5 ms·

This is the thing... Modern embedded C programming has evolved significantly in the right direction since studies were done and so I would love to see someone

This is the thing... Modern embedded C programming has evolved significantly in the right direction since studies were done and so I would love to see someone spend the time looking at 'modern' embedded C codebases. Static analysis is now widespread and not theoretical, coding standards now take security seriously (tho can be outdated). Drawbacks to certain techniques have been surfaced and recognised. Tooling is much better, portability is recognised as a good-thing, pointer usage is now minimised when possible and contained to areas where they are appropriate. Casting is frowned upon, macro-magic is frowned upon. 'Clever' code is frowned upon. Basically, I would think that certainly in the embedded domain, standards are now such that the story would now be significantly different.

vardump 10y ago
Any recommendations on static C analysis for embedded systems?
- TickleSteve 10y ago
  No one-tool does the whole job. Setup your CI system to use multiple tools (Lint, CLang-analyser, cppcheck, etc). Dont trust just one.
  - vardump 10y ago
    Pretty much what we already use. I was hoping for something new.
    - nickpsecurity 10y ago
      Here you go. Experiment away and give them constructive feedback as they need it. Esp Softbound and SAFECODE. https://news.ycombinator.com/item?id=11770726 https://news.ycombinator.com/item?id=11770726
      - vardump 10y ago
        Thanks! I'll look into those.
  - nickpsecurity 10y ago
    Have you tried Astree Analyzer? Papers I read indicated it was one of best but hard to find industry people to confirm or reject it. Want someone to clone it for FOSS. Meanwhile, I found these free ones for you two that have each found bugs in code with focus on minimal annotations. All are academic prototypes but Saturn was used on Linux kernel. Saturn http://saturn.stanford.edu/pages/overviewindex.html http://saturn.stanford.edu/pages/overviewindex.html CSolve http://goto.ucsd.edu/csolve/ http://goto.ucsd.edu/csolve/ Calysto http://www.domagoj-babic.com/index.php/ResearchProjects/Calysto http://www.domagoj-babic.com/index.php/ResearchProjects/Caly... Most academics are instead making compilers that translate C code into something mostly or totally safe while pushing the performance hit downward. Here's two of the top for you to try on various codes (or improve): https://www.cs.rutgers.edu/~santosh.nagarakatte/softbound/ https://www.cs.rutgers.edu/~santosh.nagarakatte/softbound/ http://sva.cs.illinois.edu/downloads.html http://sva.cs.illinois.edu/downloads.html

vardump 10y ago

Any recommendations on static C analysis for embedded systems?

TickleSteve 10y ago
No one-tool does the whole job. Setup your CI system to use multiple tools (Lint, CLang-analyser, cppcheck, etc). Dont trust just one.
- vardump 10y ago
  Pretty much what we already use. I was hoping for something new.
  - nickpsecurity 10y ago
    Here you go. Experiment away and give them constructive feedback as they need it. Esp Softbound and SAFECODE. https://news.ycombinator.com/item?id=11770726 https://news.ycombinator.com/item?id=11770726
    - vardump 10y ago
      Thanks! I'll look into those.
- nickpsecurity 10y ago
  Have you tried Astree Analyzer? Papers I read indicated it was one of best but hard to find industry people to confirm or reject it. Want someone to clone it for FOSS. Meanwhile, I found these free ones for you two that have each found bugs in code with focus on minimal annotations. All are academic prototypes but Saturn was used on Linux kernel. Saturn http://saturn.stanford.edu/pages/overviewindex.html http://saturn.stanford.edu/pages/overviewindex.html CSolve http://goto.ucsd.edu/csolve/ http://goto.ucsd.edu/csolve/ Calysto http://www.domagoj-babic.com/index.php/ResearchProjects/Calysto http://www.domagoj-babic.com/index.php/ResearchProjects/Caly... Most academics are instead making compilers that translate C code into something mostly or totally safe while pushing the performance hit downward. Here's two of the top for you to try on various codes (or improve): https://www.cs.rutgers.edu/~santosh.nagarakatte/softbound/ https://www.cs.rutgers.edu/~santosh.nagarakatte/softbound/ http://sva.cs.illinois.edu/downloads.html http://sva.cs.illinois.edu/downloads.html