Post #1689807

@pixx I think this falls under the #reverseEngineering umbrella. Some binary RE tools can make use of debug info and even use your usual debugger. I haven't personally used it, but you might like Ghidra's. But I think your best bet are IDEs. There are also ways to script custom analyses with clangd, but I'm yet to find an easy and up to date example. For the specific example you mention, I'd look into various taint analysis techniques in addition to static analyses. Of course those require running the code, so you need a test harness and enough test cases to exercise all interesting paths. If you don't have any tests, you might be able to generate them. I can also kinda second semgrep, in the "I heard a lot of people use it" sense. Depending on your level of aversion to GitHub, you might also consider CodeQL. Some others that I've only read about it but haven't seen many people using: Weggli, Joern. I think Coccinelle might also work as an analysis tool and not just as a semantic patcher???