You've pointed an AI agent at a compiled program and it's producing readable pseudocode in minutes. Before you get excited, there's a different question: were you allowed to do that, and what are you allowed to do with the result? Reverse engineering sits in a patchwork of copyright law, contract law, anti-circumvention rules and computer-misuse statutes, and the answer changes by country and by facts.
This is a plain-language map, not legal advice. I'm not a lawyer. If real money, a product launch, a client or a criminal-law question is involved, hire one who handles software and IP in your jurisdiction. I fetched the US sources below on 2026-10-23. I could not retrieve the official Indian statute text (more on that), so the India section is deliberately thin.
Boundary. This post does not cover defeating licence checks, DRM, anti-cheat systems or paywalls, and it does not explain how to clone a commercial product. If that's your goal, this isn't the page for it. The REA project's own DISCLAIMER.md draws the same line.
Is reverse engineering software legal in general?
Studying how a program works is not, on its own, a crime anywhere I can point to with a primary source. Trouble comes from four separate places, and a lawful answer has to clear all of them:
- Contract. The licence or EULA you accepted may forbid reverse engineering. Breaching it is usually a contract issue rather than a copyright one, and its enforceability varies by jurisdiction.
- Copyright. Making copies and adaptations of a program can infringe unless an exception applies. Copying protected expression into your own product is the classic risk.
- Anti-circumvention. Bypassing a technical measure that controls access to a work can be its own violation, separate from infringement (US: DMCA section 1201).
- Computer misuse. Accessing systems you aren't authorised to access is a different body of law entirely.
Low-risk situations tend to share traits: it's your own code or build, a system you own or are authorised to test, a CTF or training sample explicitly offered for analysis, malware analysis in isolation, or documenting a file format for interoperability, with no bypass of access controls. Higher-risk ones involve a licence that prohibits the activity, bypassing protection, redistributing the vendor's code or assets, or copying a competitor's product.
What does US copyright law say?
Primary text checked 2026-10-23:
- Section 117 (computer programs). Via the US Code text on Cornell's Legal Information Institute: the owner of a copy of a computer program may make another copy or adaptation without infringing if it is an essential step in using the program on a machine, or for archival purposes only. Exact copies can be transferred only with the original and as part of transferring all rights; adaptations need the copyright owner's authorisation. Note the word owner: whether you own a copy or merely license it can matter, and licences usually say licence.
- Section 107 (fair use). Copyright.gov's text lists purposes such as criticism, comment, scholarship and research, and four factors: purpose and character of the use, nature of the work, amount used, and effect on the market. Fair use is decided case by case, so it's a defence you argue, not a permission you hold.
What is DMCA section 1201 and where are the exceptions?
Section 1201(a)(1)(A) reads: "No person shall circumvent a technological measure that effectively controls access to a work protected under this title." (copyright.gov, Title 17 chapter 12.) So if a program is protected by an access control, getting around it is the problem even if your purpose is benign.
Chapter 12 builds in narrow carve-outs. As I read the text:
- 1201(f), interoperability. A person with legitimate access to a copy of a computer program may circumvent an access control on part of that program to identify and analyse the elements needed for an independently created program to interoperate, if doing so isn't infringing and the elements weren't previously readily available. 1201(f)(2) and (f)(3) allow building and sharing tools or information, but only to enable interoperability.
- 1201(j), security testing. Accessing a computer system with its owner's permission solely to test, investigate or fix a security flaw is exempt from the access-control ban, provided it doesn't infringe copyright or violate other laws, including 18 U.S.C. 1030. The statute lists factors such as whether results were used to improve security or shared with the developer.
These are conditional and fact-heavy. Most real disputes turn on whether you fit the conditions.
What are the DMCA triennial exemptions?
Every three years the Copyright Office reviews temporary exemptions. Its 1201 page says the most recent final rule was published in the Federal Register on 28 October 2024, and that the tenth triennial proceeding is underway, with renewed exemptions to run from October 2027 through October 2030. The current exemptions are in 37 CFR 201.40. From the CFR text (via Cornell LII, which may lag the official code, so check eCFR or the Federal Register):
- Good-faith security research (b)(18). Circumvention of computer programs on a lawfully acquired device or a system the owner authorises, solely for good-faith testing or correcting security flaws, conducted in a safe environment, with results used mainly to improve security. It states it is not a safe harbour from other laws such as the Computer Fraud and Abuse Act.
- Software preservation (b)(20). For eligible libraries, archives and museums, with conditions on eligibility and on distribution; video games are handled separately in (b)(19).
- Repair exemptions for categories such as consumer devices, medical devices and vehicles, each with its own conditions.
Two points matter. Exemptions are narrow, temporary and conditional. And none of them, as quoted, authorises defeating licence checks to use paid software for free.
What about India's Copyright Act, section 52?
Here is the honest gap. I tried the India Code PDF, the DPIIT copyright site and other official-looking URLs on 2026-10-23, and they returned HTTP 403 or 503 to my fetcher. I could not read the official text of the Copyright Act, 1957, so I'm not going to paraphrase it as verified.
What I can say with a flagged source: a secondary site, lawgist.in, reproduces section 52(1) with clauses (aa) to (ad) dealing with computer programmes: copies or adaptations by a lawful possessor to use the programme for its supplied purpose or to make back-up copies; acts necessary to obtain information essential for interoperability; observing, studying or testing the functioning of the programme to determine its underlying ideas and principles; and copies from a personally, legally obtained copy for non-commercial personal use. This is not an official source. Before you rely on any of it, read section 52 on India Code (indiacode.nic.in), check the current amendments, and ask an Indian IP lawyer how courts have applied it. I'm also not covering India's rules on anti-circumvention here, because I could not verify them.
What is clean-room reverse engineering?
Clean-room is a process, not a statute. I don't have a primary legal source to cite for it, so treat this as common practice described in general terms, and confirm the design with counsel.
The idea is to separate knowledge of the original from the creation of the new thing:
- Team A (the dirty side) studies the original, lawfully, and writes a functional specification: what inputs produce what outputs, file layouts, protocol messages, error behaviour. The spec describes behaviour and interfaces, not the original's code or distinctive expression.
- A reviewer (often counsel) checks the spec for leaked protected expression.
- Team B (the clean side) has never seen the original code or Team A's raw notes. It builds from the spec only.
- Records show who saw what and when, so you can later demonstrate independent creation.
With AI agents, the same logic has teeth. If an agent that has read decompiled output also writes your implementation in the same context, you've collapsed the wall. A cautious setup uses one agent session for analysis that outputs only a reviewed specification, and a fresh session with no access to the analysis workspace for implementation. That is my suggestion about how to apply the principle, not a legal rule. Even a perfect clean room doesn't cure a breached licence or a circumvention, and it doesn't make cloning a commercial product acceptable.
A checklist before pointing an agent at a binary
- Do I own it, am I authorised in writing to test it, or is it offered for analysis (CTF, training)?
- Have I read the licence or EULA for a reverse-engineering clause?
- Will I need to bypass any access control? If so, stop and get legal advice.
- What is the purpose (security testing, interoperability, preservation, education), and does it match a recognised exception in my jurisdiction?
- Am I keeping results to myself or the vendor, or publishing? Publishing and tool distribution carry extra conditions.
- If I'm building something compatible, do I have a clean-room split and records?
- Are untrusted samples isolated in a VM with no credentials? (See our REA verification and sandbox guide.)
- Have I told a lawyer if the stakes are commercial?
For what an agent-driven workflow looks like in practice, see the REA repo guide, and for how analysis output can be wrong, read our lesson on hallucinations.
Sources checked
- 17 U.S.C. chapter 12 (section 1201), copyright.gov, fetched 2026-10-23.
- 17 U.S.C. section 107 (copyright.gov) and section 117 (Cornell LII), fetched 2026-10-23.
- US Copyright Office section 1201 rulemaking page, fetched 2026-10-23.
- 37 CFR 201.40 via Cornell LII, fetched 2026-10-23.
- Indian Copyright Act 1957 section 52: official text not retrievable; secondary summary from lawgist.in only.
- REA DISCLAIMER.md,
github.com/morluto/rea, fetched 2026-10-23.
Nothing here is legal advice. Laws change and facts matter.
