Abstract: A high level intermediate representation of a binary is generated. Circuit nodes from the high level intermediate representation are built, wherein a circuit node represents an operation in the high level intermediate representation. The circuit nodes are connecting using a flow analysis of the binary to build a circuit that represents the binary.

Abstract: Spyware programs are detected even if their binary code is modified by normalizing the available code and comparing to known spyware patterns. Upon normalizing the known spyware code patterns, a signature of the normalized code is generated. Similar normalization techniques are employed to reduce the executable binary code as well. A match between the normalized spyware signature and the patterns in the normalized executable code is analyzed to determine whether the executable code includes a known spyware. For pattern matching, Deterministic Finite Automata (DFA) is constructed for basic blocks and simulated on the basic blocks of target executable, hash codes are generated for instructions in target code and known spyware code and compared, register usages are replaced with common variables and compared, and finally Direct Acyclic Graphs (DAGs) of all blocks are constructed and compared to catch reordering of mutually independent instructions and renamed variables.

Abstract: Technologies, systems and methods for code path analysis of an executable including: generating call graphs and control flow graphs of selected functions in the executable, and instrumenting the selected functions to provide for logging of path trace information for the selected functions upon execution of the instrumented executable, the path trace information usable for efficient system crash analysis and debugging. A stack trace from a crash dump may be utilized in the selection of the functions to analyze.

Abstract: Techniques for improving operating system performance are provided. A subsystem of an operating system operates as a kernel mode component, such as a kernel mode driver, instead of operating as a user mode component.

Abstract: Techniques for enabling inter-subsystem resource sharing are provided. A subsystem executing an application (“app subsystem”) receives resources from another subsystem providing a resource (“resource subsystem”), such as a DLL. Then, when an application of the app subsystem is executed, the application may request a resource from the app subsystem, such as a DLL. The app subsystem, upon determining that the requested resource is associated with the resource subsystem, may communicate with the resource subsystem to request the resource. The resource subsystem may then load the resource. When the application utilizes the resource to perform an activity, such as by invoking a method of the DLL, the app subsystem may communicate with the resource subsystem to request the resource to perform the activity. The resource subsystem may provide an indication of a result to the resource subsystem upon completing the activity.

Abstract: The diverse objects comprising a computing environment may be represented together as a deployable object hierarchy, which may facilitate the deployment, as well as the consistency, of a computing environment rendered by a plurality of devices. The processes within the computing environment often operate on the objects of the object hierarchy in a variety of ways, including simple operations (creation, reading, updating, and deleting) and more sophisticated operations (synchronizing, paginating, and caching), as well as with the object hierarchy in general. A platform may be devised to facilitate the various operations of the processes on the object hierarchy. The platform may be embodied, such as in an application runtime, and deployed to a variety of platforms to facilitate an equivalent execution of the processes on any type of device and consistent interactions with the object hierarchy.

Abstract: Techniques for extending operating system subsystems are provided. The techniques involve using a subsystem of an operating system having a set of insertion points that identify points in the program logic of the subsystem where logic extensions may be added. The subsystem may receive a library that has functions comprising program logic for extending the subsystem and a list that provides a correspondence between the insertion points and the functions. When the subsystem receives a request to perform an action that has a corresponding insertion point for which the list provides an associated function, the subsystem may perform the function. The function may be indicated to be performed at various points in the program logic of the subsystem, including before or after the requested action.

Abstract: Techniques for routing exceptions to operating system subsystems are provided. In various embodiments, a software developer may add a global exception handler software component to an application. The global exception handler may operate in a process relating to a subsystem. Upon receiving an exception, the global exception handler may route the exception to another subsystem.

Abstract: Techniques for enabling inter-subsystem resource sharing are provided. The techniques include providing an RPC client on a first subsystem for acting as a proxy for a resource of a second subsystem. When the first subsystem receives a request from an application to access the resource, the RPC client may invoke a function of an RPC server associated with the second subsystem. The RPC server may load the resource on the second subsystem. The RPC client may then act as a proxy for the resource.

Abstract: A method and system for generating a normalized string and performing a phonetic search are provided. To normalize a string, a native string is obtained. Upon obtaining a native string, native-character sets within the native string are identified. Each native-character set is associated with a phonetically corresponding normalized character-set. A normalized string is generated based on the phonetically corresponding normalized character-sets. After normalizing a query string and one or more search content strings, the normalized strings may be utilized to perform a phonetic search. As such, the query string may be compared to the one or more search content strings to ascertain relevant search results. Relevant search results may be indexed and obtained at a later instant.

Abstract: Which target functions in a target binary have target function basic blocks that match the source function basic blocks in a source function in a source binary is determined. For the target functions having matching target function basic blocks, a target function control flow graph is determined that has the greatest control flow matching strength to a source function control flow graph, wherein a node in the source function control graph represents a source function basic block, wherein a node in a target function control graph represents a target function basic block in a corresponding target function.

Abstract: Technologies, systems and methods for code path analysis of an executable including: generating call graphs and control flow graphs of selected functions in the executable, and instrumenting the selected functions to provide for logging of path trace information for the selected functions upon execution of the instrumented executable, the path trace information usable for efficient system crash analysis and debugging. A stack trace from a crash dump may be utilized in the selection of the functions to analyze.

Abstract: Technologies for estimating deviations in the performance characteristics of a newer version of software relative to an older version. Such performance characteristics include cache misses, pages faults, and the like. Estimations are typically made by instrumenting and profiling an older version binary, determining differences in code blocks between the older and a newer version, propagating profile data from the older version to the newer version based on a simulation heuristic, and estimating performance deviations based on the older version, the profile data, configuration parameters, and the changes in the newer version without actually executing the newer version of the binary.

Abstract: A code review tool system includes a developer on a developer node, a reviewer on a reviewer node, and a server on a server node. The developer node and the reviewer node include an integrated code review tool. The integrated code review tool includes functionality for a developer to specify source code files to be reviewed and a list of reviewer identifiers. The integrated code review tool also includes functionality to associate the reviewer's comments and/or proposed code changes with context information identifying a location in the source code files. The reviewer's comments, proposed code changes, and associated context information is sent to the developer. The developer may then see the reviewer's comments and proposed code changes in context with the location in the source code to which the comments and code changes pertain.

Abstract: A high level intermediate representation of a binary is generated. Circuit nodes from the high level intermediate representation are built, wherein a circuit node represents an operation in the high level intermediate representation. The circuit nodes are connecting using a flow analysis of the binary to build a circuit that represents the binary.

Abstract: Events captured at an application are compared to event correlation instances, wherein an event correlation instance represents a relationship between events of components of the application. The event of a plurality of events that is a potential root cause event of the plurality of events is determined. The potential root cause event and component associated with the potential root cause event are outputted.

Abstract: Spyware programs are detected even if their binary code is modified by normalizing the available code and comparing to known spyware patterns. Upon normalizing the known spyware code patterns, a signature of the normalized code is generated. Similar normalization techniques are employed to reduce the executable binary code as well. A match between the normalized spyware signature and the patterns in the normalized executable code is analyzed to determine whether the executable code includes a known spyware. For pattern matching, Deterministic Finite Automata (DFA) is constructed for basic blocks and simulated on the basic blocks of target executable, hash codes are generated for instructions in target code and known spyware code and compared, register usages are replaced with common variables and compared, and finally Direct Acyclic Graphs (DAGs) of all blocks are constructed and compared to catch reordering of mutually independent instructions and renamed variables.

Abstract: An apparatus and method provide for profile optimizations at a binary level. Thread specific data may be used to lay out a procedure in a binary. In one example, a hot thread may be identified and a layout may be generated based on the identified hot thread. Also, threads of an application may be ranked according to frequency of execution of the corresponding threads. The layout may be created based on the different threads of differing frequency of execution and conflicts between a hottest thread and each of the other threads of the application. In another example, different threads of the application may conflict. For example, two threads may contain operations that overlap temporally to create a race condition. A layout of the application threads may be created based on conflicting threads.

Abstract: A binary is received at a binary verification service from a binary verification client agent. The binary verification service performs binary verification of the binary, wherein binary verification includes determining whether the binary is complicit with a set of usage rules. The binary verification service sends a binary verification result to the binary verification client agent.

Abstract: Application setting virtualization for a user. Application settings from a source computer are copied to a user-specific location on a destination computer and layered under corresponding application settings associated with one or more applications installed on the destination computer. In response to receiving a request from an application for an application setting, the requested application setting is retrieved from the layered application settings such that the layers are searched in order for the requested application setting and the first application setting found is retrieved and returned to the requesting application.