US 11,790,079 B2
Systems and methods for executable code detection, automatic feature extraction and position independent code detection
Shlomi Salem, Tel Aviv (IL); Roy Ronen, Raanana (IL); Assaf Nativ, Tel Aviv-Jaffa (IL); Amit Zohar, Tel Aviv-Jaffa (IL); Gal Braun, Ness Ziona (IL); Pavel Ferencz, Beer Sheva (IL); Eitan Shterenbaum, Kiryat-Ono (IL); and Tal Maimon, Rishon LeZiyon (IL)
Assigned to SENTINEL LABS ISRAEL LTD.
Filed by Sentinel Labs Israel Ltd., Tel Aviv (IL)
Filed on Dec. 27, 2022, as Appl. No. 18/89,038.
Application 18/089,038 is a continuation of application No. 17/448,327, filed on Sep. 21, 2021, granted, now 11,580,218.
Application 17/448,327 is a continuation of application No. 16/920,630, filed on Jul. 3, 2020, granted, now 11,210,392, issued on Dec. 28, 2021.
Application 16/920,630 is a continuation of application No. 16/879,625, filed on May 20, 2020, granted, now 10,762,200, issued on Sep. 1, 2020.
Claims priority of provisional application 62/854,118, filed on May 29, 2019.
Claims priority of provisional application 62/850,170, filed on May 20, 2019.
Claims priority of provisional application 62/850,182, filed on May 20, 2019.
Prior Publication US 2023/0146847 A1, May 11, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 21/56 (2013.01); G06F 21/54 (2013.01)
CPC G06F 21/54 (2013.01) [G06F 21/566 (2013.01); G06F 2221/033 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A system for code detection, the system comprising:
one or more computer readable storage devices configured to store a plurality of computer executable instructions; and
one or more hardware computer processors in communication with the one or more computer readable storage devices and configured to execute the plurality of computer executable instructions in order to cause the system to:
instrument an import address table (IAT) entry of a monitored symbol, the instrumenting of the TAT entry comprising:
replacing a monitored symbol address within the TAT entry of the monitored symbol with a modified address;
executing a first code upon a call of the modified address to detect and validate a call of the monitored symbol; and
redirecting the call of the modified address to the monitored symbol address;
instrument one or more functions, the instrumenting of the one or more functions comprising:
modifying the one or more functions to return values that lead to the code;
detouring execution of the monitored symbol to a second code to detect and validate a call of the monitored symbol; and
redirecting the call of the monitored symbol to the monitored symbol address;
monitor the first code and the second code of the monitored symbol to determine if calls from an executable comprise a static call, a dynamic call, or a local call, wherein determination of whether the calls from the executable comprise a local call comprises monitoring the second code to determine if a return address is located in the same executable as the monitored symbol; and
if the system determines that at least one call from the executable does not comprise a static call, dynamic call, or a local call, flag the executable as suspicious or malicious.