6

I am looking for a library for doing custom static code analysis on CIL code. READ: I have no interest in a tool that already does static analysis like those shown here.

For custom analysis with Java Bytecodes, I have used ASM and I like the features it offers and the good documentation. A quick google search for "CIL static analysis library" doesn't yield anything that seems to provide the features of ASM.

Lincoln
  • 1,008
  • 12
  • 20

3 Answers3

7

Mono.Cecil is the best library for CIL analysis available. It is free, open-source, complete, lightweight, robust and fast. In addition to reading CIL, it can also write CIL. It also supports PDB files.

Many static analysis tools rely on Cecil for years.

Patrick from NDepend team
  • 13,237
  • 6
  • 61
  • 92
  • Thanks I will look more into this Cecil. – Lincoln Nov 29 '12 at 18:50
  • Cool, you won't find anything better anyway. I am the lead developer of the static analyzer NDepend that relies on Cecil for 5 years, and I can say that the author of Cecil (Jb Evain from SyntaxTree http://syntaxtree.com/) did a great job an provides an awesome support! – Patrick from NDepend team Nov 30 '12 at 10:01
0

Have a look at Reflector: www.reflector.net/

w0051977
  • 15,099
  • 32
  • 152
  • 329
  • 1
    This looks more like a tool that internally uses static analysis and not a library for enabling static analysis like ASM. – Lincoln Nov 28 '12 at 04:32
0

Closest thing I've found is Microsoft's FxCop utility. (Standalone download link here, 1.36 seems to have disappeared, but someone re-uploaded it to their Dropbox on another SO question)

It's certainly nothing close to C/C++ static analysis tools, but then again, C# is a managed language where a lot of the common mistakes that static analysis tools check aren't possible.

Also, there's a short list on Wikipedia of static analysis tools for .NET, might be worth a peek.

Community
  • 1
  • 1
Robert Rouhani
  • 14,512
  • 6
  • 44
  • 59
  • I am looking for a **library** that best enables me as a programmer to write custom static analysis for CIL, this seems to be a **tool** that uses static analysis to find bugs, etc. – Lincoln Nov 29 '12 at 18:48