Ryan Williams
Ryan Williams

PRAT: Protocol Representation and Analysis Toolkit

PRAT is a research artifact and command-line toolkit for identifying feature-specific code in C/C++/Rust projects using differential coverage analysis.

Given a target project and a named feature, PRAT builds the target twice: once with the feature enabled, and once with it disabled. It runs coverage-producing workloads in both configurations, diffs the resulting coverage files, and reports the source lines associated with the feature.

1,743removable TLS-associated lines
18files affected
9.49slocal smoke-run runtime

Static Demo: Mosquitto TLS

The current portfolio demo uses precomputed artifacts from a local smoke run:

  • Target: Mosquitto v2.0.15

  • Feature: TLS

  • Run date: 2026-04-25

  • Command: prat App/mosquitto TLS --output /tmp/prat-smoke

HTML reportJSON reportDOT graph

This demo is static on purpose. Running PRAT means running target build systems, compilers, and workloads, so a public personal-site version should show pinned outputs rather than execute arbitrary submitted repositories.

Pipeline

PRAT differential coverage pipeline

The pipeline is:

  1. Discover the named feature and target adapter.

  2. Compile the project with the feature enabled and coverage instrumentation.

  3. Run the workload and collect enabled coverage.

  4. Compile the project with the feature disabled and coverage instrumentation.

  5. Run the workload and collect disabled coverage.

  6. Diff coverage files.

  7. Extract feature-specific source lines.

  8. Generate HTML, JSON, and DOT reports.

Top Affected Files

FileRemovable lines
conf.c326
net_mosq.c291
net.c257
security_default.c223
client_shared.c160
options.c155
handle_connect.c102
password_mosq.c77

Reproduce Locally

git clone <repo-url>
cd PRAT
python3 -m venv .venv
source .venv/bin/activate
pip install -e ".[dev]"
./scripts/fetch-targets.sh mosquitto
prat App/mosquitto TLS --output results/mosquitto-tls

What This Demonstrates

  • Feature discovery from build configuration files.

  • Feature-on and feature-off builds with coverage instrumentation.

  • Dynamic coverage collection using gcov or llvm-cov.

  • Coverage diffing and extraction of feature-specific source lines.

  • Static reports for inspection and follow-up analysis.

  • Optional source removal and verification workflows for local experiments.