Not OP, but this often is used when I am brought onto a new project against old code base, where no one from original developers is around. I am then given four

Not OP, but this often is used when I am brought onto a new project against old code base, where no one from original developers is around. I am then given four things: - here is binary that is currently running - here is source code previous developer left - here is scant documentation of what it is supposed to accomplish - here is what we want you to change the first things you want to to do is confirm the source code you have can build the binaries running. A lot of compilers, for one reason or another, like to sprinkle random crap into the binaries that makes them different every time you compile. .Net for example adds compiled time into the binary. If you try to compare the two binaries with md5/sha they will always return different. Without reproducible builds, your next step is to run decompilers against the two binaries, and hope that that output matches. Much easier if you have reproducible builds. This is also security feature: you will know if anyone tampered with the binary.