Microsoft Technology Licensing, LLC

Harish Mohanan

Perraju Bendapudi

Rajesh Jalan

Ramarathnam R Venkatesan

SriSatya Aravind Akella

Suryanarayana Harsha

Abishek Kumarasubramanian

Which target functions in a target binary have target function basic blocks that match the source function basic blocks in a source function in a source binary is determined. For the target functions having matching target function basic blocks, a target function control flow graph is determined that has the greatest control flow matching strength to a source function control flow graph, wherein a node in the source function control graph represents a source function basic block, wherein a node in a target function control graph represents a target function basic block in a corresponding target function.

Function matching in binaries

Spyware programs are detected even if their binary code is modified by normalizing the available code and comparing to known spyware patterns. Upon normalizing the known spyware code patterns, a signature of the normalized code is generated. Similar normalization techniques are employed to reduce the executable binary code as well. A match between the normalized spyware signature and the patterns in the normalized executable code is analyzed to determine whether the executable code includes a known spyware. For pattern matching, Deterministic Finite Automata (DFA) is constructed for basic blocks and simulated on the basic blocks of target executable, hash codes are generated for instructions in target code and known spyware code and compared, register usages are replaced with common variables and compared, and finally Direct Acyclic Graphs (DAGs) of all blocks are constructed and compared to catch reordering of mutually independent instructions and renamed variables.

Pattern matching for spyware detection

Technologies, systems and methods for code path analysis of an executable including: generating call graphs and control flow graphs of selected functions in the executable, and instrumenting the selected functions to provide for logging of path trace information for the selected functions upon execution of the instrumented executable, the path trace information usable for efficient system crash analysis and debugging. A stack trace from a crash dump may be utilized in the selection of the functions to analyze.

Growing community of inventors

Hyderabad Telangana, India

Harish Mohanan