Code Instrumentation with Mod-BEAM
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
How Can Java Class Files Be Decompiled?
HOW CAN JAVA CLASS FILES BE DECOMPILED? David Foster Chamblee High School 11th Grade Many computer science courses feature building a compiler as a final project. I have decided to take a spin on the idea and instead develop a decompiler. Specifically, I decided to write a Java decompiler because: one, I am already familiar with the Java language, two, the language syntax does not suffer from feature-bloat, and three, there do not appear to be many Java decompilers currently on the market. I have approached the task of writing a decompiler as a matter of translating between two different languages. In our case, the source language is Java Virtual Machine (VM) Bytecode, and the target language is the Java Language. As such, our decompiler will attempt to analyze the semantics of the bytecode and convert it into Java source code that has equivalent semantics. A nice sideeffect of this approach is that our decompiler will not be dependent upon the syntax of the bytecodes, the compiler used to generate the bytecodes, or the source language (possibly not Java). It will only care whether a class-file’s semantics can be represented in the Java language. Decompilation is divided up into six phases: 1. Read opcodes 2. Interpret opcode behavior 3. Identify Java-language “idioms” 4. Identify patterns of control-flow 5. Generate Java-language statements 6. Format and output to file The first four phases will be discussed in detail within this paper, as they were the primary focus of my research. Further details pertaining to these phases can be gleaned from the accompanying log book. -
Advanced Programming for the Java(TM) 2 Platform
Advanced Programming for the Java(TM) 2 Platform Training Index Advanced Programming for the JavaTM 2 Platform By Calvin Austin and Monica Pawlan November 1999 [CONTENTS] [NEXT>>] [DOWNLOAD] Requires login As an experienced developer on the JavaTM platform, you undoubtedly know how fast moving and comprehensive the Early Access platform is. Its many application programming interfaces (APIs) Downloads provide a wealth of functionality for all aspects of application and system-level programming. Real-world developers never use one Bug Database or two APIs to solve a problem, but bring together key Submit a Bug functionality spanning a number of APIs. Knowing which APIs you View Database need, which parts of which APIs you need, and how the APIs work together to create the best solution can be a daunting task. Newsletters Back Issues To help you navigate the Java APIs and fast-track your project Subscribe development time, this book includes the design, development, test, and deployment phases for an enterprise-worthy auction Learning Centers application. While the example application does not cover every Articles possible programming scenario, it explores many common Bookshelf situations and the discussions leave you with a solid methodology Code Samples for designing and building your own solutions. New to Java Question of the Week This book is for developers with more than a beginning level of Quizzes understanding of writing programs in the Java programming Tech Tips language. The example application is written with the Java® 2 Tutorials platform APIs and explained in terms of functional hows and whys, so if you need help installing the Java platform, setting up your Forums environment, or getting your first application to work, you should first read a more introductory book such as Essentials of the Java Programming Language: A Hands-On Guide or The Java Tutorial. -
Information Retrieval from Java Archive Format
Eötvös Loránd University Faculty of Informatics Department of Programming Languages and Compilers Information retrieval from Java archive format Supervisor: Author: Dr. Zoltán Porkoláb Bálint Kiss Associate Professor Computer Science MSc Budapest, 2017 Abstract During the course of my work, I contributed to CodeCompass, an open source code comprehension tool made for making codebase of software projects written in C, C++ and Java more understandable through navigation and visualization. I was tasked with the development of a module for recovering code information of Java classes in JAR files. This document details background concepts required for reverse- engineering Java bytecode, creating a prototype JAR file reader and how this solu- tion could be integrated to CodeCompass. First, I studied the structure of JAR format and how class files are stored in it. I looked into the Java Class file structure and how bytecode contained in class gets interpreted by the Java Virtual Machine. I also looked at existing decompilers and what bytecode libraries are. I created a proof-of-concept prototype that reads compiled classes from JAR file and extracts code information. I first showcased the use of Java Reflection API, then the use of Apache Commons Byte Code Engineering Library, a third-party bytecode library used for extracting and representing parts of Java class file as Java objects. Finally, I examined how CodeCompass works, how part of the prototype could be integrated into it and demonstrated the integration through parsing of a simple JAR file. i Acknowledgements I would like to thank Dr. Zoltán Porkoláb, Associate Professor of the Department of Programming Languages and Compilers at the Faculty of Informatics for admit- ting me to the CodeCompass project, supplying the thesis topic and helping with the documentation. -
Opportunities and Open Problems for Static and Dynamic Program Analysis Mark Harman∗, Peter O’Hearn∗ ∗Facebook London and University College London, UK
1 From Start-ups to Scale-ups: Opportunities and Open Problems for Static and Dynamic Program Analysis Mark Harman∗, Peter O’Hearn∗ ∗Facebook London and University College London, UK Abstract—This paper1 describes some of the challenges and research questions that target the most productive intersection opportunities when deploying static and dynamic analysis at we have yet witnessed: that between exciting, intellectually scale, drawing on the authors’ experience with the Infer and challenging science, and real-world deployment impact. Sapienz Technologies at Facebook, each of which started life as a research-led start-up that was subsequently deployed at scale, Many industrialists have perhaps tended to regard it unlikely impacting billions of people worldwide. that much academic work will prove relevant to their most The paper identifies open problems that have yet to receive pressing industrial concerns. On the other hand, it is not significant attention from the scientific community, yet which uncommon for academic and scientific researchers to believe have potential for profound real world impact, formulating these that most of the problems faced by industrialists are either as research questions that, we believe, are ripe for exploration and that would make excellent topics for research projects. boring, tedious or scientifically uninteresting. This sociological phenomenon has led to a great deal of miscommunication between the academic and industrial sectors. I. INTRODUCTION We hope that we can make a small contribution by focusing on the intersection of challenging and interesting scientific How do we transition research on static and dynamic problems with pressing industrial deployment needs. Our aim analysis techniques from the testing and verification research is to move the debate beyond relatively unhelpful observations communities to industrial practice? Many have asked this we have typically encountered in, for example, conference question, and others related to it. -
Addresssanitizer + Code Coverage Kostya Serebryany, Google Eurollvm 2014 New and Shiny -Fprofile-Instr-Generate
AddressSanitizer + Code Coverage Kostya Serebryany, Google EuroLLVM 2014 New and shiny -fprofile-instr-generate ● Coming this year ● Fast BB-level code coverage ● Increment a counter per every (*) BB ○ Possible contention on counters ● Creates special non-code sections ○ Counters ○ Function names, line numbers Meanwhile: ASanCoverage ● Tiny prototype-ish thing: ○ Part of AddressSanitizer ○ 30 lines in LLVM, 100 in run-time ● Function- or BB- level coverage ○ Booleans only, not counters ○ No contention ○ No extra sections in the binary At compile time: if (!*BB_Guard) { __sanitizer_cov(); *BB_Guard = 1; } At run time void __sanitizer_cov() { Record(GET_CALLER_PC()); } At exit time ● For every binary/DSO in the process: ○ Dump observed PCs in a separate file as 4-byte offsets At analysis time ● Compare/Merge using 20 lines of python ● Symbolize using regular DWARF % cat cov.c int main() { } % clang -g -fsanitize=address -mllvm -asan-coverage=1 cov. c % ASAN_OPTIONS=coverage=1 ./a.out % wc -c *sancov 4 a.out.15751.sancov % sancov.py print a.out.15751.sancov sancov.py: read 1 PCs from a.out.15751.sancov sancov.py: 1 files merged; 1 PCs total 0x4850b7 % sancov.py print *.sancov | llvm-symbolizer --obj=a.out main /tmp/cov.c:1:0 Fuzzing with coverage feedback ● Test corpus: N random tests ● Randomly mutate random test ○ If new BB is covered -- add this test to the corpus ● Many new bugs in well fuzzed projects! Feedback from our customers ● Speed is paramount ● Binary size is important ○ Permanent & temporary storage, tmps, I/O ○ Stripping non-code -
Advanced-Java.Pdf
Advanced java i Advanced java Advanced java ii Contents 1 How to create and destroy objects 1 1.1 Introduction......................................................1 1.2 Instance Construction.................................................1 1.2.1 Implicit (Generated) Constructor.......................................1 1.2.2 Constructors without Arguments.......................................1 1.2.3 Constructors with Arguments........................................2 1.2.4 Initialization Blocks.............................................2 1.2.5 Construction guarantee............................................3 1.2.6 Visibility...................................................4 1.2.7 Garbage collection..............................................4 1.2.8 Finalizers...................................................5 1.3 Static initialization..................................................5 1.4 Construction Patterns.................................................5 1.4.1 Singleton...................................................6 1.4.2 Utility/Helper Class.............................................7 1.4.3 Factory....................................................7 1.4.4 Dependency Injection............................................8 1.5 Download the Source Code..............................................9 1.6 What’s next......................................................9 2 Using methods common to all objects 10 2.1 Introduction...................................................... 10 2.2 Methods equals and hashCode........................................... -
Java Class Annotation Example
Java Class Annotation Example Bud etherealizing her matriarch inimitably, unwavering and decayed. Antimonious and regulation Rog violated almost anywhere, though Saunderson tosses his Creon outdating. Which Roland disinhuming so ordinarily that Westleigh tooth her opposites? It is class to classes are pretty easy to reflection to list to catch, company or property to generate mock for? First method of java example. The java are given list of bibliography. Default annotations example, java code examples of the compiler to be applied to json. The new project for extracting information to create web sites without editions but i go into the annotated bibliography paper, we welcome to isolate the mechanics of using. Parsing the examples can be used from open source and. We will utilize the class analyzes the same type declaration etc at runtime reflection methods or evaluative lists the suite itself which are. Nice explanation about the front controller, we added and then issues a class of the information, management example demonstrates how can be executed and. There are working standalone spring boot application into system proposed here, because of annotations. Its annotations example annotation examples java. Hibernate does not to class or specify java example of fundamental never hurt or not. Read from java class acts as each article has been designed with examples select then we learned about? We made as classes that class or examples of annotation example classes or an earlier article example it tells spring. The table pointing back to interface. From java example is applied only contains a second argument. Junit provides a test cases, we want specific warnings and ideas into our newsletter for an understanding takt time in. -
Java and C I CSE 351 Autumn 2016
L26: JVM CSE351, Spring 2018 Java Virtual Machine CSE 351 Spring 2018 Model of a Computer “Showing the Weather” Pencil and Crayon on Paper Matai Feldacker-Grossman, Age 4 May 22, 2018 L26: JVM CSE351, Spring 2018 Roadmap C: Java: Memory & data Integers & floats car *c = malloc(sizeof(car)); Car c = new Car(); x86 assembly c->miles = 100; c.setMiles(100); c->gals = 17; c.setGals(17); Procedures & stacks float mpg = get_mpg(c); float mpg = Executables free(c); c.getMPG(); Arrays & structs Memory & caches Assembly get_mpg: Processes language: pushq %rbp Virtual memory movq %rsp, %rbp ... Memory allocation popq %rbp Java vs. C ret OS: Machine 0111010000011000 code: 100011010000010000000010 1000100111000010 110000011111101000011111 Computer system: 2 L26: JVM CSE351, Spring 2018 Implementing Programming Languages Many choices in how to implement programming models We’ve talked about compilation, can also interpret Interpreting languages has a long history . Lisp, an early programming language, was interpreted Interpreters are still in common use: . Python, Javascript, Ruby, Matlab, PHP, Perl, … Interpreter Your source code implementation Your source code Binary executable Interpreter binary Hardware Hardware 3 L26: JVM CSE351, Spring 2018 An Interpreter is a Program Execute (something close to) the source code directly Simpler/no compiler – less translation More transparent to debug – less translation Easier to run on different architectures – runs in a simulated environment that exists only inside the interpreter process . Just port the interpreter (program), not the program-intepreted Slower and harder to optimize 4 L26: JVM CSE351, Spring 2018 Interpreter vs. Compiler An aspect of a language implementation . A language can have multiple implementations . Some might be compilers and other interpreters “Compiled languages” vs. -
Hibernate Tools
APPENDIX A ■ ■ ■ More Advanced Features In this appendix, we discuss some of the features that, strictly speaking, lie outside the scope of this book, but that you should be aware of if you go on to use Hibernate in more depth. Managed Versioning and Optimistic Locking While we have saved versioning for this appendix’s discussion of advanced features, it is actually quite straightforward to understand and apply. Consider the following scenario: • Client A loads and edits a record. • Client B loads and edits the same record. • Client A commits its edited record data. • Client B commits its differently edited record data. While the scenario is simple, the problems it presents are not. If Client A establishes a transaction, then Client B may not be able to load and edit the same record. Yet in a web environment, it is not unlikely that Client A will close a browser window on the open record, never committing or canceling the transaction, so that the record remains locked until the session times out. Clearly this is not a satisfactory solution. Usually, you will not want to permit the alternative scenario, in which no locking is used, and the last person to save a record wins! The solution, versioning, is essentially a type of optimistic locking (see Chapter 8). When any changes to an entity are stored, a version column is updated to reflect the fact that the entity has changed. When a subsequent user tries to commit changes to the same entity, the original version number will be compared against the current value—if they differ, the commit will be rejected. -
Using Other Tools with Jython
A P P E N D I X A Using Other Tools with Jython The primary focus of this appendix is to provide information on using some external Python packages with Jython, as well as providing information regarding the Jython registry. In some circumstances, the tools must be used or installed a bit differently on Jython than on CPython, and those differences will be noted. Because there is a good deal of documentation on the usage of these tools available on the web, this appendix will focus on using the tool specifically with Jython. However, relevant URLs will be cited for finding more documentation on each of the topics. The Jython Registry Because there is no good platform-independent equivalent of the Windows Registry or Unix environment variables, Java has its own environment variable namespace. Jython acquires its namespace from the following sources (later sources override defaults found in earlier places): • The Java system properties, typically passed in on the command line as options to the java interpreter. • The Jython “registry” file, containing prop=value pairs. Read on for the algorithm Jython uses to find the registry file. • The user’s personal registry file, containing similarly formatted prop/value pairs. The user’s registry file can be found at "user.home"+"/.jython" • Jython properties specified on the command line as options to the Jython class. See the -D option to the interpreter. Registry Properties The following properties are recognized by Jython. There may be others that aren’t documented here; consult the comments in registry file for details. python.cachedir The directory to use for caches—currently just package information. -
A Zero Kernel Operating System: Rethinking Microkernel Design by Leveraging Tagged Architectures and Memory-Safe Languages
A Zero Kernel Operating System: Rethinking Microkernel Design by Leveraging Tagged Architectures and Memory-Safe Languages by Justin Restivo B.S., Massachusetts Institute of Technology (2019) Submitted to the Department of Electrical Engineering and Computer Science in partial fulfillment of the requirements for the degree of Masters of Engineering in Computer Science and Engineering at the MASSACHUSETTS INSTITUTE OF TECHNOLOGY February 2020 © Massachusetts Institute of Technology 2020. All rights reserved. Author............................................................................ Department of Electrical Engineering and Computer Science January 29, 2020 Certified by....................................................................... Dr. Howard Shrobe Principal Research Scientist, MIT CSAIL Thesis Supervisor Certified by....................................................................... Dr. Hamed Okhravi Senior Staff Member, MIT Lincoln Laboratory Thesis Supervisor Certified by....................................................................... Dr. Samuel Jero Technical Staff, MIT Lincoln Laboratory Thesis Supervisor Accepted by...................................................................... Katrina LaCurts Chair, Master of Engineering Thesis Committee DISTRIBUTION STATEMENT A. Approved for public release. Distribution is unlimited. This material is based upon work supported by the Assistant Secretary of Defense for Research and Engineering under Air Force Contract No. FA8702-15-D-0001. Any opinions, findings, conclusions -
Guidelines on Minimum Standards for Developer Verification of Software
Guidelines on Minimum Standards for Developer Verification of Software Paul E. Black Barbara Guttman Vadim Okun Software and Systems Division Information Technology Laboratory July 2021 Abstract Executive Order (EO) 14028, Improving the Nation’s Cybersecurity, 12 May 2021, di- rects the National Institute of Standards and Technology (NIST) to recommend minimum standards for software testing within 60 days. This document describes eleven recommen- dations for software verification techniques as well as providing supplemental information about the techniques and references for further information. It recommends the following techniques: • Threat modeling to look for design-level security issues • Automated testing for consistency and to minimize human effort • Static code scanning to look for top bugs • Heuristic tools to look for possible hardcoded secrets • Use of built-in checks and protections • “Black box” test cases • Code-based structural test cases • Historical test cases • Fuzzing • Web app scanners, if applicable • Address included code (libraries, packages, services) The document does not address the totality of software verification, but instead recom- mends techniques that are broadly applicable and form the minimum standards. The document was developed by NIST in consultation with the National Security Agency. Additionally, we received input from numerous outside organizations through papers sub- mitted to a NIST workshop on the Executive Order held in early June, 2021 and discussion at the workshop as well as follow up with several of the submitters. Keywords software assurance; verification; testing; static analysis; fuzzing; code review; software security. Disclaimer Any mention of commercial products or reference to commercial organizations is for infor- mation only; it does not imply recommendation or endorsement by NIST, nor is it intended to imply that the products mentioned are necessarily the best available for the purpose.