Dynamic binary translation and instrumentation with postponed attachment to running native threads

1. A method comprising:

determining an entry point in a binary executable, the binary executable previously executed in a native mode;

causing the binary executable to be loaded into memory, wherein the binary executable is suspended upon said loading into memory;

setting a start point hook at a start point of the binary executable;

setting a point-of-interest hook at the determined entry point;

resuming execution of the binary executable in the native mode, after setting the point-of-interest hook, until the execution reaches the start point hook; and

in response to the point-of-interest hook being executed;

initiating binary translation of the binary executable after execution of the point-of-interest hook by switching a mode of execution for the binary executable from the native mode to a dynamic binary translation mode corresponding to the binary translation; and

while in the dynamic binary translation mode, performing the binary translation of the binary executable by analyzing blocks of code associated with the binary executable and detecting malware patterns for the analyzed blocks of code.

2. The method of claim 1 , further comprising suspending the binary executable upon loading of said binary executable into memory so that execution of said binary executable does not begin.

3. The method of claim 1 , wherein said binary executable is at least part of a process comprising a guest and a host, and further wherein, in response to said start point hook being executed, said method comprises transferring a flow of control of said binary executable from said guest to said host.

4. The method of claim 3 , further comprising, in response to the start point hook being reached and executed, setting a context for the binary executable of the process, wherein said setting context further comprises establishing, in said host, a context data structure for storing context information indicative of a state of a thread of said process being executed at a time that a control of said process including said thread is transferred from said guest to said binary translation in said host.

5. The method of claim 4 , further comprising adding said context data structure indicative of said set context to a list of threads executed in said guest that have context associated with them.

6. The method of claim 5 , further comprising using the presence of said context structure in said list as an indication that said binary executable should be executed by said binary translation.

7. The method of claim 5 , wherein said host comprises a point-of-interest callback, wherein, in response to the second hook being executed, said point-of-interest callback of said host is executed, and wherein said point-of-interest callback hafts execution of the binary executable in guest.

8. The method of claim 7 , wherein said point-of-interest callback further obtains information indicative of a state associated with said binary executable, and wherein said state comprises at least one of a CPU state, a register state, and a stack state.

9. The method of claim 3 , said method comprising, before said step of starting execution of said binary executable in said guest, first loading said binary executable in a memory and then delaying said step of starting execution of said binary executable in said guest until a time after said first hook and said point-of-interest hook have been set.

10. The method of claim 1 , wherein said method comprises, in response to said point-of-interest hook being executed, initiating binary instrumentation of the binary executable that is executed after the hook, and using said binary instrumentation to detect a malware pattern of said binary executable.

11. The method of claim 1 wherein said binary executable comprises a plurality of code sections, wherein said method further comprises performing said binary translation on a code section that is executed after the point-of-interest hook, wherein a code section of said plurality of code sections comprises instructions that do not enable a change in a flow of control of a thread of said binary executable, and wherein said method further comprises bypassing binary translation for said code section comprising instructions that do not enable a change in a flow of control of a thread.

12. The method of claim 1 , wherein initiating binary translation of the binary executable that is executed after the point-of-interest hook comprises initiating at least one of binary translation of the binary executable that is executed after the entry point is reached.

13. The method of claim 1 , wherein said point-of-interest hook comprises a first point-of-interest hook, said method further comprising setting a plurality of additional point-of-interest in said binary executable, and wherein each said additional point-of-interest comprises a hook that enables changing an on/off state of a module for controlling at least one of said binary translation.

14. The method of claim 1 , wherein said binary executable comprises a plurality of threads, wherein each said thread of said plurality of threads has correspondingly available context information, and wherein said method further comprises, upon reaching a point-of-interest in one of said threads in said plurality of threads when executing said binary executable, placing said one of said threads in a frozen state and performing said binary translation on said one of said threads.

15. The method of claim 1 , wherein said binary executable further comprises a plurality of code sections, wherein said plurality of code sections comprises a subset of code sections, wherein each code section in said subset of code sections is categorized as a safe code sequence, and wherein said method further comprises bypassing said binary translation for said categorized safe code sequences in said subset of code sections.

16. The method of claim 1 , wherein said binary executable further comprises a plurality of code sections, wherein said plurality of code sections comprises a subset of code sections, wherein each code section in said subset of code sections is categorized as a safe code sequence, and wherein said method further comprises running said safe code sequences in a native mode without implementing binary translation.

17. A system comprising:

one or more processors executing instructions for performing the steps of:

determining an entry point in a binary executable, the binary executable previously executed in a native mode;

causing the binary executable to be loaded into memory, wherein the binary executable is suspended upon said loading into memory;

setting a start point hook at a start point of the binary executable;

setting a point-of-interest hook at the determined entry point;

resuming execution of the binary executable in the native mode, after setting the point-of-interest hook, until the execution reaches the start point hook; and

in response to the point-of-interest hook being executed:

initiating binary translation of the binary executable after execution of the point-of-interest hook by switching a mode of execution for the binary executable from the native mode to a dynamic binary translation mode corresponding to the binary translation; and

while in the dynamic binary translation mode, performing the binary translation of the binary executable by analyzing blocks of code associated with the binary executable and detecting malware patterns for the analyzed blocks of code.

18. A non-transitory machine-readable medium storing instructions that when executed on a processor performing the steps of:

determining an entry point in a binary executable, the binary executable previously executed in a native mode;

causing the binary executable to be loaded into memory, wherein the binary executable is suspended upon said loading into memory;

setting a start point hook at a start point of the binary executable;

setting a point-of-interest hook at the determined entry point;

resuming execution of the binary executable in the native mode, after setting the point-of-interest hook, until the execution reaches the start point hook; and

in response to the point-of-interest hook being executed:

initiating binary translation of the binary executable after execution of the point-of-interest hook by switching a mode of execution for the binary executable from the native mode to a dynamic binary translation mode corresponding to the binary translation; and

while in the dynamic binary translation mode, performing the binary translation of the binary executable by analyzing blocks of code associated with the binary executable and detecting malware patterns for the analyzed blocks of code.