专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US09032526B2 Emulating mixed-code programs using a virtual machine instance 有权
标题翻译：使用虚拟机实例模拟混合代码程序
公开(公告)号：US09032526B2
公开(公告)日：2015-05-12
申请号：US13106724
申请日：2011-05-12
申请人： Xun Wang , Adrian Emil Stepan , Timothy David Ebringer
发明人： Xun Wang , Adrian Emil Stepan , Timothy David Ebringer
IPC分类号： G06F11/00 , G06F21/56
CPC分类号： G06F9/455 , G06F21/566
摘要： The subject disclosure is directed towards a technology for efficiently emulating program code that is protected by one or more various code virtualization techniques to detect the presence of malware. An emulation engine emulates a program containing a mix of native code, custom (e.g., virtualized obfuscated) code, and at least one emulator and/or interpreter that understands the custom code, by building a custom emulation component that is built by detecting and analyzing the internal emulator or interpreter. The custom emulation component may access a translation table built from the analysis, and also may simplify a plurality of instructions in the program into a lesser number of instructions in an intermediate language used for emulation.
摘要翻译：主题公开涉及用于有效地模拟由一种或多种各种代码虚拟化技术保护以检测恶意软件的存在的程序代码的技术。仿真引擎模拟包含本地代码，自定义（例如，虚拟化模糊化）代码和至少一个理解自定义代码的模拟器和/或解释器的程序的程序，通过构建通过检测和分析构建的自定义仿真组件内部模拟器或解释器。自定义仿真组件可以访问从分析构建的翻译表，并且还可以将程序中的多个指令简化为用于仿真的中间语言的较少数量的指令。

2. 发明申请

US20120290848A1 Emulating Mixed-Code Programs Using a Virtual Machine Instance 有权
标题翻译：使用虚拟机实例模拟混合代码程序
公开(公告)号：US20120290848A1
公开(公告)日：2012-11-15
申请号：US13106724
申请日：2011-05-12
申请人： Xun Wang , Adrian Emil Stepan , Timothy David Ebringer
发明人： Xun Wang , Adrian Emil Stepan , Timothy David Ebringer
IPC分类号： G06F11/00 , G06F21/00 , G06F9/455
CPC分类号： G06F9/455 , G06F21/566
摘要： The subject disclosure is directed towards a technology for efficiently emulating program code that is protected by one or more various code virtualization techniques to detect the presence of malware. An emulation engine emulates a program containing a mix of native code, custom (e.g., virtualized obfuscated) code, and at least one emulator and/or interpreter that understands the custom code, by building a custom emulation component that is built by detecting and analyzing the internal emulator or interpreter. The custom emulation component may access a translation table built from the analysis, and also may simplify a plurality of instructions in the program into a lesser number of instructions in an intermediate language used for emulation.
摘要翻译：主题公开涉及用于有效地模拟由一种或多种各种代码虚拟化技术保护以检测恶意软件的存在的程序代码的技术。仿真引擎模拟包含本地代码，自定义（例如，虚拟化模糊化）代码和至少一个理解自定义代码的模拟器和/或解释器的程序的程序，通过构建通过检测和分析构建的自定义仿真组件内部模拟器或解释器。自定义仿真组件可以访问从分析构建的翻译表，并且还可以将程序中的多个指令简化为用于仿真的中间语言的较少数量的指令。

3. 发明授权

US07930563B2 Reliability platform configuration measurement, authentication, attestation and disclosure 有权
标题翻译：可靠性平台配置测量，认证，认证和披露
公开(公告)号：US07930563B2
公开(公告)日：2011-04-19
申请号：US12165908
申请日：2008-07-01
申请人： Timothy David Ebringer , Sachiko Yoshihama , Seiji Munetoh , Hiroshi Maruyama
发明人： Timothy David Ebringer , Sachiko Yoshihama , Seiji Munetoh , Hiroshi Maruyama
IPC分类号： G06F21/02 , G06F12/16 , G06F21/24
CPC分类号： G06F21/57 , G06F21/445 , G06F21/645 , G06F2221/2103 , G06F2221/2115 , G06F2221/2129 , G06F2221/2153
摘要： A platform configuration measurement device including: a configuration register; means for executing extension processing in which a predetermined operation is performed on a content of the configuration register by using a given additional value, a hash value is obtained by applying a predetermined hash function to a value obtained by the predetermined operation, and the hash value is set for a new content of the configuration register; and measurement extension means for obtaining measured values, corresponding to predetermined components constituting a platform, by sequentially making predetermined measurement on the predetermined components, and for allowing the means for executing extension processing to execute the extension processing using the measured values as the additional values, random extension means is provided for allowing the means for executing extension processing to execute the extension processing using a random value as the additional value.
摘要翻译：一种平台配置测量装置，包括：配置寄存器; 用于执行扩展处理的装置，其中通过使用给定的附加值对配置寄存器的内容执行预定操作，通过将预定散列函数应用于通过预定操作获得的值来获得散列值，并且散列值被设置为配置寄存器的新内容; 以及测量扩展装置，用于通过对预定的组件顺序地进行预定的测量来获得对应于构成平台的预定组件的测量值，并且允许用于执行扩展处理的装置使用测量值来执行扩展处理作为附加值，提供随机扩展装置，用于允许执行扩展处理的装置使用随机值作为附加值来执行扩展处理。

4. 发明申请

US20090070573A1 Reliability platform configuration measurement, authentication, attestation and disclosure 有权
标题翻译：可靠性平台配置测量，认证，认证和披露
公开(公告)号：US20090070573A1
公开(公告)日：2009-03-12
申请号：US12165908
申请日：2008-07-01
申请人： Timothy David Ebringer , Sachiko Yoshihama , Seiji Munetoh , Hiroshi Maruyama
发明人： Timothy David Ebringer , Sachiko Yoshihama , Seiji Munetoh , Hiroshi Maruyama
IPC分类号： G06F9/44 , G06F21/00
CPC分类号： G06F21/57 , G06F21/445 , G06F21/645 , G06F2221/2103 , G06F2221/2115 , G06F2221/2129 , G06F2221/2153
摘要： A platform configuration measurement device including: a configuration register; means for executing extension processing in which a predetermined operation is performed on a content of the configuration register by using a given additional value, a hash value is obtained by applying a predetermined hash function to a value obtained by the predetermined operation, and the hash value is set for a new content of the configuration register; and measurement extension means for obtaining measured values, corresponding to predetermined components constituting a platform, by sequentially making predetermined measurement on the predetermined components, and for allowing the means for executing extension processing to execute the extension processing using the measured values as the additional values, random extension means is provided for allowing the means for executing extension processing to execute the extension processing using a random value as the additional value.
摘要翻译：一种平台配置测量装置，包括：配置寄存器; 用于执行扩展处理的装置，其中通过使用给定的附加值对配置寄存器的内容执行预定操作，通过将预定散列函数应用于通过预定操作获得的值来获得散列值，并且散列值被设置为配置寄存器的新内容; 以及测量扩展装置，用于通过对预定的组件顺序地进行预定的测量来获得对应于构成平台的预定组件的测量值，并且允许用于执行扩展处理的装置使用测量值来执行扩展处理作为附加值，提供随机扩展装置，用于允许执行扩展处理的装置使用随机值作为附加值来执行扩展处理。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式