Whitebox review preparation

Whitebox testing or source code review can be most effective to identify hidden security issues in the source code. Before we begin our whitebox source code review, there are some preparation and input will help us to judge how (approaches, tools) and what (which modules) to do the security source code review.

The following is a list we may check before performing the source code review; take a look at this table:

Whitebox testing input	Considerations
Source code	Do we need a full buildable source code? Does the source code include related import modules or headers? These dependency source codes will help when we would like to trace the definition of certain APIs. However, if the whole source code is not available, it may require reverse engineering.
Threat-modeling documents	The threat-modeling provides a good reference to identify...