Emulator State Image Resumption for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current emulation techniques are resource-intensive and incomplete, failing to accurately recreate the operating system environment, which allows malware to detect and evade emulation through anti-emulation tricks, and lack automatic creation of images to track program code branching.
Innovation Solution
The method involves loading a file into an emulator, initializing and storing its initial state, continuing emulation, detecting conditions, creating and storing new images of the emulator state, and resuming emulation from the correct or incorrect state as needed to accurately track and terminate the emulation process, including handling anti-emulation tricks and errors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the emulator initialization process is made complete to accurately recreate the operating system environment, then the reliability of emulation is improved, but the time and resources required for initialization increase significantly
Solution Approach 1:
The patent applies preliminary action by pre-initializing the emulator to a known good state before emulation begins. The system performs initialization steps in advance (loading boot manager, basic drivers, OS kernel, sessions manager, and winlogon.exe) and stores the resulting state image, so that when emulation starts, the time-consuming initialization work has already been completed, allowing fast resumption from saved states without repeating the full initialization sequence
Solution Approach 2:
The patent uses copying by creating and storing state images that replicate the emulator's complete state at specific points in the initialization process. Instead of re-executing the entire initialization sequence each time, the system copies the pre-initialized state into memory and resumes emulation from that copied state, dramatically reducing initialization time while maintaining emulation accuracy
2Measurement precision
If the emulator state is saved frequently to track program code branching, then the measurement precision of malware behavior is improved, but the device complexity and resource consumption increase
Solution Approach 1:
The patent applies segmentation by dividing the emulation process into distinct phases and saving state images at specific checkpoints (after loading boot manager, basic drivers, OS kernel, sessions manager, and winlogon.exe). This segmented approach allows the system to track program code branching at meaningful intervals without saving states excessively frequently, managing complexity by only capturing states at critical transition points rather than continuously
Solution Approach 2:
The system uses feedback by monitoring emulation conditions and automatically creating state images when specific conditions are met (e.g., when certain system components are loaded or when program code reaches branching points). This conditional state saving provides precise behavior tracking only when necessary, avoiding unnecessary resource consumption while maintaining measurement precision at critical moments
3Adaptability or versatility
If the emulator recreates the full operating system environment including all processes and services, then the adaptability to detect anti-emulation tricks is improved, but the productivity of the emulation process decreases
Solution Approach 1:
The patent applies partial action by recreating only the essential operating system components necessary for malware execution and detection (boot manager, basic drivers, OS kernel, sessions manager, and winlogon.exe) rather than the complete OS environment with all processes and services. This partial recreation provides sufficient environment fidelity to detect anti-emulation tricks while significantly improving emulation productivity by reducing the overhead of managing unnecessary system components
Data Source
AI summary
Disclosed are systems, methods, and computer program products for emulation of files using multiple images of the emulator state. In one example, the method includes loading the file into an emulator of the computer system; initiating emulation of the file by the emulator; storing an initial image of an initial state of the emulator; continuing the emulation of the file and detecting occurrence of a condition that results during the emulation of the file; creating and storing a new image of a next state of the emulator when an occurrence of the condition is detected; determining whether the emulation of the file has terminated correctly or incorrectly; and upon determining that the emulation of the file has terminated incorrectly, loading the new image of the next state into the emulator and resuming the emulation of the file from the next state of the emulator.