  Code protections aim at blocking (or at least delaying) reverse engineering
and tampering attacks to critical assets within programs. Knowing the way
hackers understand protected code and perform attacks is important to achieve a
stronger protection of the software assets, based on realistic assumptions
about the hackers' behaviour. However, building such knowledge is difficult
because hackers can hardly be involved in controlled experiments and empirical
studies. The FP7 European project Aspire has given the authors of this paper
the unique opportunity to have access to the professional penetration testers
employed by the three industrial partners. In particular, we have been able to
perform a qualitative analysis of three reports of professional penetration
test performed on protected industrial code. Our qualitative analysis of the
reports consists of open coding, carried out by 7 annotators and resulting in
459 annotations, followed by concept extraction and model inference. We
identified the main activities: understanding, building attack, choosing and
customizing tools, and working around or defeating protections. We built a
model of how such activities take place. We used such models to identify a set
of research directions for the creation of stronger code protections.
