CS510 Software Engineering Dynamic Program Analysis Asst. Prof. Mathias Payer Department of Computer Science Purdue University TA: Scott A. Carr Slides inspired by Xiangyu Zhang http://nebelwelt.net/teaching/15-CS510-SE Spring 2015
Overview Table of Contents Overview 1 DPA Primitives 2 Tracing definition 3 Use-cases for Tracing 4 How to Trace 5 Source to Source Instrumentation Binary Instrumentation FastBT, Generating Fast Binary Translators Reducing Trace Size 6 Basic block-level Tracing Alternatives to Reduce Trace Size Compression Using Value Predictors Mathias Payer (Purdue University) CS510 Software Engineering 2015 2 / 35
Overview Overview Dynamic program analysis tackles software dependability and productivity problems by inspecting software execution . A program execution captures runtime behavior of a program (think class and object). Dynamic analysis follows path through the program: each statement is executed { 0 , N } times. The analysis is restricted to a single path. All variables are instantiated (solving the aliasing problem of static analysis). Mathias Payer (Purdue University) CS510 Software Engineering 2015 3 / 35
Overview Advantages Relatively low learning curve. Precision. Applicability. Scalability. Mathias Payer (Purdue University) CS510 Software Engineering 2015 4 / 35
Overview Disadvantages? Neither generalizable nor complete. Limited to available test-cases. Possible runtime constraints (Heisenbugs) Mathias Payer (Purdue University) CS510 Software Engineering 2015 5 / 35
DPA Primitives Table of Contents Overview 1 DPA Primitives 2 Tracing definition 3 Use-cases for Tracing 4 How to Trace 5 Source to Source Instrumentation Binary Instrumentation FastBT, Generating Fast Binary Translators Reducing Trace Size 6 Basic block-level Tracing Alternatives to Reduce Trace Size Compression Using Value Predictors Mathias Payer (Purdue University) CS510 Software Engineering 2015 6 / 35
DPA Primitives Dynamic Program Analysis Primitives Tracing Profiling Checkpoint and replay Dynamic slicing Execution indexing Delta debugging Mathias Payer (Purdue University) CS510 Software Engineering 2015 7 / 35
DPA Primitives Applications Taint tracking Dynamic information flow tracking Automated debugging Mathias Payer (Purdue University) CS510 Software Engineering 2015 8 / 35
Tracing definition Table of Contents Overview 1 DPA Primitives 2 Tracing definition 3 Use-cases for Tracing 4 How to Trace 5 Source to Source Instrumentation Binary Instrumentation FastBT, Generating Fast Binary Translators Reducing Trace Size 6 Basic block-level Tracing Alternatives to Reduce Trace Size Compression Using Value Predictors Mathias Payer (Purdue University) CS510 Software Engineering 2015 9 / 35
Tracing definition Tracing definition Tracing Tracing is a lossless process that faithfully records detailed information of a program’s execution. Tracing is a basic and simple primitive. Mathias Payer (Purdue University) CS510 Software Engineering 2015 10 / 35
Tracing definition Types of Tracing Control-flow tracing (sequence of executed statements); Dependence tracing (sequence of exercised dependences); Value tracing (sequence of values produced by each instruction); Memory access tracing (sequence of memory accesses during execution). Mathias Payer (Purdue University) CS510 Software Engineering 2015 11 / 35
Use-cases for Tracing Table of Contents Overview 1 DPA Primitives 2 Tracing definition 3 Use-cases for Tracing 4 How to Trace 5 Source to Source Instrumentation Binary Instrumentation FastBT, Generating Fast Binary Translators Reducing Trace Size 6 Basic block-level Tracing Alternatives to Reduce Trace Size Compression Using Value Predictors Mathias Payer (Purdue University) CS510 Software Engineering 2015 12 / 35
Use-cases for Tracing Use-cases for Tracing Debugging: time-travel to understand interactions; Code optimizations: hot program paths, data compression, value speculation, data locality for cache optimization; Security: malware analysis; Testing: code coverage. Mathias Payer (Purdue University) CS510 Software Engineering 2015 13 / 35
How to Trace Table of Contents Overview 1 DPA Primitives 2 Tracing definition 3 Use-cases for Tracing 4 How to Trace 5 Source to Source Instrumentation Binary Instrumentation FastBT, Generating Fast Binary Translators Reducing Trace Size 6 Basic block-level Tracing Alternatives to Reduce Trace Size Compression Using Value Predictors Mathias Payer (Purdue University) CS510 Software Engineering 2015 14 / 35
How to Trace Tracing by printf 1 i n t max = 0; 2 f o r (p = head ; p ; p = p − > next ) { p r i n t f ( ” in loop \ n” ) ; 3 i f (p − > value > max) { 4 p r i n t f ( ”True branch \ n” ) ; 5 max = p − > value ; 6 } 7 8 } Mathias Payer (Purdue University) CS510 Software Engineering 2015 15 / 35
How to Trace Source to Source Instrumentation Tracing by Source-Level Instrumentation Parse a source file into an AST. Annotate the AST with instrumentation. Translate the annotated trees into a new source file. Compile the new sources. Execute the program and produce a trace as side-effect. Mathias Payer (Purdue University) CS510 Software Engineering 2015 16 / 35
How to Trace Source to Source Instrumentation Source-Level Instrumentation Example 1 f o r ( i = 1; i < 10; i++) { a [ i ] = b [ i ] ∗ 5; 2 3 } for = i 1 10 [] * a [] i 5 b i Mathias Payer (Purdue University) CS510 Software Engineering 2015 17 / 35
How to Trace Source to Source Instrumentation Source-Level Instrumentation Example (2) 1 f o r ( i = 1; i < 10; i++) { p r i n t f ( ” In loop \ n” ) ; 2 a [ i ] = b [ i ] ∗ 5; 3 4 } for ; i 1 10 = printf [] * a [] i 5 b i Mathias Payer (Purdue University) CS510 Software Engineering 2015 18 / 35
How to Trace Source to Source Instrumentation Characteristics of Source-Level Instrumentation Detailed type and variable information available. Detailed control-flow structures available. No support for pre-compiled libraries or binaries. Limited support for multi-lingual programs. Requires full source-code. Mathias Payer (Purdue University) CS510 Software Engineering 2015 19 / 35
How to Trace Binary Instrumentation Tracing by Binary Instrumentation Parse binary into intermediate representation, generate graph data structures like CFG. Instrument IR with tracing nodes. Compile/assemble back to an executable for static binary instrumentation or use a JIT to execute on-the-fly. Mathias Payer (Purdue University) CS510 Software Engineering 2015 20 / 35
How to Trace Binary Instrumentation Characteristics of Binary-Level Instrumentation No source-code needed. Supports libraries and any executable. Possibly high overhead due to instrumentation and translation. Limited scope and high-level data structures available. Mathias Payer (Purdue University) CS510 Software Engineering 2015 21 / 35
How to Trace FastBT, Generating Fast Binary Translators FastBT Enable fast, efficient instrumentation at low overhead. Instead of converting machine code to an IR, translate using pre-generated tables. Define a set of translation actions that add instrumentation when dispatched. Use a code-cache to lower overhead. Challenge: define translation actions for instructions that change control-flow. Mathias Payer (Purdue University) CS510 Software Engineering 2015 22 / 35
How to Trace FastBT, Generating Fast Binary Translators FastBT Overview Translator ● Translates individual basic blocks ● Verifies code source / destination ● Checks branch targets and origins Original code Code cache Mapping table R RX 1 1' 1 1' 2 2' 3 3' 2 2' Indirect control … ... flow transfers use a dynamic 3 3' check to verify 4 target and origin Reading material: Generating low-overhead dynamic binary translators, Mathias Payer and Thomas R. Gross, SySTOR’10 (see course homepage). Mathias Payer (Purdue University) CS510 Software Engineering 2015 23 / 35
Reducing Trace Size Table of Contents Overview 1 DPA Primitives 2 Tracing definition 3 Use-cases for Tracing 4 How to Trace 5 Source to Source Instrumentation Binary Instrumentation FastBT, Generating Fast Binary Translators Reducing Trace Size 6 Basic block-level Tracing Alternatives to Reduce Trace Size Compression Using Value Predictors Mathias Payer (Purdue University) CS510 Software Engineering 2015 24 / 35
Reducing Trace Size Fine-grained Tracing is Expensive! 1 i n t sum = 0; 2 i n t i = 1; 3 while ( i < N) { i ++; 4 sum = sum + i ; 5 6 } 7 p r i n t f ( ”Sum: %d \ n” , sum) ; Trace ( N = 6): 1, 2, 3, 4, 5, 3, 4, 5, 6, 3, 4, 5, 6, 3, 4, 5, 6, 3, 4, 5, 6, 3, 7. Space complexity: exec length ∗ sizeof ( void ∗ ) Mathias Payer (Purdue University) CS510 Software Engineering 2015 25 / 35
Reducing Trace Size Basic block-level Tracing Basic block-level Tracing 1 i n t sum = 0; 2 i n t i = 1; 3 while ( i < N) { i ++; 4 sum = sum + i ; 5 6 } 7 p r i n t f ( ”Sum: %d \ n” , sum) ; BB Trace: 1-2, 3, 4-5, 3, 4-5, 3, 4-5, 3, 4-5, 3, 4-5, 3, 7 In this example only 13 / 19 storage needed. Drawback: seeking inside basic block is more complicated. Mathias Payer (Purdue University) CS510 Software Engineering 2015 26 / 35
Recommend
More recommend
