Showing posts with label analysis. Show all posts
Showing posts with label analysis. Show all posts

Monday, September 11, 2017

Geekbench 4 Cross Platform Testing Analysis

Geekbench 4 Cross Platform Testing Analysis


Overview

Geekbench 4 was released at the end of August and has proved to be a welcome improvement over the previous revision 3, having been praised for accurately reflecting the industry standard SPEC results through a benchmark suite that is readily available on different platforms and is easy and quick to run.

As Geekbench 4 is comparable across platforms and is available for Windows, Android, iOS and others, I thought it would be interesting to test my server, desktop, laptop, tablet and phone to see how they perform relative to each other.

I am also interested in how different processors compare across platforms, so compare the scores of the fastest processors available in different platforms and segments, including the fastest Core i7, Core M, Apple A10 and Exynos 8890 / Snapdragon 820 on Android.

Single vs Multi-core scores

Before getting to the results of my test, it is worthwhile discussing the two results that are returned from the benchmark - the Single and Multi-core values

The Single-Core result provides a ranking of which processor has the fastest CPU core in a single threaded situation. Having a fast core indicates that an application will perform well in single-threaded situations. Writing well-threaded applications is more long winded and complex than writing a traditional single-threaded application, so developers are unlikely to put in the extra effort required unless a performance issue crops up in their testing, or their application is particularly suited to multi-threading.

The Multi-Core result shows what can be achieved if an application is both suited to, and optimised for, a multi-threaded environment. The Operating system itself and many core applications are generally well threaded and will take advantage of multi-core processors. Applications and Services running in the background also make good use of multiple cores.

Which result, therefore, is the most reflective of real world performance? Generally speaking, having a high single core score will ensure that all applications perform well, no matter how they are coded. Conversely, having more, slower cores may perform better in some situations but will also perform worse in others.

I would suggest, therefore, that having a high single core score will ensure performance consistency, and having a high multi-core score will show the maximum performance you can expect in ideal circumstances.

The operating system design also plays a part in this - the higher degree of true multi-tasking the OS provides, the more important the multi core score and the less important the single core. In terms of todays common platforms, the multi core score is most important in Windows, important in Android and less important in iOS.

In conclusion, neither the single or multi-core scores provide the whole picture - the real answer lies somewhere in the middle, with the bias being dependant on the host OS and the suite of applications you frequently use.

My Results


Below is a table of my main computing devices in the house - an older desktop PC, a modern Server and Laptop, an iPad Pro and a recent phone.

The results below are ordered by their Single Core result from lowest performance to highest.

DevicePlatformCPUSingle-CoreMulti-Core
HP xw6400 (Desktop)Windows 102 x Xeon E534513625802
Xiaomi Mi Max (Phone)Android 6.0.1Snapdragon 65214673304
HP Microserver Gen 8 (Server)Windows Server 2012 R2Core i3-3220T23995118
iPad Pro 12.9" (Tablet)iOS 9.3.5Apple A9X30194915
Dell Inspiron 13 7000 (Laptop)Windows 10Core i5 6200U30535836

The table shows just how quickly mobile SoCs have caught up with older and lower power Intel Core processors.

To the layman, my desktop PC would appear to be the fastest compute device in the house - it certainly looks the part, being a hefty HP Workstation. It is a 2 processor, 8 core Xeon Workstation. However, its age is showing and the single core performance (Core 2 era Clovertown) is below even my mobile phone. Of course, having 8 cores means it is still a workable machine even today.

The iPad Pros Apple A9X, featuring 2 x 2.25Ghz Twister cores, is on a par with my 9 month old Ultrabook in terms of single core performance, and not too far off in terms of its multi-core score.

Processor comparisons

Here I have chosen a set of the top-performing processors in terms of Desktop, Laptop, Fanless laptop, iOS and Android to see how they compare.

ProcessorCoresPlatformSingle-CoreMulti-Core
Intel Core i7-6700K4 x 4Ghz SkylakeWindows (Desktop)532917023
Intel Core i7-6950X10 x 3Ghz SkylakeWindows (Desktop)446229797
Intel Core i7-6650U2 x 2.2Ghz SkylakeWindows (Laptop)37927357
Apple A102 x ? + 2 x ?iPhone 733795495
Apple A9X2 x 2.25Ghz TwisteriPad Pro30194915
Intel Core m7-6Y752 x 1.3Ghz Skylake YWindows (Fanless)28546030
Samsung Exynos 88904 x M1 2.6Ghz + 4 x A53 1.6GhzGalaxy S7 / Note 718095232
Qualcomm Snapdragon 8202 x 1.8Ghz Kryo + 2 x 1.36Ghz KryoMultiple16604015

Perhaps the most interesting item is Apples new A10 SoC, as found in the iPhone 7. The Single core result is above Intels fastest Core m7 processor in single core, and not far behind in multi-core.

It is also interesting to see that it is faster than the fastest Android SoC, as found in Samsungs S7 & Note 7 phones, in the multi-core score as well as being faster, as expected, in the single core benchmark.

Further Reading

This Anandtech article provides a great overview of how well used multi-core SoCs are on Android

This XDA article provides an overview of the changes between Geekbench 3 and 4 and provides some analysis on how scores have changed between common Android SoC cores in the process.

This XDA article is an interview with the Geekbench CEO about the new benchmark & the rationale behind the changes from version 3.


download file now

Read more »

Saturday, September 9, 2017

Groningen fork analysis

Groningen fork analysis


There are a few forks of the original groningen code from code.google.com on GitHub. Most interesting are matttproud/groningen and sladeware/groningenrepositories. Both matttproud/groningen and sladeware/groningen were createad by one of original groningen developers, as mirrors of the code.google.com repository on the 3rd of August 2012.

When trying to run code from matttproud/groningen same problems are encountered as when runing original code from code.google.com even though it appears many changes have been made. However, it seems development of groningen has continued on sladeware/groningen by original authors as well as some new contributors. It appers the project is alive and new updates are made from time to time.

Commits from August 11th 2013 to February 2nd 2014

Installation of sladeware/groningen is the same as installation of the original code. There is also a home page containing more information on sladeware/groningen such as a quick overwiev, design summary and some deployment information. When runing with java -jar target/groningen-1.0-SNAPSHOT-jar-with-dependencies.jar no problems are encountered and http server is started on port 8080. When going to localhost:8080 in a browser, the following interface will appear.


However, runing Groningen with the sample configuration file provided on the deployment page will result in an error unless comments are removed.


download file now

Read more »

Saturday, September 2, 2017

Tools for Android malware analysis

Tools for Android malware analysis


This post gives some tools for which I managed to find some info and think that can be useful for dynamic and static malware analysis.

When doing malware analysis, it is necessary to prepare safe and reliable environment for running the malware in order to observe its behavior or perform procedures of reverse engineering. Android malware, as much as other platforms, demands such environments which is bit hard to find. One reason is because malware analysis task demands high processor performance and memory capacity. Also, emulators provided by official Android SDK are very slow and we don�t want to run malware on real Android device. This makes dynamical malware analysis very annoying and tedious. Some tools like CopperDroid address this problem very nicely. Specifically CopperDroid provides web interface where you can upload apk file which is then analyzed and results of dynamic analysis are given. Downside of this approach is that it maybe won�t find all threats.

Following list enumerates some tools for Android malware reverse engineering, debugging, monitoring and emulating behavior of an Android device:

  • Androguard � Tool written in Python which can be used to analyze android application. Some of the features are: disassembly/decompilation/modification of DEX/ODEX/APK format, diffing of Android applications, measure the efficiency of obfuscators,checking if an Android application is present in a database (malwares), risk indicator of malicious application 
  • APKinspector � Also written in Python but provides a GUI to aide analysis of APKs and their DEX code. APKinspector can help to generate reports for permissions used by the application, search and filter strings, classes and methods and more. Some of the current models used by APKinspector are based on Androguard 
  • Droidbox � Sandbox for dynamic analysis of Android applications. This tool gives hashes for the analyzed package, incoming/outgoing network data, file read and write operations, started services and loaded classes through DexClassLoader, information leaks via the network (files, SMS), circumvented permissions, cryptographic operations performed using Android API, listing broadcast receivers, sent SMS and phone calls. 
  • CopperDroid � out-of-the-box dynamic behavioral analysis of Android malware. To this end, CopperDroid presents a unified analysis to characterize low-level OS-specific (e.g., writing to a file) and high-level Android-specific behaviors (e.g., sending an SMS, placing a phone call). Based on the observation that such behaviors are however achieved through the invocation of system calls, CopperDroids VMI-based dynamic system call-centric analysis is able to faithfully describe the behavior of Android malware whether it is initiated from Java, JNI or native code execution. In addition, CopperDroid features a stimulation technique to improve code coverage, aimed at triggering additional behaviors of interest. Our initial experiments show that a proper malware stimulation strategy (e.g., sending SMS, placing calls) successfully discloses additional behaviors on a non-negligible portion of the analyzed malware. 
  • Android-apktool � Tool for reverse engineering Android APK format using Java runtime environment. 
  • Smali - assembler/disassembler for the DEX format used by Dalvik, Androids Java Virtual Machine implementation. Supports the full functionality of the DEX format, e.g. annotations, debug info, line info. 
  • Android-x86 - provides a ready-to-use virtual machine disk which can be simply mounted and used to run original Android on VirtualBox. The advantage of this method is that the experience is 99% like an actual Android device, but with higher processor performance, physical memory and storage.
In the next posts I will do some Android malware analysis using presented tools. Also, in case you now some tool that should be in this list, please leave its URL in the comments.


download file now

Read more »