US 12,361,131 B2
Unpacking software via auto-unpacker interception
Vladimir Tokarev, Herzelia (IL); Yuval Gordon, Givataiym (IL); and Gil Regev, Yehud (IL)
Assigned to MICROSOFT TECHNOLOGY LICENSING, LLC, Redmond, WA (US)
Filed by Microsoft Technology Licensing, LLC, Redmond, WA (US)
Filed on May 24, 2023, as Appl. No. 18/323,100.
Prior Publication US 2024/0394369 A1, Nov. 28, 2024
Int. Cl. G06F 21/56 (2013.01); G06F 9/50 (2006.01); G06F 21/55 (2013.01)
CPC G06F 21/566 (2013.01) [G06F 9/5016 (2013.01); G06F 21/554 (2013.01); G06F 2221/034 (2013.01)] 20 Claims
OG exemplary drawing
 
1. An unpacking method performed by a computing system, the unpacking method comprising:
prior to a target process receiving control, executing a process loader hook on a process loader routine, the process loader routine configured to allocate memory for the target process prior to an execution period of the target process, the process loader hook executing comprising saving a map of memory which is allocated to the target process; and
during the execution period of the target process, performing at least one of the following:
detecting an additional allocation attempt of a memory portion to the target process and saving a description of the memory portion,
recognizing a change attempt in an execution permission of a memory portion that is allocated to the target process and saving a description of the memory portion, or
ascertaining that the target process is attempting to overwrite a memory portion that was allocated to the target process before the execution period of the target process and saving a description of the memory portion.