Patent ID: 7421587
Filing Date: 2008-09-02
Classification: G06F

Abstract:
1. A computer program product in a computer storage medium comprising a computer program operable to control a computer to detect a known computer program within a packed computer file, said packed computer file being unpacked upon execution, said computer program comprising: resource data reading logic for reading resource data within said packed computer file, said resource data specifying program resource items used by said known computer program and readable by a computer operating system without dependence upon which unpacking algorithm is used by said packed computer file; and resource data comparing logic for generating characteristics of said resource data and for comparing said characteristics of said resource data with characteristics of known computer program resource data and for detecting a match with said known computer program indicative of said packed computer file containing said known computer program; wherein said resource data of said packed computer file is processed to generate fingerprint data and to compare said generated fingerprint data with known computer program fingerprint data; wherein said generated fingerprint data includes a number of program resource items specified within said resource data of said packed computer file; wherein said generated fingerprint data includes a flag indicating which data is included within said generated fingerprint data; wherein said generated fingerprint data includes a location within said resource data of said packed computer file of an entry specifying a program resource item having a largest size; wherein said generated fingerprint data includes a checksum value calculated in dependence upon: a number of said program resource items specified beneath each node within hierarchically arranged resource data of said packed computer file; string names associated with said program resource items within said resource data of said packed computer file; and sizes of said program resource items within said resource data of said packed computer file; wherein said checksum value is rotated between each item being added into said checksum.