Methods and systems of disassembling executable code

1. A method useful for disassembling an executable binary comprising the steps of:

runtime monitoring of an application executing on a computer system;

capturing an application programming interface (API)/system call performed by the application;

capturing a control transfer in the application, wherein control transfer is implemented by inserting software hooks into the memory pages of the application process;

generating a list of collected events, wherein the list of collected events comprises at least one of the API/system call or the control transfer;

transferring the list of collected events to a disassembler;

with the disassembler:

wherein the dissembler comprises a program that translates machine language into assembly language,

generating a set of disassembly traces for an application executable binary by starting a disassembly operation at one or more potential start locations;

validating the set of disassembly traces by checking a consistency with a set of observed events that are in a memory region covered by the set of disassembly traces, wherein the set of observed events are checked against a list of known events produced by the application; and

combining a set of validated disassembly traces to complete the disassembly operation on the application executable binary.

2. The method of claim 1 , wherein an event information includes a processor register value, an application attribute, an application symbol table, an application's stack, and a processor's last branch records.

3. The method of claim 1 , wherein collected events are reported to a remote server for use in disassembly of the application executable binary.

4. The method of claim 1 further comprising the step of monitoring and reporting of a control flow in the application for generating disassembly of the application executable binary by:

scanning the computer system for a running process associated with the application executable binary;

instrumenting an application code of the executable application to monitor a control flow;

inserting event-logging code into the executable application to monitor the control flow;

inserting a software interrupt into the executable application to monitor the control flow logging a collected event reflecting a characteristic of the control flow; and

reporting the collected event to a server.

5. The method of claim 4 , wherein a potential size of the memory region is bounded by a code section boundary.

6. The method of claim 5 , wherein the validation code is part of an operating system.

7. A method useful for monitoring of an API/system call implemented by an application for generating disassembly of an application executable binary of the application, comprising the steps of:

scanning a computer system for an executable application;

scanning the computer system for a running process associated with the application executable binary;

initiating an application programming interface (API) call monitoring method that associates an observed API/system call with the application executable binary; and

reporting a set of collected events to a local server, and wherein the set of collected events are used to validate a disassembly trace and to identify and initiate a new disassembly trace,

wherein the observed API/system call is reported to a remote server,

wherein the observed API/system call is validated by matching a pointer type with the API/system call,

wherein the observed API/system call is used to validate the disassembly of an application executable binary, and

wherein the API/system call is monitored from the application, an emulator, or a hypervisor.

8. The method of claim 7 , wherein the API/system call is further validated by checking the consistency of a disassembled code with an argument used by the API/system call.