[François Taïani] Software

During my Ph.D. I contributed to the DAISY demonstration platform, and I developed a reverse-engineering environment that targets the multi-level structures encountered in today's complex software systems (CosmOpen).

CosmOpen

CosmOpen is a suite of reverse-engineering tools that helps developpers understand the complex behavioural relationships found in large software. CosmOpen allows users to navigate and mine otherwise intractable call graphes, and rapidly construct behavioural views of a complex system from a huge amount of dynamic data.

I have used CosmOpen to partially reverse-engineer an industry-grade CORBA implementation, Orbacus (Figure 1), and identify the key elements of a request lifecycle inside the ORB (Figure 2).

Figure 1 shows the interaction diagram that is obtained when directly observing Orbacus. This diagram is pretty much incomprehensible, whereas the filtered-out version of Figure 2, which was obtained with CosmOpen, clearly shows the different stages of a request's processing, from the socket connection ('accept'), up to the execution of the remote server method ('Hello_impl'), and through to the reply being sent ('send'). This second diagram also highlights the various threads involved and their relationships, something that is completely hidden by the original diagram's complexity.

[Orbacus-Complete-ThreadPool.png]

Fig. 1: Orbacus's 4.1.2 request processing, obtained by CosmOpen's observation tool, dyngdb. This graph was constructed from 658 stack traces, totalling 9178 stack frames. It contains 2065 individual invocations, over 50 C-functions and 140 C++ classes.

[DSN-7.png]

Fig. 2: An abstract representation of the above graph, obtained with CosmOpen's Graph Manipulation tool, OPSBrowser. You can easily see the low level socket operations used by orbacus (accept, send, recv), as well as the multiple threads spawned to process the request (t3, the accepting thread, t8, the receiver thread, t4, the worker thread).

The CosmOpen suite is made of three components: dyngdb, hydrogen, and OPSBrowser:

dyngdb is a dynamic data extraction tool, that automatically captures execution traces from a C++ executable by monitoring the gnu debugger gdb. It then uses an AWK script to produce an XML formatted file containing the stack-traces gathered from the running executable.
hydrogen is a static data extraction tool which is based on Doxygen, and extract structural information regarding the classes of a C++ program. Extracted data are saved in an XML format as well.
OPSBrowser is the most important part of the suite. It allows users to visualize and manipulate the data captured by the two other tools using a graph transformation language. The visualization is delegated to the dot layout program from ATT Labs.

Right now, only OPSBrowser and dyngdb are available under the GNU General Public License.

Download: cosmopen_1_1beta4.tar.gz

Related Publications:

CosmOpen: A Reverse-Engineering Tool for Complex Open-Source Architectures
François Taïani, Rapport LAAS No03226 Student Forum of DSN'03, The International Conference on Dependable Systems and Networks, San Francisco, CA, June 22nd-25th, 2003, pp.A49-A51 (3 p.), abstract, complete document.

CosmOpen: Dynamic reverse-engineering on a budget
François Taïani, Marc-Olivier Killijian, Jean-Charles Fabre, Technical Report COMP-002-2008, Computing Department, Lancaster University, Feb. 2008, (38 p.), abstract, complete document.

Note Right now, the software has only be tested under Linux and Mac OS X. It should be fairly portable to other platforms, but this requires a little tuning. This is beta software, and there's certainly plenty of improvement room. If you need help or have suggestion, please contact me at f.taiani@lancaster.ac.uk.

Back to Home

Last generated on 31 Oct 2008 francois.taiani@comp.lancs.ac.uk