Black Duck Coverity vs boofuzz

Black Duck Coverity is a paid static analysis solution for finding security vulnerabilities and code quality defects in source code before software ships. It analyzes code without executing it, scanning across files and libraries in entire codebases. Black Duck lists support for 22 programming languages and more than 250 frameworks, along with standards including MISRA, AUTOSAR, ISO 26262, PCI DSS, CERT C/C++/Java, DISA STIG, OWASP Top 10, and CWE Top 25. Coverity is TÜV SÜD certified for IEC 61508-3 support-tool requirements and qualified for use up to ASIL D under ISO 26262 and Level A under DO-178C. The Code Sight IDE plug-in offers real-time results, issue summaries, and code fixes. IDE, SCM, and CI integrations can trigger scans on commits and pull requests; listed connections include GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins, and others. Deployment can be fully air-gapped on premises, including Kubernetes clusters. Pricing is customized to team size and codebase and supplied by quote.

boofuzz is a network protocol fuzzing framework and a successor to Sulley. It installs as a Python library for building fuzzer scripts, using `pip install boofuzz`, and requires Python 3.9 or later. Its workflow generates data, detects failures, resets targets after failures, and records test data. It supports varied communications, including serial, Ethernet and IP-layer traffic, UDP broadcast, TCP, UDP, SSL, and raw sockets. Run logs are saved in a SQLite database in the boofuzz-results directory, saved runs can be reopened in a web interface with `boo open`, and results can be exported as CSV. A process monitor can detect crashes and restart applications on Windows or Linux, but must run on the target machine. The optional network monitor requires Pcapy and Impacket, which are not installed automatically. Public FTP and HTTP protocol libraries are documented, though their implementations do not provide full protocol coverage. The project describes extensibility for instrumentation and failure detection. It uses the GPL-2.0 license; usage questions are directed to Stack Overflow, while bugs and suggestions can go to GitHub issues or pull requests.