If you are sent a program written by someone so that you have the complete source code, how would you go about scanning the source code for any potential viruses/malware?

Note: While bugs and security risks in the program itself are also important to find, this relates specifically to malware written into the program.

migrated from stackoverflow.com Aug 31 '13 at 14:12

This question came from our site for professional and enthusiast programmers.


You read the code. You try to understand the code. You take the code out to dinner and get to know it better.

You compile the code and play with it. Does the code like it when you tickle it in that area? What happens when you leave it alone? Does it ignore you? Does it throw a tantrum? Is the behavior of the code what you expect it to be like?

Besides getting to know what the code is like now, you have to understand what the code is like before. Talk to prior acquaintances of the code. How was the code like before? Was the code always like this? Did the code's behavior suddenly change one day? What was the cause of the change?

Only by getting to know the code and what the code is supposed to do, can you tell if the code isn't what you are expecting it to be.

  • 1
    right on the money. malicious source code is unlikely to have a module called "malware". – ddyer Aug 31 '13 at 18:10
  • 1
    runnning it could be dangerous – GameDeveloper Oct 20 '15 at 12:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.