1. A method comprising: generating a suspect abstract syntax tree by partially decompiling a compiled software module; and comparing the suspect abstract syntax tree to one or more reference abstract syntax trees.