Using CodeSonar®
Like a compiler, CodeSonar® does a build of your code, but instead of creating object code it creates an abstract representation of the program. After the individual files are built, a synthesis phase combines the results into a whole-program model. The model is symbolically executed and the analysis keeps track of variables and how they are related. The bulk of the analysis is performed by GrammaTech's SmashProof™ analysis engine. Warnings are generated when anomalies are encountered. CodeSonar does not need test cases and works with the existing build system.
The results of an analysis are fed to a relational database, and a web-based interface provides a range of customizable views of the information in the database, including warnings issued by CodeSonar, source code, and information about projects and analyses. Analysis, database, and web components can be distributed across multiple machines.
See the following sections for details about how CodeSonar works and what it does.