METHOD FOR EXPRESS IDENTIFICATION OF EXECUTING DEVICE HARDWARE ARCHITECTURE BASED ON BINARY DATA ANALYSIS Russian patent published in 2024 - IPC G06F21/50 

FIELD: hardware identification.

SUBSTANCE: method for express identification of hardware architecture of an executing device based on the analysis of binary data. In the method, an unmodified memory image of the device under study is obtained, including the machine code of the control program, areas of high-entropy and low-entropy data are excluded from the memory image of the device under study, in the obtained memory area, commands of conditional and unconditional transfers are searched for relative offset in accordance with the alleged hardware architecture by continuous decoding binary data, while the above search is carried out on the basis of the decoded machine codes of conditional and unconditional transfers of the hypothetical hardware architecture obtained from the database of hardware architectures, control transfer graphs are formed and analysed based on the above found commands, after which a decision is made on the correct identification of the hardware architecture on based on the obtained characteristics of control transfer graphs.

EFFECT: technical result consists of increasing the efficiency of identifying the hardware architecture of the executing device.

7 cl, 6 dwg, 1 tbl