Patent ID: 8499352

Claim:
A computer-implemented method, comprising: identifying a number of call instructions in a binary executable; for each of the number of call instructions: executing the call instruction, wherein executing the call instruction causes a return address after the call instruction to be stored in a call stack; sequentially executing a plurality of instructions subsequent to a target of the call instruction; determining that an address identified by a stack pointer of the call stack is different from the return address; in response to the determination that the address identified by the stack pointer is different from the return address, determining if there is a non-obfuscation signal present; if there is a non-obfuscation signal present, identifying the call instruction as a non-obfuscated call instruction; if there is not a non-obfuscation signal present, identifying the call instruction as a possibly obfuscated call instruction; determining whether the call instructions identified as possibly obfuscated call instructions exceeds a threshold number; in response to the determination that the call instructions identified as possibly obfuscated call instructions exceeds the threshold number, identifying the binary executable as an obfuscated executable; and in response to the determination that the call instructions identified as possibly obfuscated call instructions do not exceed the threshold number, identifying the binary executable as a non-obfuscated executable.