I am looking for a tool that would analyze C/C++ code on windows and should be able capture reads and writes to variables by different functions. For example:

//in file1.c
extern int a;

    a = 1;

// in file2.c
extern int a;

    a = 5;

The tool should say that the variable "a" was written in these two functions.

This tool should cover a case like passing pointers or references to functions. For example:

int *p;
*p =2;
functionA(p); // function call
void functionA(int k) // function definition

In the above example, the tool should be able to say that the variable "p" was modified.

It should also be able to capture object oriented behavior. For example:

class objA{
    int integer_objA;
    char characterA;
    void increment_integer(){
    void print_this(){
    void write_this(){

class objB{
    int integer_objB;
    objA objectAB; // instance of class objA
    void increment_objectAB(){
    void writeAB(){
    void readAB(){

int main(){
    objB beta;
    std::cout<<"Enter a number and then a character: ";
    // increments the value of objectAB
    // this also means that beta has now changed because
    // one of its member object has changed
    return 0;

In the above example, it should be able to identify that since we change value of objectAB, inside objB's instance beta, beta is the variable/object that is written to and not just objectAB. It would also be great if the same tool has something like an API library that I can use to make it do what I want with the information that it has.

I have used some tools like the Understand tool v4.0 from Scitools, but it does not capture this.

any suggestions?

  • Trying to clarify your requirements: I think what you are looking for is "side effects of a function F". One can determine that by inspecting F for its direct side effects (if it stores via a parameter p of type int, arguably any int in the system could be effected) and combining that with the side effects of everything it calls (recursive/fixpoint). Do you effects on sytem resources? e.g., you do an fseek; the position of the file is side effected, yes or no? A variation is "side effects of F in context"; then only the entities pointed to by the parameter p can be effected.
    – Ira Baxter
    Feb 21, 2016 at 5:26
  • I am not sure if I should be calling it the side-effects. You are right when you say this "One can determine that by inspecting F for its direct side effects (if it stores via a parameter p of type int, arguably any int in the system could be effected) and combining that with the side effects of everything it calls (recursive/fixpoint)" So, I guess I need a tool that can tell me which are the methods that affect the value stored in an object/variable. And if these methods read or write to the variable/object in question. any suggestions?
    – Lucosias
    Feb 27, 2016 at 1:25
  • So what you want is a tool that produces a list of functions that can read, and which ones can affect a variable? (That seems like the equivalent/transpose of a tool that can tell you what variables a function can read, and which it can modify/side-effect. I can tell you about a tool that does the latter).
    – Ira Baxter
    Feb 27, 2016 at 4:32
  • I would like to know about the tool that you are referring to.
    – Lucosias
    Feb 27, 2016 at 21:36
  • Haven't used CppDepend myself, just the .NET equivalent NDepend. Check out the 14 day trial of cppdepend.com Aug 28, 2016 at 13:20

2 Answers 2


You can try CppDepend and its dependency matrix which report all dependency cycles between namespaces and classes. enter image description here


OP seems to want a tool that produces for each variable, what functions can read it, and what functions can write it.

That's equivalent to a tool that computes, for each function, what variables it might read, and what variables it might write. I'm going to call this information the "side effects" of the function.

If you think about this carefully, you'll realize that you actually want to know what side effects it has in the context of the specific call chain from the root method (if A calls B with an parameter that points to C, but B doesn't have any direct reference to C, then B might side-effect C in the context of a call from A. If P calls B with a pointer to X, B can't affect C in the call context of P.

A more conservative answer provides side effects for all possible call chains back to the root. In the more conservative version, because B can be called from either A or P, and in some call it can modify C, we say the side effects ("with no call context") of B are (writes-to) C.

Our DMS Software Reengineering Toolkit with its C Front End can compute the side effects with full calling context for a large set of linked C sources.

Using the C front end, DMS parses the source code (expanding preprocessor directives with the C front end preprocessor) and builds ASTs for the set of compilation units in question. Each CU is name resolved, and each function than analyzed for control and data flows. The resulting data flows are used to estimate a conservative upper bound on how pointers can be copied by the functions. DMS can then compose the direct calls graph, with the indirect possibly-calls graph, and the local side-effects information and computes a transitive closure. That transitive closure provides the reads and writes analysis for each function as a set of named declarations that may be read or may be written by the function.

This is a fairly complex exercise to set up and run, and it can be expensive to compute for big applications (We ran this on 50,000 functions in a 16 million line C system; it ate 90Gb VM; fortunately, its page behavior was remarkably local and we got by with 16Gb physical).

At present, DMS parses C++, and can compute the control flow information, and function-local data flow information and side effects. We don't yet collect sufficient interprocedural data flow facts to feed the transitive closure engine. SO DMS cannot do this for C++ yet taking full calling context into account.

  • contacted DMS, according to them they provide packages using which I can build a tool that can fulfill my requirements. I am looking for a tool that has already been made. I do not want to make a new tool. I hope you understand now.
    – Lucosias
    Apr 10, 2016 at 23:11
  • Hmm. Your question is unclear as to whether you want to do this for C or for C++ (they are not the same language) or both. AFAIK, DMS with its C front end does side-effect analysis for C. If you want this for C++, you'll have to build on top of DMS's local flow analysis, true.
    – Ira Baxter
    Apr 11, 2016 at 0:04
  • I was hoping people would figure it out by looking at the same code I posted. As such I require both.
    – Lucosias
    Apr 22, 2016 at 5:21
  • 1
    @lucosias The code you posted seems to be entirely C++, or at least valid in C++. May 1, 2016 at 6:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.