Dynamic program analysis
lastmod 2020-09-01created 2020-09-011 edits
Dynamic program analysis is program analysis performed by executing a program on a real or virtual processor. For it to be more effective, the program must be executed with sufficiently tested inputs to produce interesting behavior. Using software testing techniques such as code coverage helps ensure that an adequate slice of the program's set of possible behaviors has been observed. Care must also be taken to minimize the effect of instrumentation on the program's execution. Inadequate testing can lead to catastrophic failures.
Dynamic analysis is in contrast to static analysis. Unit testing, integration testing, system testing, and acceptance testing use dynamic analysis.
Tools
- BoundsChecker: memory error detection for Windows-based applications. Part of Micro Focus DevPartner.
- Cenzic: released dynamic application security tools that scan web applications for security vulnerabilities.
- ClearSQL: review, quality control, and code illustration for PL/SQL.
- Daikon is an implementation of dynamic invariant detection. Daikon runs a program, observes the values that the program computes, and reports values that were true over the observed executions, i.e., values likely to be true over all executions.
- Dmalloc is a library for checking memory allocation and leaks. The software must be recompiled, and all files must include the special C header file dmalloc.h.
- DynInst is a runtime code-patching library useful for developing dynamic program analysis probes and applying them to compiled executables. Dyninst generally does not require source code or recompilation, but things like debugging symbols make instrumentation easier.
- Gcov is the GNU source code coverage program.
- HP Security Suite
- IBM Rational AppScan
- Intel Thread Checker
- Intel Parallel Inspector
- Jalangi
- OpenPAT statically instruments assembly and bytecode by calling tools with dynamic execution trace information while the program runs. Used for monitoring memory leaks.
- Parasoft Insure++ is a runtime memory analysis and error detection tool. Its Inuse component provides a graphical view of memory allocations over time, heap usage, block allocations, and more.
- Parasoft Jtest uses runtime error detection to expose defects such as race conditions, exception handling, resource and memory allocation, and security attack vulnerabilities.
- Prism by CriticalBlue
- Purify: mainly performs memory corruption and memory leak detection.
- Valgrind runs programs on a virtual processor and detects memory errors and race conditions in multithreaded programs.
- VB Watch injects dynamic analysis code into Visual Basic programs to monitor their performance, call stack, execution trace, instantiated objects, variables, and code coverage.
- Vector Fabrics Pareon Verify finds memory errors and threading errors in applications.