Synopsys, Inc.

Coverity, Inc.

Andy Chou

Roger H Scott

Andreas Kuehlmann

Scott McPeak

Marat Boshernitsan

Romain Gaucher

Sumant J Kowshik

Kit Transue

Jon Passki

John Kodumal

Benjamin E Chelf

Seth A Hallem

A method to emulate a system represented by one or more of hardware portions and software portions is described. The method comprises determining whether a subset of the one or more hardware portions and software portions have been tested, and identifying whether the system has performed to a specification based on the testing. The method further comprising, when the system has not performed to the specification, determining one or more of the hardware and software portions to update for retesting.

Software and hardware emulation system

A method is provided to remediate defects in first computer program code that can be used to configure a computer to produce code for use by the same or a different computer configured using second computer program code to use the produced code to produce output information, the method comprising: configuring a computer to perform static analysis of the first program to produce an information structure in a non-transitory computer readable storage device that associates a respective code statement of the first program code with a respective context, wherein the context associates a parser state with a potential defect in the produced code; identify a defect in the first computer program code that is associated with the respective code statement; and determining a remediation for the identified defect.

Security remediation

A method is provided to evaluate tests of computer program code comprising: configuring a computer to produce, in a computer readable storage device, a code filter to indicate one or more respective portions of the computer program code to respectively either omit from or to include in a determination of adequacy of results; and comparing test results with the computer program code with the one or more respective portions filtered using the code filter to respectively either omit the respective portions from or include the respective portions in the determination as indicated by the code filter.

Policy evaluation based upon dynamic observation, static analysis and code change history

A method is provided to infer taintedness in code expressions encoded in a computer readable device comprising: configuring a computer system to, store a representation of a computer program that is to be evaluated in non-transitory storage media; identify within the representation a pointer cast operation; determine whether an identified cast operation involves a cast from a pointer to a raw memory data type to a pointer to a structured data type; determine whether a structured data type casted to is associated with indicia of externalness; designating data addressed by that pointer as tainted; and determine whether data designated as tainted is consumed by an operation in the computer program that acts as a taintedness sink.

Method and apparatus for static taint analysis of computer program code

A method to instrument program code for a virtual machine that comprises, in the course of loading a class to a virtual machine, adding code to the class to declare a field that corresponds to a field declared in a first bootstrap class.

Load-time instrumentation of virtual machine program code

Methods are provided that allow a false path pruner to traverse a directed acyclic graph in conjunction with one or more checker programs that are analyzing a program for defects or other artifacts of interest. While the checkers may have ways of avoiding re-traversal of portions of the graph that have already been traversed, the false path pruner may override such decisions made by the checkers as a result of a false path in order to allow re-traversal during a future different traversal when that same defect or artifact may not lie along a false path, and therefore avoid missing a valid defect or artifact. Computer programs stored on tangible media are provided that implement the methods of the invention.

Methods for selectively pruning false paths in graphs that use high-precision state information

A method comprising: providing in a non-transitory machine readable storage device a first information structure that includes respective elements that each respectively represent one or more components or communication channels or a combination thereof of a system that includes one or more machines configured with computer software; wherein the first information structure associates at least one element with at least one of an attribute indicative of a mitigation of one at least one known vulnerability of the at least one component or communication channel or combination thereof represented by the at least one element; using a computer system to produce and to store within a non-transitory machine readable storage device an analysis of as-built code used to configure one or more machines to implement the system; wherein the produced analysis includes an output log with respective entries that include respective code references and respective indicia of attributes corresponding to respective observation points within the as-built code that correspond respective elements of the first information structure; mapping at least one respective entry to at least the at least one element of the first information structure; and associating an attribute included within the at least one entry with an attribute associated within the first information structure with the at least one element.

Threat assessment of software-configured system based upon architecture model and as-built code

Systems and methods are provided for performing static error analysis on source code. A computer system having an operating system may contain a number of source code files. During a normal build process, a build program may be used to set various compilation options and to invoke appropriate compilers that compile the source code files into executable code. Static analysis debugging tools may be used to perform static analysis on the source code files. The appropriate static analysis tools may be invoked using a static analysis tool management program. Directory, path and name modification may be used to invoke the analysis tools. A monitoring program may be used to determine how to invoke the tools. The operating system may be modified so that the static analysis tools are invoked in place of the compilers when the build program is run.

Growing community of inventors

San Francisco, CA, United States of America

Andy Chou