66 results about "Disassembler" patented technology

A system for preventing accurate disassembly of computer code. Such code masking, referred to as “obfuscation,” is useful to prevent unwanted parties from making copies of an original author's software, obtaining valuable information from the software for purposes of breaking into a program, stealing secrets, making derivative works, etc. The present invention uses assembly-language instructions so as to confuse the disassembler to produce results that are not an accurate representation of the original assembly code. In one embodiment, a method is provided where an interrupt, or software exception instruction, is used to mask several subsequent instructions. The instruction used can be any instruction that causes the disassembler to assume that one or more subsequent words, or bytes, are associated with the instruction. The method, instead, jumps directly to the bytes assumed associated with the instruction and executes those bytes for a different purpose. A preferred embodiment works with a popular Microsoft “ASM” assembler language and “DASM” disassembler. The instructions used to achieve the obfuscation include “INT” instructions. Using this approach up to 17 bytes of obfuscation can be achieved with five instructions. Each instruction remains obfuscated until executed and returns to an obfuscated state afterwards.

A data communications system for communicating a data signal formed of successive data elements, said system comprising a transmission node; a reception node; and a link providing a data connection from said transmission node to said reception node; in which: said transmission node comprises a clock signal transmitter for transmitting a synchronisation clocking signal to said reception node via said link, said synchronisation clocking signal having synchronising features occurring at a frequency lower than a data element rate; an assembler for assembling elements of said data signal into data frames, each data frame having a plurality of successive data elements of said data signal, for transmission to said reception node via said link, said assembler being responsive to said synchronisation clocking signal so as to set a synchronisation flag associated with a data element having a first predetermined temporal relationship with a synchronising feature of said synchronisation clocking signal; and said reception node comprises: a detector detecting a synchronising feature of said synchronisation clocking signal received from said transmission node; a disassembler for disassembling received data frames to regenerate said data signal, said disassembler being operable to detect a data element associated with a set synchronisation flag; an output unit for outputting a data element associated with a set synchronisation flag at a second predetermined temporal relationship with respect to said synchronising feature of said received synchronisation clocking signal; said first and second predetermined temporal relationships being arranged so that a predetermined system latency exists between input of a data element to said transmission node and subsequent output of that data element by said reception node.

A mechanism for the disassembly of a handgun without triggering, which prevents the consequential accidental firing of a cartridge in the chamber upon triggering. The mechanism including a disassembler, sear catcher lever, sear catcher and a sear catcher spring. The disassembler has an eccentric pin. Rotation of the dissembler moves the sear catcher lever forward. The sear catcher spring pushes the sear catcher which abuts the other end of sear catcher lever. The sear catcher can catch the sear as soon as the sear is pressed downwards around the sear pin by the slide, and it can hold the sear beneath the plane of cocking of the firing pin. At the same time, the sear catcher blocks the firing pin safety lever if the sear catcher lever is in its utmost forward position. That way the cocking of the firing pin is prevented and the triggering is blocked.

When a branch instruction is decoded by the instruction decoders 409a˜409c, the upper 29 bits of the PC relative value included in the branch instruction are sent to the upper PC calculator 411 and the lower 3 bits are sent to the lower PC calculator 405. The lower PC calculator 405 adds the lower 3 bits of the PC relative value and the lower 3 bits of the present lower PC 404 and sends the result to the lower PC 404 as the updated lower PC. The upper PC calculator 411 adds the upper 29 bits of the PC relative value, the upper 29 bits of the present upper PC 403, and a carry that may be received from the lower PC calculator 405, and sends the result to the upper PC 403 as the updated upper PC.

When a branch instruction is decoded by the instruction decoders 409a˜409c, the upper 29 bits of the PC relative value included in the branch instruction are sent to the upper PC calculator 411 and the lower 3 bits are sent to the lower PC calculator 405. The lower PC calculator 405 adds the lower 3 bits of the PC relative value and the lower 3 bits of the present lower PC 404 and sends the result to the lower PC 404 as the updated lower PC. The upper PC calculator 411 adds the upper 29 bits of the PC relative value, the upper 29 bits of the present upper PC 403, and a carry that may be received from the lower PC calculator 405, and sends the result to the upper PC 403 as the updated upper PC.

The present invention extends to methods, systems, and computer program products for hierarchically disassembling messages. The functionality of disassemblers and framers is decoupled such that framers for different types of messages can be utilized at the same level in a hierarchy without having to also change disassemblers. Virtually any level of disassembly is possible to address any corresponding level of message nesting. Disassembly can be performed on a per message or per session basis.

Some embodiments provide a system that analyzes the operation of a disassembler. The system starts by generating a set of processor instructions. Next, the system validates the disassembler using each processor instruction from the set of processor instructions by obtaining an assembly representation for the processor instruction using the disassembler. The system then monitors an execution of the processor instruction on a processor operating in single-step mode to produce an execution result for the processor instruction, and determines a correctness of the disassembler by comparing the assembly representation for the processor instruction with the execution result for the processor instruction.

A full services access multiplexer is described. A master digital subscriber line (master DSL) modem is coupled to a conductor pair. A POTS extender also is coupled to the conductor pair and may sense the operation of a fallback or other signal on the conductor pair. A suppression signal may be transmitted to a master DSL modem upon occurrence of the fallback. The suppression signal may travel over a control circuit. Traffic over a backplane or other network segment may be uninterrupted to a Integrated Access Device (IAD) by handling signals inbound and outbound to the backplane via a packet assembler and disassembler (PAD). The PAD may transmit a data stream to a vocoder and receive a data stream from the vocoder for injection onto the backplane. The vocoder connects duplexed traffic to the subscriber line interface circuit (SLIC) wherein traffic between the vocoder and the SLIC are in analog formats in or near the audible range of frequencies.

In order to prevent analysis by static and dynamic disassembly techniques, instruction level code obfuscation is performed to induce misalignment and mistaken analysis by disassemblers. Misalignment is induced by including a bypass which leads, during execution, to a legitimate location. During analysis, however, bogus data may be analyzed by the disassembler due to the bypass. Run-time modifications may also be included in code. Code is changed to an invalid state, and instructions inserted into the code which will return the code to a valid state during execution. During analysis, these invalid states may be analyzed by the disassembler as invalid instructions. Induced misalignments and run-time modifications can be chained together to produce sequences of code that will always produce invalid disassembly output from common disassemblers.

The invention discloses a method for processing instruction matching of a disassembler. A user represents the description of an instruction format on an instruction set manual as an 'instruction format representation string', and establishes the correlation of the 'instruction format expression string' and an 'instruction processing callback function'; the disassembler extends the 'instruction format representation string' as an 'expanded binary string of the instruction format representation string', further to establish the correlation of the 'expanded binary string of the instruction format representation string' and the 'instruction processing callback function'; when the disassembler disassembles, an input binary stream is matched with the 'expanded binary string of the instruction format representation string'; if the matching is successful, the corresponding 'instruction format expression string' is called; otherwise, the input string is not an effective instruction string. The representation method of the instruction format is intuitive and brief; the unfolding process of the representation is fixed without respectively compiling aiming at different platforms; and the utilization of the information provided by the presentation can conveniently quote an input string in the callback function.

Methods, apparatus and systems for virtualization of a native instruction set are disclosed. Embodiments include a processor core executing the native instructions and a second core, or alternatively only the second processor core consuming less power while executing a second instruction set that excludes portions of the native instruction set. The second core's decoder detects invalid opcodes of the second instruction set. A microcode layer disassembler determines if opcodes should be translated. A translation runtime environment identifies an executable region containing an invalid opcode, other invalid opcodes and interjacent valid opcodes of the second instruction set. An analysis unit determines an initial machine state prior to execution of the invalid opcode. A partial translation of the executable region that includes encapsulations of the translations of invalid opcodes and state recoveries of the machine states is generated and saved to a translation cache memory.

Data interchanges are processed so that problematic individual elements within the data interchanges do not cause the processing of the data interchanges to be suspended unless there is a catastrophic error. The data interchanges are split up by flat file and / or XML disassemblers of a message engine into independent messages even if some elements are incorrect or cause processing failures. Those messages in the interchange that may be processed are processed, while those that would cause processing errors are suspended in a suspend queue for recovery processing. Even when a message is placed in the suspend queue, processing continues with the next independent message in the data interchange. Messages that are placed in the suspend queue for lack of routing information may be resumed by providing the routing information and again attempting to route the previously suspended message. The method of the invention is scalable since it works regardless of the size of the interchange or its individual message elements.