REVERSE ENGINEERING PROJECT CHECKLIST Ken Designers ยท kendesigners.com/articles/reverse-engineer-anything-kenya/ Planning aid only. Not legal advice. Check current law and any licence terms. --------------------------------------------------------------- 1. PERMISSION AND SCOPE (before you open anything) --------------------------------------------------------------- Target (app / device / file / protocol): ______________________ Who owns it: __________________ Who holds the licence: ________ [ ] It is mine, OR [ ] I have written permission from the owner (saved email/letter) Purpose: [ ] Interoperability [ ] Data migration [ ] Security research [ ] Learning on my own copy [ ] Clean-room feature spec [ ] I am NOT bypassing licence checks, DRM or paywalls [ ] I will NOT touch the vendor's servers, only my local copy --------------------------------------------------------------- 2. SAFE SET-UP --------------------------------------------------------------- [ ] REA installed from the official repo (morluto/rea) via npm, not a zip [ ] Commercial tools (IDA, JEB, Hopper) are legally licensed, or I use free ones (Ghidra, JADX, Apktool, Wireshark, Binwalk, sigrok) [ ] Test device / VM I can reset [ ] Personal data masked or removed before any AI agent reads it --------------------------------------------------------------- 3. THE LOOP --------------------------------------------------------------- [ ] OBSERVE what it does: screens, network calls, files written [ ] TRACE how it does it: functions, messages, data formats [ ] SPECIFY the behaviour in plain language, with no copied code [ ] REBUILD my own implementation, in a fresh session, from the spec [ ] TEST against the original's real outputs (receipts, totals) Unknowns the agent reported (verify each by hand): _____________________________________________________________ _____________________________________________________________ --------------------------------------------------------------- 4. DATA PROTECTION (Data Protection Act 2019) --------------------------------------------------------------- [ ] Client data stays on the client's machine [ ] No member, patient or customer records pasted into AI chats [ ] Lawful basis recorded for any personal data processed --------------------------------------------------------------- 5. IF YOU FIND A VULNERABILITY --------------------------------------------------------------- [ ] Stop. Do not exploit it further or access other people's data [ ] Report privately to the company (security / disclosure contact) [ ] Agree a fix window (90 days is a common norm) [ ] Escalate to the ODPC or National KE-CIRT/CC only if ignored [ ] Publish findings only after a fix, with no working exploit --------------------------------------------------------------- 6. KENYAN LAW AT A GLANCE --------------------------------------------------------------- Copyright Act s.26A(3): decompiling for interoperability is allowed Computer Misuse and Cybercrimes Act s.14: unauthorised access, up to KES 5 million / 3 years Computer Misuse and Cybercrimes Act s.16: unauthorised interference, up to KES 10 million / 5 years (KES 20 million / 10 years aggravated) Licence agreements can still ban reverse engineering (contract law)