21–30 of 32 posts
The kinds of analyses mentioned here are typically grouped under "linting"–more advanced static analysis tools will typically do things like dataflow analysis.
I too would be interested in interesting static code analyses (that are beyond linting).
Earlier quoted context omitted.
Somewhat annoyingly, the static analyzer that ships with Xcode doesn't seem to be packaged separately as in the command line tools…
Hmm, command-line clang accepts a --analyze option here ("Apple clang version 11.0.0"), and this seems to give additional output over the regular warnings. I'm not sure if that's the same thing as the analyzer integrated into Xcode, but some sort of static analyzer seems to be there.
Thanks for this article, dolftax! I followed all the examples on my machine with no problem, and I learned some new stuff. I have a question: how difficult is it to implement the ast? It seems like that the bulk of the work for this static code analysis.
Earlier quoted context omitted.
I want to read more on this topic. Have you written about this anywhere, or do you have a pointer/suggestion?
This article gets more into actual analysis of program state and execution: http://matt.might.net/articles/intro-static-analysis/ If you want to go deeper, Principles of Program Analysis is a popular reference: Principles of Program Analysis https://www.amazon.com/dp/3540654100/
Also worth checking out is BAP, the Binary Analysis Platform, which is the successor project to Bit Blaze, and is one of the most fascinating binary analysis frameworks out there for my money. It was the only one of the darpa CGC entries that ran on real binaries, not the much less complicated ones developed specifically for the challenge.
Earlier quoted context omitted.
This article gets more into actual analysis of program state and execution: http://matt.might.net/articles/intro-static-analysis/ If you want to go deeper, Principles of Program Analysis is a popular reference: Principles of Program Analysis https://www.amazon.com/dp/3540654100/
I would not recommend POPA to people wanting to go down this road, its an extremely difficult text. Personally, just my 2 cents here, a far more useful text would be Practical Binary Analysis, https://practicalbinaryanalysis.com/ The Cousant's text is fascinating but requires a level of mathematical maturity at virtually post-doc researcher levels
This is useful because it reduces many program analysis design questions to questions of which lattice to use. It also allows you to compare algorithms by comparing their lattices, which makes it easier to see how algorithms are related.
The cost is that this approach will be pretty alien if you don't have experience with abstract algebra or related fields. If you do have that experience, I don't think it requires mathematical maturity beyond an undergraduate level.
The kinds of analyses mentioned here are typically grouped under "linting"–more advanced static analysis tools will typically do things like dataflow analysis.
Any beginner friendly articles on more advanced analysis that you'd recommend?
Going to drop a toplevel comment and say while this is interesting (sincerely!) if people are interested in deeper tools/techniques the book Practical Binary Analysis is excellent, it ends in taint checking, symbolic excution techniques and uses Pin. https://practicalbinaryanalysis.com/ Also worth checking out is BAP, the Binary Analysis Platform, which is the successor project to Bit Blaze, and is one of the most fa…
Thanks for this article, dolftax! I followed all the examples on my machine with no problem, and I learned some new stuff. I have a question: how difficult is it to implement the ast? It seems like that the bulk of the work for this static code analysis.
It's good to see discussions of static analysis, but I often feel that these blog posts do a disservice to the techniques. The post leads by mentioning applications like bugfinding and security vuln detection but the examples here are barely above local syntactic checks. This is the common scenario in the majority of blog posts I see about static analysis, probably because it is just much easier to put together a qui…