Sootdiff: Bytecode comparison across different java compilers

A Dann, B Hermann, E Bodden - Proceedings of the 8th ACM SIGPLAN …, 2019 - dl.acm.org
Proceedings of the 8th ACM SIGPLAN International Workshop on State of the …, 2019dl.acm.org
Different Java compilers and compiler versions, eg, javac or ecj, produce different bytecode
from the same source code. This makes it hard to trace if the bytecode of an open-source
library really matches the provided source code. Moreover, it prevents one from detecting
which open-source libraries have been re-compiled and rebundled into a single jar, which is
a common way to distribute an application. Such rebundling is problematic because it
prevents one to check if the jar file contains open-source libraries with known vulnerabilities …
Different Java compilers and compiler versions, e.g., javac or ecj, produce different bytecode from the same source code. This makes it hard to trace if the bytecode of an open-source library really matches the provided source code. Moreover, it prevents one from detecting which open-source libraries have been re-compiled and rebundled into a single jar, which is a common way to distribute an application. Such rebundling is problematic because it prevents one to check if the jar file contains open-source libraries with known vulnerabilities. To cope with these problems, we propose the tool SootDiff that uses Soot's intermediate representation Jimple, in combination with code clone detection techniques, to reduce dissimilarities introduced by different compilers, and to identify clones. Our results show that SootDiff successfully identifies clones in 102 of 144 cases, whereas bytecode comparison succeeds in 58 cases only.
ACM Digital Library
以上显示的是最相近的搜索结果。 查看全部搜索结果