In my case, it's sort of a yes and no. I reverse engineered partly, but I was only looking to replace whole function calls.
Company I came in as a contractor to... Sort of repair codebases and retrain staff, had a product they were getting paid buckets to support.
Unfortunately, someone had broken the codebase quite severely, and they weren't using version control. All we had was a movfuscated release (yay for paranoid managers who go to tech conferences), but needed to fix a certain feature ASAP.
So I used demovfuscator, someone's memory of what the code once looked like, and some ASM know-how to tear out references to the old and inject the new. Took a couple months of going nowhere fast, but I was pretty far out of my depth.
Company I came in as a contractor to... Sort of repair codebases and retrain staff, had a product they were getting paid buckets to support.
Unfortunately, someone had broken the codebase quite severely, and they weren't using version control. All we had was a movfuscated release (yay for paranoid managers who go to tech conferences), but needed to fix a certain feature ASAP.
So I used demovfuscator, someone's memory of what the code once looked like, and some ASM know-how to tear out references to the old and inject the new. Took a couple months of going nowhere fast, but I was pretty far out of my depth.
They don't use movfuscator anymore.