It doesn't actually need to be open source. If they published binaries that would be enough to analyze.