Automated Portable Executable Unpacking via Debugging Breakpoints

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The challenge lies in effectively unpacking and validating portable executable files protected by software packers, as the nature of the executable code is obscured until execution, making it difficult to identify malware or undesirable software in a timely manner.

Innovation Solution

A method is implemented to set a debugging breakpoint at the original entry point of a packed portable executable file, execute a debugging process to collect import address table and relocation table data, and copy the debugged file to a storage medium, thereby unpacking and validating the file.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Quantity of substance

If software packers are used to compress and encrypt executable files, then storage volume and bandwidth usage are decreased, but the nature of the executable code becomes obscured and cannot be identified until execution

Engineering Contradiction:

Improvestorage volumeVSAvoidinformation about executable code nature

Core Design Contradiction:

Quantity of substanceVSLoss of information

Solution Approach 1:

The patent applies preliminary action by performing unpacking and validation operations before the executable code is actually executed. The system intercepts the packed executable file, automatically unpacks it using debugging processes, and validates its contents prior to execution, thereby recovering the hidden information about the code's nature in advance and preventing malware execution.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If software packers are used to protect intellectual property, then code theft is prevented, but the executable code cannot be analyzed for security purposes until execution

Engineering Contradiction:

Improveprotection of intellectual propertyVSAvoiddetectability of executable code nature

Core Design Contradiction:

ReliabilityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent uses an intermediary debugging process as a mediator between the packed executable file and the analysis system. This debugging process acts as an intermediate layer that automatically unpacks the executable code and makes it visible for analysis, allowing security researchers to detect and measure the code's nature without compromising the original protection mechanism.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Loss of information

If packed executable files are executed directly, then the original executable code is revealed, but malware or undesirable software may execute undetected

Engineering Contradiction:

Improvevisibility of executable code natureVSAvoidmalware execution risk

Core Design Contradiction:

Loss of informationVSObject-affected harmful factors

Solution Approach 1:

The patent applies preliminary anti-action by implementing a preemptive validation step before execution. The system automatically unpacks and validates the executable code's integrity and safety characteristics before allowing it to run, thereby counteracting the potential harmful effect of malware execution in advance.

Inventive Principle:

Principle #9Preliminary anti-action

Data Source

PatentUS10261783B2Automated unpacking of portable executable files

Publication Date: 2019.04.16 REVERSING LABS INT GMBH

AI summary

Automated unpacking of a portable executable file includes setting a debugging breakpoint at an original entry point address of a packed portable executable file. A debugging process is executed for the packed portable executable file to obtain a debugged portable executable file in memory. One or more of import address table data and relocation table data are collected during execution of the debugging process for the packed portable executable file. The debugged portable executable file in memory is copied to a storage medium, and the debugging process is terminated.