C++ Professional Code Analysis Tools

Question

Hello there, I would like to ask about the available (free or not) Static and Dynamic code analysis tools that can be used to C++ applications ESPECIALLY COM and ActiveX.

I am currently using Visual Studio's /analyze compiler option, which is good and all but I still feel there is lots of analysis to be done.

I'm talking about a C++ application where memory management and code security is of utmost importance.

I'm trying to check for problems relating to security such as memory management, input validation, buffer overflows, exception handling... etc

I'm not interested in, say, inheritance depth or lines of executable code.

Answer 1

Start here are work your way you http://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis

I don't mean to be rude when I say "google it". Personally (ymmv) I learn much more along the way from googling than just having someone give me "the" answer.

Also, when I look for tools, I will go to to SourceForge and look for - in this case - "static code analysis"

Btw, check out Valgrind

Answer 2

There is a security tool category called the fuzzers which were used in the recent Pwn2Own 2010 contest in Vancouver. The winning guy said that he's not going to tell software makers which bug he found but instead how to create a good fuzzer that will allow them to find the bugs. This was covered by computerworld.

Basically, it finds every place that the software can take input and tries to inject random data until the application crashes. Starting from there, the user attempts to understand what went wrong and develops an effective attack.

I don't know any particular fuzzers but there are many kinds of them for various uses (buffer overflows vs sql injections, 2 very different problems, 2 different fuzzers)

Answer 3

Without a doubt you want to use Axman. This is by far the best ActiveX/Com security testing tool available, and its open source. This was one of the leading tools used in the Month Of Browser Bugs by H.D. Moore, who is also the creator of Metasploit. I I have personally used Axman to find vulnerabilities and write exploit code.

Axman uses TypeLib to identify all of the components that makeup a COM . This is a type relfection, and it means that Source code is not required. Axman uses reflection to automatically generate fuzz test cases against a COM.

Answer 4

We use Coverity Prevent which is a very sophisticated static analysis tool that stores defects in a database that has a web interface. It works for C, C++, and Java.

We also use open source tools like Valgrind.