Some program-analysis frameworks have been around for a long time, with Soot alone having been around for more than one decade. Over the years, demand on such frameworks have changed drastically, stressing the flexibility of frameworks such as Soot to their limit. What were those demands back then and how did they impact the design of Soot? What are the current demands and what architectural and methodological changes do they demand? What has the Soot community done to address these challenges? What remains to be solved? This talk means to address these questions to open the debate about the future evolution of Soot and other static-analysis frameworks.
Implementations of static analyses are usually tailored toward a single goal to be efficient, hampering reusability and adaptability of the components of an analysis. To solve these issues, we propose to implement static analyses as highly-configurable software product lines (SPLs). Furthermore, we also discuss an implementation of an SPL for static analyses -- called OPAL -- that uses advanced language features offered by the Scala programming language to get an easily adaptable and (type-)safe software product line. OPAL is a general purpose library for static analysis of Java Bytecode that is already successfully used. We present OPAL and show how a design based on software produce line engineering benefits the implementation of static analyses with the framework.
Slicing is a powerful technique that can help a developer to understand how the interaction of different parts of a program causes a specific outcome. Dynamic slicing uses runtime information to compute a precise slice for a given execution. However, dynamic slicing is not possible without a static analysis of the underlying code to reveal dependencies between the instructions that have been recorded. In this paper, we present a new algorithm for computing dynamic slices. We describe how the optimization framework Soot was used to compute specialized intraprocedural dependency graphs that better reflect the programmer's view of a program than previous approaches. Combining these dependency graphs with recorded execution traces allowed us to create debuggable dynamic slices. For this, a mapping of the debugger's model of the execution to the static code model of Soot was needed, and could be found with only few ambiguities. This results in the ability to produce a dynamic slice that can not only be visualized, but explored interactively and adjusted to better answer specific questions.
One approach to defending against malicious Android applications has been to analyze them to detect potential information leaks. This paper describes a new static taint analysis for Android that combines and augments the FlowDroid and Epicc analyses to precisely track both inter-component and intra-component data flow in a set of Android applications. The analysis takes place in two phases: given a set of applications, we first determine the data flows enabled individually by each application, and the conditions under which these are possible; we then build on these results to enumerate the potentially dangerous data flows enabled by the set of applications as a whole. This paper describes our analysis method, implementation, and experimental results.
Points-to analysis that scales to large programs is still an open area of research and there are several trade-offs between speed and precision. In this paper, we report advances in achieving extremely fast and scalable analysis for field-sensitive inclusion-based points-to analysis. The first algorithm is based on an explicit representation, sparse bit-vector set representation. The second algorithm is a refinement of the first using symbolic set representations using binary decision diagrams. The first algorithm scales extremely well when compared with the state-of-the-art points-to analysis problems solving the same problem, while the second reduces the memory footprint tremendously, using, on average, 4.6x less memory than the first, and even performs slightly faster points-to set propagation. The techniques that we introduce are a judicious combination of several heuristics involving sparse bit-vector set representations, prioritized processing of worklists for efficient iteration while computing fixed-points, and usage of binary decision diagrams for storing (but not propagating) points-to sets. The implementation of our approaches scales to large real life Java applications. We evaluated our implementation on benchmark applications from two recent releases of DaCapo benchmark suite using a recent version of Java Standard Library (JRE 1.7_03). Using our techniques we can propagate points-to information on all the benchmarks in less than a minute, using at most 2GB of memory for explicit representation and, at most 600MB for symbolic representation. Comparison with the fastest and the most closely related explicit and symbolic approaches reveals that our techniques are more scalable than related explicit approaches, and in terms of time, on average 4x times faster than the current state-of-the-art.
