6 ms·

To be fair, an IDE is not geared at auditing and it would be much more painful to do freeform annotations in it. Circling problematic areas, drawing connections

by DCoder 11y ago

To be fair, an IDE is not geared at auditing and it would be much more painful to do freeform annotations in it. Circling problematic areas, drawing connections between variables/functions, making handwritten notes in the margin... all that is easy on paper and requires workarounds/other programs on a PC.

roel_v 11y ago
I can see that, but how does one work through 5000 pages? I'd shoot myself in the head before the end of week 1 (metaphorically speaking). And I guess they used a combination of digital/analog methods, but still since the GP asked - that guy must've spend weeks studying printed source code...
- DCoder 11y ago
  As I see it, the auditor's job is to analyse the system thoroughly, not to skim some areas of it. Looking through 5000 pages worth of code on a computer screen would also be quite a challenge, even with the interactive aids you get from an IDE. Tangent: speaking from personal experience, sifting through an existing foreign code base is a really exciting task for some people, figuring out what makes it tick and how the pieces fit together can be fun. Granted, I was reverse-engineering a closed-source product, not reading its actual source, but that was even more fun :D Come to think of it, the tool I used for that, IDA Pro, has some interesting features that IDEs don't, such as graphical representations of function call graphs [1] and function basic blocks [2]. It would be interesting to see what a creative person could do by integrating those into a regular IDE. [1] http://scratchpad.wikia.com/wiki/Reverse_Engineering_Mentoring_Lesson_005 http://scratchpad.wikia.com/wiki/Reverse_Engineering_Mentori... [2] https://www.hex-rays.com/products/ida/tech/graphing.shtml https://www.hex-rays.com/products/ida/tech/graphing.shtml

6 ms·

To be fair, an IDE is not geared at auditing and it would be much more painful to do freeform annotations in it. Circling problematic areas, drawing connections

by DCoder 11y ago

roel_v 11y ago
I can see that, but how does one work through 5000 pages? I'd shoot myself in the head before the end of week 1 (metaphorically speaking). And I guess they used a combination of digital/analog methods, but still since the GP asked - that guy must've spend weeks studying printed source code...
- DCoder 11y ago
  As I see it, the auditor's job is to analyse the system thoroughly, not to skim some areas of it. Looking through 5000 pages worth of code on a computer screen would also be quite a challenge, even with the interactive aids you get from an IDE. Tangent: speaking from personal experience, sifting through an existing foreign code base is a really exciting task for some people, figuring out what makes it tick and how the pieces fit together can be fun. Granted, I was reverse-engineering a closed-source product, not reading its actual source, but that was even more fun :D Come to think of it, the tool I used for that, IDA Pro, has some interesting features that IDEs don't, such as graphical representations of function call graphs [1] and function basic blocks [2]. It would be interesting to see what a creative person could do by integrating those into a regular IDE. [1] http://scratchpad.wikia.com/wiki/Reverse_Engineering_Mentoring_Lesson_005 http://scratchpad.wikia.com/wiki/Reverse_Engineering_Mentori... [2] https://www.hex-rays.com/products/ida/tech/graphing.shtml https://www.hex-rays.com/products/ida/tech/graphing.shtml