# US 12,182,271 B2 · Detecting software vulnerabilities in a binary code > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,182,271 B2 - Document ID: US12182271B2 - Status: Granted - Kind: B2 - Application number: 17/520,451 - Filed: 2021-11-05 - Published: 2023-05-11 - Granted: 2024-12-31 - Earliest claimed: 2021-11-05 - Assignees: BlackBerry Limited - Applicants: BlackBerry Limited - Inventors: Glenn Daniel Wurster; Andrew Chin; Benjamin Gnahm - Web page: https://patentgrep.com/patent/US12182271B2 ## CPC - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 11/3616: {using software metrics} - G06F 11/3684: {for test design, e.g. generating new test cases} - G06F 11/3688: {for test execution, e.g. scheduling of test suites} - G06F 21/54: by adding security routines or objects to programs - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems, methods, and software can be used to detect software errors in a binary code. In some aspects, a method comprises: obtaining a binary code; generating a base memory-write profile for the binary code, wherein the base memory-write profile comprises a count of memory updates for each of a plurality of memory locations during an execution of the binary code according to a base input; for each of a plurality of test inputs, generating a test memory-write profile for the binary code, wherein the test memory-write profile comprises a count of memory updates for each memory location during an execution of the binary code according to the test input; comparing the base memory-write profile and the plurality of test memory-write profiles; and generating a notification based on the comparison, wherein the notification indicates whether there is a difference between the base memory-write profile and the plurality of test memory-write profiles. ## Claims ### Claim 1 A computer-implemented method comprising: obtaining a binary code; generating a base memory-write profile for the binary code, wherein the base memory-write profile comprises a count of memory updates for each of a plurality of memory locations during an execution of the binary code according to a base input; for each of a plurality of test inputs, generating a test memory-write profile for the binary code, wherein the test memory-write profile comprises a count of memory updates for each of the plurality of memory locations during an execution of the binary code according to the corresponding test input; comparing the base memory-write profile and the plurality of test memory-write profiles, wherein the comparing the base memory-write profile and the plurality of test memory-write profiles comprises: comparing a count of memory updates to a particular memory location in the base memory-write profile with a count of memory updates to the particular memory location the plurality of test memory-write profiles; and generating a notification based on the comparison, wherein the notification indicates whether there is a difference between the base memory-write profile and the plurality of test memory-write profiles. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the base memory-write profile is generated by using a shadow memory to count the memory updates for each of the plurality of memory locations. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the notification indicates a number of memory locations where the count of memory updates in at least one of the test memory-write profiles is different from the base memory-write profile. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the notification indicates a difference of the count of memory updates for at least one of the plurality of memory locations between at least one of the test memory-write profiles and the base memory-write profile. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the test inputs are generated based on a fuzzing process. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the notification further indicates whether there is an error alert generated during the execution of the binary code according to the test inputs. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein one or more of the plurality of test inputs are generated based on a set of predetermined rules. ### Claim 8 A non-transitory computer-readable medium containing instructions which, when executed, cause a computing device to perform operations comprising: obtaining a binary code; generating a base memory-write profile for the binary code, wherein the base memory-write profile comprises a count of memory updates for each of a plurality of memory locations during an execution of the binary code according to a base input; for each of a plurality of test inputs, generating a test memory-write profile for the binary code, wherein the test memory-write profile comprises a count of memory updates for each of the plurality of memory locations during an execution of the binary code according to the corresponding test input; comparing the base memory-write profile and the plurality of test memory-write profiles, wherein the comparing the base memory-write profile and the plurality of test memory-write profiles comprises: comparing a count of memory updates to a particular memory location in the base memory-write profile with a count of memory updates to the particular memory location the plurality of test memory-write profiles; and generating a notification based on the comparison, wherein the notification indicates whether there is a difference between the base memory-write profile and the plurality of test memory-write profiles. ### Claim 9 (depends on 8) The computer-readable medium of claim 8, wherein the base memory-write profile is generated by using a shadow memory to count the memory updates for each of the plurality of memory locations. ### Claim 10 (depends on 8) The computer-readable medium of claim 8, wherein the notification indicates a number of memory locations where the count of memory updates in at least one of the test memory-write profiles is different from the base memory-write profile. ### Claim 11 (depends on 8) The computer-readable medium of claim 8, wherein the notification indicates a difference of the count of memory updates for at least one of the plurality of memory locations between at least one of the test memory-write profiles and the base memory-write profile. ### Claim 12 (depends on 8) The computer-readable medium of claim 8, wherein the test inputs are generated based on a fuzzing process. ### Claim 13 (depends on 8) The computer-readable medium of claim 8, wherein the notification further indicates whether there is an error alert generated during the execution of the binary code according to the test inputs. ### Claim 14 (depends on 8) The computer-readable medium of claim 8, wherein one or more of the plurality of test inputs are generated based on a set of predetermined rules. ### Claim 15 A computer-implemented system, comprising: one or more computers; and one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising: obtaining a binary code; generating a base memory-write profile for the binary code, wherein the base memory-write profile comprises a count of memory updates for each of a plurality of memory locations during an execution of the binary code according to a base input; for each of a plurality of test inputs, generating a test memory-write profile for the binary code, wherein the test memory-write profile comprises a count of memory updates for each of the plurality of memory locations during an execution of the binary code according to the corresponding test input; comparing the base memory-write profile and the plurality of test memory-write profiles, wherein the comparing the base memory-write profile and the plurality of test memory-write profiles comprises: comparing a count of memory updates to a particular memory location in the base memory-write profile with a count of memory updates to the particular memory location the plurality of test memory-write profiles; and generating a notification based on the comparison, wherein the notification indicates whether there is a difference between the base memory-write profile and the plurality of test memory-write profiles. ### Claim 16 (depends on 15) The computer-implemented system of claim 15, wherein the base memory-write profile is generated by using a shadow memory to count the memory updates for each of the plurality of memory locations. ### Claim 17 (depends on 15) The computer-implemented system of claim 15, wherein the notification indicates a number of memory locations where the count of memory updates in at least one of the test memory-write profiles is different from the base memory-write profile. ### Claim 18 (depends on 15) The computer-implemented system of claim 15, wherein the notification indicates a difference of the count of memory updates for at least one of the plurality of memory locations between at least one of the test memory-write profiles and the base memory-write profile. ### Claim 19 (depends on 15) The computer-implemented system of claim 15, wherein the test inputs are generated based on a fuzzing process. ### Claim 20 (depends on 15) The computer-implemented system of claim 15, wherein the notification further indicates whether there is an error alert generated during the execution of the binary code according to the test inputs.