views:

4665

answers:

17

What C++ static code analysis tool are there on Microsoft Windows, and which would you recommend?

Please state whether a particular tool relies on cygwin, and whether it cost money. One per post as per for voting up & down.

Similar Question: http://stackoverflow.com/questions/141498/what-open-source-c-static-analysis-tools-are-available

+1  A: 

Flawfinder

Iulian Şerbănoiu
Can you add some more basic information about it in your post, as KTC requets?
jfs
+2  A: 

Visual Studio Team System now has code analysis tools (although VSTT is pretty expensive).

Alan
+3  A: 

PC-Lint does a fair bit of static analysis.

Michael Burr
Admittedly I haven't tried PC-Lint for a while, but last time I did it was really noisy. It finds good issues...and a whole lot more.
Steve Rowe
+5  A: 

We use Coverity. It isn't free by a longshot, but Windows is a supported plaform.

Jonesinator
+11  A: 

If you run VC2008 (Express version is free) and then install the latest Windows SDK, you can get the same PREFAST static code analysis tools normally only available in VSTT. If you're already using Visual Studio this is a great way to go, if you're using GCC or some other compiler for Win32 you'll need to look elsewhere.

Prefast comes with the Windows Driver Kit (WDK), not the SDK.
KTC
If Prefast works for the largest software project on the planet (and it does), it'll probably work for you too
Paul Betts
A: 

I've also heard that Oink is good.

Alan
+1  A: 

I have used source monitor for years. some of the things does great things. Best part is that it is free.

Check out the hompage for source monitor here: Source Monitor

MikeJ
A: 

Two years ago I've used Scitools' Understand. It is portable (at least the Windows-Linux combination that we use) and has support for multiple languages. Could very well be that that is not what you're after though...

What will be interesting anyway is that it is fairly affordable, and that the support is impressive, issues and questions are more often than not addressed the same day.

andreas buykx
A: 

I use PC-Lint for code static review!

+6  A: 

CppCheck is open source and cross-platform.

Soo Wei Tan
+2  A: 

Klocwork "Insight" is another, but it's not free. I've also used Coverity "Prevent". Both are very good products if you don't mind the cost.

Void
A: 

i think 3 opensource static analysers impressive

Cppcheck - easy with gui interface...checks for coding standards and other critical issues... cccc - outputs the coding metrics..like no of lineof code...code coplexity index..comment count etc Cqual++ - will ave to build it form repository...gives the dataflow in code method and type level

my question is can i add custom codibng standards..is there any open tools supporting additin of custom coding standards

A: 

Our DMS Software Reengineering Toolkit processes a variety of C++ dialects. It can be obtained with a duplicated code detector (exact or near miss clones), but is generally designed to be customized to carry out the analysis you want. See DMS.

EDIT Yes, you can code your own custom analyses or style checks.

Ira Baxter
A: 

Vera++ also enables to check custom coding standards through scripts...

+1  A: 

I'm one of the developers for a Visual Studio C/C++ static analysis tool called Goanna. This one costs money (there's a free trial), but I'd like to think it's good.

David Crawshaw
+1  A: 

Sentry is a C++ static analyzer that supports Windows and Linux. It's not free, but it's more powerful than simple free tools like Lint.

Mike Mueller
+2  A: 

CppDepend has some useful features to analyse architecture, design and implementation, it provides CQL language to query code like SQL.

IssamLahlali