Developing a static source code analysis tool for proprietary API?

Question

There is a proprietary API that is built on top of C++. So it uses all the features of C++ and then has its own APIs. There are some APIs that function exactly the same as C++ API (like for malloc there is Stralloc), these APIs are provided for performance reasons.

Though there are many static code analyzers available for C++, we cannot use any of them. There is a need to have a static code analyzer which could be run on the code with proprietary APIs.

I would like to know how do I begin developing the code analyzer. It may need not be very feature oriented like the ones available for C++. I want to start with basic stuff like reporting unused variables, buffer overflows, memory leaks.

Any guidance will be appreciated.

[UPDATE] I found the following question which is what I was looking for, only difference is, instead of Java my concern is for proprietary APIs. So far I have got couple of good answers but I would really like to know more from people who have been through such kind of development.

Introduction to Static Analysis

Answer 1

I'm confused:

Is this a language implementation on top of C++ or just a set of APIs on top of C++?

If the latter, any normal C++ profiler will capture things like memory leaks and overflows.

Answer 2

Solutions like Coverity and Klocwork have an extensible rule set where you can write your own rules. You can also configure the tool so that their standard memory checks understand custom memory allocators. Some limitations apply though.

It's useful to use these tools because then you can borrow off the same workflow. Again, it depends on what you code you have and what exactly you are looking to do.