Bytecode Analysis Research Articles

Evolution of automated weakness detection in Ethereum bytecode: a comprehensive study

Blockchain programs (also known as smart contracts) manage valuable assets like cryptocurrencies and tokens, and implement protocols in domains like decentralized finance (DeFi) and supply-chain management. These types of applications require a high level of security that is hard to achieve due to the transparency of public blockchains. Numerous tools support developers and auditors in the task of detecting weaknesses. As a young technology, blockchains and utilities evolve fast, making it challenging for tools and developers to keep up with the pace. In this work, we study the robustness of code analysis tools and the evolution of weakness detection on a dataset representing six years of blockchain activity. We focus on Ethereum as the crypto ecosystem with the largest number of developers and deployed programs. We investigate the behavior of single tools as well as the agreement of several tools addressing similar weaknesses. Our study is the first that is based on the entire body of deployed bytecode on Ethereum’s main chain. We achieve this coverage by considering bytecodes as equivalent if they share the same skeleton. The skeleton of a bytecode is obtained by omitting functionally irrelevant parts. This reduces the 48 million contracts deployed on Ethereum up to January 2022 to 248 328 contracts with distinct skeletons. For bulk execution, we utilize the open-source framework SmartBugs that facilitates the analysis of Solidity smart contracts, and enhance it to accept also bytecode as the only input. Moreover, we integrate six further tools for bytecode analysis. The execution of the 12 tools included in our study on the dataset took 30 CPU years. While the tools report a total of 1 307 486 potential weaknesses, we observe a decrease in reported weaknesses over time, as well as a degradation of tools to varying degrees.

Performance Study of Kotlin and Java Programs with Bytecode Analysis

Performance Study of Kotlin and Java Programs with Bytecode Analysis

Intelligent Mining of Association Rules Based on Nanopatterns for Code Smells Detection

Software maintenance is an imperative step in software development. Code smells can arise as a result of poor design as well as frequent code changes due to changing needs. Early detection of code smells during software development can help with software maintenance. This work focuses on identifying code smells on Java software using nanopatterns. Nanopatterns are method-level code structures that reflect the presence of code smells. Nanopatterns are extracted using a command-line interface based on the ASM bytecode analysis. Class labels are extracted using three tools, namely inFusion, JDeodorant, and iPlasma. Rules are extracted from nanopatterns using the Apriori algorithm and mapped with the extracted class labels. Best rules are selected using the Border Collie Optimization (BCO) algorithm with the accuracy of the k-NN classifier as the fitness function. The selected rules are stored in the rule base to detect code smells. The objective is to detect a maximum number of code smells with a minimum number of rules. Experiments are carried out on Java software, namely jEdit, Nutch, Lucene, and Rhino. The proposed work detects code smells, namely data class, blob, spaghetti code, functional decomposition, and feature envy, with 98.78% accuracy for jEdit, 97.45% for Nutch, 95.58% for Lucene, and 96.34% for Rhino. The performance of the proposed work is competitive with other well-known methods of detecting code smells.

The Java Pathfinder Workshop 2022

Java Pathfinder (JPF) was originally developed as an explicit state software model checker and subsequently evolved into an extensible Java bytecode analysis framework that has been successfully used to implement techniques such as symbolic and concolic execution, compositional verification, parallel execution, incremental program analysis, and many more. Apart from its original domain of concurrent Java programs, JPF now supports the verification of new domains such as UMLs, numeric programs, graphical user interfaces, and Android applications.

The Java Pathfinder Workshop 2019

Java Path nder (JPF) was originally developed as an explicit- state software model checker, and subsequently evolved into an extensible Java bytecode analysis framework that has been suc- cessfully used to implement techniques such as symbolic and con- colic execution, compositional veri cation, parallel execution, in- cremental program analysis, and many more. To share recent research progress with JPF and related tools among the community, we have organized the annual JPF work- shop with the Automated Software Engineering Conference (ASE) 2019, held in San Diego, California, USA. We invited submissions about on-going and existing research, experience, and position papers on topics (1) related to JPF, its extensions and applica- tions in various domains; and (2) Java/Android program analysis in general. This paper gives an overview of all presentations and papers of the workshop, as well the results of the discussions.

TEGDroid: Test Case Generation Approach for Android Apps Considering Context and GUI Events

The advancement in mobile technologies has led to the production of mobile devices (e.g. smartphone) with rich innovative features. This has enabled the development of mobile applications that offer users an advanced and extremely localized context-aware content. The recent dependence of people on mobile applications for various computational needs poses a significant concern on the quality of mobile applications. In order to build a high quality and more reliable applications, there is a need for effective testing techniques to test the applications. Most existing testing technique focuses on GUI events only without sufficient support for context events. This makes it difficult to identify other defects in the changes that can be inclined by context in which an application runs. This paper presents an approach named TEGDroid for generating test case for Android Apps considering both context and GUI Events. The GUI and context events are identified through the static analysis of bytecode, and the analysis of app’s permission from the XML file. An experiment was performed on real world mobile apps to evaluate TEGDroid. Our experimental results show that TEGDroid is effective in identifying context events and had 65%-91% coverage across the eight selected applications. To evaluate the fault detection capability of this approach, mutation testing was performed by introducing mutants to the applications. Results from the mutation analysis shows that 100% of the mutants were killed. This indicates that TEGDroid have the capability to detect faults in mobile apps.

Upsortable

Top-k queries over data streams is a well studied problem. There exists numerous systems allowing to process continuous queries over sliding windows. At the opposite, non-append only streams call for ad-hoc solutions, e.g. tailor-made solutions implemented in a mainstream programming language. In the meantime, the Stream API and lambda expressions have been added in Java 8, thus gaining powerful operations for data stream processing. However, the Java Collections Framework does not provide data structures to safely and conveniently support sorted collections of evolving data. In this paper, we demonstrate Upsortable, an annotation-based approach that allows to use existing sorted collections from the standard Java API for dynamic data management. Our approach relies on a combination of pre-compilation abstract syntax tree modifications and runtime analysis of bytecode. Upsortable offers the developer a safe and time-efficient solution for developing top-k queries on data streams while keeping a full compatibility with standard Java.

Symbolic PathFinder: integrating symbolic execution with model checking for Java bytecode analysis

Symbolic PathFinder (SPF) is a software analysis tool that combines symbolic execution with model checking for automated test case generation and error detection in Java bytecode programs. In SPF, programs are executed on symbolic inputs representing multiple concrete inputs and the values of program variables are represented by expressions over those symbolic inputs. Constraints over these expressions are generated from the analysis of different paths through the program. The constraints are solved with off-the-shelf solvers to determine path feasibility and to generate test inputs. Model checking is used to explore different symbolic program executions, to systematically handle aliasing in the input data structures, and to analyze the multithreading present in the code. SPF incorporates techniques for handling input data structures, strings, and native calls to external libraries, as well as for solving complex mathematical constraints. We describe the tool and its application at NASA, in academia, and in industry.

ICST 2009 Special Issue

This special issue contains extended versions of four papers from the second IEEE International Conference on Software Testing Verification and Validation (ICST 2009). These four papers were selected based on the reviews from members of the program committee and subsequently subjected to additional rounds of review and revision. We issued 10 invitations to this special issue. Three authors declined to submit, two were not selected after submission, one chose not to revise the paper after being reviewed, and four papers were eventually accepted. The first paper is Reducing Logic Test Set Size While Preserving Fault Detection, by Kaminski and Ammann. This paper introduces a new logic criterion, Minimal-MUMCUT, which has less overlap in terms of faults detected than previous logic criteria, and thus requires fewer tests. It is also provably stronger than the widely used MCDC. The second paper is Improving Penetration Testing through Static and Dynamic Analysis, by Halfond, Choudhary, and Orso. Penetration testing seeks vulnerabilities in software by simulating attacks. Halfond et al. use new software analysis techniques to improve penetration testing. The conference version won the best paper award at ICST 2009. The third paper is An Approach for Testing Pointcut Descriptiors in AspectJ, by Romain Delamare, Baudry, Ghosh, Gupta, and Le Traon. Aspect-oriented programming uses ‘crosscutting concerns’ to increase modularity in software, by encapsulating pieces of software that appear in separate units into their own objects. Delamare et al. have invented testing techniques to find faults in the descriptions of the aspects. The fourth paper is JDAMA: Java Database Application Mutation Analyzer, by Zhou and Frankl. Modern software uses databases much more than in the past, opening up a place for software faults to appear. Database queries are often long, complicated logical expressions, with lots of potential for faults. When the faults are subtle, most queries will return the correct information, and when they do fail, the tables that are returned often look correct. Zhou and Frankl extend a previous mutation-based approach to use analysis and instrumentation of bytecode. All four papers in the ICST 2009 special issue are partially drawn from each of the first authors' PhD Dissertations. The ICST organizers take this as a strong measure of success of the conference. Six years ago, if a student asked ‘where is the best place to publish a paper on testing software?’ the answer was far from clear. The field had several special purpose testing conferences, and many conferences included testing as one topic, but not the main topic. We also had conferences that were intentionally kept very small, even as field was growing. The conference that published the most testing papers was the International Symposium on Software Reliability Engineering, even though its main topic was not testing. It was clear that we had a real need; a need for a large-scale, high quality, broad conference that included all facets of testing, verification, and validation. Thus, a small group (initially Anneliese Andrews, Lionel Briand, and Jeff Offutt) started developing ideas for a new conference in the summer of 2005. This group grew quickly to 30 or 40 people who shared this vision of a new major conference in software testing. A steering committee was elected from that group in 2007 (Andrews, Baudry, Briand, Harman, Hierons, Le Traon, Mathur, Offutt, Williams) and a preliminary charter was approved in 2007, followed by a proposal to the IEEE Computer Society in 2007. The first ICST conference was held in Lillehammer, Norway in 2008, the second in Denver, USA in 2009, the third in Paris, France in 2010, and the fourth in Berlin, Germany in 2011. Because of the obvious overlap, STVR committed to offering a special issue to ICST on a yearly basis. The special issue for ICST 2008 appeared earlier this year, and the special issues for ICST 2010 and 2011 should appear next year. On a final note, we express our gratitude to the many hard working people who helped organize ICST 2009 and this special issue. The steering committee members provided valuable advice and we were assisted by industry chairs Wolfgang Grieskamp, Christian Zapf, and Robert Binder, and general chair Anneliese Andrews. The success of ICST 2009 and the high quality papers in this special issue is due to the efforts of these individuals as well as the Technical Program Committee for ICST 2009 and the additional reviewers for this special issue. We also appreciate the hard work from the ICST 2009 local arrangements chair, Susanne Sherba, the web chair, Orest Pilskalns, and our publicity chairs, Robert Feldt, Jens Krink, Shaoying Liu, Jose Maldonado, and Tao Xie. And last but certainly not least, we thank all the authors who spent valuable time in preparing papers for ICST 2009 and this special issue. 7 July 2011

Using Genetic Search for Reverse Engineering of Parametric Behavior Models for Performance Prediction

In component-based software engineering, existing components are often reused in new applications. Correspondingly, the response time of an entire component-based application can be predicted from the execution durations of individual component services. These execution durations depend on the runtime behavior of a component which itself is influenced by three factors: the execution platform, the usage profile, and the component wiring. To cover all relevant combinations of these influencing factors, conventional prediction of response times requires repeated deployment and measurements of component services for all such combinations, incurring a substantial effort. This paper presents a novel comprehensive approach for reverse engineering and performance prediction of components. In it, genetic programming is utilized for reconstructing a behavior model from monitoring data, runtime bytecode counts, and static bytecode analysis. The resulting behavior model is parameterized over all three performance-influencing factors, which are specified separately. This results in significantly fewer measurements: The behavior model is reconstructed only once per component service, and one application-independent bytecode benchmark run is sufficient to characterize an execution platform. To predict the execution durations for a concrete platform, our approach combines the behavior model with platform-specific benchmarking results. We validate our approach by predicting the performance of a file sharing application.

자바 바이트코드 프레임워크 구현

In this paper, we design and implement CTOC, a new bytecode analysis and translation tool. We also propose E-Tree, a new intermediate code, to efficiently deal with intermediate codes translated from bytecodes. E-Tree is expressed in a tree form by combining relevant bytecode instructions in basic blocks of eCFG to overcome the weaknesses of bytecodes such as complexity and analytical difficulty. To demonstrate the usefulness and possible extensibility of CTOC, we show the creation process of eCFG and E-Tree through practical bytecode analysis and translation and shows the optimization process of a bytecode program as an example of possible extensibility.

Formalizing non-interference for a simple bytecode language in Coq

Abstract In this paper, we describe the application of the interactive theorem prover Coq to the security analysis of bytecode as used in Java. We provide a generic specification and proof of non-interference for bytecode languages using the Coq module system. We illustrate the use of this formalization by applying it to a small subset of Java bytecode. The emphasis of the paper is on modularity of a language formalization and its analysis in a machine proof.

Bytecode Rewriting in Tom

In this paper, we present a term rewriting based library for manipulating Java bytecode. We define a mapping from bytecode programs to algebraic terms, and we use Tom, an extension of Java that adds pattern-matching facilities, to describe transformations. An originality of Tom is that it provides a powerful strategy language to express traversals over trees and to control how transformation rules are applied. To be even more expressive, we use CTL formulae as conditions and we show how their satisfiability can be ensured using the strategy formalism. Through small examples, we show how bytecode analysis and transformations can be defined in an elegant way. In particular, we outline the implementation of a ClassLoader parameterized by a security policy that restricts file access.

Static Type Assignment for SSA Form in CTOC

Although the Java bytecode has numerous advantages, it also has certain shortcomings such as its slow execution speed and difficulty of analysis. In order to overcome such disadvantages, a bytecode analysis and optimization must be performed. The control flow of the bytecode should be analyzed; next, information is required regarding where the variables are defined and used to conduct a dataflow analysis and optimization. There may be cases where variables with an identical name contain different values at different locations during execution, according to the value assigned to a given variable in each location. Therefore, in order to statically determine the value and type, the variables must be separated according to allocation. In order to achieve this, variables can be expressed using a static single assignment form. After transformation into a static single assignment form, the type information of each node expressed by each variable and expression must be configured to perform a static analysis and optimization. Based on the basic type information, this paper proposes a method for finding the related equivalent nodes, setting nodes with strong connection components, and efficiently assigning each node type.

CTOC에서 자바 바이트코드를 위한 정적 단일 배정 형태

Although the Java bytecode has numerous advantages, there are also shortcomings such as slow execution speed and difficulty in analysis. In order to overcome such disadvantages, bytecode analysis and optimization must be performed. We implements CTOC for optimized codes. An extended CFG must be first created in order to analyze and optimize a bytecode. Due to unique bytecode properties, the existing CFG must be expanded according to the bytecode. Furthermore, the CFG must be converted into SSA Form for a static analysis, for which calculation is required for various information such as the dominate relation, dominator tree, immediate dominator, -function, rename, and dominance frontier. This paper describes the algorithm and the process for converting the existing CFG into the SSA From. The graph that incorporates the SSA Form is later used for type inference and optimization.

BAT2XML: XML-based Java Bytecode Representation

The creation, transformation and analysis of bytecode is widespread. Nevertheless, several problems related to the reusability and comprehensibility of the results and tools exist. In particular, the results of tools for bytecode analysis are usually represented in proprietary tool dependent ways, which makes it hard to build more sophisticated analysis on top of the results generated by tools for lower-level analysis.Furthermore, intermediate results, such as e.g., the results of basic control flow and dataflow analysis, are usually not explicitly represented at all; though, required by many more sophisticated analysis. This lack of a common format, for the well structured representation of the (intermediate) results of code analysis, makes the creation of new tools or the integration of the results generated by different tools costly and ineffective.To solve the highlighted problems, we propose a higher-level XML-based representation of Java bytecode which is designed as a common platform for the creation and transformation of bytecode and explicitly enables the integration of arbitrary information generated by different tools for static code analysis.

Subroutine Inlining and Bytecode Abstraction to Simplify Static and Dynamic Analysis

In Java bytecode, intra-method subroutines are employed to represent code in “finally” blocks. The use of such polymorphic subroutines within a method makes bytecode analysis very difficult. Fortunately, such subroutines can be eliminated through recompilation or inlining. Inlining is the obvious choice since it does not require changing compilers or access to the source code. It also allows transformation of legacy bytecode. However, the combination of nested, non-contiguous subroutines with overlapping exception handlers poses a difficult challenge. This paper presents an algorithm that successfully solves all these problems without producing superfluous instructions. Furthermore, inlining can be combined with bytecode simplification, using abstract bytecode. We show how this abstration is extended to the full set of instructions and how it simplifies static and dynamic analysis.

Annotating the Java bytecodes in support of optimization

The efficient execution of Java programs presents a challenge to hardware and software designers alike. The difficulty, however, lies with the Java bytecodes. Their model of a simplistic, platform-independent stack machine is well-suited for portability, though at the expense of execution speed. Various approaches are being proposed to increase the speed of Java bytecode programs, including: (i) on-the-fly compilation to native code (also known as JIT or ‘just-in-time’ compilation); (ii) traditional (‘ahead-of-time’) compilation of bytecodes to some higher-level intermediate form and then to native code; and (iii) translation of bytecodes to a higher-level language and then use of an existing compiler to produce native code. Speedups of the order of 50 over standard bytecode interpretation have been claimed. All of these approaches rely upon bytecode analysis (of varying sophistication) to extract information about the program, which is then used to optimize the native code during the translation process. However, extracting information from a lower-level representation such as the Java bytecodes can be very expensive. Also, given the fact that most approaches for executing Java bytecodes cannot spend a great deal of time recovering high-level information, the solutions adopted during the translation process must use faster and less accurate analysis techniques, thus penalizing the quality of the native code. In this paper we propose an optimization approach based on bytecode annotations. The bytecodes are annotated during the original source code to bytecode translation, allowing both traditional interpretation by a JVM and aggressive optimization by an annotation-aware bytecode compiler. Annotations hinder neither portability nor compatibility, while preserving optimization information that is expensive to recompute. Preliminary results yield bytecode with C-like performance using JIT technology. © 1997 John Wiley & Sons, Ltd.

Java Mobile Code Security by Bytecode Analysis

Since mobile code can migrate from a remote site to a host and can interact with the resources and facilities of the host, security becomes the key to the success of mobile code computation. Existing mobile code security mechanisms such as access control are not able to fully address the import security properties of the host including confidentiality and integrity. And these practices tend to protect the host from potential attacks by confining the mobile code, thus will impair the function of mobile code. Information-flow policy is a technique that can ensure confidentiality, however the analysis of the information flow is practically difficult. This paper describes an innovative approach to provide Java mobile code system security by bytecode analysis. The key technique of the approach is the dependence analysis adapted to information flow analysis. A security model for mobile code system is also proposed in this paper. By this approach, two major properties of the host security– integrity and confidentiality can be protected while the additional restriction on mobile code can be greatly avoided. A prototype has been implemented, which can be applied to analyze Java class file, applet and mobile agent.

Bytecode-Based Analysis for Increasing Class-Component Testability

Software testing attempts to reveal software faults by executing the program on input values and comparing the outputs from the execution with expected outputs. Testing software is easier when testability is high, so increasing testability allows faults to bedetected more efficiently. Component-based software is often constructed from third party software components. When this is done, the reused components must be retested in the new environment to ensure that they integrate correctly into the new context. However, the “black box” nature of reused components, although offering great benefits otherwise, implicitly reduces their testability. Therefore, it helps to increase a component’s testability before it is reused. To increase a component’s testability, we need information that can be gained through program analysis. A crucial property of reused software components is that the source is not available, making program analysis significantly more difficult. This research addresses this problem by performing program analysis at the bytecode level. This bytecode analysis technique increases component testability without requiring access to the source. A component’s bytecode is analyzed to gather control and data flow information, which is then used to obtain definition and use information of method and class variables. Then, the definition and use information is used to increase component testability during component integration testing. We have implemented the technique and present empirical results for some components, demonstrating that the method is feasible and practical.