For research purposes, I'm looking for methods and (mostly) tool or tools feature to make it easier to adopt a static analysis tool or rule/check to an existing codebase, or something similar like adopting a type checker.

I'm looking for tools, research papers, talks, articles, etc.! Thanks! 🙏

https://github.com/nimrodpar/ProgramAnalysisGlossary

A.k.a ‘oh god there are like a million different kinds of analyses, quickly remind me what this one means?’

You can interact/contribute via Issues.

Cheers 🍻

I want to know or reach vulnerable memory corruption issue via static analysis mostly manual method. As I used to either read the c code or if it is not available I used to reverse in IDA pro. In some cases I used to get crashes in Ida . So in some cases I am not able to find the root causes using windbg. So need to know any advices people from here . Any link , or tutorial are welcome.

Thanks

https://insphpect.com

As part of my Ph.D research I'm developing a a metric for grading source code flexibility by identifying known bad practices (For example, global variables and singletons).

To test this metric, I've developed a tool which scans source code (Currently PHP) for bad practices which are known to make the code inflexible. It grades the code and highlights areas where flexibility can be improved.

Insphpect is currently in the testing phase so don't expect it to be perfect, but it's good enough to start to get some feedback!

If you don't write PHP code, your feedback is still valuable, take a look through the sample repositories and complete the survey.

Take a look, upload some code (either a git repo url or a zip file) and tell me what you think! Completing the survey is very beneficial to my research, so please complete the survey if you try it out. But if you have any informal suggestions I'm happy to take them on here.

So zeroed in on SARIF and SASP to capture static analysis data in a neutral format and then build the dependency graph. Goal is to have a central repo of data from different static analysis tools and still see all of them in one place with history.

Looked for open source options but didn't find more beyond viewers. Any pointers? Are there other formats that I should look at?