Patent ID: 9740864
Date: 2017-08-22
CPC Classifications: G06F,H04L

Claim:
1. A method for emulating a file on a computer system, the method comprising: loading the file into an emulator of the computer system; initiating emulation of the file by the emulator; storing a first image of an initial state of the emulator in a tree data structure; continuing the emulation of the file and detecting an occurrence of a condition that results during the emulation of the file; creating and storing a second image of a second state of the emulator in the tree data structure when the occurrence of the condition is detected; determining that the emulation of the file has terminated correctly in response to at least detecting a harmful behavior of the file during the emulation; determining that the emulation of the file has terminated incorrectly in response to detecting an occurrence of an anti-emulation trick; and upon determining that the emulation of the file has terminated incorrectly,