Brian Reed on Reverse Engineering Software with SBOM

daBOM

I remember being pushed back into my seat with a force I had never felt before.

It was the first time I had ever been in an electric car, and Brian Reed was at the steering wheel with this big smile on his face as we went from 0 to 60 in about 3 seconds. It was just one of the many memorable experiences that I've had while spending time with Brian over the years.

It feels like every time I see him, he introduces me to something new, and the discussions we have - they're extremely illuminating.

Recently I ran into Brian and we started talking about Software Bill of Materials. As we were catching up, he mentioned something that caught my ear and I really had to hear more about.

He asked...

What do you do when you don't have source code to create an SBOM?

What do you do when your vendor doesn't want to give you one?

What do you do if you only have a binary file?

Well, it turns out you can do a lot... like binary scanning and reverse engineering.

I never thought of this approach as a way to generate, examine, and share information about the composition of software before - and you know, it makes so much sense.

Welcome back, to daBOM.