IP Library › Granted Patent US 7,421,587

Granted Patent B2

US 7,421,587 · App. 09/912,389 · Granted Sep 2, 2008

Detecting computer programs within packed computer files

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 7,421,587
App. No.: 09/912,389
Granted: Sep 2, 2008
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

A technique for detecting Trojans and worms within packed computer files uses fingerprint data derived from the unpacked resource data associated with the packed computer files. The number of entries, the position within the resource data and size of the resource that is the largest resource specified, a timestamp value of compilation and a checksum value derived from the whole of the resource data may be included within a fingerprint value as characteristic of a particular set of resource data. A library of such fingerprint values may be generated for known Trojans and worms, or other programs it is wished to detect, and then a suspect file compared against this library of fingerprints.

Claims (175)

1. A computer program product in a computer storage medium comprising a computer program operable to control a computer to detect a known computer program within a packed computer file, said packed computer file being unpacked upon execution, said computer program comprising:

resource data reading logic for reading resource data within said packed computer file, said resource data specifying program resource items used by said known computer program and readable by a computer operating system without dependence upon which unpacking algorithm is used by said packed computer file; and

resource data comparing logic for generating characteristics of said resource data and for comparing said characteristics of said resource data with characteristics of known computer program resource data and for detecting a match with said known computer program indicative of said packed computer file containing said known computer program;

wherein said resource data of said packed computer file is processed to generate fingerprint data and to compare said generated fingerprint data with known computer program fingerprint data;

wherein said generated fingerprint data includes a number of program resource items specified within said resource data of said packed computer file;

wherein said generated fingerprint data includes a flag indicating which data is included within said generated fingerprint data;

wherein said generated fingerprint data includes a location within said resource data of said packed computer file of an entry specifying a program resource item having a largest size;

wherein said generated fingerprint data includes a checksum value calculated in dependence upon:

a number of said program resource items specified beneath each node within hierarchically arranged resource data of said packed computer file;

string names associated with said program resource items within said resource data of said packed computer file; and

sizes of said program resource items within said resource data of said packed computer file;

wherein said checksum value is rotated between each item being added into said checksum.

2. A computer program product as claimed in claim 1 , wherein said known computer program is one of:

a Trojan computer program; and

a worm computer program.

3. A computer program product as claimed in claim 1 , wherein said resource data comparing logic is operable to compare said resource data of said packed computer file with characteristics of a plurality of known computer programs to detect if said packed computer file contains one of said plurality of known computer programs.

4. A computer program product as claimed in claim 1 , wherein said program resource items used by said known computer program include one or more of:

icon data;

string data;

dialog data;

bitmap data;

menu data; and

language data.

5. A computer program product as claimed in claim 1 , wherein said resource data of said packed computer file specifies for each resource item a storage location of said resource item.

6. A computer program product as claimed in claim 5 , wherein said storage location of said resource item is specified as an relative offset value.

7. A computer program product as claimed in claim 1 , wherein said resource data of said packed computer file specifies for each resource item a size of said resource item.

8. A computer program product as claimed in claim 1 , wherein said generated fingerprint data includes timestamp data indicative of a time of compilation of said known computer program.

9. A computer program product as claimed in claim 1 , wherein said packed computer file includes an unpacking computer program which upon execution decompresses said known computer program.

10. A computer program product as claimed in claim 1 , wherein said packed computer file is a Win32 PE file.

11. A computer program product as claimed in claim 1 , wherein said checksum value is rotated 1 bit to the left.

12. A computer program product in a computer storage medium comprising a computer program operable to control a computer to generate data for detecting a known computer program within a packed computer file, said packed computer file being unpacked upon execution, said computer program comprising:

characteristic data generating logic for generating characteristic data associated with said resource data for comparison with characteristic data of known computer program resource data to detect a match with said known computer program indicative of said packed computer file containing said known computer program;

wherein said resource data of said packed computer file is processed to generate fingerprint data and to compare said generated fingerprint data with known computer program fingerprint data;

wherein said generated fingerprint data includes a number of program resource items specified within said resource data of said packed computer file;

wherein said generated fingerprint data includes a flag indicating which data is included within said generated fingerprint data;

wherein said generated fingerprint data includes a location within said resource data of said packed computer file of an entry specifying a program resource item having a largest size;

wherein said generated fingerprint data includes a checksum value calculated in dependence upon:

a number of program resource items specified beneath each node within hierarchically arranged resource data of said packed computer file;

string names associated with program resource items within said resource data of said packed computer file; and

sizes of program resource items within said resource data of said packed computer file;

wherein said checksum value is rotated between each item being added into said checksum.

13. A computer program product as claimed in claim 12 , wherein said known computer program is one of:

a Trojan computer program; and

a worm computer program.

14. A computer program product as claimed in claim 12 , wherein said characteristic data generating logic is operable to generate characteristic data from a plurality of known computer programs to enable detection of any of said plurality of known computer programs within said packed computer file.

15. A computer program product as claimed in claim 12 , wherein said program resource items used by said known computer program include one or more of:

icon data;

string data;

dialog data;

bitmap data;

menu data; and

language data.

16. A computer program product as claimed in claim 12 , wherein said resource data of said packed computer file specifies for each resource item a storage location of said resource item.

17. A computer program product as claimed in claim 16 , wherein said storage location of said resource item is specified as an relative offset value.

18. A computer program product as claimed in claim 12 , wherein said resource data of said packed computer file specifies for each resource item a size of said resource item.

19. A computer program product as claimed in claim 12 , wherein said generated fingerprint data includes timestamp data indicative of a time of compilation of said known computer program.

20. A computer program product as claimed in claim 12 , wherein said packed computer file includes an unpacking computer program which upon execution decompresses said known computer program.

21. A computer program product as claimed in claim 12 , wherein said packed computer file is a Win32 PE file.

22. A method of controlling a computer to detect a known computer program within a packed computer file, said packed computer file being unpacked upon execution, said method comprising the steps of:

reading resource data within said packed computer file, said resource data specifying program resource items used by said known computer program and readable by a computer operating system without dependence upon which unpacking algorithm is used by said packed computer file; and

generating characteristics of said resource data and comparing said characteristics of said resource data with characteristics of known computer program resource data and detecting a match with characteristics of said known computer program indicative of said packed computer file containing said known computer program;