Patent ID: 8533836

Claim:
In a computer system, the computer system including a microprocessor and system memory, a method for identifying execution behavior for a portion of binary code, the method comprising: an act of accessing a portion of assembly code via the microprocessor, the portion of assembly code disassembled from the portion of binary code, the portion of assembly code including assembly language instructions from an assembly language instruction set; an act of converting the portion of assembly code into an intermediate representation, the intermediate representation including intermediate representation instructions from an intermediate representation instruction set, converting the portion of assembly code including: an act of analyzing the portion of the assembly code to identify a location where the portion of the assembly code calls an operating system function; an act of demarking each transition between user functions and operating system functions based on the identified locations; and an act of mapping each assembly language instruction to a corresponding ordered list of one or more intermediate representation instructions so as to reduce the complexity of analyzing the behavior of the portion of binary code, wherein the act of mapping assembly language instructions to corresponding intermediate representation instructions comprises: an act of mapping the assembly language instructions of the user functions to intermediate representation instructions; and an act of ignoring the operating system function; an act of tracking the path of one or more parameters within functions of the intermediate representation to identify one or more of: parameter values and parameter types used to call functions of interest within the portion of binary code; and an act of outputting one or more of: functions, parameter values, and parameter types of interest for the portion of binary code.