这篇博客的题目是个疑问句,因为我确实不清楚为什么。
从Soot的官网:http://www.sable.mcgill.ca/soot/ 并不能看出其可以作为Instrumentation的Framework,只是介绍是一个优化的Framework。今天抽时间学习了这篇最初的文章:
R. Vall, E-Rai, P. Co, E. Gagnon, L. Hendren, P. Lam, and V. Sundaresan, "Soot - a Java bytecode optimization framework," in Proceedings of the 1999 conference of the Centre for Advanced Studies on Collaborative research, Mississauga, Ontario, Canada, 1999, p. 13.
其实Soot最开始设计的时候,主要目的就是为了对Java字节码程序进行优化,这里的优化就是指执行效率或者运行速度方面的优化。最初设计时,Soot支持三种“中间表示方法”(Intermediate Representation):Baf,Jimple和Grimp。
所以,Soot最初的作用,就是为了提高Java程序的执行效率(由于Java程序和C/C++相比起来,在先天上就执行效率较低)。文章最后通过12个大型的benchmarks实验说明,经过Soot处理后,在interpreter中的执行效率提高了8%,在Just-In-Time(JIT)型的编译器中的执行效率提高了21%。
但是从这篇文章,实在看不出Soot和Instrumentation有什么必然的联系,我目前也只会用Soot生成些简单的控制流图。但是为什么现在大家做Java方面的实验时,都喜欢用Soot作为Instrumentor呢?例如下面这几篇文章:
R. Santelices and M. J. Harrold, "Exploiting program dependencies for scalable multiple-path symbolic execution," in Proceedings of the 19th international symposium on Software testing and analysis, Trento, Italy, 2010, pp. 195-206.
S. Park, R. W. Vuduc and M. J. Harrold, "Falcon: fault localization in concurrent programs," in Proceedings of the 32nd ACM/IEEE International Conference on Software Engineering - Volume 1, Cape Town, South Africa, 2010, pp. 245-254.
J. Huang, P. Liu and C. Zhang, "LEAP: lightweight deterministic multi-processor replay of concurrent java programs," in Proceedings of the eighteenth ACM SIGSOFT international symposium on Foundations of software engineering, Santa Fe, New Mexico, USA, 2010, pp. 385-386.
有没有大牛帮我解答这个疑惑?或者教我怎么用Soot进行Instrumentation?