Method to analyze a program for presence of computer viruses by examining the opcode for faults before emulating instruction in emulator

A computer-implemented method for emulating execution of a program, the method comprising the steps of:

• fetching an instruction of the program, the instruction including an opcode;
• determining whether a fault is generated by the opcode;
• emulating the instruction in an emulator;
• and interrupting to a fault handler routine, wherein the fault handler routine is obtained from an updatable data file.

A computer-implemented method for emulating execution of a program, the method comprising the steps of:

• fetching an instruction of the program, the instruction including an opcode;
• determining whether a fault is generated by the opcode;
• emulating the instruction in an emulator;
• interrupting to a fault handler routine;
• and executing the fault handler routine in the emulator, wherein the step of executing of the fault handler routine is performed while the emulator is in a mode immune from generating faults.

A computer-implemented method for emulating execution of a program, the method comprising the steps of:

• fetching an instruction of the program, the instruction including an opcode;
• determining whether a fault is generated by the opcode;
• emulating the instruction in an emulator;
• and
• determining whether the opcode is one of a set of special fault management opcodes, wherein the set of special fault management opcodes includes a Suspend-Fault opcode.

A computer program product comprising a computer-usable medium having computer-readable code embodied therein for using virtual fault management to analyze a program for presence of computer viruses, said product comprising:

• at least one computer-readable program code device configured to fetch an instruction of the program, the instruction including an opcode;
• at least one computer-readable program code device configured to determine whether a fault is generated by the opcode;
• and
• at least one computer-readable program code device configured to emulate the instruction in an emulator.