way, or the fact that a lot of security researchers, who by necessity have to RE, are also from around that area.
- drdaeman 12y ago
  > for learning purposes > A few limitations on utilization of the information I don't know how it is in Norway, but I see those clauses as problematic. There is not much point in reverse engineering a piece of software if you can't use the results freely, including implementation of directly "competing" software. That is, most of RE is just figuring out the data formats and protocols. And I fear that in too many jurisdictions one who had analyzed those can't also be the person who can legally write an alternate implementation, and a "clean-room engineering" is required.
  - lstor 12y ago
    As far as I know there is no legal precedence (and I'm not a lawyer), but I think that figuring out data formats and protocols counts as "ideas and principles" -- which is okay. It's hard to say, really, courts aren't famous for showing any understanding of computer science. There is the DeCSS-case, which led to acquittal in Norwegian courts: http://en.wikipedia.org/wiki/DeCSS http://en.wikipedia.org/wiki/DeCSS
- rertrree 12y ago
  This reads like disassembly of programs is legal. What about publishing that information?
nnd 12y ago
I'm curious if non-US entities were ever prosecuted by US companies for reverse-engineering?
- drdaeman 12y ago
  Dmitry Sklyarov? http://en.wikipedia.org/wiki/United_States_v._ElcomSoft_and_Sklyarov http://en.wikipedia.org/wiki/United_States_v._ElcomSoft_and_...
  - thekaleb 12y ago
    Were any successfully prosecuted?
lsiebert 12y ago
I'm curious if reverse engineering software which is classified or otherwise protected from disclosure by the force of government is legally risky. I presume doing so for those who have access to such software because of a security clearance might face a legal penalty under national security laws.
- jcr 12y ago
  Good question, particularly if interpreted in a very broad sense. The FCC is the portion of the US Fed Gov that handles things like validating the acceptable RF interference and frequency transmit/receive parameters of products. If you reverse engineer something, and the resulting reimplementation violates the FCC rules, then you'll have legal trouble. Similar would be true for Europe with the CE regulatory/testing body. For example, most wifi (802.11-) chipsets have "modes" for various countries due to the fact that the "freely available" RF spectrum varies from country to country. Though illegal (according to the FCC/CE/etc), it is often possible to make wifi chipsets use chunks of frequency that are not legally accessible (within some jurisdiction). This can be done via software (drivers) or firmware (blobs), as well as through the use of additional or modified hardware (amps, antennas, ...). When you get into "licensed spectrum" that is supposedly "owned" by a company like a mobile carrier, things get even more "legally risky" since messing around in those bands can wreak a lot of havoc. I don't know if the operation of the (mobile) baseband processors qualify as "classified" but such info is definitely protected from disclosure by both technical (hardware/software protections) and legal (contracts, NDA, etc.) means. Of course, using a self-modified baseband processor is definitely illegal since the device has not been tested and approved by the required regulatory body (FCC or CE), but the laws do have some limited exclusions/registrations for test/development purposes. If you cause problems for a carrier that spent many billions to own/license a chunk of spectrum, then you also open yourself up to civil liability for damages, in addition to the legal problems you'll have with the Fed Gov regulatory body. Needless to say, if you go mucking around in the frequency bands dedicated by law for use by the military or law enforcement, then you are going to have a whole lot of legal problems.
  - TD-Linux 12y ago
    There is nothing "secret" about the operation of basebands, or what they put out on the air. This is just the companies protecting trade secrets, trying to avoid patent litigation, or just general open source averseness. Linux includes an open source regulatory information database that several open source wifi drivers use, so FCC licensing is not an issue for open source software either. It is not a form of DRM and does not require any "black boxing". Obviously you might be able to modify the software so you violate FCC rules, but you can also build your own radio transmitter and violate the FCC rules just as well. There's no special case for it being software. If you want to experiment on the radio bands, you can trivially get a ham radio license and modify the radio as you see fit, as long as you stay within the ham radio limits.
TeMPOraL 12y ago
Interestingly, four out of five court cases mentioned are from games industry.
- Sir_Cmpwn 12y ago
  The gaming industry is well known for exercising as much control as possible over their hardware and software. Console manufacturers want to control what runs on the console and software authors want to prevent piracy.
ck2 12y ago
Has EFF ever addressed if we have the right to root our phones? Because smartphones are getting more and more locked down, they have reached the point in late 2014 where many models simply cannot be rooted by 3rd parties. Note I am not talking about carrier unlocking, I mean root. I want full control over any device I use. It is like buying a car but not being allowed into the trunk.
- shmerl 12y ago
  It would depend on what exactly prevents you from getting root rights on your device. If it's DRM, to address that you'll need to fix DMCA-1201. Or more precisely, allow breaking DRM for any non infringing purpose. Right now it forbids it, and instead provides idiotic method of Librarian of Congress deciding what exceptions to grant. This corrupted law was passed undemocratically using backdoor method of WTO trade agreements.
  - dragonwriter 12y ago
    > This corrupted law was passed undemocratically using backdoor method of WTO trade agreements. No, while the anticircumvention prevention is in a Title of the DMCA named for WIPO treaties that (among other treaties) were implemented in US law in other provisions of the title, the anticircumvention provision was not part of those treaties and, in any case, neither it nor any part of the DMCA was "passed" through trade agreements, the DMCA was passed through the normal legislative process.
    - shmerl 12y ago
      > the DMCA was passed through the normal legislative process. Wrong. First of all those treaties took place before DMCA (including 1201) was passed. And there was nothing normal about it. Normal process actually rejected such idiotic restriction outright (since DRM proponents first attempted to pass it normally). When they were kicked by normal democratic process, they turned to WIPO treaties which have no democratic oversight. Corruption there is much easier, so they squeezed anticircumvention provisions into such treaties affecting US. Then they turned back to the Congress and said: "you can't ignore your international obligations! Pass this law". And Congress passed it without much of opposition. That's not called a normal democratic process, it's called corruption and backdoor dealing. See: https://en.wikipedia.org/wiki/WIPO_Copyright_Treaty https://en.wikipedia.org/wiki/WIPO_Copyright_Treaty
shmerl 12y ago
What are fair use regulations in EU in general? Are they worse than in US? Also, how exactly does it work when contractual prohibitions try to take away fair use rights? What wins? In this FAQ it's only mentioned that it's risky.
shmerl 12y ago
There is a major discussion now about GOG changing their TOS trying to prohibit reverse engineering and as well introducing DRM-like password restriction in their installer packages. See here: * https://www.gog.com/forum/general/please_fix_your_user_agreement_to_allow_reverse_engineering_and_tinkering_when_its_fair_use_to_ret https://www.gog.com/forum/general/please_fix_your_user_agree... * https://www.gog.com/wishlist/site/to_retain_your_drm_free_stance_please_fix_your_user_agreement_to_allow_reverse_engineering_and_tinkering_when_its_fair_use https://www.gog.com/wishlist/site/to_retain_your_drm_free_st... * https://www.gog.com/forum/general/on_gnulinux_has_anyone_be_able_to_extract_the_rar_innosetup_installers https://www.gog.com/forum/general/on_gnulinux_has_anyone_be_... * https://www.gog.com/wishlist/site/dont_slip_into_drm_swamp_stop_using_password_protection_on_installer_packages https://www.gog.com/wishlist/site/dont_slip_into_drm_swamp_s...
mrsteveman1 12y ago
This post comes at a perfect time for me, as I'm currently documenting the undocumented API of Ubiquiti's Airview2[1] device, a cheap ($39, 5 years ago) 2.4GHz spectrum analyzer USB stick, which they've now stopped selling and abandoned in every way. Just the other day I was pondering who to contact to determine whether my current method of figuring out how the undocumented API works (typing command guesses over the CDC-ACM serial interface in gtkterm) puts me at risk, but it doesn't look like it. I'm not dumping the firmware and don't have a copy of it, not decompiling the original software, there is no access control on the interface, no encryption, no handshake, no EULA on the hardware itself. Seems that I'm in the clear from what I can tell. I've gotten enough of the commands documented that I've been able to write a library based on what I've learned, and I'm hoping to publish my documentation and the code soon. It's been quite fun to figure out how it works so I and others can actually use these things in other software :) [1] http://dl.ubnt.com/newsletters/0112.html http://dl.ubnt.com/newsletters/0112.html

112 points by jcr 12y ago

lstor 12y ago

In Norway, we have an un-waverable right by law to reverse engineer computer systems for learning purposes. They are described in Åndsverkloven §§ 39h and 39i. Roughly translated excerpts: § 39h Whoever has the right to use a computer program, can copy, change and work on the program to the extent necessary in order to utilize the program in accordance with its purpose, including in order to correct errors in the program. Whoever has the right to use a copy of a computer program can, during such reading, screen display, running, transfer or storage of the program that the user has the right to do, monitor, examine or probe the working of the program in order to determine the ideas and principles on which the individual parts of the program is based. [This right is un-waverable] § 39i You are allowed to produce a copy of a computer program's code and translate the form of the code, when this is a prerequisite in order to produce the information necessary to achieve functional interaction between a self-developed program and other programs, if a) the actions are performed by a person who has the right to use a copy of a computer program, or acting on behalf of someone who do, b) the information is not already easily accessible, and c) the actions are limited to the parts of the original program necessary to achieve functional interaction. [A few limitations on utilization of the information] These rights are un-waverable.

gpvos 12y ago
Nice. The only problem I can see with this (I'm not a lawyer) is that I hope 39i.c is interpreted broadly - e.g., some tools disassemble an entire executable when you only need to look at a part.
- lstor 12y ago
  I don't know for sure, but anything else would surprise me, really.
userbinator 12y ago
It seems countries in Northern Europe have some of the most liberal laws on RE - I wonder if the fact that the demoscene (which originated from software cracking culture) being quite established in that area is related in any way, or the fact that a lot of security researchers, who by necessity have to RE, are also from around that area.
drdaeman 12y ago
> for learning purposes > A few limitations on utilization of the information I don't know how it is in Norway, but I see those clauses as problematic. There is not much point in reverse engineering a piece of software if you can't use the results freely, including implementation of directly "competing" software. That is, most of RE is just figuring out the data formats and protocols. And I fear that in too many jurisdictions one who had analyzed those can't also be the person who can legally write an alternate implementation, and a "clean-room engineering" is required.
- lstor 12y ago
  As far as I know there is no legal precedence (and I'm not a lawyer), but I think that figuring out data formats and protocols counts as "ideas and principles" -- which is okay. It's hard to say, really, courts aren't famous for showing any understanding of computer science. There is the DeCSS-case, which led to acquittal in Norwegian courts: http://en.wikipedia.org/wiki/DeCSS http://en.wikipedia.org/wiki/DeCSS
rertrree 12y ago
This reads like disassembly of programs is legal. What about publishing that information?

nnd 12y ago

I'm curious if non-US entities were ever prosecuted by US companies for reverse-engineering?

drdaeman 12y ago
Dmitry Sklyarov? http://en.wikipedia.org/wiki/United_States_v._ElcomSoft_and_Sklyarov http://en.wikipedia.org/wiki/United_States_v._ElcomSoft_and_...
- thekaleb 12y ago
  Were any successfully prosecuted?

lsiebert 12y ago

I'm curious if reverse engineering software which is classified or otherwise protected from disclosure by the force of government is legally risky. I presume doing so for those who have access to such software because of a security clearance might face a legal penalty under national security laws.

jcr 12y ago
Good question, particularly if interpreted in a very broad sense. The FCC is the portion of the US Fed Gov that handles things like validating the acceptable RF interference and frequency transmit/receive parameters of products. If you reverse engineer something, and the resulting reimplementation violates the FCC rules, then you'll have legal trouble. Similar would be true for Europe with the CE regulatory/testing body. For example, most wifi (802.11-) chipsets have "modes" for various countries due to the fact that the "freely available" RF spectrum varies from country to country. Though illegal (according to the FCC/CE/etc), it is often possible to make wifi chipsets use chunks of frequency that are not legally accessible (within some jurisdiction). This can be done via software (drivers) or firmware (blobs), as well as through the use of additional or modified hardware (amps, antennas, ...). When you get into "licensed spectrum" that is supposedly "owned" by a company like a mobile carrier, things get even more "legally risky" since messing around in those bands can wreak a lot of havoc. I don't know if the operation of the (mobile) baseband processors qualify as "classified" but such info is definitely protected from disclosure by both technical (hardware/software protections) and legal (contracts, NDA, etc.) means. Of course, using a self-modified baseband processor is definitely illegal since the device has not been tested and approved by the required regulatory body (FCC or CE), but the laws do have some limited exclusions/registrations for test/development purposes. If you cause problems for a carrier that spent many billions to own/license a chunk of spectrum, then you also open yourself up to civil liability for damages, in addition to the legal problems you'll have with the Fed Gov regulatory body. Needless to say, if you go mucking around in the frequency bands dedicated by law for use by the military or law enforcement, then you are going to have a whole lot of legal problems.
- TD-Linux 12y ago
  There is nothing "secret" about the operation of basebands, or what they put out on the air. This is just the companies protecting trade secrets, trying to avoid patent litigation, or just general open source averseness. Linux includes an open source regulatory information database that several open source wifi drivers use, so FCC licensing is not an issue for open source software either. It is not a form of DRM and does not require any "black boxing". Obviously you might be able to modify the software so you violate FCC rules, but you can also build your own radio transmitter and violate the FCC rules just as well. There's no special case for it being software. If you want to experiment on the radio bands, you can trivially get a ham radio license and modify the radio as you see fit, as long as you stay within the ham radio limits.

TeMPOraL 12y ago

Interestingly, four out of five court cases mentioned are from games industry.

Sir_Cmpwn 12y ago
The gaming industry is well known for exercising as much control as possible over their hardware and software. Console manufacturers want to control what runs on the console and software authors want to prevent piracy.

ck2 12y ago

Has EFF ever addressed if we have the right to root our phones? Because smartphones are getting more and more locked down, they have reached the point in late 2014 where many models simply cannot be rooted by 3rd parties. Note I am not talking about carrier unlocking, I mean root. I want full control over any device I use. It is like buying a car but not being allowed into the trunk.

shmerl 12y ago
It would depend on what exactly prevents you from getting root rights on your device. If it's DRM, to address that you'll need to fix DMCA-1201. Or more precisely, allow breaking DRM for any non infringing purpose. Right now it forbids it, and instead provides idiotic method of Librarian of Congress deciding what exceptions to grant. This corrupted law was passed undemocratically using backdoor method of WTO trade agreements.
- dragonwriter 12y ago
  > This corrupted law was passed undemocratically using backdoor method of WTO trade agreements. No, while the anticircumvention prevention is in a Title of the DMCA named for WIPO treaties that (among other treaties) were implemented in US law in other provisions of the title, the anticircumvention provision was not part of those treaties and, in any case, neither it nor any part of the DMCA was "passed" through trade agreements, the DMCA was passed through the normal legislative process.
  - shmerl 12y ago
    > the DMCA was passed through the normal legislative process. Wrong. First of all those treaties took place before DMCA (including 1201) was passed. And there was nothing normal about it. Normal process actually rejected such idiotic restriction outright (since DRM proponents first attempted to pass it normally). When they were kicked by normal democratic process, they turned to WIPO treaties which have no democratic oversight. Corruption there is much easier, so they squeezed anticircumvention provisions into such treaties affecting US. Then they turned back to the Congress and said: "you can't ignore your international obligations! Pass this law". And Congress passed it without much of opposition. That's not called a normal democratic process, it's called corruption and backdoor dealing. See: https://en.wikipedia.org/wiki/WIPO_Copyright_Treaty https://en.wikipedia.org/wiki/WIPO_Copyright_Treaty

shmerl 12y ago

What are fair use regulations in EU in general? Are they worse than in US? Also, how exactly does it work when contractual prohibitions try to take away fair use rights? What wins? In this FAQ it's only mentioned that it's risky.

shmerl 12y ago

There is a major discussion now about GOG changing their TOS trying to prohibit reverse engineering and as well introducing DRM-like password restriction in their installer packages. See here: * https://www.gog.com/forum/general/please_fix_your_user_agreement_to_allow_reverse_engineering_and_tinkering_when_its_fair_use_to_ret https://www.gog.com/forum/general/please_fix_your_user_agree... * https://www.gog.com/wishlist/site/to_retain_your_drm_free_stance_please_fix_your_user_agreement_to_allow_reverse_engineering_and_tinkering_when_its_fair_use https://www.gog.com/wishlist/site/to_retain_your_drm_free_st... * https://www.gog.com/forum/general/on_gnulinux_has_anyone_be_able_to_extract_the_rar_innosetup_installers https://www.gog.com/forum/general/on_gnulinux_has_anyone_be_... * https://www.gog.com/wishlist/site/dont_slip_into_drm_swamp_stop_using_password_protection_on_installer_packages https://www.gog.com/wishlist/site/dont_slip_into_drm_swamp_s...

mrsteveman1 12y ago

This post comes at a perfect time for me, as I'm currently documenting the undocumented API of Ubiquiti's Airview2[1] device, a cheap ($39, 5 years ago) 2.4GHz spectrum analyzer USB stick, which they've now stopped selling and abandoned in every way. Just the other day I was pondering who to contact to determine whether my current method of figuring out how the undocumented API works (typing command guesses over the CDC-ACM serial interface in gtkterm) puts me at risk, but it doesn't look like it. I'm not dumping the firmware and don't have a copy of it, not decompiling the original software, there is no access control on the interface, no encryption, no handshake, no EULA on the hardware itself. Seems that I'm in the clear from what I can tell. I've gotten enough of the commands documented that I've been able to write a library based on what I've learned, and I'm hoping to publish my documentation and the code soon. It's been quite fun to figure out how it works so I and others can actually use these things in other software :) [1] http://dl.ubnt.com/newsletters/0112.html http://dl.ubnt.com/newsletters/0112.html