Method to analyze a program for presence of computer viruses by examining the opcode for faults before emulating instruction in emulator

• US 5,964,889 A
• Filed: 04/16/1997
• Issued: 10/12/1999
• Est. Priority Date: 04/16/1997
• Status: Expired due to Term

• Current Assignee: NortonLifeLock Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Nachenberg, Carey S.
• Primary Examiner(s): An, Meng-Al T.
• Assistant Examiner(s): Ciccozzi, John
• Application Number:
  US08/843,512
• Time in Patent Office: 909 Days
• Field of Search: 370/397, 370/440, 370/419, 364/269.4, 364/709.05, 364/550, 395/186, 395/183.09, 395/183.14, 395/181, 395/187.01, 395/182.04, 395/700, 395/550, 395/183.01, 395/183.05, 395/800.23, 395/500, 380/4, 380/2.2, 371/48, 714/25, 714/28, 714/29, 714/32, 714/34, 714/799, 712/22
• US Class Current: 714/25
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Abstract

A computer-implemented apparatus and method for countering attempts of polymorphic viruses to evade detection by emulation-based scanners. Such attempts try to exploit differences between the real and virtual execution of instructions. The invention includes a fault manager (158) integrated into the CPU emulator (154) of a virus scanner software product. Before each instruction is emulated by the CPU emulator (154), the fault manager (158) examines the opcode of the instruction to determine (310) whether a "fault" is triggered. If a fault is triggered, the fault manager (158) saves (314) a state record on a fault stack (162), then interrupts (316) to a corresponding fault handler routine (160). The criteria for triggering a fault and the corresponding fault handler routine (160) may be obtained from an updatable data file (164).

Claims

1. A computer-implemented method for using virtual fault management to analyze a program for presence of computer viruses, the method comprising the steps of:

fetching an instruction of the program, the instruction including an opcode;

determining whether a fault is generated by the opcode;

saving components of a state of an emulator if the fault is generated; and

interrupting to a fault handler routine.

2. The method of claim 1, wherein the components include a stack pointer.

3. The method of claim 1, wherein the fault handler routine is stored in virtual memory.

5. The method of claim 1, further comprising the step of executing the fault handler routine in the emulator.

4. A computer-implemented method for emulating execution of a program, the method comprising the steps of:

fetching an instruction of the program, the instruction including an opcode;

determining whether a fault is generated by the opcode;

emulating the instruction in an emulator; and

interrupting to a fault handler routine, wherein the fault handler routine is obtained from an updatable data file.

6. A computer-implemented method for emulating execution of a program, the method comprising the steps of:

fetching an instruction of the program, the instruction including an opcode;

determining whether a fault is generated by the opcode;

emulating the instruction in an emulator;

interrupting to a fault handler routine; and

executing the fault handler routine in the emulator, wherein the step of executing of the fault handler routine is performed while the emulator is in a mode immune from generating faults.

7. The method of claim 6, wherein a prefetch queue is disabled during the step of executing the fault handler routine.

8. The method of claim 6, further comprising the step of skipping determining whether a fault is generated if the emulator is in the mode immune from generating faults.

9. The method of claim 8, further comprising the step of verifying that the fault handler routine has not been executing for too many cycles.

10. A computer-implemented method for emulating execution of a program, the method comprising the steps of:

fetching an instruction of the program, the instruction including an opcode;

determining whether a fault is generated by the opcode;

emulating the instruction in an emulator; and

determining whether the opcode is one of a set of special fault management opcodes, wherein the set of special fault management opcodes includes a Suspend-Fault opcode.

11. A system for using virtual fault management to analyze a program for presence of computer viruses, the system comprising:

a CPU emulator for emulating instructions of the program; and

a fault manager incorporated into the CPU emulator for determining whether faults are generated by the instructions.

12. The system of claim 11, further comprising a fault handler in virtual memory accessible to the CPU emulator for servicing the faults generated.

13. A computer program product comprising a computer-usable medium having computer-readable code embodied therein for using virtual fault management to analyze a program for presence of computer viruses, said product comprising:

at least one computer-readable program code device configured to fetch an instruction of the program, the instruction including an opcode;

at least one computer-readable program code device configured to determine whether a fault is generated by the opcode; and

at least one computer-readable program code device configured to emulate the instruction in an emulator.

14. The product of claim 13, further comprising at least one computer-readable program code device configured to save components of a state of the emulator if the fault is generated.

15. The product of claim 13, further comprising at least one computer-readable program code device configured to interrupt to a fault handler routine.

16. The product of claim 13, further comprising at least one computer-readable program code device configured to determine whether the opcode is one of a set of special fault management opcodes.