Back to results
US 9,804,948 B2Granted
System, method, and computer program product for simulating at least one of a virtual environment and a debugging environment to prevent unwanted code from executing
AssigneeMcAfee, Inc.
InventorsDirk Kolberg, Lukesh Kumar, Kevin Andrew Gudgion
Life of this patent
Estimating the term…
Abstract
A system, method, and computer program product are provided for simulating at least one of a virtual environment and a debugging environment to prevent unwanted code from executing. In use, at least one of a virtual environment and a debugging environment is simulated. Additionally, unwanted code is prevented from executing as a result of the simulation.
Claims18
A non-transitory machine-readable medium on which are stored instructions, comprising instructions that when executed cause a machine to:
- identify a request to execute an executable file;
- disable simulation of a virtual environment during execution of the executable file responsive to a determination that the executable file is not protected or packed or a determination that a packer or protector used to pack or protect the executable file is whitelisted;
- enable simulation of the virtual environment during execution of the executable file responsive to a determination that the executable file is protected or packed and a determination that a packer or protector used to pack or protect the executable file is not whitelisted;
- and
- execute the executable file,
- wherein simulation of the virtual environment causes execution of the executable file to appear to be executing in the virtual environment even though elements of the simulated virtual environment are not present on the machine.
3 more elements
A method, comprising:
- identifying a request to execute an executable file on a machine;
- disabling simulation of a virtual environment during execution of the executable file responsive to a determination that the executable file is not protected or packed or a determination that a packer or protector used to pack or protect the executable file is whitelisted;
- enabling simulation of the virtual environment during execution of the executable file responsive to a determination that the executable file is protected or packed and a determination that a packer or protector used to pack or protect the executable file is not whitelisted;
- and
- executing the executable file,
- wherein simulation of the virtual environment causes execution of the executable file to appear to be executing in the virtual environment even though elements of the simulated virtual environment are not present on the machine.
3 more elements
A system, comprising:
- a processor;
- a memory on which are stored instructions, comprising instructions that when executed cause the processor to:
- identify a request to execute an executable file;
- disable simulation of a virtual environment during execution of the executable file responsive to a determination that the executable file is not protected or packed or a determination that a packer or protector used to pack or protect the executable file is whitelisted;
- enable simulation of the virtual environment during execution of the executable file responsive to a determination that the executable file is protected or packed and a determination that a packer or protector used to pack or protect the executable file is not whitelisted;
- and
- execute the executable file,
- wherein simulation of the virtual environment causes execution of the executable file to appear to be executing in the virtual environment even though elements of the simulated virtual environment are not present on the system.
5 more elements
Dependencies are inferred from the claim text.