ANALYSIS FUNCTION ADDITION METHOD, ANALYSIS FUNCTION ADDITION DEVICE, AND ANALYSIS FUNCTION ADDITION PROGRAM

WIPO Patent Application WO/2023/067663

A1

An analysis function addition device (10) comprises: a virtual machine analysis unit (121) that analyzes a VM of a script engine, and obtains a hook point, which is a point where an analysis code is to be inserted by hooking, and a VPC, which is a variable pointing to the next VM instruction to be executed; an instruction set architecture analysis unit (122) that analyzes an instruction set architecture, which is the instruction system of the VM, and thereby obtains a branch VM instruction, which is a VM instruction that causes branching; and a function addition unit (123) that, on the basis of the VPC and the branch VM instruction, which are architecture information obtained by analysis by the virtual machine analysis unit (121) and the instruction set architecture analysis unit (122), adds an analysis function by hooking that includes a processing of changing the destination to which a virtual stack pointer in memory points from the current destination to the return destination of the function immediately preceding the current destination, if an exception occurs at the hook point of the script engine.

USUI TOSHINORI (JP)
IKUSE TOMONORI (JP)
KAWAKOYA YUHEI (JP)
IWAMURA MAKOTO (JP)

PCT/JP2021/038492

April 27, 2023

October 18, 2021

Click for automatic bibliography generation  

NIPPON TELEGRAPH & TELEPHONE (JP)

G06F21/56

WO2021070393A1	2021-04-15
WO2020075335A1	2020-04-16

OYAMA YOSHIHIRO, HIROTAKA KOKUBO: "Dynamic Analysis Method for Exception Raising Malware", COMPUTER SECURITY SYMPOSIUM. 21 - 24 OCTOBER 2019, 14 October 2019 (2019-10-14), pages 953 - 960, XP093058985

SAKAI INTERNATIONAL PATENT OFFICE (JP)

View/Download PDF      PDF Help

Previous Patent: THERMOSETTING RESIN COMPOSITION, COVERLAY FILM, ADHESIVE SHEET, AND FLEXIBLE PRINTED CIRCUIT BOARD

Next Patent: NOVEL CRYSTAL FORM OF BENZOTHIOPHENE COMPOUND AND PRODUCTION METHOD THEREFOR