Microsoft Technology Licensing, LLC

Rajesh Jalan

Perraju Bendapudi

Siddharth Rana

Harish Mohanan

Phani Kishore Talluri

Rohini Krishnan Rajaraman

Ramarathnam R Venkatesan

Kiran Akella Venkata

Anu Engineer

Rajasekhar Khandrika

Amit Kumar Ghosh

SriSatya Aravind Akella

Suryanarayana Harsha

Vijay Kota

Abishek Kumarasubramanian

An apparatus and method provide for profile optimizations at a binary level. Thread specific data may be used to lay out a procedure in a binary. In one example, a hot thread may be identified and a layout may be generated based on the identified hot thread. Also, threads of an application may be ranked according to frequency of execution of the corresponding threads. The layout may be created based on the different threads of differing frequency of execution and conflicts between a hottest thread and each of the other threads of the application. In another example, different threads of the application may conflict. For example, two threads may contain operations that overlap temporally to create a race condition. A layout of the application threads may be created based on conflicting threads.

Multi core optimizations on a binary using static and run time analysis

Which target functions in a target binary have target function basic blocks that match the source function basic blocks in a source function in a source binary is determined. For the target functions having matching target function basic blocks, a target function control flow graph is determined that has the greatest control flow matching strength to a source function control flow graph, wherein a node in the source function control graph represents a source function basic block, wherein a node in a target function control graph represents a target function basic block in a corresponding target function.

Function matching in binaries

A facility for debugging in an operating system with native and non-native subsystems is described. The facility employs a debugger designed for use with the native subsystem. The debugger receives an indication to debug the application program of the non-native subsystem, attaches to the application program of the non-native subsystem, and when it receives an indication that the application program has started a new process, attaches to an executable component operating in the new process. When the debugger is appropriately configured, the facility attaches to an application program operating on the non-native subsystem rather than a terminal component operating on the native subsystem. When the debugger is appropriately configured, the facility redirects exceptions the debugger receives to the non-native subsystem.

Debugging in an operating system with multiple subsystems

Technologies for estimating deviations in the performance characteristics of a newer version of software relative to an older version. Such performance characteristics include cache misses, pages faults, and the like. Estimations are typically made by instrumenting and profiling an older version binary, determining differences in code blocks between the older and a newer version, propagating profile data from the older version to the newer version based on a simulation heuristic, and estimating performance deviations based on the older version, the profile data, configuration parameters, and the changes in the newer version without actually executing the newer version of the binary.

Static performance analysis of software

Spyware programs are detected even if their binary code is modified by normalizing the available code and comparing to known spyware patterns. Upon normalizing the known spyware code patterns, a signature of the normalized code is generated. Similar normalization techniques are employed to reduce the executable binary code as well. A match between the normalized spyware signature and the patterns in the normalized executable code is analyzed to determine whether the executable code includes a known spyware. For pattern matching, Deterministic Finite Automata (DFA) is constructed for basic blocks and simulated on the basic blocks of target executable, hash codes are generated for instructions in target code and known spyware code and compared, register usages are replaced with common variables and compared, and finally Direct Acyclic Graphs (DAGs) of all blocks are constructed and compared to catch reordering of mutually independent instructions and renamed variables.

Pattern matching for spyware detection

Technologies, systems and methods for code path analysis of an executable including: generating call graphs and control flow graphs of selected functions in the executable, and instrumenting the selected functions to provide for logging of path trace information for the selected functions upon execution of the instrumented executable, the path trace information usable for efficient system crash analysis and debugging. A stack trace from a crash dump may be utilized in the selection of the functions to analyze.

System crash analysis using path tracing technologies

Techniques for improving operating system performance are provided. A subsystem of an operating system operates as a kernel mode component, such as a kernel mode driver, instead of operating as a user mode component.

Operating system performance

Techniques for enabling inter-subsystem resource sharing are provided. A subsystem executing an application ('app subsystem') receives resources from another subsystem providing a resource ('resource subsystem'), such as a DLL. Then, when an application of the app subsystem is executed, the application may request a resource from the app subsystem, such as a DLL. The app subsystem, upon determining that the requested resource is associated with the resource subsystem, may communicate with the resource subsystem to request the resource. The resource subsystem may then load the resource. When the application utilizes the resource to perform an activity, such as by invoking a method of the DLL, the app subsystem may communicate with the resource subsystem to request the resource to perform the activity. The resource subsystem may provide an indication of a result to the resource subsystem upon completing the activity.

Enabling inter-subsystem resource sharing

Techniques for extending operating system subsystems are provided. The techniques involve using a subsystem of an operating system having a set of insertion points that identify points in the program logic of the subsystem where logic extensions may be added. The subsystem may receive a library that has functions comprising program logic for extending the subsystem and a list that provides a correspondence between the insertion points and the functions. When the subsystem receives a request to perform an action that has a corresponding insertion point for which the list provides an associated function, the subsystem may perform the function. The function may be indicated to be performed at various points in the program logic of the subsystem, including before or after the requested action.

Extending operating system subsystems

Techniques for routing exceptions to operating system subsystems are provided. In various embodiments, a software developer may add a global exception handler software component to an application. The global exception handler may operate in a process relating to a subsystem. Upon receiving an exception, the global exception handler may route the exception to another subsystem.

Routing exceptions to operating system subsystems

Techniques for extending operating system subsystems are provided. The techniques involve receiving a library that provides functions that extend an application program interface of the subsystem of the operating system. The techniques dynamically add a set of local procedure call ports or system call numbers corresponding to functions provided by the library and provide a known local procedure call port for receiving requests to identify a dynamically added local procedure call port or system call number. When a function of the library is requested, the subsystem determines the dynamically added port or system call number corresponding to the function, and provides an indication of the determined port or system call number to a requester of the function. The requester of the function may then invoke the function using the indicated dynamically added port or system call number.

Growing community of inventors

Hyderabad Telangana, India

Rajesh Jalan