Skip to main content

Configure an analysis with C or Cpp

What's different with C/C++? 

When analyzing C/C++ source files, important information needed for the analysis is specified at compilation time and Kiuwan Local Analyzer can't know about this in advance.

For example:

  • Where header files used in the source code are located.
  • Which macros are defined at compilation time.

Kiuwan Local Analyzer can automatically resolve this configuration to get a complete reliable analysis.

Inspecting build logs

Kiuwan Local Analyzer can inspect C and C++ build log files to automatically resolve headers and macros used in your source code.

Follow these steps to configure Kiuwan Local Analyzer by inspecting your build logs:

  1. Run the build tool (make, nmake, imake, MSbuild, scons, etc.) for the software to analyze and dump the build output to a log file. Make sure that build runs with clean dependencies. You may set the -n flag to make a build without executing compilation scripts and to ensure that commands are dumped. Examples:
    1. make clean && make -n > build.log
    2. nmake /N clean all > build.log --> cmd windows
    3. msbuild /nologo /t:rebuild MyProject.proj > build.log
    4. scons -Q -n > build.log
  2. Open the Kiuwan Local Analyzer, log in, select the application to analyze and set a source code folder.
  3. Select the language to analyze (C or C++) and click the Configuration button.
  4. In the Analysis Configuration tab, select the analysis language in the Select block dropdown menu (C or C++).
  5. Click on the Details button in the Analyze build logfile row.
  6. Browse the generated build log file and click Analyze.

The selected build log file will be analyzed to resolve used headers and macro definitions. Once the build log file analysis is done, a results window will be shown:

Follow these steps to apply the found information to your configuration:

  • Click on OK to update the header and macro configuration with the found data.
  • You can check that the "Header directories" and the defined macros will have been updated with the new information.
  • Click on Save" button to apply the configuration to your application (or globally).

You can also click on "Cancel" button if you want to analyze again a log file, change the log file or not apply the found information to the current configuration. Note that the configuration will not be saved until you click on "Save" button in the main configuration dialog.

Now you can click on "Analyze" to analyze your C or C++ application with the new header and macro definitions.

 

Use Case 1 Code Analysis with C or Cpp

Code Analysis with C/C++

Please note that these instructions may be outdated!

The static analysis of C/C++ is a bit different from the analysis of other programming languages because the preprocessor complicates the analysis process a little bit. Resolving header files and macros, used in the preprocessing phase, is essential for a complete and correct C/C++ static code analysis. Let’s break down step by step how to analyze a C application with Kiuwan Code Security.

(Please note: some screenshots may be outdated)

Analyzing locally

Kiuwan Local Analyzer can be downloaded from the new analysis screen:

Or from your management drop-down menu:

Once the local analysis is complete, you can check the temp folder under Kiuwan Local Analyzer installation directory. You can find a new directory for this analysis. In our case: %KiuwanLocalAnalyzer%\temp\linux-ftpd.82232984

Here are the log files (certainly not very user-friendly) that help us to find the causes of parsing errors.

The file .unresolved.headers.log has the list of header files that were not found during the analysis. These files are not mandatory for a successful analysis, but they can help you to know where you have declared some macros that are subsequently used.

Our first parsing error.

Cannot parse C:\_dev\c\linux-ftpd-0.17\ftpd\extern.h, due to: Parse error at line 38, column 1. Encountered: void
line[38]: void blkfree __P((char **));

This error is due to the macro __P, which was not found during the analysis. This symbol is known as a parameter wrapper. It is a kind of macro, often used in sources that are meant to be compatible with pre-ANSI compilers to protect parameter declarations in function prototypes.

This macro, in our system, is located in /usr/include/x86_64-linux-gnu/sys/cdefs.h file, and is defined as:

#define __P(args) args

The sys/cdefs.h file was one of the listed in the log file c.unresolved.headers.log.

To solve this problem, we can edit the configuration for this application. On Kiuwan Local Analyzer’s ‘Analyze screen’, click on Configuration:

We have two options:

  1. Edit the ‘Header directories’ entry, where you can set a comma-separated directories list (absolute or relative to source directories), which includes files that could be found. This is a good option if you are analyzing in the same machine where the code is compiled and you have access to all source code dependencies.
  2. Go to the ‘Macro definition section’, and click on Edit. On the new screen, you can define this new macro:

In both cases, this configuration is saved for subsequent analyses, so the configuration is a ‘one-time’ action.

Let’s go to the second error.

Once one error is fixed, we need to analyze it again, since some errors are hidden or caused by another one. In the new log file, after the second analysis, we get:

Cannot parse C:\_dev\c\linux-ftpd-0.17\ftpd\ftpd.c, due to: Parse error at line 1644, column 1. Encountered: reply
line[1644]: reply(int n, char *fmt, va_dcl va_alist)

Seeing the code, around line 1644, we find:

#ifdef __STDC__
reply(int n, const char *fmt, …)
#else
reply(int n, char *fmt, va_dcl va_alist)
#endif

Our analyzer does not support the LEGACY mode to handle variable argument lists used in va_dcl va_alist.

To skip this definition, we can define the macro __STDC__, with value 1, as seen before, and ask KIUWAN to process the preprocessor conditional directives.

After this last change all files were processed, so we have finished our work.

Conclusion

In short, when we have problems in our C analysis:

  1. Analyze locally: Local Kiuwan Analyzer
  2. Resolve parsing errors whose origin is due to configuration problems:
    • Review unresolved.headers.log
    • Include Header directories
    • Define macros
    • Whether we need to process conditional directives
 

Use Case 2 Analysis of a Windows Application with C or Cpp

Analysis of a Windows application with C/C++

Please note that these instructions may be outdated!

 In this use case, we will focus now on how to analyze a Microsoft Windows application:

Sample application

From ‘Help – Samples’ option, in Visual Studio 13 Community edition, you can download the source code of our sample application.

Database Query From MFC

Technologies: SQL Server, Visual Studio 2012

Topics: User Interface, Data Access, Database Synchronization, Database, Database Connectivity

Platforms: Desktop, Data

Analizing the code

First of all, start ‘Kiuwan Local Analyzer’ with the {KiuwanLocalAnalyzer_install_dir}\kiuwan.cmd script.

Then, create a new application and set the source code directory.

In the ‘exclude patterns’ option, add the ‘**/Generated Files/**’ path. Visual Studio generates temporal files in this directory and we need to exclude them from the analysis because we don’t want to analyze files we haven’t coded.

Click ‘Continue’, select ‘C++’, and analyze…

Once the analysis has finished, you can see the results on Kiuwan:

Everything seems just ok, but if you look closely, only four files were analyzed out of the eight files detected by Kiuwan Local Analyzer.

If we go to the log screen to find out what happened, we can see which files were left out:

Solving parser problems

Looking in the log directory for this analysis ({KiuwanLocalAnalyzer_install_dir}\temp\Database Query From MFC.1444389776635-0\results), we can find the file cpp.unresolved.headers.log.

The content of this file are the header files that Kiuwan couldn’t find during the analysis. Most probably because they are not in our project folders:

<SDKDDKVer.h>

<afxwin.h>

<afxext.h>

<afxdisp.h>

<afxdtctl.h>

<afxcmn.h>

<afxcontrolbars.h>

“afxwin.h”

<afxdb.h>

“afxdialogex.h”

In fact, these are Windows and Visual Studio header files our application uses, but are located in external directories. As we can see in the previous post, the resolution of these files is necessary to get a complete and reliable analysis.

With the last version of Kiuwan Local Analyzer, you can autoconfigure the header files paths and macro definitions using the log file that Visual Studio generates on the compilation phase.

To get the default Visual Studio header files paths, run the following commands from a DOS console:

> cd C:\_dev\vs\Database Query From MFC

> call “C:\Program Files (x86)\Microsoft Visual Studio 12.0\VC\vcvarsall.bat”

> echo %INCLUDE% > include.txt

(update the source code and Visual Studio directories with those of your installation).

 

To get Visual Studio log file we need to compile the application from the command line:

> cd C:\_dev\vs\Database Query From MFC

> call “C:\Program Files (x86)\Microsoft Visual Studio 12.0\VC\vcvarsall.bat”

> msbuild.exe “Database Query From MFC.sln” /nologo /target:Rebuild /p:Configuration=Release /p:Platform=Win32 > msbuild.log

Now, we can use the generated ‘include.txt’ and ‘msbuild.log’ files to configure Kiuwan Local analyzer.

Before clicking on ‘Analyze’, open the configuration section:

Copy the content of ‘include.txt’ file in ‘Header directories’ option. You need to replace the semicolon separator by a comma separator before the copy.

C:\Program Files (x86)\Microsoft Visual Studio 12.0\VC\INCLUDE,C:\Program Files (x86)\Microsoft Visual Studio 12.0\VC\ATLMFC\INCLUDE,C:\Program Files (x86)\Windows Kits\8.1\include\shared,C:\Program Files (x86)\Windows Kits\8.1\include\um,C:\Program Files (x86)\Windows Kits\8.1\include\winrt

You should also set the ‘Use all know macros?’ to true.

Now, in this same screen, click ‘Analyze build logfile – Details’ button, to load the msbuild output logfile:

After these steps, run the analysis again and check the new results on Kiuwan:

Now, all the eight C++ files of this sample application were correctly analyzed.

Related to

Was this article helpful?
Powered by Zendesk