TL;DR
A novel multiverse debugger capable of effectively pruning redundant paths from the state space to reduce the effect of state explosion is presented, which uses a trace-based approach which significantly reduces the overhead of multiverse de-bugging.
Migration of legacy COBOL programs to Java requires extensive testing to ensure correct functionality. This effort is often complicated by the lack of test data and the difficulty of validating all corner cases. In this paper we propose a novel agentic test-synthesis method, the"Locksmith Loop,"which is initiated by preparing two runtime environments: the COBOL source and the generated Java target are each instrumented with mocks and executed off-mainframe on commodity hardware, then an iterative agentic loop performs Witness Search over input mocks to penetrate program branches, followed by parity-preserving mutations. When routing boundaries are reached, an analyzer identifies a Locked Paragraph: a condition preventing deeper exploration. Across three COBOL-Java case studies, spanning two open-source programs and one internal production-like COBOL program and ranging from 430 to 4,114 source lines, Locksmith consistently improved coverage beyond input-search plateaus, reaching nearly complete coverage on the two open-source programs and 91.90% branch coverage on the internal production-like COBOL program. The generated Java matched the COBOL reference under deterministic parity checks in all accepted test cases. Through these findings we demonstrate, to the best of our knowledge, a novel approach for validating agentic coding output using a deterministic oracle.
Code-reuse attacks (CRAs) have become increasingly sophisticated, constructing malicious payloads by chaining together small fragments of legitimate code, called gadgets. They bypass traditional defenses such as non-executable memory and code integrity checks, by using indirect jumps or calls to orchestrate a behavior not intended by software programmers. Jump-oriented programming (JOP) attacks specifically are a particular threat because their behavior is hardly distinguishable from that of a bug or a legitimate application. In this paper, we present heatseeker, an innovative signature-based detection algorithm specifically designed to identify JOP attacks by analyzing patterns during program execution. Unlike existing mitigation techniques, which impose performance overhead or require substantial changes to system software, this algorithm can be implemented using only a dedicated hardware component working in parallel with the processor. Heatseeker relies on invariants in the JOP execution pattern that are used as signatures, which drastically reduces the dependency on gadget length. We present a proof that the algorithm detects JOP attacks and describe the underlying formalization of JOP attacks and the algorithm. We also propose a proof-of-concept implementation of the algorithm on the CV32A6 platform, an open-source RISC-V CPU supporting a Linux operating system (OS). Our experiments demonstrate the effectiveness of the heatseeker algorithm against JOP payloads as well as its safety against legitimate applications, which we demonstrate through extensive testing under Linux and with SPEC CPU 2017 benchmarks. The heatseeker algorithm provides a practical, binary-agnostic method for detecting JOP attacks, offering robust protection without impacting performance.
SimP is a program reduction framework that combines traditional reduction with LLM-based syntax- and semantic-guided reduction, and synergistically combines rule-based and LLM-based reduction stages to optimize the reduction performance.
Interactive debugging is an effective tool for understanding program behavior at the source level, allowing developers to pause execution, navigate the call stack, and inspect runtime state. However, interactive debuggers are designed for single-process execution, and interactive debugging has been widely considered impractical for distributed systems. Call stacks stop at process boundaries, debugging state fails to survive infrastructure dynamics, and, most critically, debugger-induced execution pauses trigger catastrophic timeout cascades that destroy the intended debug flow. Consequently, developers are forced to abandon live hypothesis testing in favor of unwieldy and iterative log-and-redeploy cycles. We present DDB, a source-level interactive debugger that extends interactive debugging capabilities to distributed applications. We show that each of these challenges admits a targeted solution. To bridge disjoint processes, Distributed Backtrace (DBT) embeds compact causality metadata in every RPC and reconstructs a unified call stack across RPC boundaries. To manage the lifecycle of a distributed session, an intent-preserving control plane automatically coordinates and propagates breakpoints across dynamic process sets. To make pausing safe, Pause-Erased Time (PET) virtualizes each process's clock, decoupling logical time from physical pauses and preventing timeout cascades. DDB integrates with an RPC framework in 20-60 lines of code. Evaluated on gRPC, ServiceWeaver, Nu, and Quicksand across up to 122 processes, DDB achieves 30ms median cross-RPC backtrace latency, sub-5 ms time jump under repeated execution pauses, and adds 1-5% throughput overhead, comparable to attaching a single-process debugger. In a controlled user study, DDB achieves a 100% fault localization success rate (compared to 38.5% for baseline tools) with a median localization time of ~8 minutes.
Large language model (LLM) agents are increasingly used to modernize the legacy Fortran underlying production scientific software, but validation of these transformations emphasizes nominal executions and may not test whether a modernization preserves the original code's response to faults, perturbations, and reduced precision. We present a differential fault-injection validation method: a harness instruments the shared self-consistent-field driver of GAMESS at twelve sites and applies identical, deterministic faults to the original and LLM-modernized implementations, isolating the converted integral kernels. Across more than 2,200 runs, transient-fault absorption costs match a contraction-based model (predicted slopes 0.74 and 1.49 iterations per bit; measured 0.82 and 1.50), persistent perturbations halve final-energy error per additional bit, and the campaigns expose phase-dependent parallel deadlocks and false convergence under reduced precision. The original and modernized kernels agree in all 200 paired injections, and a measurement-guided synchronization change composes with the modernization, matching in all 40 pairs.