FIELD: information technology.
SUBSTANCE: invention relates to emulating the execution of files. Method for emulating the execution of a file that comprises instructions different from machine instructions, implemented by an electronic computing device, comprising: a) forming a file image of using the emulation tool by reading a part of the file, and the file contains instructions different from machine instruction; b) emulating using the emulation tool the execution of instructions from the file image; c) forming another file image by means of the emulation tool, if the control was transferred from the instruction from the file image to the instruction in another file, by reading a part of another file, wherein the another file image is formed by reading a part of another file; d) detecting by an analysis tool at least one known set of instructions in the read part of another file, wherein the known set of instructions is a set of instructions intended for processing instructions different from machine instructions, contained in the file whose image was generated in step a; e) setting, using a breakpoint analysis tool, at the beginning of at least one known set of instructions in the another file image; f) emulating using the emulation tool the execution of instructions from the another file image, and when the breakpoint is reached by the emulation tool, an emulation record is added to the emulation log of the execution of a known set of instructions, at the beginning of which the breakpoint is set.
EFFECT: technical result is emulating the execution of files comprising instructions, different from machine instructions.
14 cl, 4 dwg
Title | Year | Author | Number |
---|---|---|---|
METHOD FOR FILE EXECUTION EMULATION | 2017 |
|
RU2659734C1 |
EMULATOR AND METHOD FOR EMULATION | 2020 |
|
RU2757409C1 |
METHOD OF DETECTING MALICIOUS EXECUTABLES, CONTAINING INTERPRETER, BY COMBINING EMULATORS | 2015 |
|
RU2622627C2 |
METHOD OF EMULATING SYSTEM FUNCTION CALLS FOR EVADING EMULATION COUNTERMEASURES | 2012 |
|
RU2514141C1 |
SYSTEM AND METHOD OF CREATING SOFTWARE DETECTION RECORDS | 2012 |
|
RU2491615C1 |
SYSTEM AND METHOD FOR AUTOMATIC PROCESSING OF SOFTWARE SYSTEM ERRORS | 2012 |
|
RU2521265C2 |
SYSTEM AND METHOD FOR LOG FORMING IN VIRTUAL MACHINE FOR ANTI-VIRUS FILE CHECKING | 2017 |
|
RU2649794C1 |
SYSTEM AND METHOD OF GENERATING LOG WHEN EXECUTING FILE WITH VULNERABILITIES IN VIRTUAL MACHINE | 2018 |
|
RU2724790C1 |
SYSTEM AND METHOD TO COMPARE FILES BASED ON FUNCTIONALITY TEMPLATES | 2009 |
|
RU2427890C2 |
SYSTEM AND METHOD OF FILE ANALYSIS FOR MALICIOUSNESS IN VIRTUAL MACHINE | 2017 |
|
RU2665911C2 |
Authors
Dates
2018-07-03—Published
2017-08-17—Filed