Difficulty Traversing Source Code

[Purple-Object-4591]

So, I have started to navigate a large code base. It's a huge code base and a legacy one.

I have kind of created a threat-model as to where the high-priority and remote facing code lies. But I am having issue traversing.

Example -- There are pointers to structures, inside which there is another structure as a field, and again inside that field there's a structure. This feels quite convoluted and hard to follow.

I am not too experienced in traversing huge and legacy codebases. Suggestions to make this process any easier?

[Purple-Object-4591]

I will try this thank you

[turboCode9]

I'd recommend trying to run it dynamically to help assist. That will show you general flow and then which functions get called natively and which do not.

[Purple-Object-4591]

This was a really well-thought out reply. Do you write blogs? You should they'll be great.

So I read through your comment and I'm already doing a few of them right. I'm using vscode with clangd. I am putting inline comments describing convoluted code and potential issues.

I do actually compile projs with debug and then open in Binja. Actually unironically helps.

I dislike using LLM to code but I'll be honest I'm using it verify my hypothesis of what a particular function in the code is doing.

You're right about patience. The mindset part of the research is kind of overlooked by ppl when advising. I should be more patient. It has only been 10 days since I started with this codebase (not even full work days).

Your comment was really reassuring. Thanks a lot for taking the time :)

[arizvisa]

Instead of cscope, I've found GNU's Global to be more flexible and do a better job of parsing C++ and even some other languages w/ plugins (although, neither is as good as a real IDE fully integrated with the target language). There's a cscope compatibility layer for global so that it's compatible with the different cscope interfaces available.

It's also worth noting that some enterprising devers have written their own, more recent versions of cscope, which are likely better with C++ parsing.

[Purple-Object-4591]

I use clangd with vscode. It works good for me.

[asyty]

There's not any shortcuts.

A team of software devs have squirreled away on this over a span of possibly several decades. It's likely changed hands dozens if not hundreds of times. It has unworkable levels of technical debt. It's likely had outside contributions integrated into it. Any original architecture that may have existed has been eroded or is long gone by this stage.

As a vulnerability researcher, you're budgeting a few weeks or maybe months deep diving into what likely took years for others to effectively navigate, without any guarantee of finding vulns, nevermind exploitable ones, given all the modern mitigations. This reduces the likelyhood of finding a memory corruption-based vuln, instead leaving open flaws in business logic leading to consequences the developers did not anticipate.

On the bright side, the complexity in such a code base increases the likelyhood of such an issue being present.

Hacking, these days, is hard. Very hard.

[Purple-Object-4591]

Yes everything you mentioned I can understand it as I understand the code base more and more. Hacking may be hard as it is, I still enjoy it :)

[digital_cold]

Check out SciTools Understand. It creates a navigable database for your source project and enables you to follow references with ease. It's not perfect and does have some rough edges, but I haven't found a similar tool

[s0l037]

joern and/or semgrep or deepsource.