Identifying application program interface use in a binary code

A computer-readable medium containing instructions which, when executed, cause a computing device to perform operations comprising:

• obtaining a base memory-write profile description for a binary code, wherein the base memory-write profile description comprises:
• a base memory-write profile for each of a plurality of Application Programming Interface (API) calls in the binary code, wherein the base memory-write profile comprises a count of memory updates for each of a plurality of memory locations during an execution of a corresponding API call;
• receiving an execution request that invokes the binary code;
• generating an execution memory-write profile for the execution request, wherein the execution memory-write profile comprises a count of memory updates for each of the plurality of memory locations during an execution of the execution request;
• determining, based on a comparison between the execution memory-write profile and the base memory-write profiles in the base memory-write profile description, an API call in the binary code that corresponds to the execution request;
• and
• generating a notification that indicates the determined API call.

A computer-implemented system, comprising:

• one or more computers;
• and
• one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising:
• obtaining a base memory-write profile description for a binary code, wherein the base memory-write profile description comprises:
• a base memory-write profile for each of a plurality of Application Programming Interface (API) calls in the binary code, wherein the base memory-write profile comprises a count of memory updates for each of a plurality of memory locations during an execution of a corresponding API call;
• receiving an execution request that invokes the binary code;
• generating an execution memory-write profile for the execution request, wherein the execution memory-write profile comprises a count of memory updates for each of the plurality of memory locations during an execution of the execution request;
• determining, based on a comparison between the execution memory-write profile and the base memory-write profiles in the base memory-write profile description, an API call in the binary code that corresponds to the execution request;
• and
• generating a notification that indicates the determined API call.