METHOD FOR EMULATING THE EXECUTION OF FILES COMPRISING INSTRUCTIONS, DIFFERENT FROM MACHINE INSTRUCTIONS Russian patent published in 2018 - IPC G06F9/455 

Abstract RU 2659742 C1

FIELD: information technology.

SUBSTANCE: invention relates to emulating the execution of files. Method for emulating the execution of a file that comprises instructions different from machine instructions, implemented by an electronic computing device, comprising: a) forming a file image of using the emulation tool by reading a part of the file, and the file contains instructions different from machine instruction; b) emulating using the emulation tool the execution of instructions from the file image; c) forming another file image by means of the emulation tool, if the control was transferred from the instruction from the file image to the instruction in another file, by reading a part of another file, wherein the another file image is formed by reading a part of another file; d) detecting by an analysis tool at least one known set of instructions in the read part of another file, wherein the known set of instructions is a set of instructions intended for processing instructions different from machine instructions, contained in the file whose image was generated in step a; e) setting, using a breakpoint analysis tool, at the beginning of at least one known set of instructions in the another file image; f) emulating using the emulation tool the execution of instructions from the another file image, and when the breakpoint is reached by the emulation tool, an emulation record is added to the emulation log of the execution of a known set of instructions, at the beginning of which the breakpoint is set.

EFFECT: technical result is emulating the execution of files comprising instructions, different from machine instructions.

14 cl, 4 dwg

Similar patents RU2659742C1

Title Year Author Number
METHOD FOR FILE EXECUTION EMULATION 2017
  • Liskin Aleksandr Viktorovich
  • Krylov Vladimir Vladimirovich
RU2659734C1
EMULATOR AND METHOD FOR EMULATION 2020
  • Pintijskij Vladislav Valerevich
  • Anikin Denis Vyacheslavovich
  • Kirsanov Dmitrij Aleksandrovich
  • Trofimenko Sergej Vladimirovich
RU2757409C1
METHOD OF DETECTING MALICIOUS EXECUTABLES, CONTAINING INTERPRETER, BY COMBINING EMULATORS 2015
  • Zakorzhevskij Vyacheslav Vladimirovich
  • Vinogradov Dmitrij Valerevich
  • Pintijskij Vladislav Valerevich
  • Kirsanov Dmitrij Aleksandrovich
RU2622627C2
METHOD OF EMULATING SYSTEM FUNCTION CALLS FOR EVADING EMULATION COUNTERMEASURES 2012
  • Belov Sergej Jur'Evich
RU2514141C1
SYSTEM AND METHOD OF CREATING SOFTWARE DETECTION RECORDS 2012
  • Golovkin Maksim Jur'Evich
RU2491615C1
SYSTEM AND METHOD FOR AUTOMATIC PROCESSING OF SOFTWARE SYSTEM ERRORS 2012
  • Antukh Aleksandr Ehduardovich
  • Malanov Aleksej Vladimirovich
RU2521265C2
SYSTEM AND METHOD FOR LOG FORMING IN VIRTUAL MACHINE FOR ANTI-VIRUS FILE CHECKING 2017
  • Pintijskij Vladislav Valerevich
  • Anikin Denis Vyacheslavovich
  • Kobychev Denis Yurevich
  • Golovkin Maksim Yurevich
  • Butuzov Vitalij Vladimirovich
  • Karasovskij Dmitrij Valerievich
  • Kirsanov Dmitrij Aleksandrovich
RU2649794C1
SYSTEM AND METHOD OF GENERATING LOG WHEN EXECUTING FILE WITH VULNERABILITIES IN VIRTUAL MACHINE 2018
  • Monastyrskij Aleksej Vladimirovich
  • Pavlyushchik Mikhail Aleksandrovich
  • Pintijskij Vladislav Valerevich
  • Anikin Denis Vyacheslavovich
  • Kirsanov Dmitrij Aleksandrovich
RU2724790C1
SYSTEM AND METHOD TO COMPARE FILES BASED ON FUNCTIONALITY TEMPLATES 2009
  • Vasilenko Roman Sergeevich
RU2427890C2
SYSTEM AND METHOD OF FILE ANALYSIS FOR MALICIOUSNESS IN VIRTUAL MACHINE 2017
  • Pintijskij Vladislav Valerevich
  • Anikin Denis Vyacheslavovich
  • Kobychev Denis Yurevich
  • Golovkin Maksim Yurevich
  • Butuzov Vitalij Vladimirovich
  • Karasovskij Dmitrij Valerievich
  • Kirsanov Dmitrij Aleksandrovich
RU2665911C2

RU 2 659 742 C1

Authors

Liskin Aleksandr Viktorovich

Krylov Vladimir Vladimirovich

Dates

2018-07-03Published

2017-08-17Filed