Normalizing entry point instructions in executable program files
Systems and methods for normalizing entry point instructions include receiving a scope of instructions starting at an entry point of executable code. For each instruction in the scope of instructions, a determination is made if the instruction performs an ineffective operation or if the instruction, in combination with another instruction, renders either or both instructions ineffective. Ineffective instructions are filtered such that they do not appear in an output buffer.
1. A method for normalizing entry point instructions, the method comprising:
receiving a plurality of instructions including an entry point of executable code;
for each instruction in the plurality of instructions:
parsing the instruction,
determining whether the instruction performs an effective operation, and
in response to determining that the instruction does not perform an effective operation, marking the instruction as ineffective; and
filtering one or more instructions of the plurality of instructions marked as ineffective such that the one or more instructions are not copied to an output buffer.
2. The method of claim 1 , further comprising:
determining whether the instruction discards an operation of a previous instruction; and
in response to determining that the instruction discards the operation of the previous instruction, marking the previous instruction as ineffective.
3. The method of claim 1 , further comprising:
determining whether the instruction reverts an operation of a previous instruction; and
in response to determining that the instruction reverts the operation of the previous instruction, marking the instruction and the previous instruction as ineffective.
4. The method of claim 1 , further comprising:
determining whether the instruction comprises a jump instruction having a target address within the plurality of instructions; and
in response to determining that the instruction comprises the jump instruction having the target address within the plurality of instructions, filtering the jump instruction and instructions between the jump instruction and the target address such that the jump instruction and instructions between the jump instruction and the target address are not copied to the output buffer.
5. The method of claim 1 , further comprising:
determining whether the instruction has a type associated with an ignored instruction; and
in response to determining that the instruction has the type associated with an ignored instruction, filtering the instruction such that the instruction is not copied to the output buffer.
6. The method of claim 1 , further comprising:
determining whether the instruction contains an immediate or displacement; and
in response to determining that the instruction contains the immediate or displacement, replacing the immediate or displacement with a blind marker in the output buffer.
7. The method of claim 1 , further comprising:
comparing the output buffer with a second output buffer associated with an executable containing known malware; and
indicating that the executable code contains the known malware in response to determining that the output buffer and the second output buffer are sufficiently similar.
8. A non-transitory machine-readable storage medium having stored thereon computer-executable instructions for normalizing entry point instructions, the computer-executable instructions to cause one or more processors to perform operations comprising:
receive a plurality of source instructions including an entry point of executable code;
for each source instruction in the plurality of source instructions:
parse the source instruction,
determine whether the source instruction performs an effective operation, and
in response to a determination that the source instruction does not perform an effective operation, mark the source instruction as ineffective; and
filter one or more source instructions of the plurality of source instructions marked as ineffective such that the one or more source instructions are not copied to an output buffer.
9. The non-transitory machine-readable storage medium of claim 8 , wherein the operations further comprise:
determine whether the source instruction discards an operation of a previous source instruction; and
in response to a determination that the source instruction discards the operation of the previous source instruction, mark the previous source instruction as ineffective.
10. The non-transitory machine-readable storage medium of claim 8 , wherein the operations further comprise:
determine whether the source instruction reverts an operation of a previous source instruction; and
in response to a determination that the source instruction reverts the operation of the previous source instruction, mark the source instruction and the previous source instruction as ineffective.
11. The non-transitory machine-readable storage medium of claim 8 , wherein the operations further comprise:
determine whether the source instruction comprises a jump instruction having a target address within the plurality of source instructions; and
in response to a determination that the source instruction comprises the jump instruction having the target address within the plurality of source instructions, filter the jump instruction and source instructions between the jump instruction and the target address such that the jump instruction and source instructions between the jump instruction and the target address are not copied to the output buffer.
12. The non-transitory machine-readable storage medium of claim 8 , wherein the operations further comprise:
determine whether the source instruction has a type associated with an ignored instruction; and
in response to a determination that the source instruction has the type associated with an ignored instruction, filter the source instruction such that the source instruction is not copied to the output buffer.
13. The non-transitory machine-readable storage medium of claim 8 , wherein the operations further comprise:
determine whether the source instruction contains an immediate or displacement; and
in response to a determination that the source instruction contains the immediate or displacement, replace the immediate or displacement with a blind marker in the output buffer.
14. The non-transitory machine-readable storage medium of claim 8 , wherein the operations further comprise:
compare the output buffer with a second output buffer associated with an executable containing known malware; and
indicate that the executable code contains the known malware in response to a determination that the output buffer and the second output buffer are sufficiently similar.
15. An apparatus for normalizing entry point instructions, the apparatus comprising:
one or more processors; and
a non-transitory machine-readable medium having stored thereon computer-executable instructions to cause the one or more processors to:
receive a plurality of source instructions including an entry point of executable code;
for each source instruction in the plurality of source instructions:
parse the source instruction,
determine whether the source instruction performs an effective operation, and
in response to a determination that the source instruction does not perform an effective operation, mark the source instruction as ineffective; and
filter one or more source instructions of the plurality of source instructions marked as ineffective such that the one or more source instructions are not copied to an output buffer.
16. The apparatus of claim 15 , wherein the computer-executable instructions further comprise instructions to cause the one or more processors to:
determine whether the source instruction discards an operation of a previous source instruction; and
in response to a determination that the source instruction discards the operation of the previous source instruction, mark the previous source instruction as ineffective.
17. The apparatus of claim 15 , wherein the computer-executable instructions further comprise instructions to cause the one or more processors to:
determine whether the source instruction reverts an operation of a previous source instruction; and
in response to a determination that the source instruction reverts the operation of the previous source instruction, mark the source instruction and the previous source instruction as ineffective.
18. The apparatus of claim 15 , wherein the computer-executable instructions further comprise instructions to cause the one or more processors to:
determine whether the source instruction comprises a jump instruction having a target address within the plurality of source instructions; and
in response to a determination that the source instruction comprises the jump instruction having the target address within the plurality of source instructions, filter the jump instruction and source instructions between the jump instruction and the target address such that the jump instruction and source instructions between the jump instruction and the target address are not copied to the output buffer.
19. The apparatus of claim 15 , wherein the computer-executable instructions further comprise instructions to cause the one or more processors to:
determine whether the source instruction has a type associated with an ignored instruction; and
in response to a determination that the source instruction has the type associated with an ignored instruction, filter the source instruction such that the source instruction is not copied to the output buffer.
20. The apparatus of claim 15 , wherein the computer-executable instructions further comprise instructions to cause the one or more processors to:
determine whether the source instruction contains an immediate or displacement; and
in response to a determination that the source instruction contains the immediate or displacement, replace the immediate or displacement with a blind marker in the output buffer.
21. The apparatus of claim 15 , wherein the computer-executable instructions further comprise instructions to cause the one or more processors to:
compare the output buffer with a second output buffer associated with an executable containing known malware; and
indicate that the executable code contains the known malware in response to a determination that the output buffer and the second output buffer are sufficiently similar.