Efficient and Precise Dynamic Construction of Control Flow Graphs

Rimsa, Andrei; Amaral, José Nelson; Quintão, Fernando Magno

doi:10.1145/3355378.3355383

Cited by 2 publications

(3 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Second, instrumentation tends to significantly impact the program's memory and runtime performance. Overheads depend on the type of profiling information that is acquired, but can be as high as 100x [Rimsa et al , 2019. Due to these limitations, instrumentation-based techniques are usually not chosen for use in industry-quality tools, such as gprof or BOLT.…”

Section: Dynamic Profilingmentioning

confidence: 99%

VESPA: static profiling for binary optimization

Moreira

Ottoni

Pereira

2021

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

Over the past few years, there has been a surge in the popularity of binary optimizers such as BOLT, Propeller, Janus and HALO. These tools use dynamic profiling information to make optimization decisions. Although effective, gathering runtime data presents developers with inconveniences such as unrepresentative inputs, the need to accommodate software modifications, and longer build times. In this paper, we revisit the static profiling technique proposed by Calder et al. in the late 90’s, and investigate its application to drive binary optimizations, in the context of the BOLT binary optimizer, as a replacement for dynamic profiling. A few core modifications to Calder et al.’s original proposal, consisting of new program features and a new regression model, are sufficient to enable some of the gains obtained through runtime profiling. An evaluation of BOLT powered by our static profiler on four large benchmarks (clang, GCC, MySQL and PostgreSQL) yields binaries that are 5.47 % faster than the executables produced by clang -O3.

show abstract

Section: Dynamic Profilingmentioning

confidence: 99%

VESPA: static profiling for binary optimization

Moreira

Ottoni

Pereira

2021

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

show abstract

“…A first summary of this effort appeared in an article that we have previously published at the Brazilian Symposium on Programming Languages. 22 That first publication exists in Portuguese only, and describes the algorithms that CFGgrind uses to reconstruct CFGs. This new work, in turn, now available in a language more widely accessible, describes, in addition to those algorithms, several experiments that demonstrate how CFGgrind can be effectively used.…”

Section: Efficiencymentioning

confidence: 99%

“…If the type is a call, then a different CFG will be visited (Line [22][23][24][25][26]. First, the CFG is obtained either from the mapping if it already exists, or a new instance is created otherwise (Line 23).…”

Section: Processing the Type Of A Group's Tail Instructionmentioning

confidence: 99%

Practical dynamic reconstruction of control flow graphs

2020

Self Cite

View full text Add to dashboard Cite

The automatic recovery of a program's high‐level representation from its binary version is a well‐studied problem in programming languages. However, most of the solutions to this problem are based on purely static approaches: techniques such as dataflow analyses or type inference are used to convert the bytes that constitute the executable code back into a control flow graph (CFG). This article departs from such a modus operandi to show that a dynamic analysis can be effective and useful, both as a standalone technique, and as a way to enhance the precision of static approaches. The experimental results provide evidence that completeness, that is, the ability to conclude that the entire CFG has been discovered, is achievable on many functions that are part of industry‐strong benchmarks. Experiments also indicate that dynamic information greatly enhances the ability of DynInst, a state‐of‐the‐art binary reconstructor, to deal with code stripped of debugging information. These results were obtained with CFGgrind, a new implementation of a dynamic code reconstructor, built on top of Valgrind. When applied to cBench, CFGgrind is 9% faster than callgrind, Valgrind's tool used to track targets of function calls; and 7% faster in Spec Cpu2017. CFGgrind recovers the complete CFG of 40% of all the procedures invoked during the standard execution of programs in Spec Cpu2017, and 37% in cBench. When combined with CFGgrind, DynInst finds 15% more CFGs for cBench, and 7% more CFGs for Spec Cpu2017. Finally, CFGgrind is more than 7 times faster than DCFG, a CFG reconstructor from Intel, and 1.30 times faster than bfTrace, a CFG reconstructor used in research. CFGgrind is also more precise than these two tools, handling operating system signals, shared code in functions, and unaligned instructions; besides supporting multithreaded programs, exact profiling and incremental refinements.

show abstract

Efficient and Precise Dynamic Construction of Control Flow Graphs

Cited by 2 publications

References 17 publications

VESPA: static profiling for binary optimization

VESPA: static profiling for binary optimization

Practical dynamic reconstruction of control flow graphs

Contact Info

Product

Resources

About