Looking for code visualizers

[Mark C. Langston]

In my new job, software archaeology has become someowhat a necessity.
So, I'm currently on the lookout for GOOD code visualizers.

What I'd ideally like:

Something that'll do function call graphs based on source code or .rtl
output from gcc.

Something that'll allow me do drill-down and weed out the call trees I'm
uninterested in, interactively (or easily in a noninteractive manner)

Something that doesn't require hooking into live code (as the code in
question runs on specialized hardware, making this somewhat difficult).

Something that'll grok C with the occasional C++ file.

Something that'll take as input a source tree for a particular binary,
and do the smart thing, pulling in the requisite headers and libraries
as part of the visualization.

Something that'll give me hints towards things like uninitialized and/or
dereferenced pointers.

Something that'll let me drill down a function call graph to a specific
function, and get a look at the arguments, and how those arguments
change up and down that call graph (e.g., I start out in function A,
initializing pointer *a, and callfunction B, passing it &a, but B calls
it c, and it never actually gets initialized/assigned a value until it's
handed down to function F, and there's a nonzero possibility that
function A is expecting *a to remain unmolested beyond certain
boundaries, and functions G, H, and I do Bad THings(TM).



Free would be nice.


Alternately, something that can take a precompiled binary and do
something similar, without executing the binary or being on the platform
capable of executing the binary would be nice.



Yes, I know part of what I'm describing can be done with gdb/ddd, but
gdb/ddd are great for walking through coredumps, assuming you've not
corrupted the stack and you do All The Right Things(TM) regarding
variable initialization and pointer referencing.  Do bad things, and
gdb/ddd is a mess.  It's also a bit of a PITA to do call traces with
DDD.


I vaguely remember seeing a commercial product (around $1k) demo'd at
BH2004 that could do such things with two different versions of the dame
binary, without access to source, but IIRC it was Windows-only and the
code had to execute to make things work.


Anyway, free or otherwise, pointers to stuff that'll do some/all of this
on *BSD (FreeBSD, OS X) or Linux would be greatly appreciated.



Alternately, a pointer to a REALLY USEFUL collection of scripts that'll
produce interesting .dot files for feeding into dotty/graphviz would be
most welcome.


Gracias.





-- 
mcl