 | This articleneeds additional citations forverification. Please helpimprove this article byadding citations to reliable sources. Unsourced material may be challenged and removed. Find sources: "Dynamic program analysis" – news ·newspapers ·books ·scholar ·JSTOR(February 2009) (Learn how and when to remove this message) |
| Program execution |
|---|
| General concepts |
| Types of code |
| Compilation strategies |
| Notable runtimes |
|
| Notable compilers & toolchains |
|
Dynamic program analysis is the act ofanalyzing software that involves executing aprogram – as opposed tostatic program analysis, which does not execute it.
Analysis can focus on different aspects of the software including but not limited to:behavior,test coverage,performance andsecurity.
To be effective, the target program must be executed with sufficient test inputs[1] to address the ranges of possible inputs and outputs.Software testing measures, such ascode coverage, and tools such asmutation testing, are used to identify where testing is inadequate.
Functional testing includes relatively commonprogramming techniques such asunit testing,integration testing andsystem testing.[2]
Computing thecode coverage of a test identifies code that is not tested.
Although this analysis identifies code that is not tested. It does not determine whether tested coded isadequately tested. Code can be executed even if the tests do not actually verify correct behavior.
Dynamic testing involves executing a program on a set of test cases.
Fuzzing is a testing technique that involves executing a program on a wide variety of inputs; often these inputs are randomly generated (at least in part).Gray-box fuzzers use code coverage to guide input generation.
Dynamic symbolic execution (also known asDSE or concolic execution) involves executing a test program on a concrete input, collecting the path constraints associated with the execution, and using aconstraint solver (generally, anSMT solver) to generate new inputs that would cause the program to take a different control-flow path, thus increasing code coverage of the test suite.[3] DSE can be considered a type offuzzing ("white-box" fuzzing).
Dynamic data-flow analysis tracks the flow of information fromsources tosinks. Forms of dynamic data-flow analysis include dynamic taint analysis and evendynamic symbolic execution.[4][5]
Daikon is an implementation of dynamic invariant detection. Daikon runs a program, observes the values thatthe program computes, and then reports properties that were true over the observed executions, and thus likely true over all executions.
Dynamic analysis can be used to detect security problems.
For a given subset of a program’s behavior, program slicing consists of reducing the program to the minimum form that still produces the selected behavior. The reduced program is called a “slice” and is a faithful representation of the original program within the domain of the specified behavior subset.Generally, finding a slice is an unsolvable problem, but by specifying the target behavior subset by the values of a set of variables, it is possible to obtain approximate slices using a data-flow algorithm. These slices are usually used by developers during debugging to locate the source of errors.
Mostperformance analysis tools use dynamic program analysis techniques.[citation needed]
Most dynamic analysis involvesinstrumentation or transformation.
Since instrumentation can affect runtime performance, interpretation of test results must account for this to avoid misidentifying a performance problem.
DynInst is a runtime code-patching library that is useful in developing dynamic program analysis probes and applying them to compiled executables. Dyninst does not requiresource code or recompilation in general, however, non-stripped executables and executables with debugging symbols are easier to instrument.
Iroh.js is a runtime code analysis library forJavaScript. It keeps track of the code execution path, provides runtime listeners to listen for specific executed code patterns and allows the interception and manipulation of the program's execution behavior.