Abstract: A flexible aes instruction set for a general purpose processor is provided. The instruction set includes instructions to perform a “one round” pass for aes encryption or decryption and also includes instructions to perform key generation. An immediate may be used to indicate round number and key size for key generation for 128/192/256 bit keys. The flexible aes instruction set enables full use of pipelining capabilities because it does not require tracking of implicit registers.

Abstract: Facilitating communications within a processing environment. Inbound traffic and outbound traffic on one or more virtual interfaces of the processing environment are monitored for a predefined amount of time. Based on the monitoring, a determination is made as to whether for a selected component of a virtual interface of the one or more virtual interfaces an inbound frame has been received but an outbound frame has not been transmitted for the predetermined amount of time. Based on determining that the inbound frame has been received but the outbound frame has not been transmitted, a generated outbound frame is forwarded to cause address registration information for the virtual interface to be refreshed.

Abstract: A system and method of making messages remain on top of a mobile bulletin board are provided. The system includes a database, a server, a push gateway, and a mobile communication device. A cloud is composed of the database, the server, and the push gateway. The server generates a bulletin board message. The bulletin board message is delivered as a push notification to the mobile communication device of a corresponding member through the push gateway and an external push server, such that the bulletin board message is made compulsory remain-on-top displayed on the mobile communication device.

Abstract: A method, system and computer program product for enforcing licensing terms when distributing content via a container image running in a container. Upon receiving a request for a service from the container by the isolation code, where the isolation code limits, accounts and isolates resource usage of process groups, the commerce code application programming interfaces (APIs) of the isolation code read a key of the container. The key contains licensing terms applied to the component(s) (e.g., applications) of the container. The commerce code APIs will then confirm that the container is in compliance with those licensing terms. If the container is in compliance with the licensing terms, the container will be allowed to execute. Otherwise, the container will be prevented from executing. In this manner, the commerce code APIs can enforce the licensing terms, including restrictions and enforcement of payment to the licensor upon distributing content in the container.

Abstract: A method of enabling multiple different operating systems to run concurrently on the same RISC (e.g. ARM) computer, comprising selecting a first operating system to have a relatively high priority (the realtime operating system, such as C5); selecting at least one secondary operating system to have a relatively lower priority (the general purpose operating system, such as Linux); providing a common program (a hardware resource dispatcher similar to a nanokernel) arranged to switch between said operating systems under predetermined conditions; and providing modifications to said first and second operating systems to allow them to be controlled by said common program.

Abstract: Distributed hardware device simulation, including: identifying a plurality of hardware components of the hardware device; providing software components simulating the functionality of each hardware component, wherein the software components are installed on compute nodes of a distributed processing system; receiving, in at least one of the software components, one or more messages representing an input to the hardware component; simulating the operation of the hardware component with the software component, thereby generating an output of the software component representing the output of the hardware component; and sending, from the software component to at least one other software component, one or more messages representing the output of the hardware component.

Abstract: An adapter may facilitate easy and swift data transfer amongst two previously incompatible electronic devices. Such an adapter may be operative to communicate data with a first of the two electronic devices using a contactless communication link and a first communication protocol and to communicate data with a second of the two electronic devices using a mechanical communication link and/or using a second communication protocol that is different than the first communication protocol, such that data may be transferred between the first and second electronic devices via the adapter. The adapter may be communicatively coupled to both the first electronic device and the second electronic device at the same time. The adapter may rapidly transition between communicating data with the first device and communicating data with the second device (e.g., without altering a physical connection between the adapter and one of the first and second devices during such a transition).

Abstract: A method, a device, and a non-transitory computer readable medium for performing dithering on an L bit long input data are presented. An M bit long random data is generated, wherein M is a number of least significant bits of the input data. An M bit long frame counter value is added to the random data. The input data is rounded up to L-M most significant bits when the M least significant bits of the input data is greater than the sum of the frame counter value and the random data. The input data is truncated to the L-M most significant bits when the M least significant bits of the input data is less than or equal to the sum of the frame counter value and the random data.

Abstract: To enable moving and copying structured data as block data at high speed, and tracing the moved or copied structured data at high speed. A data processing apparatus that processes structured data including a pointer includes a processing unit configured to process the structured data that uses as the pointer a relative address whose origin is the address of a word in which the pointer is stored.

Abstract: Embodiments relate an emulation environment that places debugging logic in a manner that connections between the debugging logic and logic components outputs can be efficiently routed. In one embodiment, the host system places the debugging logic after placing the logic components of the DUT, but before routing the logic components. In another embodiment, the host system places debugging logic after placing and routing logic components of the DUT. In another embodiment, for one or more emulator FPGAs, the host system places debugging logic units of the debugging logic evenly across the FPGA before placing logic components of the DUT.

Abstract: A mechanism is provided for operating programs on a computer cluster comprising cluster resources. The cluster resources comprise non-virtual real hardware resources with variable configurations and virtual resources. Each cluster resource has a configuration description and a type. Each type has a unique type identification and descriptions of operations that can be performed by the cluster resource of the each type. Each program is operable for: requesting usage of the cluster resource specifying the type and the configuration description; and requesting a modification of the variable configuration of the non-virtual real hardware resource with the variable configuration. Execution of each program requires the dedicated execution environment on the computer cluster. The generation of each dedicated execution environment requires one or more dedicated virtual resources and one or more dedicated non-virtual real hardware resources with the variable configurations.

Abstract: Aspects disclosed in the detailed description include power saving techniques in computing devices. In particular, as data is received by a modem processor in a computing device, the data is held until the expiration of a modem timer. The data is then passed to an application processor in the computing device over a peripheral component interconnect express (PCIe) interconnectivity bus. On receipt of the data from the modem processor, the application processor sends data held by the application processor to the modem processor over the PCIe interconnectivity bus. The application processor also has an uplink timer. If no data is received from the modem processor before expiration of the uplink timer, the application processor sends any collected data to the modem processor at expiration of the uplink timer. However, if data is received from the modem processor, the uplink timer is reset.

Abstract: Systems and methods for managing risk management rules are provided. A risk management rule may be configured at a rule configuration interface are described. The rule configuration interface may include a list of access rights available for selection. Based on input received, one of the access rights may be identified as a base access right and one of the access rights may be identified as a conflicting access right for the risk management rule. The access rights provisioned at the computing system may be monitored to determine whether a user is provisioned with both the base access right and the conflicting access right. If so, a violation review may be created and presented at a violation review interface at which a decision for the violation review is receivable. An exception to the risk management rule may also be configured at an exception configuration interface.

Abstract: A system and method of an enterprise mobile message are provided. The system includes a database, a server, a push gateway, and a mobile communication device. A cloud is composed of the database, the server and the push gateway. The server delivers a message content in the form of a push notification through the push gateway and an external push host to the mobile communication device corresponding to a member. The server creates an unread list according to a reading record uploaded from the mobile communication device of the member. The server resends the push notification to the members selected from the unread list.

Abstract: A method and related system is disclosed for emulation of a Mobile User Objective System (MUOS) ground base station. A Software Defined Radio (SDR) based architecture with interpreted scripting languages interfaces with open source software running in an embedded environment to emulate entire MUOS ground transportation segment. The ground base station emulation resides on a server remote from the MUOS enabled terminals or embedded within MUOS enabled terminals. It is transparent to the MUOS enabled terminal whether the terminal is in communication with the emulation of or the actual MUOS ground base station.

Abstract: A method performed by a physical computing system includes, with a guest, requesting execution of a virtual machine function instruction, determining that virtual machine function ability for the guest is in a disabled state, in response to the requesting execution of a virtual machine function instruction and determining that the virtual machine function ability for the guest is in a disabled state, exiting a context of the guest, after a page table that maps guest virtual addresses to guest physical addresses is validated, determining that the virtual machine function ability is enabled, and in response to determining that the virtual machine function ability for the guest is in an enabled state, executing the virtual machine function instruction.

Abstract: A debug configuration tool for configuration of on-chip debug features comprises a database comprising predefined analysis points, each relating to a configurable chip entity, and comprising a configurable condition and a configurable action for the chip entity, a plurality of predefined analysis groups, each relating to a group of configurable chip entities, and comprising a configurable condition and a configurable action for the group of chip entities. The tool comprises a graphical user interface module arranged to display representations of at least some of the analysis points and the analysis groups on different levels of detail, and to receive input from a user to set the configurable conditions and/or actions for the displayed analysis points and the analysis groups. An application program interface module processes data received from the graphical user interface module to obtain debug settings and to communicate the debug settings to a debug target system configuration module.

Abstract: A chip select signal is trained where the chip select signal is delayed to centrally align its pulses with a positive edge of a memory device's clock cycle. Over repeated iterations, the memory device stops its clock for an interval and a delayed pulse of the chip select signal is generated. The pulse delay is incrementally changed with each iteration. When the delay results in the trailing edge of the delayed pulse aligning with the positive edge of the last cycle before the stoppage interval, the memory device captures the contents of a computer bus, thus detecting a trailing edge delay value. When the delay results in the leading edge of the delayed pulse aligning with the positive edge of the last cycle, the device no longer captures the contents, thus detecting a leading edge delay value. A value between these values is then set as the optimal delay.

Abstract: In an information processing device connected to an external device via a network, the external device includes an application platform of an image forming device and the information processing device includes a platform emulator that emulates the application platform. The platform emulator includes an implementing information acquiring part that receives a list of information items of interfaces implemented on the application platform in the external device from the external device and stores the list of information items in a holding part, a determining part that determines, in response to an interface calling request from an application using the platform emulator, whether an interface is implemented in the external device based on the stored list of information items, and an external calling part that transmits, when the interface is implemented, a request of execution of the interface to the external device.

Abstract: A method, system and computer program product for enforcing licensing terms when distributing content via a container image running in a container. Upon receiving a request for a service from the container by the isolation code, where the isolation code limits, accounts and isolates resource usage of process groups, the commerce code application programming interfaces (APIs) of the isolation code read a key of the container. The key contains licensing terms applied to the component(s) (e.g., applications) of the container. The commerce code APIs will then confirm that the container is in compliance with those licensing terms. If the container is in compliance with the licensing terms, the container will be allowed to execute. Otherwise, the container will be prevented from executing. In this manner, the commerce code APIs can enforce the licensing terms, including restrictions and enforcement of payment to the licensor upon distributing content in the container.

Abstract: A modular control system is adapted to adjust an aftermarket system in a vehicle via the vehicle head unit. The head unit includes a user interface operable by the user to control the aftermarket system. An aftermarket control unit is in communication with the user interface of the vehicle head unit, the aftermarket control unit receiving an aftermarket control signal from the vehicle head unit as a results of an input by the user at the head unit. The aftermarket control unit is in communication with the aftermarket system, wherein the aftermarket control unit may operate the aftermarket system in response to the user input. The aftermarket system may be an air suspension system.

Abstract: A load store advisory program sets a breakpoint within a load-store sequence of a program, determines if the breakpoint will cause unexpected behavior, and generates a warning if it is determined that the breakpoint will cause unexpected behavior. The unexpected behavior may be the result of setting a breakpoint within a load-store sequence that, because of the breakpoint, will repeatedly fail.

Abstract: Facilitating communications within a processing environment. Inbound traffic and outbound traffic on one or more virtual interfaces of the processing environment are monitored for a predefined amount of time. Based on the monitoring, a determination is made as to whether for a selected component of a virtual interface of the one or more virtual interfaces an inbound frame has been received but an outbound frame has not been transmitted for the predetermined amount of time. Based on determining that the inbound frame has been received but the outbound frame has not been transmitted, a generated outbound frame is forwarded to cause address registration information for the virtual interface to be refreshed.

Abstract: A method for generating a circuit description for a multi-die field-programmable gate array, FPGA, comprising a first FPGA die and at least one further FPGA die is described. The method is performed in an FPGA design tool and comprises automatically evaluating a first and a second partition of a partitioned circuit description, the partitions being associated with respective ones of the FPGA dies. At least one multiplexing element is inserted into the first partition and a corresponding de-multiplexing element is inserted into the second partition based on the automated evaluation.

Abstract: Essential information for system operations, memory analysis, and design signal analysis is captured while a hardware based verification platform is performing emulation and testing. This recorded information is then accessible via a memory device and can be used to perform offline debugging with a virtual verification machine (VVM). Users can then release the shared resources and run operation commands to control replay of the design test or emulation in offline mode. Users can access any point in time of the recorded emulation in order to perform detailed design analysis and debugging operations. Offline analysis and debugging may include running certain design cycles, rerunning the emulation until the design reaches a certain state, evaluating memory contents in the design, evaluating design signals for any node in the design, etc.

Abstract: An input/output hub may include an interface unit and one or more communication units. Each communication unit may be configured to receive interrupts or messages from a corresponding endpoint device. A given communication unit may be further configured to synthesize a virtual address from the received message, translate the synthesized virtual address to a real address, and then translate the real address to a physical address. The interface unit may be configured to send an interrupt dependent upon the physical address.

Abstract: A method comprises generating a schematic of an integrated circuit (IC), the IC having a circuit component. The method also comprises searching a database having one or more configurations of the circuit component, each of the one or more configurations of the circuit component having a corresponding estimated resistance capacitance (RC) value and an assigned color scheme based on the estimated RC value. The method further comprises displaying the circuit component in the schematic as a symbol representing the circuit component, the symbol representing the circuit component being displayed having the assigned color scheme of a selected circuit component configuration. The method additionally comprises displaying a layout of the IC based on a determination that the schematic passed a design rule check, the displayed layout of the IC including the selected configuration of the circuit component, the selected configuration being displayed in the layout having the assigned color scheme.

Abstract: According to one embodiment, a self-test system integrated on a chip is provided, the chip including a functional logic module for performing a selected application. The self-test system includes a primary interface a primary interface to the functional logic module, the primary interface configured to interface with a primary device, an input interface protocol generator for generating a pattern to be inserted into the primary interface and a secondary interface to the functional logic module, the secondary interface configured to interface with a secondary device. The system also includes an emulator engine coupled to the secondary interface, the emulator engine for testing a function of the functional logic module based on the inserted patterns, the function being configured to communicate with a secondary device coupled to the secondary interface, wherein the emulator engine tests the function when no secondary device is coupled to the chip.

Abstract: A processor includes a core with logic to execute a translated instruction. The translated instruction is translated from an instruction stored in a memory location. The processor further includes a translation lookaside buffer including logic to store translation indicators from a physical map. Each translation indicator indicates whether a corresponding memory location includes translated code to be protected. The processor further includes a translation indicator agent including logic to determine whether the buffer indicates whether the memory location has been modified subsequent to translation of the instruction.

Abstract: The present disclosure is directed to methods and systems for malware detection based on environment-dependent behavior. Generally, an analysis environment is used to determine how input collected from an execution environment is used by suspicious software. The methods and systems described identify use of environmental information to decide between execution paths leading to malicious behavior or benign activity. In one aspect, one embodiment of the invention relates to a method comprising monitoring execution of suspect computer instructions; recognizing access by the instructions of an item of environmental information; identifying a plurality of execution paths in the instructions dependant on a branch in the instructions based on a value of the accessed item of environmental information; and determining that a first execution path results in benign behavior and that a second execution path results in malicious behavior.

Abstract: A message transmission system and method for a structure of a plurality of organizations are disclosed, where the system includes: a database, a server, a push gateway, and a mobile communications device. The database, the server, and the push gateway are combined into a cloud of the present disclosure. A plurality of pieces of member information is stored in the database, each piece of member information includes at least one organization ID, an account, and a password, different organization IDs are unique to each other, and each organization ID may define an organization as a single-level organization or a multi-level organization. A client may access the cloud by using a single App and a single interface to receive or transmit messages.

Abstract: A method for attesting use of an interactive component during a boot process, comprising the steps of: reading, in response to determining use of the interactive component, associated interactive input; determining whether the input should be trusted; and in response to determining that the input should be trusted, processing the input to create a trusted cryptographic value, further comprising: matching, in response to a subsequent interactive input being read, the subsequent interactive input with one or more of the trusted cryptographic values in order to determine whether the subsequent interactive input is trusted.

Abstract: A cluster compute server includes nodes coupled in a network topology via a fabric that source routes packets based on location identifiers assigned to the nodes, the location identifiers representing the locations in the network topology. Host interfaces at the nodes may be associated with link layer addresses that do not reflect the location identifier associated with the nodes. The nodes therefore implement locally cached link layer address translations that map link layer addresses to corresponding location identifiers in the network topology. In response to originating a packet directed to one of these host interfaces, the node accesses the local translation cache to obtain a link layer address translation for a destination link layer address of the packet. When a node experiences a cache miss, the node queries a management node to obtain the specified link layer address translation from a master translation table maintained by the management node.

Abstract: The present invention relates to a mobile terminal technology. The present invention discloses a data back method and device for a mobile terminal. Since the data backup method and device of the mobile terminal provided in the present invention encodes a data in the mobile terminal into UTF-8 and stores it in the xml file, it is quite convenient to back up the data in the mobile terminal to the xml file. It is also beneficial for a user to manage the data in the mobile terminal. The present invention provides convenience for the user, the operation is simple, and the backup is easy to be done.

Abstract: A cluster compute server comprises a fabric interconnect, a first node coupled to the fabric interconnect and comprising a network interface controller coupleable to an external network, and a second node coupled to the fabric interconnect and comprising a fabric interface to provide a set of one or more virtual network interface controllers representing the network interface controller of the first node. The one or more virtual network interface controllers each appear as a local network interface controller to software executed at the second node. The first node is to emulate one or more link aggregation partners for the set of one or more virtual network interface controllers.

Abstract: A method and system of providing additional lookup tables in an emulation processor cluster of an emulation chip of a hardware functional verification system is provided. An indirection table may be used within the processor cluster to provide the commonly-used function tables for the lookup tables (LUTs). The indirection table may be indexed according to a smaller portion of the standard LUT function table provided by an instruction than otherwise needed. The unused function table bits in the instruction may then be used for other purposes, including providing functionality to one or more extra LUTs of the processor cluster, whose function tables may be provided from another indirection table provided for that purpose. Additional processing capacity may thereby be provided for the cluster with a small amount of additional overhead within the emulation chip, while still providing the full range of function tables of the LUTs.

Abstract: A method, system or computer usable program product for managing virtual disk snapshots including utilizing a processor to create multiple disk containers containing multiple snapshots on a host machine persistent memory, and combining the multiple snapshots on a guest operating system to produce a final snapshot utilized by the guest OS as a virtual disk.

Abstract: A system for proactive resource reservation for protecting virtual machines. The system includes a cluster of hosts, wherein the cluster of hosts includes a master host, a first slave host, and one or more other slave hosts, and wherein the first slave host executes one or more virtual machines thereon. The first slave host is configured to identify a failure that impacts an ability of the one or more virtual machines to provide service, and calculate a list of impacted virtual machines. The master host is configured to receive a request to reserve resources on another host in the cluster of hosts to enable the impacted one or more virtual machines to failover, calculate a resource capacity among the cluster of hosts, determine whether the calculated resource capacity is sufficient to reserve the resources, and send an indication as to whether the resources are reserved.

Abstract: In a method for determining and scoring a signature for a software package. A processor determines a signature of a first software package, wherein the signature comprises an indication of a first set of files on a computer system after installation of the first software package that were not present on the computer system before the installation, and an indication of a second set of files not remaining on the computer system after an uninstall of the first software package. A processor compares the first and the second set of files indicated in the signature of the first software package to files indicated in one or more other signatures of other software packages. A processor determines a score for the signature of the first software package based on the comparison.

Abstract: A hardware-assisted integrity monitor may include one or more target machines and/or monitor machines. A target machine may include one or more processors, which may include one or more system management modes (SMM). A SMM may include one or more register checking modules, which may be configured to determine one or more current CPU register states. A SMM may include one or more acquiring modules, which may be configured to determine one or more current memory states. A SMM may include one or more network modules, which may be configured to direct one or more communications, for example of one or more current CPU register states and/or current memory states, to a monitor machine. A monitor machine may include one or more network modules and/or analysis modules. An analysis module may be configured to determine memory state differences and/or determine CPU register states differences.

Abstract: A process for creating a composite picture with a plurality of parts extrapolated from an input picture. The process includes analyzing a picture for color content to detect at least one dominant color in the picture and for shape recognition to detect at least one object in the picture and generating a concentric grid for the input picture based on the color content analysis and the shape recognition for a depth calculation of the input picture. The concentric grid includes a center point, a plurality of lines that radiate from the center point, and a plurality of concentric circles that expand at a spatial distance in the picture, dividing the input picture into a plurality of sections, each representing an equal spatial depth. The process further includes generating a plurality of partial pictures using at least two of the plurality of sections.

Abstract: The invention relates to a method and device for playing a content. The method comprising: reading a pre-stored content which include information relevant to a downloaded content; detecting available bandwidth; sending a request for downloading the downloaded content according to the information relevant to the downloaded content, wherein the request includes the information of the bandwidth; receiving the downloaded content according with the detected bandwidth; and playing the downloaded content combined with the pre-stored content. Because said method and device according to the present invention adopts the automatic real-time detection for the current usable bandwidth of the network playback device connected to, and it changes the quality of content requiring downloading, seamless playback can be realized, while avoiding the trouble due to the quality selection by the user himself.

Abstract: A method for time correction during an emulation of a native computing environment (NCE), including: obtaining, by an emulator, a code segment for execution within the NCE; identifying, during an execution of the code segment within the emulation, a first instance of a time sensitive (TS) instruction; initiating a first instruction sequence window (ISW) in response to identifying the first instance of the TS instruction; identifying, during the execution of the code segment within the emulation, a second instance of the TS instruction after initiating the first ISW; obtaining, in response to identifying the second instance during the first ISW, an expected time between execution of the first instance and the second instance of the TS instruction in the NCE; and inserting an aggregated delay based on the expected time during the execution of the code segment within the emulation.

Abstract: System and method for achieving reproducibility of a simulation operation while reasonably keeping an operation speed. A peripheral scheduler clears completion flags of all the peripheral emulators to thereby start parallel operations thereof. Then, based on processing break timing set for the individual peripheral emulators, the peripheral scheduler finds one of the peripheral emulators which is scheduled to reach a processing break at the earliest. The found peripheral emulator is referred to as a peripheral P. In a case where a time of the processing break of the peripheral P is T, the peripheral scheduler continues execution of processor emulators and plant simulators up until a time point of the time T. The peripheral scheduler waits for setting of a completion flag of the peripheral P. In response to the setting, the peripheral scheduler performs data synchronization among the peripheral P, the processor emulators, and the plant simulators.

Abstract: A method, system, and computer program are disclosed. Statistics are read from a data dictionary on a target system. The statistics include statistics for a table in a database in the target system. The statistics are exported to a test system separate from the target system. A command is received to use the statistics in emulation. In response the statistics are copied to a cache in the test system and the target system is emulated on the test system using the statistics in the test system's cache.

Abstract: It would be beneficial to allow one or more of information, applications, desktops, and in general any information to be shared between a computer and a communications device. For example, it would be useful to be able to move a presentation from a computer to a mobile communications device. Some solutions attempt to address this by requiring a user to load the information on a laptop, USB key, burn it to an optical disk or the like, and then “open” the information on another device located at the remote destination. In one embodiment, through the use of one or more of virtualization and content translation, any information and/or applications can be exchanged between a computer and a communications device. More specifically, one embodiment utilizes metadata in conjunction with a virtualization environment to allow the exchange of information and/or applications between a personal computer and a communications device, or vice versa.

Abstract: A cruise control arrangement for a vehicle includes a cruise control speed function, a cruise control brake function and at least one selectable economy level, having a set maximum speed value corresponding to a maximum allowed vehicle speed, a set brake speed value corresponding to a brake cruise speed and a set cruise speed value corresponding to a cruise speed, where a temporary brake speed value replaces the set brake speed value as the actually used brake speed value, and where the temporary brake speed value is dependent on the selected economy level. The behavior of the cruise control of a vehicle can be adapted to take account of economy, which makes it possible to optimize the fuel consumption of the vehicle.

Abstract: As described herein, a tool records a log (or trace) of all sources of non-determinism in the system. In most of the cases, it's enough to log all transitions and the exact timestamps at all the entry and exit points of the system. By using this information it is possible to recreate a cycle accurate execution of the hardware system in simulation. Unlike CHIPSCOPE and SIGNALTAP which let you monitor a small number of signals in the design, the tool provides visibility into the whole system.

Abstract: An information handling system is provided. The information handling system includes at least one network switch. The at least one network switch includes a network access port receiving network packets including management information at least one processing unit, the at least one processing unit transmitting and receiving serial information. The at least one network switch also includes a baseband management controller coupled between the network access port and the at least one processing unit, the baseband management controller converting the serial information into network information and converting the network packets into serial information and a remote management terminal coupled to the at least one network switch, the remote management terminal transmitting the network packets including management information to the network switch for remotely managing the network switch.

Abstract: In a method for determining signatures for a software package, a processor compares files on a computer system after an installation of a software package to files on the computer system before the installation. The processor determines a signature of the software package. The signature includes an indication of files on the computer system after the installation of the software package that were not present on the computer system before the installation. The processor compares files remaining on the computer system after an uninstall of the first software package to the files on the computer system after the installation of the first software package. The processor determines one or more files indicated in the first signature not remaining on the computer system after the uninstall of the first software package.