For the past three months I've been working on a research paper for my employer. The paper is about source code auditing. Basically I give a few examples of code which is flawed and give an explaination as to why it is flawed. The paper will be released publicly soon. When that happens I'll be sure to post up some links to it.

I'm also working on a complementary project for the paper. The plan is to create a tool which allows auditors to create function audit logs while they view source code. The idea is to create a web based application which interacts with a MySQL database and allows an auditor to create a project to work on. The auditors can then manage the project by specifying the source code they want to look at. While looking at the source code an auditor will have the ability to follow cross references and create function audit logs for any functions they deem necessary.

The cool thing about this project is that I'm incorporating a lot of cool features which are going to be extremely useful. Some of the cool things I plan on adding into the project is syntax highlighting, multiple programming language support, dynamic flow graph generation, a very cool code viewer utilizing CSS and Javascript (DHTML), automatic source code reversion capabilities. Yea thats a lot of features. I'll definately be posting some more on this subject as the project starts to shape up some more.

Currently the layout of the web application is complete and I've started to write some of the backend code which handles the majority of the MySQL database communication. About the only thing left is to start adding on the features listed above. I expect the project to take me about three months. At that time I should at the very least have a working demo for everyone to test out.

I really hope the tool is put to good use. It seems to me that a tool such as this is really what the source code auditing community has been needing for a long time. I know it likely won't be the perfect solution for some people but it should definately help. I am designing the tool to be as flexible as possible so that people can use it in just about anyway they could imagine.