Detecting executable code within a data entity

A computer implemented method for protecting a computer, the method comprising:

• receiving by the computer, a data block entering a network;
• detecting, by the computer, a type of the data block;
• selecting a process for generating a binary representation of the data block based on the type of the data block;
• generating, by the computer, a binary representation of the data block based on the selected process;
• searching, by the computer, for anchors within the data block, wherein an anchor is a pre-defined code artifact that can be disassembled for a machine instruction from a specific set of instructions;
• when said searching locates one or more anchors within the data block, then disassembling a pre-defined number of successive bytes of the data block following the anchors to discover additional machine instructions;
• further searching, by the computer, for machine instructions in the data block for jumping to different locations within the data block;
• following the jump instructions to the jump location, and further disassembling, by the computer, the pre-defined number of successive bytes of the data block to discover yet additional machines instructions;
• attempting to build, by the computer, an execution path from the discovered machine instructions, comprising:
• parsing the discovered machine instructions;
• and
• following the flow of the execution path, including conditional and unconditional branches of the parsed machine instructions, to validate or invalidate the execution path;
• validating, by the computer, an incremented location by scanning a built execution path for machine instructions that increment a register that stores a location on the execution path;
• finding, by the computer after validating the incremented location, a self-modifying artifact by scanning remaining machine instructions in the built execution path for an arithmetic or logic operation performed on a register that currently or previously held a location in the validated incremented location;
• finding, by the computer after finding the self-modifying artifact, a modified loop index by scanning remaining machine instructions in the built execution path for registers that hold a loop value that is incremented or decremented;
• preventing, by the computer, the data block from entering the network when a modified loop index is found.