Dynamic program analysis

• Code
• Translation
  • Compiler
  • Compile time
  • Optimizing compiler
• Linking
• Execution
  • Runtime system
  • Executable
  • Interpreter
  • Virtual machine
• Intermediate representation (IR)

• Source code
• Object code
• Bytecode
• Machine code
• Microcode

• Ahead-of-time (AOT)
• Just-in-time (JIT)
  • Tracing just-in-time
  • Compile and go system
• Precompilation
• Transcompilation
• Recompilation
• Meta-tracing

• Android Runtime (ART)
• BEAM (Erlang)
• Common Language Runtime (CLR) and Mono
• CPython and PyPy
• crt0 (C target-specific initializer)
• Java virtual machine (JVM)
• LuaJIT
• Objective-C and Swift's
• V8 and Node.js
• Zend Engine (PHP)

• GNU Compiler Collection (GCC)
• LLVM and Clang
• MSVC
• Glasgow Haskell Compiler (GHC)

Functional testing includes relatively common programming techniques such as unit testing, integration testing and system testing.

Computing the test code coverage identifies code that is not tested.

Although this analysis identifies code that is not tested, it does not determine whether the tested code is adequately tested. Code can be executed even if the tests do not actually verify correct behavior.

• Gcov is the GNU source code coverage program.
• VB Watch injects dynamic analysis code into Visual Basic programs to monitor code coverage, the call stack, execution trace, instantiated objects, and variables.

Dynamic symbolic execution (also known as DSE or concolic execution) involves executing a test program on a concrete input, collecting the path constraints associated with the execution, and using a constraint solver (generally, an SMT solver) to generate new inputs that would cause the program to take a different control-flow path, thus increasing code coverage of the test suite. DSE can be considered a type of fuzzing ("white-box" fuzzing).

Dynamic data-flow analysis tracks the flow of information from sources to sinks. Forms of dynamic data-flow analysis include dynamic taint analysis and even dynamic symbolic execution.

Daikon is an implementation of dynamic invariant detection. Daikon runs a program, observes the values the program computes, and then reports properties that were true during the observed executions and are thus likely true over all executions.

Dynamic analysis can be used to detect security problems.

• IBM Rational AppScan is a suite of application security solutions targeted for different stages of the development lifecycle. The suite includes two main dynamic analysis products: IBM Rational AppScan Standard Edition and IBM Rational AppScan Enterprise Edition. In addition, the suite includes IBM Rational AppScan Source Edition—a static analysis tool.

• Parasoft Jtest uses runtime error detection to expose defects such as race conditions, exceptions, resource and memory leaks, and security attack vulnerabilities.
• Intel Inspector performs run-time threading and memory error analysis in Windows.
• Parasoft Insure++ is a runtime memory analysis and error detection tool. Its Inuse component provides a graphical view of memory allocations over time, with specific visibility of overall heap usage, block allocations, possible outstanding leaks, etc.
• Google's Thread Sanitizer is a data race detection tool. It instruments LLVM IR to capture racy memory accesses.