Fortify-SCA-扫描工具指导手册.pdf

Fortify-SCA-扫描工具指导手册.pdf
fortify扫描工具的说明手册，对实际工作有指导作用，讲的比较清晰。
FortifySCA分析原理Front-End3rdpartyIDEJavaPug-InC/C++MicrOsoLNETIBM.eclipseAuditworkbenchPLSQLXMLAnalysisEngineSemanticfdi/fprGobalDataflowNControlFlowConfigurationStructuralFortifyManagerNSTRulesbuilderCustomPre-PackagedFORTIFYFortifySCA分析过程SCAEngineIntermediateScanphaseflesUsingAnalyzersTttransation(NST).RulesAnalysisResultFile-bbuildid阶段一:转换阶段(Translation)阶段二:分析阶段(Scanosourceanalyzer-b-cleanosourceanalyzer-bsourceanalyzer-b-Xmx1250m-scan-fresultsfprFORTIFYFortifySCA扫描的工作VisualstudioEclipse,IBMRAD面AuditWorkbenchJava,.NetFortifyGlobalBuildToolC,C/C++AnalysisJSPTouchlessBuildFortifyPL/SQLIDEIntermediateFPRTSOLModelColdCommandLineInterfaceFusion运己FortifyImManagerSecureCodingRulesFortifyCustomizedRulesRulesFORTIFYFortifySCA扫描的五种方式插件方式:Plug-In(Eclipse,vsWsAd,rad)命令行方式Commandline●扫描目录方式:AuditworkbenchscanFolder与其他工具集成:ScanwithANt,Makefile●编译监控器方式:FortifySCABuildMonitorFORTIFYFortifySCA扫描的四个步骤FortifySCA扫描总共可以分为四个步骤:●1.Clean:清除阶段:sourceanalyzer-bproName-clean2.Translation:转换阶段3.ShoW-fe:查看阶段sourceanalyzer-bproName-show-files4.scan:扫描阶段sourceanalyzer-bproName-Xmx1250m-scan-fproName.fprFORTIFYFortifySCA命令行参数说明查看SCA扫描命令及参数→＞sourceanalyzerca\C:\VIRDoS\syste32\cd.exe川icrosoftWindowsXP[版不5.1268gKc版权所有1985-2061MicrosoftGorp:Documentsandsettingsanming＞sourceanalyzer--helpFortifySourceCodeAnalyze4..日.回153Copyright(c＞2003-2006FortifySoftwareUsageBu⊥1dJava:sourceanalyzer-bsourceanalyzer-bjavacG/C++:sourceanalyzer-bNET:sourceanalyzer-bscan〓sourceanalyzer-b-scan-fresults.fprOutputoptions-formatControlstheoutputformat.Validoptionsareauto,fpr.fvdl,andtext.D