Non-intrusive method of detecting security flaws of a computer program

A computer program product comprising a computer-readable storage device storing instructions that, when the instructions are executed on a computing device, cause the computing device to perform a non-intrusive method of detecting security flaws of a computer program, the instructions comprising:

• an execution function configured to execute an executable and non-instrumentalized version of the program in a computer system, the computer system comprising at least one cryptographic function able to be called by the program to manipulate at least one cryptographic object;
• an instrumentalizing function configured to instrumentalize the at least one cryptographic function before execution of the executable and non-instrumentalized version of the program to allow recording of the modalities of calls to the cryptographic function from the executable and non-instrumentalized version of the program;
• a recording function that, in a course of execution of the program, and without instrumentalizing the program during execution of the program, is configured to record in a tracing file the modalities of calls to the at least one cryptographic function;
• and
• an analysis function that, after the execution of the program, is configured to analyze the tracing file and create a data structure of states taken by the at least one cryptographic object manipulated in the course of the execution of the program responsive to the analyzing the tracing file, and analyze the data structure to detect calls to the at least one cryptographic function that are liable to form a security flaw.

A system comprising:

• one or more computers and one or more storage devices on which are stored instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
• an execution function configured to execute an executable and non-instrumentalized version of the program in a computer system, the computer system comprising at least one cryptographic function able to be called by the program to manipulate at least one cryptographic object;
• an instrumentalizing function configured to instrumentalize the at least one cryptographic function before execution of the executable and non-instrumentalized version of the program to allow recording of the modalities of calls to the cryptographic function from the executable and non-instrumentalized version of the program;
• a recording function that, in a course of execution of the program, and without instrumentalizing the program during execution of the program, is configured to record in a tracing file the modalities of calls to the at least one cryptographic function;
• and
• an analysis function that, after the execution of the program, is configured to analyze the tracing file and create a data structure of states taken by the at least one cryptographic object manipulated in the course of the execution of the program responsive to the analyzing the tracing file, and analyze the data structure to detect calls to the at least one cryptographic function that are liable to form a security flaw.