The Swirl Project:
Effective Security Through Visualization
 

Vavoom

Vavoom is a visualization engine for the Java virtual machine (Dourish and Byttner, 2002). The first version of Vavoom was an extension of an open source Java virtual machine implementation, augmented to report various statistics and events about the execution of Java class files to a separate process, responsible for demultiplexing the events and feeding them to a range of components capable of visualizing aspects of the run-time behavior of the class files (e.g. their memory usage patterns, interclass call patterns, method invocation, instance allocation, etc.) The key feature of this system was that it could visualize the behavior of arbitrary unmodified class files, including Java system components for which source was not available. Vavoom was originally developed as a pedagogical tool, but its ability to produce dynamic, real-time visualizations of Java software operation clearly made it appropriate to this project. However, the initial version of Vavoom had a number of problems, primarily performance and compatability. These problems both stemmed from a single design problem, which was that Vavoom was tied to a particular JVM implementation. Relying on the instruction stream, it was based on the interpreted version of this JVM, which was no longer being actively maintained, as well as having obvious performance issues itself.

For this project, we adopted a different implementation strategy for Vavoom, creating a new custom classloader, which would dynamically rewrite Java byteloaders at load-time, instrumenting the class files with calls to our visualization engine. This largely preserved the features of the original Vavoom system, including the ability to work with arbitrary Java class files, even in the absence of source. More to the point, though, it made the system independent of JVM implementation, and now able to work with high-performance JVMs such as HotSpot.

For more information see the Vavoom developer's site.