Products
SvaceSvacerUse Cases & Solutions
Features
Interprocedural AnalysisLanguages & CompilersCI/CD IntegrationAnalysis Customization
ServicesCustomer Cases
Company
PricingLinux Kernel CVEsAbout UsTechnical Documentation
Home/Features/Intermodular & interprocedural analysis
Intermodular & Interprocedural Analysis

See the Whole Picture with Context-Aware Scanning

By understanding the entire development context throughout your architecture, Svace exposes defects hidden deep within specific execution paths.

Analyze Across All Code Functions

001

Eliminate blind spots by enriching analysis with the information about all functions utilized in your project.

  • Build-interception pipeline, supporting any build system: Make, CMake, Bazel, Mage, etc.
  • Summary-based interprocedural symbolic analysis engine
  • Symbolic execution, merging analysis states at path join points
  • Function summaries generation for external code to capture side effects
  • Re-use of summaries during main scan for full interprocedural precision
  • Bypassing of unused procedures in imported dependencies (for Go)

Build & Analysis Phases

002

Capture the finest build process details unavailable to other tools.

Compiled languages: C, C++, C#, VB.NET, Go, Java, Kotlin, Scala
  • Build — original build script as input; compiler and linker calls are intercepted; IR is saved for later analysis
  • Analysis
Interpreted languages: Python, JavaScript, Lua
  • Scanning the directory with source files — input: directory with source files; saving IR for later analysis
  • Analysis

Intermediate Representation

003

Svace IR in a nutshell. The analyzer produces accurate and relevant intermediate representation of the analyzed source code. The main analysis engine utilizes it to perform deep interprocedural and path-sensitive analysis to uncover complex issues. Secondary analysis engines run on the same IR to quickly uncover a large number of more specific and simpler issues.

Two IRs
  • Unified Abstract Syntax Tree (UAST)
  • SSA-based Svace IR
Three main engines
  • UAST analysis for syntax errors
  • SvEng analysis
  • SharpCherker — C#, VB.NET (inside Roslyn)
Two additional analyzers
  • Clang Static Analyzer for C/C++
  • Spotbugs for Java

Find Hidden Issues in Critical Software