Cobra Interactive Static Code Analyzer

about papers manpages downloads

Version V2.4 of Cobra, full version with Rule Libraries (Oct. 2017)

An unlimited one-year license to the Cobra tool is available for $36 for Linux (64-bit), Mac/OS-X (64bit), or Cygwin/Windows (32-bit).

When you've placed your order we'll prepare the executable and you will receive an email with download instructions for the tool and rule libraries, typically within a few hours. Please make sure you provide a reliable email address where you can be contacted with this information.


  • choose a directory where you want to install the tool, and place the tar-file there. below this is referred to as directory $COBRA
  • untarring the archive creates these subdirectories and files:
       $ tar -xzf cobra_*.tar.gz
       drwxrwxr-x 2 gh gh 4096 May 16 12:59 bin
       drwxrwxr-x 2 gh gh 4096 May 15 10:03 doc
       drwxrwxr-x 8 gh gh 4096 May 12 15:55 rules
       -rwxrwxr-x 1 gh gh  555 May 16 12:43
  • execute the installation script (this will also try to install a manual page, hence the sudo for linux):
       $ sudo sh
    the installation creates a ~/.cobra file, which cobra reads on startup to find predefined queries
  • add $COBRA/cobra/bin to your search path (where the cobra executables live)

Basic Usage

  • cd to the directory with the source files you want to work on, and start cobra. Try a pattern search, for instance for empty if-statements:
       $ cobra -pattern 'if ( .* ) ;' *.[ch]
    Or try some predefined checks:
       $ cobra -terse -f basic *.[ch]
    or for more detail, and with preprocessing enabled:
       $ cobra -cpp -f basic *.[ch]
    add C preprocessor directives on the command-line as needed
  • some of predefined checks:
      $ cobra -terse -f stats     *.[ch]
      $ cobra -terse -f metrics   *.[ch]
      $ cobra -terse -f misra1997 *.[ch]
      $ cobra -terse -f basic     *.[ch]
    for a list:
      $ cobra -lib
    for all command-line options:
      $ cobra --
    or check the online manual pages, which also give details on writing inline cobra programs
  • for interactive use, type for instance:
       $ cobra -cpp *.[ch]
       4 cores, 14 files, 93623 tokens
       :           # << the cobra command prompt
       :           # << type your queries here
       : q         # << quit


  • report problems and bug reports: gholzmann [atsign] acm [dot] org