What are some C/C++ static analysis tools for finding dependencies in code?

Question

I am looking for a tool that would analyze C/C++ code on windows and should be able capture reads and writes to variables by different functions. For example:

//in file1.c
extern int a;

write_to_a(){
    a = 1;
} 

// in file2.c
extern int a;

write_to_a_again(){
    a = 5;
} 

The tool should say that the variable "a" was written in these two functions.

This tool should cover a case like passing pointers or references to functions. For example:

int *p;
*p =2;
functionA(p); // function call
void functionA(int k) // function definition
{  
  k++;
}

In the above example, the tool should be able to say that the variable "p" was modified.

It should also be able to capture object oriented behavior. For example:

class objA{
    int integer_objA;
    char characterA;
    public:    
    void increment_integer(){
        integer_objA++;
    }
    void print_this(){
        std::cout<<integer_objA<<"\n";
        std::cout<<characterA<<"\n";
    }
    void write_this(){
        std::cin>>integer_objA;
        std::cin>>characterA;
    }
};

class objB{
    int integer_objB;
    objA objectAB; // instance of class objA
    public:
    void increment_objectAB(){
        objectAB.increment_integer();
    }
    void writeAB(){
        objectAB.write_this();   
    }
    void readAB(){
        objectAB.print_this();
    }
};

int main(){
    objB beta;
    std::cout<<"Enter a number and then a character: ";
    beta.writeAB();
    // increments the value of objectAB
    // this also means that beta has now changed because
    // one of its member object has changed
    beta.increment_objectAB();
    beta.readAB();
    return 0;
}

In the above example, it should be able to identify that since we change value of objectAB, inside objB's instance beta, beta is the variable/object that is written to and not just objectAB. It would also be great if the same tool has something like an API library that I can use to make it do what I want with the information that it has.

I have used some tools like the Understand tool v4.0 from Scitools, but it does not capture this.

any suggestions?

Answer 1

You can try CppDepend and its dependency matrix which report all dependency cycles between namespaces and classes.

Answer 2

OP seems to want a tool that produces for each variable, what functions can read it, and what functions can write it.

That's equivalent to a tool that computes, for each function, what variables it might read, and what variables it might write. I'm going to call this information the "side effects" of the function.

If you think about this carefully, you'll realize that you actually want to know what side effects it has in the context of the specific call chain from the root method (if A calls B with an parameter that points to C, but B doesn't have any direct reference to C, then B might side-effect C in the context of a call from A. If P calls B with a pointer to X, B can't affect C in the call context of P.

A more conservative answer provides side effects for all possible call chains back to the root. In the more conservative version, because B can be called from either A or P, and in some call it can modify C, we say the side effects ("with no call context") of B are (writes-to) C.

Our DMS Software Reengineering Toolkit with its C Front End can compute the side effects with full calling context for a large set of linked C sources.

Using the C front end, DMS parses the source code (expanding preprocessor directives with the C front end preprocessor) and builds ASTs for the set of compilation units in question. Each CU is name resolved, and each function than analyzed for control and data flows. The resulting data flows are used to estimate a conservative upper bound on how pointers can be copied by the functions. DMS can then compose the direct calls graph, with the indirect possibly-calls graph, and the local side-effects information and computes a transitive closure. That transitive closure provides the reads and writes analysis for each function as a set of named declarations that may be read or may be written by the function.

This is a fairly complex exercise to set up and run, and it can be expensive to compute for big applications (We ran this on 50,000 functions in a 16 million line C system; it ate 90Gb VM; fortunately, its page behavior was remarkably local and we got by with 16Gb physical).

At present, DMS parses C++, and can compute the control flow information, and function-local data flow information and side effects. We don't yet collect sufficient interprocedural data flow facts to feed the transitive closure engine. SO DMS cannot do this for C++ yet taking full calling context into account.