Insights

Legacy Code Analysis: Tools and Step-by-Step Method

guillermo.rodriguez@go4it.solutions (Guillermo Rodríguez | CTO) — Fri, 03 Jul 2026 11:54:39 GMT

Legacy code used to be defined as the code that someone who did not write it is responsible for maintaining. Today that definition is too narrow: it also applies to applications developed by the company itself, when the people who originally wrote the code are already working on other projects. A more useful definition is this: legacy code is code that is difficult to modify because its behavior is unknown, almost always due to a lack of documentation and tests. Before touching a single line, it has to be analyzed. This article reviews what to prepare before starting and which legacy code analysis tools help get the job done in reasonable timeframes.

What legacy code actually is (and why it is so hard to change)

Legacy code is not just old code: it is code that is difficult to modify because nobody fully understands how it works. It is usually undocumented or poorly documented, almost never has unit tests, and often does not follow any design pattern that is still recognizable today.

For changes that are not trivial, you first need to understand the architecture, how its components relate to one another, and what limitations each one has. These applications also tend to be monolithic, which makes it even harder to define the real scope of a change.

Before analyzing legacy code: what to prepare first

There are some prerequisites worth addressing before starting the analysis. The first is to be clear about the goal: analyzing an application to replace it in the medium term is not the same as analyzing it to maintain it, or to modernize it so it can keep running for a long time.

Gather all available information: technical documentation, user manuals, initial requirements, and the history of changes. This helps you understand why certain decisions were made over the software’s lifetime.
If repositories exist, preserve all code versions. Seeing how the code evolved to meet needs that were not anticipated at the start provides context that is not written down anywhere.
Obtain a full or partial copy of the database that allows you to understand the system in real operation. Sometimes the parts that seemed most complex are barely used, and that completely changes the priorities of the analysis.

A typical case: custom calendars built into legacy applications that no one uses anymore because email clients and office suites do that job better. Detecting that dead code and replacing it with simple connectors reduces maintenance cost with very little effort.

Static analysis tools: the first level of analysis

How do you analyze an application with hundreds of thousands of lines of code? Doing it manually requires resources and time that are almost never available, especially if the application is still in use and must be changed soon. This is where static code analysis tools come in, such as Helix QAC for C and C++, or Klocwork, which also covers C# and Java. There are options for almost every language: the key is choosing the one that fits the software you are analyzing.

Also, generative AI has changed this landscape by making software easier to understand, generating documentation, answering questions about the code, and even identifying patterns and possible issues in a matter of minutes. However, AI does not replace static analysis; static analysis tools remain an essential complement.

At the unit level, these tools report on how isolated parts of the code behave with respect to the rest: data, benchmarks, system behavior. It is a basic but necessary analysis, and it provides a solid first picture of the overall architecture.

At the technology level, they make it possible to analyze interactions between those parts in order to detect potential errors, such as a method that returns output that can cause another class to fail. In those cases, you need to adapt the class so it validates the data, or derive it to handle that specific case.

System-level analysis: performance, security, and databases

At the system level, other pieces come into play: the environment, the database, the full infrastructure. Here the tools focus less on the code itself and more on its behavior in specific tasks, allowing you to detect, for example, components that generate an unnecessary number of database requests and slow down the entire application.

Optimizing and rationalizing those queries usually improves performance directly.
Adding in-memory database caches or token-based authentication systems solves many performance and security issues in a way that is practically transparent to the rest of the application.

For this kind of analysis, general profiling or benchmarking tools are usually used to study database usage, operating system resources, and network access.

Checklist: is everything ready to analyze your legacy code?

Are you clear on whether the goal is to maintain the application, replace it, or modernize it so it can keep running long term?
Have you collected all available technical documentation, requirements, and change history?
Do you preserve all code versions in the repository, not just the latest one?
Do you have a copy of the database that reflects real system usage, not just its original design?
Do you know which static analysis tool fits your application’s programming language?

Frequently asked questions about legacy code analysis

What exactly is legacy code?

It is code that is difficult to modify because its behavior is unknown. It is almost always undocumented, without unit tests, and not following current design guidelines, regardless of its age.

Where should you start before analyzing legacy code?

By defining the goal of the analysis: whether it is for maintenance, replacement, or modernizing the application. Then you should gather documentation, preserve repository history, and obtain a realistic copy of the database.

Which static code analysis tools are used most often?

Today, code analysis combines two complementary approaches. On one hand, generative AI helps with software comprehension, documentation generation, and rapid exploration of large codebases. On the other hand, static analysis tools remain essential when you need precise, verifiable, and deterministic information about code behavior.

Among the most widely used static analysis tools are Helix QAC for C and C++, and Klocwork, which also supports C# and Java. Equivalent solutions exist for most languages; the important part is choosing the one that best fits the technology of the application being analyzed.

What is the difference between unit-level and technology-level analysis?

Unit-level analysis studies isolated parts of the code: data, benchmarks, behavior. Technology-level analysis goes one step further and studies how those parts interact with each other to detect errors that only appear in that interaction.

What is analyzed at the system level in a legacy application?

The complete environment: database, infrastructure, access patterns. It allows you to detect, for example, components that generate unnecessary database requests and slow down the entire application.

Is analyzing legacy code for maintenance the same as analyzing it for migration?

No. If the goal is maintenance, the analysis focuses on understanding risks and dependencies. If the goal is migration or replacement, much of the complexity you discover may end up being discarded along with the code that is no longer needed in the new system.

What Is Machine Learning: definition, examples, and how it works

guillermo.rodriguez@go4it.solutions (Guillermo Rodríguez | CTO) — Fri, 03 Jul 2026 11:36:27 GMT

Machine Learning is one of the technologies getting the most attention right now, and not only in technical circles: it is also being discussed in sectors as far removed from computing as industry and manufacturing. To understand why, you first need to know what Machine Learning is, what it is used for, and how it works under the hood. Below, we review the most important points without unnecessary jargon.

What Machine Learning is (and why it has become so popular)

Within Artificial Intelligence there are several branches or approaches. One of them is Machine Learning, which in Spanish is translated as “aprendizaje automático.” It has been theorized and developed for decades, but only in recent years has it become popular enough to move beyond the purely scientific sphere and enter business language and mainstream media.

Part of that popularity comes from the fact that Machine Learning is already part of everyday life for almost everyone. Many product and service companies boast about using it as a competitive advantage, and that has helped make the term familiar even to people who have never written a line of code.

Where you encounter Machine Learning in everyday life

Machine Learning is much closer than it seems. Here are some of the most common examples:

Personalized recommendations: platforms like Netflix use it to suggest content based on what you have already watched.
Text assistants and suggestions: from virtual assistants on your phone to Gmail, which suggests phrases just when you were about to type them yourself.
Security and identification: captcha systems that reliably distinguish people from bots, and facial recognition algorithms that unlock your phone or organize your photos.

It is also behind less visible but equally important uses: early disease detection, financial, weather, or sports forecasting, and increasingly, software modernization that needs some kind of experience-based automation.

How long Machine Learning has been around: a brief history

There is a lot of theory written about this branch of computing: since the 1950s, the foundation that makes all this possible has been taking shape. However, practical applications were very limited until recent decades, when increased processing power and, above all, lower barriers to access, made a real leap possible.

A good example is internet search engines. In the early 1990s, they were little more than hand-built directories. As the web grew, that stopped being viable, and crawlers began to appear: bots that scanned and indexed content. Google was the first to successfully rank that content by relevance with PageRank, laying the foundations of what we now take for granted when searching online.

Today, search engines use Artificial Intelligence to identify what a page is about by analyzing its actual content, something that used to be done through tags filled in by the website creator themselves and which turned out to be easy to manipulate. They also learn from user behavior: if someone opens the first result and immediately goes back, the system takes note to improve next time.

How Machine Learning works: the logic behind learning

There are different algorithmic techniques that allow a machine to learn, but most methods start from Bayes’ theorem: the ability to calculate the conditional probability of a given event occurring. In practice, almost everything comes down to trial and error.

The machine analyzes the available data and looks for correlations that, for a human analyst, might not make any sense. It then tests that hypothesis against another data set to check whether it performs better than chance. By repeating this process over and over, the algorithm refines the correlations that work best. In more advanced cases, it is not even necessary to build the algorithm from fixed conclusions: the system feeds back into itself and adjusts over time.

Checklist: does Machine Learning make sense in your company?

Do any of your systems need to automate decisions based on accumulated experience, not just fixed rules?
Do you generate enough data for an algorithm to find useful correlations in it?
Do you have manual processes that today depend on the intuition of an experienced person?
Could any of your legacy systems benefit from a prediction or recommendation layer?
Would you be able to tell the difference between a good Machine Learning use case and a passing trend?

Frequently asked questions about machine learning

What is Machine Learning in simple terms?

It is a branch of Artificial Intelligence, also called “apprentissage automatique” in Spanish, in which a machine learns from data and examples instead of following fixed rules written by a person.

What Machine Learning examples do I use without realizing it?

Netflix recommendations, Gmail text suggestions, mobile virtual assistants, captcha systems, and facial recognition are examples that almost everyone uses every day without thinking about the technology behind them.

How long has Machine Learning existed?

The theory goes back to the 1950s, but practical applications were very limited until processing power increased and access to technology became cheaper, well into the current century.

How does a machine learn in Machine Learning?

By analyzing data and looking for correlations through trial and error. It compares those correlations against new data to see whether they outperform chance, and repeats the process until it fine-tunes an algorithm that makes reliable predictions.

Is Machine Learning the same as Artificial Intelligence?

Not exactly. Artificial Intelligence is the broader field, and Machine Learning is one of its branches: the one focused on systems learning from data instead of following explicitly programmed instructions.

Can Machine Learning help modernize legacy systems?

Yes, especially when software needs some kind of automation based on accumulated experience: pattern detection, predictions, or recommendations that used to depend entirely on fixed rules or on a person’s intuition.

Visual Basic 6 replacement: what options really exist and how to migrate without stopping the business

guillermo.rodriguez@go4it.solutions (Guillermo Rodríguez | CTO) — Fri, 03 Jul 2026 09:40:45 GMT

If you have production applications written in Visual Basic 6, you already know that Microsoft ended support in 2008. We have spent eighteen years operating on an environment without security patches, without runtime updates, and without native compatibility with modern 64-bit operating systems. The question of what software can replace Visual Basic 6 is not academic: it is a decision that most CTOs and IT Directors have had pending for years and that, at some point, stops being postponable. This article does not aim to convince you of anything you do not already know. It aims to be the technical guide you were missing to make that decision with sound judgment.

Why you have been postponing the decision for years and what has changed in 2026

The most honest answer is that postponing made economic sense. As long as the system kept working, the cost of not migrating was invisible. The visible costs — migration, operational risk, learning curve — weighed more heavily on the annual budget.
What has changed in the last three years is that this equation no longer works:
Maintenance costs have grown non-linearly. Fewer than 2% of active developers work with Visual Basic as their primary technology (Stack Overflow Developer Survey 2024). The hourly cost of a senior VB6 specialist in Spain has multiplied by 2.3 over the last five years.
Technical debt has reached an inflection point. Applications developed in VB6 between 1995 and 2005 now carry between 20 and 30 years of patches, workarounds, and business logic buried in modules that no one remembers the purpose of.
Regulators are not indifferent. DORA (Digital Operational Resilience Act), in force since January 2025, establishes operational resilience requirements. An unsupported vendor application processing financial transactions is a documented point of regulatory risk.

Real options as a replacement for Visual Basic 6

There are four paths typically considered in any VB6 modernization project:

1. Manual rewrite in a modern language (Java, C#, Python)

It makes sense when the system is small and well documented. 74% of manual rewrite initiatives exceed the initial budget, and 52% do not complete the functional migration within the expected timeframe, according to a 2023 Gartner report. The underlying problem: the business logic lies in years of patches that no one documented.

2. Rewrite assisted by generative AI (GitHub Copilot, LLM models)

Generative AI is not deterministic: given the same input, it can produce different outputs. For banking settlement systems or insurance policy calculation, an unexpected variation is a regulatory risk, not a bug. According to a 2024 Forrester Research report, 68% of AI migration pilots in critical systems were halted بسبب traceability problems.

3. Emulation and encapsulation (wrappers, APIs over the existing system)

A transitional solution, not a modernization one. Useful for gaining 12–18 months while preparing the real migration. The risk: adopting it as a permanent solution and accumulating an additional layer of technical debt.

4. Automatic migration with an industrialized and deterministic process

Our automated migration process, built around our own pivot language, produces verifiable and traceable functional equivalence by following formal rules — not statistical ones. Result: clean, readable code that can be maintained by the in-house team, with no additional licensing. Recommended for systems with 50+ functional units, complex or poorly documented logic, and regulated environments where traceability is mandatory.

Is generative AI already good enough?

For secondary applications: possibly yes. For core applications with 25 years of accumulated rules: no, and probably not within the next three years for that level of criticality.
The argument is not that AI is bad technology — it is excellent for assessment, automatic documentation, and test generation. The argument is that the place where variation is not tolerable is exactly where AI has its inherent limitations. For those systems, determinism is not a marketing argument: it is a functional requirement.

What happens in practice: the decision pattern we have seen in banking and insurance

In the projects we have executed, the process follows this pattern:

The initial trigger is almost always an incident, an audit, or a regulatory change. The item has usually remained in the backlog for 2 to 5 years.
The first evaluation includes large consulting firms and AI tools. The result: an expensive manual rewrite or an AI pilot that does not scale to critical modules.
The final selection criterion is not price. It is technical certainty: “Can I commit this project to my board of directors with a guarantee that it will work?”

A free proof of concept on the system’s own modules answers that question better than any presentation.

Evaluation checklist: before deciding which replacement to use for your VB6 system

How many windows, modules, or functional units does the system have? (From 100 onward, manual rewriting starts to become unfeasible within reasonable timeframes.)
Is the business logic documented? (If the answer is “more or less,” there is hidden logic that a manual rewrite will not capture.)
Does the system process critical transactions or regulated data? (If yes, traceability is a non-negotiable requirement.)
Can the business tolerate a code freeze during the project? (Most cannot: the business continues evolving while the migration is underway.)
Can the provider demonstrate verifiable functional equivalence before committing to the full project?

Frequently asked questions about migration and replacement of Visual Basic 6

What is the best replacement for Visual Basic 6 in critical enterprise applications?

There is no direct replacement in the sense of “I install X and the code works the same.” What exists are migration strategies toward modern languages such as Java, C#, or Angular. The most important criterion is not the target language but the migration process: it must guarantee complete functional equivalence, traceability, and must not require freezing the code during the project.

Can generative AI (ChatGPT, GitHub Copilot) migrate VB6 applications?

It can generate code in modern languages from VB6, but not deterministically. For systems that process financial transactions or policy calculations, the lack of verifiable traceability is a problem that no manual review can fully solve at scale. Projects that have tried usually reach 60–70% coverage and get blocked on the most critical modules.

How long does it take to migrate a VB6 system to Java or Angular?

A proof of concept on real modules: 2–4 weeks. A full automated migration project: between 3 and 18 months depending on volume and complexity. The critical variable is not the volume of code, but the complexity of the business logic and whether the business can continue evolving during the migration.

What happens if we continue maintaining VB6 applications in production without migrating?

In the short term, the system will keep working. The risk is cumulative: incompatibilities with modern Windows 11/Server environments, inability to apply security patches, and scarcity of VB6 developers. In the context of DORA (in force since January 2025), operating critical applications without vendor support must be documented as a managed risk.

What is the difference between deterministic automatic migration and manual VB6 rewriting?

Manual rewriting depends on how much the team understood of the original logic. Deterministic automatic migration starts from formal transformation rules: the code is converted through a reproducible process where functional equivalence is verifiable and traceable. Any auditor can see which line of the original code corresponds to which line of the new one.

How do I know if my VB6 system is a candidate for automatic migration?

The best candidates are systems with 50+ functional units, consolidated business logic, regulated environments where traceability is mandatory, and organizations that cannot tolerate system downtime. A free proof of concept on the most representative modules is the fastest way to validate before committing any budget.

GO4IT participates in the NOCOD4TST project

info@go4it.solutions (GO4IT) — Fri, 03 Jul 2026 07:19:49 GMT

GO4IT SOLUTIONS successfully completes the first year of the NoCode4Testing project

At GO4IT SOLUTIONS, we continue to invest in technological innovation as a driver of business transformation. Today, we would like to share an important milestone: we have successfully completed the first year of the NoCode4Testing project, a strategic initiative aimed at redefining how organizations modernize and validate their software systems, funded through the HAZITEK call.

A project to transform software quality

NoCode4Testing was created with a clear objective: to revolutionize the validation process in the modernization of legacy systems. In a context where many organizations still depend on outdated technologies, ensuring quality after a migration remains one of the greatest challenges, both due to its complexity and its cost.

The project proposes a disruptive approach based on multimodal generative artificial intelligence. Instead of relying on labor-intensive manual processes, the solution aims to automate the generation of functional tests based on the real use of legacy applications, capturing video, audio, and user interaction and transforming them into automatic testing scripts.

Innovation based on generative AI

During this first year, the focus has been on laying the technological foundations of the system. Specifically, work has been carried out on:

Researching AI models capable of interpreting interfaces and business processes from video and voice.
Developing intelligent agents that transform this information into structured descriptions.
Automatically generating functional testing scripts to validate modernized systems.

This approach enables progress towards a model in which software quality is no longer a bottleneck, but becomes an automated, continuous, and scalable process.

Initial results and learnings

The first year has focused on research and the development of the first prototypes, especially in scenarios where legacy systems in Windows environments evolve into modern web applications.
Key progress includes:

Defining the system’s core architecture.
Initial development of multimodal AI pipelines.
First functional prototypes for the automatic generation of tests.

These achievements validate the technical feasibility of the approach and lay the groundwork for the next phases of the project.

Expected impact: efficiency and quality

The potential impact of NoCode4Testing is meaningful. We estimate that the solution will allow to:

Reduce the effort required to perform functional testing by up to 75%.
Reduce errors detected during validation phases by 50%.

This not only represents an improvement in operational efficiency, but also accelerates the technological modernization processes of our clients.

Looking ahead

Following this first year, the project is entering a new phase focused on:

Expanding use cases and types of legacy systems.
Improving the accuracy and robustness of the models.
Integrating more complex tests and real-world scenarios.

At GO4IT SOLUTIONS, we are convinced that NoCode4Testing will mark a turning point in the way companies approach software modernization, combining automation, artificial intelligence, and operational efficiency.

We keep moving forward.