about summary refs log tree commit diff
path: root/nixpkgs/pkgs/development/tools/analysis
diff options
context:
space:
mode:
Diffstat (limited to 'nixpkgs/pkgs/development/tools/analysis')
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/autoflake/default.nix24
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/brakeman/default.nix17
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/cccc/cccc.patch24
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/cccc/default.nix37
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/checkstyle/default.nix37
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/clang-analyzer/0001-Fix-scan-build-to-use-NIX_CFLAGS_COMPILE.patch33
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/clang-analyzer/default.nix36
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/coan/default.nix33
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/cov-build/default.nix48
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/cppcheck/default.nix39
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/cpplint/default.nix29
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/egypt/default.nix32
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/emma/default.nix24
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/eresi/default.nix60
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/findbugs/default.nix44
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/flow/default.nix29
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/frama-c/default.nix92
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/frama-c/dynamic.diff12
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilegen/default.nix32
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilegen/gcc7.patch13
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilesim/default.nix28
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/hopper/default.nix44
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/hotspot/default.nix64
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/ikos/default.nix36
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/include-what-you-use/default.nix39
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/jdepend/default.nix35
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/kcov/default.nix38
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/lcov/default.nix36
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/makefile2graph/default.nix32
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/massif-visualizer/default.nix30
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/panopticon/default.nix52
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/pev/default.nix24
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/pmd/default.nix26
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/qcachegrind/default.nix40
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/radare2/cutter.nix54
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/radare2/default.nix133
-rwxr-xr-xnixpkgs/pkgs/development/tools/analysis/radare2/update.py141
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/randoop/default.nix28
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/retdec/default.nix235
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/retdec/yaracpp.nix49
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/rr/default.nix60
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/smatch/default.nix35
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/snowman/default.nix33
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/sparse/default.nix26
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/spin/default.nix46
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/splint/darwin.patch13
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/splint/default.nix32
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/splint/tmpdir.patch16
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/swarm/default.nix30
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/valgrind/coregrind-makefile-race.patch41
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/valgrind/default.nix95
-rw-r--r--nixpkgs/pkgs/development/tools/analysis/valkyrie/default.nix30
52 files changed, 2316 insertions, 0 deletions
diff --git a/nixpkgs/pkgs/development/tools/analysis/autoflake/default.nix b/nixpkgs/pkgs/development/tools/analysis/autoflake/default.nix
new file mode 100644
index 000000000000..c30c3555100a
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/autoflake/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, python3Packages }:
+
+with python3Packages;
+buildPythonApplication rec {
+  pname = "autoflake";
+  version = "1.2";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "c103e63466f11db3617167a2c68ff6a0cda35b940222920631c6eeec6b67e807";
+  };
+
+  propagatedBuildInputs = [ pyflakes ];
+
+  doCheck = true;
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/myint/autoflake;
+    description = "A simple program which removes unused imports and unused variables as reported by pyflakes";
+    license = licenses.mit;
+    maintainers = with maintainers; [ yuriaisaka ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/brakeman/default.nix b/nixpkgs/pkgs/development/tools/analysis/brakeman/default.nix
new file mode 100644
index 000000000000..90eeffd58da1
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/brakeman/default.nix
@@ -0,0 +1,17 @@
+{ lib, ruby, buildRubyGem }:
+
+buildRubyGem rec {
+  inherit ruby;
+  name = "${gemName}-${version}";
+  gemName = "brakeman";
+  version = "4.5.0";
+  source.sha256 = "0c11i01yw87fssmwbybaqf5rdxsjp44hvxdw54c3iqb8fvj76b68";
+
+  meta = with lib; {
+    description = "Static analysis security scanner for Ruby on Rails";
+    homepage = https://brakemanscanner.org/;
+    license = [ licenses.cc-by-nc-sa-40 licenses.mit ];
+    platforms = ruby.meta.platforms;
+    maintainers = [ maintainers.marsam ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/cccc/cccc.patch b/nixpkgs/pkgs/development/tools/analysis/cccc/cccc.patch
new file mode 100644
index 000000000000..9454e3b18ad1
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/cccc/cccc.patch
@@ -0,0 +1,24 @@
+diff --git a/cccc/cccc_tbl.cc b/cccc/cccc_tbl.cc
+index df98e2b..59f2572 100644
+--- a/cccc/cccc_tbl.cc
++++ b/cccc/cccc_tbl.cc
+@@ -96,7 +96,7 @@ bool CCCC_Table<T>::remove(T* old_item_ptr)
+   typename map_t::iterator value_iterator=map_t::find(old_item_ptr->key());
+   if(value_iterator!=map_t::end())
+     {
+-      erase(value_iterator);
++      map_t::erase(value_iterator);
+       retval=true;
+     }
+   return retval;
+diff --git a/makefile b/makefile
+index 23ad004..2cca469 100644
+--- a/makefile
++++ b/makefile
+@@ -20,5 +20,5 @@ test :
+ 	cd test ; make -f posix.mak
+ 
+ install : 
+-	cd install ; su root -c "make -f install.mak" 
++	cd install ; make -f install.mak
+ 
diff --git a/nixpkgs/pkgs/development/tools/analysis/cccc/default.nix b/nixpkgs/pkgs/development/tools/analysis/cccc/default.nix
new file mode 100644
index 000000000000..a46d7f9d9536
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/cccc/default.nix
@@ -0,0 +1,37 @@
+{ stdenv, fetchurl }:
+
+let
+  name = "cccc";
+  version = "3.1.4";
+in
+stdenv.mkDerivation {
+  name = "${name}-${version}";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/${name}/${version}/${name}-${version}.tar.gz";
+    sha256 = "1gsdzzisrk95kajs3gfxks3bjvfd9g680fin6a9pjrism2lyrcr7";
+  };
+
+  hardeningDisable = [ "format" ];
+
+  patches = [ ./cccc.patch ];
+
+  preConfigure = ''
+    substituteInPlace install/install.mak --replace /usr/local/bin $out/bin
+    substituteInPlace install/install.mak --replace MKDIR=mkdir "MKDIR=mkdir -p"
+  '';
+  buildFlags = [ "CCC=c++" "LD=c++" ];
+
+  meta = {
+    description = "C and C++ Code Counter";
+    longDescription = ''
+      CCCC is a tool which analyzes C++ and Java files and generates a report
+      on various metrics of the code. Metrics supported include lines of code, McCabe's
+      complexity and metrics proposed by Chidamber&Kemerer and Henry&Kafura.
+    '';
+    homepage = http://cccc.sourceforge.net/;
+    license = stdenv.lib.licenses.gpl2;
+    platforms = stdenv.lib.platforms.unix;
+    maintainers = [ stdenv.lib.maintainers.linquize ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/checkstyle/default.nix b/nixpkgs/pkgs/development/tools/analysis/checkstyle/default.nix
new file mode 100644
index 000000000000..604e44cf7b14
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/checkstyle/default.nix
@@ -0,0 +1,37 @@
+{ stdenv, fetchurl, makeWrapper, jre }:
+
+stdenv.mkDerivation rec {
+  version = "8.18";
+  name = "checkstyle-${version}";
+
+  src = fetchurl {
+    url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-${version}/checkstyle-${version}-all.jar";
+    sha256 = "1l9dqihl73yi3k27j2a1k87gqzs64z0mpwxj6w68ipvxf4rg63x5";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
+
+  unpackPhase = ":";
+
+  installPhase = ''
+    runHook preInstall
+    install -D $src $out/checkstyle/checkstyle-all.jar
+    makeWrapper ${jre}/bin/java $out/bin/checkstyle \
+      --add-flags "-jar $out/checkstyle/checkstyle-all.jar"
+    runHook postInstall
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Checks Java source against a coding standard";
+    longDescription = ''
+      checkstyle is a development tool to help programmers write Java code that
+      adheres to a coding standard. By default it supports the Sun Code
+      Conventions, but is highly configurable.
+    '';
+    homepage = http://checkstyle.sourceforge.net/;
+    license = licenses.lgpl21;
+    maintainers = with maintainers; [ pSub ];
+    platforms = with platforms; linux;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/clang-analyzer/0001-Fix-scan-build-to-use-NIX_CFLAGS_COMPILE.patch b/nixpkgs/pkgs/development/tools/analysis/clang-analyzer/0001-Fix-scan-build-to-use-NIX_CFLAGS_COMPILE.patch
new file mode 100644
index 000000000000..bcb3ac1d146a
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/clang-analyzer/0001-Fix-scan-build-to-use-NIX_CFLAGS_COMPILE.patch
@@ -0,0 +1,33 @@
+From 6ab08bc1c889e4fb9a39432b1a654eaa19ee65eb Mon Sep 17 00:00:00 2001
+From: Austin Seipp <aseipp@pobox.com>
+Date: Fri, 2 May 2014 12:28:23 -0500
+Subject: [PATCH] Fix scan-build to use NIX_CFLAGS_COMPILE
+
+Signed-off-by: Austin Seipp <aseipp@pobox.com>
+---
+ tools/scan-build/ccc-analyzer | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/tools/scan-build/ccc-analyzer b/tools/scan-build/ccc-analyzer
+index b463ec0..9d39dd0 100755
+--- a/tools/scan-build/ccc-analyzer
++++ b/tools/scan-build/ccc-analyzer
+@@ -207,6 +207,15 @@ sub Analyze {
+       push @Args, "-Xclang", "-analyzer-viz-egraph-ubigraph";
+     }
+ 
++
++    # Add Nix flags to analysis
++    if (defined $ENV{'NIX_CFLAGS_COMPILE'}) {
++      my @nixArgs = split(/\s+/, $ENV{'NIX_CFLAGS_COMPILE'});
++      foreach my $nixArg (@nixArgs) {
++        push @Args, $nixArg;
++      }
++    }
++
+     my $AnalysisArgs = GetCCArgs("--analyze", \@Args);
+     @CmdArgs = @$AnalysisArgs;
+   }
+-- 
+1.8.3.2
+
diff --git a/nixpkgs/pkgs/development/tools/analysis/clang-analyzer/default.nix b/nixpkgs/pkgs/development/tools/analysis/clang-analyzer/default.nix
new file mode 100644
index 000000000000..2e01e4d8f28e
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/clang-analyzer/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, fetchurl, clang, llvmPackages, perl, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  name    = "clang-analyzer-${version}";
+  version = "3.4";
+
+  src = fetchurl {
+    url    = "http://llvm.org/releases/${version}/clang-${version}.src.tar.gz";
+    sha256 = "06rb4j1ifbznl3gfhl98s7ilj0ns01p7y7zap4p7ynmqnc6pia92";
+  };
+
+  patches = [ ./0001-Fix-scan-build-to-use-NIX_CFLAGS_COMPILE.patch ];
+  buildInputs = [ clang llvmPackages.clang perl makeWrapper ];
+
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/bin $out/libexec
+    cp -R tools/scan-view  $out/libexec
+    cp -R tools/scan-build $out/libexec
+
+    makeWrapper $out/libexec/scan-view/scan-view $out/bin/scan-view
+    makeWrapper $out/libexec/scan-build/scan-build $out/bin/scan-build \
+      --add-flags "--use-cc=${clang}/bin/clang" \
+      --add-flags "--use-c++=${clang}/bin/clang++" \
+      --add-flags "--use-analyzer='${llvmPackages.clang}/bin/clang'"
+  '';
+
+  meta = {
+    description = "Clang Static Analyzer";
+    homepage    = "http://clang-analyzer.llvm.org";
+    license     = stdenv.lib.licenses.bsd3;
+    platforms   = stdenv.lib.platforms.unix;
+    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/coan/default.nix b/nixpkgs/pkgs/development/tools/analysis/coan/default.nix
new file mode 100644
index 000000000000..2b4a87ffcb8d
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/coan/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, fetchurl, perl }:
+
+stdenv.mkDerivation rec {
+  version = "6.0.1";
+  name = "coan-${version}";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/project/coan2/v${version}/${name}.tar.gz";
+    sha256 = "1d041j0nd1hc0562lbj269dydjm4rbzagdgzdnmwdxr98544yw44";
+  };
+
+  nativeBuildInputs = [ perl ];
+
+  enableParallelBuilding = true;
+
+  postInstall = ''
+    mv -v $out/share/man/man1/coan.1.{1,gz}
+  '';
+
+  meta = with stdenv.lib; {
+    description = "The C preprocessor chainsaw";
+    longDescription = ''
+      A software engineering tool for analysing preprocessor-based
+      configurations of C or C++ source code. Its principal use is to simplify
+      a body of source code by eliminating any parts that are redundant with
+      respect to a specified configuration. Dead code removal is an
+      application of this sort.
+    '';
+    homepage = http://coan2.sourceforge.net/;
+    license = licenses.bsd3;
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/cov-build/default.nix b/nixpkgs/pkgs/development/tools/analysis/cov-build/default.nix
new file mode 100644
index 000000000000..bd0a4ee5e40a
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/cov-build/default.nix
@@ -0,0 +1,48 @@
+{ stdenv, requireFile }:
+
+let
+  message = ''
+    Register an account at https://scan.coverity.com, download the
+    build tools, and add it to the nix store with nix-prefetch-url
+  '';
+in
+stdenv.mkDerivation rec {
+  name    = "cov-build-${version}";
+  version = "7.0.2";
+
+  src =
+    if stdenv.hostPlatform.system == "i686-linux"
+    then requireFile {
+      name = "cov-analysis-linux32-${version}.tar.gz";
+      sha256 = "0i06wbd7blgx9adh9w09by4i18vwmldfp9ix97a5dph2cjymsviy";
+      inherit message;
+    }
+    else requireFile {
+      name = "cov-analysis-linux64-${version}.tar.gz";
+      sha256 = "0iby75p0g8gv7b501xav47milr8m9781h0hcgm1ch6x3qj6irqd8";
+      inherit message;
+    };
+
+  dontStrip = true;
+  buildPhase = false;
+  installPhase = ''
+    mkdir -p $out/bin $out/libexec
+    mv * $out/libexec
+    for x in cov-build cov-capture cov-configure cov-emit cov-emit-java \
+      cov-export-cva cov-extract-scm cov-help cov-import-scm cov-link \
+      cov-internal-clang cov-internal-emit-clang cov-internal-nm \
+      cov-internal-emit-java-bytecode cov-internal-reduce cov-translate \
+      cov-preprocess cov-internal-pid-to-db cov-manage-emit \
+      cov-manage-history; do
+        ln -s $out/libexec/bin/$x $out/bin/$x;
+    done
+  '';
+
+  meta = {
+    description = "Coverity Scan build tools";
+    homepage    = "https://scan.coverity.com";
+    license     = stdenv.lib.licenses.unfreeRedistributable;
+    platforms   = stdenv.lib.platforms.linux;
+    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/cppcheck/default.nix b/nixpkgs/pkgs/development/tools/analysis/cppcheck/default.nix
new file mode 100644
index 000000000000..f228cf7774c1
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/cppcheck/default.nix
@@ -0,0 +1,39 @@
+{ stdenv, fetchurl, libxslt, docbook_xsl, docbook_xml_dtd_45, pcre }:
+
+stdenv.mkDerivation rec {
+  pname = "cppcheck";
+  version = "1.87";
+  name = "${pname}-${version}";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/${pname}/${name}.tar.bz2";
+    sha256 = "1jl1qlr8la1rix1ffcvl6s4arv2n9fvx85sl4zgp29428xks9c73";
+  };
+
+  buildInputs = [ pcre ];
+  nativeBuildInputs = [ libxslt docbook_xsl docbook_xml_dtd_45 ];
+
+  makeFlags = ''PREFIX=$(out) CFGDIR=$(out)/cfg HAVE_RULES=yes'';
+
+  outputs = [ "out" "man" ];
+
+  enableParallelBuilding = true;
+
+  postInstall = ''
+    make DB2MAN=${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl man
+    mkdir -p $man/share/man/man1
+    cp cppcheck.1 $man/share/man/man1/cppcheck.1
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A static analysis tool for C/C++ code";
+    longDescription = ''
+      Check C/C++ code for memory leaks, mismatching allocation-deallocation,
+      buffer overruns and more.
+    '';
+    homepage = http://cppcheck.sourceforge.net/;
+    license = licenses.gpl3Plus;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ joachifm ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/cpplint/default.nix b/nixpkgs/pkgs/development/tools/analysis/cpplint/default.nix
new file mode 100644
index 000000000000..10ed99e3ffe6
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/cpplint/default.nix
@@ -0,0 +1,29 @@
+{ lib, pythonPackages, fetchFromGitHub }:
+
+pythonPackages.buildPythonApplication rec {
+  pname = "cpplint";
+  version = "1.3.0";
+
+  # Fetch from github instead of pypi, since the test cases are not in the pypi archive
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = version;
+    sha256 = "107v7bp35kxbv9v7wl79h7115z1m4b48rhasp0cnivql1grd277i";
+  };
+
+  postPatch = ''
+    patchShebangs cpplint_unittest.py
+  '';
+
+  checkPhase = ''
+    ./cpplint_unittest.py
+  '';
+
+  meta = with lib; {
+    homepage = https://github.com/cpplint/cpplint;
+    description = "Static code checker for C++";
+    maintainers = [ maintainers.bhipple ];
+    license = [ licenses.bsd3 ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/egypt/default.nix b/nixpkgs/pkgs/development/tools/analysis/egypt/default.nix
new file mode 100644
index 000000000000..7db46005f453
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/egypt/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, fetchurl, perlPackages }:
+
+perlPackages.buildPerlPackage rec {
+  name = "egypt-${version}";
+  version = "1.10";
+
+  src = fetchurl {
+    sha256 = "0r0wj6v8z9fzlh9pb5617kyjdf92ppmlbzajaarrq729bbb6ln5m";
+    url = "https://www.gson.org/egypt/download/${name}.tar.gz";
+  };
+
+  outputs = [ "out" ];
+
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
+  meta = with stdenv.lib; {
+    description = "Tool for making call graphs of C programmes";
+    longDescription = ''
+      Egypt is a simple tool for creating call graphs of C programs. It neither
+      analyzes source code nor lays out graphs. Instead, it leaves the source
+      code analysis to GCC and the graph layout to Graphviz, both of which are
+      better at their respective jobs than egypt itself could ever hope to be.
+      Egypt is simply a very small Perl script that glues these existing tools
+      together.
+    '';
+    homepage = http://www.gson.org/egypt/;
+    license = with licenses; [ artistic1 gpl1Plus ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/emma/default.nix b/nixpkgs/pkgs/development/tools/analysis/emma/default.nix
new file mode 100644
index 000000000000..1bd24b4785d0
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/emma/default.nix
@@ -0,0 +1,24 @@
+{stdenv, fetchurl, unzip}:
+
+stdenv.mkDerivation {
+  name = "emma-2.0.5312";
+  
+  src = fetchurl {
+    url = mirror://sourceforge/emma/emma-2.0.5312.zip;
+    sha256 = "0xxy39s2lvgs56vicjzpcz936l1vjaplliwa0dm7v3iyvw6jn7vj";
+  };
+
+  buildInputs = [unzip];
+
+  installPhase = ''
+    mkdir -p $out/lib/jars
+    cp lib/*.jar $out/lib/jars/
+  '';
+
+  meta = {
+    homepage = http://emma.sourceforge.net/;
+    description = "A code coverage tool for Java";
+    platforms = stdenv.lib.platforms.unix;
+    license = stdenv.lib.licenses.cpl10;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/eresi/default.nix b/nixpkgs/pkgs/development/tools/analysis/eresi/default.nix
new file mode 100644
index 000000000000..00c020e3f404
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/eresi/default.nix
@@ -0,0 +1,60 @@
+{ stdenv, lib, fetchFromGitHub, which, openssl, readline }:
+
+stdenv.mkDerivation rec {
+  name = "eresi-${version}";
+  version = "0.83-a3-phoenix";
+
+  src = fetchFromGitHub {
+    owner = "thorkill";
+    repo = "eresi";
+    rev = version;
+    sha256 = "0a5a7mh2zw9lcdrl8n1mqccrc0xcgj7743l7l4kslkh722fxv625";
+  };
+
+  postPatch = ''
+    # Two occurences of fprintf() with only two arguments, which should really
+    # be fputs().
+    #
+    # Upstream pull request: https://github.com/thorkill/eresi/pull/162
+    #
+    sed -i -e 's/fprintf(\(stderr\), *\([a-z0-9]\+\))/fputs(\2, \1)/g' \
+      libe2dbg/common/common.c libe2dbg/user/threads.c
+
+    # We need to patch out a few ifs here, because it tries to create a series
+    # of configuration files in ~/.something. However, our builds are sandboxed
+    # and also don't contain a valid home, so let's NOP it out :-)
+    #
+    # The second fix we need to make is that we need to pretend being Gentoo
+    # because otherwise the build process tries to link against libtermcap,
+    # which I think is solely for historic reasons (nowadays Terminfo should
+    # have largely superseded it).
+    sed -i -e '/^if \[ ! -e/c if false; then' \
+           -e 's/^GENTOO=.*/GENTOO=1/' configure
+  '';
+
+  configureFlags = [
+    (if stdenv.is64bit then "--enable-32-64" else "--enable-32")
+    "--enable-readline"
+  ];
+
+  # The configure script is not generated by autoconf but is hand-rolled, so it
+  # has --enable-static but no --disabled-static and also doesn't support the
+  # equals sign in --prefix.
+  prefixKey = "--prefix ";
+  dontDisableStatic = true;
+
+  nativeBuildInputs = [ which ];
+  buildInputs = [ openssl readline ];
+  enableParallelBuilding = true;
+
+  installTargets = lib.singleton "install"
+                ++ lib.optional stdenv.is64bit "install64";
+
+  meta = {
+    description = "The ERESI Reverse Engineering Software Interface";
+    license = lib.licenses.gpl2;
+    homepage = http://www.eresi-project.org/;
+    maintainers = [ lib.maintainers.aszlig ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/findbugs/default.nix b/nixpkgs/pkgs/development/tools/analysis/findbugs/default.nix
new file mode 100644
index 000000000000..7f2df62008f0
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/findbugs/default.nix
@@ -0,0 +1,44 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "findbugs-3.0.1";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/findbugs/${name}.tar.gz";
+    sha256 = "06b46fz4nid7qvm36r66zw01fr87y4jyz21ixw27b8hkqah0s3p8";
+  };
+
+  buildPhase = ''
+    substituteInPlace bin/findbugs --replace /bin/pwd pwd
+  '';
+
+  installPhase = ''
+    d=$out/libexec/findbugs
+    mkdir -p $d $out/bin $out/nix-support
+
+    cp -prd bin lib plugin doc $d/
+    rm $d/bin/*.bat
+    for i in $d/bin/*; do
+      if [ -f $i ]; then ln -s $i $out/bin/; fi
+    done
+
+    # Get rid of unnecessary JARs.
+    rm $d/lib/ant.jar
+
+    # Make some JARs findable.
+    mkdir -p $out/share/java
+    ln -s $d/lib/{findbugs.jar,findbugs-ant.jar} $out/share/java/
+
+    cat <<EOF > $out/nix-support/setup-hook
+    export FINDBUGS_HOME=$d
+    EOF
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A static analysis tool to find bugs in Java programs automatically";
+    homepage = http://findbugs.sourceforge.net/;
+    maintainers = with maintainers; [ pSub ];
+    platforms = with platforms; unix;
+    license = licenses.lgpl3;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/flow/default.nix b/nixpkgs/pkgs/development/tools/analysis/flow/default.nix
new file mode 100644
index 000000000000..9759bb532c8d
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/flow/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub, ocamlPackages, cf-private, CoreServices }:
+
+stdenv.mkDerivation rec {
+  pname = "flow";
+  version = "0.96.0";
+
+  src = fetchFromGitHub {
+    owner  = "facebook";
+    repo   = "flow";
+    rev    = "refs/tags/v${version}";
+    sha256 = "04al9jnaxgh8la6s2pzzpzm6pyfc5c6g7pc8cwz4xcngbsw60cpn";
+  };
+
+  installPhase = ''
+    install -Dm755 bin/flow $out/bin/flow
+    install -Dm644 resources/shell/bash-completion $out/share/bash-completion/completions/flow
+  '';
+
+  buildInputs = (with ocamlPackages; [ ocaml findlib ocamlbuild dtoa core_kernel sedlex ocaml_lwt lwt_log lwt_ppx ppx_deriving ppx_gen_rec ppx_tools_versioned visitors wtf8 ])
+    ++ stdenv.lib.optionals stdenv.isDarwin [ cf-private CoreServices ];
+
+  meta = with stdenv.lib; {
+    description = "A static type checker for JavaScript";
+    homepage = https://flow.org/;
+    license = licenses.mit;
+    platforms = ocamlPackages.ocaml.meta.platforms;
+    maintainers = with maintainers; [ puffnfresh globin ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/frama-c/default.nix b/nixpkgs/pkgs/development/tools/analysis/frama-c/default.nix
new file mode 100644
index 000000000000..29a190220944
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/frama-c/default.nix
@@ -0,0 +1,92 @@
+{ stdenv, fetchurl, makeWrapper, ncurses, ocamlPackages, graphviz
+, ltl2ba, coq, why3, autoconf
+}:
+
+let
+  mkocamlpath = p: "${p}/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib";
+  ocamlpath = "${mkocamlpath ocamlPackages.apron}:${mkocamlpath ocamlPackages.mlgmpidl}";
+in
+
+stdenv.mkDerivation rec {
+  name    = "frama-c-${version}";
+  version = "18.0";
+  slang   = "Argon";
+
+  src = fetchurl {
+    url    = "http://frama-c.com/download/frama-c-${version}-${slang}.tar.gz";
+    sha256 = "0a88k2mhafj7pz3dzgsqkrc9digkxpnvr9jqq9nbzwq8qr02bca2";
+  };
+
+  why2 = fetchurl {
+    url    = "http://why.lri.fr/download/why-2.40.tar.gz";
+    sha256 = "0h1mbpxsgwvf3pbl0qbg22j6f4v1ffka24ap1ajbjk9b1yb3ali8";
+  };
+
+  nativeBuildInputs = [ autoconf makeWrapper ];
+
+  buildInputs = with ocamlPackages; [
+    ncurses ocaml findlib ltl2ba ocamlgraph
+    lablgtk coq graphviz zarith why3 apron
+  ];
+
+
+  # Experimentally, the build segfaults with high core counts
+  enableParallelBuilding = false;
+
+  unpackPhase = ''
+    tar xf $src
+    tar xf $why2
+  '';
+
+  buildPhase = ''
+    cd frama*
+    ./configure --prefix=$out
+    # It is not parallel safe
+    make
+    make install
+    cd ../why*
+    FRAMAC=$out/bin/frama-c ./configure --prefix=$out
+    make
+    make install
+    for p in $out/bin/frama-c{,-gui};
+    do
+      wrapProgram $p --prefix OCAMLPATH ':' ${ocamlpath}
+    done
+  '';
+
+  # Enter frama-c directory before patching
+  prePatch = ''cd frama*'';
+  patches = [ ./dynamic.diff ];
+  postPatch = ''
+    # strip absolute paths to /usr/bin
+    for file in ./configure ./share/Makefile.common ./src/*/configure; do #*/
+      substituteInPlace $file  --replace '/usr/bin/' ""
+    done
+
+    substituteInPlace ./src/plugins/aorai/aorai_register.ml --replace '"ltl2ba' '"${ltl2ba}/bin/ltl2ba'
+
+    cd ../why*
+
+    substituteInPlace ./Makefile.in --replace '-warn-error A' '-warn-error A-3'    
+    substituteInPlace ./frama-c-plugin/Makefile --replace 'shell frama-c' "shell $out/bin/frama-c"
+    substituteInPlace ./jc/jc_make.ml --replace ' why-dp '       " $out/bin/why-dp "
+    substituteInPlace ./jc/jc_make.ml --replace "?= why@\n"      "?= $out/bin/why@\n"
+    substituteInPlace ./jc/jc_make.ml --replace ' gwhy-bin@'     " $out/bin/gwhy-bin@"
+    substituteInPlace ./jc/jc_make.ml --replace ' why3 '         " ${why3}/bin/why3 "
+    substituteInPlace ./jc/jc_make.ml --replace ' why3ide '      " ${why3}/bin/why3ide "
+    substituteInPlace ./jc/jc_make.ml --replace ' why3replayer ' " ${why3}/bin/why3replayer "
+    substituteInPlace ./jc/jc_make.ml --replace ' why3ml '       " ${why3}/bin/why3ml "
+    substituteInPlace ./jc/jc_make.ml --replace ' coqdep@'       " ${coq}/bin/coqdep@"
+    substituteInPlace ./jc/jc_make.ml --replace 'coqc'           " ${coq}/bin/coqc"
+    substituteInPlace ./frama-c-plugin/register.ml --replace ' jessie ' " $out/bin/jessie "
+    cd ..
+  '';
+
+  meta = {
+    description = "An extensible and collaborative platform dedicated to source-code analysis of C software";
+    homepage    = http://frama-c.com/;
+    license     = stdenv.lib.licenses.lgpl21;
+    maintainers = with stdenv.lib.maintainers; [ thoughtpolice amiddelk ];
+    platforms   = stdenv.lib.platforms.unix;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/frama-c/dynamic.diff b/nixpkgs/pkgs/development/tools/analysis/frama-c/dynamic.diff
new file mode 100644
index 000000000000..737cad0cda4f
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/frama-c/dynamic.diff
@@ -0,0 +1,12 @@
+--- a/src/kernel_services/plugin_entry_points/dynamic.ml	2016-05-30 16:15:22.000000000 +0200
++++ b/src/kernel_services/plugin_entry_points/dynamic.ml	2016-10-13 18:25:31.000000000 +0200
+@@ -270,7 +270,8 @@
+   load_path :=
+     List.fold_right (add_dir ~user:true) path
+       (List.fold_right (add_dir ~user:false) Config.plugin_dir []);
+-  let findlib_path = String.concat ":" !load_path in
++  let findlib_path = String.concat ":" (!load_path @
++    try [Sys.getenv "OCAMLPATH"] with Not_found -> []) in
+   Klog.debug ~dkey "setting findlib path to %s" findlib_path;
+   Findlib.init ~env_ocamlpath:findlib_path ()
+ 
diff --git a/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilegen/default.nix b/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilegen/default.nix
new file mode 100644
index 000000000000..f96f7e9b66bd
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilegen/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, fetchFromGitHub, cmake }:
+
+stdenv.mkDerivation rec {
+
+  name = "tracefilegen-2017-05-13";
+
+  src = fetchFromGitHub {
+    owner = "GarCoSim";
+    repo = "TraceFileGen";
+    rev = "0ebfd1fdb54079d4bdeaa81fc9267ecb9f016d60";
+    sha256 = "1gsx18ksgz5gwl3v62vgrmhxc0wc99i74qwhpn0h57zllk41drjc";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  patches = [ ./gcc7.patch ];
+
+  installPhase = ''
+    install -Dm755 TraceFileGen $out/bin/TraceFileGen
+    mkdir -p $out/share/doc/${name}/
+    cp -ar $src/Documentation/html $out/share/doc/${name}/.
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Automatically generate all types of basic memory management operations and write into trace files";
+    homepage = https://github.com/GarCoSim;
+    maintainers = [ maintainers.cmcdragonkai ];
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+  };
+
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilegen/gcc7.patch b/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilegen/gcc7.patch
new file mode 100644
index 000000000000..48301bbf61ad
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilegen/gcc7.patch
@@ -0,0 +1,13 @@
+diff --git a/Utils/Logger.cpp b/Utils/Logger.cpp
+index 747cd63..e3efdf1 100644
+--- a/Utils/Logger.cpp
++++ b/Utils/Logger.cpp
+@@ -29,7 +29,7 @@ Logger::Logger(char* tracepath) {
+ 	trace = fopen(tracepath, "w");

+ 

+ 	// dot file is not used, set null as default value

+-	dot = '\0';

++	dot = nullptr;

+ 	//dot = fopen("gcKons.dot", "w");

+ 	//fprintf(dot,"digraph G {\n");

+ }

diff --git a/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilesim/default.nix b/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilesim/default.nix
new file mode 100644
index 000000000000..557fa8384746
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilesim/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, fetchgit }:
+
+stdenv.mkDerivation {
+
+  name = "tracefilesim-2015-11-07";
+
+  src = fetchgit {
+    url = "https://github.com/GarCoSim/TraceFileSim.git";
+    rev = "368aa6b1d6560e7ecbd16fca47000c8f528f3da2";
+    sha256 = "156m92k38ap4bzidbr8dzl065rni8lrib71ih88myk9z5y1x5nxm";
+  };
+
+  hardeningDisable = [ "fortify" ];
+
+  installPhase = ''
+    mkdir --parents "$out/bin"
+    cp ./traceFileSim "$out/bin"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Ease the analysis of existing memory management techniques, as well as the prototyping of new memory management techniques.";
+    homepage = https://github.com/GarCoSim;
+    maintainers = [ maintainers.cmcdragonkai ];
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+  };
+
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/hopper/default.nix b/nixpkgs/pkgs/development/tools/analysis/hopper/default.nix
new file mode 100644
index 000000000000..7158ea38c04d
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/hopper/default.nix
@@ -0,0 +1,44 @@
+{ stdenv, fetchurl, pkgs, makeWrapper, lib }:
+
+stdenv.mkDerivation rec {
+  pname    = "hopper";
+  version = "4.5.7";
+  rev = "v${lib.versions.major version}";
+
+  src = fetchurl {
+    url = "https://d2ap6ypl1xbe4k.cloudfront.net/Hopper-${rev}-${version}-Linux.pkg.tar.xz";
+    sha256 = "1ce7a0f13126a940398aa8da4a74e250dff0401074f30446a8840ac3dbb902c0";
+  };
+
+  sourceRoot = ".";
+
+  ldLibraryPath = with pkgs; stdenv.lib.makeLibraryPath  [
+libbsd.out libffi.out gmpxx.out python27Full.out python27Packages.libxml2 qt5.qtbase zlib  xlibs.libX11.out xorg_sys_opengl.out xlibs.libXrender.out gcc-unwrapped.lib
+  ];
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+     mkdir -p $out/bin
+     mkdir -p $out/lib
+     mkdir -p $out/share
+     cp $sourceRoot/opt/hopper-${rev}/bin/Hopper $out/bin/hopper
+     cp -r $sourceRoot/opt/hopper-${rev}/lib $out
+     cp -r $sourceRoot/usr/share $out/share
+    patchelf \
+    --set-interpreter ${stdenv.glibc}/lib/ld-linux-x86-64.so.2 \
+    $out/bin/hopper
+    # Details: https://nixos.wiki/wiki/Qt
+     wrapProgram $out/bin/hopper \
+    --suffix LD_LIBRARY_PATH : ${ldLibraryPath} \
+    --suffix QT_PLUGIN_PATH : ${pkgs.qt5.qtbase}/lib/qt-${pkgs.qt5.qtbase.qtCompatVersion}/plugins
+  '';
+
+  meta = {
+    homepage = "https://www.hopperapp.com/index.html";
+    description = "A macOS and Linux Disassembler";
+    license = stdenv.lib.licenses.unfree;
+    maintainers = [ stdenv.lib.maintainers.luis ];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/hotspot/default.nix b/nixpkgs/pkgs/development/tools/analysis/hotspot/default.nix
new file mode 100644
index 000000000000..6544046b16d2
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/hotspot/default.nix
@@ -0,0 +1,64 @@
+{ stdenv,
+  cmake,
+  elfutils,
+  extra-cmake-modules,
+  fetchFromGitHub,
+  kconfigwidgets,
+  ki18n,
+  kitemmodels,
+  kitemviews,
+  libelf,
+  qtbase,
+  threadweaver,
+}:
+
+stdenv.mkDerivation rec {
+  name = "hotspot-${version}";
+  version = "1.0.0"; # don't forget to bump `rev` below when you change this
+
+  src = fetchFromGitHub {
+    owner = "KDAB";
+    repo = "hotspot";
+    # TODO: For some reason, `fetchSubmodules` doesn't work when using `rev = "v${version}";`,
+    #       so using an explicit commit instead. See #15559
+    rev = "352687bf620529e9887616651f123f922cb421a4";
+    sha256 = "09ly15yafpk31p3w7h2xixf1xdmx803w9fyb2aq7mhmc7pcxqjsx";
+    fetchSubmodules = true;
+  };
+
+  buildInputs = [
+    cmake
+    elfutils
+    extra-cmake-modules
+    kconfigwidgets
+    ki18n
+    kitemmodels
+    kitemviews
+    libelf
+    qtbase
+    threadweaver
+  ];
+
+  # hotspot checks for the presence of third party libraries'
+  # git directory to give a nice warning when you forgot to clone
+  # submodules; but Nix clones them and removes .git (for reproducibility).
+  # So we need to fake their existence here.
+  postPatch = ''
+    mkdir -p 3rdparty/perfparser/.git
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = {
+    description = "A GUI for Linux perf";
+    longDescription = ''
+      hotspot is a GUI replacement for `perf report`.
+      It takes a perf.data file, parses and evaluates its contents and
+      then displays the result in a graphical way.
+    '';
+    homepage = https://github.com/KDAB/hotspot;
+    license = with stdenv.lib.licenses; [ gpl2 gpl3 ];
+    platforms = stdenv.lib.platforms.linux;
+    maintainers = with stdenv.lib.maintainers; [ nh2 ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/ikos/default.nix b/nixpkgs/pkgs/development/tools/analysis/ikos/default.nix
new file mode 100644
index 000000000000..6f3df32f3c04
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/ikos/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, lib, fetchFromGitHub, cmake, boost
+, gmp, llvm, clang, sqlite, python3
+, ocamlPackages, mpfr, ppl, doxygen, graphviz
+}:
+
+let
+  python = python3.withPackages (ps: with ps; [
+    pygments
+  ]);
+in
+
+stdenv.mkDerivation rec {
+  name = "ikos";
+  version = "2.1";
+
+  src = fetchFromGitHub {
+    owner = "NASA-SW-VnV";
+    repo = name;
+    rev = "v${version}";
+    sha256 = "09nf47hpk5w5az4c0hcr5hhwvpz8zg1byyg185542cpzbq1xj8cb";
+  };
+
+  buildInputs = [ cmake boost gmp clang llvm sqlite python
+                  ocamlPackages.apron mpfr ppl doxygen graphviz ];
+
+  cmakeFlags = "-DAPRON_ROOT=${ocamlPackages.apron}";
+
+  postBuild = "make doc";
+
+  meta = with lib; {
+    homepage = https://github.com/NASA-SW-VnV/ikos;
+    description = "Static analyzer for C/C++ based on the theory of Abstract Interpretation";
+    license = licenses.nasa13;
+    maintainers = with maintainers; [ atnnn ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/include-what-you-use/default.nix b/nixpkgs/pkgs/development/tools/analysis/include-what-you-use/default.nix
new file mode 100644
index 000000000000..4222f72248a8
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/include-what-you-use/default.nix
@@ -0,0 +1,39 @@
+{ stdenv, fetchurl, cmake, llvmPackages, python2 }:
+
+stdenv.mkDerivation rec {
+  name = "include-what-you-use-${version}";
+  # Also bump llvmPackages in all-packages.nix to the supported version!
+  version = "0.10";
+
+  src = fetchurl {
+    sha256 = "16alan9rwbhpyfxmlpc7gbfnbqd877wdqrkvgqrjb1jlqkzpg55s";
+    url = "${meta.homepage}/downloads/${name}.src.tar.gz";
+  };
+
+  buildInputs = with llvmPackages; [ clang-unwrapped llvm python2 ];
+  nativeBuildInputs = [ cmake ];
+
+  cmakeFlags = [ "-DIWYU_LLVM_ROOT_PATH=${llvmPackages.clang-unwrapped}" ];
+
+  enableParallelBuilding = true;
+
+  postInstall = ''
+    substituteInPlace $out/bin/iwyu_tool.py \
+      --replace "['include-what-you-use']" "['$out/bin/include-what-you-use']"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Analyze #includes in C/C++ source files with clang";
+    longDescription = ''
+      For every symbol (type, function variable, or macro) that you use in
+      foo.cc, either foo.cc or foo.h should #include a .h file that exports the
+      declaration of that symbol.  The main goal of include-what-you-use is to
+      remove superfluous #includes, both by figuring out what #includes are not
+      actually needed for this file (for both .cc and .h files), and by
+      replacing #includes with forward-declares when possible.
+    '';
+    homepage = https://include-what-you-use.org;
+    license = licenses.bsd3;
+    platforms = platforms.unix;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/jdepend/default.nix b/nixpkgs/pkgs/development/tools/analysis/jdepend/default.nix
new file mode 100644
index 000000000000..939ae10c089d
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/jdepend/default.nix
@@ -0,0 +1,35 @@
+{ stdenv, fetchFromGitHub, ant, jdk, runtimeShell }:
+
+stdenv.mkDerivation rec {
+  name = "jdepend-${version}";
+  version = "2.9.1";
+
+  src = fetchFromGitHub {
+    owner = "clarkware";
+    repo = "jdepend";
+    rev = version;
+    sha256 = "1sxkgj4k4dhg8vb772pvisyzb8x0gwvlfqqir30ma4zvz3rfz60p";
+  };
+
+  nativeBuildInputs = [ ant jdk ];
+  buildPhase = "ant jar";
+
+  installPhase = ''
+    mkdir -p $out/bin $out/share
+    install dist/${name}.jar $out/share
+
+    cat > "$out/bin/jdepend" <<EOF
+    #!${runtimeShell}
+    exec ${jdk.jre}/bin/java -classpath "$out/share/*" "\$@"
+    EOF
+    chmod a+x $out/bin/jdepend
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Traverses Java class file directories and generates design quality metrics for each Java package";
+    homepage = http://www.clarkware.com/software/JDepend.html;
+    license = licenses.bsd3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ pSub ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/kcov/default.nix b/nixpkgs/pkgs/development/tools/analysis/kcov/default.nix
new file mode 100644
index 000000000000..af20165d155f
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/kcov/default.nix
@@ -0,0 +1,38 @@
+{stdenv, fetchFromGitHub, cmake, pkgconfig, zlib, curl, elfutils, python, libiberty, libopcodes}:
+
+stdenv.mkDerivation rec {
+  name = "kcov-${version}";
+  version = "36";
+
+  src = fetchFromGitHub {
+    owner = "SimonKagstrom";
+    repo = "kcov";
+    rev = "v${version}";
+    sha256 = "1q1mw5mxz041lr6qc2v4280rmx13pg1bx5r3bxz9bzs941r405r3";
+  };
+
+  preConfigure = "patchShebangs src/bin-to-c-source.py";
+  nativeBuildInputs = [ cmake pkgconfig ];
+
+  buildInputs = [ zlib curl elfutils python libiberty libopcodes ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Code coverage tester for compiled programs, Python scripts and shell scripts";
+
+    longDescription = ''
+      Kcov is a code coverage tester for compiled programs, Python
+      scripts and shell scripts. It allows collecting code coverage
+      information from executables without special command-line
+      arguments, and continuosly produces output from long-running
+      applications.
+    '';
+
+    homepage = http://simonkagstrom.github.io/kcov/index.html;
+    license = licenses.gpl2;
+
+    maintainers = with maintainers; [ gal_bolle ekleog ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/lcov/default.nix b/nixpkgs/pkgs/development/tools/analysis/lcov/default.nix
new file mode 100644
index 000000000000..06c712588f8f
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/lcov/default.nix
@@ -0,0 +1,36 @@
+{stdenv, fetchurl, perl}:
+
+stdenv.mkDerivation rec {
+  name = "lcov-1.14";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/ltp/${name}.tar.gz";
+    sha256 = "06h7ixyznf6vz1qvksjgy5f3q2nw9akf6zx59npf0h3l32cmd68l";
+  };
+
+  buildInputs = [ perl ];
+
+  preBuild = ''
+    patchShebangs bin/
+    makeFlagsArray=(PREFIX=$out LCOV_PERL_PATH=$(command -v perl))
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Code coverage tool that enhances GNU gcov";
+
+    longDescription =
+      '' LCOV is an extension of GCOV, a GNU tool which provides information
+         about what parts of a program are actually executed (i.e.,
+         "covered") while running a particular test case.  The extension
+         consists of a set of PERL scripts which build on the textual GCOV
+         output to implement the following enhanced functionality such as
+         HTML output.
+      '';
+
+    homepage = http://ltp.sourceforge.net/coverage/lcov.php;
+    license = stdenv.lib.licenses.gpl2Plus;
+
+    maintainers = with maintainers; [ dezgeg ];
+    platforms = platforms.all;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/makefile2graph/default.nix b/nixpkgs/pkgs/development/tools/analysis/makefile2graph/default.nix
new file mode 100644
index 000000000000..7afa71429a75
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/makefile2graph/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, fetchFromGitHub, makeWrapper, bash, gnumake }:
+
+stdenv.mkDerivation rec {
+  name = "makefile2graph-2018-01-03";
+
+  src = fetchFromGitHub {
+    owner = "lindenb";
+    repo = "makefile2graph";
+    rev = "61fb95a5ba91c20236f5e4deb11127c34b47091f";
+    sha256 = "07hq40bl48i8ka35fcciqcafpd8k9rby1wf4vl2p53v0665xaghr";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  makeFlags = [ "prefix=$(out)" ];
+
+  fixupPhase = ''
+    substituteInPlace $out/bin/makefile2graph \
+      --replace '/bin/sh' ${bash}/bin/bash \
+      --replace 'make2graph' "$out/bin/make2graph"
+    wrapProgram $out/bin/makefile2graph \
+      --set PATH ${stdenv.lib.makeBinPath [ gnumake ]}
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/lindenb/makefile2graph";
+    description = "Creates a graph of dependencies from GNU-Make; Output is a graphiz-dot file or a Gexf-XML file";
+    maintainers = with maintainers; [ cmcdragonkai ];
+    license = licenses.mit;
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/massif-visualizer/default.nix b/nixpkgs/pkgs/development/tools/analysis/massif-visualizer/default.nix
new file mode 100644
index 000000000000..a9793e048839
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/massif-visualizer/default.nix
@@ -0,0 +1,30 @@
+{
+  mkDerivation, lib, fetchurl,
+  extra-cmake-modules, shared-mime-info,
+  qtsvg, qtxmlpatterns, karchive, kconfig, kcoreaddons, kparts, kio, ki18n,
+  kdiagram, kgraphviewer
+}:
+
+mkDerivation rec {
+  name = "massif-visualizer-${version}";
+  version = "0.7.0";
+
+  src = fetchurl {
+    url = "mirror://kde/stable/massif-visualizer/${version}/src/${name}.tar.xz";
+    sha256 = "0v8z6r9gngzckvqyxjm9kp7hilwfqibyk2f9vag9l98ar0iwr97q";
+  };
+
+  nativeBuildInputs = [ extra-cmake-modules shared-mime-info ];
+
+  buildInputs = [
+    qtsvg qtxmlpatterns karchive kconfig kcoreaddons kparts kio ki18n
+    kdiagram kgraphviewer
+  ];
+
+  meta = with lib; {
+    description = "Tool that visualizes massif data generated by valgrind";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ lethalman zraexy ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/panopticon/default.nix b/nixpkgs/pkgs/development/tools/analysis/panopticon/default.nix
new file mode 100644
index 000000000000..a50f6993c331
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/panopticon/default.nix
@@ -0,0 +1,52 @@
+{ stdenv, fetchFromGitHub, rustPlatform, qt5, git, cmake
+, pkgconfig, makeWrapper }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "panopticon";
+  version = "unstable-20171202";
+  name = "${pname}-${version}";
+
+  src = fetchFromGitHub {
+    owner = "das-labor";
+    repo = pname;
+    rev = "33ffec0d6d379d51b38d6ea00d040f54b1356ae4";
+    sha256 = "1zv87nqhrzsxx0m891df4vagzssj3kblfv9yp7j96dw0vn9950qa";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ makeWrapper ];
+  propagatedBuildInputs = with qt5; [
+     qt5.qtbase
+     qtdeclarative
+     qtsvg
+     qtquickcontrols2
+     qtgraphicaleffects
+     pkgconfig
+     git
+  ];
+
+  cargoSha256 = "02k21mh0jyc6vz52jx1qijsfk07pkdv1g2hqx7gyvmm4v10vbfna";
+  doCheck = false;
+
+  postInstall = ''
+    mkdir -p $out/share/${pname} $out/bin
+    cp -R qml $out/share/${pname}
+    mv $out/bin/${pname} $out/share/${pname}
+    chmod +x $out/share/${pname}
+    makeWrapper $out/share/${pname}/${pname} $out/bin/${pname}
+     '';
+
+  meta = with stdenv.lib; {
+    description = "A libre cross-platform disassembler";
+    longDescription = ''
+      Panopticon is a cross platform disassembler for reverse
+      engineering written in Rust. It can disassemble AMD64,
+      x86, AVR and MOS 6502 instruction sets and open ELF files.
+      Panopticon comes with Qt GUI for browsing and annotating
+      control flow graphs.
+    '';
+    license = with licenses; [ gpl3 ];
+    maintainers = with maintainers; [ leenaars ];
+    platforms = platforms.all;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/pev/default.nix b/nixpkgs/pkgs/development/tools/analysis/pev/default.nix
new file mode 100644
index 000000000000..8e8f438b5e1a
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/pev/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, openssl, fetchFromGitHub }:
+stdenv.mkDerivation {
+  name = "pev-unstable-2018-07-22";
+  buildInputs = [ openssl ];
+  src = fetchFromGitHub {
+    owner = "merces";
+    repo = "pev";
+    rev = "aa4ef7f"; 
+    sha256 = "00a3g486343lhqcsf4vrdy5xif6v3cgcf2y8yp5b96x15c0wid36"; 
+    fetchSubmodules = true;
+  };
+
+  makeFlags = [ "prefix=$(out)" ];
+  installFlags = [ "prefix=$(out)" ];
+
+  meta = with stdenv.lib; {
+    description = "pev is a full-featured, open source, multiplatform command line toolkit to work with PE (Portable Executables) binaries.";
+    homepage = "http://pev.sourceforge.net/";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.jeschli ];
+  };
+
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/pmd/default.nix b/nixpkgs/pkgs/development/tools/analysis/pmd/default.nix
new file mode 100644
index 000000000000..c08106eea2ff
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/pmd/default.nix
@@ -0,0 +1,26 @@
+{stdenv, fetchurl, unzip}:
+
+stdenv.mkDerivation rec {
+  name = "pmd-${version}";
+  version = "6.12.0";
+
+  buildInputs = [ unzip ];
+
+  src = fetchurl {
+    url = "mirror://sourceforge/pmd/pmd-bin-${version}.zip";
+    sha256 = "1fayb62i6p21q1d6y7ixljf37r7n7vwjwa69q5z6wr4zspaj79f9";
+  };
+
+  installPhase = ''
+    mkdir -p $out
+    cp -R * $out
+  '';
+
+  meta = with stdenv.lib; {
+    description = "An extensible cross-language static code analyzer";
+    homepage = https://pmd.github.io/;
+    platforms = platforms.unix;
+    license = with licenses; [ bsdOriginal asl20 ];
+  };
+}
+
diff --git a/nixpkgs/pkgs/development/tools/analysis/qcachegrind/default.nix b/nixpkgs/pkgs/development/tools/analysis/qcachegrind/default.nix
new file mode 100644
index 000000000000..fb0f7414841c
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/qcachegrind/default.nix
@@ -0,0 +1,40 @@
+{ stdenv, qmake, qtbase, perl, python, php, kcachegrind }:
+
+let
+  name = stdenv.lib.replaceStrings ["kcachegrind"] ["qcachegrind"] kcachegrind.name;
+
+in stdenv.mkDerivation rec {
+  inherit name;
+
+  src = kcachegrind.src;
+
+  buildInputs = [ qtbase perl python php ];
+
+  nativeBuildInputs = [ qmake ];
+
+  postInstall = ''
+     mkdir -p $out/bin
+     cp -p converters/dprof2calltree $out/bin/dprof2calltree
+     cp -p converters/hotshot2calltree.cmake $out/bin/hotshot2calltree
+     cp -p converters/memprof2calltree $out/bin/memprof2calltree
+     cp -p converters/op2calltree $out/bin/op2calltree
+     cp -p converters/pprof2calltree $out/bin/pprof2calltree
+     chmod -R +x $out/bin/
+  '' + (if stdenv.isDarwin then ''
+    mkdir -p $out/Applications
+    cp cgview/cgview.app/Contents/MacOS/cgview $out/bin
+    cp -a qcachegrind/qcachegrind.app $out/Applications
+  '' else ''
+    install qcachegrind/qcachegrind cgview/cgview -t "$out/bin"
+    install -Dm644 qcachegrind/qcachegrind.desktop -t "$out/share/applications"
+    install -Dm644 kcachegrind/32-apps-kcachegrind.png "$out/share/icons/hicolor/32x32/apps/kcachegrind.png"
+    install -Dm644 kcachegrind/48-apps-kcachegrind.png "$out/share/icons/hicolor/48x48/apps/kcachegrind.png"
+  '');
+
+  meta = with stdenv.lib; {
+    description = "A Qt GUI to visualize profiling data";
+    license = licenses.gpl2;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ periklis ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/radare2/cutter.nix b/nixpkgs/pkgs/development/tools/analysis/radare2/cutter.nix
new file mode 100644
index 000000000000..c92cdb19ae28
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/radare2/cutter.nix
@@ -0,0 +1,54 @@
+{ stdenv, fetchFromGitHub
+# nativeBuildInputs
+, qmake, pkgconfig
+# Qt
+, qtbase, qtsvg, qtwebengine
+# buildInputs
+, r2-for-cutter
+, python3 }:
+
+let
+  version = "1.8.0";
+in
+stdenv.mkDerivation rec {
+  name = "radare2-cutter-${version}";
+
+  src = fetchFromGitHub {
+    owner = "radareorg";
+    repo = "cutter";
+    rev = "v${version}";
+    sha256 = "1z3lpzl7k3qn5xabi0qxl83rdbwi00h45blnljx8yfw0am5vfphc";
+  };
+
+  postUnpack = "export sourceRoot=$sourceRoot/src";
+
+  # Remove this "very helpful" helper file intended for discovering r2,
+  # as it's a doozy of harddcoded paths and unexpected behavior.
+  # Happily Nix has everything all set so we don't need it,
+  # other than as basis for the qmakeFlags set below.
+  postPatch = ''
+    substituteInPlace Cutter.pro \
+      --replace "include(lib_radare2.pri)" ""
+  '';
+
+  nativeBuildInputs = [ qmake pkgconfig ];
+  buildInputs = [ qtbase qtsvg qtwebengine r2-for-cutter python3 ];
+
+  qmakeFlags = [
+    "CONFIG+=link_pkgconfig"
+    "PKGCONFIG+=r_core"
+    # Leaving this enabled doesn't break build but generates errors
+    # at runtime (to console) about being unable to load needed bits.
+    # Disable until can be looked at.
+    "CUTTER_ENABLE_JUPYTER=false"
+  ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "A Qt and C++ GUI for radare2 reverse engineering framework";
+    homepage = src.meta.homepage;
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ mic92 dtzWill ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/radare2/default.nix b/nixpkgs/pkgs/development/tools/analysis/radare2/default.nix
new file mode 100644
index 000000000000..9219698b2df0
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/radare2/default.nix
@@ -0,0 +1,133 @@
+{stdenv, fetchFromGitHub
+, buildPackages
+, callPackage
+, pkgconfig
+, libusb, readline, libewf, perl, zlib, openssl
+, libuv, file, libzip, xxHash
+, gtk2 ? null, vte ? null, gtkdialog ? null
+, python3 ? null
+, ruby ? null
+, lua ? null
+, useX11 ? false
+, rubyBindings ? false
+, pythonBindings ? false
+, luaBindings ? false
+}:
+
+assert useX11 -> (gtk2 != null && vte != null && gtkdialog != null);
+assert rubyBindings -> ruby != null;
+assert pythonBindings -> python3 != null;
+
+
+let
+  inherit (stdenv.lib) optional;
+
+  generic = {
+    version_commit,
+    gittap,
+    gittip,
+    rev,
+    version,
+    sha256,
+    cs_ver,
+    cs_sha256
+  }:
+    stdenv.mkDerivation rec {
+      name = "radare2-${version}";
+
+      src = fetchFromGitHub {
+        owner = "radare";
+        repo = "radare2";
+        inherit rev sha256;
+      };
+
+      postPatch = let
+        capstone = fetchFromGitHub {
+          owner = "aquynh";
+          repo = "capstone";
+          # version from $sourceRoot/shlr/Makefile
+          rev = cs_ver;
+          sha256 = cs_sha256;
+        };
+      in ''
+        mkdir -p build/shlr
+        cp -r ${capstone} capstone-${cs_ver}
+        chmod -R +w capstone-${cs_ver}
+        # radare 3.3 compat for radare2-cutter
+        (cd shlr && ln -s ../capstone-${cs_ver} capstone)
+        tar -czvf shlr/capstone-${cs_ver}.tar.gz capstone-${cs_ver}
+        # necessary because they broke the offline-build:
+        # https://github.com/radare/radare2/commit/6290e4ff4cc167e1f2c28ab924e9b99783fb1b38#diff-a44d840c10f1f1feaf401917ae4ccd54R258
+        # https://github.com/radare/radare2/issues/13087#issuecomment-465159716
+        curl() { true; }
+        export -f curl
+      '';
+
+      postInstall = ''
+        install -D -m755 $src/binr/r2pm/r2pm $out/bin/r2pm
+      '';
+
+      WITHOUT_PULL="1";
+      makeFlags = [
+        "GITTAP=${gittap}"
+        "GITTIP=${gittip}"
+        "RANLIB=${stdenv.cc.bintools.bintools}/bin/${stdenv.cc.bintools.targetPrefix}ranlib"
+      ];
+      configureFlags = [
+        "--with-sysmagic"
+        "--with-syszip"
+        "--with-sysxxhash"
+        "--with-openssl"
+      ];
+
+      enableParallelBuilding = true;
+      depsBuildBuild = [ buildPackages.stdenv.cc ];
+
+      nativeBuildInputs = [ pkgconfig ];
+      buildInputs = [ file readline libusb libewf perl zlib openssl libuv ]
+        ++ optional useX11 [ gtkdialog vte gtk2 ]
+        ++ optional rubyBindings [ ruby ]
+        ++ optional pythonBindings [ python3 ]
+        ++ optional luaBindings [ lua ];
+
+      propagatedBuildInputs = [
+        # radare2 exposes r_lib which depends on these libraries
+        file # for its list of magic numbers (`libmagic`)
+        libzip
+        xxHash
+      ];
+
+      meta = {
+        description = "unix-like reverse engineering framework and commandline tools";
+        homepage = http://radare.org/;
+        license = stdenv.lib.licenses.gpl2Plus;
+        maintainers = with stdenv.lib.maintainers; [ raskin makefu mic92 ];
+        platforms = with stdenv.lib.platforms; linux;
+        inherit version;
+      };
+  };
+in {
+  #<generated>
+  # DO NOT EDIT! Automatically generated by ./update.py
+  radare2 = generic {
+    version_commit = "21238";
+    gittap = "3.3.0";
+    gittip = "5a9127d2599c8ff61d8544be7d4c9384402e94a3";
+    rev = "3.3.0";
+    version = "3.3.0";
+    sha256 = "11ap3icr8w0y49lq5dxch2h589qdmwf3qv9lsdyfsz4l0mjm49ri";
+    cs_ver = "4.0.1";
+    cs_sha256 = "0ijwxxk71nr9z91yxw20zfj4bbsbrgvixps5c7cpj163xlzlwba6";
+  };
+  r2-for-cutter = generic {
+    version_commit = "21238";
+    gittap = "3.3.0";
+    gittip = "5a9127d2599c8ff61d8544be7d4c9384402e94a3";
+    rev = "5a9127d2599c8ff61d8544be7d4c9384402e94a3";
+    version = "3.3.0";
+    sha256 = "11ap3icr8w0y49lq5dxch2h589qdmwf3qv9lsdyfsz4l0mjm49ri";
+    cs_ver = "4.0.1";
+    cs_sha256 = "0ijwxxk71nr9z91yxw20zfj4bbsbrgvixps5c7cpj163xlzlwba6";
+  };
+  #</generated>
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/radare2/update.py b/nixpkgs/pkgs/development/tools/analysis/radare2/update.py
new file mode 100755
index 000000000000..794581bca7ad
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/radare2/update.py
@@ -0,0 +1,141 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -p nix -p python3 -p git -i python
+# USAGE - just run the script: ./update.py
+# When editing this file, make also sure it passes the mypy typecheck
+# and is formatted with black.
+import fileinput
+import json
+import re
+import subprocess
+import tempfile
+import urllib.request
+from datetime import datetime
+from pathlib import Path
+from typing import Dict
+
+SCRIPT_DIR = Path(__file__).parent.resolve()
+
+
+def sh(*args: str) -> str:
+    out = subprocess.check_output(list(args))
+    return out.strip().decode("utf-8")
+
+
+def prefetch_github(owner: str, repo: str, ref: str) -> str:
+    return sh(
+        "nix-prefetch-url",
+        "--unpack",
+        f"https://github.com/{owner}/{repo}/archive/{ref}.tar.gz",
+    )
+
+
+def get_radare2_rev() -> str:
+    url = "https://api.github.com/repos/radare/radare2/releases/latest"
+    with urllib.request.urlopen(url) as response:
+        release = json.load(response)  # type: ignore
+    return release["tag_name"]
+
+
+def get_cutter_version() -> str:
+    version_expr = """
+(with import <nixpkgs> {}; (builtins.parseDrvName (qt5.callPackage <radare2/cutter.nix> {}).name).version)
+"""
+    return sh("nix", "eval", "--raw", version_expr.strip(), "-I", "radare2={0}".format(SCRIPT_DIR))
+
+
+def get_r2_cutter_rev() -> str:
+    version = get_cutter_version()
+    url = f"https://api.github.com/repos/radareorg/cutter/contents?ref=v{version}"
+    with urllib.request.urlopen(url) as response:
+        data = json.load(response)  # type: ignore
+    for entry in data:
+        if entry["name"] == "radare2":
+            return entry["sha"]
+    raise Exception("no radare2 submodule found in github.com/radareorg/cutter")
+
+
+def git(dirname: str, *args: str) -> str:
+    return sh("git", "-C", dirname, *args)
+
+
+def get_repo_info(dirname: str, rev: str) -> Dict[str, str]:
+    sha256 = prefetch_github("radare", "radare2", rev)
+
+    cs_ver = None
+    with open(Path(dirname).joinpath("shlr", "Makefile")) as makefile:
+        for l in makefile:
+            match = re.match("CS_VER=(\S+)", l)
+            if match:
+                cs_ver = match.group(1)
+    assert cs_ver is not None
+
+    cs_sha256 = prefetch_github("aquynh", "capstone", cs_ver)
+
+    return dict(
+        rev=rev,
+        sha256=sha256,
+        version_commit=git(dirname, "rev-list", "--all", "--count"),
+        gittap=git(dirname, "describe", "--tags", "--match", "[0-9]*"),
+        gittip=git(dirname, "rev-parse", "HEAD"),
+        cs_ver=cs_ver,
+        cs_sha256=cs_sha256,
+    )
+
+
+def write_package_expr(version: str, info: Dict[str, str]) -> str:
+    return f"""generic {{
+    version_commit = "{info["version_commit"]}";
+    gittap = "{info["gittap"]}";
+    gittip = "{info["gittip"]}";
+    rev = "{info["rev"]}";
+    version = "{version}";
+    sha256 = "{info["sha256"]}";
+    cs_ver = "{info["cs_ver"]}";
+    cs_sha256 = "{info["cs_sha256"]}";
+  }}"""
+
+
+def main() -> None:
+    radare2_rev = get_radare2_rev()
+    r2_cutter_rev = get_r2_cutter_rev()
+
+    with tempfile.TemporaryDirectory() as dirname:
+        git(
+            dirname,
+            "clone",
+            "--branch",
+            radare2_rev,
+            "https://github.com/radare/radare2",
+            ".",
+        )
+        nix_file = str(SCRIPT_DIR.joinpath("default.nix"))
+
+        radare2_info = get_repo_info(dirname, radare2_rev)
+
+        git(dirname, "checkout", r2_cutter_rev)
+
+        timestamp = git(dirname, "log", "-n1", "--format=%at")
+        r2_cutter_version = datetime.fromtimestamp(int(timestamp)).strftime("%Y-%m-%d")
+
+        r2_cutter_info = get_repo_info(dirname, r2_cutter_rev)
+
+        in_block = False
+        with fileinput.FileInput(nix_file, inplace=True) as f:
+            for l in f:
+                if "#<generated>" in l:
+                    in_block = True
+                    print(
+                        f"""  #<generated>
+  # DO NOT EDIT! Automatically generated by ./update.py
+  radare2 = {write_package_expr(radare2_rev, radare2_info)};
+  r2-for-cutter = {write_package_expr(r2_cutter_version, r2_cutter_info)};
+  #</generated>"""
+                    )
+                elif "#</generated>" in l:
+                    in_block = False
+                elif not in_block:
+                    print(l, end="")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/nixpkgs/pkgs/development/tools/analysis/randoop/default.nix b/nixpkgs/pkgs/development/tools/analysis/randoop/default.nix
new file mode 100644
index 000000000000..4fc85c301665
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/randoop/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, fetchurl, unzip }:
+
+stdenv.mkDerivation rec {
+  version = "3.1.5";
+  name = "randoop-${version}";
+
+  src = fetchurl {
+    url = "https://github.com/randoop/randoop/releases/download/v${version}/${name}.zip";
+    sha256 = "13zspyi9fgnqc90qfqqnj0hb7869l0aixv0vwgj8m4m1hggpadlx";
+  };
+
+  buildInputs = [ unzip ];
+
+  installPhase = ''
+    mkdir -p $out/lib $out/doc
+
+    cp -R *.jar $out/lib
+    cp README.txt $out/doc
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Automatic test generation for Java";
+    homepage = https://randoop.github.io/randoop/;
+    license = licenses.mit;
+    maintainers = with maintainers; [ pSub ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/retdec/default.nix b/nixpkgs/pkgs/development/tools/analysis/retdec/default.nix
new file mode 100644
index 000000000000..fec127178f9e
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/retdec/default.nix
@@ -0,0 +1,235 @@
+{ stdenv
+, fetchFromGitHub
+, fetchpatch
+, fetchzip
+, lib
+, callPackage
+, openssl
+, cmake
+, autoconf
+, automake
+, libtool
+, pkgconfig
+, bison
+, flex
+, groff
+, perl
+, python3
+, time
+, upx
+, ncurses
+, libffi
+, libxml2
+, zlib
+, withPEPatterns ? false
+}:
+
+let
+  capstone = fetchFromGitHub {
+    owner = "avast-tl";
+    repo = "capstone";
+    rev = "27c713fe4f6eaf9721785932d850b6291a6073fe";
+    sha256 = "105z1g9q7s6n15qpln9vzhlij7vj6cyc5dqdr05n7wzjvlagwgxc";
+  };
+  elfio = fetchFromGitHub {
+    owner = "avast-tl";
+    repo = "elfio";
+    rev = "998374baace397ea98f3b1d768e81c978b4fba41";
+    sha256 = "09n34rdp0wpm8zy30zx40wkkc4gbv2k3cv181y6c1260rllwk5d1";
+  };
+  keystone = fetchFromGitHub { # only for tests
+    owner = "keystone-engine";
+    repo = "keystone";
+    rev = "d7ba8e378e5284e6384fc9ecd660ed5f6532e922";
+    sha256 = "1yzw3v8xvxh1rysh97y0i8y9svzbglx2zbsqjhrfx18vngh0x58f";
+  };
+  libdwarf = fetchFromGitHub {
+    owner = "avast-tl";
+    repo = "libdwarf";
+    rev = "85465d5e235cc2d2f90d04016d6aca1a452d0e73";
+    sha256 = "11y62r65py8yp57i57a4cymxispimn62by9z4j2g19hngrpsgbki";
+  };
+  llvm = fetchFromGitHub {
+    owner = "avast-tl";
+    repo = "llvm";
+    rev = "725d0cee133c6ab9b95c493f05de3b08016f5c3c";
+    sha256 = "0dzvafmn4qs62w1y9vh0a11clpj6q3hb41aym4izpcyybjndf9bq";
+  };
+  pelib = fetchFromGitHub {
+    owner = "avast-tl";
+    repo = "pelib";
+    rev = "a7004b2e80e4f6dc984f78b821e7b585a586050d";
+    sha256 = "0nyrb3g749lxgcymz1j584xbb1x6rvy1mc700lyn0brznvqsm81n";
+  };
+  rapidjson = fetchFromGitHub {
+    owner = "Tencent";
+    repo = "rapidjson";
+    rev = "v1.1.0";
+    sha256 = "1jixgb8w97l9gdh3inihz7avz7i770gy2j2irvvlyrq3wi41f5ab";
+  };
+  yaracpp = callPackage ./yaracpp.nix {}; # is its own package because it needs a patch
+  yaramod = fetchFromGitHub {
+    owner = "avast-tl";
+    repo = "yaramod";
+    rev = "v2.2.2";
+    sha256 = "0cq9h4h686q9ybamisbl797g6xjy211s3cq83nixkwkigmz48ccp";
+  };
+  jsoncpp = fetchFromGitHub {
+    owner = "open-source-parsers";
+    repo = "jsoncpp";
+    rev = "1.8.4";
+    sha256 = "1z0gj7a6jypkijmpknis04qybs1hkd04d1arr3gy89lnxmp6qzlm";
+  };
+  googletest = fetchFromGitHub { # only for tests
+    owner = "google";
+    repo = "googletest";
+    rev = "83fa0cb17dad47a1d905526dcdddb5b96ed189d2";
+    sha256 = "1c2r0p9v7vz2vasy8bknfb448l6wsvzw35s8hmc5z013z5502mpk";
+  };
+  tinyxml2 = fetchFromGitHub {
+    owner = "leethomason";
+    repo = "tinyxml2";
+    rev = "cc1745b552dd12bb1297a99f82044f83b06729e0";
+    sha256 = "015g8520a0c55gwmv7pfdsgfz2rpdmh3d1nq5n9bd65n35492s3q";
+  };
+
+  retdec-support = let
+    version = "2018-02-08"; # make sure to adjust both hashes (once with withPEPatterns=true and once withPEPatterns=false)
+  in fetchzip {
+    url = "https://github.com/avast-tl/retdec-support/releases/download/${version}/retdec-support_${version}.tar.xz";
+    sha256 = if withPEPatterns then "148i8flbyj1y4kfdyzsz7jsj38k4h97npjxj18h6v4wksd4m4jm7"
+                               else "0ixv9qyqq40pzyqy6v9jf5rxrvivjb0z0zn260nbmb9gk765bacy";
+    stripRoot = false;
+    # Removing PE signatures reduces this from 3.8GB -> 642MB (uncompressed)
+    extraPostFetch = lib.optionalString (!withPEPatterns) ''
+      rm -r "$out/generic/yara_patterns/static-code/pe"
+    '';
+  } // {
+    inherit version; # necessary to check the version against the expected version
+  };
+
+  # patch CMakeLists.txt for a dependency and compare the versions to the ones expected by upstream
+  # this has to be applied for every dependency (which it is in postPatch)
+  patchDep = dep: ''
+    # check if our version of dep is the same version that upstream expects
+    echo "Checking version of ${dep.dep_name}"
+    expected_rev="$( sed -n -e 's|.*URL https://github.com/.*/archive/\(.*\)\.zip.*|\1|p' "deps/${dep.dep_name}/CMakeLists.txt" )"
+    if [ "$expected_rev" != '${dep.rev}' ]; then
+      echo "The ${dep.dep_name} dependency has the wrong version: ${dep.rev} while $expected_rev is expected."
+      exit 1
+    fi
+
+    # patch the CMakeLists.txt file to use our local copy of the dependency instead of fetching it at build time
+    sed -i -e 's|URL .*|URL ${dep}|' "deps/${dep.dep_name}/CMakeLists.txt"
+  '';
+
+in stdenv.mkDerivation rec {
+  name = "retdec-${version}";
+
+  # If you update this you will also need to adjust the versions of the updated dependencies. You can do this by first just updating retdec
+  # itself and trying to build it. The build should fail and tell you which dependencies you have to upgrade to which versions.
+  # I've notified upstream about this problem here:
+  # https://github.com/avast-tl/retdec/issues/412
+  version = "3.2";
+
+  src = fetchFromGitHub {
+    owner = "avast-tl";
+    repo = "retdec";
+    name = "retdec-${version}";
+    rev = "refs/tags/v${version}";
+    sha256 = "0chky656lsddn20bnm3pmz6ix20y4a0y8swwr42hrhi01vkhmzrp";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    autoconf
+    automake
+    libtool
+    pkgconfig
+    bison
+    flex
+    groff
+    perl
+    python3
+  ];
+
+  buildInputs = [
+    openssl
+    ncurses
+    libffi
+    libxml2
+    zlib
+  ];
+
+  cmakeFlags = [
+    "-DRETDEC_TESTS=ON" # build tests
+  ];
+
+  # all dependencies that are normally fetched during build time (the subdirectories of `deps`)
+  # all of these need to be fetched through nix and the CMakeLists files need to be patched not to fetch them themselves
+  external_deps = [
+    (capstone // { dep_name = "capstone"; })
+    (elfio // { dep_name = "elfio"; })
+    (googletest // { dep_name = "googletest"; })
+    (jsoncpp // { dep_name = "jsoncpp"; })
+    (keystone // { dep_name = "keystone"; })
+    (libdwarf // { dep_name = "libdwarf"; })
+    (llvm // { dep_name = "llvm"; })
+    (pelib // { dep_name = "pelib"; })
+    (rapidjson // { dep_name = "rapidjson"; })
+    (tinyxml2 // { dep_name = "tinyxml2"; })
+    (yaracpp // { dep_name = "yaracpp"; })
+    (yaramod // { dep_name = "yaramod"; })
+  ];
+
+  # Use newer yaramod to fix w/bison 3.2+
+  patches = [
+    # 2.1.2 -> 2.2.1
+    (fetchpatch {
+      url = https://github.com/avast-tl/retdec/commit/c9d23da1c6e23c149ed684c6becd3f3828fb4a55.patch;
+      sha256 = "0hdq634f72fihdy10nx2ajbps561w03dfdsy5r35afv9fapla6mv";
+    })
+    # 2.2.1 -> 2.2.2
+    (fetchpatch {
+      url = https://github.com/avast-tl/retdec/commit/fb85f00754b5d13b781385651db557741679721e.patch;
+      sha256 = "0a8mwmwb39pr5ag3q11nv81ncdk51shndqrkm92shqrmdq14va52";
+    })
+  ];
+
+  postPatch = (lib.concatMapStrings patchDep external_deps) + ''
+    # install retdec-support
+    echo "Checking version of retdec-support"
+    expected_version="$( sed -n -e "s|^version = '\(.*\)'$|\1|p" 'cmake/install-share.py' )"
+    if [ "$expected_version" != '${retdec-support.version}' ]; then
+      echo "The retdec-support dependency has the wrong version: ${retdec-support.version} while $expected_version is expected."
+      exit 1
+    fi
+    mkdir -p "$out/share/retdec"
+    cp -r ${retdec-support} "$out/share/retdec/support" # write permission needed during install
+    chmod -R u+w "$out/share/retdec/support"
+    # python file originally responsible for fetching the retdec-support archive to $out/share/retdec
+    # that is not necessary anymore, so empty the file
+    echo > cmake/install-share.py
+
+    # call correct `time` and `upx` programs
+    substituteInPlace scripts/retdec-config.py --replace /usr/bin/time ${time}/bin/time
+    substituteInPlace scripts/retdec-unpacker.py --replace "'upx'" "'${upx}/bin/upx'"
+  '';
+
+  enableParallelBuilding = true;
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    ${python3.interpreter} "$out/bin/retdec-tests-runner.py"
+
+    rm -rf $out/bin/__pycache__
+  '';
+
+  meta = with lib; {
+    description = "A retargetable machine-code decompiler based on LLVM";
+    homepage = https://retdec.com;
+    license = licenses.mit;
+    maintainers = with maintainers; [ dtzWill timokau ];
+    platforms = ["x86_64-linux" "i686-linux"];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/retdec/yaracpp.nix b/nixpkgs/pkgs/development/tools/analysis/retdec/yaracpp.nix
new file mode 100644
index 000000000000..cc857b86145f
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/retdec/yaracpp.nix
@@ -0,0 +1,49 @@
+{ stdenv
+, fetchFromGitHub
+, coreutils
+}:
+
+let
+  yara = fetchFromGitHub {
+    owner = "avast-tl";
+    repo = "yara";
+    rev = "ea101c5856941f39cad2db3012f2660d1d5c8b65";
+    sha256 = "033ssx2hql5k4pv9si043s3mjq2b748ymjzif8pg6rdwh260faky";
+  };
+in stdenv.mkDerivation rec {
+  # only fetches the yaracpp source patched to work with a local yara clone,
+  # does not build anything
+  name = "yaracpp-src-${version}";
+  version = "2018-10-09";
+  rev = "b92bde0e59e3b75bc445227e04b71105771dee8b"; # as specified in retdec/deps/yaracpp/CMakeLists.txt
+
+  src = fetchFromGitHub {
+    inherit rev;
+    owner = "avast-tl";
+    repo = "yaracpp";
+    sha256 = "0fan7q79j7s3bjmhsd2nw6sqyi14xgikn7mr2p4nj87lick5l4a2";
+  };
+
+  postPatch = ''
+      # check if our version of yara is the same version that upstream expects
+      echo "Checking version of yara"
+      expected_rev="$( sed -n -e 's|.*URL https://github.com/.*/archive/\(.*\)\.zip.*|\1|p' "deps/CMakeLists.txt" )"
+      if [ "$expected_rev" != '${yara.rev}' ]; then
+        echo "The yara dependency has the wrong version: ${yara.rev} while $expected_rev is expected."
+        exit 1
+      fi
+
+      # patch the CMakeLists.txt file to use our local copy of the dependency instead of fetching it at build time
+      sed -i -e "s|URL .*|URL ${yara}|" "deps/CMakeLists.txt"
+
+      # abuse the CONFIGURE_COMMAND to make the source writeable after copying it to the build locatoin (necessary for the build)
+      sed -i -e 's|CONFIGURE_COMMAND ""|CONFIGURE_COMMAND COMMAND ${coreutils}/bin/chmod -R u+w .|' "deps/CMakeLists.txt"
+    '';
+
+  buildPhase = "# do nothing";
+  configurePhase = "# do nothing";
+  installPhase = ''
+    mkdir -p "$out"
+    cp -r * "$out"
+  '';
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/rr/default.nix b/nixpkgs/pkgs/development/tools/analysis/rr/default.nix
new file mode 100644
index 000000000000..cd2fb21209c4
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/rr/default.nix
@@ -0,0 +1,60 @@
+{ stdenv, fetchFromGitHub, cmake, libpfm, zlib, pkgconfig, python2Packages, which, procps, gdb, capnproto }:
+
+stdenv.mkDerivation rec {
+  version = "5.2.0";
+  name = "rr-${version}";
+
+  src = fetchFromGitHub {
+    owner = "mozilla";
+    repo = "rr";
+    rev = version;
+    sha256 = "19jsnm8n2smalx2z60x9d8f6g4kdm7zghwyjfvwcxnslk1vn9dkc";
+  };
+
+  postPatch = ''
+    substituteInPlace src/Command.cc --replace '_BSD_SOURCE' '_DEFAULT_SOURCE'
+    sed '7i#include <math.h>' -i src/Scheduler.cc
+    patchShebangs .
+  '';
+
+  # TODO: remove this preConfigure hook after 5.2.0 since it is fixed upstream
+  # see https://github.com/mozilla/rr/issues/2269
+  preConfigure = ''substituteInPlace CMakeLists.txt --replace "std=c++11" "std=c++14"'';
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [
+    cmake libpfm zlib python2Packages.python python2Packages.pexpect which procps gdb capnproto
+  ];
+  cmakeFlags = [
+    "-DCMAKE_C_FLAGS_RELEASE:STRING="
+    "-DCMAKE_CXX_FLAGS_RELEASE:STRING="
+    "-Ddisable32bit=ON"
+  ];
+
+  # we turn on additional warnings due to hardening
+  NIX_CFLAGS_COMPILE = "-Wno-error";
+
+  hardeningDisable = [ "fortify" ];
+
+  enableParallelBuilding = true;
+
+  # FIXME
+  #doCheck = true;
+
+  preCheck = "export HOME=$TMPDIR";
+
+  meta = {
+    homepage = https://rr-project.org/;
+    description = "Records nondeterministic executions and debugs them deterministically";
+    longDescription = ''
+      rr aspires to be your primary debugging tool, replacing -- well,
+      enhancing -- gdb. You record a failure once, then debug the
+      recording, deterministically, as many times as you want. Every
+      time the same execution is replayed.
+    '';
+
+    license = with stdenv.lib.licenses; [ mit bsd2 ];
+    maintainers = with stdenv.lib.maintainers; [ pierron thoughtpolice ];
+    platforms = stdenv.lib.platforms.x86;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/smatch/default.nix b/nixpkgs/pkgs/development/tools/analysis/smatch/default.nix
new file mode 100644
index 000000000000..9dc1e2db8c09
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/smatch/default.nix
@@ -0,0 +1,35 @@
+{ stdenv, fetchgit, sqlite, pkgconfig, perl
+, buildllvmsparse ? true
+, buildc2xml ? true
+, llvm ? null, libxml2 ? null
+}:
+
+assert buildllvmsparse -> llvm != null;
+assert buildc2xml -> libxml2 != null;
+
+stdenv.mkDerivation {
+  name = "smatch-20120924";
+
+  src = fetchgit {
+    url = git://repo.or.cz/smatch.git;
+    rev = "23656e3e578b700cbf96d043f039e6341a3ba5b9";
+    sha256 = "0r43qi6vryqg450fj73yjwbb7gzcgx64rhrhb3r1m6a252srijiy";
+  };
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [sqlite perl]
+   ++ stdenv.lib.optional buildllvmsparse llvm
+   ++ stdenv.lib.optional buildc2xml libxml2;
+
+  preBuild =
+    '' sed -i Makefile \
+           -e "s|^PREFIX=.*|PREFIX = $out|g"
+    '';
+
+  meta = {
+    description = "A semantic analysis tool for C";
+    homepage = http://smatch.sourceforge.net/;
+    license = stdenv.lib.licenses.free; /* OSL, see http://www.opensource.org */
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/snowman/default.nix b/nixpkgs/pkgs/development/tools/analysis/snowman/default.nix
new file mode 100644
index 000000000000..e965acc746cc
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/snowman/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, fetchFromGitHub, cmake, boost, qtbase }:
+
+stdenv.mkDerivation rec {
+  name = "snowman-${version}";
+  version = "0.1.3";
+
+  src = fetchFromGitHub {
+    owner = "yegord";
+    repo = "snowman";
+    rev = "v${version}";
+    sha256 = "1mrmhj2nddi0d47c266vsg5vbapbqbcpj5ld4v1qcwnnk6z2zn0j";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ boost qtbase ];
+
+  postUnpack = ''
+    export sourceRoot=$sourceRoot/src
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Native code to C/C++ decompiler";
+    homepage = "http://derevenets.com/";
+
+    # https://github.com/yegord/snowman/blob/master/doc/licenses.asciidoc
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ dtzWill ];
+    platforms = platforms.all;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/sparse/default.nix b/nixpkgs/pkgs/development/tools/analysis/sparse/default.nix
new file mode 100644
index 000000000000..945f6c80af52
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/sparse/default.nix
@@ -0,0 +1,26 @@
+{ fetchurl, stdenv, pkgconfig, libxml2, llvm }:
+
+stdenv.mkDerivation rec {
+  name = "sparse-0.5.0";
+
+  src = fetchurl {
+    url = "mirror://kernel/software/devel/sparse/dist/${name}.tar.xz";
+    sha256 = "1mc86jc5xdrdmv17nqj2cam2yqygnj6ar1iqkwsx2y37ij8wy7wj";
+  };
+
+  preConfigure = ''
+    sed -i Makefile -e "s|^PREFIX=.*$|PREFIX=$out|g"
+  '';
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libxml2 llvm ];
+  doCheck = true;
+
+  meta = {
+    description = "Semantic parser for C";
+    homepage    = "https://git.kernel.org/cgit/devel/sparse/sparse.git/";
+    license     = stdenv.lib.licenses.mit;
+    platforms   = stdenv.lib.platforms.linux;
+    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/spin/default.nix b/nixpkgs/pkgs/development/tools/analysis/spin/default.nix
new file mode 100644
index 000000000000..fbb7eca0ef51
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/spin/default.nix
@@ -0,0 +1,46 @@
+{ stdenv, lib, fetchurl, makeWrapper, yacc, gcc
+, withISpin ? true, tk, swarm, graphviz }:
+
+let
+  binPath = stdenv.lib.makeBinPath [ gcc ];
+  ibinPath = stdenv.lib.makeBinPath [ gcc tk swarm graphviz tk ];
+
+in stdenv.mkDerivation rec {
+  name = "spin-${version}";
+  version = "6.4.9";
+  url-version = stdenv.lib.replaceChars ["."] [""] version;
+
+  src = fetchurl {
+    # The homepage is behind CloudFlare anti-DDoS protection, which blocks cURL.
+    # Dropbox mirror from developers:
+    # https://www.dropbox.com/sh/fgzipzp4wpo3qc1/AADZPqS4aoR-pjNF6OQXRLQHa
+    # (note that this URL doesn't work aross versions and hash should come from official site)
+    url = "https://www.dropbox.com/sh/fgzipzp4wpo3qc1/AABtxFePMJmPxsxSvU5cpxh8a/spin${url-version}.tar.gz?raw=1";
+    sha256 = "07b7wk3qyfnp4pgwicqd33l7i1krzyihx0cf9zkv81ywaklf5vll";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ yacc ];
+
+  sourceRoot = "Spin/Src${version}";
+
+  installPhase = ''
+    install -Dm644 ../Man/spin.1 $out/share/man/man1/spin.1
+
+    install -Dm755 spin $out/bin/spin
+    wrapProgram $out/bin/spin \
+      --prefix PATH : ${binPath}
+  '' + lib.optionalString withISpin ''
+    install -Dm755 ../iSpin/ispin.tcl $out/bin/ispin
+    wrapProgram $out/bin/ispin \
+      --prefix PATH ':' "$out/bin:${ibinPath}"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Formal verification tool for distributed software systems";
+    homepage = http://spinroot.com/;
+    license = licenses.free;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ pSub ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/splint/darwin.patch b/nixpkgs/pkgs/development/tools/analysis/splint/darwin.patch
new file mode 100644
index 000000000000..8c435707571d
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/splint/darwin.patch
@@ -0,0 +1,13 @@
+diff --git a/src/osd.c b/src/osd.c
+index ebe214a..4ba81d5 100644
+--- a/src/osd.c
++++ b/src/osd.c
+@@ -516,7 +516,7 @@ osd_getPid ()
+ # if defined (WIN32) || defined (OS2) && defined (__IBMC__)
+   int pid = _getpid ();
+ # else
+-  __pid_t pid = getpid ();
++  pid_t pid = getpid ();
+ # endif
+ 
+   return (int) pid;
diff --git a/nixpkgs/pkgs/development/tools/analysis/splint/default.nix b/nixpkgs/pkgs/development/tools/analysis/splint/default.nix
new file mode 100644
index 000000000000..57a83e54d705
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/splint/default.nix
@@ -0,0 +1,32 @@
+{ fetchurl, stdenv, flex }:
+
+stdenv.mkDerivation rec {
+  name = "splint-3.1.2";
+
+  src = fetchurl {
+    url = "http://www.splint.org/downloads/${name}.src.tgz";
+    sha256 = "02pv8kscsrkrzip9r08pfs9xs98q74c52mlxzbii6cv6vx1vd3f7";
+  };
+
+  patches = [ ./tmpdir.patch ] ++ stdenv.lib.optional stdenv.isDarwin ./darwin.patch;
+
+  buildInputs = [ flex ];
+
+  doCheck = true;
+
+  meta = with stdenv.lib; {
+    homepage = http://www.splint.org/;
+    description = "Annotation-assisted lightweight static analyzer for C";
+
+    longDescription = ''
+      Splint is a tool for statically checking C programs for security
+      vulnerabilities and coding mistakes.  With minimal effort, Splint
+      can be used as a better lint.  If additional effort is invested
+      adding annotations to programs, Splint can perform stronger
+      checking than can be done by any standard lint.
+    '';
+
+    license = licenses.gpl2Plus;
+    platforms = platforms.unix;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/splint/tmpdir.patch b/nixpkgs/pkgs/development/tools/analysis/splint/tmpdir.patch
new file mode 100644
index 000000000000..01402ce943bc
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/splint/tmpdir.patch
@@ -0,0 +1,16 @@
+Have Splint honor $TMPDIR.
+
+--- splint-3.1.2/src/context.c	2004-07-31 21:04:26.000000000 +0200
++++ splint-3.1.2/src/context.c	2008-07-11 10:55:16.000000000 +0200
+@@ -801,7 +801,10 @@ context_resetAllFlags (void) 
+                 val = cstring_makeLiteral (env != NULL ? env : DEFAULT_TMPDIR);
+ 	      }
+ # else
+-	      val = cstring_makeLiteral (DEFAULT_TMPDIR);
++	      {
++		char *env = getenv ("TMPDIR");
++		val = cstring_makeLiteral (env != NULL ? env : DEFAULT_TMPDIR);
++	      }
+ # endif /* !defined(OS2) && !defined(MSDOS) */
+ 
+ 	      break;
diff --git a/nixpkgs/pkgs/development/tools/analysis/swarm/default.nix b/nixpkgs/pkgs/development/tools/analysis/swarm/default.nix
new file mode 100644
index 000000000000..a67d9b8d42e8
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/swarm/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "swarm-${version}";
+  version = "3.1";
+
+  src = fetchurl {
+    url = "http://www.spinroot.com/swarm/swarm${version}.tar";
+    sha256 = "12hi6wy0v0jfbrmgfxpnz7vxfzz3g1c6z7dj8p8kc2nm0q5bii47";
+  };
+
+  sourceRoot = ".";
+
+  buildPhase = ''
+    gcc -O2 -lm swarm.c -o swarm
+  '';
+
+  installPhase = ''
+    install -Dm755 swarm $out/bin/swarm
+    install -Dm644 swarm.1 $out/share/man/man1/swarm.1
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Verification script generator for Spin";
+    homepage = http://spinroot.com/;
+    license = licenses.free;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ abbradar ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/valgrind/coregrind-makefile-race.patch b/nixpkgs/pkgs/development/tools/analysis/valgrind/coregrind-makefile-race.patch
new file mode 100644
index 000000000000..cd09f0edff37
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/valgrind/coregrind-makefile-race.patch
@@ -0,0 +1,41 @@
+From 7820fc268fae4353118b6355f1d4b9e1b7eeebec Mon Sep 17 00:00:00 2001
+From: Philippe Waroquiers <philippe.waroquiers@skynet.be>
+Date: Sun, 28 Oct 2018 18:35:11 +0100
+Subject: [PATCH 1/1] Fix dependencies between libcoregrind*.a and
+ *m_main.o/*m_libcsetjmp.o
+
+The primary and secondary coregrind libraries must be updated
+when m_main.c or m_libcsetjmp.c are changed.
+
+A dependency was missing between libcoregrind*.a and libnolto_coregrind*.a,
+and so tools were not relinked when m_main.c or m_libcsetjmp.c were
+changed.
+---
+ coregrind/Makefile.am | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/coregrind/Makefile.am b/coregrind/Makefile.am
+index 914a270..8de1996 100644
+--- a/coregrind/Makefile.am
++++ b/coregrind/Makefile.am
+@@ -511,6 +511,8 @@ libcoregrind_@VGCONF_ARCH_PRI@_@VGCONF_OS@_a_CFLAGS += \
+ endif
+ libcoregrind_@VGCONF_ARCH_PRI@_@VGCONF_OS@_a_LIBADD = \
+     $(libnolto_coregrind_@VGCONF_ARCH_PRI@_@VGCONF_OS@_a_OBJECTS)
++libcoregrind_@VGCONF_ARCH_PRI@_@VGCONF_OS@_a_DEPENDENCIES = \
++    libnolto_coregrind-@VGCONF_ARCH_PRI@-@VGCONF_OS@.a
+ 
+ if VGCONF_HAVE_PLATFORM_SEC
+ libcoregrind_@VGCONF_ARCH_SEC@_@VGCONF_OS@_a_SOURCES = \
+@@ -531,6 +533,8 @@ libcoregrind_@VGCONF_ARCH_SEC@_@VGCONF_OS@_a_CFLAGS += \
+ endif
+ libcoregrind_@VGCONF_ARCH_SEC@_@VGCONF_OS@_a_LIBADD = \
+     $(libnolto_coregrind_@VGCONF_ARCH_SEC@_@VGCONF_OS@_a_OBJECTS)
++libcoregrind_@VGCONF_ARCH_SEC@_@VGCONF_OS@_a_DEPENDENCIES = \
++    libnolto_coregrind-@VGCONF_ARCH_SEC@-@VGCONF_OS@.a
+ endif
+ 
+ #----------------------------------------------------------------------------
+-- 
+2.9.3
+
diff --git a/nixpkgs/pkgs/development/tools/analysis/valgrind/default.nix b/nixpkgs/pkgs/development/tools/analysis/valgrind/default.nix
new file mode 100644
index 000000000000..78f40913eb5f
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/valgrind/default.nix
@@ -0,0 +1,95 @@
+{ stdenv, fetchurl, perl, gdb, llvm, cctools, xnu, bootstrap_cmds, autoreconfHook }:
+
+stdenv.mkDerivation rec {
+  name = "valgrind-3.14.0";
+
+  src = fetchurl {
+    url = "https://sourceware.org/pub/valgrind/${name}.tar.bz2";
+    sha256 = "19ds42jwd89zrsjb94g7gizkkzipn8xik3xykrpcqxylxyzi2z03";
+  };
+
+  # autoreconfHook is needed to pick up patching of Makefile.am
+  # Remove when the patch no longer applies.
+  patches = [ ./coregrind-makefile-race.patch ];
+  # Perl is needed for `cg_annotate'.
+  nativeBuildInputs = [ autoreconfHook perl ];
+
+  outputs = [ "out" "dev" "man" "doc" ];
+
+  hardeningDisable = [ "stackprotector" ];
+
+  # GDB is needed to provide a sane default for `--db-command'.
+  buildInputs = [ gdb ]  ++ stdenv.lib.optionals (stdenv.isDarwin) [ bootstrap_cmds xnu ];
+
+  enableParallelBuilding = true;
+  separateDebugInfo = stdenv.isLinux;
+
+  preConfigure = stdenv.lib.optionalString stdenv.isDarwin (
+    let OSRELEASE = ''
+      $(awk -F '"' '/#define OSRELEASE/{ print $2 }' \
+      <${xnu}/Library/Frameworks/Kernel.framework/Headers/libkern/version.h)'';
+    in ''
+      echo "Don't derive our xnu version using uname -r."
+      substituteInPlace configure --replace "uname -r" "echo ${OSRELEASE}"
+
+      # Apple's GCC doesn't recognize `-arch' (as of version 4.2.1, build 5666).
+      echo "getting rid of the \`-arch' GCC option..."
+      find -name Makefile\* -exec \
+        sed -i {} -e's/DARWIN\(.*\)-arch [^ ]\+/DARWIN\1/g' \;
+
+      sed -i coregrind/link_tool_exe_darwin.in \
+          -e 's/^my \$archstr = .*/my $archstr = "x86_64";/g'
+
+      echo "substitute hardcoded /usr/include/mach with ${xnu}/include/mach"
+      substituteInPlace coregrind/Makefile.in \
+         --replace /usr/include/mach ${xnu}/include/mach
+
+      echo "substitute hardcoded dsymutil with ${llvm}/bin/llvm-dsymutil"
+      find -name "Makefile.in" | while read file; do
+         substituteInPlace "$file" \
+           --replace dsymutil ${llvm}/bin/llvm-dsymutil
+      done
+
+      substituteInPlace coregrind/m_debuginfo/readmacho.c \
+         --replace /usr/bin/dsymutil ${llvm}/bin/llvm-dsymutil
+
+      echo "substitute hardcoded /usr/bin/ld with ${cctools}/bin/ld"
+      substituteInPlace coregrind/link_tool_exe_darwin.in \
+        --replace /usr/bin/ld ${cctools}/bin/ld
+    '');
+
+  # To prevent rebuild on linux when moving darwin's postPatch fixes to preConfigure
+  postPatch = "";
+
+  configureFlags =
+    stdenv.lib.optional (stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "x86_64-darwin") "--enable-only64bit";
+
+  doCheck = false; # fails
+
+  postInstall = ''
+    for i in $out/lib/valgrind/*.supp; do
+      substituteInPlace $i \
+        --replace 'obj:/lib' 'obj:*/lib' \
+        --replace 'obj:/usr/X11R6/lib' 'obj:*/lib' \
+        --replace 'obj:/usr/lib' 'obj:*/lib'
+    done
+  '';
+
+  meta = {
+    homepage = http://www.valgrind.org/;
+    description = "Debugging and profiling tool suite";
+
+    longDescription = ''
+      Valgrind is an award-winning instrumentation framework for
+      building dynamic analysis tools.  There are Valgrind tools that
+      can automatically detect many memory management and threading
+      bugs, and profile your programs in detail.  You can also use
+      Valgrind to build new tools.
+    '';
+
+    license = stdenv.lib.licenses.gpl2Plus;
+
+    maintainers = [ stdenv.lib.maintainers.eelco ];
+    platforms = stdenv.lib.platforms.unix;
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/valkyrie/default.nix b/nixpkgs/pkgs/development/tools/analysis/valkyrie/default.nix
new file mode 100644
index 000000000000..1ecdd9f32ce5
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/valkyrie/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, fetchurl, qt4, qmake4Hook }:
+
+stdenv.mkDerivation rec {
+  name = "valkyrie-2.0.0";
+
+  src = fetchurl {
+    url = "http://valgrind.org/downloads/${name}.tar.bz2";
+    sha256 = "0hwvsncf62mdkahwj9c8hpmm94c1wr5jn89370k6rj894kxry2x7";
+  };
+
+  patchPhase = ''
+    sed -i '1s;^;#include <unistd.h>\n;' src/objects/tool_object.cpp
+    sed -i '1s;^;#include <unistd.h>\n;' src/utils/vk_config.cpp
+    sed -i '1s;^;#include <sys/types.h>\n;' src/utils/vk_config.cpp
+    sed -i '1s;^;#include <unistd.h>\n;' src/utils/vk_utils.cpp
+    sed -i '1s;^;#include <sys/types.h>\n;' src/utils/vk_utils.cpp
+  '';
+
+  buildInputs = [ qt4 ];
+
+  nativeBuildInputs = [ qmake4Hook ];
+
+  meta = with stdenv.lib; {
+    homepage = http://www.valgrind.org/;
+    description = "Qt4-based GUI for the Valgrind 3.6.x series";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ pSub ];
+  };
+}