{"id":23792494,"url":"https://github.com/se2p/sa2023","last_synced_at":"2025-04-13T03:56:46.531Z","repository":{"id":161166953,"uuid":"632861843","full_name":"se2p/sa2023","owner":"se2p","description":null,"archived":false,"fork":false,"pushed_at":"2023-07-12T09:42:51.000Z","size":1152,"stargazers_count":3,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-04-13T03:56:22.803Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Jupyter Notebook","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/se2p.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-04-26T09:30:27.000Z","updated_at":"2024-04-18T01:07:19.000Z","dependencies_parsed_at":null,"dependency_job_id":"3a9723d8-2ce4-4657-a0fd-7e9011c09d9e","html_url":"https://github.com/se2p/sa2023","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/se2p%2Fsa2023","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/se2p%2Fsa2023/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/se2p%2Fsa2023/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/se2p%2Fsa2023/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/se2p","download_url":"https://codeload.github.com/se2p/sa2023/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248661708,"owners_count":21141450,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-01-01T18:35:22.058Z","updated_at":"2025-04-13T03:56:46.491Z","avatar_url":"https://github.com/se2p.png","language":"Jupyter Notebook","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Software Analysis SS2023\n\nThis repository collects examples from the Software Analysis lecture in\nJupyter notebooks. \n\n## Installation\n\nPDF Exports of the notebooks will be uploaded to StudIP, and markdown\nexports are included in the repository. To run the notebooks on your own you\nwill need to install [Jupyter](https://jupyter.org/install).\n\n## Contents\n\n### 1: Initial character-based analysis\n\nThis chapter describes two very basic analyses of source code at character\nlevel, by splitting source code files into lines: The first analysis is to\ncount lines of code, and the second on is a basic code clone detection\ntechnique, capable of detecting type 1 clones.\n\n[Markdown Export](rendered/1%20Analysis%20Basics.md)\n\n\n### 2: On the Naturalness of Code: Token-level analysis\n\nThis chapter looks at the process of converting source code into token streams,\nand applying different types of analyses on these, such as code clone detection\nor code completion based on language models.\n\n[Markdown Export](rendered/2%20Naturalness%20of%20Code.md)\n\n### 3: Syntax-based analysis (Part 1)\n\nThis chapter considers syntactic information on top of the lexical\ninformation provided by the tokens. That is, it considers what language\nconstructs the tokens are used in, by looking at the abstract syntax tree.\nWe further look at how we can automatically generate parsers using Antlr,\nand then use these to translate programs and to create abstract syntax\ntrees. We also use the Abstract Syntax Trees to do some basic linting.\n\n[Markdown Export](rendered/3%20Syntax-based%20Analysis%20Part%201.md)\n\n### 4: Syntax-based analysis (Part 2)\n\nIn this chapter we use the Abstract Syntax Trees to create code embeddings,\nwhich we can use to apply machine learning on source code. In particular we\nconsider two models, Code2vec and ASTNN.\n\n[Markdown Export](rendered/4%20Syntax-based%20Analysis%20Part%202.md)\n\n\n### 5: Control-flow analysis\n\nThis chapter looks at how to extract information about the flow of control\nbetween the statements in a program, and how to represent this in the\ncontrol flow graph. The control flow graph is the foundation for further\ncontrol flow analyses, and in particular we consider dominance and\npost-dominance relations, which in turn are the foundation for control\ndependence analysis.\n\n[Markdown Export](rendered/5%20Controlflow%20Analysis.md)\n\n\n\n### 6: Data-flow analysis (Part 1)\n\nThis chapter looks at how to track the propagation of data throughout the\ncontrol flow of the program. We consider some classical data-flow analyses\nusing an iterative analysis framework, and specifically look at how to\npropagate information about reaching definitions and reachable uses, which\nthen allows us to construct a data-dependence graph.\n\n[Markdown Export](rendered/6%20Dataflow%20Analysis.md)\n\n\n### 7: Data-flow analysis (Part 2): Abstract interpretation\n\nThis chapter continues with dataflow analysis, and refines our iterative\ndataflow analysis algorithm from chapter 6 to the lattice-theoretic monotone\nframework. Using this framework, we can then apply abstract interpretation,\nwhich is a more general analysis not only of how the program computes (which\nare all the analyses from chapter 6), but also _what_ the program computes.\nSince this is more challenging, we need to abstract the values. Our example\nanalysis checks if programs may have division by zero errors.\n\n[Markdown Export](rendered/7%20Abstract%20Interpretation.md)\n\n\n### 8: Interprocedural analysis\n\nThis chapter continues the zero-analysis example, but considers what happens\nif you have functions that call other functions. We can either assume a\nfunction call can return anything, or we have to make our analysis\ninterprocedural. This causes some challenges, for example if the same\nmethod is called from multiple locations. We counter this problem by making\nour analysis context-sensitive (using cloning in the example).\n\n[Markdown Export](rendered/8%20Interprocedural%20Analysis.md)\n\n### 9: Program Slicing\n\nIn this chapter we revisit control dependencies, and look at an alternative\nway to calculate them using the dominance frontier (a concept used for\ncreating static single assignment form). By combining data and control\ndependencies, we can create the program dependence graph. This can be used\nto _slice_ programs, i.e., extract subsets of the program that are relevant\nfor a given target slicing criterion. Since the examples are analysing Java\ncode, the notebook focuses only on static slicing, although the concepts\ngeneralise well to dynamic slicing as covered in the lecture.\n\n[Markdown Export](rendered/9%20Program%20Dependence.md)\n\n\n### 10: Dynamic Analysis\n\nAll previous chapters considered static analysis, now we move on to dynamic\nanalysis. We start analysing Python code, since this can be executed easily\nwithin the notebooks. We consider two alternative ways to instrument\nprograms such that we can create execution traces: (1) Modifying ASTs, and\n(2) using the VM's tracing functionality. Using these instrumentation\napproaches we implement a range of different example dynamic analyses.\n\n[Markdown Export](rendered/10%20Dynamic%20Analysis.md)\n\n\n### 11: (Dynamic) Symbolic Execution\n\nSymbolic execution represents execution paths as symbolic constraints over\ninput variables. This can be used to generate test inputs that cover\nspecific paths, or it can be used to check assertions and other properties\nof a program. Although recent progress on constraint solvers (SMT solvers in\nparticular) has greatly improved the applicability of symbolic execution,\nthere are fundamental limitations such as having to deal with loops, or\nblack box function calls, which can, however, be overcome dynamically. The\ncombination of dynamic and symbolic execution is known as dynamic symbolic\nexecution, or concolic execution (concrete+symbolic). This chapter is based\non Andreas Zeller's excellent [Fuzzing Book](https://www.fuzzingbook.org/html/ConcolicFuzzer.html)\n\n[Markdown Export](rendered/11%20Symbolic%20Execution.md)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fse2p%2Fsa2023","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fse2p%2Fsa2023","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fse2p%2Fsa2023/lists"}