At the end of the summer I headed back to university, still under tenuous employment with Juniper. I noticed that BinDiff’s license agreement explicitly allowed the user to reverse engineer BinDiff itself. I loaded bd_bindiff.plw into IDA, and discovered that it was more interesting than the malware and vulnerabilities that I was dealing with in my other work. I decided to manually decompile it. It took three or four weeks, resulted in about 10,000 lines of C++/STL source code, and was a nightmare to get working (imagine manually byte-patching the .plw to make it print out debug information via IDA’s msg(), adding the same debug information to the decompiled source code, and then comparing the results by hand), but I eventually succeeded: at the end of it,	 I had a codebase that I could recompile and which functioned identically to the original. In Q3-2004, I sent about 25 bug reports over to Halvar, who then hired me to take over work on the codebase

Source: Interview with Rolf Rolles in the current HITB magazine (http://bit.ly/dQQphe)