The challenge behind the engagement.
Binary reverse engineering helps you understand compiled software when source code is unavailable or incomplete. We inspect authorized executables, libraries, and firmware images to explain selected behavior and assess security risks. We identify file structure and dependencies, reconstruct important functions, trace data handling and security checks, and compare versions where that answers your question. Static analysis comes first; agreed behavior testing runs only in an isolated environment. The principal reviews AI-assisted analysis and validates reported conclusions against the binary or observed behavior. You receive an annotated function and behavior map, evidence-backed findings, documented uncertainties, and remediation guidance with scoped retesting of remediated findings. We confirm supported formats and architectures before starting; original source recovery and complete coverage are not promised.
For product owners, engineering leaders, and security teams who need to understand an authorized binary before a release, acquisition, integration, or targeted security review when source code is unavailable.
What we do.
What you can use.
Confirm files and analysis questions
We record the approved binaries, versions, and file fingerprints in a scope sheet. You provide authorization, available documentation, and any test environment. We agree the functions to investigate, supported formats, handling restrictions, and whether isolated execution or external AI services are permitted.
Trace and validate compiled behavior
We inspect the binary without running it, annotate selected functions, and trace how inputs reach security-sensitive operations. Where agreed, isolated behavior testing checks the interpretation. The principal validates AI-assisted suggestions against code and evidence, separating observed behavior from conclusions that remain uncertain.
Deliver findings and an analysis map
You keep an annotated function and behavior map, the reviewed file inventory, and security findings with locations, evidence, reproduction steps, and fixes. We explain analysis limits in the report and walk engineering through results. Remediated findings receive a scoped retest when you supply an updated binary and test setup.
Who it’s for.
When you need it.
- Product owners responsible for compiled applications whose source code is missing or incomplete
- Engineering teams maintaining legacy executables or libraries with limited internal documentation
- Security teams evaluating sensitive behavior inside authorized third-party software components
- Device manufacturers needing focused analysis of supplied firmware images before broader hardware testing
- A security review identifies a compiled component that cannot be assessed through source review
- An acquisition or handover leaves critical software without reliable implementation documentation
- An update changes security-sensitive behavior and you need the differences explained
- A customer asks for evidence about data handling or security checks inside shipped binaries
What the scope can include.
- 01
Record authorized binary versions, file fingerprints, analysis objectives, and approved handling conditions
- 02
Confirm executable formats, processor architectures, dependencies, and available testing access before analysis
- 03
Inspect selected functions, data flows, embedded secrets, and security checks without source code
- 04
Compare agreed software versions to explain relevant changes in behavior or security controls
- 05
Validate selected behavior in an isolated test environment when execution is authorized and feasible
- 06
Document confirmed findings, uncertain interpretations, coverage limits, and remediation verification steps
What it typically costs.
One rate: $150/hour.
Every engagement is priced by the hours it takes at one flat rate, with scoping, the work, and reporting, plus a retest of your fixes, included. Find the size closest to yours.
One supplied executable or library, one agreed security or behavior question, and a supported architecture
About 24–40 hoursOne application component with related binaries, several security questions, and targeted runtime validation
About 56–88 hoursSeveral connected binaries or a complex component requiring deeper behavior reconstruction and validation
About 100–160 hours- Number of binaries, versions, architectures, and security questions in scope
- Packing, obfuscation, missing symbols, and other barriers to analysis
- Availability of a working test environment, dependencies, and representative inputs
- Depth of runtime validation, reporting, and agreed remediation checks
1–5 weeks after access and scope are confirmed; complex or protected targets may take longer
Discovery confirms feasibility and the analysis boundary before a fixed quote. Estimates cover supplied binaries; hardware teardown and firmware extraction require a separate scope. Binary reverse engineering is a separate project from routine vendor reviews and bundled annual penetration testing.
Get a fixed quote for your scopeRanges are planning estimates at $150/hour, not a quote. Your price is confirmed in writing after a scoping call, before any work begins.
What you take forward.
- Annotated function and behavior map tied to the reviewed binary versions and file fingerprints
- Security findings with relevant file locations, evidence, impact, reproduction steps, and remediation guidance
- Analysis report separating confirmed behavior, inferred conclusions, unexamined areas, and constraints
- Scoped retest evidence for remediated findings when updated binaries and a test setup are supplied
Final coverage, deliverables, timing, and any retesting or implementation work are confirmed before the engagement begins.
Before we get started.
What do you need, and can you recover the original source?
We need the files you are authorized to have analyzed, the questions you want answered, and any available version details, documentation, or test setup. We confirm format and architecture support before committing to the scope. Decompiled output helps explain behavior but does not restore the original source, comments, or exact design. Encryption, packing, missing dependencies, and anti-analysis protections can limit coverage. We document those constraints and agree priorities before proceeding.
How does this differ from vendor or device testing?
This service investigates selected functions and behavior inside supplied binaries. Vendor assessment supports a buying or integration decision by reviewing the supplier, product posture, and requested access. Device testing includes hardware, connections, and supporting applications; extracting firmware from hardware needs its own agreed scope. Binary analysis can support either engagement when added explicitly. AI may assist analysis, but the principal validates conclusions; client files or derived code go to external AI services only with your approval.
- NIST SP 800-115: Technical Guide to Information Security Testing and Assessment
- OWASP Web Security Testing Guide
- OWASP Top 10 API Security Risks – 2023
- Common Vulnerability Scoring System version 4.0: Specification Document
- NIST SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security
- Penetration Testing - Amazon Web Services (AWS)
- Ghidra Software Reverse Engineering Framework