Patent ID: 9361173
Filing Date: 2016-06-07
CPC Classification: G06F

Claim Text:
1. A computer implemented method comprising: setting, by a computing device, a debugging breakpoint at an original entry point address of a packed portable executable file, wherein the original entry point includes a first instruction of executable code before the packed portable executable file was protected; executing, by the computing device, a debugging process for the packed portable executable file to obtain a debugged portable executable file in memory; collecting, by the computing device, one or more of import address table data and relocation table data during execution of the debugging process for the packed portable executable file by setting one or more debugging breakpoints associated with a LoadLibrary call, a GetModuleHandle call, and each of a plurality of GetProcAddress calls; adding a new section to the debugged portable executable file; pasting into the debugged portable executable file in the new section one or more of an import address table of the import table data and a relocation table of the relocation table data collected during execution of the debugging process for the packed portable executable file; copying, by the computing device, the debugged portable executable file in memory to a storage medium; and terminating, by the computing device, the debugging process at the original entry point.