Method, computer program and computer for analyzing an executable computer file
First Claim
1. A method of unpacking or decrypting an executable computer file in a malware scanner using a host computer having a hardware processor, the method comprising:
- during emulation in a virtual memory on the host computer for malware detection;
partitioning the executable computer file into plural basic blocks of code;
creating at least a read page of a cache memory for at least some of the basic blocks, the read page of the cache memory storing a read cached real address corresponding to a read cached virtual memory address for a respective basic block, and creating at least a write page of the cache memory for at least some of the basic blocks, the write page of the cache memory storing a write cached real address corresponding to a write cached virtual memory address for a respective basic block;
emulating the executable file by executing some basic blocks of code in the virtual memory on the host computer;
checking, during the execution of said some basic blocks of code, at least one of the read page and the write page of the cache memory for a cached real address corresponding to the virtual address that is being accessed for a respective basic block of said some basic blocks of code;
translating other basic blocks of code during the emulation into translated basic blocks of code that are functionally equivalent to said other basic blocks and which can be executed directly by the hardware processor of the host computer rather than by the virtual computer;
linking at least some of the translated basic blocks of code in a real memory of the host computer; and
executing at least some of the translated basic blocks of code on the host computer so as to enable the executable computer file to be unpacked or decrypted in the virtual memory, whereupon the unpacked or decrypted executable computer file can be analyzed to determine whether the executable computer file is or should be classed as malware.
11 Assignments
0 Petitions
Accused Products
Abstract
In one aspect, an executable computer file is partitioned into basic blocks of code. At least some basic blocks are translated into translated basic blocks. At least some translated basic blocks are linked in memory of a computer. At least some translated basic blocks on the computer are executed so as to enable the file to be unpacked or decrypted. In this way, the file can be analyzed to determine whether the file is or should be classed as malware. In another aspect, at least a read page of cache memory is created for at least some basic blocks and at least a write page of cache memory is created for at least some basic blocks. During the execution of a basic block, at least one of the read page and the write page is checked for a cached real address corresponding to the virtual address that is being accessed for said basic block.
-
Citations
35 Claims
-
1. A method of unpacking or decrypting an executable computer file in a malware scanner using a host computer having a hardware processor, the method comprising:
during emulation in a virtual memory on the host computer for malware detection; partitioning the executable computer file into plural basic blocks of code; creating at least a read page of a cache memory for at least some of the basic blocks, the read page of the cache memory storing a read cached real address corresponding to a read cached virtual memory address for a respective basic block, and creating at least a write page of the cache memory for at least some of the basic blocks, the write page of the cache memory storing a write cached real address corresponding to a write cached virtual memory address for a respective basic block; emulating the executable file by executing some basic blocks of code in the virtual memory on the host computer; checking, during the execution of said some basic blocks of code, at least one of the read page and the write page of the cache memory for a cached real address corresponding to the virtual address that is being accessed for a respective basic block of said some basic blocks of code; translating other basic blocks of code during the emulation into translated basic blocks of code that are functionally equivalent to said other basic blocks and which can be executed directly by the hardware processor of the host computer rather than by the virtual computer; linking at least some of the translated basic blocks of code in a real memory of the host computer; and executing at least some of the translated basic blocks of code on the host computer so as to enable the executable computer file to be unpacked or decrypted in the virtual memory, whereupon the unpacked or decrypted executable computer file can be analyzed to determine whether the executable computer file is or should be classed as malware. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11)
-
12. A computer program for unpacking or decrypting an executable computer file in a malware scanner using a host computer having a hardware processor, the computer program recorded on a non-transitory computer readable medium and comprising program instructions for causing a said host computer to carry out a method of:
during emulation in a virtual memory on the host computer for malware detection by the malware scanner; partitioning the executable computer file into plural basic blocks of code; creating at least a read page of a cache memory for at least some of the basic blocks, the read page of the cache memory storing a read cached real address corresponding to a read cached virtual memory address for a respective basic block, and creating at least a write page of the cache memory for at least some of the basic blocks, the write page of the cache memory storing a write cached real address corresponding to a write cached virtual memory address for a respective basic block; emulating the executable file by executing some basic blocks of code in the virtual memory on the host computer; checking, during the execution of said some basic blocks of code, at least one of the read page and the write page of cache memory for a cached real address corresponding to the virtual address that is being accessed for a respective basic block of said some basic blocks of code; translating other basic blocks of code during the emulation into translated basic blocks of code that are functionally equivalent to said other basic blocks and which can be directly by the hardware processor of the host computer rather than by the virtual computer; linking at least some of the translated basic blocks of code in a real memory of the host computer; and executing at least some of the translated basic blocks of code on the host computer so as to enable the executable computer file to be unpacked or decrypted in the virtual memory, whereupon the unpacked or decrypted executable computer file can be analyzed in the virtual memory to determine whether the executable computer file is or should be classed as malware. - View Dependent Claims (13, 14, 15, 16, 17, 18, 19, 20, 21)
-
22. A computer program for unpacking or decrypting an executable computer file, the computer program recorded on a non-transitory computer readable medium and comprising program instructions for causing a host computer to carry out a method of:
during emulation in a virtual memory on a host computer for malware detection; partitioning the executable computer file into plural basic blocks of code; creating at least a read page of a cache memory for at least some of the basic blocks, the read page of the cache memory storing a read cached real address corresponding to a read cached virtual memory address for a respective basic block, and creating at least a write page of the cache memory for at least some of the basic blocks, the write page of the cache memory storing a write cached real address corresponding to a write cached virtual memory address for a respective basic block; emulating the executable file by executing some of the basic blocks of code; during the execution of said some of the basic blocks of code, checking at least one of the read page and the write page of the cache memory for a cached real address corresponding to the virtual address that is being accessed for a respective basic block of said some of the basic blocks of code; translating basic blocks of code that execute more than a predetermined number of times during the emulation into translated basic blocks of code that can be executed by the host computer; linking at least some of the translated basic blocks of code in a real memory of the host computer; and executing at least some of the translated basic blocks of code on the host computer so as to enable the executable computer file to be unpacked or decrypted, whereupon the unpacked or decrypted executable computer file can be analyzed to determine whether the executable computer file is or should be classed as malware. - View Dependent Claims (23, 24, 25)
-
26. A method of analyzing an executable computer file using a host computer, the method comprising:
during emulation in a virtual memory on a host computer for malware detection; partitioning the executable computer file into plural basic blocks of code; creating at least a read page of a cache memory of the host computer for at least some of the basic blocks, the read page of the cache memory storing a read cached real address corresponding to a read cached virtual memory address for a respective basic block, and creating at least a write page of the cache memory for at least some of the basic blocks, the write page of the cache memory storing a write cached real address corresponding to a write cached virtual memory address for a respective basic block; emulating the executable file by executing some basic blocks of code, wherein, during the execution of a basic block of said some basic blocks of code, at least one of the read page and the write page of the cache memory is checked for a cached real address corresponding to the virtual address that is being accessed for said basic block; translating basic blocks of code that execute more than a predetermined number of times during the emulation into translated basic blocks of code that can be executed by the host computer; linking at least some of the translated basic blocks of code in a real memory of the host computer; and executing at least some of the translated basic blocks of code on the host computer so as to enable the executable computer file to be unpacked or decrypted, whereupon the unpacked or decrypted executable computer file can be analyzed to determine whether the executable computer file is or should be classed as malware. - View Dependent Claims (27, 28, 29, 30, 31, 32, 33, 34, 35)
Specification