US 7,603,713 B1 · Method for accelerating hardware emulator used for malware detection and analysis

Abstract

A method and system for accelerating malware emulator by using an accelerator. The accelerator allows for a potentially malicious component (i.e., process) containing dummy processes to be executed in a real CPU of a computer system using its operating memory. A special memory area is allocated for the process based on the memory requested by the process in the emulator. The state of the CPU and the memory is loaded in the emulator prior to executing the suspicious process. The system can be restored to its initial state in case of malicious actions performed by the process. The dummy instructions of the process are processed by the CPU at its own speed and as soon as the process performs a malicious instruction it is stopped by the emulator. The emulation process is accelerated to a speed of a regular CPU.

Claims19

Dependent claims

A computer-implemented method for accelerating a malware emulator, the method comprising:

(a) selecting a process inside an emulator;
(b) allocating an isolated accelerator address space for the process on a computer system;
(c) executing, in the user mode, native unmodified instructions of the process in the accelerator address space, wherein:
the process is stopped in the accelerator when any one of the following events occur:
(i) a specified exception is raised;
(ii) a limit on instructions to be executed is reached;
and
(iii) a pre-determined time for the accelerator is reached;
and
the execution of the process is continued inside the emulator;
(d) recording the process execution results;
and
(e) providing the process execution results from the accelerator to the emulator.

10 more elements

Dependencies are inferred from the claim text.

Method for accelerating hardware emulator used for malware detection and analysis

Life of this patent

Method for accelerating hardware emulator used for malware detection and analysis

Life of this patent

Abstract

Claims19