Is it legal to disassemble a Microsoft dll and post the result on my blog?

Question

I'm writing an article for my blog about undocumented functions which exist in the dwmapi.dll library. I want to post the result of the disassembled code to explain how the names and parameters of these functions are obtained, something like the article from this blog. This is only for educational purposes to show a couple of samples using these undocumented functions. So the question is: Can I post the disassembled code of this library on my blog?

UPDATE : There exist a couple of applications like Aura which uses these undocumented functions (DwmGetColorizationParameters, DwmSetColorizationParameters), obviously the authors in some point disassembled the dwmapi.dll file in order to get the parameters and functions names. But they (the authors) only publish the final source code to access to these functions. This makes me think that I can disassemble in private a Microsoft dll and then publish an application or source code based in this research. Is this correct?

Answer 1

4. LIMITATIONS ON REVERSE ENGINEERING, DECOMPILATION, AND DISASSEMBLY. You may not reverse engineer, decompile, or disassemble the Software, except and only to the extent that such activity is expressly permitted by applicable law notwithstanding this limitation.

I'd say no, it's not legal.

Edit for clarification:

Simply put, by posting disassembly on your blog, (imo) you're playing with fire. I'm far from a legal expert, but I'd assume that there are legal loopholes that Microsoft lawyers could use, such as physical location of your blog provider's server. Even though your local laws may say one thing, if Microsoft decided that what you posted was sensitive enough (chances in this case are not as it's old tech), I'm fairly certain that their barrage of top notch lawyers could find some way to pursue you legally. So simply put (again, imho), the risks far outweigh the potential gains.

Having said that, @David Thornley is correct in his comment: Consult a lawyer about your local laws, as it's the only way to make sure that you're covered.

Answer 2

Generally it's allowed if your local law explicitly allows so.

Since you live in Chile, it's perfectly legal for you to do reverse-engineering. The law explicitly allows it for interoperability and for research & development. See: http://pumarino.blogspot.com/2010/10/ingenieria-inversa-en-programas.html

Artículo 71 Ñ. Las siguientes actividades relativas a programas computacionales están permitidas, sin que se requiera autorización del autor o titular ni pago de remuneración alguna:

b) Las actividades de ingeniería inversa sobre una copia obtenida legalmente de un programa computacional que se realicen con el único propósito de lograr la compatibilidad operativa entre programas computacionales o para fines de investigación y desarrollo. La información así obtenida no podrá utilizarse para producir o comercializar un programa computacional similar que atente contra la presente ley o para cualquier otro acto que infrinja los derechos de autor.

Now, publishing results of disassembly on blog, that's another thing. I'm not sure about Chilean law, but for example under European law you can do reverse-engineering, but you may not publish the results. Publishing your source code, that you've created thanks to what you found out, should be completely OK.

Answer 3

It depends on where do you live and what local law says about it. In my country (Poland) it is legal to perform disassembly if your intention is to study application and make your own application compatibile with the one being disassembled. This takes precedence over anything people write in licenses. I bet other countries have similar laws and that is why these days most licenses state that disassembly is illegal except where it is permited by the local law.

Answer 4

Actually, you don't have to disassemble a dll to check which functions you can call on. Even the undocumented functions can be accessed from outside, without disassembly - for example, load the DLL as a reference inside Visual Studio and IntelliSense will show you which functions are accessible..

Just because you can do this introspection also by "disassembling" the library doesn't mean that it is disassembly (otherwise all Visual Studio users would violate the EULA because of IntelliSense).

Answer 5

It is ok, to a point.

When Vista was first announced, and apparently was going to be built with the new cool .NET technology that was so wonderful it was going to be everywhere, Dr Richard Grimes (of the books) thought he'd decompile the headers of every dll in Vista to see just how many of them were .NET dlls, just out of curiosity, and publish the results on his blog.

Naturally, despite Microsoft saying everything was great, only a dozen dlls were .NET (IIRC), and Microsoft heard about this, threw a wobbly, and demanded he take it all down and stop doing this investigation (you'd have thought they'd have something to hide!).

Net result, he stopped, but nowhere did MS sue or take other legal action - all they did was threaten to remove his MVP status.

So I guess (IANAL) that it depends how much decompilation you do, published in the entire decompiled sources would be bad, but publishing the function calls (which are not the same as the source code, as Oracle v Google showed) would be ok. There used to be a lot fo books published with "secrets of hidden Microsoft functions" that MS didn't like but did nothing about (except to say "these will change so don't use them").

Answer 6

Based on their available EULAs, it is probably illegal. Whether it's legal or not in this particular case will not conclusively be decided until after you are sued and potentially bankrupt.

Do you really want to risk it? We're talking about Microsoft here. They don't shy away from litigation even when the defendants have million dollar counsel on retainer.