Towards the Industrial Scale Development of Custom Static Analyzers

This paper presents a high level overview of a technology called CodeHawk whose purpose is to support verification of software properties. Today’s commercially available static analysis tools identify potential runtime and vulnerability problems based on properties described in the semantics of the programming language. While CodeHawk will detect those classes of problems, it is distinguished by the user’s ability to generate high performance static analyzers for the verification of application-specific properties. Today’s static analyzers may also trade off assurance and flexibility for speed in handling very large code sets. Our goal with CodeHawk is to handle industrial sized code sets with the highest speed in the industry among those offering 100% verification assurance. CodeHawk’s customizability opens up additional uses of the core technology beyond detecting runtime or vulnerability exposures. In this paper we describe one such use, namely static analysis in support of optimized dynamic analysis.