静态分析 API？
我对现有的静态分析工具很感兴趣。或者更确切地说，支持的 API 允许我使用这些 API 编写自己的工具。 多年来，我在目前的工作中编写了数十篇文章，仔细检查我们的源代码 (C++) 中的各种内容。但我想知道的一件事是是否还有其他可用的静态分析 API。所以
我的问题是
- 你使用什么静态分析 API？
- 你为什么使用它？
- 说出你用它写过的一件事？
对于我来说，我的答案是：
什么： 我使用 API 来理解 4 c++。
为什么： 我使用它是因为：
- 它的 C API 是一个头文件（非常小）
- C API 几乎不需要内存管理
- 我围绕它编写了一个托管包装器，这样我就可以使用 c# 了！
- API 非常小，但在查找各种事物方面功能强大。
一个工具： 好吧，上周我编写了一个工具，用于在基类上采用虚拟函数，然后更改其可访问性以及派生类上的所有虚拟重写。 如果我手工完成的话，需要花一周的时间。使用这个花了我很短时间编写的工具，我只需按一下按钮就可以更改近一千个文件。酷
注： 我还尝试过 Visual Studio 提供的 C++ 代码模型，并成功编写了针对该模型的宏。
谢谢，我期待您的任何答复。
I am interested in static analysis tools that are out there. Or rather the API's that are supported to allow me to write my own tools using these API's.
I've written dozens over the years at my present employment that scrutinize our source code (C++) for various things. But one thing I want to know is if there are other static analysis API's that are available. So
My question are
- What static analysis API's do you use?
- Why do you use it?
- Name one thing you have written with it?
As for me, my answers are:
What:
I use an API for understand 4 c++.
Why:
I use it because:
- The C API for it is one header file (Very small)
- The C API requires almost no memory management
- I wrote a managed wrapper around it so I can use c# with it!
- The API is very small but powerful in finding various things.
One Tool:
Well, last week I wrote a tool to take a virtual function on a base class and then to change the accessibility on it and all virtual overrides on derived classes.
This would have taken me a week to do by hand. Using the tool which took me a very short time to write I was able to change almost a thousand files with one push of a button. Cool
Note:
I've also played around with the C++ code model that is available with Visual studio and have been successful in writing macros to target that.
Thanks, and I look forward to any answers you may have.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
clang 尝试提供一组有用的库，用于对其支持的语言进行静态分析。
不幸的是，虽然它的C支持相当好，但它的C++支持目前还相当不完整。（Clang C++支持现在已经成熟，甚至许多C++11功能都可以使用）为什么要使用它？它是一个成熟的编译器，因此您可以完全了解您正在使用的代码。 API（至少大部分）是设计得非常好的 C++。
我还没有写过任何特别严肃的东西。我目前正在开发一个工具，该工具使用 索引库 来查找以下标头包含但从未引用，但它还没有完成（而且可能永远不会完成——我只是想把它作为进行一些探索的借口，而不是一个真正有用的工具）。
clang attempts to provide a useful set of libraries for static analysis of the languages it supports.
Unfortunately, although its C support is pretty good, its C++ support is currently pretty incomplete.(Clang C++ support is now mature and even many C++11 features are working)Why use it? It's a full-blown compiler, so you can get full visibility into the code you're working with. The APIs are (at least mostly) pretty nicely designed C++.
I haven't written anything particularly serious with it yet. I'm currently working on a tool that uses the Index library to find headers that are included but never referenced, but it's not finished yet (and may never be -- I only really intended it as an excuse to do some exploring, not really a useful tool).
我们的工具名为 CodeSonar，是一款用于 C/C++ 程序的商业高级静态分析工具。它提供了多个可用于扩展其功能的 API。请注意，它是为进行分析而设计的，而不是为了进行程序转换。
有一些API（C 和Scheme 中的）允许访问程序的AST（包括符号表）、每个子程序的CFG、整个程序调用图、编译单元、包含文件等。所有这些表示都是交叉的- 与位置信息相关，因此可以返回负责的代码行。
分析引擎访问所有这些数据结构，用户可以通过指定在访问期间调用的回调来编写检查器。
CodeSonar 是一个路径敏感的分析工具。路径探索是困难的，因为有些路径是不可行的，并且将这些路径排除在考虑范围之外需要付出一些努力。排除不可行的路径以降低误报率非常重要。 CodeSonar 允许用户搭载其路径探索，再次使用访问者模式，这允许他们编写路径敏感的检查器，而无需自己实现可行路径探索。
该机制已用于实现一个检查器，该检查器可以发现与相当复杂的错误报告习惯用法的偏差。
编写检查的另一种方法是使用不同的专用 API，其目的不是执行，而是向分析引擎提供有关程序属性的信息。粗略地说，您可以使用此 API 编写类似于动态检查属性的代码，但该代码由符号执行引擎“解释”。您可以通过调用此 API 来装饰自己的代码，或者将其全部放在一边。
许多 CodeSonar 的 API 使用内置检查器都是以这种方式指定的。
写支票只是成功的一半。一旦您在生产中使用了检查器，您就需要一种方法来管理它所发现的内容。上述所有机制都会生成填充数据库的报告，并且有一个基于 Web 客户端的 UI，用于查看结果、附加注释、与其他工具集成等。
我希望这会有所帮助！
Our tool, named CodeSonar, is a commercial advanced static analysis tool for C/C++ programs. It offers several APIs that can be used to extend its functionality. Note that it is designed for doing analysis, not for doing program transformations.
There are APIs (in both C and Scheme) that allow access to the program's ASTs (which comprise symbol tables), the CFGs for each subprogram, the whole-program call graph, compilation units, include files, etc. All these representations are cross-associated with position information, so it is possible to get back to the line of code responsible.
The analysis engine visits all of these data structures, and a user can write a checker by specifying a callback to be invoked during the visit.
CodeSonar is a path-sensitive analysis tool. Path exploration is hard because some paths are infeasible and excluding those from consideration takes some effort. It is important to exclude infeasible paths to keep false positives low. CodeSonar allows users to piggyback on its path exploration, again using a visitor pattern, which allows them to write path-sensitive checkers without having to implement feasible-path exploration themselves.
This mechanism has been used to implement a checker that finds deviations from a fairly complex error reporting idiom.
Another way to write checks is to use a different special-purpose API whose purpose is not to be executed, but to educate the analysis engine about properties of the program. Roughly speaking you can use this API to write code that is similar to what you would write for a dynamic check for the property, but which is instead "interpreted" by the symbolic execution engine. You can decorate your own code with calls to this API, or keep it all off to the side.
Many of CodeSonar's built-in checkers for API usage are specified exactly this way.
Writing checks is only half the battle. Once you have a checker in production you need a way to manage what it finds. All of the mechanisms described above generate reports that populate a database, and there is a web-client based UI for looking at the results, attaching notes, integrating with other tools, etc.
I hope this helps!
我们的 DMS 软件重新工程工具包是商业上可用的、用于解析/分析的通用机器/转换多种语言的源代码，包括C、C++、C#、Java、COBOL……
它使用显式语言定义（例如BNF）来驱动解析机器直接构建AST； DMS 支持某些语言的多种方言。内置分析器支持符号表构建、控制和数据流分析、指向分析、符号范围分析...
对于 C、Java 和 COBOL，内置分析机制与语言定义相关联，以便您可以使用这些分析器作为您可能想要构建的自定义分析的基础。 C++ 确实有符号表，但尚未与其他内部分析器绑定，但机制已经存在。
除此之外，DMS 还提供程序和源到源转换，以分析结果为条件；可以对修改后的 AST 进行漂亮打印，以重新生成包含原始注释的可编译源。
您的三个问题：
1.您使用什么静态分析 API？
2.你为什么使用它？
令人惊讶的是人们对代码有这么多不同的问题，
以及他们想要以多少种方式重塑大型应用程序。
3.说出你用它写过的一件事？
Our DMS Software Reengineering Toolkit is commercially available, general purpose machinery for parsing/analyzing/transforming source code for many languages, including C, C++, C#, Java, COBOL, ...
It uses explicit langauge definitions (e.g., BNF) to drive parsing machinery to build ASTs directly; DMS supports multiple dialects for some languages. There are built in analyzers to support symbol table construction, control and data flow anlaysis, points-to analysis, symbolic range analysis ...
For C, Java and COBOL, the built-in analysis machinery is tied to the language definitions so that you can use these analyzers as a foundation for a custom analysis you might want to build. C++ does have the symbol tables but isn't yet tied to the other internal analyzers, but the machinery is there.
DMS also provides procedural and source-to-source transformations, conditioned by analysis results, on top of all of this; the modified ASTs can be prettyprinted to regenerate compilable source complete with the original comments.
Your three questions:
1.What static analysis API's do you use?
2.Why do you use it?
Its amazing how many different questions people have about code,
and how many ways they want to reshape a large application.
3.Name one thing you have written with it?
NDepend 是一个 .NET 静态分析器，带有完整的 NDepend.API 来编写您自己的静态分析器。
免责声明：我是该工具的开发人员之一
NDepend.API 是 LINQ 友好的。提议了超过 200 条代码规则。它们基于 NDepend.API 上的 LINQ 查询，我们称之为 CQLinq 。这些代码规则涵盖了广泛的需求（API、演化/差异、命名、架构/设计、代码度量/质量、死代码、代码覆盖率、OOP...）您可以根据自己的需求调整它们并创建自己的规则那些。
提出了14个基于NDepend.API的Power Tools开源工具。 Power Tools实际上是自定义静态分析器。您也可以在这里调整它们或创建您自己的。如果您下载 NDepend 位，这些 Power Tools 的代码源位于 VisualStudio 解决方案中：$NDependInstallPath$\NDepend.PowerTools.SourceCode\NDepend.PowerTools.sln
< img src="https://i.sstatic.net/y3p6D.png" alt="NDepend 电动工具列表">
NDepend is a .NET static analyzer that comes with a complete NDepend.API to write your own static analyzer.
Disclaimer: I am one of the developer of the tool
NDepend.API is LINQ friendly. More than 200 code rules are proposed. They are based on LINQ queries over NDepend.API, what we call CQLinq . These code rules cover a wide range of needs (API, evolution/diff, naming, architecture/design, code metric/quality, dead code, code coverage, OOP...) You can adapt them to your own needs and create your own ones.
14 Power Tools open source base on NDepend.API are proposed. Power Tools are actually custom static analyzers. Here also you can adapt them or create your own ones. If you download the NDepend bits, the code source of these Power Tools is in the VisualStudio solution: $NDependInstallPath$\NDepend.PowerTools.SourceCode\NDepend.PowerTools.sln