Reverse Engineering

REVERSE ENGINEERING
INTRODUCTION
Reverse engineering (RE) is the process of discovering the technological principles of
a device, object or system through analysis of its structure, function and operation. It
often involves taking something (e.g., a mechanical device, electronic component, or
software program) apart and analying its workings in detail to be used in maintenance,
or to try to make a new device or program that does the same thing without copying
anything from the original.
Reverse engineering has its origins in the analysis of hardware for commercial or
military advantage. !he purpose is to deduce design decisions from end products with
little or no additional knowledge about the procedures involved in the original
production. !he same techni"ues are currently being researched for application to
legacy software systems, not for industrial or defense ends, but rather to replace
incorrect, incomplete, or otherwise unavailable documentation.
REASONS FOR REVERSE ENGINEERING
• Interoperability.
• #ost documentation$ Reverse engineering often is done because the
documentation of a particular device has been lost (or was never written), and
the person who built it is no longer available. Integrated circuits often seem to
have been designed on obsolete, proprietary systems, which means that the only
way to incorporate the functionality into new technology is to reverse%engineer
the e&isting chip and then re%design it.
• 'roduct analysis. !o e&amine how a product works, what components it consists
of, estimate costs, and identify potential patent infringement.
• (igital update)correction. !o update the digital version (e.g. CAD model) of an
object to match an *as%built* condition.
• +ecurity auditing.
• ,ilitary or commercial espionage. #earning about an enemy-s or competitor-s
latest research by stealing or capturing a prototype and dismantling it.
• Removal of copy protection, circumvention of access restrictions.
• .reation of unlicensed)unapproved duplicates.
• /cademic)learning purposes.
• .uriosity
• .ompetitive technical intelligence (understand what your competitor is actually
doing versus what they say they are doing)
• #earning$ learn from others- mistakes. (o not make the same mistakes that
others have already made and subse"uently corrected
PRODUCT DEVELOPMENT LIFE CYCLE
IDEA
Designin
g
Prototypin
g
Manufacturin
g
Productio
n
Maintenanc
e
Replaceme
nt with New
Product
REVERSE ENGINEERING FOR MILITARY APPLICATIONS
Reverse engineering is often used by militaries in order to copy other nations-
technologies, devices or information that have been obtained by regular troops in the
fields or by intelligence operations. It was often used during the +econd 0orld 0ar and
the .old 0ar. 0ell%known e&amples from 00II and later include
• Jerry can $ 1ritish and /merican forces noticed that the 2ermans had gasoline
cans with an e&cellent design. !hey reverse%engineered copies of those cans.
!he cans were popularly known as *3erry cans*.
• Tu!"ev Tu#$ $ !hree /merican 1%45 bombers on missions over 3apan were
forced to land in the 6++R. !he +oviets, who did not have a similar strategic
bomber, decided to copy the 1%45. 0ithin a few years, they had developed the
!u%7, a near%perfect copy.
• V% R!c&e' $ !echnical documents for the 84 and related technologies were
captured by the 0estern /llies at the end of the war. +oviet and captured
2erman engineers had to reproduce technical documents and plans, working
from captured hardware, in order to make their clone of the rocket, the R%9,
which began the postwar +oviet rocket program that led to the R%: and the
beginning of the space race.
• (#)*+R#*S ,issi"e -NATO re!r'ing na,e AA#% .A'!""/, a +oviet reverse%
engineered copy of the /I,%5 +idewinder, made possible after a !aiwanese /I,%
51 hit a .hinese ,i2%9: without e&ploding; amaingly, the missile became
lodged within the airframe, the pilot returning to base with what Russian
scientists would describe as a university course in missile development.
Testing
• 0GM#1) TO2 Missi"e $ In ,ay 95:<, negotiations between Iran and =ughes
,issile +ystems on co%production of the !>0 and ,averick missiles stalled over
disagreements in the pricing structure, the subse"uent 95:5 revolution ending all
plans for such co%production. Iran was later successful in reverse%engineering the
missile and are currently producing their own copy$ the !oophan .
• .hina has reversed many e&amples of >ccidental countries and Russian
hardware, from fighter aircraft to missiles and =,,08 cars.
REVERSE ENGINEERING OF MEC3ANICAL DEVICES
/s computer%aided design (./() has become more popular, reverse engineering has
become a viable method to create a ?( virtual model of an e&isting physical part for use
in ?( ./(, ./,, ./E and other software
@?A
. !he reverse%engineering process involves
measuring an object and then reconstructing it as a ?( model. !he physical object can
be measured using ?( scanning technologies like .,,s, laser scanners, structured
light digitiers or computed tomography. !he measured data alone, usually represented
as a point cloud, lacks topological information and is therefore often processed and
modeled into a more usable format such as a triangular%faced mesh, a set of B6R1+
surfaces or a ./( model.
!he point clouds produced by ?( scanners are usually not used directly since they are
very large unwieldy data sets, although for simple visualiation and measurement in the
architecture and construction world, points may suffice. ,ost applications instead use
polygonal ?( models, B6R1+ surface models, or editable feature%based ./( models
(aka solid modeling). !he process of converting a point cloud into a usable ?( model in
any of the forms described above is called C modeling D .
• POLYGON MES3 MODELS $ In a polygonal representation of a shape, a curved
surface is modeled as many small faceted flat surfaces (think of a sphere
modeled as a disco ball). 'olygon models %% also called ,esh models, are useful
for visualiation, for some ./, (i.e., machining), but are generally *heavy* ( i.e.,
very large data sets), and are relatively un%editable in this form. Reconstruction to
polygonal model involves finding and connecting adjacent points with straight
lines in order to create a continuous surface. ,any applications are available for
this purpose (eg. kubit 'oint.loud for /uto./(, photomodeler, imagemodel,
'oly0orks, Rapidform, 2eomagic, Imageware, Rhino, etc.).
• SURFACE MODELS $ !he ne&t level of sophistication in modeling involves
using a "uilt of curved surface patches to model our shape. !hese might be
B6R1+, !+plines or other representations of curved topology using higher
ordered polynomials (i.e, curved, not straight). 6sing B6R1+, our sphere is a
true mathematical sphere. +ome applications offer patch layout by hand but the
best in class offer both automated patch layout and manual layout. !hese
patches have the advantage of being lighter and more manipulable when
e&ported to ./(. +urface models are somewhat editable, but only in a sculptural
sense of pushing and pulling to deform the surface. !his representation lends
itself well to modeling organic and artistic shapes. 'roviders of surface modelers
include BE, Imageware, Rapidform, 2eomagic, Rhino, ,aya, ! +plines etc.
• SOLID CAD MODELS $ From an engineering)manufacturing perspective, the
ultimate representation of a digitied shape is the editable, parametric ./(
model. /fter all, ./( is the common *language* of industry to describe, edit and
maintain the shape of the enterprise-s assets. In ./(, our sphere is described by
parametric features which are easily edited by changing a value(e.g., centerpoint
and radius).
!hese ./( models describe not simply the envelope or shape of the object, but ./(
models also embody the *design intent* (i.e., critical features and their relationship to
other features). /n e&ample of design intent not evident in the shape alone might be a
brake drum-s lug bolts, which must be concentric with the hole in the center of the drum.
!his knowledge would drive the se"uence and method of creating the ./( model; a
designer with an awareness of this relationship would not design the lug bolts
referenced to the outside diameter, but instead, to the center. / modeler creating a ./(
model will want to include both +hape and design intent in the complete ./( model.
8endors offer different approaches to getting to the parametric ./( model. +ome
e&port the B6R1+ surfaces and leave it to the ./( designer to complete the model in
./((e.g., Geomagic, Imageware, Rhino). >thers use the scan data to create an
editable and verifiable feature based model that is imported into ./( with full feature
tree intact, yielding a complete, native ./( model, capturing both shape and design
intent (e.g. Rapidform). +till other ./( applications are robust enough to manipulate
limited points or polygon models within the ./( environment (e.g., Catia).
Reverse engineering is also used by businesses to bring e&isting physical geometry into
digital product development environments, to make a digital ?( record of their own
products or to assess competitors- products. It is used to analye, for instance, how a
product works, what it does, and what components it consists of, estimate costs, and
identify potential patent infringement, etc.
8alue engineering is a related activity also used by businesses. It involves
deconstructing and analying products, but the objective is to find opportunities for cost
cutting.
?( scanner
/ *D scanner is a device that analyes a real%world object or environment to collect
data on its shape and possibly its appearance (i.e. color). !he collected data can then
be used to construct digital, three dimensional models useful for a wide variety of
applications. !hese devices are used e&tensively by the entertainment industry in the
production of movies and video games. >ther common applications of this technology
include industrial design, orthotics and prosthetics, reverse engineering and prototyping,
"uality control)inspection and documentation of cultural artifacts.
,any different technologies can be used to build these ?( scanning devices; each
technology comes with its own limitations, advantages and costs. It should be
remembered that many limitations in the kind of objects that can be digitied are still
present$ for e&ample optical technologies encounter many difficulties with shiny,
mirroring or transparent objects.
!here are however methods for scanning shiny objects, such as covering them with a
thin layer of white powder that will help more light photons to reflect back to the scanner.
#aser scanners can send trillions of light photons toward an object and only receive a
small percentage of those photons back via the optics that they use. !he reflectivity of
an object is based upon the object-s color or terrestrial albedo. / white surface will
reflect lots of light and a black surface will reflect only a small amount of light.
!ransparent objects such as glass will only refract the light and give false three
dimensional information.
!he purpose of a ?( scanner is usually to create a point cloud of geometric samples on
the surface of the subject. !hese points can then be used to e&trapolate the shape of
the subject (a process called reconstruction). If color information is collected at each
point, then the colors on the surface of the subject can also be determined.
?( scanners are very analogous to cameras. #ike cameras, they have a cone%like field
of view, and like cameras, they can only collect information about surfaces that are not
obscured. 0hile a camera collects color information about surfaces within its field of
view, ?( scanners collect distance information about surfaces within its field of view.
!he CpictureD produced by a ?( scanner describes the distance to a surface at each
point in the picture. If a spherical coordinate system is defined in which the scanner is
the origin and the vector out from the front of the scanner is GHI and JHI, then each
point in the picture is associated with a G and J. !ogether with distance, which
corresponds to the r component, these spherical coordinates fully describe the three
dimensional position of each point in the picture, in a local coordinate system relative to
the scanner.
For most situations, a single scan will not produce a complete model of the subject.
,ultiple scans, even hundreds, from many different directions are usually re"uired to
obtain information about all sides of the subject. !hese scans have to be brought in a
common reference system, a process that is usually called alignment or registration,
and then merged to create a complete model. !his whole process, going from the single
range map to the whole model, is usually known as the ?( scanning pipeline.
Tec4n!"!gy
!he two types of ?( scanners are contact and non%contact. Bon%contact ?( scanners
can be further divided into two main categories, active scanners and passive scanners.
!here are a variety of technologies that fall under each of these categories.
C!n'ac'
.ontact ?( scanners probe the subject through physical touch. / .,, (coordinate
measuring machine) is an e&ample of a contact ?( scanner. It is used mostly in
manufacturing and can be very precise. !he disadvantage of .,,s though, is that it
re"uires contact with the object being scanned. !hus, the act of scanning the object
might modify or damage it. !his fact is very significant when scanning delicate or
valuable objects such as historical artifacts. !he other disadvantage of .,,s is that
they are relatively slow compared to the other scanning methods. 'hysically moving the
arm that the probe is mounted on can be very slow and the fastest .,,s can only
operate on a few hundred hert. In contrast, an optical system like a laser scanner can
operate from 9I to <II k=.
>ther e&amples are the hand driven touch probes used to digitie clay models in
computer animation industry.
Bon%.ontact /ctive
/ctive scanners emit some kind of radiation or light and detect its reflection in order to
probe an object or environment. 'ossible types of emissions used include light,
ultrasound or &%ray.
N!n#c!n'ac' assive
'assive scanners do not emit any kind of radiation themselves, but instead rely on
detecting reflected ambient radiation. ,ost scanners of this type detect visible light
because it is a readily available ambient radiation. >ther types of radiation, such as
infrared could also be used. 'assive methods can be very cheap, because in most
cases they do not need particular hardware.
Time-of-flight
!his lidar scanner may be used to scan buildings, rock formations, etc., to produce a ?(
model. !he lidar can aim its laser beam in a wide range$ its head rotates horiontally, a
mirror flips vertically. !he laser beam is used to measure the distance to the first object
on its path .
!he time%of%flight ?( laser scanner is an active scanner that uses laser light to probe the
subject. /t the heart of this type of scanner is a time%of%flight laser rangefinder. !he
laser rangefinder finds the distance of a surface by timing the round%trip time of a pulse
of light. / laser is used to emit a pulse of light and the amount of time before the
reflected light is seen by a detector is timed. +ince the speed of light c is a known, the
round%trip time determines the travel distance of the light, which is twice the distance
between the scanner and the surface. If t is the round%trip time, then distance is e"ual to
. !he accuracy of a time%of%flight ?( laser scanner depends on how precisely
we can measure the t time$ ?.? picoseconds (approx.) is the time taken for light to travel
9 millimetre.
!he laser rangefinder only detects the distance of one point in its direction of view.
!hus, the scanner scans its entire field of view one point at a time by changing the
range finderKs direction of view to scan different points. !he view direction of the laser
rangefinder can be changed by either rotating the range finder itself, or by using a
system of rotating mirrors. !he latter method is commonly used because mirrors are
much lighter and can thus be rotated much faster and with greater accuracy. !ypical
time%of%flight ?( laser scanners can measure the distance of 9I,IIIL9II,III points
every second.
In 4II5,the !ime%of%flight camera became commercially available. In this configuration,
a sensor chip has multiple sensors on it like on a .harge%coupledMdevice. !he light
pulse can be generated with integrated #E(-s on the sensor chip itself, or by e&ternal
#E(-s located near the sensor. Each sensor pi&el on the chip makes an independent
time%of%flight distance measurement. +ee this blog article$ Bew ?( ,easurement !ool.
PROTOTYPING
/ r!'!'ye is an original type, form, or instance of something serving as a typical
e&ample, basis, or standard for other things of the same category.
DESIGN AND MODELING
In many fields, there is great uncertainty as to whether a new design will actually do
what is desired. Bew designs often have une&pected problems. / prototype is often
used as part of the product design process to allow engineers and designers the ability
to e&plore design alternatives, test theories and confirm performance prior to starting
production of a new product. Engineers use their e&perience to tailor the prototype
according to the specific unknowns still present in the intended design. For e&ample,
some prototypes are used to confirm and verify consumer interest in a proposed design
where as other prototypes will attempt to verify the performance or suitability of a
specific design approach.
In general, an iterative series of prototypes will be designed, constructed and tested as
the final design emerges and is prepared for production. 0ith rare e&ceptions, multiple
iterations of prototypes are used to progressively refine the design. / common strategy
is to design, test, evaluate and then modify the design based on analysis of the
prototype.
In many products it is common to assign the prototype iterations 2reek letters. For
e&ample, a first iteration prototype may be called an */lpha* prototype. >ften this
iteration is not e&pected to perform as intended and some amount of failures or issues
are anticipated. +ubse"uent prototyping iterations (1eta, 2amma, etc.) will be e&pected
to resolve issues and perform closer to the final production intent.
In many product development organiations, prototyping specialists are employed %
individuals with specialied skills and training in general fabrication techni"ues that can
help bridge between theoretical designs and the fabrication of prototypes.
0asic Pr!'!'ye Ca'eg!ries
!here is no general agreement on what constitutes a *prototype* and the word is often
used interchangeably with the word *model* which can cause confusion. In general,
CprototypesD fall into four basic categories$
Pr!!5#!5#Princi"e Pr!'!'ye -M!6e"/ (also called a readoard). !his type of
prototype is used to test some aspect of the intended design without attempting to
e&actly simulate the visual appearance, choice of materials or intended manufacturing
process. +uch prototypes can be used to CproveD out a potential design approach such
as range of motion, mechanics, sensors, architecture, etc. !hese types of models are
often used to identify which design options will not work, or where further development
and testing is necessary.
F!r, S'u6y Pr!'!'ye -M!6e"/7 !his type of prototype will allow designers to e&plore
the basic sie, look and feel of a product without simulating the actual function or e&act
visual appearance of the product. !hey can help assess ergonomic factors and provide
insight into visual aspects of the product-s final form. Form +tudy 'rototypes are often
hand%carved or machined models from easily sculpted, ine&pensive materials (e.g.,
urethane foam), without representing the intended color, finish, or te&ture. (ue to the
materials used, these models are intended for internal decision making and are
generally not durable enough or suitable for use by representative users or consumers.
Visua" Pr!'!'ye -M!6e"/ will capture the intended design aesthetic and simulate the
appearance, color and surface te&tures of the intended product but will not actually
embody the function(s) of the final product. !hese models will be suitable for use in
market research, e&ecutive reviews and approval, packaging mock%ups, and photo
shoots for sales literature.
Func'i!na" Pr!'!'ye -M!6e"/ (also called a wor!ing protot"pe) will, to the greatest
e&tent practical, attempt to simulate the final design, aesthetics, materials and
functionality of the intended design. !he functional prototype may be reduced in sie
(scaled down) in order to reduce costs. !he construction of a fully working full%scale
prototype and the ultimate test of concept, is the engineers- final check for design flaws
and allows last%minute improvements to be made before larger production runs are
ordered.
Di55erences 8e'9een a r!'!'ye an6 a r!6uc'i!n 6esign
In general, prototypes will differ from the final production variant in three fundamental
ways$
Pr!'!'yes are !5'en c!ns'ruc'e6 via n!n#r!6uc'i!n in'en' ,a'eria"s. 'roduction
materials may re"uire manufacturing processes involving higher capital costs than what
is practical for prototyping. Instead, engineers of prototyping specialists will attempt to
substitute materials with properties that simulate the intended final material.
Pr!'!'yes are genera""y c!ns'ruc'e6 via n!n#r!6uc'i!n in'en' ,anu5ac'uring
r!cesses. >ften e&pensive and time consuming uni"ue tooling is re"uired to fabricate
a custom design. 'rototypes will often compromise by using more fle&ible processes.
Pr!'!'yes are genera""y c!ns'ruc'e6 5r!, a 6esign '4a' 4as 8een 6eve"!e6 '! a
"!9er "eve" !5 5i6e"i'y '4an r!6uc'i!n in'en'. Final production designs often re"uire
e&tensive effort to capture high volume manufacturing detail. +uch detail is generally
unwarranted for prototypes as some refinement to the design is to be e&pected. >ften
prototypes are built using very limited engineering detail as compared to final production
intent.
MEC3ANICAL AND ELECTRICAL ENGINEERING
/ prototype of the 'olish economy hatchback car 1eskid 9IN designed in the 95OIs
,ain article$ rapid prototyping
!he most common use of the word prototype is a functional, although e&perimental,
version of a non%military machine (e.g., automoiles, domestic appliances, consumer
electronics) whose designers would like to have built by mass production means, as
opposed to a mockup, which is an inert representation of a machine-s appearance,
often made of some non%durable substance.
/n electronics designer often builds the first prototype from breadboard or stripboard or
perfboard, typically using *(I'* packages. =owever, more and more often the first
functional prototype is built on a *prototype '.1* almost identical to the production
'.1, as '.1 manufacturing prices fall and as many components are not available in
(I' packages, but only available in +,! packages optimied for placing on a '.1.
1uilders of military machines and aviation prefer the terms *e&perimental* and *service
test*.
MANUFACTURING
CNC MILLING
Nu,erica" c!n'r!" (NC) refers to the automation of machine tools that are operated by
abstractly programmed commands encoded on a storage medium, as opposed to
manually controlled via handwheels or levers or mechanically automated via cams
alone. !he first B. machines were built in the 957Is and <Is, based on e&isting tools
that were modified with motors that moved the controls to follow points fed into the
system on paper tape. !hese early servomechanisms were rapidly augmented with
analog and digital computers, creating the modern c!,u'er nu,erica" c!n'r!""e6
(CNC) machine tools that have revolutionied the design process.
In modern .B. systems, end%to%end component design is highly automated using
./()./, programs. !he programs produce a computer file that is interpreted to
e&tract the commands needed to operate a particular machine, and then loaded into the
.B. machines for production. +ince any particular component might re"uire the use of
a number of different tools % drills, saws, etc. % modern machines often combine multiple
tools into a single *cell*. In other cases, a number of different machines are used with an
e&ternal controller and human or
robotic operators that move the
component from machine to
machine. In either case the
comple& series of steps needed to
produce any part is highly automated and produces a part that closely matches the
original ./( design.

.B. lathe ) .B. turning center
.B. lathes are rapidly replacing the older production lathes (multispindle, etc) due to
their ease of setting and operation. !hey are designed to use modern carbide tooling
and fully utilie modern processes. !he part may be designed and the toolpaths
programmed by the ./()./, process, and the resulting file uploaded to the machine,
and once set and trialled the machine will continue to turn out parts under the
occasional supervision of an operator.
!he machine is controlled electronically via a computer menu style interface, the
program may be modified and displayed at the machine, along with a simulated view of
the process. !he setter)operator needs a high level of skill to perform the process,
however the knowledge base is broader compared to the older production machines
where intimate knowledge of each machine was considered essential. !hese machines
are often set and operated by the same person, where the operator will supervise a
small number of machines (cell).
!he design of a .B. lathe has evolved yet again however the basic principles and
parts are still recogniable, the turret holds the tools and inde&es them as needed. !he
machines are often totally enclosed, due in large part to >ccupational health and safety
(>=P+) issues.
0ith the advent of cheap computers, free operating systems such as #inu&, and open
source .B. software, the entry price of .B. machines has plummeted. For e&ample,
+herline makes a desktop .B. lathe that is affordable by hobbyists.