Solving the "Lost Source Code" Crisis in Industrial Control Systems

Your most critical production line is currently running on a software stack that nobody understands, and the source code vanished in 2004.

This isn't a hypothetical scenario. In Industrial Control Systems (ICS) and manufacturing, the "lost source code" crisis is a quiet emergency. We are seeing multi-billion dollar enterprises held hostage by "black box" legacy interfaces—HMI (Human-Machine Interface) and SCADA systems where the original vendor is defunct, the documentation is non-existent, and the original developers have long since retired.

The $3.6 trillion global technical debt isn't just a line item on a balance sheet; in industrial environments, it’s a physical risk to operations. When you are solving lost source code issues in these environments, the traditional "Big Bang" rewrite is a death sentence for the project. With 70% of legacy rewrites failing or exceeding their timelines, the industry needs a new methodology.

TL;DR: Visual Reverse Engineering allows enterprises to bypass the "archaeology" phase of modernization by using real-time user workflows to generate documented, production-ready React components and API contracts in days rather than years.

The High Cost of Digital Archaeology#

Most Enterprise Architects approach a lost source code problem like an archaeologist: they dig. They try to decompile binaries, sniff packets, and manually map out every button and input field. This manual approach is the primary reason why the average enterprise rewrite takes 18 to 24 months.

When you lack the source code, you aren't just missing lines of COBOL or C++; you are missing the business logic and user intent that dictated those lines. 67% of legacy systems lack any form of documentation, meaning your team is essentially trying to rebuild a jet engine by looking at its shadow.

The Modernization Matrix#

Why "Rewriting from Scratch" is a Failed Paradigm#

The conventional wisdom says that if the source is lost, you must start from a blank page. This is a fallacy. Starting from scratch ignores the "Tribal Knowledge" embedded in the existing UI. The way an operator interacts with a legacy HMI is the documentation.

Every click, every data entry, and every state change represents a hard-coded business requirement. If you ignore the existing behavior, you spend the first 12 months of your project rediscovering edge cases that the legacy system solved decades ago.

At Replay, we believe the future of modernization isn't rewriting—it’s understanding. By recording real user workflows, we treat the video and interaction data as the "source of truth." We move from a black box to a documented codebase by observing the system in its natural state.

⚠️ Warning: Attempting to modernize ICS without a verified behavioral map often leads to "Feature Drift," where the new system fails to handle critical safety or operational protocols present in the original.

Solving Lost Source: The Visual Reverse Engineering Workflow#

Instead of spending 40 hours manually documenting a single complex screen, Replay reduces that effort to approximately 4 hours. We do this through a structured extraction process that turns pixels and network calls into code.

Step 1: Workflow Recording#

Capture a subject matter expert (SME) performing standard operations on the legacy system. Replay records the DOM changes (if web-based) or visual state changes, alongside network traffic and user inputs.

Step 2: Component Extraction#

Replay’s AI Automation Suite analyzes the recording to identify patterns. It recognizes a "Valve Control Slider" or a "Pressure Gauge" not just as pixels, but as functional components.

Step 3: Design System Generation (The Library)#

The platform extracts styles and behaviors to create a centralized Library. This ensures that the modernized React components maintain the functional integrity of the original system while utilizing a modern, maintainable architecture.

Step 4: Logic Mapping (Blueprints)#

Using the Blueprints editor, architects can see the underlying logic flow. This is where we bridge the gap between "what it looks like" and "how it works," generating API contracts and E2E tests automatically.

The Output: Production-Ready Code#

When we talk about solving lost source issues, we aren't talking about "low-code" wrappers. We are talking about clean, extensible TypeScript and React code.

Below is an example of a component generated by Replay after observing a legacy industrial monitoring dashboard. Note how the business logic and state management are preserved and modernized.

typescript
// Example: Generated React component from Replay Visual Extraction
// Source: Legacy SCADA Monitoring Screen (Original Source Lost)

import React, { useState, useEffect } from 'react';
import { Gauge, AlertNotification, Button } from '@/components/industrial-ui';
import { useIndustrialData } from '@/hooks/useIndustrialData';

export const PressureMonitor: React.FC<{ machineId: string }> = ({ machineId }) => {
  const { telemetry, updateThreshold } = useIndustrialData(machineId);
  const [isAlertActive, setAlertActive] = useState(false);

  // Business logic preserved from visual behavior analysis:
  // Legacy system triggered visual red flash at > 85% capacity
  useEffect(() => {
    if (telemetry.pressure > telemetry.maxThreshold * 0.85) {
      setAlertActive(true);
    } else {
      setAlertActive(false);
    }
  }, [telemetry.pressure, telemetry.maxThreshold]);

  return (
    <div className={`p-6 rounded-lg ${isAlertActive ? 'bg-red-900 animate-pulse' : 'bg-slate-800'}`}>
      <h3 className="text-white font-bold mb-4">Unit: {machineId} - Pressure Status</h3>
      
      <Gauge 
        value={telemetry.pressure} 
        min={0} 
        max={telemetry.maxThreshold} 
        unit="PSI"
      />

      {isAlertActive && (
        <AlertNotification 
          type="CRITICAL" 
          message="Pressure exceeding safety threshold (85%)" 
        />
      )}

      <div className="mt-4 flex gap-2">
        <Button onClick={() => updateThreshold(telemetry.maxThreshold + 10)}>
          Adjust Threshold
        </Button>
      </div>
    </div>
  );
};

💰 ROI Insight: Manual recreation of the above component—including logic discovery, styling, and testing—typically takes 3-5 days of developer time. Replay generates the functional scaffold in minutes.

Bridging the Data Gap: API Contract Generation#

The biggest hurdle in solving lost source code problems isn't the UI—it's the "ghost" API. Legacy systems often communicate via undocumented, proprietary protocols or ancient REST/SOAP implementations.

Replay’s AI suite monitors the network layer during the recording phase. It maps the data sent by the UI to the responses received from the backend, automatically generating an OpenAPI (Swagger) specification. This allows your backend team to build a modern middleware or microservice layer that perfectly matches the legacy system's expectations.

yaml
# Generated OpenAPI Specification from Replay Network Extraction
openapi: 3.0.0
info:
  title: Legacy ICS Controller API
  version: 1.0.0
paths:
  /api/v1/controls/valve-state:
    post:
      summary: Extracted from "Emergency Shutoff" workflow
      parameters:
        - name: unit_id
          in: query
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                state:
                  type: string
                  enum: [OPEN, CLOSED, PARTIAL]
                override_code:
                  type: integer
      responses:
        '200':
          description: State updated successfully

Security and Compliance in Regulated Environments#

In industries like Financial Services, Healthcare, and Government, "cloud-only" is often a dealbreaker. When dealing with Industrial Control Systems, security is paramount. A "lost source" system is often a vulnerable system because it can't be patched.

Replay is built for these high-stakes environments:

• •SOC2 & HIPAA Ready: Data handling that meets the strictest enterprise standards.
• •On-Premise Deployment: Keep your reverse engineering data within your own air-gapped or secure network.
• •Technical Debt Audit: Beyond just generating code, Replay provides a comprehensive audit of your technical debt, identifying security vulnerabilities in the legacy workflow that need to be addressed in the modern version.

📝 Note: Modernizing "black box" systems also provides an opportunity to implement modern AuthN/AuthZ (like OAuth2 or SAML) where the original system might have relied on hardcoded credentials or no security at all.

The 10x Architect's Roadmap to Modernization#

If you are tasked with solving lost source code issues, follow this accelerated roadmap:

1. Identify the "Critical Path"#

Don't try to modernize the whole system at once. Use Replay to record the 20% of workflows that handle 80% of the business value.

2. Establish the Visual Source of Truth#

Record the workflows with your most experienced operators. This recording becomes the permanent documentation that was previously missing.

3. Generate the "Library"#

Use Replay to extract the UI components. This creates a modern Design System in React that mirrors the legacy functionality but uses modern CSS/Tailwind and accessible components.

4. Automate Testing#

Replay generates E2E (End-to-End) tests based on the recorded workflows. This ensures that the new system behaves exactly like the old one, providing a safety net for the migration.

5. Incremental Deployment#

Using the Flows feature, map out the architecture and deploy modernized screens one by one, rather than waiting for a 2-year "Big Bang" release.

Frequently Asked Questions#

How does Replay handle logic that isn't visible on the screen?#

While Replay excels at visual reverse engineering, it also captures the "side effects"—network calls, state changes, and data mutations. By analyzing the relationship between an input (e.g., a button click) and the resulting network traffic, Replay can infer and document complex business logic that would otherwise remain hidden in the lost source code.

Can Replay work with desktop applications or just web-based HMI?#

Replay is designed to handle a variety of enterprise environments. For web-based legacy systems, we offer deep DOM extraction. For legacy desktop applications (Citrix, Delphi, VB6, etc.), our visual analysis engine uses computer vision and OCR to map the interface and generate modern web equivalents.

Does this replace my engineering team?#

No. Replay is a force multiplier. It eliminates the "grunt work" of manual documentation and component scaffolding (which takes up 70% of a modernization project). This allows your senior engineers to focus on high-level architecture, security, and integration, rather than spending months trying to figure out what a "Submit" button does.

What is the typical time-to-value?#

Most enterprise clients see their first documented, functional React screens within 48 to 72 hours of their first recording. A full migration of a complex module that would typically take 6 months can often be completed in 3 to 4 weeks.

---

Ready to modernize without rewriting? Book a pilot with Replay - see your legacy screen extracted live during the call.