Abstract: Determination and provision of improved representations of program flow control are provided by a method that monitors execution of binary code of a program on a computer system. The monitoring includes monitoring manipulation(s) of call stack(s) maintained by the computer system for the execution of the binary code. The method, based on the monitoring, determines function call pattern(s) and branch pattern(s) exhibited by the execution of the binary code. The method identifies, from the binary code and using the determined function call pattern(s) and branch pattern(s), function calls and branches, relations between the function calls and branches, and function and variable names. The method also provides a representation of program flow control of the program using the identified function calls and branches, relations, and function and variable names.

Abstract: Determination and provision of improved representations of program flow control are provided by a method that monitors execution of binary code of a program on a computer system. The monitoring includes monitoring manipulation(s) of call stack(s) maintained by the computer system for the execution of the binary code. The method, based on the monitoring, determines function call pattern(s) and branch pattern(s) exhibited by the execution of the binary code. The method identifies, from the binary code and using the determined function call pattern(s) and branch pattern(s), function calls and branches, relations between the function calls and branches, and function and variable names. The method also provides a representation of program flow control of the program using the identified function calls and branches, relations, and function and variable names.

Abstract: A computer-implemented method, computer program product and computer system are provided. A processor receives an indication of sensitive data in one or more files. A processor updates at least one bit in the virtual address space for the one or more files indicated to have sensitive data. A processor, in response to a program accessing the one or more files, evaluates a respective virtual address for the one or more files. A processor, in response to the at least one bit in the respective virtual address for the one or more files, marks intermediate data generated by the program as sensitive data.

Abstract: Embodiments of the present disclosure relate to a method, system, and computer program product for dynamic update of a computer program in memory. According to the method, one or more processors obtain incremental information, the incremental information specifying an incremental update to at least one section of at least one target function in a computer program. One or more processors identify, based on the incremental information, the at least one target function to be updated from the computer program. One or more processors generate at least one updated copy of the at least one target function by updating the at least one section of the at least one target function based on the incremental information. One or more processors update the computer program based on the at least one updated copy of the at least one target function while the computer program is running.

Abstract: A method, computer system, and a computer program for monitoring synchronization and aggregation are provided. The method may include receiving a plurality of metrics and identifying a plurality of metadata associated with the plurality of metrics. The method may further include calculating a hash value of the plurality of metadata based on the plurality of metrics. The method may further include detecting at least one modification to the plurality of metadata based on the hash value and updating the plurality of metrics based on the at least one modification in which the plurality of metrics are displayed in a self-adapting metric diagram.

Abstract: Aspects of the invention include includes detecting a change in a code section of a source code in relation to a reference code section. An incremental section is created in object code, the incremental section includes an object code section describing the change in the code section and a symbol section describing a change to a symbol associated with the changed code section. The incremental section is attached to a software update. The software update to a target computer system.

Abstract: Embodiments of the present disclosure relate to a method, system, and computer program product for dynamic update of a computer program in memory. According to the method, one or more processors obtain incremental information, the incremental information specifying an incremental update to at least one section of at least one target function in a computer program. One or more processors identify, based on the incremental information, the at least one target function to be updated from the computer program. One or more processors generate at least one updated copy of the at least one target function by updating the at least one section of the at least one target function based on the incremental information. One or more processors update the computer program based on the at least one updated copy of the at least one target function while the computer program is running.

Abstract: Aspects of the invention include includes detecting a change in a code section of a source code in relation to a reference code section. An incremental section is created in object code, the incremental section includes an object code section describing the change in the code section and a symbol section describing a change to a symbol associated with the changed code section. The incremental section is attached to a software update. The software update to a target computer system.

Abstract: Aspects of the invention include computer-implemented method that includes generating a preliminary control flow graph from memory dump data and compiler listing data in response to an exception event at a computing program. Code segments associated with each block of the preliminary control flow graph are translated to Boolean statements. Each Boolean statement is determined to be either satisfied or unsatisfied based on input values retrieved from the memory dump data. An edge property value of a first edge and a second edge of a plurality of edges of the preliminary control flow graph based are calculated based on a satisfaction of the Boolean statements. The edge property value of the first edge is compared to the edge property value of the second edge. The preliminary control flow graph is refined by deleting the first edge of the plurality of edges based at least in part on the comparison.

Abstract: Aspects of the present disclosure are directed to methods, systems, and computer program products for using dynamic-link library based on memory size. In the method, a request for calling a first function in a Dynamic-link library (DLL) at runtime is received first. A size of a memory allocated to the DLL is then determined. Then call relationship of functions in the DLL is obtained. At last, functions related to the first function in the DLL are loaded into the memory allocated to the DLL based on the size of the memory allocated to the DLL and call relationship of functions in the DLL.

Abstract: The present disclosure provides a computer-implemented method, computer system and computer program product for user authentication. According to the method, identity information can be received from a user, and a plurality of questions can be presented to the user, the plurality of questions comprising one or more valid questions generated based on a password related to the identity information and one or more invalid questions. Then, an input can be received from the user, and in response to the input corresponding to the one or more valid questions, the user can be authenticated based on the input.

Abstract: Aspects of the present disclosure are directed to methods, systems, and computer program products for using dynamic-link library based on memory size. In the method, a request for calling a first function in a Dynamic-link library (DLL) at runtime is received first. A size of a memory allocated to the DLL is then determined. Then call relationship of functions in the DLL is obtained. At last, functions related to the first function in the DLL are loaded into the memory allocated to the DLL based on the size of the memory allocated to the DLL and call relationship of functions in the DLL.

Abstract: The present disclosure provides a computer-implemented method, computer system and computer program product for user authentication. According to the method, identity information can be received from a user, and a plurality of questions can be presented to the user, the plurality of questions comprising one or more valid questions generated based on a password related to the identity information and one or more invalid questions. Then, an input can be received from the user, and in response to the input corresponding to the one or more valid questions, the user can be authenticated based on the input.