Analyzing Code with CAST RPA SCAN. IDENTIFY. ACT.

2 Confidential This document outlines the basic process to analyze source code with the CAST Highlight Analyzer. Before you get started be sure that you have the CAST Highlight Analyzer installed on your desktop. If you do not you can click here to download it.here About the CAST Highlight Analyzer The Analyzer contains the code quality analyzers and other utilities needed to analyze your source code. The analyzer is a downloadable so that you can perform the analysis in your domain, where your code resides. Once complete the Analyzer creates an encrypted file that you will need to upload to this portal. This file contain only the application name and data needed to finalize the analysis. Introduction CAST HIGHLIGHT ANALYZER Please note that no source code or other information is ever uploaded to the portal.

3 Confidential Process overview As application are composed of different technologies CAST Highlight can analyze many languages (the following page contains a complete listing). As Highlight does not connect to databases or software configuration systems the code to be scanned must be extracted first. The following pages provide instructions on how to prepare the code for analysis. Before you get started please be sure to identify all the application components and ensure that you have access to them.

4 Confidential The application source code must be available as in text files that are accessible to the Highlight Analyzer. For security reasons, the Analyzer cannot access source code management systems therefore you will need to extract the source code from any CMDB to a location that can be accessed by the Analyzer. Extracted File Formats: The table to the right lists which file extensions per technology can be analyzed. For languages not requiring a specific source file extension (COBOL, Unix shell scripts and PL1), it is recommended to designate a folder with only source files to be analyzed.. Analyzing Code

5 Confidential To analyze database code you need to extract information from your database. CAST provides tools to extract the table/program data into a format that can be read analyzed. The extraction can be carried out either: using the executable.JAR files CASTDBGUI.jar / CASTDBExtractorGUI.jar or using the command line only (CASTDBExtractor.jar) Code must be extract one script file per functions, procedures, triggers, views. Analyzing Databases

6 Confidential The following information is needed prior to performing the SAP / ABAP extraction:  CAST supports SAP R3 (4.0 to 6.0)  The name of customized objects must start with a Z - although SAP does allow certified partners that deliver SAP complements to use other letters for the transactions (example: Y*, LZ*, LY*, SAPLY*, SAPLZ*)  Are there SAP packages outside of the Z package that are to be analyzed?  Are applications implemented on several SAP instances?  Can you quantify the number of ABAP objects per package this represent?  SAP access must be set up for a SAP user that has development authority  Which network or local hard drive can be used to store the results of the extraction?  If you have not installed the CAST ABAP Extractors please refer to the following page. Analyze SAP ABAP Custom Code

7 Confidential Install CAST ABAP extractors (ZCAST_EXTRACTOR_prog.abap and ZCAST_EXTRACTOR_tables.abap) which are located in the C drive C:\Program Files (x86)\CAST\Highlight\IHM\content The ZCAST_EXTRACTOR_PRG*.txt extracts all programs belonging to SAP packages including, user-exits, functions, classes, interfaces, BAPI, processing screens, transactions, Web Dynpro for ABAP. The ZCAST_EXTRACTOR_TAB*.txt extracts all tables and views belonging to SAP object names as well as extract the number of rows for tables that have been extracted. The extraction process splits the code into different folders (1 folder = 1 package). Highlight can read each folder and analyze each program (.abap) associated to the folder. ABAP Extractors FOR INSTRUCTIONS REVIEW THE SAP EXTRACTOR GUIDE.