Binary API Identification via Memory-Write Profile Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identifying and tracking API calls in binary code without source code is challenging due to the binary format being non-human readable, making it difficult to determine which API calls are executed, especially for APIs without documentation.
Innovation Solution
A method is provided to monitor and determine a memory-write profile for the execution of binary code, which is compared to base memory-write profiles of known API calls to identify the invoked API call and assess the risk level of the execution request.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If binary code is analyzed without source code, then security analysis can be performed on compiled software, but the binary format being non-human readable makes it difficult to identify which API calls are executed
Solution Approach 1:
The patent introduces an intermediary layer (runtime instrumentation and API monitoring system) that sits between the binary code execution and the analysis process. This intermediary automatically tracks and records API call invocations, parameters, and return values, converting the invisible binary execution into observable data without requiring human readable source code.
Solution Approach 2:
The patent replaces manual/static analysis methods with dynamic/runtime analysis mechanisms. Instead of attempting to parse and understand binary code structure statically (mechanical approach), the system dynamically instruments the code during execution to automatically capture API call behavior, substituting manual analysis with automated runtime monitoring.
2Measurement precision
If memory-write profiles are monitored to identify API calls, then API invocation can be detected in binary code, but the process requires comparing execution profiles against base profiles of known API calls
Solution Approach 1:
The patent performs preliminary action by pre-establishing base memory-write profiles for known API calls before actual security analysis. These baseline profiles capture the characteristic memory access patterns of legitimate API invocations, enabling later comparison and anomaly detection during runtime analysis of suspicious binary code.
Solution Approach 2:
The patent utilizes parameter changes in memory access patterns as the key differentiator for identifying API calls. By monitoring changes in memory-write behavior (address patterns, access frequencies, data sizes) during execution and comparing them against baseline parameters, the system can identify which API calls are invoked without needing to parse binary code directly.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems, methods, and software can be used to identify API use in a binary code. In some aspects, a method comprises: obtaining a base memory-write profile description for a binary code, wherein the description comprises: a base memory-write profile for each of a plurality of API calls in the binary code, wherein the base memory-write profile comprises a count of memory updates for each of a plurality of memory locations during an execution of a corresponding API call; receiving an execution request that invokes the binary code; generating an execution memory-write profile for the request, wherein the execution memory-write profile comprises a count of memory updates for each memory location during an execution of the request; determining, based on a comparison between the execution memory-write profile and the base memory-write profiles in the description, an API call corresponding to the request; and generating a notification indicating the determined API call.