César Soto-Valero, Thomas Durieux, Nicolas Harrand et al. · arXiv (Cornell University) · 2020
Software bloat is code that is packaged in an application but is actually not necessary to run the application. The presence of software bloat is an issue for security, for performance, and for maintenance. In this paper, we introduce a novel technique for debloating, which we call coverage-based debloating. We implement the technique for one single language: Java bytecode. We leverage a combination of state-of-the-art Java bytecode coverage tools to precisely capture what parts of a project and its dependencies are used when running with a specific workload. Then, we automatically remove the parts that are not covered, in order to generate a debloated version of the project. We succeed to debloat 211 library versions from a dataset of 94 unique open-source Java libraries. The debloated versions are syntactically correct and preserve their original behavior according to the workload. Our results indicate that 68.3% of the libraries' bytecode and 20.3% of their total dependencies can be removed through coverage-based debloating. For the first time in the literature on software debloating, we assess the utility of debloated libraries with respect to client applications that reuse them. We select 988 client projects that either have a direct reference to the debloated library in their source code or which test suite covers at least one class of the libraries that we debloat. Our results show that 81.5% of the clients, with at least one test that uses the library, successfully compile and pass their test suite when the original library is replaced by its debloated version.
Cited by 2Open access
Pinto Camara, Tarcisio · Americanae (AECID Library) · 2014
Cited by 0Open access
Jens Dietrich, Behnaz Hassanshahi · 2025
The security of software builds has attracted increased attention in recent years in response to incidents like solarwinds and xz. Now, several companies including Oracle and Google rebuild open source projects in a secure environment and publish the resulting binaries through dedicated repositories. This practice enables direct comparison between these rebuilt binaries and the original ones produced by developers and published in repositories such as Maven Central. These binaries are often not bitwise identical; however, in most cases, the differences can be attributed to variations in the build environment, and the binaries can still be considered equivalent. Establishing such equivalence, however, is a labor-intensive and error-prone process.While there are some tools that can be used for this purpose, they all fall short of providing provenance, i.e. readable explanation of why two binaries are equivalent, or not. To address this issue, we present daleq, a tool that disassembles Java byte code into a relational database, and can normalise this database by applying datalog rules. Those databases can then be used to infer equivalence between two classes. Notably, equivalence statements are accompanied with datalog proofs recording the normalisation process. We demonstrate the impact of daleq in an industrial context through a large-scale evaluation involving 2,714 pairs of jars, comprising 265,690 class pairs. In this evaluation, daleq is compared to two existing bytecode transformation tools. Our findings reveal a significant reduction in the manual effort required to assess non-bitwise equivalent artifacts, which would otherwise demand intensive human inspection. Furthermore, the results show that daleq outperforms existing tools by identifying more artifacts rebuilt from the same code as equivalent, even when no behavioral differences are present.
Cited by 0
Aine Leddy, James Power, John Waldron · 2002
Much research has been conducted in the analysis of Java bytecodes in order to gain a better understanding of how Java programs behave. One branch of this research has focused on analysing bytecode usage within the Java Virtual Machine (JVM), with particular emphasis on analysing bytecodes associated with various benchmark programs.
Cited by 0
Jung Sung-Ok, Lee Sung-Joo, Kwangman Ko · 2000
The massive growth of the Internet and the World Wide Web has lead to research into programming languages for the development of applications in heterogeneous, network-wide distributed environments. Java is an object-oriented language for such an environment and the Java programming language environment provides a portable, interpreted, high-performance, simple programming language. Bytecode is an intermediate code for the Java language and it enables the development of applications on multiple platforms in heterogeneous, distributed networks, but it takes a lot of time to execute bytecode because an interpretation method is used. We design and implement a retargetable code generation system, which can be systematically reconfigured to generate code for a variety of distinct target computers. Using the system, we realize the code generator which translates the bytecode being produced by the Java compiler into native target code. We use the ACK system to do the work easily.
Cited by 1
Ziegler, Patrick · Repository for Publications and Research Data (ETH Zurich) · 2023
Cited by 0Open access
Insik Shin, John C. Mitchell · 2007
While the Java Virtual Machine includes a bytecode verifier that checks bytecode programs before execution, and a bytecode interpreter that performs run-time tests such as array bounds and null-pointer checks, Java applets may still behave in ways that are annoying or potentially harmful to users. For example, applets may mount denial-of-service attacks, forge email or display misleading information in order to trick users. With these concerns in mind, we present techniques that may be used to insert additional run-time tests into Java applets. These techniques may be used to restrict applet behavior or, potentially, insert code appropriate to profiling or other monitoring efforts. The main techniques are class-level modification, involving subclassing non-final classes, and method-level modification, which may be used when control over objects from final classes is desired. Subject Areas: language design and implementation, analysis and design methods, software engineering practices, ...
Cited by 0
Key Words · 2008
Java applets run on a Virtual Machine that checks code’s integrity and correctness before execution using a module called Bytecode Verifier. Java Card technology allows Java applets to run on smart cards. Large memory space requirements of the verification process do not allow the implementation of a Bytecode Verifier embedded in the Java Card Virtual Machine. To address this feasibility problem, we propose a modified verification algorithm that optimizes the use of system memory. The algorithm, inspired to compilers’ techniques, partitions the code of the methods into control regions. In this way data structures can be dynamically allocated and the verification process can be applied locally to a subset of instructions.
Cited by 0
Azevedo, Ana, Nicolau, Alex, Hummel, Joe · eScholarship (California Digital Library) · 1999
This paper summarizes the Java Bytecode Annotations currently supported or under implementation in our Annotation-generating Java Bytecode Compiler (AJBC) and in our Annotation-aware JIT compilation system (AJIT). We explain the meaning of the annotation types, how they are generated by the Java Bytecode compiler, the formats for encoding annotations in the class file and how annotations are employed by a JVM engine (an interpreter or a JIT compiler) to produce high performance code. We analyze the potential benefits and costs of the different types of annotations and identify possible improvement and extensions.
Cited by 0
Elvira Albert, Samir Genaim, Miguel Gómez‐Zamalloa · 2007
This article presents a heap space analysis for (sequential) Java bytecode. The analysis generates heap space cost relations which define at compile-time the heap consumption of a program as a function of its data size. These relations can be used to obtain upper bounds on the heap space located during the execution of the different methods. In addition, we describe how to refine the cost relations, by relying on escape analysis, in order to take into account the heap space that can be safely deallocated by the garbage collector upon exit from a corresponding method. These refined cost relations are then used to infer upper bounds on the active heap space upon methods return. Example applications for the analysis consider inference of constant heap usage and heap usage proportional to the data size (including polynomial and exponential heap consumption). Our prototype implementation is reported and demonstrated by means of a series of examples which illustrate how the analysis naturally encompasses standard data-structures like lists, trees and arrays with several dimensions written in object-oriented programming style.
Cited by 50
James Hamilton, Sebastian Danicic · 2013
bytecode languages such as Java bytecode and Microsoft’s Common Intermediate Language have made copying, decompiling and disassembling software easier. The global revenue loss due to software piracy was estimated to be more than $50 billion in 2008. Watermarking is a technique which attempts to protect software by inserting copyright notices or unique identifiers into software to prove ownership. We evaluate the existing Java static watermarking systems and algorithms by using them to watermark bytecode files and then applying distortive attacks to each watermarked program by obfuscating and optimising. Our study revealed that a high proportion of watermarks were removed as a result of these transformations both in the commercial and academic watermarking systems that we tested. This is further evidence that static watermarking techniques on their own do not give sufficient protection against software piracy.
Cited by 0
Joachim Posegga, Harald Vogt · 1998
We provide an abstract interpretation for Java bytecode programs to build finite state models of these programs. We describe the bytecode constraints as CTL formulas which can be checked against the finite models by a (standard) model checker. We see a practical way to perform bytecode verification on a formal basis in that it could help to achieve higher security and open the door for further extensions to prove additional properties of Java bytecode.
Cited by 0
Raja Vallee-Rai, Phong Co, Etienne Gagnon et al. · eScholarship@McGill (McGill) · 1999
Java provides many attractive features such as platform independence, execution safety, garbage collection and object orientation. These features facilitate application development but are expensive to support; applications written in Java are often much slower than their counterparts written in C or C++. To use these features without having to pay a great performance penalty, sophisticated optimizations and runtime systems are required.
Cited by 11Open access
Étienne Payet, Fred Mesnard, Fausto Spoto · arXiv (Cornell University) · 2014
We introduce a fully automated static analysis that takes a sequential Java bytecode program P as input and attempts to prove that there exists an infinite execution of P. The technique consists in compiling P into a constraint logic program P_CLP and in proving non-termination of P_CLP; when P consists of instructions that are exactly compiled into constraints, the non-termination of P_CLP entails that of P. Our approach can handle method calls; to the best of our knowledge, it is the first static approach for Java bytecode able to prove the existence of infinite recursions. We have implemented our technique inside the Julia analyser. We have compared the results of Julia on a set of 113 programs with those provided by AProVE and Invel, the only freely usable non-termination analysers comparable to ours that we are aware of. Only Julia could detect non-termination due to infinite recursion.
Cited by 2Open access
Chun-yuan Chen, Zong Qiang Chen, Wuu Yang · 2008
Java has become one of the most popular languages for network applications. The main drawback of Java is concerned with the execution speed due to interpreted execution. We implemented a translation system that converts Java bytecode to X86 assembly code. The main approach of our translation system is that objects are still created and manipulated inside the (run-time) Java virtual machine. Other ordinary operations are translated into assembly code. Some pattern-based optimizations are applied during the translation process. Faster execution of Java programs will certainly make Java more attractive to network applications.
Cited by 0
LATTANZI, EMANUELE, BOGLIOLO, ALESSANDRO, BENINI L · CINECA IRIS Institutional Research information system (University of Urbino) · 2003
We present a portable profiling tool for Java and its application to the\nanalysis and comparison of the run-time behavior of embedded applications running on different platforms. Portability is achieved by instrumenting directly the bytecode of the target application. The instrumented bytecode can then be executed on different embedded platforms to collect valuable information for design space exploration and platform-specific code optimization.
Cited by 0
O'Donoghue, Diarmuid P., Leddy, Aine, Power, James F. et al. · Maynooth University ePrints and eTheses Archive (Maynooth University) · 2002
We report on a project that performed a bigram analysis of dynamic bytecode sequences. The objective was to identify the most commonly used bytecode pairs, and to examine the relative frequency of occurrence of these bytecodes. In all, 12 large Java programs were analysed, taken from the Java Grande and SPEC benchmark suites. Our findings are of relevance to research into instruction set design and implementation, as well as JVM optimisation
Cited by 0Open access
Stefan Marx, Sebastian Erdweg · 2024
We develop a framework of definitional abstract interpreters for Java bytecode in Sturdy. Specifically, we provide a generic interpreter that abstractly executes Java bytecode but resorts to configurable analysis components for abstracting values and effects. From this, we can derive a concrete reference semantics for Java bytecode and sound abstract interpreters.
Cited by 1
Tomaž Dobravec · Acta Electrotechnica et Informatica · 2018
Development of algorithms for solving various kinds of computer related problems consists of several consecutive and possibly repetitive phases. The final and very important step in this process is to implement the developed algorithm in a selected programming language, to test its behavior on some real-world test cases and to compare the results with the results of other algorithms. This evaluation can be done by comparing different execution indicators among which the time consumption is usually considered to be the most relevant. On the other hand, timing the algorithms in practice is very difficult since it is hard to ensure a fair and reproducible environment in which algorithm's implementations can be compared. To overcome this barrier, we introduce a system called ALGATOR that was developed to facilitate the algorithm evaluation process. Besides the time complexity and the project-specific indicators, ALGATOR also measures the counters of Java code and Java bytecode usage. The measurement of the former is implemented by using special tags that are to be inserted in the appropriate lines of Java code while the measurement of the latest is enabled by using an adapted Java virtual machine, which counts the Java bytecode usage and reports the statistics. By using this counters new timingindependent criteria for algorithm assessment can be derived. In this paper we present some basic concepts of the ALGATOR system and give some examples of how to use the system in practice. We show the distribution of the usage of Java bytecode instruction for the sorting problem and the usage of the Java bytecode indicators in the time-complexity prediction for the matrix multiplication algorithm. The examples presented in this article show how the classic time measurement methods can be replaced by measuring some other more reliable indicators, and how this measurements can help to asses the quality of our algorithms.
Cited by 0Open access
Martin Zabel · Qucosa (Saxon State and University Library Dresden) · 2011
Die Java-Plattform bietet viele Vorteile für die schnelle Entwicklung komplexer Software. Für die Ausführung des Java-Bytecodes auf eingebetteten Systemen eignen sich insbesondere Java-(Bytecode)-Prozessoren, die den Java-Bytecode als nativen Befehlssatz unterstützen. Die vorliegende Arbeit untersucht detailliert die Gestaltung einer Mehrkernarchitektur für Java-Prozessoren zur effizienten Nutzung der auf Thread-Ebene ohnehin vorhandenen Parallelität eines Java-Programms. Für die Funktionalitäts- und Leistungsbewertung eines Prototyps wird eine eigene Trace-Architektur eingesetzt. Es wird eine hohe Leistungssteigerung bei nur geringem zusätzlichem Hardwareaufwand erzielt sowie eine höhere Leistung als bekannte alternative Ansätze erreicht.
Cited by 1Open access