Plus I guess Visual Studio could be backdoored to recognise the TrueCrypt source code and insert malicious code?
Not only technically very difficult, but requires the MS VC++ team to be complicit and silent. I'd put it pretty far down the list.
Re:A public TrueCrypt Audit
by DigitalJack on Wednesday October 09, 2013 @08:11PM
(#6524827)
Not that hard to imagine anymore, with National Security Letters and whatnot.
Then compile it with gcc on cygwin and/or llvm and compare.
Then it won't match. Your only hope of getting exactly the same binary is to use the same compiler with all the same settings.
At the end of each official .exe and .sys file, there are embedded digital signatures and all related certificates (i.e. all certificates in the relevant certification chain, such as the certification authority certificates, CA-MS cross-certificate, and the TrueCrypt Foundation certificate). Keep this in mind if you compile TrueCrypt and compare your binaries with the official binaries. If your binaries are unsigned, the sizes of the official binaries will usually be approximately 10 KB greater than sizes of your binaries (there may be further differences if you use a different version of the compiler, or if you install a different or no service pack for Visual Studio, or different hotfixes for it, or if you use different versions of the required SDKs).