PRAT: Protocol Representation and Analysis Toolkit

How it works

Given a target project and a named feature, PRAT builds the target twice — once with the feature enabled and once with it disabled — and compares what code actually runs:

1. Compile with the feature enabled, instrumented with coverage flags.

2. Generate coverage (enabled) — gcov/llvm-cov produce .gcov files.

3. Compile with the feature disabled, with the same instrumentation.

4. Generate coverage (disabled) — a second set of .gcov files.

5. Diff the coverage files to find lines unique to the feature-enabled build.

6. Extract feature code — lines never executed when the feature is off.

7. Generate reports — an HTML table, a JSON checkpoint, and a DOT graph of the removable code.

Supported build systems

PRAT drives each target through a small build adapter, so the same workflow applies whether a project uses Make, CMake, Autotools, or Cargo:

Reproducing the paper

PRAT ships seven self-contained Docker demos covering the paper's evaluation targets. Each demo clones its target at a pinned tag, builds it with the feature on and off, runs coverage, diffs, and extracts — writing a manifest.json that records the exact git commit and tool versions used. PRAT reports two figures: an interleaved count (feature code inside files shared by both builds) and a paper-aligned combined value that also counts dedicated feature-only files.

Every target builds and runs in the reference environment, and the extracted counts fall within the paper's acceptance ranges. The full methodology — along with an honest account of where the static analysis diverges from the paper's KLEE-based numbers — lives in the reproducibility report.

Architecture

The toolkit is organized as a pipeline of focused modules under src/prat/:

• workflow.py — end-to-end orchestration with resumable checkpoints.

• batch.py — multi-feature batch analysis (the paper's Algorithm 1).

• discovery.py — automatic feature-flag discovery from build configuration.

• compilation.py — multi-build-system compilation.

• coverage.py — gcov/llvm-cov/cargo-llvm-cov coverage generation.

• diff.py and extraction.py — coverage comparison and feature-line extraction.

• removal.py and verification.py — automated removal plus post-removal correctness checks.

• feature_graph.py and reporting.py — interactive D3.js dependency graphs and HTML/DOT reports.

• symbolic.py — experimental KLEE-based symbolic test generation.

• adapters/ — per-project build adapters (Mosquitto, FFmpeg, azure-uamqp-c, OpenDDS, libaom, generic CMake, and Cargo/Rust).

Using PRAT

Install from the public repository and fetch a target project:

git clone https://github.com/williamsryan/PRAT
cd PRAT
pip install -e ".[dev]"
./scripts/fetch-targets.sh mosquitto

Run an analysis from the command line:

# Analyze a feature
prat App/mosquitto TLS

# List discoverable features
prat App/mosquitto --list

# Preview operations without modifying anything
prat App/mosquitto TLS --dry-run

…or drive the workflow programmatically:

from prat.workflow import run_complete_workflow

result = run_complete_workflow(
    project_path="App/mosquitto",
    feature="TLS",
    run_tests=False,
)
print(f"Removable lines: {result.extraction_result.total_removable_lines}")

Live demo: Mosquitto TLS

The artifacts below come from a pinned PRAT run against the Mosquitto MQTT broker, isolating its TLS feature. They are served statically — running PRAT means building target projects and executing their workloads, so a personal site should publish pinned outputs rather than execute submitted repositories.

• Target: Mosquitto v2.0.15

• Feature: TLS

• Command: prat App/mosquitto TLS --output results/mosquitto-tls

The largest concentrations of removable TLS code in that run:

Citation

If you use PRAT or build on this work, please cite the paper:

@article{williams2021guided,
  author    = {Williams, Ryan and Ren, Tongwei and De Carli, Lorenzo and Lu, Long and Smith, Gillian},
  title     = {Guided Feature Identification and Removal for Resource-constrained Firmware},
  journal   = {ACM Transactions on Software Engineering and Methodology},
  volume    = {31},
  number    = {2},
  pages     = {1--25},
  year      = {2021},
  doi       = {10.1145/3487568}
}