@inproceedings{dhb19sootdiff,
author = {Dann, Andreas and Hermann, Ben and Bodden, Eric},
title = {SootDiff: Bytecode Comparison across Different Java Compilers},
year = {2019},
isbn = {9781450367202},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3315568.3329966},
doi = {10.1145/3315568.3329966},
abstract = {Different Java compilers and compiler versions, e.g., javac or ecj, produce different bytecode from the same source code. This makes it hard to trace if the bytecode of an open-source library really matches the provided source code. Moreover, it prevents one from detecting which open-source libraries have been re-compiled and rebundled into a single jar, which is a common way to distribute an application. Such rebundling is problematic because it prevents one to check if the jar file contains open-source libraries with known vulnerabilities. To cope with these problems, we propose the tool SootDiff that uses Soot's intermediate representation Jimple, in combination with code clone detection techniques, to reduce dissimilarities introduced by different compilers, and to identify clones. Our results show that SootDiff successfully identifies clones in 102 of 144 cases, whereas bytecode comparison succeeds in 58 cases only.},
booktitle = {Proceedings of the 8th ACM SIGPLAN International Workshop on State Of the Art in Program Analysis},
pages = {14–19},
numpages = {6},
keywords = {Code Clone Detection, Intermediate Representation, Static Analysis},
location = {Phoenix, AZ, USA},
series = {SOAP 2019}
}