Identifying software execution behavior
The present invention extends to methods, systems, and computer program products for identifying software execution behavior. Embodiments of the invention can be used to assist a user in a making a reasoned and informed decision about whether the behavior of executable code is malicious. Data indicative of executable code behavior can be collected statically without having to execute the executable code. Behavior data can be collected essentially automatically with little, if any, user involvement. A user initiates analysis of executable code and is provided a visual categorized representation of behavior data for the executable code.
1. In a computer system, the computer system including a microprocessor and system memory, a method for identifying execution behavior for a portion of binary code, the method comprising:
an act of accessing a portion of assembly code via the microprocessor, the portion of assembly code disassembled from the portion of binary code, the portion of assembly code including assembly language instructions from an assembly language instruction set;
an act of converting the portion of assembly code into an intermediate representation, the intermediate representation including intermediate representation instructions from an intermediate representation instruction set, converting the portion of assembly code including:
an act of analyzing the portion of the assembly code to identify a location where the portion of the assembly code calls an operating system function;
an act of demarking each transition between user functions and operating system functions based on the identified locations; and
an act of mapping each assembly language instruction to a corresponding ordered list of one or more intermediate representation instructions so as to reduce the complexity of analyzing the behavior of the portion of binary code, wherein the act of mapping assembly language instructions to corresponding intermediate representation instructions comprises:
an act of mapping the assembly language instructions of the user functions to intermediate representation instructions; and
an act of ignoring the operating system function;
an act of tracking the path of one or more parameters within functions of the intermediate representation to identify one or more of:
parameter values and parameter types used to call functions of interest within the portion of binary code; and
an act of outputting one or more of: functions, parameter values, and parameter types of interest for the portion of binary code.
2. The method as recited in claim 1 , further comprising prior to accessing the portion of assembly code:
an act of accessing the portion of binary code;
an act of disassembling the portion of binary code into the portion of assembly code; and
an act of outputting the portion of assembly code.
3. The method as recited in claim 1 , wherein the act of converting the portion of assembly code into the intermediate representation comprises an act of keeping track of a stack pointer used in the portion of assembly code.
4. The method as recited in claim 3 , wherein the act of keeping track of the stack pointer used in the portion of assembly code comprises, for each location where an operating system function is called by a calling convention:
an act of accessing a stack delta for the operating system function;
an act of accessing the calling convention for the operating system function; and
an act of determining how to adjust the stack pointer based on the stack delta and the calling convention for the operating system function.
5. The method as recited in claim 1 , wherein the act of tracking the path of one or more parameters within functions of the intermediate representation comprises an act of identifying parameter values used to call the operating system functions.
6. The method as recited in claim 1 , wherein the act of mapping each assembly language instruction to a corresponding ordered list of one or more intermediate representation instructions comprises: an act of reducing redundant instructions within the portion of assembly code.
7. The method as recited in claim 1 , wherein the act of tracking the path of one or more parameters within the functions of the intermediate representation comprises an act of identifying parameter values used to call functions that facilitate one or more of: network access, opening a file, modifying a registry, and activating computer system peripheral devices.
8. The method as recited in claim 1 , wherein the act of tracking the path of one or more parameters within functions of the intermediate representation comprises an act of tracking values that are configured to get moved between system registers and system memory.
9. The method as recited in claim 1 , wherein the act of outputting one or more of: functions, parameter values, and parameter types of interest for the portion of binary code, comprises: an act of categorizing functions, parameter values, and parameter types to simplify complexity and assist in identifying potentially malicious behavior exhibited by the portion of binary code.
10. The method as recited in claim 1 , wherein the act of outputting one or more of: functions, parameter values, and parameter types of interest for the portion of binary code, comprises: an act of categorizing functions of interest based on operations the functions are configured to perform.
11. The method as recited in claim 10 , wherein the act of categorizing functions of interest based on the operations the functions are configured to perform, comprises: an act of categorizing functions to indicate whether the functions are configured to perform operations selected from: network access, opening a file, modifying a registry, and activating computer system peripheral devices.
12. The method as recited in claim 1 , further comprising an act of sending the output of one or more of: functions, parameter values, and parameter types of interest to a display device for presentation to a user, with the presentation to the user assisting the user in determining if the portion of binary code includes malicious behaviors.
13. A computer program product for use in a computer system, the computer system including a display device, the computer program product implementing a method for identifying execution behavior for a portion of binary code, the computer program product comprising one or more computer storage devices having stored thereon computer-executable instructions that, when executed by a microprocessor, cause the computer system to perform the method, the method including the following:
accessing a portion of assembly code, the portion of assembly code disassembled from the portion of binary code, the portion of assembly code including assembly language instructions from an assembly language instruction set;
converting the portion of assembly code into an intermediate representation, the intermediate representation including intermediate representation instructions from an intermediate representation instruction set, said converting the portion of assembly code including:
analyzing the portion of assembly code to identify each location where the portion of assembly code calls an operating system function;
demarking each transition between user functions and operating system functions based on the identified locations; and
mapping each assembly language instruction to a corresponding ordered list of one or more intermediate representation instructions so as to reduce the complexity of analyzing the behavior of the portion of binary code, wherein mapping each assembly language instruction comprises:
mapping assembly language instructions of the user functions to intermediate representation instructions; and
ignoring the operating system functions;
tracking the path of one or more parameters within functions of the intermediate representation to identify one or more of: parameter values and parameter types used to call functions of interest within the portion of binary code;
outputting one or more of: functions, parameter values, and parameter types of interest for the portion of binary code; and
presenting the one or more of: functions, parameter values, and parameter types of interest at the display device, said presentation via the display device assisting a user in determining if the portion of binary code includes malicious behaviors.
14. The computer program product as recited in claim 13 , wherein converting the portion of assembly code into the intermediate representation comprises keeping track of a stack pointer used in the portion of assembly code.
15. The computer program product as recited in claim 13 , wherein mapping each assembly language instruction to the corresponding ordered list of one or more intermediate representation instruction, comprises: reducing redundant instructions within the portion of assembly code.
16. The computer program product as recited in claim 13 , wherein outputting the one or more of: functions, parameter values, and parameter types of interest for the portion of binary code comprises categorizing functions, parameter values, and parameter types to simplify complexity and assist in identifying potentially malicious behavior exhibited by the portion of binary code.
17. The computer program product as recited in claim 13 , wherein outputting the one or more of: functions, parameter values, and parameter types of interest for the portion of binary code comprises categorizing functions of interest based on the operations the functions are configured to perform.
18. In a computer system, the computer system including a microprocessor, system memory, and a display device, a method for identifying execution behavior for a portion of binary code, the method comprising:
an act of accessing a portion of assembly code via the microprocessor, the portion of assembly code disassembled from the portion of binary code, the portion of assembly code including assembly language instructions from an assembly language instruction set;
an act of converting the portion of assembly code into an intermediate representation, the intermediate representation including intermediate representation instructions from an intermediate representation instruction set, converting the portion of assembly code including:
an act of analyzing the portion of assembly code to identify each location where the portion of assembly code calls an operating system function;
an act of demarking each transition between user functions and operating system functions based on the identified locations; and
an act of mapping each assembly language instruction to a corresponding ordered list of one or more intermediate representation instructions so as to reduce the complexity of analyzing the behavior of the portion of binary code, including for at least one assembly language instruction decomposing the assembly language instruction in to a plurality of micro operations to simplify analysis of the portion of binary code, wherein the act of mapping the assembly language instructions to corresponding intermediate representation instructions comprises:
an act of mapping assembly language instructions of the user functions to intermediate representation instructions; and
an act of ignoring the operating system functions;
an act of tracking the path of one or more parameters within functions of the intermediate representation to identify one or more of:
parameter values and parameter types used to call functions of interest within the portion of binary code;
an act of categorizing functions, parameter values, and parameter types to simplify the complexity of identifying potentially malicious behavior exhibited by the portion of binary code; and
an act of presenting the categorized functions, parameter values, and parameter types of interest at the display device, presentation at the display device assisting a user in determining if the portion of binary code includes malicious behaviors.