Method for semantic preserving transform mutation discovery and vetting

A computer system with at least one processor for executing instructions for generating validated software transforms, the instructions from a non-transitory storage media causing the at least one processor to perform steps comprising:

• mutating a target program binary, producing a plurality of variants of the target program binary;
• determining whether each variant of the variants passes a test suite for the target program binary;
• upon determining the variant does not pass the test suite, discarding the variant;
• upon determining the variant passes the test suite:
• extracting a candidate transform that describes a difference between a disassembled output of the target program binary and a disassembled output of the variant;
• applying the candidate transform to each test program binary of a plurality of additional program binaries, producing a variant of the test program binary;
• determining whether the candidate transform is safe, wherein the candidate transform is considered safe if, for each test program binary of the additional program binaries, the variant of the test program binary passes a respective test suite for the test program binary;
• upon determining the candidate transform is not safe, discarding the candidate transform;
• and
• upon determining the candidate transform is safe, collecting the candidate transform as one of the validated software transforms.

A computer system with at least one processor for executing instructions for generating validated software transforms, the instructions from a non-transitory storage media causing the at least one processor to perform steps comprising:

• mutating a target program binary using genetic mutation, producing a plurality of variants of the target program binary using a crossover combination technique and tournament selection, wherein the crossover combination technique is a two-point technique;
• determining whether each variant of the variants passes a test suite for the target program binary;
• upon determining the variant does not pass the test suite, discarding the variant;
• upon determining the variant passes the test suite:
• extracting a candidate transform by comparing a disassembled output of the target program binary with a disassembled output of the variant, the candidate transform describing a difference between the disassembled outputs of the target program binary and the variant within a window scope criteria;
• applying the candidate transform to each test program binary of a plurality of additional program binaries, producing a variant of the test program binary, wherein the candidate transform is applied to a .text section of the test program binary;
• determining whether the candidate transform is safe, wherein the candidate transform is considered safe if, for each test program binary of the additional program binaries, the variant of the test program binary passes a respective test suite for the test program binary;
• upon determining the candidate transform is not safe, discarding the candidate transform;
• and
• upon determining the candidate transform is safe, collecting the candidate transform as one of the validated software transforms.