# US 10,311,233 B2 · Generic unpacking of program binaries > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,311,233 B2 - Document ID: US10311233B2 - Status: Granted - Kind: B2 - Application number: 15/038,413 - Filed: 2014-12-23 - Published: 2016-10-06 - Granted: 2019-06-04 - Earliest claimed: 2013-12-26 - Assignees: McAfee, Inc. - Applicants: Mcafee, Inc. - Inventors: Amit Malik; Vikas Taneja; Benjamin Cruz - Web page: https://patentgrep.com/patent/US10311233B2 ## CPC - G06F 21/562: {Static detection} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract By hooking application programming interfaces in an execution environment, the return address for hooked application programming interface calls can be logged and used to determine when a packed binary has been unpacked. In one approach, memory allocations are detected and the return address is checked against the memory regions allocated. In another approach, the contents of memory at the return address in a pre-execution copy of the executable binary is compared with the contents of memory at the return address in the executing copy of the binary. This allows efficient detection of the completion of unpacking without knowledge of the unpacking technique. The unpacked binary may then be analyzed for possible malware. ## Claims ### Claim 1 A storage disk or storage device comprising instructions for detecting malware that, when executed, cause a processor to at least: load a self-extracting first executable into memory, the self-extracting first executable including an unpacking second executable and a packed third executable; and after the unpacking second executable unpacks the packed third executable into a fourth executable: detect an application programming interface call; determine a return address for the application programming interface call; determine whether the fourth executable is being executed based on the return address not being in a region of memory previously allocated to the self-extracting first executable; and when the fourth executable is being executed, scan the fourth executable for malware. ### Claim 2 (depends on 1) The storage disk or storage device of claim 1, wherein the instructions, when executed cause the processor to detect the application programming interface call by detecting system related application programming interface calls. ### Claim 3 (depends on 1) The storage disk or storage device of claim 1, wherein the instructions, when executed, cause the processor to detect the application programming interface call by detecting any of a set of application programming interface calls. ### Claim 4 (depends on 1) The storage disk or storage device of claim 1, wherein the instructions, when executed, cause the processor to detect the application programming interface call by: detecting an allocation of the region of memory by the self-extracting first executable; and recording memory allocation data corresponding to the region of memory. ### Claim 5 (depends on 4) The storage disk or storage device of claim 4, wherein the instructions, when executed, cause the processor to determine whether the fourth executable is being executed based on the recorded memory allocation data. ### Claim 6 (depends on 1) The storage disk or storage device of claim 1, wherein the instructions, when executed, cause the processor to determine whether the fourth executable is being executed based on the return address not in the region of memory previously allocated by: comparing memory contents at the return address in an active binary image with memory contents at the return address in a passive binary image. ### Claim 7 (depends on 6) The storage disk or storage device of claim 6, wherein the instructions, when executed, cause the processor to translate the return address in the active binary image to an address in the passive binary image. ### Claim 8 A system for detecting malware, comprising: a processor; and a first memory including instructions that, when executed, cause the processor to at least: load a self-extracting first executable into a second memory, the self-extracting first executable including an unpacking second executable and a packed third executable; after the unpacking second executable has unpacked the packed third executable into a fourth executable: determine a return address for an application programming interface call; and in response to the return address not being in a region of memory previously allocated to the self-extracting first executable, scan the fourth executable for malware. ### Claim 9 (depends on 8) The system of claim 8, wherein the instructions, when executed, cause the processor to: determine the return address for the application programming interface by detecting the application programming interface call by the self-extracting first executable. ### Claim 10 (depends on 8) The system of claim 8, wherein the instructions, when executed, cause the processor to: detect the application programming interface call by detecting system related application programming interface calls. ### Claim 11 (depends on 8) The system of claim 8, wherein the instructions, when executed, cause the processor to: detect the application programming interface call by detecting any of a predetermined set of application programming interface calls. ### Claim 12 (depends on 8) The system of claim 8, wherein the instructions, that when executed, cause the processor to: detect the application programming interface call by: detecting allocations of memory by the self-extracting first executable; and recording memory allocation data corresponding to the allocations of memory. ### Claim 13 (depends on 12) The system of claim 12, wherein the instructions, when executed, cause the processor to: determine whether the return address is in one of the allocations of memory based on the recorded memory allocation data. ### Claim 14 (depends on 8) The system of claim 8, wherein the instructions, when executed, cause the processor to: determine whether the fourth executable is being executed based on the return address by: compare memory contents at the return address in an active binary image with memory contents at the return address in a passive binary image. ### Claim 15 (depends on 14) The system of claim 14, wherein the instructions, that when executed, cause the processor to: determine whether the fourth executable is being executed based on the return address by translating the return address in the active binary image to an address in the passive binary image. ### Claim 16 A method of unpacking a packed binary, comprising: executing the packed binary in a programmable device to: unpack a packed first executable of the packed binary into a second executable; detecting an application programming interface call by the packed binary; determining a return address for the application programming interface call; and scanning the second executable for malware in response to the return address being in a region of memory previously allocated by the packed binary. ### Claim 17 (depends on 16) The method of claim 16, further including capturing memory allocation data upon an allocation of memory by the packed binary. ### Claim 18 (depends on 16) The method of claim 16, further including: wherein determining whether the third executable is being executed mapping the packed binary into memory as a passive image and executing the packed binary as an active image; and comparing memory contents at the return address in the passive image with memory contents at the return address in the active image. ### Claim 19 (depends on 18) The method of claim 18, further including translating the return address in the active image into a return address in the passive image.