I'm not expert in these matters, but how would someone go about finding this exploit if they DIDNT have access to the source code (i.e. grep -R strcpy *). To me, this seems almost impossible to figure out without source code access, but clearly people find stuff in closed source code. How?