Emulating mixed-code programs using a virtual machine instance
View Patent ↗The subject disclosure is directed towards a technology for efficiently emulating program code that is protected by one or more various code virtualization techniques to detect the presence of malware. An emulation engine emulates a program containing a mix of native code, custom (e.g., virtualized obfuscated) code, and at least one emulator and/or interpreter that understands the custom code, by building a custom emulation component that is built by detecting and analyzing the internal emulator or interpreter. The custom emulation component may access a translation table built from the analysis, and also may simplify a plurality of instructions in the program into a lesser number of instructions in an intermediate language used for emulation.
1. In a computing environment, a system configured to emulate a program comprising:
an emulator component;
a custom emulation component processing a custom instruction block from program code of the program into an intermediate language for emulation by the emulator component;
a native component processing a native instruction block from the program code of the program and outputting instructions corresponding to the native instruction block to the emulator component; and
mixed code processing logic dynamically switching between the custom emulation component and the native component as the system processes the program code responsive to detection of at least one jump instruction in the program code.
2. The system of claim 1 wherein the emulator component comprises a virtual machine instance, and wherein the emulation component comprises a plurality of front-ends, including one front end configured to decode or translate, or both decode and translate from executable code, and at least one other front-end each configured to translate a supported computer language into a platform-independent intermediate language (IL).
3. The system of claim 1 wherein the custom emulation component translates from at least one of an alternate language or bytecode into the intermediate language that is common with an intermediate language produced by the native component.
4. The system of claim 1 further comprising:
a scanner module configured to detect an emulator or interpreter in the program; and
a code parser and analyzer configured to analyze the detected emulator or interpreter to dynamically build the custom emulation component.
5. The system of claim 4 wherein the scanner module detects the emulator or interpreter in the program via one or more signatures.
6. The system of claim 4 wherein the code parser and analyzer are configured to determine a custom binary format for each instruction that is used in the custom instruction block.
7. The system of claim 4 wherein the code parser and analyzer are configured to determine a decryption algorithm and one or more decryption keys used in conjunction with the decryption algorithm.
8. The system of claim 4 wherein the code parser and analyzer are configured to determine a de-obfuscation algorithm and one or associated parameters used to obfuscate at least one instruction in the program.
9. The system of claim 1 wherein the custom emulation component simplifies a plurality of instructions in the program code by generating a lesser number of intermediate language instructions relative to translating original instructions one-by-one in a repetitive process.
10. In a computing environment, a method performed at least in part on at least one processor, comprising:
receiving a program, including program code that comprises native code and custom code;
processing, by a custom emulation component, at least one custom instruction block of the custom code into an intermediate language;
processing, by a native code emulator component, at least one native instruction block of the native code into the intermediate language;
dynamically switching between processing by the custom emulation component and the native component responsive to detection of at least one jump instruction in the program code; and
outputting the custom instruction block in the intermediate language and the native instruction block in the intermediate language to an emulator component for emulation of the program.
11. The method of claim 10 further comprising:
emulating the program code of the program by dynamically switching between the native code emulator component when a program code instruction is part of the native code and the custom emulation component when a program code instruction is part of the custom code.
12. The method of claim 11 further comprising:
determining a custom binary format for each program code instruction that is used in the custom code.
13. The method of claim 11 further comprising:
determining a decryption algorithm and one or more decryption keys used in conjunction with the decryption algorithm to encrypt the custom code; and
using at least one of the decryption keys and the decryption algorithm for decrypting the custom code.
14. The method of claim 11 further comprising:
determining a de-obfuscation algorithm and one or associated parameters used to obfuscate the custom code; and
using the de-obfuscation algorithm to de-obfuscate the custom code.
15. The method of claim 10 further comprising:
determining at least one range of addresses in the program code of the program containing target language instructions.
16. One or more hardware computer-readable storage devices having computer-executable instructions, which when executed by a computer processor perform operations of a process, comprising:
processing program code containing native code and custom code;
translating, by a custom emulator component, at least one custom instruction block of the custom code into an intermediate language;
translating, by a native component, at least one native instruction block of the native code into the intermediate language;
dynamically switching between processing by the custom emulation component and the native component responsive to detection of at least one jump instruction in the program code; and
emulating the program code using the translated at least one custom instruction block and the translated at least one native instruction block.
17. The one or more hardware computer-readable storage devices of claim 16 wherein the custom emulator component translates the custom instruction block into the intermediate language by translating the custom code to a known bytecode language.
18. The one or more hardware computer-readable storage devices of claim 16 further executed to perform operations of a process, comprising:
scanning the program code to detect an emulator or interpreter for the custom code in the program code; and
analyzing the detected emulator or interpreter to dynamically build the custom emulator component.
19. The one or more hardware computer-readable storage devices of claim 16 further executed to perform operations of a process, comprising:
generating a lesser number of intermediate language instructions relative to a number of instructions received in the program code prior to translation to simplify a plurality of instructions in the program code.
20. The one or more hardware computer-readable storage devices of claim 16 further executed to perform operations of a process, comprising:
detecting at least one execution control transfer in the emulated program code.