Our tool, called CodeSonar , is a commercial advanced static analysis tool for C / C ++ programs. It offers several APIs that can be used to extend its functionality. Please note that it is intended for analysis and not for software transformations.
There are APIs (both in C and in the Scheme) that allow access to software AST (which contain symbol tables), CFG for each subprogram, call graph of the entire program, compilation units, include files, etc. All these representations are interconnected with location information, so you can return to the line of the responsible code.
The analysis engine visits all of these data structures, and the user can write a checker specifying a callback to call during the visit.
CodeSonar is a path dependent analysis tool. The study of the path is difficult because some paths are not feasible, and the exclusion of them from consideration requires some effort. It is important to eliminate invalid paths in order to support false positives. CodeSonar allows users to piggyback their trajectory, again using a visitor template that allows them to write path-sensitive control parameters without having to research the potential path themselves.
This mechanism has been used to implement validation, which finds deviations from the rather complex idiom of error messages.
Another way to write checks is to use a special special-purpose API, the purpose of which should not be met, but to train the analysis mechanism about the properties of the program. Roughly speaking, you can use this API to write code that is similar to what you write to dynamically check a property, but which is โinterpretedโ instead using a symbolic execution mechanism. You can decorate your own code with calls to this API or leave everything aside.
Many of CodeSonar's built-in checkers for using the API are specified in this way.
Written checks are only half the battle. When you have a supervisor in production, you need a way to manage what he finds. All the mechanisms described above generate reports that populate the database, and there is a web-based user interface for viewing results, adding notes, integrating with other tools, etc.
Hope this helps!