File Emulation Breakpoint Logging for Script Analysis

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing file emulation systems face challenges in logging function calls when dealing with instructions different from machine instructions, such as those in intermediate code or scripts, as they lack information in the Import Address Table (IAT) to record function calls accurately.

Innovation Solution

A system and method for emulating file execution that generates an image of the file, detects known instruction sets, sets breakpoints, and emulates execution using alternative instructions to log function calls effectively, while avoiding anti-emulation instructions that impede the process.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If the emulator executes instructions different from machine instructions (such as intermediate code or scripts), then the ability to analyze and detect malicious files is improved, but the completeness of function call logging deteriorates because no information is saved in the IAT for these instruction types

Engineering Contradiction:
Improveability to analyze different instruction typesVSAvoidfunction call logging completeness
Core Design Contradiction:
Adaptability or versatilityVSLoss of information

Solution Approach 1:

The patent introduces an intermediary translation layer that converts instructions different from machine instructions into equivalent machine instructions before execution. This translator acts as a mediator between the emulator and the target file, enabling the emulator to handle diverse instruction types (intermediate code, scripts) while maintaining complete function call logging through the IAT, thus resolving the information loss problem

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If the emulator logs all function calls for instructions different from machine instructions, then the detection rate of malicious files is improved, but the complexity of the emulation system increases due to additional processing requirements

Engineering Contradiction:
Improvedetection rateVSAvoidemulation system complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies preliminary action by pre-translating instructions different from machine instructions into equivalent machine instructions before the emulation process begins. This preprocessing step stores the translated instructions in a form that can be directly executed and logged by the existing emulator infrastructure, thereby improving detection rate without significantly increasing system complexity during runtime

Inventive Principle:
Principle #10Preliminary action

3Measurement precision

If the emulator executes anti-emulation instructions, then the accuracy of file behavior analysis is improved, but the emulation process is impeded and may fail completely

Engineering Contradiction:
Improvefile behavior analysis accuracyVSAvoidemulation process continuity
Core Design Contradiction:
Measurement precisionVSReliability

Solution Approach 1:

The patent applies preliminary anti-action by detecting anti-emulation instructions before they are executed and replacing them with equivalent machine instructions that do not have the anti-emulation property. This preemptive measure neutralizes the harmful effect of anti-emulation instructions while preserving the intended file behavior, thus maintaining both analysis accuracy and emulation continuity

Inventive Principle:
Principle #9Preliminary anti-action

Data Source

PatentEP3444737B1System and method of emulating execution of files
Publication Date: 2022.11.16 AO KASPERSKY LAB
  • EP3444737B1 patent drawingFigure 1
  • EP3444737B1 patent drawingFigure 2A
  • EP3444737B1 patent drawingFigure 2B

AI summary

Disclosed are systems and methods for emulating execution of a file. An image of a file is formed, which is comprised of instructions read from the file. An analysis module detects at least one known set of instructions in a portion read from the file, and inserts a break point into a position in the generated image of the file corresponding to a start of the detected set of instructions. An emulation module emulates execution of the file by emulating execution of instructions from the generated image of the file and adding corresponding records to an emulation log associated with the emulated execution of the at least one known set of instructions.