scat : source code analysis tool

scat displays function call graphs of C programs. scat also displays the conditions that need to be satisfied for a function to be called.

scat allows a programmer to quickly comprehend the structure of a program.

User Interface

Below is a demonstration of scat's user interface. Point at a function call arc to see the conditions that must be satisfied for that call to occur. Point at a function name to see the function's signature and where the function is defined.

Below is an old picture showing a call graph being created interactively:

I used the GTK-- and GNOME-- libraries (which provide a C++ interface to GTK+ and GNOME). libsigc++ was also used.

Features

• Auto draw feature.

  The user specifies two functions and scat displays all the ways program execution can go from the first function to the other function.

• Function call arcs are drawn in a special color (purple instead of blue) if the "calling function" always calls the "called function".
• Function filter.

  Some functions such as malloc, free, printf, etc. usually do not need to be displayed. The set of functions which are not displayed can be specified.

Function call database

The function call database is interrogated using cscope.

Similar programs

• cbrowser

  cbrowser uses cscope. It has a nice GUI for making cscope queries and it can also draw a function call tree.

• Source Navigator

  Source Navigator can work with source code in many different languages. It seems to be slower than cscope at analysing C code.

I hope scat makes it possible to understand how programs are structured more quickly than with similar programs. (I've used v0.8 of cbrowser and v5.0.0 of Source Navigator.) Enhancements include:

• Giving the user more control over what is displayed. (E.g. not all of the functions called by a particular function need be displayed as they may not relate to what the user is trying to understand.)
• Displaying a function call graph (as opposed to a tree where the same function may be shown several times).
• Providing a quick method to find out the conditions which must be satisfied for a particular function to be called.

Planned features

• ability to add text annotations to parts of the graph.
• "auto arrange": scat will arrange the functions to reduce the number of function call lines which cross.

  This appears to be a difficult task. I am thinking of using the library which doxygen uses to format graphs.

• rename a function (all references to the function in the source code will automatically be updated).
• calculate required stack usage. scat could follow all function call branches from main and report the maximum stack usage,
• ability to insert scat function call graphs into other documents (maybe by using Gnome's bonobo architecture).
• use doxygen to show documentation for functions.
• load, save and print graphs

A basic save function has been implented: It only stores the names of the functions displayed (and nothing else). I am considering using libXML in future.

• support for languages other than C.

Conditions for a function call to occur

The code which determines the conditions for a particular function call to occur is not finished. Below is a list of some things that are yet to be done:

• case labels inside switch statements are not yet handled.
• break, continue and return statements are not yet handled. (They cause a parse error which prevents scat showing misleading information for code it can't yet analyse.)

Source code

Download

I use gcc v3.0.3 to compile scat.

Requirements

The following packages are required to build scat. I have listed the versions I have installed (older versions may also work).

Running scat

scat will use the cscope.out file in the current working directory, however, you can specify a different file (or several files) using the "Cscope Connections" window.

scat does not create nor update cscope databases. ("cscope -Rb" will build a database for all files in the current directory and sub-directories of the current directory. I recommend using the cscope "-q" option as it increases the speed to interrogate the database.)

Last update: 25 November 2002