Post #743654

2026-03-23 12:21 UTC

Working on an old abandoned code base where i can&#39;t talk to the authors and it takes hours to figure out some of the bullshit it&#39;s pulling off, i can definitely see the appeal for a tool that can quickly read over the code and check my inferences on e.g. memory flow and ownership patterns Nowadays, people would obviously default to either LLMs for that or for arguing that humans should do it because the other people are saying LLMs and fuck that But what I&#39;m more interested in: there&#39;s plenty of static analysis tools for checking code you wrote. Is there any prior art in deterministic static analysis tools that help _read code_ by other people? Dataflow and control flow analysis are super commonly used in compiler optimization. Are there any tools out there that do dataflow analysis and then, say, can look at a variable and show all _possible references_ and relevant code? E.g. this Foo* is passed to foo(), so it can be f there, which might call bar, and ...) Or &quot;this code allocates Bar, here&#39;s the entire possible relevant code for what might happen to that across this 100kloc project, here&#39;s every function in every file that might use _that specific value_, and an explanation of how it gets there&quot;

Replies (11)

@pixx@merveilles.town 2026-03-23 17:21

Something fascinating here: this is a codebase in C. It's not doing anything crazy by the rules of C. C is my preferred language, the one I'm best at. I understand every single line of code, on its own. But a lot of the high level logic feels weirdly foreign, moreso than typical Go code even. I can read the code and go "oh that's a hash table" pretty easily, and i get using a hash table to quickly identify cached blocks But the table is, implicit? Sorta? The heads of each "bucket" are stored in the cache, but there's no real bucket. Each block just has a doubly linked list to follow prev/next pointers which, sure, but then it also multiple other unrelated lists. Okay, not too crazy. But they're sorted by a fake ticker clock, except not entirely, only sorta quadratically? Which seems to just be a way to maintain a LRU in *yet another list* sorting the *exact same set* of *statically allocated blocks*. And, i can untangle all of this. It requires pen and paper ( or a .tex file), but it's a fascinating experience reading something, understanding what it means, but having no clue what it's doing

Open ##1689790
@kabel42@polymaths.social 2026-03-23 12:27

@pixx that would also be nice for libraries you use. Which parts of this lib actually end up in my binary?

Open ##1689792
@taylan@fedi.feministwiki.org 2026-03-23 12:27

@pixx While I was working on Android Java code using IntelliJ IDEA, I've noticed there was a "data flow to/from here" feature of that IDE, which I ended up using a handful of times over the years. (My own codebase, so not much to discover.)

Open ##1689793
@muvlon@hachyderm.io 2026-03-23 12:41

@pixx I think semgrep might fit the bill (but have no firsthand experience with it).

Open ##1689794
@poleguy@mastodon.social 2026-03-23 14:03

@pixx I wonder if most of the work on such tools has been in commercial code targeted at high end enterprise price points, or developed for interval use only within large orgs. I feel my company (or I) was always too penny too pinching to argue, push red tape and spend the few hundred needed to get those tools. And likely the industry didn't develop broadly because doing this well is hard work and hard to sell. But LLM does a half ass job and is easy to sell because it "does everything."

Open ##1689795
@malcircuit@thingy.social 2026-03-23 14:03

@pixx This is why I use vscode, which seems much more aware of stuff like this. But yeah, I think it could be a lot better. Particularly when it comes to understanding functional and logical connections across an entire project.

Open ##1689797
@Rajiv@infosec.exchange 2026-03-23 14:58

@pixx there used to be a UML modelling tool whose name now escapes me... kdevelop? may be? but it was capable of both taking your UML diagrams and spitting out code or taking in code from C, C++ and handful of other languages and analyze it. I unfortunately have not done any coding since 2004 seriously but even then, there were commercial offerings that had that capability. for some reason name Rational Rose comes to mind as well. This is nothing new and capability existed way before LLMs did. just may not be available in non-commercial format today :(

Open ##1689798
@StevenSaus@faithcollapsing.com 2026-03-23 16:00

@pixx Agreed! I'll also add: if one must use an LLM, use an LLM to create the tool so that you don't have to keep using the LLM.

Open ##1689802
@lykso@tiny.tilde.website 2026-03-23 16:06

@pixx This sounds like symbolic execution to me! I've not used this technique myself, but I had some colleagues who wrote their own symbolic execution analysis tools (I don't think they ever released them). This seems like a promising list: https://github.com/ksluckow/awesome-symbolic-execution Wikipedia: https://en.wikipedia.org/wiki/Symbolic_execution

Open ##1689803
@csepp@merveilles.town 2026-03-23 16:09

@pixx I think this falls under the #reverseEngineering umbrella. Some binary RE tools can make use of debug info and even use your usual debugger. I haven't personally used it, but you might like Ghidra's. But I think your best bet are IDEs. There are also ways to script custom analyses with clangd, but I'm yet to find an easy and up to date example. For the specific example you mention, I'd look into various taint analysis techniques in addition to static analyses. Of course those require running the code, so you need a test harness and enough test cases to exercise all interesting paths. If you don't have any tests, you might be able to generate them. I can also kinda second semgrep, in the "I heard a lot of people use it" sense. Depending on your level of aversion to GitHub, you might also consider CodeQL. Some others that I've only read about it but haven't seen many people using: Weggli, Joern. I think Coccinelle might also work as an analysis tool and not just as a semantic patcher???

Open ##1689807
@evin@gts.yujiri.xyz 2026-03-23 16:23

@pixx not that i can think of. this reminds me of the idea of semantic coloring instead of syntax coloring...

Open ##1689808