Exploration and visualization of large execution traces

Abstract

Trace analysis is one of major methods in dynamic analysis of reverse engineering. One step towards dealing with large traces is representing it using a schema developed in our laboratory called "Compact Trace Format", where the whole trace is converted from a tree structure to a graph representation and only distinct nodes exist in it. Various filtering algorithms can then be applied to this model, and as a result, some nodes that are of less interest to a user can be filtered out and only those that help in understanding will be displayed. In this thesis we have done three things: Firstly we implemented a tool based on the above approach. Secondly, as part of the tool we implemented a dynamic trace-loading scheme allowing a user to navigate through a large trace more rapidly. Instead of loading a whole tree for exploration, the loading algorithm only retrieves the part of the tree needed by the current display window. With this method, not only can the size explosion be conquered, but performance and responsiveness requirements can also be achieved. The third item achieved is to implement a special tree widget as part of the tool. This extends the UI of standard tree widgets, and is aimed to help users quickly navigate the trace and further aid them in understanding part of the system in which they are interested. (Abstract shortened by UMI.)