Chava: reverse engineering and tracking of Java applets

Abstract

Java applets have been used increasingly on Web sites to perform client-side processing and provide dynamic content. While many Web site analysis tools are available, their focus has been on static HTML content and most ignore applet code completely. The paper presents Chava, a system that analyzes and tracks changes in Java applets. The tool extracts information from applet code about classes, methods, fields and their relationships into a relational database. Supplementary checksum information in the database is used to detect changes in two versions of a Java applet. Given our Java data model, a suite of programs that query, visualize, and analyze the structural information were generated automatically from CIAO, a retargetable reverse engineering system. Chava is able to process either Java source files or compiled class files, making it possible to analyze remote applets, whose source code is unavailable. The information can be combined with HTML analysis tools to track both the static and dynamic content of many Web sites. The paper presents our data model for Java and describes the implementation of Chava. Advanced reverse engineering tasks such as reachability analysis, clustering, and program differencing can be built on top of Chava to support design recovery and selective regression testing. In particular, we show how Chava is used to compare several Java Development Kit (JDK) versions to help spot changes that might impact Java developers. Performance numbers indicate that the tool scales well.