In this paper we present CosmOpen, a reverse-engineering tool optimized for the behavioural analysis of complex layered software. CosmOpen combines cheap and non-intrusive observation techniques with a versatile graph manipulation engine. By programming different graph manipulation scripts, the ‘focal length’ of our tool can be adapted to different abstraction levels. We illustrate how our tool can be used to extract high-level behavioural models from a complex multi-threaded platform (GNU/Linux, CORBA middleware).