Abstract: A software tool is provided to analyze static source code. Source Code files are selected to define the project work space. A class and a method in the class are selected from said selected source code files. The tool generates a Call Tree as an ordered recursive sequence of all method calls in different classes or their instances that are invoked by said selected method in said selected class. A Sequence Diagram is generated from said Call Tree. The tool remembers all updates to the Call Tree used to generate the Sequence Diagram. This information is used when a generated Sequence Diagram is impacted due to changes made to any source code file included in the project.

Abstract: Systems and methods for detecting a potential deadlock in a computing execution environment are provided. A plurality of locks taken during one or more test runs are monitored. A runtime identity and a code location for each of the plurality of locks are identified during each test run. One or more locks among the plurality of locks are classified as same locks based on the runtime identity and code location identified for each lock.

Abstract: A method/system for avoiding software conflicts, with library being divided into layer 1 to layer M and M?1.

Abstract: A software tool is provided to analyze static source code. Source Code files are selected to define the project work space. A class and a method in the class are selected from said selected source code files. The tool generates a Call Tree as an ordered recursive sequence of all method calls in different classes or their instances that are invoked by said selected method in said selected class. A Sequence Diagram is generated from said Call Tree. The tool remembers all updates to the Call Tree used to generate the Sequence Diagram. This information is used when a generated Sequence Diagram is impacted due to changes made to any source code file included in the project.

Abstract: A method of a fast system call is provided. First, a logical operation to compute a kernel service routine is used. Then the logical operation result is compared with ciphertext from a key register. At least one input for the logical operation is from the relevant information of the required kernel service routine. For example, the start address of the kernel service routine or the content of the start address of the kernel service routine, or combinations thereof. If the logical operation result equals to the ciphertext of the key register, a switch from a user mode to a kernel mode to read the kernel service routine is allowed. Otherwise, the central processing system executes a corresponding exceptional handler routine. Then the operating system terminates the mode switch request and reports an error to the operating system.

Abstract: Apparatus, method, and computer readable medium for generating and utilizing a feature code to monitor a program are provided. The program is run in a secure environment at the beginning. The program calls a function through an application program interface. A return address of the application program interface is used to generate the feature code. When the application runs again at another time, the feature code is utilized to monitor the program. According to the aforementioned arrangement and steps, the application program interface can be monitored dynamically. Consequently, any program can be monitored by this approach, which results in a more secure environment. Further, fewer application program interfaces are required to be monitored, so the required computer resource is less.

Abstract: Computer implemented method, system and computer usable program code for profiling the execution of an application that is both space- and time-efficient and highly accurate. A computer implemented method for profiling the execution of an application includes sampling execution characteristics of the application at a plurality of sampling points to provide samples, and deriving a calling context of the samples. The application is continuously executed between sampling points while additional profiling data is gathered.

Abstract: A system and method for dynamically building applications for stream processing includes providing processing elements with a flow specification describing each input and a stream description describing each output such that the flow specification indicates a stream or streams which are to be received based on processing information and the stream descriptions indicate the processing information. Processing elements that can be reused are identified by determining equivalence between the processing elements. Processing elements that are new and are not reusable are instantiated in a flow graph. An application is dynamically composed, using the instantiated processing elements by routing available streams to the instantiated processing elements in accordance with the flow specifications.

Abstract: This paper describes preferential path profiling, which enables profiling a specified subset of all possible program paths with very low overhead. Preferential path profiling compactly identifies paths of interest using an array. More specifically, PPP assigns a unique and compact path index identifier to all interesting paths that can be used to index into a path array. The path array contains a second path value identifier that is used to distinguish interesting paths from other program paths This path numbering allows the implementation of preferential path profiling to use array-based counters instead of hash table-based counters for identifying paths of interest and gathering path profiles, which significantly reduces execution time and computational resource overhead during profiling.

Abstract: A method of detecting recursive instantiation loops in a wireless application. A data model digraph is constructed including a respective node for each data component in the wireless application, and a respective edge for each relationship between a pair of data components. The data model digraph is searched to identify any cycles. For each identified cycle, each data component that participates in the cycle is identified.

Abstract: This invention is to provide a technology for taking out trace information externally without lacking under the condition of limited output bandwidth. A semiconductor integrated circuit provided includes: a processing unit which can perform arithmetic processing according to a predetermined program and can output trace information with respect to the arithmetic processing; and a trace compression unit which can compress the trace information outputted from the processing unit. The trace compression unit includes a storage device, a comparator unit which can compare trace information stored in the storage device and the trace information newly outputted from the processing unit, and a trace information compression controller which can compress trace information to be externally outputted, based on the comparison result of the comparator unit.

Abstract: Symbolic execution identifies possible execution paths of a computer program or method, each having certain constraints over the input values. The symbolic execution also records updates of memory locations, e.g. updates of the fields of symbolic objects in the heap of an object oriented program, involving a description of the previous heap, the updated symbolic object, a field identification, and a newly assigned symbolic value. The symbolic execution can also record calls to summarized methods, involving a description of previous calls, an identification of the summarized methods, and its symbolic arguments. The behavior of summarized methods can be expressed by axioms. Axioms describe the relationship between summarized methods under certain conditions. Axioms can be generated from parameterized unit tests. A parameterized unit test is a method with parameters which executes a sequence of calls to methods of an implementation under test; it asserts constraints over the inputs and outputs of the calls.

Abstract: A method for preventing a return address from being falsified due to a buffer overflow during the program execution, and for detecting the buffer-overflow beforehand. When the return address is re-written during program execution, the debug function of the central processing unit is used to output an error. The falsification of the return address is detected through the error output. Then the falsified return address is re-written to a value stored in advance to enable the program to return to normal operation. When the falsification of the return address is detected, the executing program is terminated.

Abstract: A system and method for collecting and correlating information about development of a computer software, including software tools reports. The system and method provides overview of entire software development lifecycle, provides decision support engine for project management, allows estimation of project timelines based upon empirical data, allows evaluation of project quality based upon empirical data, and correlates information from previous projects to estimate progress of current project (confidence factors). The system and method for collecting and correlating information about development of a computer software include collecting data from a plurality of software tools during each point in lifecycle of the computer software; storing the collected data in a database; and correlating the stored collected data to monitor the development of the computer software.

Abstract: A mechanism for determining a probabilistic security score for a software package is provided. The mechanism calculates a raw numerical score that is probabilistically linked to how many security vulnerabilities are present in the source code. The score may then be used to assign a security rating that can be used in either absolute form or comparative form. The mechanism uses a source code analysis tool to determine a number of critical vulnerabilities, a number of serious vulnerabilities, and a number of inconsequential vulnerabilities. The mechanism may then determine a score based on the numbers of vulnerabilities and the number of lines of code.

Abstract: Techniques are disclosed for debugging heterogeneous applications in a distributed environment. In one embodiment, an architecture for debugging heterogeneous applications in a distributed environment is configured to enable both location transparency and dynamic exposure of service state. Regardless of where the physical application state resides, the architecture describes or otherwise provides a mechanism that allows seamless debugging and troubleshooting of distributed applications. The location of the state is transparent to the debugger and the application being debugged. In addition, the architecture enables an individual service to expose its state dynamically at run-time. It is possible for the service to expose its state in a self-describing fashion, allowing service state to be exposed in the architecture regardless of the service environment.

Abstract: A method, apparatus, and computer instructions for determining computer flows autonomically using hardware assisted thread stack and cataloged symbolic data. When a new thread is spawned during execution of a computer program, new thread work area is allocated by the operating system in memory for storage of call stack information for the new thread. Hardware registers are set with values corresponding to the new thread work area. Upon context switch, values of the registers are saved in a context save area for future restoration. When call stack data is post-processed, the operating system or a device driver copies call stack data from the thread work areas to a consolidated buffer and each thread is mapped to a process. Symbolic data may be obtained based on the process identifier and address of the method/routine that was called/returned in the thread. Corresponding program flow is determined using retrieved symbolic data and call stack data.

Abstract: A computer-implemented method for detecting program bugs in source code of a computer program that includes a plurality of source modules, each of the plurality of source modules including at least a set of subroutines, is provided. The method includes performing summary collection on subroutines of the plurality of source modules. Performing the summary collection includes collecting first data pertaining to at least untrusted data in each of the subroutines of the plurality of source modules. The method also includes storing the first data in a set of intermediate files. The method further includes performing interprocedural analysis on the set of intermediate files. The interprocedural analysis is configured to identify at least first untrusted data in a given subroutine of the subroutines of the plurality of source modules and to map a data flow tracking the first untrusted data across at least two of the plurality of source modules.

Abstract: A system and method for debugging a computer program by using a call graph. A call graph that represents trace events during execution of a debuggee program may be used as input to a system that enables a user to debug the debuggee program. Mechanisms facilitate conditionally forming clusters of event nodes, a cluster indicative of multiple event nodes corresponding to an execution of a source language statement. During a debugging session, in response to a command to perform a step operation, the nodes of a cluster are processed together so that a step corresponds to multiple events if the multiple events correspond to a single source language statement. A mechanism for inspecting variables is provided. Variable values may be selectively propagated and provided based on the call graph and a static control flow analysis of the debuggee program.

Abstract: A system and method for generating a computer program call graph. A profiler may insert probes into a debuggee computer program, the probes generating call trace events. Checkpoints may be performed during execution of the debuggee program, so that a snapshot of the call stack is performed. Call trace events and checkpoint snapshots are logged and serialized. Logged call trace events and checkpoints may be retrieved and used in combination to generate a call graph and a shadow stack. Mechanisms facilitate combining the different sources of debuggee program information and determining whether the call graph and shadow stack are determinate or indeterminate at any time. The mechanisms may provide for improved accuracy of generated call graphs.

Abstract: A computer-implemented method of finding portions of a computer program exhibiting irregular performance can include detecting an entry into a function of a computer program under test indicating a current execution of the function and, responsive to detecting an exit from the function, determining a count of a computing resource utilized by the function during the current execution of the function. The count of the computing resource can be compared with a predetermined count range to determine whether the function is nonconforming to the predetermined count range. Usage information for the computer program under test can be output to a display of an electronic device resource, the resource usage information indicating that the function does not conform to the predetermined count range.

Abstract: A technique for feedback-directed call graph expansion includes performing symbolic analysis on an interprocedural control flow graph representation of software code, skipping over a virtual method call in the control flow graph, using information obtained from the symbolic analysis as feedback to identify a target of the virtual method call, and iterating the symbolic analysis on a modified version of the control flow graph that associates the target with the virtual method.

Abstract: The present invention is directed to automatically analyzing software systems for identifying faults or bugs and/or detection of malicious code. In various embodiments, the present invention measures code coverage for high priority invocable program elements, uses a relaxed coverage estimation technique that, instead of guaranteeing which code units will be executed, guarantees that at least a certain number of code units will be executed, determines and solves constraints in code to identify infeasible paths containing one or more selected nodes, determines, for a composite data type, a range of values for each of at least two non-composite data fields, and/or translates, prior to code analysis complex code into simpler code having fewer operators.

Abstract: Disclosed is a configuration for directly accessing a first computing system from a browser executing within a second computing system. One embodiment includes defining a browser code script for executing a predefined function call and defining a plurality of call functions executable by the browser code script. Each call function corresponds with a particular function on the first computing device. A direct communication link is established between a communication device driver on the second computing system and a communication device driver on the first computing system in response to the browser code script executing at least one call function of the plurality of call functions.

Abstract: A method and system automatically generates flow charts of call flow programs used in a call center based on information about the call flow program and other telephone system resources collected from the call center. Such collected information includes automatic call distributor (ACD) programming. The method and system generate the flow chart of the call flow programs without prior knowledge of such collected information.

Abstract: Embodiments of the present invention provide for minimizing the number of procedure frame unwinding operations to be performed when restoring the program control flow information. A first data structure may be constructed to contain procedure linkage information along with references to the conventional memory area where each procedure linkage information element (procedure return address or a procedure frame pointer) was originally found. The first data structure may be initialized upon the initial request for program control flow information. Upon each subsequent request, the contents of the conventional memory area as referenced by the first data structure may be compared with the corresponding elements of the first data structure. As a result of said comparison, changed and unchanged regions within the conventional memory area may be determined. Then, procedure frame unwinding operations may be performed for the changed regions.

Abstract: The described technology provides data structure path profiling. An instrumented version of a program is created that calls a profiler runtime when pointer based data structures are allocated or accessed via pointers. A model of the heap is created and nodes in the model data structures are assigned unique identifiers. Paths traversed through the model data structures are assigned unique identifiers. The paths are counted in order to identify paths through the data structure model that are traversed frequently. The model is useful for providing information about high frequency data paths to the program developer and for various optimization purposes, such as prefetching and or increasing data locality during garbage collection.

Abstract: A computer implemented technique framework, prototype tool and associated methods that provide a high degree of visibility and control over the in-field execution of software in a minimally intrusive manner wherein developer-defined correctness tests and validation logic are embedded into the sensor node itself, making in-field software testing autonomous without necessitating continuous developer participation.

Abstract: A method for static code analyzing customizations to a pre-packaged computing solution can include establishing a communicative connection from a recommendation generation module to a pre-packaged computing solution and authenticating into the pre-packaged computing solution. Customized program code can be extracted from the pre-packaged computing solution and a call graph of the customized program code can be constructed such that the call graph indicates method calls to different interfaces for program code of the pre-packaged computing solution. Finally, a report can be generated identifying customized program code to be adapted to a new version of the pre-packaged computing solution based upon changes in the different interfaces shown by the call graph to be used in the new version of the pre-packaged computing solution and modifications required for the customized program code to call the different interfaces in the new version of the pre-packaged computing solution.

Abstract: Systems and methods are provided for identifying and displaying dependencies. One aspect of the invention comprises a system having a dependency parser that parses components of a system with dependencies and generates a plurality of component dependency pairs associated with the components, and a component dependency graph generator that generates a dependency directed graph from the plurality of dependency pairs. The system further includes a component levels and cycles analyzer that traverses the dependency directed graph to identify dependencies, strong components and component dependency levels associated with the dependency directed graph, and a graphical user interface that provides a tree view illustrating a dependency tree of the identified dependencies over the identified component dependency levels.

Abstract: Techniques for verifying a signature of an executable file are disclosed. In one particular exemplary embodiment, the techniques may be realized as a computer-implemented method for verifying a signature of a first executable file, comprising creating a first functional flow graph from the first executable file, storing the first functional flow graph, receiving, using a processor, a rule for the first executable file, and storing the rule. The techniques may also comprise receiving a second executable file, creating a second functional flow graph from the second executable file, determining whether a difference between the first functional flow graph and the second functional flow graph is less than a tolerance, and when it is determined that the difference between the first functional flow graph and the second functional flow graph is less than the tolerance, applying the rule to the second executable file.

Abstract: The present invention is directed to automatically analyzing software systems for identifying faults or bugs and/or detection of malicious code. In various embodiments, the present invention measures code coverage for high priority invocable program elements, uses a relaxed coverage estimation technique that, instead of guaranteeing which code units will be executed, guarantees that at least a certain number of code units will be executed, determines and solves constraints in code to identify infeasible paths containing one or more selected nodes, determines, for a composite data type, a range of values for each of at least two non-composite data fields, and/or translates, prior to code analysis complex code into simpler code having fewer operators.

Abstract: A method monitors non-faulty application traces of a computer application with the runtime environment during fault-free activities to create non-faulty runtime signatures for the computer application. Once obtained, the method stores the non-faulty runtime signatures. The method then detects a faulty application trace of the computer application and compares the faulty application trace with the non-faulty runtime signatures by comparing a call graph of the faulty application trace with call graphs of non-faulty application traces of the application signatures to identify differences between the two (e.g., fault attributes). Then the invention outputs the fault attributes to allow the user to identify a fault cause.

Abstract: A system and method for model checking of concurrent multi-threaded programs with bounded lock chains includes analyzing individual program threads in a concurrent multi-threaded program to determine sets of reachable states and lock access patterns for bounded lock chains by tracking sets of states reachable from a given set of states and tracking lock acquisitions and releases by maintaining a bi-directional lock causality graph. Analysis results from multiple threads are combined using an acceptance condition of the lock causality graph to determine whether there is a violation of a correctness property in the concurrent multi-threaded program.

Abstract: An automated software class specification validation tool automatically determines, for functions defined in a function definition section of a class specification, whether the function is properly declared throughout one or more other sections of the same class specification. Further, it can be determined whether variables, i.e., attributes, parameters, and local variables, associated with respective functions in the function definition section are properly specified throughout one or more other sections of the same class specification. The functions and variables that are validated include attributes and functions that are specified for structures and nested classes defined in a defined type section of the class specification. The validation tool is accessible over a network via a web page, and results of the validation process are also displayed on a web page.

Abstract: Systems and methods that alleviate programmers of the burden of writing extensive code to implement a context switch for a particular piece of software code. For software code for which a context switch is desired, a declaration of the context and its attributes may be included in the code, along with an indication of the boundaries of the portion of the code to be executed within the context. No further programming for particular piece of code may be necessary in order to implement the context switch. An execution engine may be configured to identify the declaration and the indication of the boundaries, control the generation of the context, and control (or at least initiate) the execution of the software code within the generated context. Thus, from the perspective of the programmer of the piece of code, the context switch may seem transparent.

Abstract: The present invention is directed to automatically analyzing software systems for identifying faults or bugs and/or detection of malicious code. In various embodiments, the present invention measures code coverage for high priority invocable program elements, uses a relaxed coverage estimation technique that, instead of guaranteeing which code units will be executed, guarantees that at least a certain number of code units will be executed, determines and solves constraints in code to identify infeasible paths containing one or more selected nodes, determines, for a composite data type, a range of values for each of at least two non-composite data fields, and/or translates, prior to code analysis complex code into simpler code having fewer operators.

Abstract: Computer implemented method, system and computer usable program code for profiling the execution of an application that is both space- and time-efficient and highly accurate. A computer implemented method for profiling the execution of an application includes sampling execution characteristics of the application at a plurality of sampling points to provide samples, and deriving a calling context of the samples. The application is continuously executed between sampling points while additional profiling data is gathered.

Abstract: Methods and apparatus for checking the compliance of a file with global and custom standards are disclosed. According to one aspect of the present invention, a method for checking a file that is associated with a first set of standards and a second set of standards into a repository includes providing the file to a checking arrangement that includes a checking tool and an adapter that is interfaced with the checking tool. The method also includes executing the checking tool to determine compliance of the file with the first set of standards, and executing the adapter to determine compliance of the file with the second set of standards.

Abstract: A system and method for determining execution path differences in a computer-implemented software application is provided herein. A software application under analysis is executed at least twice, thereby generating first and second call tree data and associated first and second sets of execution data describing the at least two executions of the software application. This data is then compared to determine a set of differences between the first and second executions of the program, the set of differences comprising one or more nodes that are either called differently in the first and second execution paths or executed differently in the first and second sets of execution data. For each node identified in the set of differences, the first and second call trees are then analyzed to identify at least one parent node that is the root cause of the difference in the execution data.

Abstract: The branch origin address and branch destination address of a branch instruction (jmp instruction) are stored, a judgment is made as to whether or not a call instruction for calling an instruction code group for executing an external command is associated with the branch destination address, a judgment is made as to whether or not the call destination address is between the branch origin address and the branch destination address if the call instruction is associated with the branch destination address, and information indicating that malicious code was detected is generated if the call destination of the call instruction is between the branch origin address and the branch destination address.

Abstract: A program generation program used in a personal computer processes information on relationship between an action and a pair of a state of a system and an event to create a program for incorporating a new state in a state transition table. The computer reads the state transition table in a storage medium and selects the state specified in the state transition table. The computer generates a program that determines whether the selected state is an exceptional state or a normal state on the basis of state information in the state transition table. Based on the result of the determination, the program performs an action including a state transition or a process allocated to the exceptional state specified in the state transition table when the state is the exceptional.

Abstract: The computer program enables a computer to function as: means for transforming a static call graph into a syntax tree having a binary tree structure; means for transforming a protocol state diagram into a stochastic process algebraic form; means for transforming an activity diagram into a stochastic process algebraic form; means for obtaining a stochastic process algebraic form of each of classes by merging the stochastic process algebraic form of the protocol state diagram, and the stochastic process algebraic form of the activity diagram; and means for obtaining a stochastic algebraic form of a whole system from the syntax tree, and from the stochastic process algebraic forms of the classes.

Abstract: A method for the static analysis of concurrent multi-threaded software which bypasses the state explosion situation that plagues the prior art, thereby making our method scalable while—at the same time—producing no loss in precision. Our inventive method maintains patterns of lock acquisition and lock release by individual threads by constructing augmented versions of the threads. Once the augmented versions have been constructed, our inventive method verifies the concurrent program using existing tools for the verification of sequential programs—thereby greatly reducing implementation overhead. Finally, our inventive augmentation and method is carried out in an automatic manner—without requiring user intervention.

Abstract: For identification of the quality of trustworthiness and reliability of software components, an eigenvector based approach is used in which a procedure invocation graph of a set of software components is provided. Subsequently, the authoritativeness of a first software component is calculated as a function of an eigenvector of the provided procedure invocation graph. For calculating the authoritativeness, a flexible algorithm, which considers background knowledge is used. Applying the method, software code can be analyzed more efficiently. The method can be applied in software code analysis and/or in software architecture analysis.

Abstract: A system, method, and computer program for analyzing code execution and software performance characteristics are disclosed. Samples of executing code may be taken based on any of a number of various triggers. For example, samples may be triggered based on function calls, such as malloc calls. Alternatively, samples may be triggered based on occurrence of a specified event. Code execution is graphically displayed such that certain patterns may be easily identified. Multiple redundant function calls and areas of code having excessively deep function calls can be readily spotted. Such areas represent opportunities for performance optimization.

Abstract: To improve upon existing Winsock implementations, the claimed system and method adapts an existing Winsock system to use out-of-process NSP services. The claimed method and system provides asynchronous Winsock Next calls to provide client application processing flexibility. Further, the claimed method and system provides additional structures for passing additional NSP specific information for a result set to enable further client functionality. One embodiment of the claimed system provides additional client Winsock API functions to aggregate and manage asynchronous calls to multiple NSPs and/or multiple namespaces.

Abstract: A device (100) for managing a plurality of software items, the device (100) comprising an analysis unit (103) adapted for analyzing a functional correlation between the plurality of software items, and a grouping unit (105) adapted for grouping functionally correlated ones of the plurality of software items together in a common memory space.

Abstract: A process of analyzing performance of a computer program including a plurality of components includes steps of: receiving a call tree profile having a plurality of nodes, each node representing an invocation and each node being annotated with a cumulative performance cost for the node; a set of one or more components of interest to a user; and a threshold level of a cumulative performance cost associated with invocations of methods of the component that constitutes an expensive method invocation; analyzing the call tree profile from leaf nodes, the analyzing step comprising selecting a set of one or more components of interest to a user and selecting only invocations that exceed the threshold level, and pruning the set of invocations that are not selected. Finally the process includes a step of presenting to the user a list of costs associated with the selected invocations.

Abstract: A system, method, and computer program for analyzing code execution and software performance characteristics are disclosed. Samples of executing code may be taken based on any of a number of various triggers. For example, samples may be triggered based on function calls, such as malloc calls. Alternatively, samples may be triggered based on occurrence of a specified event. Code execution is graphically displayed such that certain patterns may be easily identified. Multiple redundant function calls and areas of code having excessively deep function calls can be readily spotted. Such areas represent opportunities for performance optimization.