Abstract: Systems and methods for performing hybrid symbolic execution to detect exploitable bugs in binary code are described. In some example embodiments, the systems and methods determine that resources associated with an execution client performing symbolic execution of a target program are below, at, or above a threshold performance level, generate checkpoints for active executing paths of the online symbolic execution, and cause the execution client to perform symbolic execution in response to the determination that the resources are at or above the threshold performance level.

Abstract: A method includes receiving a program code at a processor. The method also includes generating, via the processor, a heap model corresponding to the program code. The method further includes detecting, via the processor, a linearizable data structure in the program code. The method also further includes modifying, via the processor, the heap model based on the detected linearizable data structure. The method also further includes analyzing, via the processor, the program code using the modified heap model.

Abstract: A method includes receiving a program code at a processor. The method also includes generating, via the processor, a heap model corresponding to the program code. The method further includes detecting, via the processor, a linearizable data structure in the program code. The method also further includes modifying, via the processor, the heap model based on the detected linearizable data structure. The method also further includes analyzing, via the processor, the program code using the modified heap model.

Abstract: When a new element is interactively arranged in cooperative with an input device and a display device, an element arranged just before is specified based on the time relation of the new element to already arranged elements, the association is made to provide a relation between the specified element and the newly arranged element, and the relation between them is displayed on the display device. Therefore, an actual condition in that a series of relational elements is arranged successively in time is utilized, to thereby associate the elements according to the time relation thereof to provide a relation therebetween. Hence, the relation between the elements is easily provided while reflecting the intention of user as much as possible.

Abstract: Various embodiments automatically test software automation scripts. In one embodiment, at least one software automation script is obtained. The software automation script is configured to automatically place a computing system into a target state. A plurality of test cases for the software automation script is executed. Each of the plurality of test cases is a separate instance of the software automation script configured based at least on one or more different states of the computing system. The software automation script is determined to be one of idempotent and non-idempotent and/or one of convergent and non-convergent based on executing the plurality of test cases.

Abstract: Various embodiments automatically test software automation scripts. In one embodiment, at least one software automation script is obtained. The software automation script is configured to automatically place a computing system into a target state. A plurality of test cases for the software automation script is executed. Each of the plurality of test cases is a separate instance of the software automation script configured based at least on one or more different states of the computing system. The software automation script is determined to be one of idempotent and non-idempotent and/or one of convergent and non-convergent based on executing the plurality of test cases.

Abstract: A computer receives one or more partitions of application code and one or more tags associated with each partition. The computer identifies feedback corresponding to the application and determines whether terms contained within the feedback correspond to the tags associated with the partitions of code. Based on determining that the terms within the feedback correspond to the tags associated with a partition, associating the feedback with the corresponding partition of code. Based on determining that the terms within the feedback do not correspond to the tags associated with a partition, improving correlating accuracy through techniques such as machine learning, text analytics, natural language processing, and developer feedback to determine additional terms and additional tags.

Abstract: A computer implemented method and system including techniques for developing and executing automated test cases are described herein. In one embodiment, a test case automation tool provides functionality for defining an automated test set and associated test cases within a testing user interface without the use of scripting languages or compiled programming. The definition of each test case may occur within a testing user interface, including displaying and receiving user selection of available methods for testing; displaying user parameter fields and receiving user parameter values in response for testing; abstracting parameter types in the user parameter values; and generating XML-format definitions of the test case. The test case automation tool may then execute the selected methods of the software application using parameters provided in the XML-format definitions, and return testing results of the test case execution.

Abstract: Described herein are various embodiments of computer-implemented tools, systems, and methods for managing debugging of different portions of an application (e.g., front-end and back-end) with different respective debuggers in a manner that facilitates debugging the entire application from within the user interface associated with one of the debuggers (e.g., from within a browser interface). In some embodiments, a debug manager acts as a bridge between a web-browser debugger and a back-end debugger, allowing an application developer to debug web applications without leaving the browser.

Abstract: The invention relates to monitoring processor characteristic information of a processor using run-time-instrumentation. An aspect of the invention includes executing an instruction stream on the processor and detecting a run-time instrumentation sample point of the executing instruction stream on the processor. A reporting group is stored in a run-time instrumentation program buffer based on the run-time instrumentation sample point. The reporting group includes processor characteristic information associated with the processor.

Abstract: A method and data processing system are disclosed for concurrently loading a plurality of new modules while code of a plurality of modules of an original (i.e., currently running) computer program is loaded and executed on a computer system. The method may include allocating a module thread local storage (TLS) block for each thread within an initial computer program, wherein the allocated module TLS blocks are large enough to hold all module thread variables that are loaded or to be loaded. The method further may include providing constant offsets between module TLS block pointers corresponding to the module TLS blocks and the module thread variables for all of the threads. The disclosed method may be used to add modules to the original computer program and/or to apply a concurrent patch by replacing one or more of the plurality of original computer program modules.

Abstract: Methods, apparatuses, and computer program products for determining a number of unique incidents in a plurality of incidents for incident processing in a distributed processing system are provided. Embodiments include an incident analyzer identifying within the plurality of incidents, attribute combination entries of location identifications and incident types and analyzing each location identification in each attribute combination entry according to a sequence of the attribute combination entries including creating attribute pairs. The incident analyzer is also configured to count the attribute pairs. The number of attribute pairs is the number of unique incidents in the plurality of incidents.

Abstract: File modifications performed by malicious codes are detected by detecting a file modification for an original file before the file modification is performed on the original file. In response to detecting the file modification, a corresponding shadow file is created. The shadow file represents the original file as modified by the file modification. Before allowing the file modification to be performed on the original file, the original file is compared to the shadow file to determine if the file modification is being performed by malicious codes. The file modification may be deemed to be performed by malicious codes when the file modification involves, for example, entry point append, entry point prepend, entry point obfuscation, cavity, overwriting, or mal-tattoo.

Abstract: Techniques for malicious content detection using memory dump are described herein. According to one embodiment, a monitoring module is configured to monitor activities of a malicious content suspect executed within a sandboxed operating environment. In response to detection of one or more predetermined events triggered by the malicious content suspect, a memory dump module is configured to generate a memory dump of the malicious content suspect. An analysis module is configured to analyze the memory dump to determine whether the malicious content suspect should be declared as malicious based on a set of one or more rules.

Abstract: A data processing apparatus is provided comprising data processing circuitry and debug circuitry. The debug circuitry controls operation of the processing circuitry when operating in a debug mode. The data processing circuitry determines upon entry into a debug mode a current operating state of the data processing apparatus. The data processing circuitry allocates one of a plurality of instruction sets to be used as a debug instruction set depending upon the determined current operating state.

Abstract: Techniques for detection and handling of virtual appliance failures. In one aspect, a method is implemented on a host platform on which a hypervisor (aka Virtual Machine Manager) and a plurality of virtual machines (VMs) are running, the plurality of VMs collectively hosting a plurality of Software Defined Networking (SDN) and/or Network Function Virtualization (NFV) appliances that are communicatively coupled via a virtual network. A software-based entity running on the host platform is configured to monitor the plurality of virtual network appliances to detect failures of the virtual network appliances. In response to detection of a virtual network appliance failure, messages containing configuration information are implemented to reconfigure packet flows to bypass the virtual network appliance that has failed.

Abstract: The invention relates to tracing the execution path of a computer program comprising at least one module including a plurality of instructions. At least one of these instructions is a branch instruction. Each branch instruction is identified and evaluated to be one of true and false. An evaluation of true results in a unique identifier being pushed into a predefined area of storage. This unique identifier is associated with the instructions executed as a result of an evaluation of true.

Abstract: Various embodiments automatically test software automation scripts. In one embodiment, at least one software automation script is obtained. The software automation script is configured to automatically place a computing system into a target state. A plurality of test cases for the software automation script is executed. Each of the plurality of test cases is a separate instance of the software automation script configured based at least on one or more different states of the computing system. The software automation script is determined to be one of idempotent and non-idempotent and/or one of convergent and non-convergent based on executing the plurality of test cases.

Abstract: Methods, apparatuses, and computer program products for determining a number of unique incidents in a plurality of incidents for incident processing in a distributed processing system are provided. Embodiments include an incident analyzer identifying within the plurality of incidents, attribute combination entries of location identifications and incident types and analyzing each location identification in each attribute combination entry according to a sequence of the attribute combination entries including creating attribute pairs. The incident analyzer is also configured to count the attribute pairs. The number of attribute pairs is the number of unique incidents in the plurality of incidents.

Abstract: Embodiments of the present invention provide a method, system and computer program product for trace capture of successfully completed transactions for trace debugging of failed transactions. In an embodiment of the invention, a method for trace capture of successfully completed transactions for trace debugging of failed transactions is provided. The method includes storing entries in a log with information pertaining to successfully completed transactions in a transaction processing system executing in memory of a host server, detecting a failed transaction in the transaction processing system, generating a trace for the failed transaction, and providing with the generated trace an entry from the log with information pertaining to a successful completion of the failed transaction.

Abstract: Gaming devices with virtualization managers are described herein. In one embodiment, a gaming device includes a plurality of operating systems, each of the operating systems to facilitate execution of one or more gaming applications. The gaming device also includes gaming device resources for use by ones of the plurality of operating systems and a virtualization manager to share the gaming device resources between the plurality of operating systems during virtually simultaneous execution of the plurality of operating systems.

Abstract: Methods and apparatus for determining the state of a tile based deferred rendering processor are described. The method and apparatus include generating information indicating the state of the tile based deferred rendering processor when processing a unit of data during the geometry phase; generating an identifier that identifies the unit of data being processed during the geometry phase; storing the identifier identifying the unit of data processed during the geometry phase in association with the state of the tile based deferred rendering processor when processing the identified unit of data; generating information indicating the state of the tile based deferred rendering processor when processing the identified unit of data during the rasterisation phase; and outputting the stored identifier and the stored state information relating to the processing of the unit of data when the state of the tile based deferred rendering processor meets a condition.

Abstract: Various embodiments automatically test software automation scripts. In one embodiment, at least one software automation script is obtained. The software automation script is configured to automatically place a computing system into a target state. A plurality of test cases for the software automation script is executed. Each of the plurality of test cases is a separate instance of the software automation script configured based at least on one or more different states of the computing system. The software automation script is determined to be one of idempotent and non-idempotent and/or one of convergent and non-convergent based on executing the plurality of test cases.

Abstract: The present invention provides a computer implemented method, data processing system and computer program product for running a diagnostic test on an I/O adapter. The data processing system communicates a stop command to a functional device driver; wherein the functional device driver is configured to communicate with the I/O adapter. The data processing system determines whether the functional device driver has completed storing a state of the I/O adapter. The data processing system loads a diagnostic device driver for communicating with the I/O adapter. The data processing system applies test inputs to the diagnostic device driver, wherein at least one test input is presented to the I/O adapter. The data processing system receives test results from the diagnostic device driver.

Abstract: A method associates errors by causal relationship in software systems where multiple threads share access to hardware and/or software components. Where a software object, such as a lock, is provided, a thread can place an error ID into the object if encountered while the first thread controls the object. A second thread can retrieve the error ID and associate it as a parent error for any time-out error encountered while waiting for the software object. Errors can be reported and displayed in a causal graph for determining root causes. Errors can have a severity that can facilitate the display of errors to a user. Root cause errors can be assigned the severity of the most severe of its child errors to assist a user in determining a root cause. Errors can further be displayed or masked based on the severity assigned to the errors and/or their parent or child errors.

Abstract: A method for automated detection of a real IT system problem may include obtaining monitor measurements of metrics associated with activities of a plurality of configuration items of the IT system. The method may also include detecting anomalies in the monitor measurements. The method may further include grouping concurrent anomalies of the detected anomalies corresponding to configuration items of the plurality of configuration items which are topologically linked to be regarded as a system anomaly. The method may further include calculating a significance score for the system anomaly, and determining that the system anomaly relates to a real system problem based on the calculated significance score.

Abstract: The present invention relates to a processor including: an instruction cache configured to store at least some of first instructions stored in an external memory and second instructions each including a plurality of micro instructions; a micro cache configured to store third instructions corresponding to the plurality of micro instructions included in the second instructions; and a core configured to read out the first and second instructions from the instruction cache and perform calculation, in which the core performs calculation by the first instructions from the instruction cache under a normal mode, and when the process enters a micro instruction mode, the core performs calculation by the third instructions corresponding to the plurality of micro instructions provided from the micro cache.

Abstract: A method begins by a dispersed storage (DS) processing module mapping a set of data partitions to a set of storage regions. For each data partition, the method continues with the DS processing module segmenting the data partition into a plurality of data segments and designating a first data segment. The method continues with the DS processing module generating data storage mapping information. The method continues with the DS processing module encoding the data storage mapping information to produce at least one set of encoded mapping information slices and for each data partition, encoding the plurality of data segments to produce a plurality of sets of encoded data slices. The method continues with the DS processing module outputting the at least one set of encoded mapping information slices and, for each data partition, the plurality of sets of encoded data slices to the DSN for storage therein.

Abstract: A shared platform included in a device can be configured to execute instructions from a first application and a second application to operate the device. The shared platform can be configured to receive mode instructions from the first application indicative of operating in a test mode where the shared platform provides simulated responses to the first application. The shared platform can receive a request from the first application pertaining to an operation of the second application. The shared platform operating in the test mode can determine a response to the request from the first application based on a simulation of providing the request to the second application.

Abstract: The invention relates to the field of anti-virus protection. The technical result of the invention lies in providing possibility for unblocking the computer with no data loss and computer resetting, for increasing the antivirus systems operation efficiency and consequently improving the computer systems security. A method for neutralizing malicious software blocking computer operation, the method being performed by means of a separate antivirus activation device developed for the antimalware procedure activation to be run by a PC user, the device comprising connectors for connection to a control bus, a controller and an activation unit. Computer unblocking and malware neutralizing procedure is activated after receiving an activation signal from the antivirus activation device.

Abstract: Systems and methods for breaking program execution on events are described. One of the systems includes an event subsystem for receiving the signaling events generated by one or more associated peripheral devices. The system also includes a command module which is coupled between the event subsystem and a debug module, the command module receives the signaling events from the event subsystem and in response generates break commands. The debug module of the system receives the break commands from the command module and, in response, interrupts the execution of a program of a controller.

Abstract: Techniques detect bootkits resident on a computer by detecting a change or attempted change to contents of boot locations (e.g., the master boot record) of persistent storage, which may evidence a resident bootkit. Some embodiments may monitor computer operations seeking to change the content of boot locations of persistent storage, where the monitored operations may include API calls performing, for example, WRITE, READ or APPEND operations with respect to the contents of the boot locations. Other embodiments may generate a baseline hash of the contents of the boot locations at a first point of time and a hash snapshot of the boot locations at a second point of time, and compare the baseline hash and hash snapshot where any difference between the two hash values constitutes evidence of a resident bootkit.

Abstract: A single file is used to coordinate multiple testing processes. The single file is used to start a test, for other aspects of testing, including, but not limited to, checking test prerequisites before the run, the collection of load driver logs, the analysis of collected test data, and the generation of database and other reports for the test run. The file is generated as a script to set variables and then launch one or more load driver instances on the local and/or network attached severs. The file is used by other programs and scripts as a “run description” data file to check or control the viability of the test before launch, the status of the test if the test is currently in progress, collect the results of the test after finishing, and to begin the analysis and report generation of the collected test results.

Abstract: A network security device and associated methods which protects a user's computer from the direct effects of software sent from a server by converting the data to a non-volatile information stream using two or more firewall isolation stages. The multistage functionality completely decouples the information communicated from the bulk of data sent from the server by converting the data into non-volatile information and eliminates risk from the even most aggressive adaptive malware by using an intermediate protocol translation between two of the stages contained in the decoupling firewall.

Abstract: A method for testing multiple language versions of a browser-based application. A host language Hypertext Transfer Protocol (HTTP) request issued by a host language browser is received. The host language HTTP request is configured to be sent to a host server address. The host language HTTP request comprises parameter strings in a host language. A target language HTTP request is generated by replacing each host parameter string of at least one host parameter string of the parameter strings in the received HTTP request with a respective target parameter string associated with a target language that differs from the host language. The generated target language HTTP request is configured to be sent to a target server address associated with and different from the host server address.

Abstract: The present document pertains to systems and methods of dependency framework analysis to automatically identify errors in the dependency framework of an application or software module. Variations discussed include devices and methods for identifying errors in an object dependency graph by techniques such as determining a module and module type associated with a method at a plugin point on the object dependency graph; automatically selecting, from a set of testlets, at least one testlet associated with the determined module type, where each testlet is associated with one or more common dependency errors; and automatically creating, with a processor, at least one test suite for each selected testlet, where automatically creating includes building an executable code module that, when executed with a processor, analyzes the dependency graph at the plugin point and generates data showing a location and severity of common dependency errors within the graph.

Abstract: Approaches for facilitating spatial and temporal verification of users and/or user devices are disclosed. In some implementations, a user device may be detected within a short wireless communication range. A wireless communication session with the user device may be initiated based on the detection. Information identifying a first integrity-based certificate may be received from the user device during the wireless communication session during a first time period. Information identifying a second integrity-based certificate associated with a second time period may be provided responsive to determining that the first integrity-based certificate is a valid integrity-based certificate associated with the first time period. The second integrity-based certificate may be configured to allow network access for the user device during the second time period.

Abstract: A data processing device has a processor (10) operable at selectable ones of a plurality of performance levels. The processor generates a workload data vector indicating a workload of the processor as a function of time. A memory stores a set of reference workload vectors. A pattern matcher (18) detects whether there is a matching reference workload data vector. A performance level controller (19) selects the performance level of the processor based on control information that is stored in combination with the matching workload data vector.

Abstract: A system for testing multiple language versions of a browser-based application. A host language Hypertext Transfer Protocol (HTTP) request issued by a host language browser is received. The host language HTTP request is configured to be sent to a host server address. The host language HTTP request comprises parameter strings in a host language. A target language HTTP request is generated by replacing each host parameter string of at least one host parameter string of the parameter strings in the received HTTP request with a respective target parameter string associated with a target language that differs from the host language. The generated target language HTTP request is configured to be sent to a target server address associated with and different from the host server address.

Abstract: A method comprising detecting an problem with a software product, capturing debugging information corresponding to the detected problem, searching for the detected problem in a repository of a set of known issues corresponding to the software product to identify a root cause of the detected problem. If the detected problem is a known issue in the set of known issues corresponding to the software product, automatically applying a corresponding solution to the detected problem. If the detected problem is not a known issue in the set of known issues corresponding to the software product, analyzing the user input describing an occurrence of the problem with the software product, as well as the captured debugging information. Based on the analysis, the repository of the set of known issues is updated to include the detected problem as a new known issue and a corresponding solution to the detected problem.

Abstract: Embodiments of apparatuses, articles, methods, and systems for protecting software components using transition point wrappers are generally described herein. In one embodiment, an apparatus includes a first component, a wrapper component, and a management module. The wrapper component is to transform a transition point between the first component and a second component. The management module is to control access to the first component through the transformed transition point. Other embodiments may be described and claimed.

Abstract: Systems and techniques for preventing malicious instruction execution are described herein. A first instance of an instruction for a graphics processing unit (GPU) may be received. The instruction may be placed in a target list. A notification that the instruction caused a problem with the GPU may be received. The instruction may be moved from the target list to a black list in response to the notification. A second instance of the instruction may be received. The second instance of the instruction may be prevented from executing on the GPU in response to the instruction being on the black list.

Abstract: A platform executing on a computer system configures an application and components that provide capabilities to the application based on an application descriptor of the application, the application and the components to be run on a plurality of nodes of the platform that are arranged in a cluster. The platform assigns a first set of the components to run on a first node of the plurality of nodes and a second set of on the components to run on a second node of the plurality of nodes. The platform installs the first set of the components on the first node and the second set of the components on the second node.

Abstract: A method, computer program and system for controlling accesses to memory by threads created by a process executing on a multiprocessor computer. A page table structure is allocated for each new thread and copied from the existing threads. The page access is controlled by a present bit and a writable bit. Upon a page fault the access is provided to one thread. The kernel handles the new page entry creation process and set the page present bits to zero which creates page faults. In a second embodiment, two page table structures are created, one for one thread having access to the address space and the other page table structure shared by all the other threads not having access to the address space.

Abstract: Reliability of one or more software modules is projected according to a current state in a development life cycle of the software modules and any of various additional indicators. Preferably, a data processing support provider separate from the service-providing enterprise maintains historical field support data concerning significant field defect events with respect to various resources, and uses this data for projecting reliability of the resources. Preferably, software module reliability projections are used to support an analysis of risk of degradation of a service specified in a service requirements specification when provided by a configuration of data processing resources specified in a configuration specification.

Abstract: Systems and methods are described for analyzing and verifying distributed applications. In one embodiment, an application program is parsed and a set of inputs is determined. The application program is executed as one or more independently executable components. During execution, non-deterministic events are modified in order to effectuate a deterministic result. Redundant portions of the set of inputs are aggregated, and the set of inputs is iteratively updated.

Abstract: Reliability of one or more software modules is projected according to a current state in a development life cycle of the software modules and any of various additional indicators. Preferably, a data processing support provider separate from the service-providing enterprise maintains historical field support data concerning significant field defect events with respect to various resources, and uses this data for projecting reliability of the resources. Preferably, software module reliability projections are used to support an analysis of risk of degradation of a service specified in a service requirements specification when provided by a configuration of data processing resources specified in a configuration specification.

Abstract: Consistent with the present disclosure, a block of software code or “software code block” that is executed while particular tests are carried out is assigned a software code block identifier, which is associated with test identifiers, which, in turn, identify the tests that were performed. The software code block identifiers and corresponding test identifiers are then stored in a database. When a portion of the software code block is later modified, either by a change to one or more lines of the code or by deleting or adding code, the corresponding software code block identifier is determined or selected, and then used to access the corresponding test identifiers from the database. The test identifiers are then used to generate a report, for example, that lists each test to be performed in order to determine whether the modified software code block operates properly.

Abstract: A system detects malware in a computing architecture with an unknown pedigree. The system includes a first computing device having a known pedigree and operating free of malware. The first computing device executes a series of instrumented functions that, when executed, provide a statistical baseline that is representative of the time it takes the software application to run on a computing device having a known pedigree. A second computing device executes a second series of instrumented functions that, when executed, provides an actual time that is representative of the time the known software application runs on the second computing device. The system detects malware when there is a difference in execution times between the first and the second computing devices.

Abstract: Systems and methods for generating and traversing test cases trees are provided. A test case tree indicates an order of execution for multiple test cases, where setup and tear down or equivalent steps are not required before and after execution of each test case in the tree. The tree may allow for generation of virtual test cases to encompass multiple test cases which ordinarily would have mutually exclusive execution requirements.