Patent ID: 9208314
Filing Date: 2015-12-08
Classification: G06F

Abstract:
1. A computer-implemented method for distinguishing code of a program obfuscated within a packed program, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: retrieving memory of the packed program, wherein the memory of the packed program comprises at least: identifying a first import address table and a second import address table within the memory of the packed program; determining, based at least in part on a comparison between at least one characteristic of the first import address table and at least one characteristic of the second import address table, that the first import address table is an import address table of the code of the obfuscated program; determining that a region of code within the memory of the packed program comprises the code of the obfuscated program by determining that the region of code uses the first import address table; performing a security operation on the region of code.