US 12,223,061 B1 · Methods and systems for analyzing dataflow associated with software code to detect software anomalies

Abstract

A non-transitory processor-readable medium stores code representing instructions to be executed by one or more processors, and the instructions include code to cause the one or more processors to (1) receive executable binary code and a specification that defines a constraint and (2) generate a predicate set. The code also causes the one or more processors to identify an argument of a function to be called by the executable binary code, the argument identified based on a map. A constrained predicate set is generated based on the predicate set and the machine-readable specification and, using solver software, the code causes the one or more processors to determine that the argument satisfies the constraint based on the constrained predicate set. A signal that indicates that the executable binary code is associated with a predetermined software action is generated in response to determining the argument satisfies the constraint.

Claims22

Dependent claims

A non-transitory processor-readable medium storing code representing instructions to be executed by one or more processors, the instructions comprising code to cause the one or more processors to:

receive a file that includes executable binary code;
receive a machine-readable specification that defines a constraint;
generate a predicate set based on the executable binary code;
identify an argument of a function to be called by the executable binary code, the argument identified based on a map associated with the function;
generate a constrained predicate set based on the predicate set and the machine-readable specification;
determine, using solver software, that the argument satisfies the constraint based on the constrained predicate set;
and
generate a signal (1) that indicates that the executable binary code is associated with a predetermined software action in response to determining the argument satisfies the constraint and (2) to prevent the executable binary code from being executed at a target processor that is different from the one or more processors.

5 more elements

A method, comprising:

receiving, at a processor, machine-readable binary code to be executed at an execution processor;
generating, via the processor, a machine-readable predicate set based on the machine-readable binary code;
receiving, at the processor, a machine-readable specification indicating a dataflow constraint associated with a variable included in the machine-readable predicate set;
identifying, via the processor, a memory location associated with the variable based on a map associated with the variable;
binding, via the processor, the dataflow constraint to the memory location;
generating, via the processor, a machine-readable constrained predicate set based on the machine-readable predicate set and the dataflow constraint bound to the memory location;
evaluating, via the processor and using solver software, the machine-readable constrained predicate set to determine that the machine-readable binary code satisfies the dataflow constraint for at least one possible execution of the machine-readable binary code;
and
in response to determining that the machine-readable binary code satisfies the dataflow constraint for the at least one possible execution of the machine-readable binary code, modifying, via the processor, an instruction that is included in the machine-readable binary code and is associated with the dataflow constraint, to discontinue the machine-readable binary code from satisfying the dataflow constraint for the at least one possible execution of the machine-readable binary code.

6 more elements

Dependencies are inferred from the claim text.

Methods and systems for analyzing dataflow associated with software code to detect software anomalies

Life of this patent

Methods and systems for analyzing dataflow associated with software code to detect software anomalies

Life of this patent

Abstract

Claims22