about summary refs log tree commit diff
path: root/nixpkgs/pkgs/development/tools/analysis
diff options
context:
space:
mode:
Diffstat (limited to 'nixpkgs/pkgs/development/tools/analysis')
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/autoflake/default.nix23
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/brakeman/default.nix17
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/cccc/cccc.patch24
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/cccc/default.nix37
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/checkstyle/default.nix37
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/clang-analyzer/0001-Fix-scan-build-to-use-NIX_CFLAGS_COMPILE.patch33
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/clang-analyzer/default.nix36
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/coan/default.nix33
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/cov-build/default.nix48
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/cppcheck/default.nix38
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/cpplint/default.nix29
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/egypt/default.nix32
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/emma/default.nix24
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/eresi/default.nix60
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/evmdis/default.nix21
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/findbugs/default.nix44
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/flow/default.nix29
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/frama-c/default.nix82
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilegen/default.nix32
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilegen/gcc7.patch13
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilesim/default.nix28
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/hopper/default.nix42
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/hotspot/default.nix66
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/ikos/default.nix36
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/include-what-you-use/default.nix39
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/jdepend/default.nix35
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/kcov/default.nix38
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/lcov/default.nix36
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/makefile2graph/default.nix32
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/massif-visualizer/default.nix30
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/oclgrind/default.nix28
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/panopticon/default.nix51
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/pev/default.nix24
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/pmd/default.nix28
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/qcachegrind/default.nix40
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/radare2/cutter.nix53
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/radare2/default.nix133
-rwxr-xr-xnixpkgs/pkgs/development/tools/analysis/radare2/update.py141
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/randoop/default.nix28
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/retdec/default.nix235
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/retdec/yaracpp.nix49
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/rr/default.nix60
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/smatch/default.nix35
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/snowman/default.nix33
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/sparse/default.nix26
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/spin/default.nix46
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/splint/darwin.patch13
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/splint/default.nix32
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/splint/tmpdir.patch16
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/swarm/default.nix25
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/tflint/default.nix24
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/uefi-firmware-parser/default.nix30
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/valgrind/coregrind-makefile-race.patch41
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/valgrind/default.nix92
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/valkyrie/default.nix30
55 files changed, 2387 insertions, 0 deletions
diff --git a/nixpkgs/pkgs/development/tools/analysis/autoflake/default.nix b/nixpkgs/pkgs/development/tools/analysis/autoflake/default.nix
new file mode 100644
index 000000000000..16b4be47d8b7
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/autoflake/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, python3Packages }:
+
+with python3Packages;
+buildPythonApplication rec {
+  pname = "autoflake";
+  version = "1.3";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0wzrvrn6279fijg8jkqbs6313f7b5ll5d22pk5s0fc1fp2wyanbb";
+  };
+
+  propagatedBuildInputs = [ pyflakes ];
+
+  doCheck = true;
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/myint/autoflake;
+    description = "A simple program which removes unused imports and unused variables as reported by pyflakes";
+    license = licenses.mit;
+    maintainers = with maintainers; [ yuriaisaka ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/brakeman/default.nix b/nixpkgs/pkgs/development/tools/analysis/brakeman/default.nix
new file mode 100644
index 000000000000..9c3efd02de03
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/brakeman/default.nix
@@ -0,0 +1,17 @@
+{ lib, ruby, buildRubyGem }:
+
+buildRubyGem rec {
+  inherit ruby;
+  name = "${gemName}-${version}";
+  gemName = "brakeman";
+  version = "4.6.1";
+  source.sha256 = "04chxflc5n6q0kz93c9dc6jwqrz0mrrlpm4iqncb39yyvg4ghcbf";
+
+  meta = with lib; {
+    description = "Static analysis security scanner for Ruby on Rails";
+    homepage = https://brakemanscanner.org/;
+    license = [ licenses.cc-by-nc-sa-40 licenses.mit ];
+    platforms = ruby.meta.platforms;
+    maintainers = [ maintainers.marsam ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/cccc/cccc.patch b/nixpkgs/pkgs/development/tools/analysis/cccc/cccc.patch
new file mode 100644
index 000000000000..9454e3b18ad1
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/cccc/cccc.patch
@@ -0,0 +1,24 @@
+diff --git a/cccc/cccc_tbl.cc b/cccc/cccc_tbl.cc
+index df98e2b..59f2572 100644
+--- a/cccc/cccc_tbl.cc
++++ b/cccc/cccc_tbl.cc
+@@ -96,7 +96,7 @@ bool CCCC_Table<T>::remove(T* old_item_ptr)
+   typename map_t::iterator value_iterator=map_t::find(old_item_ptr->key());
+   if(value_iterator!=map_t::end())
+     {
+-      erase(value_iterator);
++      map_t::erase(value_iterator);
+       retval=true;
+     }
+   return retval;
+diff --git a/makefile b/makefile
+index 23ad004..2cca469 100644
+--- a/makefile
++++ b/makefile
+@@ -20,5 +20,5 @@ test :
+ 	cd test ; make -f posix.mak
+ 
+ install : 
+-	cd install ; su root -c "make -f install.mak" 
++	cd install ; make -f install.mak
+ 
diff --git a/nixpkgs/pkgs/development/tools/analysis/cccc/default.nix b/nixpkgs/pkgs/development/tools/analysis/cccc/default.nix
new file mode 100644
index 000000000000..a46d7f9d9536
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/cccc/default.nix
@@ -0,0 +1,37 @@
+{ stdenv, fetchurl }:
+
+let
+  name = "cccc";
+  version = "3.1.4";
+in
+stdenv.mkDerivation {
+  name = "${name}-${version}";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/${name}/${version}/${name}-${version}.tar.gz";
+    sha256 = "1gsdzzisrk95kajs3gfxks3bjvfd9g680fin6a9pjrism2lyrcr7";
+  };
+
+  hardeningDisable = [ "format" ];
+
+  patches = [ ./cccc.patch ];
+
+  preConfigure = ''
+    substituteInPlace install/install.mak --replace /usr/local/bin $out/bin
+    substituteInPlace install/install.mak --replace MKDIR=mkdir "MKDIR=mkdir -p"
+  '';
+  buildFlags = [ "CCC=c++" "LD=c++" ];
+
+  meta = {
+    description = "C and C++ Code Counter";
+    longDescription = ''
+      CCCC is a tool which analyzes C++ and Java files and generates a report
+      on various metrics of the code. Metrics supported include lines of code, McCabe's
+      complexity and metrics proposed by Chidamber&Kemerer and Henry&Kafura.
+    '';
+    homepage = http://cccc.sourceforge.net/;
+    license = stdenv.lib.licenses.gpl2;
+    platforms = stdenv.lib.platforms.unix;
+    maintainers = [ stdenv.lib.maintainers.linquize ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/checkstyle/default.nix b/nixpkgs/pkgs/development/tools/analysis/checkstyle/default.nix
new file mode 100644
index 000000000000..ac2c6795a428
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/checkstyle/default.nix
@@ -0,0 +1,37 @@
+{ stdenv, fetchurl, makeWrapper, jre }:
+
+stdenv.mkDerivation rec {
+  version = "8.23";
+  pname = "checkstyle";
+
+  src = fetchurl {
+    url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-${version}/checkstyle-${version}-all.jar";
+    sha256 = "0k161c687q33rlm4r8h3f0ks5p2w8pj6kh258zdzk8kjfigfxkmx";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -D $src $out/checkstyle/checkstyle-all.jar
+    makeWrapper ${jre}/bin/java $out/bin/checkstyle \
+      --add-flags "-jar $out/checkstyle/checkstyle-all.jar"
+    runHook postInstall
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Checks Java source against a coding standard";
+    longDescription = ''
+      checkstyle is a development tool to help programmers write Java code that
+      adheres to a coding standard. By default it supports the Sun Code
+      Conventions, but is highly configurable.
+    '';
+    homepage = http://checkstyle.sourceforge.net/;
+    license = licenses.lgpl21;
+    maintainers = with maintainers; [ pSub ];
+    platforms = jre.meta.platforms;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/clang-analyzer/0001-Fix-scan-build-to-use-NIX_CFLAGS_COMPILE.patch b/nixpkgs/pkgs/development/tools/analysis/clang-analyzer/0001-Fix-scan-build-to-use-NIX_CFLAGS_COMPILE.patch
new file mode 100644
index 000000000000..bcb3ac1d146a
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/clang-analyzer/0001-Fix-scan-build-to-use-NIX_CFLAGS_COMPILE.patch
@@ -0,0 +1,33 @@
+From 6ab08bc1c889e4fb9a39432b1a654eaa19ee65eb Mon Sep 17 00:00:00 2001
+From: Austin Seipp <aseipp@pobox.com>
+Date: Fri, 2 May 2014 12:28:23 -0500
+Subject: [PATCH] Fix scan-build to use NIX_CFLAGS_COMPILE
+
+Signed-off-by: Austin Seipp <aseipp@pobox.com>
+---
+ tools/scan-build/ccc-analyzer | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/tools/scan-build/ccc-analyzer b/tools/scan-build/ccc-analyzer
+index b463ec0..9d39dd0 100755
+--- a/tools/scan-build/ccc-analyzer
++++ b/tools/scan-build/ccc-analyzer
+@@ -207,6 +207,15 @@ sub Analyze {
+       push @Args, "-Xclang", "-analyzer-viz-egraph-ubigraph";
+     }
+ 
++
++    # Add Nix flags to analysis
++    if (defined $ENV{'NIX_CFLAGS_COMPILE'}) {
++      my @nixArgs = split(/\s+/, $ENV{'NIX_CFLAGS_COMPILE'});
++      foreach my $nixArg (@nixArgs) {
++        push @Args, $nixArg;
++      }
++    }
++
+     my $AnalysisArgs = GetCCArgs("--analyze", \@Args);
+     @CmdArgs = @$AnalysisArgs;
+   }
+-- 
+1.8.3.2
+
diff --git a/nixpkgs/pkgs/development/tools/analysis/clang-analyzer/default.nix b/nixpkgs/pkgs/development/tools/analysis/clang-analyzer/default.nix
new file mode 100644
index 000000000000..6b0c1b401f63
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/clang-analyzer/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, fetchurl, clang, llvmPackages, perl, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  pname = "clang-analyzer";
+  version = "3.4";
+
+  src = fetchurl {
+    url    = "http://llvm.org/releases/${version}/clang-${version}.src.tar.gz";
+    sha256 = "06rb4j1ifbznl3gfhl98s7ilj0ns01p7y7zap4p7ynmqnc6pia92";
+  };
+
+  patches = [ ./0001-Fix-scan-build-to-use-NIX_CFLAGS_COMPILE.patch ];
+  buildInputs = [ clang llvmPackages.clang perl makeWrapper ];
+
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/bin $out/libexec
+    cp -R tools/scan-view  $out/libexec
+    cp -R tools/scan-build $out/libexec
+
+    makeWrapper $out/libexec/scan-view/scan-view $out/bin/scan-view
+    makeWrapper $out/libexec/scan-build/scan-build $out/bin/scan-build \
+      --add-flags "--use-cc=${clang}/bin/clang" \
+      --add-flags "--use-c++=${clang}/bin/clang++" \
+      --add-flags "--use-analyzer='${llvmPackages.clang}/bin/clang'"
+  '';
+
+  meta = {
+    description = "Clang Static Analyzer";
+    homepage    = "http://clang-analyzer.llvm.org";
+    license     = stdenv.lib.licenses.bsd3;
+    platforms   = stdenv.lib.platforms.unix;
+    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/coan/default.nix b/nixpkgs/pkgs/development/tools/analysis/coan/default.nix
new file mode 100644
index 000000000000..951c46e2166f
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/coan/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, fetchurl, perl }:
+
+stdenv.mkDerivation rec {
+  version = "6.0.1";
+  pname = "coan";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/project/coan2/v${version}/${pname}-${version}.tar.gz";
+    sha256 = "1d041j0nd1hc0562lbj269dydjm4rbzagdgzdnmwdxr98544yw44";
+  };
+
+  nativeBuildInputs = [ perl ];
+
+  enableParallelBuilding = true;
+
+  postInstall = ''
+    mv -v $out/share/man/man1/coan.1.{1,gz}
+  '';
+
+  meta = with stdenv.lib; {
+    description = "The C preprocessor chainsaw";
+    longDescription = ''
+      A software engineering tool for analysing preprocessor-based
+      configurations of C or C++ source code. Its principal use is to simplify
+      a body of source code by eliminating any parts that are redundant with
+      respect to a specified configuration. Dead code removal is an
+      application of this sort.
+    '';
+    homepage = http://coan2.sourceforge.net/;
+    license = licenses.bsd3;
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/cov-build/default.nix b/nixpkgs/pkgs/development/tools/analysis/cov-build/default.nix
new file mode 100644
index 000000000000..bd8c5c37c864
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/cov-build/default.nix
@@ -0,0 +1,48 @@
+{ stdenv, requireFile }:
+
+let
+  message = ''
+    Register an account at https://scan.coverity.com, download the
+    build tools, and add it to the nix store with nix-prefetch-url
+  '';
+in
+stdenv.mkDerivation rec {
+  pname = "cov-build";
+  version = "7.0.2";
+
+  src =
+    if stdenv.hostPlatform.system == "i686-linux"
+    then requireFile {
+      name = "cov-analysis-linux32-${version}.tar.gz";
+      sha256 = "0i06wbd7blgx9adh9w09by4i18vwmldfp9ix97a5dph2cjymsviy";
+      inherit message;
+    }
+    else requireFile {
+      name = "cov-analysis-linux64-${version}.tar.gz";
+      sha256 = "0iby75p0g8gv7b501xav47milr8m9781h0hcgm1ch6x3qj6irqd8";
+      inherit message;
+    };
+
+  dontStrip = true;
+  buildPhase = false;
+  installPhase = ''
+    mkdir -p $out/bin $out/libexec
+    mv * $out/libexec
+    for x in cov-build cov-capture cov-configure cov-emit cov-emit-java \
+      cov-export-cva cov-extract-scm cov-help cov-import-scm cov-link \
+      cov-internal-clang cov-internal-emit-clang cov-internal-nm \
+      cov-internal-emit-java-bytecode cov-internal-reduce cov-translate \
+      cov-preprocess cov-internal-pid-to-db cov-manage-emit \
+      cov-manage-history; do
+        ln -s $out/libexec/bin/$x $out/bin/$x;
+    done
+  '';
+
+  meta = {
+    description = "Coverity Scan build tools";
+    homepage    = "https://scan.coverity.com";
+    license     = stdenv.lib.licenses.unfreeRedistributable;
+    platforms   = stdenv.lib.platforms.linux;
+    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/cppcheck/default.nix b/nixpkgs/pkgs/development/tools/analysis/cppcheck/default.nix
new file mode 100644
index 000000000000..8b6eb71f90ff
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/cppcheck/default.nix
@@ -0,0 +1,38 @@
+{ stdenv, fetchurl, libxslt, docbook_xsl, docbook_xml_dtd_45, pcre }:
+
+stdenv.mkDerivation rec {
+  pname = "cppcheck";
+  version = "1.88";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
+    sha256 = "1jiqv9pzzy2gxkdhxv3gqjarwgbvc7kxyc66dm3i6xwp94bl89dv";
+  };
+
+  buildInputs = [ pcre ];
+  nativeBuildInputs = [ libxslt docbook_xsl docbook_xml_dtd_45 ];
+
+  makeFlags = ''PREFIX=$(out) CFGDIR=$(out)/cfg HAVE_RULES=yes'';
+
+  outputs = [ "out" "man" ];
+
+  enableParallelBuilding = true;
+
+  postInstall = ''
+    make DB2MAN=${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl man
+    mkdir -p $man/share/man/man1
+    cp cppcheck.1 $man/share/man/man1/cppcheck.1
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A static analysis tool for C/C++ code";
+    longDescription = ''
+      Check C/C++ code for memory leaks, mismatching allocation-deallocation,
+      buffer overruns and more.
+    '';
+    homepage = http://cppcheck.sourceforge.net/;
+    license = licenses.gpl3Plus;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ joachifm ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/cpplint/default.nix b/nixpkgs/pkgs/development/tools/analysis/cpplint/default.nix
new file mode 100644
index 000000000000..10ed99e3ffe6
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/cpplint/default.nix
@@ -0,0 +1,29 @@
+{ lib, pythonPackages, fetchFromGitHub }:
+
+pythonPackages.buildPythonApplication rec {
+  pname = "cpplint";
+  version = "1.3.0";
+
+  # Fetch from github instead of pypi, since the test cases are not in the pypi archive
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = version;
+    sha256 = "107v7bp35kxbv9v7wl79h7115z1m4b48rhasp0cnivql1grd277i";
+  };
+
+  postPatch = ''
+    patchShebangs cpplint_unittest.py
+  '';
+
+  checkPhase = ''
+    ./cpplint_unittest.py
+  '';
+
+  meta = with lib; {
+    homepage = https://github.com/cpplint/cpplint;
+    description = "Static code checker for C++";
+    maintainers = [ maintainers.bhipple ];
+    license = [ licenses.bsd3 ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/egypt/default.nix b/nixpkgs/pkgs/development/tools/analysis/egypt/default.nix
new file mode 100644
index 000000000000..6259756794df
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/egypt/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, fetchurl, perlPackages }:
+
+perlPackages.buildPerlPackage rec {
+  pname = "egypt";
+  version = "1.10";
+
+  src = fetchurl {
+    sha256 = "0r0wj6v8z9fzlh9pb5617kyjdf92ppmlbzajaarrq729bbb6ln5m";
+    url = "https://www.gson.org/egypt/download/${pname}-${version}.tar.gz";
+  };
+
+  outputs = [ "out" ];
+
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
+  meta = with stdenv.lib; {
+    description = "Tool for making call graphs of C programmes";
+    longDescription = ''
+      Egypt is a simple tool for creating call graphs of C programs. It neither
+      analyzes source code nor lays out graphs. Instead, it leaves the source
+      code analysis to GCC and the graph layout to Graphviz, both of which are
+      better at their respective jobs than egypt itself could ever hope to be.
+      Egypt is simply a very small Perl script that glues these existing tools
+      together.
+    '';
+    homepage = http://www.gson.org/egypt/;
+    license = with licenses; [ artistic1 gpl1Plus ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/emma/default.nix b/nixpkgs/pkgs/development/tools/analysis/emma/default.nix
new file mode 100644
index 000000000000..1bd24b4785d0
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/emma/default.nix
@@ -0,0 +1,24 @@
+{stdenv, fetchurl, unzip}:
+
+stdenv.mkDerivation {
+  name = "emma-2.0.5312";
+  
+  src = fetchurl {
+    url = mirror://sourceforge/emma/emma-2.0.5312.zip;
+    sha256 = "0xxy39s2lvgs56vicjzpcz936l1vjaplliwa0dm7v3iyvw6jn7vj";
+  };
+
+  buildInputs = [unzip];
+
+  installPhase = ''
+    mkdir -p $out/lib/jars
+    cp lib/*.jar $out/lib/jars/
+  '';
+
+  meta = {
+    homepage = http://emma.sourceforge.net/;
+    description = "A code coverage tool for Java";
+    platforms = stdenv.lib.platforms.unix;
+    license = stdenv.lib.licenses.cpl10;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/eresi/default.nix b/nixpkgs/pkgs/development/tools/analysis/eresi/default.nix
new file mode 100644
index 000000000000..ed338a6e0d9b
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/eresi/default.nix
@@ -0,0 +1,60 @@
+{ stdenv, lib, fetchFromGitHub, which, openssl, readline }:
+
+stdenv.mkDerivation rec {
+  pname = "eresi";
+  version = "0.83-a3-phoenix";
+
+  src = fetchFromGitHub {
+    owner = "thorkill";
+    repo = "eresi";
+    rev = version;
+    sha256 = "0a5a7mh2zw9lcdrl8n1mqccrc0xcgj7743l7l4kslkh722fxv625";
+  };
+
+  postPatch = ''
+    # Two occurences of fprintf() with only two arguments, which should really
+    # be fputs().
+    #
+    # Upstream pull request: https://github.com/thorkill/eresi/pull/162
+    #
+    sed -i -e 's/fprintf(\(stderr\), *\([a-z0-9]\+\))/fputs(\2, \1)/g' \
+      libe2dbg/common/common.c libe2dbg/user/threads.c
+
+    # We need to patch out a few ifs here, because it tries to create a series
+    # of configuration files in ~/.something. However, our builds are sandboxed
+    # and also don't contain a valid home, so let's NOP it out :-)
+    #
+    # The second fix we need to make is that we need to pretend being Gentoo
+    # because otherwise the build process tries to link against libtermcap,
+    # which I think is solely for historic reasons (nowadays Terminfo should
+    # have largely superseded it).
+    sed -i -e '/^if \[ ! -e/c if false; then' \
+           -e 's/^GENTOO=.*/GENTOO=1/' configure
+  '';
+
+  configureFlags = [
+    (if stdenv.is64bit then "--enable-32-64" else "--enable-32")
+    "--enable-readline"
+  ];
+
+  # The configure script is not generated by autoconf but is hand-rolled, so it
+  # has --enable-static but no --disabled-static and also doesn't support the
+  # equals sign in --prefix.
+  prefixKey = "--prefix ";
+  dontDisableStatic = true;
+
+  nativeBuildInputs = [ which ];
+  buildInputs = [ openssl readline ];
+  enableParallelBuilding = true;
+
+  installTargets = lib.singleton "install"
+                ++ lib.optional stdenv.is64bit "install64";
+
+  meta = {
+    description = "The ERESI Reverse Engineering Software Interface";
+    license = lib.licenses.gpl2;
+    homepage = http://www.eresi-project.org/;
+    maintainers = [ lib.maintainers.aszlig ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/evmdis/default.nix b/nixpkgs/pkgs/development/tools/analysis/evmdis/default.nix
new file mode 100644
index 000000000000..c250f442a0eb
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/evmdis/default.nix
@@ -0,0 +1,21 @@
+{ stdenv, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage {
+  pname = "evmdis-unstable";
+  version = "2018-03-23";
+  goPackagePath = "github.com/Arachnid/evmdis";
+
+  src = fetchFromGitHub {
+    owner = "Arachnid";
+    repo = "evmdis";
+    rev = "0d1406905c5fda6224651fa53260a21c907eb986";
+    sha256 = "09y4j7ipgv8yd99g3xk3f079w8fqfj7kl1y7ry81ainysn0qlqrg";
+  };
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/Arachnid/evmdis;
+    description = "Ethereum EVM disassembler";
+    license = [ licenses.asl20 ];
+    maintainers = with maintainers; [ asymmetric ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/findbugs/default.nix b/nixpkgs/pkgs/development/tools/analysis/findbugs/default.nix
new file mode 100644
index 000000000000..7f2df62008f0
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/findbugs/default.nix
@@ -0,0 +1,44 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "findbugs-3.0.1";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/findbugs/${name}.tar.gz";
+    sha256 = "06b46fz4nid7qvm36r66zw01fr87y4jyz21ixw27b8hkqah0s3p8";
+  };
+
+  buildPhase = ''
+    substituteInPlace bin/findbugs --replace /bin/pwd pwd
+  '';
+
+  installPhase = ''
+    d=$out/libexec/findbugs
+    mkdir -p $d $out/bin $out/nix-support
+
+    cp -prd bin lib plugin doc $d/
+    rm $d/bin/*.bat
+    for i in $d/bin/*; do
+      if [ -f $i ]; then ln -s $i $out/bin/; fi
+    done
+
+    # Get rid of unnecessary JARs.
+    rm $d/lib/ant.jar
+
+    # Make some JARs findable.
+    mkdir -p $out/share/java
+    ln -s $d/lib/{findbugs.jar,findbugs-ant.jar} $out/share/java/
+
+    cat <<EOF > $out/nix-support/setup-hook
+    export FINDBUGS_HOME=$d
+    EOF
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A static analysis tool to find bugs in Java programs automatically";
+    homepage = http://findbugs.sourceforge.net/;
+    maintainers = with maintainers; [ pSub ];
+    platforms = with platforms; unix;
+    license = licenses.lgpl3;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/flow/default.nix b/nixpkgs/pkgs/development/tools/analysis/flow/default.nix
new file mode 100644
index 000000000000..f4c7047e8de2
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/flow/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub, ocamlPackages, CoreServices }:
+
+stdenv.mkDerivation rec {
+  pname = "flow";
+  version = "0.107.0";
+
+  src = fetchFromGitHub {
+    owner  = "facebook";
+    repo   = "flow";
+    rev    = "refs/tags/v${version}";
+    sha256 = "1in7a006lgw4v2p0gn5sx41cn3p259vncpq0l3rz52lyfpn7ai3b";
+  };
+
+  installPhase = ''
+    install -Dm755 bin/flow $out/bin/flow
+    install -Dm644 resources/shell/bash-completion $out/share/bash-completion/completions/flow
+  '';
+
+  buildInputs = (with ocamlPackages; [ ocaml findlib ocamlbuild dtoa core_kernel sedlex ocaml_lwt lwt_log lwt_ppx ppx_deriving ppx_gen_rec ppx_tools_versioned visitors wtf8 ocaml-migrate-parsetree ])
+    ++ stdenv.lib.optionals stdenv.isDarwin [ CoreServices ];
+
+  meta = with stdenv.lib; {
+    description = "A static type checker for JavaScript";
+    homepage = https://flow.org/;
+    license = licenses.mit;
+    platforms = ocamlPackages.ocaml.meta.platforms;
+    maintainers = with maintainers; [ marsam puffnfresh ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/frama-c/default.nix b/nixpkgs/pkgs/development/tools/analysis/frama-c/default.nix
new file mode 100644
index 000000000000..8f1709933707
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/frama-c/default.nix
@@ -0,0 +1,82 @@
+{ lib, stdenv, fetchurl, makeWrapper, writeText
+, autoconf, ncurses, graphviz, doxygen
+, ocamlPackages, ltl2ba, coq, why3,
+}:
+
+let
+  mkocamlpath = p: "${p}/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib";
+  runtimeDeps = with ocamlPackages; [
+    apron
+    biniou
+    camlzip
+    easy-format
+    menhir
+    mlgmpidl
+    num
+    ocamlgraph
+    why3
+    yojson
+    zarith
+  ];
+  ocamlpath = lib.concatMapStringsSep ":" mkocamlpath runtimeDeps;
+in
+
+stdenv.mkDerivation rec {
+  pname = "frama-c";
+  version = "19.0";
+  slang   = "Potassium";
+
+  src = fetchurl {
+    url    = "http://frama-c.com/download/frama-c-${version}-${slang}.tar.gz";
+    sha256 = "190n1n4k0xbycz25bn0d2gnfxd8w6scz3nlixl7w2k2jvpqlcs3n";
+
+  };
+
+  preConfigure = lib.optionalString stdenv.cc.isClang "configureFlagsArray=(\"--with-cpp=clang -E -C\")";
+
+  nativeBuildInputs = [ autoconf makeWrapper ];
+
+  buildInputs = with ocamlPackages; [
+    ncurses ocaml findlib ltl2ba ocamlgraph yojson menhir camlzip
+    lablgtk coq graphviz zarith apron why3 mlgmpidl doxygen
+  ];
+
+  enableParallelBuilding = true;
+
+  fixupPhase = ''
+    for p in $out/bin/frama-c{,-gui};
+    do
+      wrapProgram $p --prefix OCAMLPATH ':' ${ocamlpath}
+    done
+  '';
+
+  # Allow loading of external Frama-C plugins
+  setupHook = writeText "setupHook.sh" ''
+    addFramaCPath () {
+      if test -d "''$1/lib/frama-c/plugins"; then
+        export FRAMAC_PLUGIN="''${FRAMAC_PLUGIN}''${FRAMAC_PLUGIN:+:}''$1/lib/frama-c/plugins"
+        export OCAMLPATH="''${OCAMLPATH}''${OCAMLPATH:+:}''$1/lib/frama-c/plugins"
+      fi
+
+      if test -d "''$1/lib/frama-c"; then
+        export OCAMLPATH="''${OCAMLPATH}''${OCAMLPATH:+:}''$1/lib/frama-c"
+      fi
+
+      if test -d "''$1/share/frama-c/"; then
+        export FRAMAC_EXTRA_SHARE="''${FRAMAC_EXTRA_SHARE}''${FRAMAC_EXTRA_SHARE:+:}''$1/share/frama-c"
+      fi
+
+    }
+
+    addEnvHooks "$targetOffset" addFramaCPath
+  '';
+
+
+  meta = {
+    description = "An extensible and collaborative platform dedicated to source-code analysis of C software";
+    homepage    = http://frama-c.com/;
+    license     = stdenv.lib.licenses.lgpl21;
+    maintainers = with stdenv.lib.maintainers; [ thoughtpolice amiddelk ];
+    platforms   = stdenv.lib.platforms.unix;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilegen/default.nix b/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilegen/default.nix
new file mode 100644
index 000000000000..f96f7e9b66bd
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilegen/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, fetchFromGitHub, cmake }:
+
+stdenv.mkDerivation rec {
+
+  name = "tracefilegen-2017-05-13";
+
+  src = fetchFromGitHub {
+    owner = "GarCoSim";
+    repo = "TraceFileGen";
+    rev = "0ebfd1fdb54079d4bdeaa81fc9267ecb9f016d60";
+    sha256 = "1gsx18ksgz5gwl3v62vgrmhxc0wc99i74qwhpn0h57zllk41drjc";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  patches = [ ./gcc7.patch ];
+
+  installPhase = ''
+    install -Dm755 TraceFileGen $out/bin/TraceFileGen
+    mkdir -p $out/share/doc/${name}/
+    cp -ar $src/Documentation/html $out/share/doc/${name}/.
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Automatically generate all types of basic memory management operations and write into trace files";
+    homepage = https://github.com/GarCoSim;
+    maintainers = [ maintainers.cmcdragonkai ];
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+  };
+
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilegen/gcc7.patch b/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilegen/gcc7.patch
new file mode 100644
index 000000000000..48301bbf61ad
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilegen/gcc7.patch
@@ -0,0 +1,13 @@
+diff --git a/Utils/Logger.cpp b/Utils/Logger.cpp
+index 747cd63..e3efdf1 100644
+--- a/Utils/Logger.cpp
++++ b/Utils/Logger.cpp
+@@ -29,7 +29,7 @@ Logger::Logger(char* tracepath) {
+ 	trace = fopen(tracepath, "w");

+ 

+ 	// dot file is not used, set null as default value

+-	dot = '\0';

++	dot = nullptr;

+ 	//dot = fopen("gcKons.dot", "w");

+ 	//fprintf(dot,"digraph G {\n");

+ }

diff --git a/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilesim/default.nix b/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilesim/default.nix
new file mode 100644
index 000000000000..557fa8384746
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilesim/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, fetchgit }:
+
+stdenv.mkDerivation {
+
+  name = "tracefilesim-2015-11-07";
+
+  src = fetchgit {
+    url = "https://github.com/GarCoSim/TraceFileSim.git";
+    rev = "368aa6b1d6560e7ecbd16fca47000c8f528f3da2";
+    sha256 = "156m92k38ap4bzidbr8dzl065rni8lrib71ih88myk9z5y1x5nxm";
+  };
+
+  hardeningDisable = [ "fortify" ];
+
+  installPhase = ''
+    mkdir --parents "$out/bin"
+    cp ./traceFileSim "$out/bin"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Ease the analysis of existing memory management techniques, as well as the prototyping of new memory management techniques.";
+    homepage = https://github.com/GarCoSim;
+    maintainers = [ maintainers.cmcdragonkai ];
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+  };
+
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/hopper/default.nix b/nixpkgs/pkgs/development/tools/analysis/hopper/default.nix
new file mode 100644
index 000000000000..c9214ae7e35d
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/hopper/default.nix
@@ -0,0 +1,42 @@
+{ stdenv, fetchurl, pkgs, lib }:
+
+stdenv.mkDerivation rec {
+  pname    = "hopper";
+  version = "4.5.7";
+  rev = "v${lib.versions.major version}";
+
+  src = fetchurl {
+    url = "https://d2ap6ypl1xbe4k.cloudfront.net/Hopper-${rev}-${version}-Linux.pkg.tar.xz";
+    sha256 = "1ce7a0f13126a940398aa8da4a74e250dff0401074f30446a8840ac3dbb902c0";
+  };
+
+  sourceRoot = ".";
+
+  ldLibraryPath = with pkgs; stdenv.lib.makeLibraryPath  [
+libbsd.out libffi.out gmpxx.out python27Full.out python27Packages.libxml2 qt5.qtbase zlib  xlibs.libX11.out xorg_sys_opengl.out xlibs.libXrender.out gcc-unwrapped.lib
+  ];
+
+  nativeBuildInputs = [ pkgs.qt5.wrapQtAppsHook ];
+
+  qtWrapperArgs = [ ''--suffix LD_LIBRARY_PATH : ${ldLibraryPath}'' ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    mkdir -p $out/lib
+    mkdir -p $out/share
+    cp $sourceRoot/opt/hopper-${rev}/bin/Hopper $out/bin/hopper
+    cp -r $sourceRoot/opt/hopper-${rev}/lib $out
+    cp -r $sourceRoot/usr/share $out/share
+    patchelf \
+      --set-interpreter ${stdenv.glibc}/lib/ld-linux-x86-64.so.2 \
+      $out/bin/hopper
+  '';
+
+  meta = {
+    homepage = "https://www.hopperapp.com/index.html";
+    description = "A macOS and Linux Disassembler";
+    license = stdenv.lib.licenses.unfree;
+    maintainers = [ stdenv.lib.maintainers.luis ];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/hotspot/default.nix b/nixpkgs/pkgs/development/tools/analysis/hotspot/default.nix
new file mode 100644
index 000000000000..89ffbff3db71
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/hotspot/default.nix
@@ -0,0 +1,66 @@
+{ stdenv,
+  cmake,
+  elfutils,
+  extra-cmake-modules,
+  fetchFromGitHub,
+  kconfigwidgets,
+  ki18n,
+  kio,
+  kitemmodels,
+  kitemviews,
+  kwindowsystem,
+  libelf,
+  qtbase,
+  threadweaver,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "hotspot";
+  version = "1.2.0";
+
+  src = fetchFromGitHub {
+    owner = "KDAB";
+    repo = "hotspot";
+    rev = "v${version}";
+    sha256 = "05rkzrvak93z8mzcpm4mcjxb933l8pjsxr9a595wfn1gn2ihmada";
+    fetchSubmodules = true;
+  };
+
+  buildInputs = [
+    cmake
+    elfutils
+    extra-cmake-modules
+    kconfigwidgets
+    ki18n
+    kio
+    kitemmodels
+    kitemviews
+    kwindowsystem
+    libelf
+    qtbase
+    threadweaver
+  ];
+
+  # hotspot checks for the presence of third party libraries'
+  # git directory to give a nice warning when you forgot to clone
+  # submodules; but Nix clones them and removes .git (for reproducibility).
+  # So we need to fake their existence here.
+  postPatch = ''
+    mkdir -p 3rdparty/perfparser/.git
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = {
+    description = "A GUI for Linux perf";
+    longDescription = ''
+      hotspot is a GUI replacement for `perf report`.
+      It takes a perf.data file, parses and evaluates its contents and
+      then displays the result in a graphical way.
+    '';
+    homepage = https://github.com/KDAB/hotspot;
+    license = with stdenv.lib.licenses; [ gpl2 gpl3 ];
+    platforms = stdenv.lib.platforms.linux;
+    maintainers = with stdenv.lib.maintainers; [ nh2 ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/ikos/default.nix b/nixpkgs/pkgs/development/tools/analysis/ikos/default.nix
new file mode 100644
index 000000000000..6f3df32f3c04
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/ikos/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, lib, fetchFromGitHub, cmake, boost
+, gmp, llvm, clang, sqlite, python3
+, ocamlPackages, mpfr, ppl, doxygen, graphviz
+}:
+
+let
+  python = python3.withPackages (ps: with ps; [
+    pygments
+  ]);
+in
+
+stdenv.mkDerivation rec {
+  name = "ikos";
+  version = "2.1";
+
+  src = fetchFromGitHub {
+    owner = "NASA-SW-VnV";
+    repo = name;
+    rev = "v${version}";
+    sha256 = "09nf47hpk5w5az4c0hcr5hhwvpz8zg1byyg185542cpzbq1xj8cb";
+  };
+
+  buildInputs = [ cmake boost gmp clang llvm sqlite python
+                  ocamlPackages.apron mpfr ppl doxygen graphviz ];
+
+  cmakeFlags = "-DAPRON_ROOT=${ocamlPackages.apron}";
+
+  postBuild = "make doc";
+
+  meta = with lib; {
+    homepage = https://github.com/NASA-SW-VnV/ikos;
+    description = "Static analyzer for C/C++ based on the theory of Abstract Interpretation";
+    license = licenses.nasa13;
+    maintainers = with maintainers; [ atnnn ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/include-what-you-use/default.nix b/nixpkgs/pkgs/development/tools/analysis/include-what-you-use/default.nix
new file mode 100644
index 000000000000..c05d47e396cf
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/include-what-you-use/default.nix
@@ -0,0 +1,39 @@
+{ stdenv, fetchurl, cmake, llvmPackages, python2 }:
+
+stdenv.mkDerivation rec {
+  pname = "include-what-you-use";
+  # Also bump llvmPackages in all-packages.nix to the supported version!
+  version = "0.12";
+
+  src = fetchurl {
+    sha256 = "09b0h704fh7r4f5h92p5997cj3zk1v04bqp4jk1j1f6cmfq2z2d5";
+    url = "${meta.homepage}/downloads/${pname}-${version}.src.tar.gz";
+  };
+
+  buildInputs = with llvmPackages; [ clang-unwrapped llvm python2 ];
+  nativeBuildInputs = [ cmake ];
+
+  cmakeFlags = [ "-DIWYU_LLVM_ROOT_PATH=${llvmPackages.clang-unwrapped}" ];
+
+  enableParallelBuilding = true;
+
+  postInstall = ''
+    substituteInPlace $out/bin/iwyu_tool.py \
+      --replace "'include-what-you-use'" "'$out/bin/include-what-you-use'"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Analyze #includes in C/C++ source files with clang";
+    longDescription = ''
+      For every symbol (type, function variable, or macro) that you use in
+      foo.cc, either foo.cc or foo.h should #include a .h file that exports the
+      declaration of that symbol.  The main goal of include-what-you-use is to
+      remove superfluous #includes, both by figuring out what #includes are not
+      actually needed for this file (for both .cc and .h files), and by
+      replacing #includes with forward-declares when possible.
+    '';
+    homepage = https://include-what-you-use.org;
+    license = licenses.bsd3;
+    platforms = platforms.unix;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/jdepend/default.nix b/nixpkgs/pkgs/development/tools/analysis/jdepend/default.nix
new file mode 100644
index 000000000000..455ff7722fa9
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/jdepend/default.nix
@@ -0,0 +1,35 @@
+{ stdenv, fetchFromGitHub, ant, jdk, runtimeShell }:
+
+stdenv.mkDerivation rec {
+  pname = "jdepend";
+  version = "2.9.1";
+
+  src = fetchFromGitHub {
+    owner = "clarkware";
+    repo = "jdepend";
+    rev = version;
+    sha256 = "1sxkgj4k4dhg8vb772pvisyzb8x0gwvlfqqir30ma4zvz3rfz60p";
+  };
+
+  nativeBuildInputs = [ ant jdk ];
+  buildPhase = "ant jar";
+
+  installPhase = ''
+    mkdir -p $out/bin $out/share
+    install dist/${pname}-${version}.jar $out/share
+
+    cat > "$out/bin/jdepend" <<EOF
+    #!${runtimeShell}
+    exec ${jdk.jre}/bin/java -classpath "$out/share/*" "\$@"
+    EOF
+    chmod a+x $out/bin/jdepend
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Traverses Java class file directories and generates design quality metrics for each Java package";
+    homepage = http://www.clarkware.com/software/JDepend.html;
+    license = licenses.bsd3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ pSub ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/kcov/default.nix b/nixpkgs/pkgs/development/tools/analysis/kcov/default.nix
new file mode 100644
index 000000000000..b5bc31ad5e9f
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/kcov/default.nix
@@ -0,0 +1,38 @@
+{stdenv, fetchFromGitHub, cmake, pkgconfig, zlib, curl, elfutils, python, libiberty, libopcodes}:
+
+stdenv.mkDerivation rec {
+  pname = "kcov";
+  version = "36";
+
+  src = fetchFromGitHub {
+    owner = "SimonKagstrom";
+    repo = "kcov";
+    rev = "v${version}";
+    sha256 = "1q1mw5mxz041lr6qc2v4280rmx13pg1bx5r3bxz9bzs941r405r3";
+  };
+
+  preConfigure = "patchShebangs src/bin-to-c-source.py";
+  nativeBuildInputs = [ cmake pkgconfig ];
+
+  buildInputs = [ zlib curl elfutils python libiberty libopcodes ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Code coverage tester for compiled programs, Python scripts and shell scripts";
+
+    longDescription = ''
+      Kcov is a code coverage tester for compiled programs, Python
+      scripts and shell scripts. It allows collecting code coverage
+      information from executables without special command-line
+      arguments, and continuosly produces output from long-running
+      applications.
+    '';
+
+    homepage = http://simonkagstrom.github.io/kcov/index.html;
+    license = licenses.gpl2;
+
+    maintainers = with maintainers; [ gal_bolle ekleog ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/lcov/default.nix b/nixpkgs/pkgs/development/tools/analysis/lcov/default.nix
new file mode 100644
index 000000000000..06c712588f8f
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/lcov/default.nix
@@ -0,0 +1,36 @@
+{stdenv, fetchurl, perl}:
+
+stdenv.mkDerivation rec {
+  name = "lcov-1.14";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/ltp/${name}.tar.gz";
+    sha256 = "06h7ixyznf6vz1qvksjgy5f3q2nw9akf6zx59npf0h3l32cmd68l";
+  };
+
+  buildInputs = [ perl ];
+
+  preBuild = ''
+    patchShebangs bin/
+    makeFlagsArray=(PREFIX=$out LCOV_PERL_PATH=$(command -v perl))
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Code coverage tool that enhances GNU gcov";
+
+    longDescription =
+      '' LCOV is an extension of GCOV, a GNU tool which provides information
+         about what parts of a program are actually executed (i.e.,
+         "covered") while running a particular test case.  The extension
+         consists of a set of PERL scripts which build on the textual GCOV
+         output to implement the following enhanced functionality such as
+         HTML output.
+      '';
+
+    homepage = http://ltp.sourceforge.net/coverage/lcov.php;
+    license = stdenv.lib.licenses.gpl2Plus;
+
+    maintainers = with maintainers; [ dezgeg ];
+    platforms = platforms.all;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/makefile2graph/default.nix b/nixpkgs/pkgs/development/tools/analysis/makefile2graph/default.nix
new file mode 100644
index 000000000000..20fe74ecb74d
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/makefile2graph/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, fetchFromGitHub, makeWrapper, bash, gnumake }:
+
+stdenv.mkDerivation {
+  name = "makefile2graph-2018-01-03";
+
+  src = fetchFromGitHub {
+    owner = "lindenb";
+    repo = "makefile2graph";
+    rev = "61fb95a5ba91c20236f5e4deb11127c34b47091f";
+    sha256 = "07hq40bl48i8ka35fcciqcafpd8k9rby1wf4vl2p53v0665xaghr";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  makeFlags = [ "prefix=$(out)" ];
+
+  fixupPhase = ''
+    substituteInPlace $out/bin/makefile2graph \
+      --replace '/bin/sh' ${bash}/bin/bash \
+      --replace 'make2graph' "$out/bin/make2graph"
+    wrapProgram $out/bin/makefile2graph \
+      --set PATH ${stdenv.lib.makeBinPath [ gnumake ]}
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/lindenb/makefile2graph";
+    description = "Creates a graph of dependencies from GNU-Make; Output is a graphiz-dot file or a Gexf-XML file";
+    maintainers = with maintainers; [ cmcdragonkai ];
+    license = licenses.mit;
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/massif-visualizer/default.nix b/nixpkgs/pkgs/development/tools/analysis/massif-visualizer/default.nix
new file mode 100644
index 000000000000..c2f0236ed0b4
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/massif-visualizer/default.nix
@@ -0,0 +1,30 @@
+{
+  mkDerivation, lib, fetchurl,
+  extra-cmake-modules, shared-mime-info,
+  qtsvg, qtxmlpatterns, karchive, kconfig, kcoreaddons, kparts, kio, ki18n,
+  kdiagram, kgraphviewer
+}:
+
+mkDerivation rec {
+  pname = "massif-visualizer";
+  version = "0.7.0";
+
+  src = fetchurl {
+    url = "mirror://kde/stable/massif-visualizer/${version}/src/${pname}-${version}.tar.xz";
+    sha256 = "0v8z6r9gngzckvqyxjm9kp7hilwfqibyk2f9vag9l98ar0iwr97q";
+  };
+
+  nativeBuildInputs = [ extra-cmake-modules shared-mime-info ];
+
+  buildInputs = [
+    qtsvg qtxmlpatterns karchive kconfig kcoreaddons kparts kio ki18n
+    kdiagram kgraphviewer
+  ];
+
+  meta = with lib; {
+    description = "Tool that visualizes massif data generated by valgrind";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ lethalman zraexy ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/oclgrind/default.nix b/nixpkgs/pkgs/development/tools/analysis/oclgrind/default.nix
new file mode 100644
index 000000000000..4d1b22a72b5c
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/oclgrind/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, fetchFromGitHub, cmake, llvmPackages, readline, python }:
+
+stdenv.mkDerivation rec {
+  pname = "oclgrind";
+  version = "18.3"; # see comment in all-packages.nix
+
+  src = fetchFromGitHub {
+    owner = "jrprice";
+    repo = "oclgrind";
+    rev = "v${version}";
+    sha256 = "0s42z3dg684a0gk8qyx2h08cbh95zkrdaaj9y71rrc5bjsg8197x";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ llvmPackages.llvm llvmPackages.clang-unwrapped readline python ];
+
+  cmakeFlags = [
+    "-DCLANG_ROOT=${llvmPackages.clang-unwrapped}"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "An OpenCL device simulator and debugger";
+    homepage = https://github.com/jrprice/oclgrind;
+    license = licenses.bsd3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ athas ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/panopticon/default.nix b/nixpkgs/pkgs/development/tools/analysis/panopticon/default.nix
new file mode 100644
index 000000000000..250002a16b76
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/panopticon/default.nix
@@ -0,0 +1,51 @@
+{ stdenv, fetchFromGitHub, rustPlatform, qt5, git, cmake
+, pkgconfig, makeWrapper }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "panopticon";
+  version = "unstable-20171202";
+
+  src = fetchFromGitHub {
+    owner = "das-labor";
+    repo = pname;
+    rev = "33ffec0d6d379d51b38d6ea00d040f54b1356ae4";
+    sha256 = "1zv87nqhrzsxx0m891df4vagzssj3kblfv9yp7j96dw0vn9950qa";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ makeWrapper ];
+  propagatedBuildInputs = with qt5; [
+     qt5.qtbase
+     qtdeclarative
+     qtsvg
+     qtquickcontrols2
+     qtgraphicaleffects
+     pkgconfig
+     git
+  ];
+
+  cargoSha256 = "1fsxd7yzb38h1d52yyz7kj1v0riycjydb1b1bn1zkhgwm5sm2kbs";
+  doCheck = false;
+
+  postInstall = ''
+    mkdir -p $out/share/${pname} $out/bin
+    cp -R qml $out/share/${pname}
+    mv $out/bin/${pname} $out/share/${pname}
+    chmod +x $out/share/${pname}
+    makeWrapper $out/share/${pname}/${pname} $out/bin/${pname}
+     '';
+
+  meta = with stdenv.lib; {
+    description = "A libre cross-platform disassembler";
+    longDescription = ''
+      Panopticon is a cross platform disassembler for reverse
+      engineering written in Rust. It can disassemble AMD64,
+      x86, AVR and MOS 6502 instruction sets and open ELF files.
+      Panopticon comes with Qt GUI for browsing and annotating
+      control flow graphs.
+    '';
+    license = with licenses; [ gpl3 ];
+    maintainers = with maintainers; [ leenaars ];
+    platforms = platforms.all;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/pev/default.nix b/nixpkgs/pkgs/development/tools/analysis/pev/default.nix
new file mode 100644
index 000000000000..8e8f438b5e1a
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/pev/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, openssl, fetchFromGitHub }:
+stdenv.mkDerivation {
+  name = "pev-unstable-2018-07-22";
+  buildInputs = [ openssl ];
+  src = fetchFromGitHub {
+    owner = "merces";
+    repo = "pev";
+    rev = "aa4ef7f"; 
+    sha256 = "00a3g486343lhqcsf4vrdy5xif6v3cgcf2y8yp5b96x15c0wid36"; 
+    fetchSubmodules = true;
+  };
+
+  makeFlags = [ "prefix=$(out)" ];
+  installFlags = [ "prefix=$(out)" ];
+
+  meta = with stdenv.lib; {
+    description = "pev is a full-featured, open source, multiplatform command line toolkit to work with PE (Portable Executables) binaries.";
+    homepage = "http://pev.sourceforge.net/";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.jeschli ];
+  };
+
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/pmd/default.nix b/nixpkgs/pkgs/development/tools/analysis/pmd/default.nix
new file mode 100644
index 000000000000..3f3731e2ac83
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/pmd/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, fetchurl, unzip }:
+
+stdenv.mkDerivation rec {
+  pname = "pmd";
+  version = "6.17.0";
+
+  nativeBuildInputs = [ unzip ];
+
+  src = fetchurl {
+    url = "mirror://sourceforge/pmd/pmd-bin-${version}.zip";
+    sha256 = "0000w28dg5z8gs7cxhx7d0fv10ry0yxamk5my28ncqqsg7a4qy8w";
+  };
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out
+    cp -R {bin,lib} $out
+    runHook postInstall
+  '';
+
+  meta = with stdenv.lib; {
+    description = "An extensible cross-language static code analyzer";
+    homepage = "https://pmd.github.io/";
+    changelog = "https://pmd.github.io/pmd-${version}/pmd_release_notes.html";
+    platforms = platforms.unix;
+    license = with licenses; [ bsdOriginal asl20 lgpl3Plus ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/qcachegrind/default.nix b/nixpkgs/pkgs/development/tools/analysis/qcachegrind/default.nix
new file mode 100644
index 000000000000..d9f39667ceff
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/qcachegrind/default.nix
@@ -0,0 +1,40 @@
+{ stdenv, qmake, qtbase, perl, python, php, kcachegrind }:
+
+let
+  name = stdenv.lib.replaceStrings ["kcachegrind"] ["qcachegrind"] kcachegrind.name;
+
+in stdenv.mkDerivation {
+  inherit name;
+
+  src = kcachegrind.src;
+
+  buildInputs = [ qtbase perl python php ];
+
+  nativeBuildInputs = [ qmake ];
+
+  postInstall = ''
+     mkdir -p $out/bin
+     cp -p converters/dprof2calltree $out/bin/dprof2calltree
+     cp -p converters/hotshot2calltree.cmake $out/bin/hotshot2calltree
+     cp -p converters/memprof2calltree $out/bin/memprof2calltree
+     cp -p converters/op2calltree $out/bin/op2calltree
+     cp -p converters/pprof2calltree $out/bin/pprof2calltree
+     chmod -R +x $out/bin/
+  '' + (if stdenv.isDarwin then ''
+    mkdir -p $out/Applications
+    cp cgview/cgview.app/Contents/MacOS/cgview $out/bin
+    cp -a qcachegrind/qcachegrind.app $out/Applications
+  '' else ''
+    install qcachegrind/qcachegrind cgview/cgview -t "$out/bin"
+    install -Dm644 qcachegrind/qcachegrind.desktop -t "$out/share/applications"
+    install -Dm644 kcachegrind/32-apps-kcachegrind.png "$out/share/icons/hicolor/32x32/apps/kcachegrind.png"
+    install -Dm644 kcachegrind/48-apps-kcachegrind.png "$out/share/icons/hicolor/48x48/apps/kcachegrind.png"
+  '');
+
+  meta = with stdenv.lib; {
+    description = "A Qt GUI to visualize profiling data";
+    license = licenses.gpl2;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ periklis ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/radare2/cutter.nix b/nixpkgs/pkgs/development/tools/analysis/radare2/cutter.nix
new file mode 100644
index 000000000000..84c56a9b5691
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/radare2/cutter.nix
@@ -0,0 +1,53 @@
+{ stdenv, fetchFromGitHub
+# nativeBuildInputs
+, qmake, pkgconfig
+# Qt
+, qtbase, qtsvg, qtwebengine
+# buildInputs
+, r2-for-cutter
+, python3
+, wrapQtAppsHook }:
+
+stdenv.mkDerivation rec {
+  pname = "radare2-cutter";
+  version = "1.8.3";
+
+  src = fetchFromGitHub {
+    owner = "radareorg";
+    repo = "cutter";
+    rev = "v${version}";
+    sha256 = "03f3cdckh51anx9gd1b0ndb2fg7061hqngvygf32ky29mm2m2lyv";
+  };
+
+  postUnpack = "export sourceRoot=$sourceRoot/src";
+
+  # Remove this "very helpful" helper file intended for discovering r2,
+  # as it's a doozy of harddcoded paths and unexpected behavior.
+  # Happily Nix has everything all set so we don't need it,
+  # other than as basis for the qmakeFlags set below.
+  postPatch = ''
+    substituteInPlace Cutter.pro \
+      --replace "include(lib_radare2.pri)" ""
+  '';
+
+  nativeBuildInputs = [ qmake pkgconfig ];
+  buildInputs = [ qtbase qtsvg qtwebengine r2-for-cutter python3 wrapQtAppsHook ];
+
+  qmakeFlags = [
+    "CONFIG+=link_pkgconfig"
+    "PKGCONFIG+=r_core"
+    # Leaving this enabled doesn't break build but generates errors
+    # at runtime (to console) about being unable to load needed bits.
+    # Disable until can be looked at.
+    "CUTTER_ENABLE_JUPYTER=false"
+  ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "A Qt and C++ GUI for radare2 reverse engineering framework";
+    homepage = src.meta.homepage;
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ mic92 dtzWill ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/radare2/default.nix b/nixpkgs/pkgs/development/tools/analysis/radare2/default.nix
new file mode 100644
index 000000000000..41949b0ad42d
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/radare2/default.nix
@@ -0,0 +1,133 @@
+{stdenv, fetchFromGitHub
+, buildPackages
+, pkgconfig
+, libusb, readline, libewf, perl, zlib, openssl
+, libuv, file, libzip, xxHash
+, gtk2 ? null, vte ? null, gtkdialog ? null
+, python3 ? null
+, ruby ? null
+, lua ? null
+, useX11 ? false
+, rubyBindings ? false
+, pythonBindings ? false
+, luaBindings ? false
+}:
+
+assert useX11 -> (gtk2 != null && vte != null && gtkdialog != null);
+assert rubyBindings -> ruby != null;
+assert pythonBindings -> python3 != null;
+
+
+let
+  inherit (stdenv.lib) optional;
+
+  generic = {
+    version_commit, # unused
+    gittap,
+    gittip,
+    rev,
+    version,
+    sha256,
+    cs_ver,
+    cs_sha256
+  }:
+    stdenv.mkDerivation {
+      pname = "radare2";
+      inherit version;
+
+      src = fetchFromGitHub {
+        owner = "radare";
+        repo = "radare2";
+        inherit rev sha256;
+      };
+
+      postPatch = let
+        capstone = fetchFromGitHub {
+          owner = "aquynh";
+          repo = "capstone";
+          # version from $sourceRoot/shlr/Makefile
+          rev = cs_ver;
+          sha256 = cs_sha256;
+        };
+      in ''
+        mkdir -p build/shlr
+        cp -r ${capstone} capstone-${cs_ver}
+        chmod -R +w capstone-${cs_ver}
+        # radare 3.3 compat for radare2-cutter
+        (cd shlr && ln -s ../capstone-${cs_ver} capstone)
+        tar -czvf shlr/capstone-${cs_ver}.tar.gz capstone-${cs_ver}
+        # necessary because they broke the offline-build:
+        # https://github.com/radare/radare2/commit/6290e4ff4cc167e1f2c28ab924e9b99783fb1b38#diff-a44d840c10f1f1feaf401917ae4ccd54R258
+        # https://github.com/radare/radare2/issues/13087#issuecomment-465159716
+        curl() { true; }
+        export -f curl
+      '';
+
+      postInstall = ''
+        install -D -m755 $src/binr/r2pm/r2pm $out/bin/r2pm
+      '';
+
+      WITHOUT_PULL="1";
+      makeFlags = [
+        "GITTAP=${gittap}"
+        "GITTIP=${gittip}"
+        "RANLIB=${stdenv.cc.bintools.bintools}/bin/${stdenv.cc.bintools.targetPrefix}ranlib"
+      ];
+      configureFlags = [
+        "--with-sysmagic"
+        "--with-syszip"
+        "--with-sysxxhash"
+        "--with-openssl"
+      ];
+
+      enableParallelBuilding = true;
+      depsBuildBuild = [ buildPackages.stdenv.cc ];
+
+      nativeBuildInputs = [ pkgconfig ];
+      buildInputs = [ file readline libusb libewf perl zlib openssl libuv ]
+        ++ optional useX11 [ gtkdialog vte gtk2 ]
+        ++ optional rubyBindings [ ruby ]
+        ++ optional pythonBindings [ python3 ]
+        ++ optional luaBindings [ lua ];
+
+      propagatedBuildInputs = [
+        # radare2 exposes r_lib which depends on these libraries
+        file # for its list of magic numbers (`libmagic`)
+        libzip
+        xxHash
+      ];
+
+      meta = {
+        description = "unix-like reverse engineering framework and commandline tools";
+        homepage = http://radare.org/;
+        license = stdenv.lib.licenses.gpl2Plus;
+        maintainers = with stdenv.lib.maintainers; [ raskin makefu mic92 ];
+        platforms = with stdenv.lib.platforms; linux;
+        inherit version;
+      };
+  };
+in {
+  #<generated>
+  # DO NOT EDIT! Automatically generated by ./update.py
+  radare2 = generic {
+    version_commit = "22775";
+    gittap = "3.9.0";
+    gittip = "2afe613741d07f35a5d80bc4e2dade2113ae6a74";
+    rev = "3.9.0";
+    version = "3.9.0";
+    sha256 = "0jzz3fzcr9xm8q6n86mhrf30h6cbh147ss9h993cm34fd4d5z7ah";
+    cs_ver = "4.0.1";
+    cs_sha256 = "0ijwxxk71nr9z91yxw20zfj4bbsbrgvixps5c7cpj163xlzlwba6";
+  };
+  r2-for-cutter = generic {
+    version_commit = "22775";
+    gittap = "3.6.0";
+    gittip = "ff3bb6e3b2e6a519b4c975d05758c171a5186389";
+    rev = "ff3bb6e3b2e6a519b4c975d05758c171a5186389";
+    version = "2019-06-24";
+    sha256 = "0vp94qzznqv87vvjbyyj6swkm6gl7byqvb1jv23i8i42zi5n7qmd";
+    cs_ver = "4.0.1";
+    cs_sha256 = "0ijwxxk71nr9z91yxw20zfj4bbsbrgvixps5c7cpj163xlzlwba6";
+  };
+  #</generated>
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/radare2/update.py b/nixpkgs/pkgs/development/tools/analysis/radare2/update.py
new file mode 100755
index 000000000000..794581bca7ad
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/radare2/update.py
@@ -0,0 +1,141 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -p nix -p python3 -p git -i python
+# USAGE - just run the script: ./update.py
+# When editing this file, make also sure it passes the mypy typecheck
+# and is formatted with black.
+import fileinput
+import json
+import re
+import subprocess
+import tempfile
+import urllib.request
+from datetime import datetime
+from pathlib import Path
+from typing import Dict
+
+SCRIPT_DIR = Path(__file__).parent.resolve()
+
+
+def sh(*args: str) -> str:
+    out = subprocess.check_output(list(args))
+    return out.strip().decode("utf-8")
+
+
+def prefetch_github(owner: str, repo: str, ref: str) -> str:
+    return sh(
+        "nix-prefetch-url",
+        "--unpack",
+        f"https://github.com/{owner}/{repo}/archive/{ref}.tar.gz",
+    )
+
+
+def get_radare2_rev() -> str:
+    url = "https://api.github.com/repos/radare/radare2/releases/latest"
+    with urllib.request.urlopen(url) as response:
+        release = json.load(response)  # type: ignore
+    return release["tag_name"]
+
+
+def get_cutter_version() -> str:
+    version_expr = """
+(with import <nixpkgs> {}; (builtins.parseDrvName (qt5.callPackage <radare2/cutter.nix> {}).name).version)
+"""
+    return sh("nix", "eval", "--raw", version_expr.strip(), "-I", "radare2={0}".format(SCRIPT_DIR))
+
+
+def get_r2_cutter_rev() -> str:
+    version = get_cutter_version()
+    url = f"https://api.github.com/repos/radareorg/cutter/contents?ref=v{version}"
+    with urllib.request.urlopen(url) as response:
+        data = json.load(response)  # type: ignore
+    for entry in data:
+        if entry["name"] == "radare2":
+            return entry["sha"]
+    raise Exception("no radare2 submodule found in github.com/radareorg/cutter")
+
+
+def git(dirname: str, *args: str) -> str:
+    return sh("git", "-C", dirname, *args)
+
+
+def get_repo_info(dirname: str, rev: str) -> Dict[str, str]:
+    sha256 = prefetch_github("radare", "radare2", rev)
+
+    cs_ver = None
+    with open(Path(dirname).joinpath("shlr", "Makefile")) as makefile:
+        for l in makefile:
+            match = re.match("CS_VER=(\S+)", l)
+            if match:
+                cs_ver = match.group(1)
+    assert cs_ver is not None
+
+    cs_sha256 = prefetch_github("aquynh", "capstone", cs_ver)
+
+    return dict(
+        rev=rev,
+        sha256=sha256,
+        version_commit=git(dirname, "rev-list", "--all", "--count"),
+        gittap=git(dirname, "describe", "--tags", "--match", "[0-9]*"),
+        gittip=git(dirname, "rev-parse", "HEAD"),
+        cs_ver=cs_ver,
+        cs_sha256=cs_sha256,
+    )
+
+
+def write_package_expr(version: str, info: Dict[str, str]) -> str:
+    return f"""generic {{
+    version_commit = "{info["version_commit"]}";
+    gittap = "{info["gittap"]}";
+    gittip = "{info["gittip"]}";
+    rev = "{info["rev"]}";
+    version = "{version}";
+    sha256 = "{info["sha256"]}";
+    cs_ver = "{info["cs_ver"]}";
+    cs_sha256 = "{info["cs_sha256"]}";
+  }}"""
+
+
+def main() -> None:
+    radare2_rev = get_radare2_rev()
+    r2_cutter_rev = get_r2_cutter_rev()
+
+    with tempfile.TemporaryDirectory() as dirname:
+        git(
+            dirname,
+            "clone",
+            "--branch",
+            radare2_rev,
+            "https://github.com/radare/radare2",
+            ".",
+        )
+        nix_file = str(SCRIPT_DIR.joinpath("default.nix"))
+
+        radare2_info = get_repo_info(dirname, radare2_rev)
+
+        git(dirname, "checkout", r2_cutter_rev)
+
+        timestamp = git(dirname, "log", "-n1", "--format=%at")
+        r2_cutter_version = datetime.fromtimestamp(int(timestamp)).strftime("%Y-%m-%d")
+
+        r2_cutter_info = get_repo_info(dirname, r2_cutter_rev)
+
+        in_block = False
+        with fileinput.FileInput(nix_file, inplace=True) as f:
+            for l in f:
+                if "#<generated>" in l:
+                    in_block = True
+                    print(
+                        f"""  #<generated>
+  # DO NOT EDIT! Automatically generated by ./update.py
+  radare2 = {write_package_expr(radare2_rev, radare2_info)};
+  r2-for-cutter = {write_package_expr(r2_cutter_version, r2_cutter_info)};
+  #</generated>"""
+                    )
+                elif "#</generated>" in l:
+                    in_block = False
+                elif not in_block:
+                    print(l, end="")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/nixpkgs/pkgs/development/tools/analysis/randoop/default.nix b/nixpkgs/pkgs/development/tools/analysis/randoop/default.nix
new file mode 100644
index 000000000000..e8e3168e937c
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/randoop/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, fetchurl, unzip }:
+
+stdenv.mkDerivation rec {
+  version = "3.1.5";
+  pname = "randoop";
+
+  src = fetchurl {
+    url = "https://github.com/randoop/randoop/releases/download/v${version}/${pname}-${version}.zip";
+    sha256 = "13zspyi9fgnqc90qfqqnj0hb7869l0aixv0vwgj8m4m1hggpadlx";
+  };
+
+  buildInputs = [ unzip ];
+
+  installPhase = ''
+    mkdir -p $out/lib $out/doc
+
+    cp -R *.jar $out/lib
+    cp README.txt $out/doc
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Automatic test generation for Java";
+    homepage = https://randoop.github.io/randoop/;
+    license = licenses.mit;
+    maintainers = with maintainers; [ pSub ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/retdec/default.nix b/nixpkgs/pkgs/development/tools/analysis/retdec/default.nix
new file mode 100644
index 000000000000..475d1950bb2a
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/retdec/default.nix
@@ -0,0 +1,235 @@
+{ stdenv
+, fetchFromGitHub
+, fetchpatch
+, fetchzip
+, lib
+, callPackage
+, openssl
+, cmake
+, autoconf
+, automake
+, libtool
+, pkgconfig
+, bison
+, flex
+, groff
+, perl
+, python3
+, time
+, upx
+, ncurses
+, libffi
+, libxml2
+, zlib
+, withPEPatterns ? false
+}:
+
+let
+  capstone = fetchFromGitHub {
+    owner = "avast-tl";
+    repo = "capstone";
+    rev = "27c713fe4f6eaf9721785932d850b6291a6073fe";
+    sha256 = "105z1g9q7s6n15qpln9vzhlij7vj6cyc5dqdr05n7wzjvlagwgxc";
+  };
+  elfio = fetchFromGitHub {
+    owner = "avast-tl";
+    repo = "elfio";
+    rev = "998374baace397ea98f3b1d768e81c978b4fba41";
+    sha256 = "09n34rdp0wpm8zy30zx40wkkc4gbv2k3cv181y6c1260rllwk5d1";
+  };
+  keystone = fetchFromGitHub { # only for tests
+    owner = "keystone-engine";
+    repo = "keystone";
+    rev = "d7ba8e378e5284e6384fc9ecd660ed5f6532e922";
+    sha256 = "1yzw3v8xvxh1rysh97y0i8y9svzbglx2zbsqjhrfx18vngh0x58f";
+  };
+  libdwarf = fetchFromGitHub {
+    owner = "avast-tl";
+    repo = "libdwarf";
+    rev = "85465d5e235cc2d2f90d04016d6aca1a452d0e73";
+    sha256 = "11y62r65py8yp57i57a4cymxispimn62by9z4j2g19hngrpsgbki";
+  };
+  llvm = fetchFromGitHub {
+    owner = "avast-tl";
+    repo = "llvm";
+    rev = "725d0cee133c6ab9b95c493f05de3b08016f5c3c";
+    sha256 = "0dzvafmn4qs62w1y9vh0a11clpj6q3hb41aym4izpcyybjndf9bq";
+  };
+  pelib = fetchFromGitHub {
+    owner = "avast-tl";
+    repo = "pelib";
+    rev = "a7004b2e80e4f6dc984f78b821e7b585a586050d";
+    sha256 = "0nyrb3g749lxgcymz1j584xbb1x6rvy1mc700lyn0brznvqsm81n";
+  };
+  rapidjson = fetchFromGitHub {
+    owner = "Tencent";
+    repo = "rapidjson";
+    rev = "v1.1.0";
+    sha256 = "1jixgb8w97l9gdh3inihz7avz7i770gy2j2irvvlyrq3wi41f5ab";
+  };
+  yaracpp = callPackage ./yaracpp.nix {}; # is its own package because it needs a patch
+  yaramod = fetchFromGitHub {
+    owner = "avast-tl";
+    repo = "yaramod";
+    rev = "v2.2.2";
+    sha256 = "0cq9h4h686q9ybamisbl797g6xjy211s3cq83nixkwkigmz48ccp";
+  };
+  jsoncpp = fetchFromGitHub {
+    owner = "open-source-parsers";
+    repo = "jsoncpp";
+    rev = "1.8.4";
+    sha256 = "1z0gj7a6jypkijmpknis04qybs1hkd04d1arr3gy89lnxmp6qzlm";
+  };
+  googletest = fetchFromGitHub { # only for tests
+    owner = "google";
+    repo = "googletest";
+    rev = "83fa0cb17dad47a1d905526dcdddb5b96ed189d2";
+    sha256 = "1c2r0p9v7vz2vasy8bknfb448l6wsvzw35s8hmc5z013z5502mpk";
+  };
+  tinyxml2 = fetchFromGitHub {
+    owner = "leethomason";
+    repo = "tinyxml2";
+    rev = "cc1745b552dd12bb1297a99f82044f83b06729e0";
+    sha256 = "015g8520a0c55gwmv7pfdsgfz2rpdmh3d1nq5n9bd65n35492s3q";
+  };
+
+  retdec-support = let
+    version = "2018-02-08"; # make sure to adjust both hashes (once with withPEPatterns=true and once withPEPatterns=false)
+  in fetchzip {
+    url = "https://github.com/avast-tl/retdec-support/releases/download/${version}/retdec-support_${version}.tar.xz";
+    sha256 = if withPEPatterns then "148i8flbyj1y4kfdyzsz7jsj38k4h97npjxj18h6v4wksd4m4jm7"
+                               else "0ixv9qyqq40pzyqy6v9jf5rxrvivjb0z0zn260nbmb9gk765bacy";
+    stripRoot = false;
+    # Removing PE signatures reduces this from 3.8GB -> 642MB (uncompressed)
+    extraPostFetch = lib.optionalString (!withPEPatterns) ''
+      rm -r "$out/generic/yara_patterns/static-code/pe"
+    '';
+  } // {
+    inherit version; # necessary to check the version against the expected version
+  };
+
+  # patch CMakeLists.txt for a dependency and compare the versions to the ones expected by upstream
+  # this has to be applied for every dependency (which it is in postPatch)
+  patchDep = dep: ''
+    # check if our version of dep is the same version that upstream expects
+    echo "Checking version of ${dep.dep_name}"
+    expected_rev="$( sed -n -e 's|.*URL https://github.com/.*/archive/\(.*\)\.zip.*|\1|p' "deps/${dep.dep_name}/CMakeLists.txt" )"
+    if [ "$expected_rev" != '${dep.rev}' ]; then
+      echo "The ${dep.dep_name} dependency has the wrong version: ${dep.rev} while $expected_rev is expected."
+      exit 1
+    fi
+
+    # patch the CMakeLists.txt file to use our local copy of the dependency instead of fetching it at build time
+    sed -i -e 's|URL .*|URL ${dep}|' "deps/${dep.dep_name}/CMakeLists.txt"
+  '';
+
+in stdenv.mkDerivation rec {
+  pname = "retdec";
+
+  # If you update this you will also need to adjust the versions of the updated dependencies. You can do this by first just updating retdec
+  # itself and trying to build it. The build should fail and tell you which dependencies you have to upgrade to which versions.
+  # I've notified upstream about this problem here:
+  # https://github.com/avast-tl/retdec/issues/412
+  version = "3.2";
+
+  src = fetchFromGitHub {
+    owner = "avast-tl";
+    repo = "retdec";
+    name = "retdec-${version}";
+    rev = "refs/tags/v${version}";
+    sha256 = "0chky656lsddn20bnm3pmz6ix20y4a0y8swwr42hrhi01vkhmzrp";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    autoconf
+    automake
+    libtool
+    pkgconfig
+    bison
+    flex
+    groff
+    perl
+    python3
+  ];
+
+  buildInputs = [
+    openssl
+    ncurses
+    libffi
+    libxml2
+    zlib
+  ];
+
+  cmakeFlags = [
+    "-DRETDEC_TESTS=ON" # build tests
+  ];
+
+  # all dependencies that are normally fetched during build time (the subdirectories of `deps`)
+  # all of these need to be fetched through nix and the CMakeLists files need to be patched not to fetch them themselves
+  external_deps = [
+    (capstone // { dep_name = "capstone"; })
+    (elfio // { dep_name = "elfio"; })
+    (googletest // { dep_name = "googletest"; })
+    (jsoncpp // { dep_name = "jsoncpp"; })
+    (keystone // { dep_name = "keystone"; })
+    (libdwarf // { dep_name = "libdwarf"; })
+    (llvm // { dep_name = "llvm"; })
+    (pelib // { dep_name = "pelib"; })
+    (rapidjson // { dep_name = "rapidjson"; })
+    (tinyxml2 // { dep_name = "tinyxml2"; })
+    (yaracpp // { dep_name = "yaracpp"; })
+    (yaramod // { dep_name = "yaramod"; })
+  ];
+
+  # Use newer yaramod to fix w/bison 3.2+
+  patches = [
+    # 2.1.2 -> 2.2.1
+    (fetchpatch {
+      url = https://github.com/avast-tl/retdec/commit/c9d23da1c6e23c149ed684c6becd3f3828fb4a55.patch;
+      sha256 = "0hdq634f72fihdy10nx2ajbps561w03dfdsy5r35afv9fapla6mv";
+    })
+    # 2.2.1 -> 2.2.2
+    (fetchpatch {
+      url = https://github.com/avast-tl/retdec/commit/fb85f00754b5d13b781385651db557741679721e.patch;
+      sha256 = "0a8mwmwb39pr5ag3q11nv81ncdk51shndqrkm92shqrmdq14va52";
+    })
+  ];
+
+  postPatch = (lib.concatMapStrings patchDep external_deps) + ''
+    # install retdec-support
+    echo "Checking version of retdec-support"
+    expected_version="$( sed -n -e "s|^version = '\(.*\)'$|\1|p" 'cmake/install-share.py' )"
+    if [ "$expected_version" != '${retdec-support.version}' ]; then
+      echo "The retdec-support dependency has the wrong version: ${retdec-support.version} while $expected_version is expected."
+      exit 1
+    fi
+    mkdir -p "$out/share/retdec"
+    cp -r ${retdec-support} "$out/share/retdec/support" # write permission needed during install
+    chmod -R u+w "$out/share/retdec/support"
+    # python file originally responsible for fetching the retdec-support archive to $out/share/retdec
+    # that is not necessary anymore, so empty the file
+    echo > cmake/install-share.py
+
+    # call correct `time` and `upx` programs
+    substituteInPlace scripts/retdec-config.py --replace /usr/bin/time ${time}/bin/time
+    substituteInPlace scripts/retdec-unpacker.py --replace "'upx'" "'${upx}/bin/upx'"
+  '';
+
+  enableParallelBuilding = true;
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    ${python3.interpreter} "$out/bin/retdec-tests-runner.py"
+
+    rm -rf $out/bin/__pycache__
+  '';
+
+  meta = with lib; {
+    description = "A retargetable machine-code decompiler based on LLVM";
+    homepage = https://retdec.com;
+    license = licenses.mit;
+    maintainers = with maintainers; [ dtzWill timokau ];
+    platforms = ["x86_64-linux" "i686-linux"];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/retdec/yaracpp.nix b/nixpkgs/pkgs/development/tools/analysis/retdec/yaracpp.nix
new file mode 100644
index 000000000000..c8bc4ed747b3
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/retdec/yaracpp.nix
@@ -0,0 +1,49 @@
+{ stdenv
+, fetchFromGitHub
+, coreutils
+}:
+
+let
+  yara = fetchFromGitHub {
+    owner = "avast-tl";
+    repo = "yara";
+    rev = "ea101c5856941f39cad2db3012f2660d1d5c8b65";
+    sha256 = "033ssx2hql5k4pv9si043s3mjq2b748ymjzif8pg6rdwh260faky";
+  };
+in stdenv.mkDerivation rec {
+  # only fetches the yaracpp source patched to work with a local yara clone,
+  # does not build anything
+  pname = "yaracpp-src";
+  version = "2018-10-09";
+  rev = "b92bde0e59e3b75bc445227e04b71105771dee8b"; # as specified in retdec/deps/yaracpp/CMakeLists.txt
+
+  src = fetchFromGitHub {
+    inherit rev;
+    owner = "avast-tl";
+    repo = "yaracpp";
+    sha256 = "0fan7q79j7s3bjmhsd2nw6sqyi14xgikn7mr2p4nj87lick5l4a2";
+  };
+
+  postPatch = ''
+      # check if our version of yara is the same version that upstream expects
+      echo "Checking version of yara"
+      expected_rev="$( sed -n -e 's|.*URL https://github.com/.*/archive/\(.*\)\.zip.*|\1|p' "deps/CMakeLists.txt" )"
+      if [ "$expected_rev" != '${yara.rev}' ]; then
+        echo "The yara dependency has the wrong version: ${yara.rev} while $expected_rev is expected."
+        exit 1
+      fi
+
+      # patch the CMakeLists.txt file to use our local copy of the dependency instead of fetching it at build time
+      sed -i -e "s|URL .*|URL ${yara}|" "deps/CMakeLists.txt"
+
+      # abuse the CONFIGURE_COMMAND to make the source writeable after copying it to the build locatoin (necessary for the build)
+      sed -i -e 's|CONFIGURE_COMMAND ""|CONFIGURE_COMMAND COMMAND ${coreutils}/bin/chmod -R u+w .|' "deps/CMakeLists.txt"
+    '';
+
+  buildPhase = "# do nothing";
+  configurePhase = "# do nothing";
+  installPhase = ''
+    mkdir -p "$out"
+    cp -r * "$out"
+  '';
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/rr/default.nix b/nixpkgs/pkgs/development/tools/analysis/rr/default.nix
new file mode 100644
index 000000000000..844fd38d9be6
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/rr/default.nix
@@ -0,0 +1,60 @@
+{ stdenv, fetchFromGitHub, cmake, libpfm, zlib, pkgconfig, python2Packages, which, procps, gdb, capnproto }:
+
+stdenv.mkDerivation rec {
+  version = "5.2.0";
+  pname = "rr";
+
+  src = fetchFromGitHub {
+    owner = "mozilla";
+    repo = "rr";
+    rev = version;
+    sha256 = "19jsnm8n2smalx2z60x9d8f6g4kdm7zghwyjfvwcxnslk1vn9dkc";
+  };
+
+  postPatch = ''
+    substituteInPlace src/Command.cc --replace '_BSD_SOURCE' '_DEFAULT_SOURCE'
+    sed '7i#include <math.h>' -i src/Scheduler.cc
+    patchShebangs .
+  '';
+
+  # TODO: remove this preConfigure hook after 5.2.0 since it is fixed upstream
+  # see https://github.com/mozilla/rr/issues/2269
+  preConfigure = ''substituteInPlace CMakeLists.txt --replace "std=c++11" "std=c++14"'';
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [
+    cmake libpfm zlib python2Packages.python python2Packages.pexpect which procps gdb capnproto
+  ];
+  cmakeFlags = [
+    "-DCMAKE_C_FLAGS_RELEASE:STRING="
+    "-DCMAKE_CXX_FLAGS_RELEASE:STRING="
+    "-Ddisable32bit=ON"
+  ];
+
+  # we turn on additional warnings due to hardening
+  NIX_CFLAGS_COMPILE = "-Wno-error";
+
+  hardeningDisable = [ "fortify" ];
+
+  enableParallelBuilding = true;
+
+  # FIXME
+  #doCheck = true;
+
+  preCheck = "export HOME=$TMPDIR";
+
+  meta = {
+    homepage = https://rr-project.org/;
+    description = "Records nondeterministic executions and debugs them deterministically";
+    longDescription = ''
+      rr aspires to be your primary debugging tool, replacing -- well,
+      enhancing -- gdb. You record a failure once, then debug the
+      recording, deterministically, as many times as you want. Every
+      time the same execution is replayed.
+    '';
+
+    license = with stdenv.lib.licenses; [ mit bsd2 ];
+    maintainers = with stdenv.lib.maintainers; [ pierron thoughtpolice ];
+    platforms = stdenv.lib.platforms.x86;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/smatch/default.nix b/nixpkgs/pkgs/development/tools/analysis/smatch/default.nix
new file mode 100644
index 000000000000..9dc1e2db8c09
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/smatch/default.nix
@@ -0,0 +1,35 @@
+{ stdenv, fetchgit, sqlite, pkgconfig, perl
+, buildllvmsparse ? true
+, buildc2xml ? true
+, llvm ? null, libxml2 ? null
+}:
+
+assert buildllvmsparse -> llvm != null;
+assert buildc2xml -> libxml2 != null;
+
+stdenv.mkDerivation {
+  name = "smatch-20120924";
+
+  src = fetchgit {
+    url = git://repo.or.cz/smatch.git;
+    rev = "23656e3e578b700cbf96d043f039e6341a3ba5b9";
+    sha256 = "0r43qi6vryqg450fj73yjwbb7gzcgx64rhrhb3r1m6a252srijiy";
+  };
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [sqlite perl]
+   ++ stdenv.lib.optional buildllvmsparse llvm
+   ++ stdenv.lib.optional buildc2xml libxml2;
+
+  preBuild =
+    '' sed -i Makefile \
+           -e "s|^PREFIX=.*|PREFIX = $out|g"
+    '';
+
+  meta = {
+    description = "A semantic analysis tool for C";
+    homepage = http://smatch.sourceforge.net/;
+    license = stdenv.lib.licenses.free; /* OSL, see http://www.opensource.org */
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/snowman/default.nix b/nixpkgs/pkgs/development/tools/analysis/snowman/default.nix
new file mode 100644
index 000000000000..f8f2f55c5aa7
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/snowman/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, fetchFromGitHub, cmake, boost, qtbase }:
+
+stdenv.mkDerivation rec {
+  pname = "snowman";
+  version = "0.1.3";
+
+  src = fetchFromGitHub {
+    owner = "yegord";
+    repo = "snowman";
+    rev = "v${version}";
+    sha256 = "1mrmhj2nddi0d47c266vsg5vbapbqbcpj5ld4v1qcwnnk6z2zn0j";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ boost qtbase ];
+
+  postUnpack = ''
+    export sourceRoot=$sourceRoot/src
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Native code to C/C++ decompiler";
+    homepage = "http://derevenets.com/";
+
+    # https://github.com/yegord/snowman/blob/master/doc/licenses.asciidoc
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ dtzWill ];
+    platforms = platforms.all;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/sparse/default.nix b/nixpkgs/pkgs/development/tools/analysis/sparse/default.nix
new file mode 100644
index 000000000000..945f6c80af52
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/sparse/default.nix
@@ -0,0 +1,26 @@
+{ fetchurl, stdenv, pkgconfig, libxml2, llvm }:
+
+stdenv.mkDerivation rec {
+  name = "sparse-0.5.0";
+
+  src = fetchurl {
+    url = "mirror://kernel/software/devel/sparse/dist/${name}.tar.xz";
+    sha256 = "1mc86jc5xdrdmv17nqj2cam2yqygnj6ar1iqkwsx2y37ij8wy7wj";
+  };
+
+  preConfigure = ''
+    sed -i Makefile -e "s|^PREFIX=.*$|PREFIX=$out|g"
+  '';
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libxml2 llvm ];
+  doCheck = true;
+
+  meta = {
+    description = "Semantic parser for C";
+    homepage    = "https://git.kernel.org/cgit/devel/sparse/sparse.git/";
+    license     = stdenv.lib.licenses.mit;
+    platforms   = stdenv.lib.platforms.linux;
+    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/spin/default.nix b/nixpkgs/pkgs/development/tools/analysis/spin/default.nix
new file mode 100644
index 000000000000..26598bb36cd0
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/spin/default.nix
@@ -0,0 +1,46 @@
+{ stdenv, lib, fetchurl, makeWrapper, yacc, gcc
+, withISpin ? true, tk, swarm, graphviz }:
+
+let
+  binPath = stdenv.lib.makeBinPath [ gcc ];
+  ibinPath = stdenv.lib.makeBinPath [ gcc tk swarm graphviz tk ];
+
+in stdenv.mkDerivation rec {
+  pname = "spin";
+  version = "6.4.9";
+  url-version = stdenv.lib.replaceChars ["."] [""] version;
+
+  src = fetchurl {
+    # The homepage is behind CloudFlare anti-DDoS protection, which blocks cURL.
+    # Dropbox mirror from developers:
+    # https://www.dropbox.com/sh/fgzipzp4wpo3qc1/AADZPqS4aoR-pjNF6OQXRLQHa
+    # (note that this URL doesn't work aross versions and hash should come from official site)
+    url = "https://www.dropbox.com/sh/fgzipzp4wpo3qc1/AABtxFePMJmPxsxSvU5cpxh8a/spin${url-version}.tar.gz?raw=1";
+    sha256 = "07b7wk3qyfnp4pgwicqd33l7i1krzyihx0cf9zkv81ywaklf5vll";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ yacc ];
+
+  sourceRoot = "Spin/Src${version}";
+
+  installPhase = ''
+    install -Dm644 ../Man/spin.1 $out/share/man/man1/spin.1
+
+    install -Dm755 spin $out/bin/spin
+    wrapProgram $out/bin/spin \
+      --prefix PATH : ${binPath}
+  '' + lib.optionalString withISpin ''
+    install -Dm755 ../iSpin/ispin.tcl $out/bin/ispin
+    wrapProgram $out/bin/ispin \
+      --prefix PATH ':' "$out/bin:${ibinPath}"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Formal verification tool for distributed software systems";
+    homepage = http://spinroot.com/;
+    license = licenses.free;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ pSub ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/splint/darwin.patch b/nixpkgs/pkgs/development/tools/analysis/splint/darwin.patch
new file mode 100644
index 000000000000..8c435707571d
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/splint/darwin.patch
@@ -0,0 +1,13 @@
+diff --git a/src/osd.c b/src/osd.c
+index ebe214a..4ba81d5 100644
+--- a/src/osd.c
++++ b/src/osd.c
+@@ -516,7 +516,7 @@ osd_getPid ()
+ # if defined (WIN32) || defined (OS2) && defined (__IBMC__)
+   int pid = _getpid ();
+ # else
+-  __pid_t pid = getpid ();
++  pid_t pid = getpid ();
+ # endif
+ 
+   return (int) pid;
diff --git a/nixpkgs/pkgs/development/tools/analysis/splint/default.nix b/nixpkgs/pkgs/development/tools/analysis/splint/default.nix
new file mode 100644
index 000000000000..57a83e54d705
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/splint/default.nix
@@ -0,0 +1,32 @@
+{ fetchurl, stdenv, flex }:
+
+stdenv.mkDerivation rec {
+  name = "splint-3.1.2";
+
+  src = fetchurl {
+    url = "http://www.splint.org/downloads/${name}.src.tgz";
+    sha256 = "02pv8kscsrkrzip9r08pfs9xs98q74c52mlxzbii6cv6vx1vd3f7";
+  };
+
+  patches = [ ./tmpdir.patch ] ++ stdenv.lib.optional stdenv.isDarwin ./darwin.patch;
+
+  buildInputs = [ flex ];
+
+  doCheck = true;
+
+  meta = with stdenv.lib; {
+    homepage = http://www.splint.org/;
+    description = "Annotation-assisted lightweight static analyzer for C";
+
+    longDescription = ''
+      Splint is a tool for statically checking C programs for security
+      vulnerabilities and coding mistakes.  With minimal effort, Splint
+      can be used as a better lint.  If additional effort is invested
+      adding annotations to programs, Splint can perform stronger
+      checking than can be done by any standard lint.
+    '';
+
+    license = licenses.gpl2Plus;
+    platforms = platforms.unix;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/splint/tmpdir.patch b/nixpkgs/pkgs/development/tools/analysis/splint/tmpdir.patch
new file mode 100644
index 000000000000..01402ce943bc
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/splint/tmpdir.patch
@@ -0,0 +1,16 @@
+Have Splint honor $TMPDIR.
+
+--- splint-3.1.2/src/context.c	2004-07-31 21:04:26.000000000 +0200
++++ splint-3.1.2/src/context.c	2008-07-11 10:55:16.000000000 +0200
+@@ -801,7 +801,10 @@ context_resetAllFlags (void) 
+                 val = cstring_makeLiteral (env != NULL ? env : DEFAULT_TMPDIR);
+ 	      }
+ # else
+-	      val = cstring_makeLiteral (DEFAULT_TMPDIR);
++	      {
++		char *env = getenv ("TMPDIR");
++		val = cstring_makeLiteral (env != NULL ? env : DEFAULT_TMPDIR);
++	      }
+ # endif /* !defined(OS2) && !defined(MSDOS) */
+ 
+ 	      break;
diff --git a/nixpkgs/pkgs/development/tools/analysis/swarm/default.nix b/nixpkgs/pkgs/development/tools/analysis/swarm/default.nix
new file mode 100644
index 000000000000..922a73a4be09
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/swarm/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation {
+  name = "swarm-2019-03-11";
+
+  src = fetchFromGitHub {
+    owner = "nimble-code";
+    repo = "swarm";
+    rev = "4b36ed83c8fbb074f2dc5777fe1c0ab4d73cc7d9";
+    sha256 = "18zwlwsiiksivjpg6agmbmg0zsw2fl9475ss66b6pgcsya2q4afs";
+  };
+
+  installPhase = ''
+    install -Dm755 Src/swarm $out/bin/swarm
+    install -Dm644 Doc/swarm.1 $out/share/man/man1/swarm.1
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Verification script generator for Spin";
+    homepage = http://spinroot.com/;
+    license = licenses.free;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ abbradar ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/tflint/default.nix b/nixpkgs/pkgs/development/tools/analysis/tflint/default.nix
new file mode 100644
index 000000000000..8c47a8bc0697
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/tflint/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "tflint";
+  version = "0.11.1";
+
+  src = fetchFromGitHub {
+    owner = "wata727";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0aw39xv6jpnhy201gp9jhz6cbz47k7qgxgcwsffak8janbk6bj2a";
+  };
+
+  modSha256 = "1facqppgpmmz2j7j77fa3mnjv2nzjxz4ya6xvyvyy92ma0ybclgh";
+
+  subPackages = [ "." ];
+
+  meta = with lib; {
+    description = "Terraform linter focused on possible errors, best practices, and so on";
+    homepage = "https://github.com/wata727/tflint";
+    license = licenses.mpl20;
+    maintainers = [ maintainers.marsam ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/uefi-firmware-parser/default.nix b/nixpkgs/pkgs/development/tools/analysis/uefi-firmware-parser/default.nix
new file mode 100644
index 000000000000..0ad042d74def
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/uefi-firmware-parser/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, python3, fetchFromGitHub }:
+
+with python3.pkgs;
+
+buildPythonApplication rec {
+  pname = "uefi-firmware-parser";
+  version = "1.8";
+
+  # Version 1.8 is not published on pypi
+  src = fetchFromGitHub {
+    owner = "theopolis";
+    repo = "uefi-firmware-parser";
+    rev = "v${version}";
+    sha256 = "1yn9vi91j1yxkn0icdnjhgl0qrqqkzyhccj39af4f19q1gdw995l";
+  };
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/theopolis/uefi-firmware-parser/";
+    description = "Parse BIOS/Intel ME/UEFI firmware related structures: Volumes, FileSystems, Files, etc";
+    # MIT + license headers in some files
+    license = with licenses; [
+      mit
+      zlib         # uefi_firmware/me.py
+      bsd2         # uefi_firmware/compression/Tiano/**/*
+      publicDomain # uefi_firmware/compression/LZMA/SDK/C/*
+    ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
+    maintainers = [ maintainers.samueldr ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/valgrind/coregrind-makefile-race.patch b/nixpkgs/pkgs/development/tools/analysis/valgrind/coregrind-makefile-race.patch
new file mode 100644
index 000000000000..cd09f0edff37
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/valgrind/coregrind-makefile-race.patch
@@ -0,0 +1,41 @@
+From 7820fc268fae4353118b6355f1d4b9e1b7eeebec Mon Sep 17 00:00:00 2001
+From: Philippe Waroquiers <philippe.waroquiers@skynet.be>
+Date: Sun, 28 Oct 2018 18:35:11 +0100
+Subject: [PATCH 1/1] Fix dependencies between libcoregrind*.a and
+ *m_main.o/*m_libcsetjmp.o
+
+The primary and secondary coregrind libraries must be updated
+when m_main.c or m_libcsetjmp.c are changed.
+
+A dependency was missing between libcoregrind*.a and libnolto_coregrind*.a,
+and so tools were not relinked when m_main.c or m_libcsetjmp.c were
+changed.
+---
+ coregrind/Makefile.am | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/coregrind/Makefile.am b/coregrind/Makefile.am
+index 914a270..8de1996 100644
+--- a/coregrind/Makefile.am
++++ b/coregrind/Makefile.am
+@@ -511,6 +511,8 @@ libcoregrind_@VGCONF_ARCH_PRI@_@VGCONF_OS@_a_CFLAGS += \
+ endif
+ libcoregrind_@VGCONF_ARCH_PRI@_@VGCONF_OS@_a_LIBADD = \
+     $(libnolto_coregrind_@VGCONF_ARCH_PRI@_@VGCONF_OS@_a_OBJECTS)
++libcoregrind_@VGCONF_ARCH_PRI@_@VGCONF_OS@_a_DEPENDENCIES = \
++    libnolto_coregrind-@VGCONF_ARCH_PRI@-@VGCONF_OS@.a
+ 
+ if VGCONF_HAVE_PLATFORM_SEC
+ libcoregrind_@VGCONF_ARCH_SEC@_@VGCONF_OS@_a_SOURCES = \
+@@ -531,6 +533,8 @@ libcoregrind_@VGCONF_ARCH_SEC@_@VGCONF_OS@_a_CFLAGS += \
+ endif
+ libcoregrind_@VGCONF_ARCH_SEC@_@VGCONF_OS@_a_LIBADD = \
+     $(libnolto_coregrind_@VGCONF_ARCH_SEC@_@VGCONF_OS@_a_OBJECTS)
++libcoregrind_@VGCONF_ARCH_SEC@_@VGCONF_OS@_a_DEPENDENCIES = \
++    libnolto_coregrind-@VGCONF_ARCH_SEC@-@VGCONF_OS@.a
+ endif
+ 
+ #----------------------------------------------------------------------------
+-- 
+2.9.3
+
diff --git a/nixpkgs/pkgs/development/tools/analysis/valgrind/default.nix b/nixpkgs/pkgs/development/tools/analysis/valgrind/default.nix
new file mode 100644
index 000000000000..c362ae5734cb
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/valgrind/default.nix
@@ -0,0 +1,92 @@
+{ stdenv, fetchurl, perl, gdb, cctools, xnu, bootstrap_cmds }:
+
+stdenv.mkDerivation rec {
+  name = "valgrind-3.15.0";
+
+  src = fetchurl {
+    url = "https://sourceware.org/pub/valgrind/${name}.tar.bz2";
+    sha256 = "1ccawxrni8brcvwhygy12iprkvz409hbr9xkk1bd03gnm2fplz21";
+  };
+
+  # Perl is needed for `cg_annotate'.
+  nativeBuildInputs = [ perl ];
+
+  outputs = [ "out" "dev" "man" "doc" ];
+
+  hardeningDisable = [ "stackprotector" ];
+
+  # GDB is needed to provide a sane default for `--db-command'.
+  buildInputs = [ gdb ]  ++ stdenv.lib.optionals (stdenv.isDarwin) [ bootstrap_cmds xnu ];
+
+  enableParallelBuilding = true;
+  separateDebugInfo = stdenv.isLinux;
+
+  preConfigure = stdenv.lib.optionalString stdenv.isDarwin (
+    let OSRELEASE = ''
+      $(awk -F '"' '/#define OSRELEASE/{ print $2 }' \
+      <${xnu}/Library/Frameworks/Kernel.framework/Headers/libkern/version.h)'';
+    in ''
+      echo "Don't derive our xnu version using uname -r."
+      substituteInPlace configure --replace "uname -r" "echo ${OSRELEASE}"
+
+      # Apple's GCC doesn't recognize `-arch' (as of version 4.2.1, build 5666).
+      echo "getting rid of the \`-arch' GCC option..."
+      find -name Makefile\* -exec \
+        sed -i {} -e's/DARWIN\(.*\)-arch [^ ]\+/DARWIN\1/g' \;
+
+      sed -i coregrind/link_tool_exe_darwin.in \
+          -e 's/^my \$archstr = .*/my $archstr = "x86_64";/g'
+
+      echo "substitute hardcoded /usr/include/mach with ${xnu}/include/mach"
+      substituteInPlace coregrind/Makefile.in \
+         --replace /usr/include/mach ${xnu}/include/mach
+
+      substituteInPlace coregrind/m_debuginfo/readmacho.c \
+         --replace /usr/bin/dsymutil ${stdenv.cc.bintools.bintools}/bin/dsymutil
+
+      echo "substitute hardcoded /usr/bin/ld with ${cctools}/bin/ld"
+      substituteInPlace coregrind/link_tool_exe_darwin.in \
+        --replace /usr/bin/ld ${cctools}/bin/ld
+    '');
+
+  # To prevent rebuild on linux when moving darwin's postPatch fixes to preConfigure
+  postPatch = "";
+
+  configureFlags =
+    stdenv.lib.optional (stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "x86_64-darwin") "--enable-only64bit";
+
+  doCheck = false; # fails
+
+  postInstall = ''
+    for i in $out/lib/valgrind/*.supp; do
+      substituteInPlace $i \
+        --replace 'obj:/lib' 'obj:*/lib' \
+        --replace 'obj:/usr/X11R6/lib' 'obj:*/lib' \
+        --replace 'obj:/usr/lib' 'obj:*/lib'
+    done
+  '';
+
+  meta = {
+    homepage = http://www.valgrind.org/;
+    description = "Debugging and profiling tool suite";
+
+    longDescription = ''
+      Valgrind is an award-winning instrumentation framework for
+      building dynamic analysis tools.  There are Valgrind tools that
+      can automatically detect many memory management and threading
+      bugs, and profile your programs in detail.  You can also use
+      Valgrind to build new tools.
+    '';
+
+    license = stdenv.lib.licenses.gpl2Plus;
+
+    maintainers = [ stdenv.lib.maintainers.eelco ];
+    platforms = stdenv.lib.platforms.unix;
+    badPlatforms = [
+      "armv5tel-linux" "armv6l-linux" "armv6m-linux"
+      "sparc-linux" "sparc64-linux"
+      "riscv32-linux" "riscv64-linux"
+      "alpha-linux"
+    ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/valkyrie/default.nix b/nixpkgs/pkgs/development/tools/analysis/valkyrie/default.nix
new file mode 100644
index 000000000000..1ecdd9f32ce5
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/valkyrie/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, fetchurl, qt4, qmake4Hook }:
+
+stdenv.mkDerivation rec {
+  name = "valkyrie-2.0.0";
+
+  src = fetchurl {
+    url = "http://valgrind.org/downloads/${name}.tar.bz2";
+    sha256 = "0hwvsncf62mdkahwj9c8hpmm94c1wr5jn89370k6rj894kxry2x7";
+  };
+
+  patchPhase = ''
+    sed -i '1s;^;#include <unistd.h>\n;' src/objects/tool_object.cpp
+    sed -i '1s;^;#include <unistd.h>\n;' src/utils/vk_config.cpp
+    sed -i '1s;^;#include <sys/types.h>\n;' src/utils/vk_config.cpp
+    sed -i '1s;^;#include <unistd.h>\n;' src/utils/vk_utils.cpp
+    sed -i '1s;^;#include <sys/types.h>\n;' src/utils/vk_utils.cpp
+  '';
+
+  buildInputs = [ qt4 ];
+
+  nativeBuildInputs = [ qmake4Hook ];
+
+  meta = with stdenv.lib; {
+    homepage = http://www.valgrind.org/;
+    description = "Qt4-based GUI for the Valgrind 3.6.x series";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ pSub ];
+  };
+}