Abstract: Methods and systems for preventing an application which has been maliciously or inadvertently tampered with from causing harm to a computer system are described. Application code of the tampered application is inputted into a code analyzer. The code is analyzed and functions within the application code are identified and examined. A profile is created and may be a description of how a function is intended to operate, that is, the function's expected behavior. Calls between functions are examined and a called function is replaced with a replacement function, such that a call to an original function results in a call to the replacement function. The original function is unaware that it is not getting function calls or that such calls are being directed to a replacement function or stub. A replacement function contains code to ensure that the user space maintains its original appearance.

Abstract: Methods, systems, and apparatus, including computer program products, for processing input data and for defining processing operations to be performed on such data. Input data is processed according to a data parser description associated with the input data format, and output data is generated based on the processing. The data parser description includes a plurality of leaf nodes and a plurality of branch nodes arranged in a tree structure. The leaf nodes each have an associated function. Each of the branch nodes has one or more associated child nodes selected from leaf nodes and other branch nodes. The nodes of the data parser description are evaluated in an order defined by the tree structure. For branch nodes, one or more of the associated child nodes are evaluated; for leaf nodes, the associated function is executed based on data in a current location in the input data.

Abstract: Methods and systems for preventing an application which has been maliciously or inadvertently tampered with from causing harm to a computer system are described. Application code of the tampered application is inputted into a code analyzer. The code is analyzed and functions within the application code are identified and examined. Multiple profiles are created and each identified function is assigned a profile. A profile may be a description of how a function is intended to operate, that is, the function's expected behavior. Multiple replacement functions are created using a first set of functions, where each function is called by the identified functions and a second set of functions where each function in the second set calls the identified function. Calls between functions are examined and a called function is replaced with a replacement function, such that a call to an original function results in a call to the replacement function.

Abstract: Methods, systems, and apparatus, including computer program products, for processing input data and for defining processing operations to be performed on such data. Input data is processed according to a data parser description associated with the input data format, and output data is generated based on the processing. The data parser description includes a plurality of leaf nodes and a plurality of branch nodes arranged in a tree structure. The leaf nodes each have an associated function. Each of the branch nodes has one or more associated child nodes selected from leaf nodes and other branch nodes. The nodes of the data parser description are evaluated in an order defined by the tree structure. For branch nodes, one or more of the associated child nodes are evaluated; for leaf nodes, the associated function is executed based on data in a current location in the input data.