REPAIRING PORTABLE EXECUTABLE FILES

• US 20110029805A1
• Filed: 07/29/2010
• Published: 02/03/2011
• Est. Priority Date: 07/29/2009
• Status: Active Grant

• Current Assignee: Reversing Labs International GmbH
• Original Assignee: ReversingLabs Incorporated
• Inventors: PERICIN, TOMISLAV
• Granted Patent: US 8,826,071 B2
• Time in Patent Office: Days
• US Class Current: 714/2
• CPC Class Codes: G06F 11/0715 in a system implementing multitasking multitasking per se G06F9/46
• CPC Class Codes: G06F 11/0721 within a central processing unit [CPU]
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/362 Software debugging
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/74 Reverse engineering; Extracting design information from source code

Abstract

A portable executable file can be repaired by identifying an invalid field of a portable executable file. A likelihood of repairing the invalid field of the portable executable file is determined. A repair model for repairing the invalid field of the portable executable file is generated, and the invalid field of the portable executable file is repaired based upon, at least in part, the repair model.

Claims

1. A computer implemented method comprising:

identifying, by a computing device, an invalid field of a portable executable file;

determining, by the computing device, a likelihood of repairing the invalid field of the portable executable file;

generating, by the computing device, a repair model for repairing the invalid field of the portable executable file; and

repairing, by the computing device, the invalid field of the portable executable file based upon, at least in part, the repair model.

2. The computer implemented method of claim 1, wherein determining a likelihood of repairing the invalid field of the portable executable file includes determining the number and characteristics of attributes of the invalid field that do not match a valid characteristic of a valid corresponding field based upon, at least in part, a portable executable file format specification.

3. The computer implemented method of claim 1, wherein generating a repair model includes generating a repair model based upon one or more empirically derived rules.

4. The computer implemented method of claim 1, wherein repairing the invalid field includes statically repairing the invalid field including:

modifying, by the computing device, an image of the portable executable file on a storage medium; and

storing, by the computing device, the modified image on the storage medium.

5. The computer implemented method of claim 1, wherein repairing the invalid field includes dynamically repairing the invalid field including:

executing, by the computing device, the portable executable file; and

modifying, by the computing device, a file stored in memory during execution of the portable executable file, wherein the filed stored in memory is based upon the portable executable file.

6. The computer implemented method of claim 1, wherein repairing the invalid field includes disabling, by the computing device, the invalid field.

7. The computer implemented method of claim 6, wherein disabling the invalid field includes removing, by the computing device, the invalid field from an image of the portable executable file stored on a storage medium prior to execution of the portable executable file.

8. A computer program product comprising a computer readable medium having a plurality of instructions stored thereon, which, when executed by a processor, cause the processor to perform operations comprising:

identifying an invalid field of a portable executable file;

determining a likelihood of repairing the invalid field of the portable executable file;

generating a repair model for repairing the invalid field of the portable executable file; and

repairing the invalid field of the portable executable file based upon, at least in part, the repair model.

9. The computer program product of claim 8, wherein determining a likelihood of repairing the invalid field of the portable executable file includes determining the number and characteristics of attributes of the invalid field that do not match a valid characteristic of a valid corresponding field based upon, at least in part, a portable executable file format specification.

10. The computer program product of claim 8, wherein generating a repair model includes generating a repair model based upon one or more empirically derived rules.

11. The computer program product of claim 8, wherein repairing the invalid field includes statically repairing the invalid field including:

modifying an image of the portable executable file on a storage medium; and

storing the modified image on the storage medium.

12. The computer program product of claim 8, wherein repairing the invalid field includes dynamically repairing the invalid field including:

executing the portable executable file; and

modifying a file stored in memory during execution of the portable executable file, wherein the filed stored in memory is based upon the portable executable file.

13. The computer program product of claim 8, wherein repairing the invalid field includes disabling the invalid field.

14. The computer program product of claim 13, wherein disabling the invalid field includes removing the invalid field from an image of the portable executable file stored on a storage medium prior to execution of the portable executable file.

15. A system comprising:

a processor;

a memory coupled with the processor;

a first software module executable by the processor and the memory, the first software module configured to identify an invalid field of a portable executable file;

a second software module executable by the processor and the memory, the second software module configured to determine a likelihood of repairing the invalid field of the portable executable file;

a third software module executable by the processor and the memory, the third software module configured to generate a repair model for repairing the invalid field of the portable executable file; and

a fourth software module executable by the processor and the memory, the fourth software module configured to repair the invalid field of the portable executable file based upon, at least in part, the repair model.

16. The system of claim 15, wherein the second software module, configured to determine a likelihood of repairing the invalid field of the portable executable file, is configured to determine the number and characteristics of the attributes of the invalid field that do not match a valid characteristic of a valid corresponding field based upon, at least in part, a portable executable file format specification.

17. The system of claim 15, wherein the third software module, configured to generate a repair model, is configured to generate a repair model based upon one or more empirically derived rules.

18. The system of claim 15, wherein the fourth software module, configured to repair the invalid field, is configured for statically repairing the invalid field including:

modifying an image of the portable executable file on a storage medium; and

storing the modified image on the storage medium.

19. The system of claim 15, wherein the fourth software module configured to repair the invalid field, is configured for dynamically repairing the invalid field including:

executing the portable executable file; and

modifying a file stored in memory during execution of the portable executable file, wherein the filed stored in memory is based upon the portable executable file.

20. The system of claim 15, wherein the fourth software module configured to repair the invalid field, is configured to disable the invalid field.

21. The system of claim 20, wherein the fourth software module, configured to disable the invalid field, is configured to remove the invalid field from an image of the portable executable file stored on a storage medium prior to execution of the portable executable file.