Largely it is legal, but it's complicated. https://www.eff.org/issues/coders/reverse-engineering-faq