Integrated Disassembler with Function-Queue Manager for Code Gene Extraction

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current disassemblers are inefficient and lack scalability in processing binary files for malware classification, requiring full disassembly and consuming significant time and resources, making them slow and clumsy in identifying code genes from large numbers of files.

Innovation Solution

An integrated disassembler with a function-queue manager and disassembly interrupter that allows disassembly to start at entry points, enabling partial disassembly and immediate analysis of code fragments, with a function-queue manager to verify and submit fragments to a database, and a disassembly interrupter to terminate processing when sufficient gene information is obtained.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If full disassembly is performed using traditional disassemblers, then complete code fragment extraction is achieved, but processing time increases significantly and scalability is reduced

Engineering Contradiction:

Improvecode fragment extraction completenessVSAvoidprocessing speed

Core Design Contradiction:

Measurement precisionVSProductivity

Solution Approach 1:

The patent segments the disassembly process into independent function units that can be processed individually. Each function is identified by entry points and processed separately, allowing parallel processing and early termination when sufficient code genes are extracted, thus improving productivity while maintaining extraction completeness

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent implements partial disassembly by processing only necessary functions until a predefined threshold of code gene extraction is reached. The disassembly interrupter stops further processing when sufficient information is obtained, avoiding unnecessary full disassembly and significantly reducing processing time for large binary files

Inventive Principle:

Principle #16Partial or excessive action

2Reliability

If traditional disassemblers process large numbers of binary files, then comprehensive malware classification is achieved, but resource consumption increases and scalability is limited

Engineering Contradiction:

Improvemalware classification accuracyVSAvoidsystem resource consumption

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent performs preliminary identification of function entry points and basic blocks before full disassembly. By pre-identifying potential code genes and their locations, the system can prioritize processing of high-value functions and terminate early when classification confidence is sufficient, reducing overall resource consumption while maintaining classification reliability

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces dynamic control mechanisms including the disassembly interrupter that adapts processing depth based on extracted code gene quality and quantity. The function-queue manager dynamically prioritizes functions based on their potential to yield useful code genes, optimizing resource allocation across multiple files and improving scalability

Inventive Principle:

Principle #15Dynamics

3Measurement precision

If manual code fragment inspection is performed, then detailed analysis is achieved, but processing time becomes prohibitively long for bulk files

Engineering Contradiction:

Improvecode fragment analysis depthVSAvoidanalysis time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent replaces manual inspection with automated function-queue management and disassembly interruption mechanisms. The system automatically identifies, prioritizes, and processes functions based on predefined criteria, eliminating manual intervention while maintaining detailed analysis capability through systematic exploration of code fragments

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS11056212B1Methods and systems for an integrated disassembler with a function-queue manager and a disassembly interrupter for rapid, efficient, and scalable code gene extraction and analysis

Publication Date: 2021.07.06 INTEZER LABS LTD

AI summary

The present invention discloses methods and systems for an integrated disassembler with a function-queue manager and a disassembly interrupter for rapid, efficient, and scalable code gene extraction and analysis. Methods include the steps of: upon receiving a target binary file, disassembling the target binary file into assembly code; extracting code fragments from the assembly code; as each code fragment is extracted, verifying each code fragment; upon availability, placing each verified code fragment in an extractor queue; and upon availability, submitting each code fragment in the extractor queue to a gene-analysis system having a code genome database. Alternatively, upon determining the extractor queue is empty or determining resources of the gene-analysis system are underutilized, transferring partially-verified code fragments to the extractor queue. Alternatively, upon receiving gene information regarding the target binary file from the gene-analysis system during disassembly, determining whether to terminate the step of disassembling based on the gene information.