Search

There is an increasing interest in explicitly managed memory hierarchies, where a hierarchy of distinct memories is exposed to the programmer and managed explicitly in software. These hierarchies can be found in typical embedded systems and an emerging class of multicore architectures. To run an application that requires more code memory than the available higher-level memory, typically an overlay structure is needed. The overlay structure is generated manually by the programmer or automatically by a specialized linker. Manual code overlaying requires the programmer to deeply understand the program structure for maximum memory savings as well as minimum performance degradation. Although the linker can automatically generate the code overlay structure, its memory savings are limited and it even brings significant performance degradation because traditional techniques do not consider the program context. In this article, we propose an automatic code overlay generation technique that overcomes the limitations of traditional automatic code overlaying techniques. We are dealing with a system context that imposes two distinct constraints: (1) no hardware support for address translation and (2) a spatially and temporally coarse grained faulting mechanism at the function level. Our approach addresses those two constraints as efficiently as possible. Our technique statically computes the Worst-Case Number of Conflict misses (WCNC) between two different code segments using path expressions. Then, it constructs a static temporal relationship graph with the WCNCs and emits an overlay structure for a given higher-level memory size. We also propose an inter-procedural partial redundancy elimination technique that minimizes redundant code copying caused by the generated overlay structure. Experimental results show that our approach is promising.

Software Clone detection is one of the hottest research area that helps in detecting duplicate code from an applications. The research has shown that 5% to 20% of software systems can contain duplicated code that is generated by simply copying the existing program code and pasting with or without minor modifications. Cloning creates problem when a bug is found in one code segment that was copied and pasted at several locations earlier. The objective of this study is to analyze the working of hybrid clone detection technique that design and analyze a hybrid technique for detecting software clone in an application. We will combine metric approach with text base (line of code) technique for the above said reason. A model will be designed to automate the concept of clone detection.

We are working on a process for carrying out a set of transformations on Fortran legacy projects. We started our work for parallelization and reduction of runtime at least on multiprocessing systems, but we found necessary to update several old Fortran features and/or legacy software issues as a previous task. We present how to define and implement several source code transformations in order to enhance readability and, also, provide a source code that we think is more likely to be parallelized in subsequent work. Furthermore, we propose that some parallelization (e.g. for shared memory parallel computers) can be made at least as a tool-guided process, i.e. as other source code transformations. In the most simple cases, some transformations from sequential to parallel processing could be made automatically by a source code software analysis and transformation tool, which could provide the user (programmer/developer) a suggested way of Parallelisation. Source code transformations are initially approached as restructurings, and implemented by changing the abstract syntax tree (AST) program representation. We provide some comments on our preliminary work on the source code transformations directly focussed on parallelization that we expect to implement almost automatically.

Source code plagiarism is an easy to do task, but very difficult to detect without proper tool support. Various source code similarity detection systems have been developed to help detect source code plagiarism. Those systems need to recognize a number of lexical and structural source code modifications. For example, by some structural modifications (e.g. modification of control structures, modification of data structures or structural redesign of source code) the source code can be changed in such a way that it almost looks genuine. Most of the existing source code similarity detection systems can be confused when these structural modifications have been applied to the original source code. To be considered effective, a source code similarity detection system must address these issues. To address them, we designed and developed the source code similarity system for plagiarism detection. To demonstrate that the proposed system has the desired effectiveness, we performed a well-known conformism test. The proposed system showed promising results as compared with the JPlag system in detecting source code similarity when various lexical or structural modifications are applied to plagiarized code. As a confirmation of these results, an independent samples t-test revealed that there was a statistically significant difference between average values of F-measures for the test sets that we used and for the experiments that we have done in the practically usable range of cut-off threshold values of 35–70%.

Program matching refers to the mapping between equivalent codes written in different languages — including high-level and low-level languages. This equivalence is useful for some software engineering scenarios such as determining whether rewritten code is correct, which version of a program is being used, and whether a malware is present in the program. In the present work, we propose a novel approach to solve the executable code traceability by using program code analysis and artificial neural networks. From the program code analysis we obtained execution behavior properties of the codes, and from the artificial neural networks we judge about their correspondence. Our evaluation using real code examples shows an acceptable correspondence rate between 62% and 100% with the very low rate of 4% false positives.

Class material for computer science courses often contains algorithms and code snippets, as well as the results of their execution. Usually, these are written and tested outside the source document then included via copy-and-paste. Making sure that the code compiles and that the results really correspond to the included code is the teacher's responsibility. Using techniques and ideas from literate programming, we propose to include source code and executable instruc-tions inside the source document. To support this, we have implemented Lepton which is a tool for extracting source code, compiling, executing, and including the results of the documented programs. Consequently, copy-and-paste is eliminated and code output is guaranteed to be up-to-date with source code. This manuscript was written with Lepton.

In this paper, we propose a pinpoint-hide defense method, which aims to improve the stealth of obfuscated code. In the pinpointing process, we scan the obfuscated code in a few small code fragment level and identify all surprising fragments, that is, very unusual fragments which may draw the attention of an attacker to the obfuscated code. In the hiding process, we transform the pinpointed surprising fragments into unsurprising ones while preserving semantics. The obfuscated code transformed by our method consists only by unsurprising code fragments, therefore is more difficult for attackers to be distinguished from unobfuscated code than the original. In the case study, we apply our pinpoint-hide method to some programs transformed by well-known obfuscation techniques. The result shows our method can pinpoint surprising fragments such as dummy code that does not fit in the context of the program, and instructions used in a complicated arithmetic expression. We also confirm that instruction camouflage can make the pinpointed surprising fragments unsurprising ones, and that it runs correctly.

This paper reports a case study of using the Xevolver code transformation framework for data layout optimizations of high-performance computing (HPC) applications. Due to the variety of data structures used in individual applications, a code transformation rule for data layout optimizations is generally specific to a particular application. Since the Xevolver framework enables users to define their own code transformations, a custom code transformation can be defined so that a specific data representation in an existing code can mechanically and consistently be translated to another one. Our evaluation results clearly demonstrate that such a code transformation is effective to improve memory access efficiency and hence the performance of an HPC application without overcomplicating the code.

HPC scientific codes are less readable and less manageable because of complex hand optimization which is often platform-dependent. We are developing a toolset that hopefully mitigates that maintainability problem by user-defined easy-to-use code transformation: The code is written in a simpler form, and coding technique for high performance is introduced by code transformations. In this paper, we present xevtgen, which is a code transformation generator of our toolset. Transformation rules are defined using dummy Fortran codes with some directives, and we expect that design makes it easier to learn for Fortran programmers. Some examples of code transformations are shown to discuss the practicality of the proposed approach.

Locating bugs in a source code is an overwhelming task and takes a great amount of cost, time and human effort. To locate bugs a developer has to go through thousands of lines of code to zero in on the code area that is creating the unintended output. It is a necessity to create automated systems that can assist the developers with the task of bug fixing by narrowing down to the possible location of the bug, if not locate the exact location. This paper concentrates on the bug localization technique based on the idea of source code mutation. The premises of the approach is that if the source code contains bugs then a mutation of the source code might be a better approximation of the intended code. The paper proposes new and minimal sets of mutation operators for two unexplored aspects of programming: Exception Handling and Multithreading that will create mutations of the source code hoping to get better approximation of the intended code thereby uncovering a bug in Exception Handling or in Multithreading.

A general prerequisite for a code reuse attack is that the attacker needs to locate code gadgets that perform the desired operations and then direct the control flow of a vulnerable application to those gadgets. Address Space Layout Randomization (ASLR) attempts to stop code reuse attacks by making the first part of the prerequisite unsatisfiable. However, research in recent years has shown that this protection is often defeated by commonly existing information leaks, which provides attackers clues about the whereabouts of certain code gadgets. In this paper, we present ASLR-Guard, a novel mechanism that completely prevents the leaks of code pointers, and render other information leaks (e.g., the ones of data pointers) useless in deriving code address. The main idea behind ASLR-Guard is to render leak of data pointer useless in deriving code address by separating code and data, provide a secure storage for code pointers, and encode the code pointers when they are treated as data. ASLR-Guard can either prevent code pointer leaks or render their leaks harmless. That is, ASLR-Guard makes it impossible to overwrite code pointers with values that point to or will hijack the control flow to a desired address when the code pointers are dereferenced. We have implemented a prototype of ASLR-Guard, including a compilation toolchain and a C/C++ runtime. Our evaluation results show that (1) ASLR-Guard supports normal operations correctly; (2) it completely stops code address leaks and can resist against recent sophisticated attacks; (3) it imposes almost no runtime overhead (

Vulnerabilities that disclose executable memory pages enable a new class of powerful code reuse attacks that build the attack payload at runtime. In this work, we present Heisenbyte, a system to protect against memory disclosure attacks. Central to Heisenbyte is the concept of destructive code reads -- code is garbled right after it is read. Garbling the code after reading it takes away from the attacker her ability to leverage memory disclosure bugs in both static code and dynamically generated just-in-time code. By leveraging existing virtualization support, Heisenbyte's novel use of destructive code reads sidesteps the problem of incomplete binary disassembly in binaries, and extends protection to close-sourced COTS binaries, which are two major limitations of prior solutions against memory disclosure vulnerabilities. Our experiments demonstrate that Heisenbyte can tolerate some degree of imperfect static analysis in disassembled binaries, while effectively thwarting dynamic code reuse exploits in both static and JIT code, at a modest 1.8% average runtime overhead due to virtualization and 16.5% average overhead due to the destructive code reads.

Many coders today do not take the time to consider the implications of the code they write. Not all code is created equal, and something as seemingly harmless as incrementing or decrementing via prefix instead of a postfix notation can have a considerable effect on performance. Modern day compilers can and do optimize certain common instances of code involving this notation, but it should not be relied upon in a well-developed and maintained code base.

Recently, erasure codes such as Reed-Solomon (RS) code and Cauchy Reed-Solomon (CRS) code have been widely used in distributed file system to reduce the large storage overhead incurred by replication scheme. Now, there is a new erasure code called Binary Reed-Solomon (BRS) code that can achieve better performance than that of RS code, CRS code and is available to be deployed in distributed file system. In this paper, we compare the encoding and decoding performance of BRS code with CRS code and RS code practically. Moreover, we evaluate how the performance of these codes is affected by cache size and multi-core from modern computer architecture perspective. The experimental results show that it is possible to replace RS code or CRS code with BRS code in distributed file system. These works let us have a better understanding of BRS code, CRS code and RS code and help us to make full use of modern computer to get best performance of these codes from modern computer architecture perspective.

It s often important to know how fast a snippet of code executes. This information allows the coder to make important decisions about the code that they create. Perhaps the coder is trying to find out what function call is taking so long or which code executes faster between different ways of accomplishing the same task. Regardless of the reason, faster code is typically more efficient and inherently will use less power.

The output of a code generator is assumed to be correct and not usually intended to be read or modified; yet programmers are often interested in this, e.g., to monitor a system property. Here, we consider code customization for a family of code generators associated with big-step executable modelling languages (e.g., statecharts). We introduce a customization language that allows us to express customization scenarios for the generated code independently of a specific big-step execution semantics. These customization scenarios are all different forms of runtime monitors, which lend themselves to a principled, uniform implementation for observation and code extension. A monitor is given in terms of the enabledness and execution of the transitions of a model and a reachability relation between two states of the execution of the model during a big step. For each monitor, we generate the aspect code that is incorporated into the output of a code generator to implement the monitor at the generated-code level. Thus, we provide means for code analysis through using the vocabulary of a model, rather than the detail of the generated code. Our technique not only requires the code generators to reveal only limited information about their code generation mechanisms, but also keeps the structure of the generated code intact. We demonstrate how various useful properties of a model, or a language, can be checked using our monitors.

To meet the requirements of enterprises in different developing phases, often using the latest technology under the circumstances that lead to existing many and various hardware, operating systems, middleware, programming languages, data storage, reusable redundant code in the enterprise. Service-Oriented Architecture (SOA)[1] is naturally chose as an application architecture by many enterprises because of its innate loose coupling and co-operating. In this paper you will see the Web service development tools supplied by WebSphere platform and you will also see that Web service function which is supplied by J2EE can easily build up SOA system [2] and visit the the existing business process.

A certificate is a mathematical object that can be used to establish that a piece of mobile code satisfies some security policy. In general, certificates cannot be generated automatically. There is thus an interest in developing methods to reuse certificates generated for source code to provide strong guarantees of the compiled code correctness. Certificate translation is a method to transform certificates of program correctness along semantically justified program transformations. These methods have been developed in previous work, but they were strongly dependent on particular programming and verification settings. This article provides a more general development in the setting of abstract interpretation, showing the scalability of certificate translation.

Abbreviation Completion is a novel technique to improve the efficiency of code-writing by supporting code completion of multiple keywords based on non-predefined abbreviated input--a different approach from conventional code completion that finds one keyword at a time based on an exact character match. Abbreviated input consisting of abbreviated keywords and non-alphanumeric characters between each abbreviated keyword (e.g. pb st nm) is expanded into a full expression (e.g. public String name) by a Hidden Markov Model learned from a corpus of existing code and abbreviation examples. The technique does not require the user to memorize abbreviations and provides incremental feedback of the most likely completions. In addition to code completion by disabbreviation of multiple keywords, abbreviation completion supports prediction of the next keywords and non-alphanumeric characters of a code completion candidate, a technique called code completion by extrapolation. The system finds the most likely next keywords and non-alphanumeric characters using an n-gram model of programming language. This enables a code completion scenario in which a user first types a short abbreviated expression to complete the beginning part of a desired full expression and then uses the extrapolation feature to complete the remaining part without further typing. This paper presents the algorithm for abbreviation completion, integrated with a new user interface for multiple-keyword code completion. We tested the system by sampling 4919 code lines from open source projects and found that more than 99% of the code lines could be resolved from acronym-like abbreviations. The system could also extrapolate code completion candidates to complete the next one or two keywords with the accuracy of 96% and 82%, respectively. A user study of code completion by disabbreviation found 30% reduction in time usage and 41% reduction of keystrokes over conventional code completion.

International audience; This paper presents a non-intrusive method for Objective Caml code coverage analysis. While classic methods rewrite the source code to an instrumented version that will produce traces at runtime, our approach chooses not to rewrite the source code. Instead, we use a virtual machine to monitor instructions execution and produce traces. These low-level traces are used to create a machine code coverage report. Combined with control-flow debug information, they can be analyzed to produce a source code coverage report. The purpose of this approach is to make available a method to generate code coverage analysis with the same binary for testing and for production. Our customized virtual machine respects the same semantics as the original virtual machine; one of its original aspects is that it is implemented in the Objective Caml, the very language we build the tool for.This work is part of the Coverage project, which aims to develop open source tools for safety-critical embedded applications and their code generators.

The paper presents an efficient 88 line MATLAB code for topology optimization. It has been developed using the 99 line code presented by Sigmund (Struct Multidisc Optim 21(2):120-127, 2001) as a starting point. The original code has been extended by a density filter, and a considerable improvement in efficiency has been achieved, mainly by preallocating arrays and vectorizing loops. A speed improvement with a factor of 100 is obtained for a benchmark example with 7,500 elements. Moreover, the length of the code has been reduced to a mere 88 lines. These improvements have been accomplished without sacrificing the readability of the code. The 88 line code can therefore be considered as a valuable successor to the 99 line code, providing a practical instrument that may help to ease the learning curve for those entering the field of topology optimization. The paper also discusses simple extensions of the basic code to include recent PDE-based and black-and-white projection filtering methods. The complete 88 line code is included as an appendix and can be downloaded from the web site www.topopt.dtu.dk . © 2010 Springer-Verlag. ispartof: STRUCTURAL AND MULTIDISCIPLINARY OPTIMIZATION vol:43 issue:1 pages:1-16 status: published

That semiosis is specific to the living world is the cornerstone of biosemiotics. For checking an information-theoretic interpretation of this statement already proposed at the 2009 Biosemiotics Gathering in Prague, it is first attempted here to answer a question asked by Kupiec and Sonigo in Ni Dieu ni Gene (2000) on what differentiates living objects and those resulting from a geophysical process. Similar questions were asked by Schrodinger in his essay What Is Life? where the emphasis was laid on the relationship of the atomic scale of the genes and the macroscopic scale of living beings. This essay was published in 1944, before information was introduced as a scientific entity, at a time when DNA was not yet identified as the vector of heredity. We undertake answering some of these questions, arguing that the living world is made of organisms, i.e., of assemblies possessing in a genome the information needed for their replication and their maintenance while the inanimate world only contains aggregates. In short, a biological process keeps its order through the use of information. For defining order, it is proposed that an orderly object can be produced by a construction (e.g., the copy of a template) using available data within some given context. In other words, replicating an orderly object does not bring new information into its context. Order in this meaning appears as specific to the living world, at variance with the inanimate world which is basically disorderly. A better understanding of what separates the living world from the inanimate world results: the use of information is the distinguishing feature which defines their border. Any living thing contains a symbolic information, referred to as its genome, inscribed into DNA molecules. This genome can indeed be copied but, its support being embedded in the physical world, it incurs disturbances which result in symbol errors. Keeping its order thus needs endowing any genome with error correction ability: it must belong to a redundant code, i.e., a set of sequences separated by some minimum distance. The larger its minimum distance, the more immune to errors are the elements of a code. Then genomes become as distinct as to ensure order. Identity and specificity result. Although conservative according to the above definition of order, the living world actually exhibits an extreme diversity which even tends to increase as evolution proceeds. In sharp contrast, homogeneity and monotony are observed in the inanimate world, assumed however non-conservative. In order to solve this paradox and justify the proposed definition of order, it is argued that the error-correcting means which ensure the conservation of genomes fail with some low, but non-zero, probability. Although very infrequent, regeneration errors result in genomes largely different from the initial ones; and the correction mechanisms conserve the mutated genomes just as the original ones. The operation of life changes scales, since the regeneration errors which originate in atomic events have observable consequences at the macroscopic scale.

A key step in Model-Based Design is the deployment of an algorithm as machine code onto a target processor in the production vehicle. Modern software tools automatically generate the algorithmic source code from models. Given the many combinatorial possibilities for realizing a given algorithm within the modeling environment, the generated C source code will be a function of a realization. This dependency is an important consideration because the quality and clarity of the source code impacts the amount of verification and analysis that must be done for production software development. Other factors involved in generating the machine code from the source code, such as compiler optimization and microprocessor architecture, also contribute to this optimization. Organizations that proactively data mine and gather these optimizations into a set of best practices stand to benefit from reduced development times and lower costs. This paper introduces techniques that can be used to generate and measure code constructs used to create a set of best practices for the Simulink modeling environment. The quality of the object code is measured by examining the algorithm compiled within an Integrated Development Environment.

In event-driven systems, separating the reactive part of software (i.e., event-driven control) from the non-reactive part is a common design practice. The reactive part is typically structured according to the states and transitions of a system, whereas the non-reactive part is typically structured according to the concepts of the application domain (e.g., the services provided by the system). In such systems, the non-reactive part of software stimulates the reactive part with event calls. Whenever the non-reactive part is modified (e.g., during evolution), the existing event calls may become invalid, new event calls may become necessary, and the two parts of software may become incompatible. Manually finding and repairing these types of defects is a time-consuming and error-prone maintenance task. In this article, we present a solution that combines source code model checking and aspect-oriented programming techniques, to reduce the time spent by developers and to automatically find defects, while performing the maintenance task mentioned above. In addition, we present controlled experiments showing that the solution can reduce the time by 75%, and enable the prevention of one defect per 140 lines of source code.

Problem statement: How a host (the code consumer) can determine with certainty that a downloaded program received from untrusted source (the code producer) will maintain the confidentiality of the data it manipulates and it is safe to install and execute. Approach: The approach adopted for verifying that a downloaded program will not leak confidential data to unauthorized parties was based on the concept of Proof-Carrying Code (PCC). A mobile program (in its assembly form) was analyzed for information flow security based on the concept of proof-carrying code. The security policy was centered on a type system for analyzing information flows within assembly programs based on the notion of noninterference. Results: A verification tool for verifying assembly programs for information flow security was built. The tool certifies SPARC assembly programs for secure information flow by statically analyzing the program based on the idea of Proof-Carrying Code (PCC). The tool operated directly on the machine-code requiring only the inputs and outputs of the code annotated with security levels. The tool provided a windows user interface enabling the users to control the verification process. The proofs that untrusted program did not leak sensitive information were generated and checked on the host machine and if they are valid, then the untrusted program can be installed and executed safely. Conclusion: By basing proof-carrying code infrastructure on information flow analysis type-system, a sufficient assurance of protecting confidential data manipulated by the mobile program can be obtained. This assurance was come due to the fact that type systems provide a sufficient guarantee of protecting confidentiality.

Swift is a new, principled approach to building Web applications that are secure by construction. Modern Web applications typically implement some functionality as client-side JavaScript code, for improved interactivity. Moving code and data to the client can create security vulnerabilities, but currently there are no good methods for deciding when it is secure to do so. Swift automatically partitions application code while providing assurance that the resulting placement is secure and efficient. Application code is written as Java-like code annotated with information flow policies that specify the confidentiality and integrity of Web application information. The compiler uses these policies to automatically partition the program into JavaScript code running in the client browser and Java code running on the server. To improve interactive performance, code and data are placed on the client. However, security-critical code and data are always placed on the server. The compiler may also automatically replicate code across the client and server, to obtain both security and performance.

Prior to .NET, developers wrote programs in languages such as C or C++, in which the source code is compiled directly to machine code for a particular computer architecture. This is called unmanaged code because memory management, type checking, and security aren't built in. The code must manage such issues on its own, and the environment in which unmanaged code runs is simply the operating system (OS) itself.

Embedded systems are characterized by the requirement of demanding small memory footprint code. A popular architectural modification to improve code density in RISC embedded processors is to use a reduced bit-width instruction set. This approach reduces the length of the instructions to improve code size. However, having less addressable registers by the reduced instructions, these architectures suffer a slight performance degradation as more reduced instructions are required to execute a given task. On the other hand, 0-operand computers such as stack and queue machines implicitly access their source and destination operands making instructions naturally short. Queue machines offer a highly parallel computation model, unlike the stack model. This paper proposes a novel alternative for reducing code size by using a queue-based reduced instruction set while retaining the high parallelism characteristics in programs. We introduce an efficient code generation algorithm to generate programs for our reduced instruction set. Our algorithm successfully constrains the code to the reduced instruction set with the addition of only 4% extra code, in average. We show that our proposed technique is able to generate about 16% more compact code than MIPS16, 26% over ARM/Thumb, and 50% over MIPS32 code. Furthermore, we show that our compiler is able to extract about the same parallelism than fully optimized RISC code.

Reusing software through copying and pasting is a continuous plague in software development despite the fact that it creates serious maintenance problems. Various techniques have been proposed to find duplicated redundant code (also known as software clones). A recent study has compared these techniques and shown that token-based clone detection based on suffix trees is fast but yields clone candidates that are often not syntactic units. Current techniques based on abstract syntax trees--on the other hand--find syntactic clones but are considerably less efficient. This paper describes how we can make use of suffix trees to find syntactic clones in abstract syntax trees. This new approach is able to find syntactic clones in linear time and space. The paper reports the results of a large case study in which we empirically compare the new technique to other techniques using the Bellon benchmark for clone detectors. The Bellon benchmark consists of clone pairs validated by humans for eight software systems written in C or Java from different application domains. The new contributions of this paper over the conference paper are the additional analysis of Java programs, the exploration of an alternative path that uses parse trees instead of abstract syntax trees, and the investigation of the impact on recall and precision when clone analyses insist on consistent parameter renaming.

This paper presents some current work and preliminary thoughts on two seemingly unrelated areas. The first is the development of code analysis tools to help identify possible errors in R code. Current versions of these tools have been useful in finding bugs in R’s code as well as code in packages submitted to CRAN. The second area, where work is just beginning, is the development of mechanisms to allow R’s internal vectorized operations, as well as vectorized operations defined in packages, to take advantage of multiple processors. These two areas are related through their connections to ongoing efforts to develop a byte code compiler for R.

Most of the work done in the field of code compression pertains to processors with fixed-length instruction encoding. The design of a code-compression scheme for variable-length instruction encodings poses newer design challenges. In this work, we first investigate the scope for code compression on variable-length instruction-set processors whose encodings are already optimized to a certain extent with respect to their usage. For such ISAs instruction boundaries are not known prior to decoding. Another challenging task of designing a code-compression scheme for such ISAs is designing the decompression hardware, which must decompress code postcache so that we gain in performance. We present two dictionary-based code compression schemes. The first algorithm uses a bit-vector; the second one uses reserved instructions to identify code words. We design additional logic for each of the schemes to decompress the code on-the-fly. We test the two algorithms with a variable-length RISC processor. We provide a detailed experimental analysis of the empirical results obtained by extensive simulation-based design space exploration for this system. The optimized decompressor can now execute compressed program faster than the native program. The experiments demonstrate reduction in code size (up to 30%), speed-up (up to 15%), and bus-switching activity (up to 20%). We also implement one decompressor in a hardware description language and synthesize it to illustrate the small overheads associated with the proposed approach.

The software industry is so important to the 21C information society Not only the digital content control but the technology of software source code for the intellectual property is so much mean to international competition. On occurring disputation property of software source code, we have to prove the fact, there is a problem to discriminate the original software source code. In this paper, we make a study of the digital licence prototype for discriminate the original source code. Reserved words of software source code by parsing express to XML file that have hierarchical structure. Then, we can express node pattern and architecture pattern of software source code by tree structure form instead of complex software source code. And we make a simulation of discrimination possibility of digital license and propose CRYPTEX model.

This paper proposes automatic generation method of proxy client code to automation of web service selection process through a monitoring agent. The technique of this paper help service consumer to provide source code of proxy client as it bring an attribute value of specific element of WSDL document using template rule. Namely, a XSLT script file provide code frame of dynamic invocation interface model. The automatic code generation technique need to solving starvation status of selection architecture. It is required to creating request HTTP message for every service on the result of search. The created proxy client program code generate dummy message about services. The proposed client code generation method show us a possibility of application in the automatic generation programming domain.

Swift is a new, principled approach to building web applications that are secure by construction . In modern web applications, some application functionality is usually implemented as client-side code written in JavaScript. Moving code and data to the client can create security vulnerabilities, but currently there are no good methods for deciding when it is secure to do so. Swift automatically partitions application code while providing assurance that the resulting placement is secure and efficient. Application code is written as Java-like code annotated with information flow policies that specify the confidentiality and integrity of web application information. The compiler uses these policies to automatically partition the program into JavaScript code running in the browser, and Java code running on the server. To improve interactive performance, code and data are placed on the client side. However, security-critical code and data are always placed on the server. Code and data can also be replicated across the client and server, to obtain both security and performance. A max-flow algorithm is used to place code and data in a way that minimizes client-server communication.

Many techniques for detecting duplicated source code (software clones) have been proposed in the past. However, it is not yet clear how these techniques compare in terms of recall and precision as well as space and time requirements. This paper presents an experiment that evaluates six clone detectors based on eight large C and Java programs (altogether almost 850 KLOC). Their clone candidates were evaluated by one of the authors as an independent third party. The selected techniques cover the whole spectrum of the state-of-the-art in clone detection. The techniques work on text, lexical and syntactic information, software metrics, and program dependency graphs.

Maintaining software systems is becoming more difficult as the size and complexity of software increase. One factor that complicates software maintenance is the presence of code clones. A code clone is a code fragment that has identical or similar code fragments to it in the source code. Code clones are introduced for various reasons such as reusing code by 'copy and paste'. If modifying a code clone with many similar code fragments, we must consider whether to modify each of them. Especially for large-scale software, such a process is very complicated and expensive. In this paper, we propose methods of visualizing and featuring code clones to support their understanding in large-scale software. The methods have been implemented as a tool called Gemini, which has applied to an open source software system. Application results show the usefulness and capability of our system.

An experiment was carried out by a group of scientists to compare different tools and techniques for detecting duplicated or near-duplicated source code. The overall comparative results are presented elsewhere. This paper takes a closer look at the results for one tool, Dup, which finds code sections that are textually the same or the same except for systematic substitution of parameters such as identifiers and constants. Various factors that influenced the results are identified and their impact on the results is assessed via rerunning Dup with changed options and modifications. These improve the performance of Dup with regard to the experiment and could be incorporated into a postprocessor to be used with other tools.

Code Optimization is converting to a code that is equivalent to given program but more efficient, and this process is processed in Code Optimizer. This paper designed and processed Code Optimizer Generator that automatically generates Code Optimizer. In other words Code Optimizer is automatically generated for DFA Pattern Matching which finds the optimal code for the incoming pattern description. DFA Pattern Matching removes redundancy comparisons that occur when patterns are sought for through normalization process and improves simplification and structure of pattern shapes for low cost. Automatic generation of Code Optimization for DFA Pattern Matching eliminates extra effort to generate Code Optimizer every time the code undergoes various transformations, and enables formalism of Code Optimization. Also, the advantage of making DFA for optimization is that it is faster and saves cost of Code Optimizer Generator.

A compiler is a computer program which translates a source code into a target code, often with an objective to reduce the execution time and/or save critical resources. However, an error in the design or in the implementation of a compiler may result in software bugs in the target code obtained from that compiler. Translation validation is a formal verification approach for compilers whereby, each individual translation is followed by a validation phase which verifies that the target code produced correctly implements the source code. In this paper, we present a tool for translation validation of optimizing transformations of programs; the original and the transformed programs are modeled as Finite State Machines with Datapath having Arrays (FSMDAs) and a symbolic value propagation (SVP) based equivalence checking strategy is applied over this model to determine the correctness of the applied transformations. The tool has been demonstrated to handle uniform and non-uniform code motions, including code motions across loops, along with transformations which result in modification of control structures of programs. Moreover, arithmetic transformations such as, associative, commutative, distributive transformations, expression simplification, constant folding, etc., are also supported.

Operator overloading allows the semantic extension of existing code without the need for sweeping code changes. For example, automatic differentiation tools in C++ commonly use this feature to enhance the code with additional derivative computation. To this end, a floating point data type is changed to a complex user-defined type. While conceptually straightforward, this type change often leads to compilation errors that can be tedious to decipher and resolve. This is due to the fact that the built-in floating point types in C++ are treated differently than user-defined types, and code constructs that are legal for floating point types can be a violation of the C++ standard for complex user-defined types. We identify and classify such problematic code constructs and suggest how the code can be changed to avoid these errors, while still allowing the use of operator overloading. To automatically flag such occurrences, we developed a Clang-based tool for the static analysis of C++ code based on our assessment of constructs problematic in operator overloading for numeric types. It automatically finds instances of problematic code locations and prints Lint-like warning messages. To showcase the relevance of this topic and the usefulness of our tool, we consider the basic routines of the OpenFOAM CFD software package, consisting of 1,476 C++ source and header files, for a total of over 150,000 lines of code. Altogether, we found 74 distinct occurrences of problematic code constructs in 21 files. As some of these files are included in over 400 different locations in the OpenFOAM base, errors in these files create a torrent of error messages that often are difficult to comprehend. In summary, the classification of problematic instances aids developers in writing numerical code that is fit for operator overloading and the tool helps programmers that augment legacy code in spotting problematic code constructs.

Opaque code, which is executable but whose source is unavailable or hard to process, can be problematic in a number of scenarios, such as program analysis. Manual construction of models is often used to handle opaque code, but this process is tedious and error-prone. (In this paper, we use model to mean a representation of a piece of code suitable for program analysis.) We present a novel technique for automatic generation of models for opaque code, based on program synthesis. The technique intercepts memory accesses from the opaque code to client objects, and uses this information to construct partial execution traces. Then, it performs a heuristic search inspired by Markov Chain Monte Carlo techniques to discover an executable code model whose behavior matches the opaque code. Native execution, parallelization, and a carefully-designed fitness function are leveraged to increase the effectiveness of the search. We have implemented our technique in a tool Mimic for discovering models of opaque JavaScript functions, and used Mimic to synthesize correct models for a variety of array-manipulating routines.

We present the Asuna system which supports implicitly heterogeneous multi-stage programming based on MetaOCaml, a multi-stage extension of OCaml. Our system allows programmers to write code generators in a high-level language, and generated code can be translated to a program in low-level languages such as C and LLVM. The high-level code generators can make use of all the features of MetaOCaml such as algebraic data types and higher-order functions while the generated code may include low-level CPU instructions such as vector (SIMD) operations. One can write programs in a modular and type-safe programming style and can directly represent low-level optimizations. Asuna is a multi-target system, that means a single code generator can generate code in C and LLVM, without changing the generator. The translation by Asuna preserves typing and all generated code is guaranteed to be well typed and well scoped. In this paper, we explain the practical aspect of Asuna, using examples taken from high-performance computing.

Use-after-free conditions occur when an execution path of a process accesses an incorrectly deal located object. Such access is problematic because it may potentially allow for the execution of arbitrary code by an adversary. However, while increasingly common, such flaws are rarely detected by compilers in even the most obvious instances. In this paper, we design and implement a static analysis method for the detection of use-after-free conditions in binary code. Our new analysis is similar to available expression analysis and traverses all code paths to ensure that every object is defined before each use. Failure to achieve this property indicates that an object is improperly freed and potentially vulnerable to compromise. After discussing the details of our algorithm, we implement a tool and run it against a set of enterprise-grade, publicly available binaries. We show that our tool can not only catch textbook and recently released in-situ examples of this flaw, but that it has also identified 127 additional use-after-free conditions in a search of 652 compiled binaries in the Windows system32 directory. In so doing, we demonstrate not only the power of this approach in combating this increasingly common vulnerability, but also the ability to identify such problems in software for which the source code is not necessarily publicly available.

Interface-confinement is a common mechanism that secures untrusted code by executing it inside a sandbox. The sandbox limits (confines) the code's interaction with key system resources to a restricted set of interfaces. This practice is seen in web browsers, hypervisors, and other security-critical systems. Motivated by these systems, we present a program logic, called System M, for modeling and proving safety properties of systems that execute adversary-supplied code via interface-confinement. In addition to using computation types to specify effects of computations, System M includes a novel invariant type to specify the properties of interface-confined code. The interpretation of invariant type includes terms whose effects satisfy an invariant. We construct a step-indexed model built over traces and prove the soundness of System M relative to the model. System M is the first program logic that allows proofs of safety for programs that execute adversary-supplied code without forcing the adversarial code to be available for deep static analysis. System M can be used to model and verify protocols as well as system designs. We demonstrate the reasoning principles of System M by verifying the state integrity property of the design of Memoir, a previously proposed trusted computing system.

API-library switching is to change an underlying API library to another one for a given program. API-library switching is frequent in software-development process, with typical examples as migrating programs across platforms or across incompatible versions of API libraries. Manual APIlibrary switching is time-consuming and error-prone. To address this problem, previous research has proposed a series of rule based code-transformation approaches. However, these existing approaches are ineffective in conducting code transformation for those original code snippets containing a sequence of method invocations correlated with each other and in need of being considered together when transformed. We call the pair of an original code snippet and its transformed target code snippet as a compositional-mapping instance. Through our empirical investigation, we confirm that compositional-mapping instances widely exist during API-library switching. To handle compositional-mapping instances, in this paper, we propose a novel code-transformation approach named as CMIT. Our evaluations compare CMIT with an existing rule-based code transformation approach. The evaluation results show that, compared to the existing approach, CMIT is more flexible, and CMIT increases the recall on average by 33.8% without decreasing the precision.

Sometimes the data format used can radically simplify the code. A simple change to the way data is stored in a file can make a big difference in the code required to read it. This was made apparent recently with some Visual Basic code which would locate a list of numbers based on certain search criteria. The code was about one thousand lines and needed to be converted to C# for a new application. It was time to rethink how this could be simplified. The original data format was just a series of numbers stored in an Excel spreadsheet accessed by variable names. Through a long series of if-then-else and case statements the code determined which data to read from the file. The data-search hierarchy was in the source code. It was found that by changing the data format in a hierarchically structured way the code could be drastically simplified. After changing the data format the search function was simplified to about forty lines of code. Although this article will describe a specific data type search algorithm, it may inspire the developer to think more about the data-code design.

In this paper we propose an algorithm for detecting duplicate fragments of source code based on call graphs. The complexity of the proposed algorithm is estimated and the practical performance is tested using several executions of the algorithm on three different versions of open source Ant. An analysis is made of the influence of the algorithm parameters on its results. Additionally a visualization approach for displaying the results is represented, demonstrated by a tool implementing the algorithm.