Portable executable file analysis

1. A computer implemented method comprising:

prior to execution of a binary image of a portable executable file format:

parsing, by a computing device, the binary image of the portable executable file format running on a Windows operating system to generate a parsed field;

determining, by the computing device, an attribute of the parsed field;

comparing, by the computing device, the attribute of the parsed field to a valid characteristic of a valid corresponding field specified by a portable executable file format specification;

determining, by the computing device, if the attribute of the parsed field matches the valid characteristic of the valid corresponding field specified by the portable executable file format specification, wherein determining if the attribute of the parsed field matches the valid characteristic of the valid corresponding field specified by the portable executable file format specification further includes determining, by the computing device, if the attribute of the parsed field is valid for a predetermined operating system;

identifying, by the computing device, if the parsed field does not match the valid characteristic of the valid corresponding field; and

determining, by the computing device, a likelihood of modifying the parsed field that does not match the valid characteristic of the valid corresponding field to generate a valid field based upon, at least in part, one or more empirically determined rules, wherein the empirically determined rules are based upon, at least in part, possible errors that occur in the parsed field and a number of modifications to implement to correct each possible error.

2. The computer implemented method of claim 1 , wherein the parsed field includes one or more of a portable executable format signature, an ImageBase field, a SizeOfImage field, a FileAlignment field, a SectionAlignment field, an EntryPoint address, an import table, an import address table, an export table, a relocation table, a resource table, a thread local storage table, a load configuration table, a bound import table, a COM table, and a portable executable section table.

3. The computer implemented method of claim 1 , wherein the attribute of the parsed field includes one or more of a field identifier, a field length, and a field content.

4. The computer implemented method of claim 1 , further comprising determining, by the computing device, if the binary image of the portable executable file format includes a dynamic link library, a kernel driver, or an executable object.

5. A computer program product comprising a non-transitory computer readable medium having a plurality of instructions stored thereon, which, when executed by a processor, cause the processor to perform operations comprising:

prior to execution of a binary image of a portable executable file format:

parsing the binary image of the portable executable file format running on a Windows operating system to generate a parsed field;

determining an attribute of the parsed field;

comparing the attribute of the parsed field to a valid characteristic of a valid corresponding field specified by a portable executable file format specification;

determining if the attribute of the parsed field matches the valid characteristic of the valid corresponding field specified by the portable executable file format specification, wherein determining if the attribute of the parsed field matches the valid characteristic of the valid corresponding field specified by the portable executable file format specification further includes determining if the attribute of the parsed field is valid for a predetermined operating system;

identifying if the parsed field does not match the valid characteristic of the valid corresponding field; and

determining a likelihood of modifying the parsed field that does not match the valid characteristic of the valid corresponding field to generate a valid field based upon, at least in part, one or more empirically determined rules, wherein the empirically determined rules are based upon, at least in part, possible errors that occur in the parsed field and a number of modifications to implement to correct each possible error.

6. The computer program product of claim 5 , wherein the parsed field includes one or more of a portable executable format signature, an ImageBase field, a SizeOfImage field, a FileAlignment field, a SectionAlignment field, an EntryPoint address, an import table, an import address table, an export table, a relocation table, a resource table, a thread local storage table, a load configuration table, a bound import table, a COM table, and a portable executable section table.

7. The computer program product of claim 5 , wherein the attribute of the parsed field includes one or more of a field identifier, a field length, and a field content.

8. The computer program product of claim 5 , further comprising determining if the binary image of the portable executable file format includes a dynamic link library, a kernel driver, or an executable object.

9. A system comprising:

a processor;

a memory coupled with the processor;

prior to execution of a binary image of a portable executable file format:

a first software module executable by the processor and the memory, the first software module configured to parse the binary image of the portable executable file format running on a Windows operating system to generate a parsed field;

a second software module executable the by processor and the memory, the second software module configured to determine an attribute of the parsed field;

a third software module executable by the processor and the memory, the third software module configured to compare the attribute of the parsed field to a valid characteristic of a valid corresponding field specified by a portable executable file format specification;

a fourth software module executable by the processor and the memory, the fourth software module configured to determine if the attribute of the parsed field matches the valid characteristic of the valid corresponding field specified by the portable executable file format specification, wherein determining if the attribute of the parsed field matches the valid characteristic of the valid corresponding field specified by the portable executable file format specification further includes determining if the attribute of the parsed field is valid for a predetermined operating system;

a fifth software module executable by the processor and the memory, the fifth software module configured to identify if the parsed field does not match the valid characteristic of the valid corresponding field; and

a sixth software module executable by the processor and the memory, the sixth software module configured to determine a likelihood of modifying the parsed field that does not match the valid characteristic of the valid corresponding field to generate a valid field based upon, at least in part, one or more empirically determined rules, wherein the empirically determined rules are based upon, at least in part, possible errors that occur in the parsed field and a number of modifications to implement to correct each possible error.

10. The system of claim 9 , wherein the parsed field includes one or more of a portable executable format signature, an ImageBase field, a SizeOfImage field, a FileAlignment field, a SectionAlignment field, an EntryPoint address, an import table, an import address table, an export table, a relocation table, a resource table, a thread local storage table, a load configuration table, a bound import table, a COM table, and a portable executable section table.

11. The system of claim 9 , wherein the attribute of the parsed field includes one or more of a field identifier, a field length, and a field content.

12. The system of claim 9 , further comprising a seventh software module executable by the processor and the memory, the seventh software module configured to determine if the binary image of the portable executable file format includes a dynamic link library, a kernel driver, or an executable object.