EMULATOR AND METHOD FOR EMULATION Russian patent published in 2021 - IPC G06F21/56 G06F9/455 

FIELD: information security.

SUBSTANCE: apparatus comprises an emulation tool intended for emulating execution of the instructions of a file on the virtual processor of the emulator; suspending the emulation of execution of the instructions on an API function call; confirming the presence of the API function in the set of updated modules; emulating the execution of said API function following the instructions according to the implementation from the corresponding updated module if the API function is found; transferring control to the execution tool if the API function is not found in the set of updated modules; continuing the emulation of execution of the instructions of the file from the instruction on the return address of the API function using the result of execution of the API function; a set of updated modules stored in the memory consisting of at least one updated module, wherein each updated module from said set comprises an implementation of at least one API function; an execution tool intended for forming the result of execution of said API function according to the implementation of the API function stored in the execution tool or created by the execution tool and further transferring the result of execution of the API function to the emulation tool.

EFFECT: increase in the accuracy of emulation of the instructions of a file, increase in the level of detection of malicious code, reduction in the time of response to new threats.

20 cl, 6 dwg