Emulating Mixed-Code Programs Using Virtual Machine Instance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-malware solutions face inefficiencies in detecting and emulating malware protected by virtualization-based obfuscation, as they require lengthy emulation processes due to the increased instructions and redundant code used by virtualized malware, making real-time detection on customer machines unfeasible.
Innovation Solution
A dynamic emulation engine is developed that includes a custom emulation component to process both native and custom code, analyzing the internal emulator or interpreter to build a translation table and simplify instructions, allowing for efficient emulation by converting custom bytecode into intermediate language, thereby bypassing the need for extensive emulation of the internal interpreter.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional emulation mechanisms are used to detect virtualized obfuscated malware, then malware detection capability is achieved, but emulation time becomes excessively long and unfeasible for real-time use
Solution Approach 1:
The patent creates a simplified copy model of the virtual machine by extracting and emulating only the essential instruction execution logic. Instead of fully emulating the complex internal virtual machine interpreter, the system copies the critical instruction-to-action mappings and executes them directly through a streamlined emulation engine, achieving two orders of magnitude speedup while maintaining detection accuracy
Solution Approach 2:
The patent segments the malware execution into distinct instruction blocks and processes them through a customized emulation approach. By dividing the virtual machine instruction set into manageable segments and creating specific handling logic for each segment type, the system avoids the overhead of general-purpose interpretation while maintaining comprehensive detection coverage
2Reliability
If virtualized obfuscation is used by malware, then malware protection and code obfuscation are achieved, but code execution speed decreases due to increased instruction count and redundant operations
Solution Approach 1:
The patent extracts the essential execution logic from the virtualized malware code by analyzing the instruction blocks and identifying the core operational patterns. The extraction process removes redundant virtualization overhead while preserving the malicious functionality, allowing direct emulation of the extracted logic without the burden of full virtual machine interpretation
Solution Approach 2:
The patent changes the emulation parameters by implementing a customized instruction set architecture that maps virtual machine instructions directly to host machine operations. This parameter transformation eliminates the intermediate interpretation layer, changing the execution model from byte-by-byte interpretation to block-level direct execution, thereby significantly improving performance
Data Source
AI summary
The subject disclosure is directed towards a technology for efficiently emulating program code that is protected by one or more various code virtualization techniques to detect the presence of malware. An emulation engine emulates a program containing a mix of native code, custom (e.g., virtualized obfuscated) code, and at least one emulator and/or interpreter that understands the custom code, by building a custom emulation component that is built by detecting and analyzing the internal emulator or interpreter. The custom emulation component may access a translation table built from the analysis, and also may simplify a plurality of instructions in the program into a lesser number of instructions in an intermediate language used for emulation.