Search

Nowadays, developers are often using multiple programming languages to exploit the advantages of each language and to reuse code. However, dependency analysis across multilanguage is more challenging compared to mono-language systems. In this article, we introduce two approaches for multilanguage dependency analysis: static multilanguage dependency analyzer) and historical multilanguage dependency analyzer, which we apply on ten open-source multilanguage systems to empirically analyze the prevalence of the dependencies across languages, i.e., interlanguage dependencies and their impact on software quality and security. Our main results show that: the more interlanguage dependencies, the higher the risk of bugs and vulnerabilities being introduced, while this risk remains constant for intralanguage dependencies; the percentage of bugs within interlanguage dependencies is three times higher than the percentage of bugs identified in intralanguage dependencies; the percentage of vulnerabilities within interlanguage dependencies is twice the percentage of vulnerabilities introduced in intralanguage dependencies.

In this paper, FPGA Configuration is implemented in which programmable circuit of a FPGA and a USB-PHY transceiver are bring together to form new programming interface. Purpose of FPGA configurartion by Flash programmer is to minimize software and communication overhead to achieve close to theoretical programming time possible on polarfire devices. Although the focus is to speed up polarfire configuration, previous generation of flash devices could take advantage of the hardware architecture and achieve faster programming time as well. FPGA offers a variety of programming Option; FPGA device usage JTAG or SPI interface to configure on-chip system controller through its dedicated USB port. To achieve that we used java native Interface which creates libraries to be used with a proprietary interpreter tool, which provide us flexibility to configure FPGA devices with JTAG Instructions. Visual studio is used to inherit product specific libraries along with JNI. This platform can also be used by broad range of applications wherever high-speed data transfer is required. USB 3.0 capable host is used for high speed communication.

Android apps include third-party native libraries to increase performance and to reuse functionality. Native code is directly executed from apps through the Java Native Interface or the Android Native Development Kit. Android developers add precompiled native libraries to their projects, enabling their use. Unfortunately, developers often struggle or simply neglect to update these libraries in a timely manner. This results in the continuous use of outdated native libraries with unpatched security vulnerabilities years after patches became available. To further understand such phenomena, we study the security updates in native libraries in the most popular 200 free apps on Google Play from Sept. 2013 to May 2020. A core difficulty we face in this study is the identification of libraries and their versions. Developers often rename or modify libraries, making their identification challenging. We create an approach called LibRARIAN (LibRAry veRsion IdentificAtioN) that accurately identifies native libraries and their versions as found in Android apps based on our novel similarity metric bin(2)sim. LibRARIAN leverages different features extracted from libraries based on their metadata and identifying strings in read-only sections. We discovered 53/200 popular apps (26.5%) with vulnerable versions with known CVEs between Sept. 2013 and May 2020, with 14 of those apps remaining vulnerable. We find that app developers took, on average, 528.71 +/- 40.20 days to apply security patches, while library developers release a security patch after 54.59 +/- 8.12 days-a 10 times slower rate of update.To further understand such phenomena, we study the security updates in native libraries in the most popular 200 free apps on Google Play from Sept. 2013 to May 2020. A core difficulty we face in this study is the identification of libraries and their versions. Developers often rename or modify libraries, making their identification challenging. We create an approach called LibRARIAN (LibRAry veRsion IdentificAtioN) that accurately identifies native libraries and their versions as found in Android apps based on our novel similarity metric bin(2)sim. LibRARIAN leverages different features extracted from libraries based on their metadata and identifying strings in read-only sections. We discovered 53/200 popular apps (26.5%) with vulnerable versions with known CVEs between Sept. 2013 and May 2020, with 14 of those apps remaining vulnerable. We find that app developers took, on average, 528.71 +/- 40.20 days to apply security patches, while library developers release a security patch after 54.59 +/- 8.12 days-a 10 times slower rate of update.

Most programming languages support foreign language interoperation that allows developers to integrate multiple modules implemented in different languages into a single multilingual program. While utilizing various features from multiple languages expands expressivity, differences in language semantics require developers to understand the semantics of multiple languages and their inter-operation. Because current compilers do not support compile-time checking for interoperation, they do not help developers avoid in-teroperation bugs. Similarly, active research on static analysis and bug detection has been focusing on programs written in a single language. In this paper, we propose a novel approach to analyze multilingual programs statically. Unlike existing approaches that extend a static analyzer for a host language to support analysis of foreign function calls, our approach extracts semantic summaries from programs written in guest languages using a modular analysis technique, and performs a whole-program analysis with the extracted semantic summaries. To show practicality of our approach, we design and implement a static analyzer for multilingual programs, which analyzes JNI interoperation between Java and C. Our empirical evaluation shows that the analyzer is scalable in that it can construct call graphs for large programs that use JNI interoperation, and useful in that it found 74 genuine interoperation bugs in real-world Android JNI applications.

Current Java static analyzers, operating either on the source or bytecode level, exhibit unsoundness for programs that contain native code. We show that the Java Native Interface (JNI) specification, which is used by Java programs to interoperate with Java code, is principled enough to permit static reasoning about the effects of native code on program execution when it comes to call-backs. Our approach consists of disassembling native binaries, recovering static symbol information that corresponds to Java method signatures, and producing a model for statically exercising these native call-backs with appropriate mock objects. The approach manages to recover virtually all Java calls in native code, for both Android and Java desktop applications—(a) achieving 100% native-to-application call-graph recall on large Android applications (Chrome, Instagram) and (b) capturing the full native call-back behavior of the XCorpus suite programs.

Fast networks like InfiniBand are important for large-scale applications and big data analytics. Current InfiniBand hardware offers bandwidths of up to 200 Gbit/s with latencies of less than two microseconds. While it is mainly used in high performance computing, there are also some applications in the field of big data analytics. In addition, some cloud providers are offering instances equipped with InfiniBand hardware. Many big data applications and frameworks are written using the Java programming language, but the Java Development Kit does not provide native support for InfiniBand. To this end we propose neutrino, a network library providing comfortable and efficient access to InfiniBand hardware in Java as well as epoll based multithreaded connection management. Neutrino supports InfiniBand message passing as well as remote direct memory access, is implemented using the Java Native Interface, and can be used with any Java Virtual Machine. It also provides access to native C structures via a specially developed proxy system, which in turn enables the developer to leverage the InfiniBand hardware’s full functionality. Our experiments show that efficient access to InfiniBand hardware from within a Java Virtual Machine is possible while fully utilizing the available bandwidth.

Developers often combine multiple programming languages to build large-scale applications. They choose programming languages properly for their tasks at hand instead of solving all of their problems with a single language. Foreign Functions Interface allow code written in one programming language to access features available in another programming language. Multi-language systems benefits from several advantages. However, they also introduce challenges related to the development, comprehension, and maintenance of such systems. Software quality is achieved partly by following good practices---architectural styles, design patterns, idioms---and avoiding bad practices---design anti-patterns and code smells. Yet, a review of the literature shows that there are a few works that study developers' practices among multi-language systems. The heterogeneity of components introduces code smells at the source code level. While design patterns are defined as good solutions to a recurrent problem, code smells are defined as poor design and coding choices that can negatively impact the quality of a software program despite satisfying functional requirements. In this paper, we report four patterns and five code smells related to multi-language systems. Those patterns and code smells were extracted from open-source systems, developers' documentation, and bug reports. We encoded these practices in the form of patterns and code smells in the context of Java Native Interface systems.

With the rapid use of Android OS in mobile devices and related products, face recognition technology is an essential feature, so that mobile devices have a strong personal identity authentication. In this paper, we propose Android based software development framework for real-time face detection and recognition using OpenCV library, which is applicable in several mobile applications. Initially, the Gaussian smoothing and gray-scale transformation algorithm is applied to preprocess the source image. Then, the Haar-like feature matching method is used to describe the characteristics of the operator and obtain the face characteristic value. Finally, the normalization method is used to match the recognition of face database. To achieve the face recognition in the Android platform, JNI (Java Native Interface) is used to call the local Open CV. The proposed system is tested in real-time in two different brands of smart phones, and results average success rate in both devices for face detection and recognition is 95% and 80% respectively.

Deep Learning (DL) has found great success in well-diversified areas such as machine vision, speech recognition, and multimedia understanding. However, the state-of-the-art tools (e.g. Caffe, TensorFlow, and CNTK), are programming libraries with many dependencies and implemented in languages such as C++ that need to be compiled to a specific runtime environment and require users to install the entire tool libraries for training or inference, which limits the portability of DL applications. In this work, we introduce DeepDSL, a domain specific language (DSL) embedded in Scala, that compiles DL networks encoded with DeepDSL to efficient, compact, and portable Java source programs for DL training and inference. DeepDSL represents DL networks as abstract tensor functions, performs symbolic gradient derivations to generate Intermediate Representation (IR), optimizes the IR expressions, and translates the optimized IR expressions to Java code that runs on GPU without additional dependencies other than the necessary GPU libraries and the related invocation interfaces: a small set of JNI (Java Native Interface) wrappers. Our experiments show DeepDSL outperforms existing tools in several benchmark programs adopted from the current mainstream Deep Neural Networks (DNNs).

This article aims to explore JNI features and to discover fundamental operations of the Java programming language, such as arrays, objects, classes, threads and exception handling, and to illustrate these by using various algorithms and code samples. The authors also investigate the JNI Invocation API that allows native applications to interact with the Java Virtual Machine (JVM). They focus on attaching native threads to a running JVM and on leveraging existing native code using one-to-one mapping and shared stubs.

En la actualidad existen diversos lenguajes de programación y es necesario contar con una herramienta que permita la integración entre ellos. Java provee de un framework llamado: interfaz nativa de Java, JNI por sus siglas en inglés; para permitir que se puedan escribir programas en otros lenguajes diferentes a Java y mantener la portabilidad entre todas las plataformas. Permite que el código que se ejecuta en la máquina virtual de Java pueda interactuar con aplicaciones y bibliotecas escritas en otros lenguajes, como C, C++ y ensamblador. Esta guía se basa en un ejemplo básico de una aplicación “Hello Word”, la cual servirá para de manera sencilla, mostrar los pasos a seguir para la configuración de JNI en los entornos de desarrollo involucrados, que para esta guía se utilizó, para Java: Eclipse y para C++: Visual Studio 2010.

As the game industry is moving from PC to smartphone platforms, security problems related to mobile games are becoming critical. Considering the characteristics of mobile games such as having short life-cycles and high communication costs, the server/network-side security technologies designed for PC games are not appropriate for mobile games. In this study, we propose TZMon, a client-side game protection mechanism based on the ARM TrustZone, which protects the confidentiality and integrity of mobile games. TZMon is composed of application integrity protocol, secure update protocol, data hiding protocol, and timer synchronization protocol. To adequately safeguard game codes and data, TZMon is designed considering an environment of frequent communications with the game server, a stand-alone operation environment, and an unreliable environment using a rooted OS. Furthermore, flexibility is provided to game application developers who apply security policies by using the Java Native Interface (JNI). In this study, we use Android and the Open Portable Trusted Execution Environment (OPTEE) as the OS platforms for Normal World and Secure World, respectively. After implementing a full-featured prototype of TZMon, we apply it to several open-source mobile games. We prove through the experiments that the application of the proposed TZMon does not cause any noticeable performance degradation and can detect major cheating techniques of mobile games.

We live in a period of explosive growth of smart device applications. Specifically, the growth rate of Android applications is amazing. And these Android applications often use JNI (Java native interface). However, research on the leakage of private information using JNI is lacking. In this paper, we propose a system for detecting the leakage of private information using JNI. Our system named PILDroid adopts tainted analysis based on static method. PILDroid can perform the analysis more easily and effectively than the assembly-based analysis systems because it decompiles a JNI into LLVM IR instead of assembly language. And this paper demonstrates an experiment to verify the precision and performance. For the test data, we selected five Android applications: three of which are well known malware, two of which are malware made by us. And experiment results, PILDroid determined that there has a leak of privacy information flow from five malware.

It is well known that once a Java application uses native C/C++ methods through the Java Native Interface (JNI), any security guarantees provided by Java might be invalidated by the native methods. So any vulnerability in this trusted native code can compromise the security of the Java program. Fuzzing test is an approach to software testing whereby the system being tested is bombarded with inputs generated by another program. When using fuzzer to test JNI programs, how to accurately reach the JNI functions and run through them to find the sensitive system APIs is the pre-condition of the test. In this paper, we present a heuristic fuzz generator method on JNI vulnerability detection based on the branch predication information of program. The result in the experiment shows our method can use less fuzzing times to reach more sensitive windows APIs in Java native code.

From Oracle JVM to Android Runtime, most Java runtime environments officially support Java Native Interface (JNI) for interaction between Java and C. Using JNI, developers can improve Java program performance or reuse existing libraries implemented in C. At the same time, differences between the languages can lead to various kinds of unexpected bugs when developers do not understand the differences or comprehensive interoperation semantics completely. Furthermore, existing program analysis techniques do not cover the interoperation, which can reduce the quality of JNI programs. We propose a JNI program analysis technique that analyzes Java and C code of JNI programs using analyzers targeting each language respectively. The C analyzer generates a semantic summary for each C function callable from Java and the Java analyzer constructs call graphs using the semantic summaries and Java code. In addition to the call graph construction, we extend the analysis technique to detect four bug types that can occur in the interoperation between the languages. We believe that our approach would be able to detect genuine bugs as well as improve the quality of JNI programs.

As many people use smartphones, many Android applications are being developed and distributed. They are usually written in Java, including C legacy libraries through Java native interface (JNI). To execute these applications written in Java, a virtual machine (VM) is required. For Android, Google's own Dalvic VM had been used, and recently Android Runtime (ART) is being used.

In this paper, we propose a new HDFS-AIO framework to enhance HDFS with Adaptive I/O System (ADIOS), which supports many different I/O methods and enables applications to select optimal I/O routines for a particular platform without source-code modification and re-compilation. First, we customize ADIOS into a chunk-based storage system so its API semantics can fit the requirement of HDFS easily; then, we utilize Java Native Interface (JNI) to bridge HDFS and the tailored ADIOS. We use different I/O patterns to compare HDFS-AIO and the original HDFS, and the experimental results show the design feasibility and benefits. We also examine the performance of HDFS-AIO using various I/O techniques. There have been many studies that use ADIOS, however our research is expected to help in expanding the function of HDFS.

Android allows application developers to use native language (C/C++) to implement a part or the complete program. Recent research and our own statistics show that native payloads are commonly used in both benign and malicious apps. Current state-of-the-art Android static analysis tools, such as Amandroid, FlowDroid, DroidSafe, IccTA, and CHEX avoid handling native method invocation and apply conservative models for their data-flow behavior. None of those tools have capability to capture the inter-language dataflow. We propose a new approach to conduct inter-language dataflow analysis for security vetting of Android apps, and build an analysis framework, called JN-SAF to compute flow and context-sensitive inter-language points-to information in an efficient way. We show that: 1) Precise and efficient inter-language dataflow analysis is completely feasible with support of a summary-based bottom-up dataflow analysis (SBDA) algorithm, 2) A comprehensive model of Java Native Interface (JNI) and Native Development Kit (NDK) for binary analysis is essential as none of the existing binary analysis frameworks is able to handle Android binaries, 3) JN-SAF is capable of capturing inter-language security issues in real-world Android apps as demonstrated by our evaluation result.

The Open Source Environment and API's Android not only created a boom in the market but also attracted large number of people to turn in to application developers. Android not only changed the technology but also help people how to get better with the means of technology This paper mainly showcase kernel level development with the help of java native interface technology; and FFmpeg (open source codec project) tool and associated libraries and at the end android based codec application is designed and implemented with the help of c/c++ and other languages Keywords—Android; Application development; Audio/Video Codec; JNI; Ffmpeg.

NASA's "SPICE"* ancillary information system has gradually become the de facto international standard for providing scientists the fundamental observation geometry needed to perform photogrammetry, map making and other kinds of planetary science data analysis. SPICE provides position and orientation ephemerides of both the robotic spacecraft and the target body; target body size and shape data; instrument mounting alignment and field-of-view geometry; reference frame specifications; and underlying time system conversions. SPICE comprises not only data, but also a large suite of software, known as the SPICE Toolkit, used to access those data and subsequently compute derived quantities–items such as instrument viewing latitude/longitude, lighting angles, altitude, etc. In existence since the days of the Magellan mission to Venus, the SPICE system has continuously grown to better meet the needs of scientists and engineers. For example, originally the SPICE Toolkit was offered only in Fortran 77, but is now available in C, IDL, MATLAB, and Java Native Interface. SPICE calculations were originally available only using APIs (subroutines), but can now be executed using a client-server interface to a geometry engine. Originally SPICE "products" were only available in numeric form, but now SPICE data visualization is also available. The SPICE components are free of cost, license and export restrictions. Substantial tutorials and programming lessons help new users learn to employ SPICE calculations in their own programs. The SPICE system is implemented and maintained by the Navigation and Ancillary Information Facility (NAIF)–a component of NASA's Planetary Data System (PDS). * Spacecraft, Planet, Instrument, Camera-matrix, Events