File Emulation Breakpoint Logging for Script Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing file emulation systems face challenges in logging function calls when dealing with instructions different from machine instructions, such as those in intermediate code or scripts, as they lack information in the Import Address Table (IAT) to record function calls accurately.
Innovation Solution
A system and method for emulating file execution that generates an image of the file, detects known instruction sets, sets breakpoints, and emulates execution using alternative instructions to log function calls effectively, while avoiding anti-emulation instructions that impede the process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the emulator executes instructions different from machine instructions (such as intermediate code or scripts), then the ability to analyze and detect malicious files is improved, but the completeness of function call logging deteriorates because no information is saved in the IAT for these instruction types
Solution Approach 1:
The patent introduces an intermediary translation layer that converts instructions different from machine instructions into equivalent machine instructions before execution. This translator acts as a mediator between the emulator and the target file, enabling the emulator to handle diverse instruction types (intermediate code, scripts) while maintaining complete function call logging through the IAT, thus resolving the information loss problem
2Reliability
If the emulator logs all function calls for instructions different from machine instructions, then the detection rate of malicious files is improved, but the complexity of the emulation system increases due to additional processing requirements
Solution Approach 1:
The patent applies preliminary action by pre-translating instructions different from machine instructions into equivalent machine instructions before the emulation process begins. This preprocessing step stores the translated instructions in a form that can be directly executed and logged by the existing emulator infrastructure, thereby improving detection rate without significantly increasing system complexity during runtime
3Measurement precision
If the emulator executes anti-emulation instructions, then the accuracy of file behavior analysis is improved, but the emulation process is impeded and may fail completely
Solution Approach 1:
The patent applies preliminary anti-action by detecting anti-emulation instructions before they are executed and replacing them with equivalent machine instructions that do not have the anti-emulation property. This preemptive measure neutralizes the harmful effect of anti-emulation instructions while preserving the intended file behavior, thus maintaining both analysis accuracy and emulation continuity
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Disclosed are systems and methods for emulating execution of a file. An image of a file is formed, which is comprised of instructions read from the file. An analysis module detects at least one known set of instructions in a portion read from the file, and inserts a break point into a position in the generated image of the file corresponding to a start of the detected set of instructions. An emulation module emulates execution of the file by emulating execution of instructions from the generated image of the file and adding corresponding records to an emulation log associated with the emulated execution of the at least one known set of instructions.