Abstract: A method is presented for analyzing an original software program as a potentially evasive malware. The method may comprise discovering at least one revealed instruction in the original software program, where the revealed instructions are not executed when the original software program is run without modification; modifying the original software program to create a modified program that will execute at least one revealed instruction when the modified program is run; and exploring the at least one revealed instruction by running the modified program.

Abstract: A hybrid static/dynamic binary rewrite method is presented, comprising: a one-time configuration step for instrumentation of an unmodified executable binary, invoking the executable binary by copying the unmodified executable binary into a system memory image and running the binary from the system memory image, and rewriting the system memory image by inserting at a safe location one or more new instructions in place of existing instructions, where the one or more new instructions transfer execution control to instrumentation instructions located elsewhere within the system memory image, and where the instrumentation instructions that were at least in part not contained in the unmodified executable binary.

Abstract: Binary rewriters that do not require relocation information and automatic parallelizers within binary rewriters are provided, as well as methods for performing binary rewriting and automatic parallelization. The method, in certain embodiments. includes disassembling a binary file and determining functions in the disassembled binary file. The method can further include rewriting the binary file without relying on relocation information or object files. Optionally, the method can further include performing automatic parallelization of the binary before rewriting the binary file.

Abstract: Binary rewriters that do not require relocation information and automatic parallelizers within binary rewriters are provided, as well as methods for performing binary rewriting and automatic parallelization. The method, in certain embodiments. includes disassembling a binary file and determining functions in the disassembled binary file. The method can further include rewriting the binary file without relying on relocation information or object files. Optionally, the method can further include performing automatic parallelization of the binary before rewriting the binary file.