Script Engine VM Analysis for Exception-Resilient Path Coverage

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for analyzing malicious scripts face challenges in capturing all execution paths due to code obfuscation and interference, leading to incomplete analysis when exceptions occur during multipath execution.

Innovation Solution

An analysis function providing method that analyzes a script engine's virtual machine, identifies hook points, and inserts an exception handler to continue execution by skipping instructions causing exceptions, using a virtual program counter to maintain analysis flow.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If dynamic analysis is used to analyze malicious scripts, then execution behavior can be monitored, but only a single execution path can be captured

Engineering Contradiction:

Improvebehavior analysis accuracyVSAvoidexecution path coverage

Core Design Contradiction:

Measurement precisionVSProductivity

Solution Approach 1:

The patent segments the execution path analysis by introducing virtual program counters for different paths (first virtual program counter and second virtual program counter) to independently track and analyze multiple execution paths that diverge at conditional branches, thereby capturing comprehensive behavior without executing all paths simultaneously

Inventive Principle:

Principle #1Segmentation

2Productivity

If multipath execution is implemented to capture all execution paths, then path coverage is improved, but execution stops when exceptions occur

Engineering Contradiction:

Improveexecution path coverageVSAvoidexecution continuity

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent performs preliminary action by detecting exception instructions in advance during the analysis process and preparing corresponding handling mechanisms, allowing the system to continue analyzing alternative paths without stopping when exceptions occur during multipath execution

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary mechanism (exception handling logic) that mediates between exception occurrences and execution continuation, allowing the analysis to proceed by switching to alternative paths when exceptions are detected in the current path

Inventive Principle:

Principle #24Intermediary (Mediator)

3Device complexity

If code obfuscation is present in malicious scripts, then analysis difficulty increases, but static analysis becomes impossible when code is dynamically acquired

Engineering Contradiction:

Improvecode complexityVSAvoidanalysis feasibility

Core Design Contradiction:

Device complexityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent replaces static code analysis (mechanical inspection) with dynamic execution-based analysis, using virtual program counters and exception handling to trace execution flow and infer behavior without relying on static code inspection, thereby overcoming obfuscation barriers

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS20250224961A1Analysis function imparting method, analysis function imparting device, and analysis function imparting program

Publication Date: 2025.07.10 NT T INC

AI summary

An analysis function providing method executed by an analysis function providing device includes first analyzing a virtual machine of a script engine, and acquiring a hook point that is a part where an analysis code is inserted by applying a hook, and a virtual program counter that is a variable indicating an instruction of the virtual machine to be executed next, second analyzing an instruction set architecture that is a system of instructions of the virtual machine and detecting an offset value of the virtual program counter, and providing an analysis function by applying a hook, to the hook point of the script engine, the hook including processing of setting a value of a next virtual program counter to a value obtained by adding the offset value of the virtual program counter to a value of an immediately preceding virtual program counter when an exception has occurred.