review articles

DOI:10.1145/ 1924421.1924451
software life cycle costs is due to main-
Deeply understanding the intricacies tenance and support; while figures
vary, there is a general agreement in
of software must always come before the software industry that the propor-
any considerations for modifying it. tion is well over 50% of software costs.
The need for modifying software
BY GERARDO CANFORA, MASSIMILIANO DI PENTA, induces the need to comprehend it.
AND LUIGI CERULO Software comprehension is a human-
intensive process, where developers
acquire sufficient knowledge about a

Achievements
software artifact, or an entire system,
so as to be able to successfully accom-
plish a given task, by means of analysis,
guessing, and formulation of hypoth-

and
eses. In most cases, software compre-
hension is challenged by the lack of
adequate and up-to-date software doc-
umentation, often due to limited skills

Challenges
or to resource and timing constraints
during development activities.
Software reverse engineering is a
broad term that encompasses an array

in Software
of methods and tools to derive infor-
mation and knowledge from existing
software artifacts and leverage it into
software engineering processes. In a
seminal paper, Chikofsky and Cross12

Reverse define software reverse engineering as

“the process of analyzing a subject sys-
tem to identify the system’s components
and their inter-relationships and create

Engineering representations of the system in another

form or at a higher level of abstraction.”
In accordance with this definition, re-
verse engineering is a process of exami-
nation rather than a process of change,

key insights
When maintaining a software system,
often the only reliable information is
T H E NEED F ORchanging existing software has been embedded in its source code. Reverse
engineering aims at creating high-level
with us since the first programs were written. After representations for an existing software
system to support comprehension and
the pioneering work of Lehman30 we know that evolution.

real-world software systems require continuous Understanding software consumes a

substantial portion of the maintenance
change and enhancement to satisfy new user effort; nevertheless, such a task is often
performed with simple general-purpose
requirements and expectations, to adapt to new tools, such as editors and regular-
and emerging business models and organizations, expression matchers.

to adhere to changing legislation, to cope with Available reverse engineering tools

help to: extract facts from source code/
technology innovation, and to preserve the system binaries, execution traces, or historical
data; query the extracted facts; and build
structure from deterioration. A major proportion of high-level views for humans.

142 COMM UNICATIO NS O F T H E AC M | A P R I L 201 1 | VO L . 5 4 | NO. 4

 as the core of reverse engineering is and design patterns, re-documenting During the last decade, the Y2K and
deriving, from available software arti- programs and database, identifying the Euro problems focused the world’s
facts, representations understandable reusable assets, building traceability attention on system evolution issues,
by humans. between software artifacts, computing demonstrating the maturity of reverse
Software reverse engineering origi- change impacts, re-modularizing exist- engineering as an effective support to
nated in software maintenance: the ing systems, renewing user interfaces, face difficult and critical problems. In
standard IEEE-1219a recommends migrating toward new architectures such context, reverse engineering was
reverse engineering as a key support- and platforms.9 used, above all, to locate features that
ing technology to deal with systems To support such a wide range of needed modifications, and to evaluate
that have the source code as the only applications, many different types of the impact of such modifications. Suc-
reliable representation. Since then, tools have been developed either in cess stories of reverse engineering can
ILLUSTRATION BY A ND REAS KÖBERLE

it has been successfully exploited to academia or industry, including pretty be seen every day, when organizations:
deal with numerous software engi- printers, static and dynamic code ana-  Keep their development costs un-
neering problems. A non-exhaustive lyzers, and tools for code visualization der control by integrating commercial-
list includes: recovering architectures and exploration, design recovery, docu- off-the-shelf;
ments and diagrams generation, and,  Components into existing soft-

a The IEEE SA-1219-1988 IEEE Standard for more recently, for mining software re- ware systems;
Software Maintenance. positories.  Gain competitive advantages by

A P R I L 2 0 1 1 | VO L. 54 | N O. 4 | C OM M U N IC AT ION S OF T H E ACM 143

review articles

Reverse engineering concepts.

cd: RE Core Model

Evolution History Revision

+ resolves

+ evolves as
Execution Trace * Executable Change Request + assigned to

+ produces + uses + submits

Chikofsky and Cross Process

Software Artifact

+ is developed by

Software Engineer
+ analyzes
+ explores
Analyzer Information Base Software View
+ populates

+ queries
Abstractor provides
+ creates
feedback

Recommendation
Hybrid Analyzer Static Analyzer Dynamic Analyzer Historical Analyzer System

moving existing systems to the Web; engineering concepts and describe the solve some specific problems related
 Maintain software systems in line main challenges and achievements. We to a software product, consisting of
with the business evolution by prepar- also provide references to relevant and software artifacts (for example, source
ing existing systems for fruition as a set available tools for the two major activi- code, executables, project documenta-
of services within a service oriented in- ties of a reverse engineering process,12 tion, test cases, and change requests).
frastructure; for example, performing software Software engineers benefit of reverse
 Cope with the growing complexity analysis and building software views, engineering by exploring software arti-
of today’s systems-of-systems by inject- respectively. Finally, we outline future facts by means of software views, repre-
ing adaptation and self-management trends of reverse engineering in to- sentations, sometimes visual, aimed at
capabilities into existing systems; and day’s’ software engineering landscape. increasing the current comprehension
 Maintain software investments in of a software product, or at favoring
line with the organization strategies Reverse Engineering Concepts maintenance and evolution activities.
by thorough software portfolio man- The accompanying figure shows a Software views are built by means of an
agement. conceptual model for software reverse abstractor, which in turn uses informa-
In this article we discuss—with engineering as a UML class diagram. tion extracted from software artifacts
no ambition to provide an exhaus- This model stems from the Chikofsky and stored in the information base by
tive survey—developments of broad and Cross view of the reverse engineer- an analyzer. Often reverse engineer-
significance in the field of reverse en- ing process, highlighted in the gray ing aims at analyzing the evolution of
gineering, and highlight unresolved area in the figure. As described in the software artifacts across their revisions,
questions and future directions. We model, a reverse engineering activity which occur to satisfy change requests.
summarize the most important reverse is performed by a software engineer to The analyzers can extract informa-

144 COM MUNICATIO NS O F TH E ACM | A P R I L 201 1 | VO L . 5 4 | NO. 4

 review articles

tion by means of static analysis (static of preprocessor directives where these

analyzers), dynamic analysis (Dynamic are foreseen by the programming lan-
Analyzers) or a combination of the two guage. Whenever we do not need a
(hybrid analyzers). Recently, historical complete parsing, but rather to extract
analyzers, which extract information some specific information, we can use
from the evolution repository of a soft- Software island and lake parsers.35 Island pars-
ware product, are gaining a growing
popularity.
comprehension ers only parse source code fragments
of interest, ignoring any other token
The software engineer can provide is a human- and activating the parser only when to-
feedbacks to the reverse engineering
tool with the aim of producing refined
intensive process, kens of interest are encountered. Lake
parsers, instead, are able to ignore
and more precise views. A particular where developers source code fragments not contem-
type of software view that emerged re-
cently are recommendation systems,39
acquire sufficient plated by the grammar, such as, relat-
ed to programming language dialects.
which provide suggestions to the soft- knowledge Tools such as TXL15 or SrcML14 allow for
ware engineer and, if needed, trigger a a robust source code island parsing.
new change request. about a software Whenever the source code is not avail-
artifact or system able, decompilation tools are needed
Software Analysis to perform the analysis.13
Software analysis is performed by ana- to successfully  Ability to extract facts useful for re-
lyzers—tools that take software arti-
facts as input and extract information
accomplish a given verse engineering tasks. Sometimes we
do not need to build a complete pro-
relevant to reverse engineering tasks. task, by means of gram Abstract Syntax Tree (AST), but
Software analysis can be: static, when
it is performed, within a single system
analysis, guessing, rather to populate the information
base with information relevant for a
snapshot, on software artifacts with- and formulation of particular reverse engineering task.
out requiring their execution; dynamic, Fact extractors such as the Bauhaus
when it is performed by analyzing ex-
hypotheses. fact extractor26 or Columbus19 extract
ecution traces obtained from the ex- facts—for example, dependencies,
ecution of instrumented versions of a metrics—from the source code and
program, or by using an execution en- store them in an information base. Ap-
vironment able to capture facts from proaches such as the one by Kuhn et
program executions; and historical, al.28 consider the source code as text,
when the aim is to gain information and extract fact from it by indexing the
about the evolution of the system un- terms it contains.
der analysis by considering the chang-  Ability to extract a program’s se-
es performed by developers to software mantics. This entails the ability of an-
artifacts, as recorded by versioning sys- alyzers to go beyond the simple AST
tems. David Binkley6 has written a thor- extraction, by performing a set of anal-
ough survey on source code analysis. yses that are indispensable for many
Static analyzers must deal with a reverse engineering tasks.
number of challenges: Tools such as CodeSurfer1 allow to
 Ability to parse different language perform a series of analyses related to
variants and non-compilable code. The a program’s semantics, such as con-
diffusion of a wide number of pro- trol dependence analysis, data flow
gramming languages dialects and im- analysis, or pointer analysis, and then
plicit characteristics of programming build views on top of these analyses,
languages, for example the presence for example, aimed at represent a pro-
of preprocessor directives and mac- gram slice or to highlight the impact of
ros, makes the life of reverse engineers a change.
not easy. In some cases it is necessary Static analysis is reasonably fast,
to analyze partial fragments of source precise, and cheap. However, many pe-
code violating the assumption of pars- culiarities of programming languages,
ers: this might be the case, for exam- such as pointers and polymorphism,
ple, of a snapshot downloaded from a or dynamic class loading, make static
versioning system. analysis difficult and sometimes im-
There are tools such as the Design precise. In addition, the extraction of
Maintenance Systems (DMS)3 that per- some specific information related, for
form a complete parsing of the source instance, to the interaction of a user
code, also contemplating the presence with the application or to the sequence

A P R I L 2 0 1 1 | VO L. 54 | N O. 4 | C OM M U N IC AT ION S OF T H E ACM 145

review articles

of messages exchanged between ob- source code, but just execute the de-
jects, is difficult, if not infeasible, to ployed application.
perform statically. Some approaches31 reverse engineer
To overcome the limitations of properties of a deployed service relying
static analysis, reverse engineers can only on the observed outputs, without
count on dynamic analysis, which ex- Software analysis the need for source code analysis.
tracts information from execution is performed by The growing diffusion of version-
traces. For many reverse engineering
tasks, it is beneficial to combine static analyzers—tools ing systems, bug tracking systems,
and other software repositories, such
and dynamic analysis, as static analy-
sis can be imprecise, for example, not
that take software as mailing lists or security advisories,
poses the basis for a third dimension
able to fully deal with aspects such artifacts as input of software analysis, namely the histori-
as pointer resolution, while dynamic
analysis can be incomplete, because
and extract cal analysis of data extracted from soft-
ware repositories. Historical analysis is
it depends on program inputs. An ex- information complementary to static and dynamic
tensive survey of dynamic analysis ap- analysis, in that it allows us to under-
proaches for the specific purpose of
relevant to reverse stand how an artifact was modified
program comprehension can be found engineering tasks. over time, when it was changed, why
in Cornelissen et al.16 it was changed, who changed it, and
Key challenges of dynamic analysis what artifacts changed together. (For a
include: thorough survey on historical analysis
 Ability to compile and execute the see Kagdi et al.24) While mining soft-
program, which might appear as ob- ware repositories opens challenging
vious, however it is not always true if research directions, such sources of in-
we want to analyze an intermediate formation must be used with particular
version of a program. Again, this can care. Among others, in a recent round-
happen when analyzing an incomplete table of mining software repositories
snapshot grabbed from a versioning experts,21 Notkin warned against the
system. flourishing of mining software reposi-
 Ability to choose representative in- tory studies able to find relationships in
puts, as the results of dynamic analysis and among repositories, that, although
strongly depend on the inputs used to significant, are not causal, or cannot
execute the subject system. lead to improved approaches and tools
For some reverse engineering tasks, to develop better software systems.
it may be necessary to perform a thor- Also, Mockus pointed out that informa-
ough coverage of the application code tion about software projects cannot be
or functionality, while in other cases fully observed from versioning systems
it would be more appropriate to ex- and problem reporting systems only.
ecute the program under a realistic Historical analysis poses a series of
execution scenarios, where the most challenges related to:
frequently used features are exercised  Ability to classify and combine in-
more than others. formation from different, heterogeneous
 Ability to mine relevant information software repositories. For example, inte-
from execution traces. Execution traces grating different repositories requires
tend to quickly become large and un- linking a change committed in a ver-
manageable, thus a relevant challenge sioning system with an issue posted on
is to filter them and extract informa- a bug-tracking system.
tion relevant for the particular under- A widely used heuristic aims at
standing task being performed. matching the bug tracking IDs to ver-
Approaches such as the one pro- sioning system commit notes. Another
posed by Hassan et al.23 aim at filtering problem historical analysis must deal
the execution traces and mining recur- with is the accuracy of the available
ring patterns to analyze the applica- information, for example, of the way
tion’s operational profiles, and tools issues posted on bug tracking systems
like Daikon18 identify likely invariants are classified and prioritized.
by analyzing execution traces.  Ability to analyze differences. The
 Ability to perform a black-box analy- “core” of historical analysis is to under-
sis: for some kinds of systems, for ex- stand changes occurred in software ar-
ample, service-oriented systems, the tifacts, usually stored in versioning sys-
reverse engineer cannot access the tems such as the Concurrent Versions

146 COM MUNICATIO NS O F TH E ACM | A P R I L 201 1 | VO L . 5 4 | NO. 4

 review articles

Systemb (CVS) and SubVersioNc (SVN). relational calculus to query the infor- tem architecture, the system design,
There are approaches working on mation base. If the information base or traceability links between different
a flat representation of the program, is populated with source code ASTs, software artifacts. During the years, ap-
thus ensuring language indepen- it can be queried by means of pattern proaches have been successful devel-
dence, and other, language-depen- matching mechanisms working over oped to build views at different levels
dent, that work on ASTs. In the first ASTs, as it happens for tools such as of abstraction, namely:
category fall the Unix diff and ldiff,11 DMS and TXL, or even using XQuery  Code views: traditional code views
which overcomes diff limitations in when AST is represented in XML, as it provided by source code browsers need
distinguishing likely line changes happens for SrcML. to be augmented with other informa-
from additions and removals, and of  Ability to abstract low-level artifacts tion aimed at better supporting the
tracking line moving. In the second and reconstruct high-level information. tasks a software developer performs,
category falls ChangeDistiller,20 which Very often the only reliable source of such as, debugging, determining the
is able to provide detailed information documentation for a software system impact of a change, or refactoring.
about the changes occurred, for exam- is its source code. To comprehend a There are tools aimed at comput-
ple, a change to a method parameter software system, higher-level docu- ing and visualizing slices or data-flow
or to control-flow construct. mentation is needed, such as the sys- information,1 extracting source code
 Ability to group together related
changes. When performing historical Table 1. Software analyzers.

analysis, it would be useful to consider

changes related to the same develop-
ment/maintenance activity as a whole. Name Availability Description
Grouping together related changes is Static Analysis
particularly crucial when CVS is used, SrcML14 Free Robust, island-grammar based parser. Produces a XML-
as it treats commits of different files based AST.
URL: http://www.sdml.info/projects/srcml/
separately, although for SVN—which
DMS®3 Commercial General purpose software analysis and transformation
intrinsically treats a commit of mul- toolkit.
tiple files as a whole—it might be use- URL: http://www.semdesigns.com/Products/
ful to group together related commits. TXL15 Free Program analysis and transformation toolkit.
Existing approaches group sequences It is based on a hybrid functional/rule-based language
for program transformation.
of file revisions that share the same
URL: http://www.txl.ca/
author, branch, and commit notes,
CodeSurfer1 Commercial, free Supports a wide series of features such as data flow
and exhibit differences between time- for academic use analysis, points-to analysis, slicing, impact analysis,
stamps below a certain threshold (of- dependence analysis.
ten 200 seconds). URL: http://www.grammatech.com/products/codesurfer/
Table 1 provides a categorization of Bauhaus fact Commercial, free Front end of the Bauhaus reverse engineering framework.
extractor26 for academic use The analyzer populates a knowledge base composed
some relevant examples of static, dy- of the InterMediate Language (IML) representations,
namic, historical, and hybrid analyzers. containing at the syntactical and semantic levels, and
Resource Flow graphs (RFG) representing architectural
Building Software Views aspects.
URL: http://www.bauhaus-stuttgart.de/
A primary goal of reverse engineering is
Columbus/CAN19 Commercial, free Robust and error-tolerant parser front end for C and C++.
to produce software views by abstract- for academic use URL: http://www.frontendart.com/
ing facts stored in the knowledge base. Dynamic Analysis
During the process of building views, Daikon18 Free Likely invariant detection tool for languages such as C,
there is a series of challenges that re- C++, Eiffel, IOA, Java, and Perl. Includes
verse engineers must face off: a code instrumentor.
 Ability to query the information base URL: http://groups.csail.mit.edu/pag/daikon/
Historical Analysis
containing facts populated by analyz-
Ldiff11 Free Line-based differencing tool, overcomes
ers. This entails the need for powerful
the Unix diff limitations in detecting changes.
query languages that allow building in- URL: http://www.rcost.unisannio.it/cerulo/tools.html
formative views from the data stored in Evolizer20 Free Platform-realized as set of Eclipse plug ins-to analyze
the Information Base. (Apache 2.0 license) software project data. Includes Change Distiller, an AST-
Examples of querying mechanism based differencing tool.
URL: https://www.evolizer.org/
include: Grok, a notation for manipu-
Hybrid Analysis
lating binary relations using the Tar-
Moose37 Free Software analysis tool, relies on external fact extractors,
ski’s relational algebra, and compris- and stores facts in different knowledge bases
ing operators for manipulating sets (e.g., FAMIX). Several tools for building views (e.g.,
or relations, or CrocoPat,5 which uses CodeCrawler) are built on top of Moose.
URL: http://moose.unibe.ch/

b http://ximbiot.com/cvs/
c http://subversion.tigris.org/

A P R I L 2 0 1 1 | VO L. 54 | N O. 4 | C OM M U N IC AT ION S OF T H E ACM 147

review articles

clones and visualizing them,25 or at The literature reports several different terns in the software system design,43
identifying the presence of crosscut- approaches aimed at reconstructing and, in general, at re-documenting the
ting concerns.33 A different case of software architectures;38 among other software structure.45
code view is a decompilation,13 where techniques, clustering techniques32 are  Symbolic views, highlights “what
the objective is not to augment the used to group together modules with a software artifacts are about.” Such
source code with further information, particular objective in mind, for exam- views can be used for program under-
but rather to abstract the (unavailable) ple, maximizing cohesion and mini- standing, but also for other tasks such
source code from binaries. mizing coupling. Other approaches impact analysis or for recommending
 Design views: as very often design aim at reconstructing the software de- relevant developers for a given artifact.
documents are not available, incom- sign—for example, UML diagrams us- An example of this kind of view is the
plete or outdated, design views ab- ing static analysis,42 or a combination work of Kuhn et al.,28 who build views
stract design information by relying on of static and dynamic analysis40—and highlighting the semantic of software
facts extracted from the source code. at identifying the usage of design pat- packages by using an information re-
trieval technique—namely latent se-
Table 2. Tool support for building software views.
mantic indexing—to group software
artifacts.
 Traceability links among different
Name Availability Description views: traceability links are crucial to
Information Base Querying Tools support software maintenance tasks,
Grok Free Programming language for manipulating binary however they may be outdated or not
relations. Part of the SWAG toolkit developed at
present at all.
the University of Waterloo.
URL: http://www.swag.uwaterloo.ca/tools.html Techniques using information re-
Crocopat5 Free Relational programming tool able to manipulate relations trieval methods have been developed
of any arity. to recover traceability links, hypoth-
URL: http://www.sosy-lab.org/~dbeyer/CrocoPat/ esizing the consistency between high-
View Builders level document terms and source code
Bauhaus26 Commercial, free Complete reverse engineering toolkit. Foresees the identifiers and comments.2
for academic use production of software views at different levels of details,
 Ability to properly visualize ab-
code views (pointer analysis, dependency analysis,
clone detection, dead code detection), feature location, stracted information. Software visu-
component mining, architecture reconstruction. alization is a crucial step for reverse
URL: http://www.bauhaus-stuttgart.de/ engineering: the way information is
Rigi45 Free Extensible reverse engineering tool for software presented to developers could strongly
understanding and redocumentation. Shows views
at different levels of detail, from software architecture affect the usefulness of the program
to control and data flow relations. Also includes analysis or design recovery techniques.
a fact extractor. In some cases, when reverse engineer-
URL: http://www.rigi.csc.uvic.ca/
ing techniques aim at extracting widely
CCFinderX25 Commercial, free Token-based clone detection tool. Works with languages
adopted and well defined diagrams
for academic use such as Java, C/C++, COBOL, VB, C#.
http://www.ccfinder.net/ from source code—for example, UML
FINT33 Free Aspect mining Eclipse plugin. Detects crosscutting diagrams and control flow graphs—
concerns using a combination of different techniques (fan- the choice of a proper visualization is
in analysis, grouped calls analysis and redirection finder). quite straightforward. In other cases,
URL: http://swerl.tudelft.nl/bin/view/AMR/FINT
visualization constitutes the essence of
Design pattern Free Graph-similarity-based design pattern detection tool.
detector43 Analyzes Java bytecode.
a reverse engineering technique, for its
URL: http://java.uom.gr/~nikos/pattern-detection.html ability to highlight relevant informa-
Software Visualization Tools tion at the right level of detail. Relevant
Codecrawler29 Free Reverse engineering visualization toolkit. In particular examples of visualization tools include
visualizes polymetric views. SHriMP,41 which allows exploring soft-
URL: http://smallwiki.unibe.ch/codecrawler/ ware architectures, or other pieces of
SHriMP41 Free Tool (and technique) to explore software architectures knowledge related to a software sys-
and information spaces in general. Built as Protegé plugin.
URL: http://www.thechiselgroup.org/shrimp/ tem. Other visualizations have been
Recommendation Systems conceived to provide developers with
HipiKat Free Recommends pertinent software development artifacts immediate insights about the metric
related to the context where the developer is operating. profile of an entire system and zoom-
URL: http://www.cs.ubc.ca/labs/spl/projects/hipikat/ ing into detailed information about
CloneTracker17 Free Eclipse plugin for clone tracking. Developers tag clones; particular artifacts. For example, Co-
when clones are changed, developers are notified and
deCrawler29 combines the capability
supported to make consistent changes.
URL: http://www.cs.mcgill.ca/~swevo/clonetracker/ of showing software entities and their
relationships, with the capability of vi-
sualizing software metrics using poly-
metric views, which represent software

148 COMM UNICATIO NS O F T H E ACM | A P R I L 201 1 | VO L . 5 4 | NO. 4

 review articles

artifacts as boxes and show different ment process, so that developers can
metrics using the width, the length benefit from on-the-fly application of
and the color of these boxes. (An exten- reverse engineering techniques, for
sive survey on software visualization example, while they are writing code
approaches and tools is provided by or a design model. Muller et al.34 high-
Rainer Koschke.27) A primary goal of lighted the idea of exploiting informa-
Software visualizations are not nec-
essarily related to a single snapshot of
reverse engineering tion extracted by reverse engineering
as a feedback on the forward develop-
a software system. Historical analysis is to produce ment process. This idea of continu-
allows for building historical views; as
an example, the animated storyboards
software views ous reverse engineering has several
expected benefits:
proposed by Beyer and Hassan4 use a by abstracting  By extracting and continuously up-
sequence of animated panels to visual-
ize the changes occurring in a software
facts stored in the dating high-level views (such as, archi-
tectural views, or design diagrams such
system. knowledge base. as class diagrams, sequence diagrams,
Some relevant examples of tools state machines) from the source code
supporting the creation of reverse engi- under development, it would be pos-
neering views are described in Table 2. sible to provide a clearer picture of the
system being created;
Future and Emerging Trends  When artifacts at different levels of
Reverse engineering has reached great abstraction are available, a continuous
maturity, as we have examined. How- consistency check between them could
ever, there are still a number of open help to reduce development errors, for
problems that call for additional re- example checking whether the code is
search to advance and improve current consistent with the design or complies
methods and tools, and to consider with pre and post conditions;
new software development scenarios  A continuous analysis of the code
where reverse engineering could play a under development and of other arti-
crucial role. Moreover, radical innova- facts can be used to provide developers
tions are needed to cope with new and with useful insights, such as, suggest-
emerging software development sce- ing the use of a particular component
narios and new system architectures. or revealing that duplication of code is
Current approaches to build views being created; and,
suffer two main limitations:  Feedback from developers could
1. They are either incomplete or im- be automatically grabbed from the de-
precise, especially when they are com- velopment environment and used to
pletely automatic; above all, they do improve the performance of reverse
not account for experts’ knowledge; engineering techniques. For example,
2. They are semi-automatic, for ex- the Rocchio Vector Space Model rel-
ample, inputs from human experts are evance feedback mechanism is used to
required to complement or correct the improve the performances of traceabil-
information automatically extracted ity recovery approaches.
and to produce useful views for the de- In recent years, the availability of
veloper. multiple sources of data (software re-
These limitations indicate the need positories) demands for techniques
to close the loop between tool support to combine them and for the need of
and developers. Future research activi- filtering such a huge amount of infor-
ties in reverse engineering should push mation, that would otherwise cause
towards a tight integration of human an overload for developers.36 Recom-
feedbacks into automatic reverse en- mender systems are an emerging re-
gineering techniques. In other words, sponse to this kind of issues favored
the reverse engineering machinery by the availability of highly customiz-
should be able to learn from expert able development environments, such
feedbacks to automatically produce as Eclipsed and NetBeanse providing
better results. ways to quickly develop new tools com-
Reverse engineering has been tra- pletely integrated in the environment
ditionally intended as a support for the developer is using. For example,
post-delivery activities. There is a
growing need for full integration of re- d http://www.eclipse.org/
verse engineering within the develop- e http://www.netbeans.org/

A P R I L 2 0 1 1 | VO L. 54 | N O. 4 | C OM M U N IC AT ION S OF T H E ACM 149

review articles

CloneTracker17 keep tracks of changes notations can also be produced using

occurring on source code clones. Rec- source code reverse engineering tech-
ommender systems integrate many re- niques, aimed at extracting models
verse engineering techniques and their to be used for annotating the service.
growing popularity suggests that next Of course, this kind of automatically
generation software development envi- Radical innovations extracted information can be differ-
ronments will most probably leverage
reverse engineering into the standard
are needed to ent from what today is assumed by the
already developed automatic service
outfit of software developers. cope with new and discovery and composition mecha-
In the view of analyzing developers’
work on software projects, an impor-
emerging software nisms, necessitating a step back and a
rethinking for some of them.
tant challenge is to relate information development Many organizations are currently
about software artifacts, extracted by
means of reverse engineering tech-
scenarios and using SOA as an integration platform
for their systems. Thus, within an en-
niques, with information about com- new system terprise a key challenge is often to turn
munication/cooperation among de- monolithic systems into service orient-
velopers or in general among project architectures. ed architectures, so that they are better
contributors. In recent years, the aligned with the business processes.
combination of program analysis and Reverse engineering is a valuable option
mining software repositories with so- to help re-architecting these intra-enter-
cial network analysis techniques is be- prise applications.10 Recasting existing
coming an effective tool that helps to systems into services is also a prerequi-
understand the relationships existing site to move towards cloud computing,
between developers’ social network- a style of computing where not only soft-
ing the characteristics of the code they ware but also the infrastructure and the
tend to modify.7 platform are seen as services.
Today, many systems are multi-lan- Reverse engineering has tradition-
guages and cross-platforms, requiring ally focused on recovering functional
reverse engineering tools able to deal and architectural views from existing
with multiple languages and multiple software artifacts. However, reverse en-
platforms within a single conceptual gineering approaches have also shown
framework. Finally, new kinds of soft- useful to recover performance models
ware artifacts, that need to be reverse and workload models of an applica-
engineered, are emerging, including tion, manly by analyzing execution
spreadsheets and macros deriving traces.23,44 These models have proven
from the growing phenomenon of end- particularly useful to deal with appli-
user programming.8 cations running on limited-resources
The advent of service oriented archi- devices, including embedded systems
tectures (SOA) poses new challenges to and mobile and pervasive applications,
reverse engineering. A service oriented and to help migrating existing applica-
system is composed of distributed ser- tions onto these devices. Example of
vices published by different providers key problems are adapting the inter-
and poses relevant software under- face to the limited size and resolution
standing issues.22 In fact, each service of these devices and miniaturizing li-
offers, through its interface, a limited braries to accommodate for reduced
view of the features because providers size of memory.
“sell” the usage of a service but want to With the increasing diffusion of
protect the technology behind it. This handled-devices and wireless sensor
affects the service understandabil- networks, power management is be-
ity and, being the implementation not coming a key issue. Consequently, an
available for reverse engineering, black emerging goal of reverse engineering
box understanding techniques must is to analyze an application and iden-
be used. Upcoming work in reverse en- tify changes aimed at reducing power
gineering can also support service pro- consumption. This is crucial for mo-
viders to (semi) automatically produce bile devices such as smart phones and
service annotations—inferred using Personal Digital Assistants (PDAs),
black box reverse engineering tech- but, especially, in the context of sen-
niques—for the purpose of automatic sor networks, where there is the need
discovery and reconfiguration.31 From for increasing battery duration for
the service provider side, service an- geographically distributed sensors. In

150 COMM UNICATIO NS O F T H E AC M | A P R I L 201 1 | VO L . 5 4 | NO. 4

 review articles

this context, reverse engineering has 4. Beyer, D. and Hassan, A.E. Animated visualization for program understanding and evolution. Ph.D. thesis,
of software history using evolution storyboards. In Univ. of Stuttgart, Germany, 2000.
the role of understanding application Proc. of the 13th Working Conference on Reverse 27. Koschke, R. Software visualization in software
power bottlenecks, which may be an Engineering, 2006. IEEE CS Press, 199−210. maintenance, reverse engineering, and reengineering:
5. Beyer, D. and Lewerentz, C. CrocoPat: Efficient A research survey. Journal of Software Maintenance
excessive usage of the display or of a pattern analysis in object-oriented programs. In 15, 2 (2003), Wiley, 87−109.
wireless connection, but also to the use Proc. of the 11th International Workshop on Program 28. Kuhn, A. Ducasse, S., and Gîrba, T. Semantic
Comprehension, 2003. IEEE CS Press, 294−295. clustering: Identifying topics in source code.
of CPU instructions having high power 6. Binkley, D. Source code analysis: A road map. In Information & Software Technology 49, 3 (2007),
requirements. Last but not least, in a Proc. of the International Conference on Software 230−243.
Engineering — Future of Software Engineering Track 29. Lanza, M. and Ducasse, S. Polymetric views—A
long-term vision, “green computing” (FOSE). IEEE CS Press, 104−119. lightweight visual approach to reverse engineering.
envisages scenarios where general- 7. Bird, C., Pattison, D., D’Souza, R., Filkov, V., and IEEE Transactions on Software Engineering 29, 9
Devanbu, P. Latent social structure in open source (2003), 782−795.
purpose computing makes a reduced projects. In Proc. of the 16th ACM SIGSOFT 30. Lehman, M.M. and Belady, L.A. Program Evolution—
international Symposium on Foundations of Software Processes of Software Change. Academic Press,
utilization of power resources. This is, London, 1985.
Engineering, 2008. ACM Press, 24−35.
indeed, a software engineering prob- 8. Burnett, M., Cook, C., and Rothermel, G. End-user 31. Lorenzoli, D., Mariani, L., and Pezzè, M. Automatic
software engineering. Comm. ACM 47, 9 (Sept. 2004), generation of software behavioral models. In Proc.
lem and, for existing systems, a reverse of the 30th International Conference on Software
53–58.
engineering problem. 9. Canfora, G. and Di Penta, M. New frontiers of reverse Engineering, 2008. ACM Press, 501−510.
engineering. In Proc. of the International Conference 32. Maqbool, O. and Babri, H.A. Hierarchical clustering for
on Software Engineering - Future of Software software architecture recovery. IEEE Transactions on
Conclusion Engineering Track (FOSE), 2007. IEEE CS Press, Software Engineering 33, 11 (2007), 759−780.
326−341. 33. Marin, M., van Deursen, A., and Moonen, L. Identifying
Reverse engineering is, at the same 10. Canfora, G., Fasolino, A.R., Frattolillo, G., and crosscutting concerns using fan-in analysis.
time, an old activity and young disci- Tramontana, P. A wrapping approach for migrating ACM Transactions on Software Engineering and
legacy system interactive functionalities to service Methodology 17, 1 (2007), 1−37.
pline. In fact, developers have always oriented architectures. Journal of Systems and 34. Muller, H.A., Jahnke, J.H., Smith, D.B., Storey, M.D.,
struggled about analyzing software Software 81, 4 (2008), 463−480. Tilley, S.R., and Wong, K. Reverse engineering:
11. Canfora, G., Cerulo, L., and Di Penta, M. Tracking your A roadmap. In Proc. of the 22nd International
components to gather information changes: A language-independent approach. IEEE Conference on Software Engineering—Future of
that the documentation leaves out, Software 27, 1 (2009), 50−57. Software Engineering Track, 2000, 47–60.
12. Chikofsky, E., and Cross, J.I. Reverse engineering 35. Moonen, L. Generating robust parsers using island
examining source code to reconstruct and design recovery: A taxonomy. IEEE Software 7, 1 grammars. In Proc. of the 8th Working Conference on
the underlying rationale and design (1990), 13–17. Reverse Engineering, 2001. IEEE CS Press, 13−22.
13. Cifuentes, C. and Gough, K.J. Decompilation of binary 36. Murphy, G.C. Houston: We are in overload. In Proc. of
choices, and inspecting data formats programs. Software Practice and Experience 25, 7 the 23rd IEEE International Conference on Software
Maintenance, 2007, IEEE CS Press.
to maintain communications among (1995), 811–829.
37. Nierstrasz, O., Ducasse, S., and Gîrba, T. The story
14. Collard, M.L., Kagdi, H.H., and Maletic, J.I. An
applications. However, for a long time XML-based lightweight C++ fact extractor. In Proc. of Moose: An agile reengineering environment. In
of the 11th International Workshop on Program Proc. of the 10th European Software Engineering
these and other reverse engineering Conference held jointly with 13th ACM SIGSOFT
Comprehension, 2003. IEEE CS Press, 134−143.
tasks have been carried-on using ad- 15. Cordy, J.R., Dean, T.R., Malton, A.J., Schneider, K.A. International Symposium on Foundations of Software
Source transformation in software engineering using Engineering, 2005, Lisbon, Portugal, (Sept. 5-9, 2005).
hoc approaches, with the help of very the TXL transformation system. Information & ACM Press, 1−10.
simple general-purposes tools, such Software Technology 44, 13 (2002), 827−837. 38. Ducasse, S, and Pollet, D. Software architecture
16. Cornelissen, B., Zaidman, A., van Deursen, A., Moonen, reconstruction: A process-oriented taxonomy. IEEE
as editors and regular-expression Transactions on Software Engineering 35, 4 (2009),
L., and Koschke, R. A systematic survey of program
matchers. comprehension through dynamic analysis. IEEE 573−591.
Transactions on Software Engineering. http://doi. 39. Resnick, P. and Varian, H.R. Recommender systems.
Only in the past two decades has Comm. ACM 40, 3 (Mar. 1997), 6–89.
ieeecomputersociety.org/10.1109/TSE.2009.28
software engineering recognized the 17. Duala-Ekoko, E., and Robillard, M.P. Tracking code 40. Systa, T. Static and Dynamic Reverse Engineering
clones in evolving software. In Proc. of the 29th Techniques for Java Software Systems. Ph.D. thesis,
need for systematic approaches, and International Conference on Software Engineering, Univ. of Tampere, Finland, 2000.
supporting tools, to gather informa- 2007. IEEE CS Press, 158−167. 41. Storey, M.D., and Müller, H.A. Manipulating and
18. Ernst, M.D., Cockrell, J., Griswold, W.G., Notkin, D. documenting software structures using Shrimp
tion from existing software and lever- Dynamically discovering likely program invariants views. In Proc. of the 11th International Conference
aging it into engineering processes. to support program evolution. IEEE Transactions on on Software Maintenance, 1995. IEEE CS Press,
Software Engineering 27, 2 (2001), 1−25. 275−284.
Nevertheless, pushing the adoption 19. Ferenc, R., Beszédes, À., Tarkiainen, and M., Gyimòthy, 42. Tonella, P. and Potrich, A. Reverse Engineering
of Object Oriented Code. Springer-Verlag, Berlin,
of reverse engineering techniques T. Columbus—reverse engineering tool and schema
Heidelberg, New York, 2005.
for C++. In Proc. of the 18th International Conference
in the development practice is still on Software Maintenance, 2002. IEEE CS Press, 43. Tsantalis, N., Chatzigeorgiou, A., Stephanides, G., and
Halkidis, S. T. Design pattern detection using similarity
a major need, requiring appropriate 172−181.
scoring. IEEE Transactions on Software Engineering
20. Fluri, B., Würsch, M., Pinzger, M., Gall, H. Change
education of developers both in uni- distilling: Tree differencing for finegrained source code 32, 11 (2006), 896−909.
44. Woodside, C.M., Franks, G., and Petriu, D.C. The future
versity courses and within industry, change extraction. IEEE Transactions on Software
of software performance engineering. In Proc. of the
Engineering 33, 11 (2007), 725−743.
and to support reverse engineering 21. Godfrey, M.W., Hassan, A.E., Herbsleb, J.D., Murphy, International Conference on Software Engineering,
Future of Software Engineering Track (FOSE) 2007.
techniques and tools with empirical G.C., Robillard, M.P., Devanbu, P.T., Mockus, A., Perry,
IEEE CS Press, 171−187.
D.E., and Notkin, D. Future of mining software archives:
evidence about their performance and A roundtable. IEEE Software 26, 1 (2009), 67−70. 45. Wong, K., Tilley, S., Muller, H.A., and Storey, M.D.
22. Gold, N., Knight, C., Mohan, A., and Munro, M. Structural redocumentation: A case study. IEEE
usability and with guidelines for their Software (Jan. 1996), 46−54.
Understanding service-oriented software. IEEE
adoption. Software 21, 2 (2004), 71–77.
23. Hassan, A.E., Martin, D.J., Flora, P., Mansfield, P.,
Gerardo Canfora ([email protected]) is a
and Dietz, D. An industrial case study of customizing
professor of software engineering in the Department of
operational profiles using log compression. In Proc.
References Engineering at the University of Sannio, Benevento, Italy.
of the 30th international Conference on Software
1. Anderson, P. and Teitelbaum, T. Software inspection Engineering 2008. ACM Press, 713−723.
using CodeSurfer. In Proc. of the 1st Workshop on Massimiliano Di Penta ([email protected]) is an
24. Kagdi, H.H., Collard, M.L., and Maletic, J.I. A survey
Inspection in Software Engineering, 2001, 4−11. assistant professor in the Department of Engineering, at
and taxonomy of approaches for mining software
the University of Sannio, Benevento, Italy.
2. Antoniol, G., Canfora, G., Casazza, G., De Lucia, A., and repositories in the context of software evolution.
Merlo, E. Recovering traceability links between code Journal of Software Maintenance 19, 2 (2007). Wiley, Luigi Cerulo ([email protected]) is an assistant
and documentation. IEEE Transactions on Software 77−131. professor in the Department of Biological and
Engineering 28, 10 (2002), 970–983. 25. Kamiya, T., Kusumoto, S., and Inoue, K. CCFinder: Environmental Sciences at the University of Sannio,
3. Baxter, I.D., Pidgeon, C., and Mehlich, M. DMS: A multilinguistic token-based code clone detection Benevento, Italy.
Program transformations for practical scalable system for large scale source code. IEEE Transactions
software evolution. In Proc. of the 26th International on Software Engineering 28, 7, (2002), 654–670.
Conference on Software Engineering, 2004, 625−634. 26. Koschke, R. Atomic architectural component recovery © 2011 ACM 0001-0782/11/04 $10.00

A P R I L 2 0 1 1 | VO L. 54 | N O. 4 | C OM M U N IC AT ION S OF T H E ACM 151

Copyright of Communications of the ACM is the property of Association for Computing Machinery and its
content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's
express written permission. However, users may print, download, or email articles for individual use.