SherbyNet - /page/wikibook/entry.mu

Micron Document

`:top

`!Dynamic program analysis`! is the act of `F33f`_`[analyzing software`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Program_analysis_(computer_science)]`_`f that involves executing a `F33f`_`[program`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Computer_program]`_`f – as opposed to `F33f`_`[static program analysis`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Static_program_analysis]`_`f, which does not execute it.

Analysis can focus on different aspects of the software including but not limited to: `F33f`_`[behavior`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Behavior]`_`f, `F33f`_`[test coverage`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Test_coverage]`_`f, `F33f`_`[performance`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Software_performance]`_`f and `F33f`_`[security`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Security]`_`f.

To be effective, the target program must be executed with sufficient test inputs`:cite-ref-1[`F5bf`_`[1`#cite-note-1]`_`f] to address the ranges of possible inputs and outputs. `F33f`_`[Software testing`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Software_testing]`_`f measures, such as `F33f`_`[code coverage`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Code_coverage]`_`f, and tools such as `F33f`_`[mutation testing`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Mutation_testing]`_`f, are used to identify where testing is inadequate.

>>Contents

• `F0af`_`[Types`#types]`_`f

• `F0af`_`[Functional testing`#functional-testing]`_`f

• `F0af`_`[Code coverage`#code-coverage]`_`f

• `F0af`_`[Dynamic testing`#dynamic-testing]`_`f

• `F0af`_`[Memory error detection`#memory-error-detection]`_`f

• `F0af`_`[Fuzzing`#fuzzing]`_`f

• `F0af`_`[Dynamic symbolic execution`#dynamic-symbolic-execution]`_`f

• `F0af`_`[Dynamic data-flow analysis`#dynamic-data-flow-analysis]`_`f

• `F0af`_`[Invariant inference`#invariant-inference]`_`f

• `F0af`_`[Security analysis`#security-analysis]`_`f

• `F0af`_`[Concurrency errors`#concurrency-errors]`_`f

• `F0af`_`[Program slicing`#program-slicing]`_`f

• `F0af`_`[Performance analysis`#performance-analysis]`_`f

• `F0af`_`[Techniques`#techniques]`_`f

• `F0af`_`[Examples`#examples]`_`f

• `F0af`_`[See also`#see-also]`_`f

• `F0af`_`[References`#references]`_`f

-─

>>Types

>>>Functional testing

Functional testing includes relatively common `F33f`_`[programming`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Computer_programming]`_`f techniques such as `F33f`_`[unit testing`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Unit_testing]`_`f, `F33f`_`[integration testing`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Integration_testing]`_`f and `F33f`_`[system testing`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=System_testing]`_`f.`:cite-ref-2[`F5bf`_`[2`#cite-note-2]`_`f]

>>>Code coverage

Computing the `F33f`_`[code coverage`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Code_coverage]`_`f of a test identifies code that is not tested; not covered by a test.

Although this analysis identifies code that is not tested it does not determine whether tested coded is `*adequately`* tested. Code can be executed even if the tests do not actually verify correct behavior.

• `F33f`_`[Gcov`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Gcov]`_`f is the `F33f`_`[GNU`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=GNU]`_`f source code coverage program.

• `F33f`_`[VB Watch`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=VB_Watch]`_`f injects dynamic analysis code into Visual Basic programs to monitor `F33f`_`[code coverage`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Code_coverage]`_`f, call stack, execution trace, instantiated objects and variables.

>>>Dynamic testing

Dynamic testing involves executing a program on a set of test cases.

>>>Memory error detection

• `F33f`_`[AddressSanitizer`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=AddressSanitizer]`_`f: Memory error detection for Linux, `F33f`_`[macOS`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=MacOS]`_`f, Windows, and more. Part of `F33f`_`[LLVM`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=LLVM]`_`f.

• `F33f`_`[BoundsChecker`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=BoundsChecker]`_`f: Memory error detection for Windows based applications. Part of `F33f`_`[Micro Focus`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Micro_Focus]`_`f `F33f`_`[DevPartner`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=DevPartner]`_`f.

• `F33f`_`[Dmalloc`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Dmalloc]`_`f: Library for checking memory allocation and leaks. Software must be recompiled, and all files must include the special C header file dmalloc.h.

• `F33f`_`[Intel Inspector`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Intel_Inspector]`_`f: Dynamic memory error debugger for C, C++, and Fortran applications that run on `F33f`_`[Windows`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Windows]`_`f and `F33f`_`[Linux`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Linux]`_`f.

• `F33f`_`[Purify`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=IBM_Rational_Purify]`_`f: Mainly `F33f`_`[memory corruption`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Storage_violation]`_`f detection and memory leak detection.

• `F33f`_`[Valgrind`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Valgrind]`_`f: Runs programs on a virtual processor and can detect memory errors (e.g., misuse of `F33f`_`[malloc`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Malloc]`_`f and `F33f`_`[free`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Free_(programming)]`_`f) and `F33f`_`[race conditions`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Race_conditions]`_`f in `F33f`_`[multithread`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Multithreading_(software)]`_`f programs.

>>>Fuzzing

Fuzzing is a testing technique that involves executing a program on a wide variety of inputs; often these inputs are randomly generated (at least in part). `F33f`_`[Gray-box fuzzers`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Fuzzing]`_`f use code coverage to guide input generation.

>>>Dynamic symbolic execution

Dynamic symbolic execution (also known as `*DSE`* or concolic execution) involves executing a test program on a concrete input, collecting the path constraints associated with the execution, and using a `F33f`_`[constraint solver`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Constraint_solver]`_`f (generally, an `F33f`_`[SMT solver`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=SMT_solver]`_`f) to generate new inputs that would cause the program to take a different control-flow path, thus increasing code coverage of the test suite.`:cite-ref-3[`F5bf`_`[3`#cite-note-3]`_`f] DSE can be considered a type of `F33f`_`[fuzzing`#fuzzing]`_`f ("white-box" fuzzing).

>>>Dynamic data-flow analysis

Dynamic data-flow analysis tracks the flow of information from `*sources`* to `*sinks`*. Forms of dynamic data-flow analysis include dynamic taint analysis and even `F33f`_`[dynamic symbolic execution`#dynamic-symbolic-execution]`_`f.`:cite-ref-4[`F5bf`_`[4`#cite-note-4]`_`f]`:cite-ref-5[`F5bf`_`[5`#cite-note-5]`_`f]

>>>Invariant inference

`F33f`_`[Daikon`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Daikon_(system)]`_`f is an implementation of dynamic invariant detection. Daikon runs a program, observes the values that the program computes, and then reports properties that were true over the observed executions, and thus likely true over all executions.

>>>Security analysis

Dynamic analysis can be used to detect security problems.

• `F33f`_`[IBM Rational AppScan`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=IBM_Rational_AppScan]`_`f is a suite of application security solutions targeted for different stages of the development lifecycle. The suite includes two main dynamic analysis products: IBM Rational AppScan Standard Edition, and IBM Rational AppScan Enterprise Edition. In addition, the suite includes IBM Rational AppScan Source Edition—a static analysis tool.

>>>Concurrency errors

• `F33f`_`[Parasoft`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Parasoft]`_`f `F33f`_`[Jtest`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Jtest]`_`f uses runtime error detection to expose defects such as `F33f`_`[race conditions`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Race_conditions]`_`f, exceptions, resource and memory leaks, and security attack vulnerabilities.

• `F33f`_`[Intel Inspector`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Intel_Inspector]`_`f performs run-time threading and memory error analysis in Windows.

• `F33f`_`[Parasoft`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Parasoft]`_`f `F33f`_`[Insure++`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Insure++]`_`f is a runtime memory analysis and error detection tool. Its Inuse component provides a graphical view of memory allocations over time, with specific visibility of overall heap usage, block allocations, possible outstanding leaks, etc.

• `F33f`_`[Google's`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Google's]`_`f Thread Sanitizer is a data race detection tool. It instruments `F33f`_`[LLVM`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=LLVM]`_`f IR to capture racy memory accesses.

>>>Program slicing

For a given subset of a program’s behavior, program slicing consists of reducing the program to the minimum form that still produces the selected behavior. The reduced program is called a “slice” and is a faithful representation of the original program within the domain of the specified behavior subset. Generally, finding a slice is an unsolvable problem, but by specifying the target behavior subset by the values of a set of variables, it is possible to obtain approximate slices using a data-flow algorithm. These slices are usually used by developers during debugging to locate the source of errors.

>>>Performance analysis

Most `F33f`_`[performance analysis tools`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=List_of_performance_analysis_tools]`_`f use dynamic program analysis techniques.

>>Techniques

Most dynamic analysis involves `F33f`_`[instrumentation`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Instrumentation_(computer_programming)]`_`f or transformation.

Since instrumentation can affect runtime performance, interpretation of test results must account for this to avoid misidentifying a performance problem.

>>>Examples

DynInst is a runtime code-patching library that is useful in developing dynamic program analysis probes and applying them to compiled executables. Dyninst does not require `F33f`_`[source code`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Source_code]`_`f or recompilation in general, however, non-stripped executables and executables with debugging symbols are easier to instrument.

Iroh.js is a runtime code analysis library for `F33f`_`[JavaScript`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=JavaScript]`_`f. It keeps track of the code execution path, provides runtime listeners to listen for specific executed code patterns and allows the interception and manipulation of the program's execution behavior.

>>See also

• `F33f`_`[Abstract interpretation`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Abstract_interpretation]`_`f

• `F33f`_`[Daikon`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Daikon_(system)]`_`f

• `F33f`_`[Dynamic load testing`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Dynamic_load_testing]`_`f

• `F33f`_`[Profiling (computer programming)`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Profiling_(computer_programming)]`_`f

• `F33f`_`[Runtime verification`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Runtime_verification]`_`f

• `F33f`_`[Program analysis (computer science)`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Program_analysis_(computer_science)]`_`f

• `F33f`_`[Static code analysis`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Static_code_analysis]`_`f

• `F33f`_`[Time Partition Testing`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Time_Partition_Testing]`_`f

>>References

`:cite-note-1`!1.`! `F0af`_`[↑`#cite-ref-1]`_`f `:citerefkhatiwadatushevmahmoud2018`aKhatiwada, Saket; Tushev, Miroslav; Mahmoud, Anas (2018-01-01). "Just enough semantics: An information theoretic approach for IR-based software bug localization". `*`F33f`_`[Information and Software Technology`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Information_and_Software_Technology]`_`f`*. `!93`!: 45–57. `F33f`_`[doi`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Doi_(identifier)]`_`f:10.1016/j.infsof.2017.08.012.

`:cite-note-2`!2.`! `F0af`_`[↑`#cite-ref-2]`_`f `:citerefmyers-g-j-1979`a`F33f`_`[Myers, G. J.`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Glenford_Myers]`_`f (1979). `*The Art of Software Testing`*. John Wiley and Sons.

`:cite-note-3`!3.`! `F0af`_`[↑`#cite-ref-3]`_`f `:citerefchenzhangguoli2013`aChen, Ting; Zhang, Xiao-song; Guo, Shi-ze; Li, Hong-yuan; Wu, Yue (2013-09-01). "State of the art: Dynamic symbolic execution for automated test generation". `*Future Generation Computer Systems`*. Including Special sections: Cyber-enabled Distributed Computing for Ubiquitous Cloud and Network Services & Cloud Computing and Scientific Applications — Big Data, Scalable Analytics, and Beyond. `!29`! (7): 1758–1773. `F33f`_`[doi`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Doi_(identifier)]`_`f:10.1016/j.future.2012.02.006. `F33f`_`[ISSN`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=ISSN_(identifier)]`_`f 0167-739X.

`:cite-note-4`!4.`! `F0af`_`[↑`#cite-ref-4]`_`f `:citerefchenhanyinzeng2022`aChen, Ju; Han, Wookhyun; Yin, Mingjun; Zeng, Haochen; Song, Chengyu; Lee, Byoungyoung; Yin, Heng; Shin, Insik (2022). `*{SYMSAN}: Time and Space Efficient Concolic Execution via Dynamic Data-flow Analysis`*. pp. 2531–2548. `F33f`_`[ISBN`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=ISBN_(identifier)]`_`f 978-1-939133-31-1.

`:cite-note-5`!5.`! `F0af`_`[↑`#cite-ref-5]`_`f `:citerefchangstreifflin2008`aChang, Walter; Streiff, Brandon; Lin, Calvin (2008-10-27). "Efficient and extensible security enforcement using dynamic data flow analysis". `*Proceedings of the 15th ACM conference on Computer and communications security`*. CCS '08. New York, NY, USA: Association for Computing Machinery. pp. 39–50. `F33f`_`[doi`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Doi_(identifier)]`_`f:10.1145/1455770.1455778. `F33f`_`[ISBN`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=ISBN_(identifier)]`_`f 978-1-59593-810-7. `F33f`_`[S2CID`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=S2CID_(identifier)]`_`f 6888893.

`c`F0af`_`[↑ Back to top`#top]`_`f`a