Emulator Updatable Modules for API Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional antivirus emulators face challenges in detecting malicious software due to anti-emulation tricks, which can lead to inadequate quality of emulation and delayed updates, resulting in reduced detection rates and increased response times to new threats.
Innovation Solution
The implementation of updatable modules within the emulator that contain native and virtual code for API functions, allowing for dynamic emulation of API calls, either by using precompiled native code or generating results based on parameters, thereby enhancing the reliability and speed of emulation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the emulator implements complete OS simulation to improve detection quality, then the detection rate improves, but the emulation speed deteriorates
Solution Approach 1:
The emulator is segmented into multiple independent modules, each responsible for specific API functions. This allows the system to selectively load only the modules needed for analyzing a particular file, rather than loading a complete OS simulation, thus maintaining detection quality while improving emulation speed.
Solution Approach 2:
The emulator implements dynamic module loading and updating mechanisms. Modules can be loaded on-demand based on the analysis requirements and updated without restarting the entire emulator. This dynamic approach allows the system to adapt to different analysis scenarios, loading only necessary components to maintain speed while ensuring detection quality when needed.
2Reliability
If the emulator updates implementation code frequently to counter new anti-emulation tricks, then the detection rate improves, but the update complexity increases
Solution Approach 1:
The implementation code is divided into separate, independently updatable modules. Each module can be updated individually without affecting others, reducing update complexity. The modular architecture allows the emulator to incorporate new anti-emulation countermeasures in isolated modules rather than requiring full system updates.
Solution Approach 2:
The emulator implements automatic update mechanisms that can detect and download new module versions without manual intervention. The system automatically manages module dependencies, version compatibility, and activation, reducing the operational complexity of frequent updates while maintaining high detection rates through continuous improvement of anti-emulation capabilities.
3Speed
If the emulator uses stub functions for rare API calls to maintain performance, then the emulation speed improves, but the detection quality deteriorates
Solution Approach 1:
The emulator introduces an intermediary layer that dynamically determines whether to use detailed implementations or stub functions for API calls. Based on the context and importance of the API function, the system selects the appropriate level of simulation fidelity. This intermediary mechanism allows the emulator to maintain high speed through stub functions for routine operations while providing detailed simulation for critical API calls that affect detection quality.
Data Source
AI summary
A method for emulating execution of a file includes emulating execution of the instructions of a file on a virtual processor of an emulator. The execution of the instructions is halted in response to an invocation of an API function. A determination is made whether the invoked API function is present in the updatable modules of the emulator. The updatable modules contain implementation of API functions. In response to determining that the invoked API function is present in the updatable modules, execution of the invoked API function is emulated according to corresponding implementation contained in the updatable modules. Otherwise, result of execution of the invoked API function is generated by executing a corresponding virtual API function on a processor of a computing device.