Uses assembly, debuggers, disassemblers, decompilers, and controlled execution to recover program behavior and identify security weaknesses.
