Patent US5765030A successfully refreshed from Google Patents.
US5765030A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Processor emulator module having a variable pre-fetch queue size for program execution
Assignee: Gen Digital Inc
•
Filing: 1996-07-19
•
Granted: 1998-06-09
•
Expires: 2016-07-19
Abstract
Abstract An emulation module (110) includes a pre-fetch queue (116) having an adjustable size (126) to eliminate any dependence of virus decryption routines on the size of the pre-fetch queue (116) when emulating executable files to test for the presence of virus infections. An executable file is tested by setting (210, 258) the size of the emulator's pre-fetch queue (116) and emulating (220) the file under the guidance of an emulation control module (130). Emulated instructions are monitored and a flag is set (230) when any instructions are modified (224) after being copied to the pre-fetch queue and subsequently executed (228). Emulation continues until the emulation control module (130) indicates (230) that the file should be scanned for virus signatures. If no virus signatures are detected (234) and the flag is set (244), the size of the pre-fetch queue is reduced (258) and the process is repeated. An executable file is declared virus-free (250) if the file is emulated (220) without setting the flag (230) and no virus signatures are detected (234). The executable file is declared virus-infected (240) when virus signatures are detected (234), independent of whether the flag is set (230). For Intel processors, pre-fetch queue sizes of 32, 16, 8, and zero bytes may be emulated.
Inventors
- 👤 Carey S. Nachenberg
- 👤 Kevin R. Marcus
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-03 17:30
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/50; G06F21/55; G06F21/56; G06F21/562; G06F21/564; G06F21/566
Claims Analysis
Total Claims: 15
Claim 1
Independent Claim
120 words
A computer-implemented method for emulating a computer file in a processor emulator having a selectable pre-fetch queue size, to detect a computer virus, the method comprising the steps of: selecting a pre-fetch queue size for the emulator; emulating instructions of the computer file; setting a first flag when an emulated instruction modifies another instruction within the selected pre-fetch queue size and the modified instruction is executed; scanning the emulated computer file for a virus signature; reducing the pre-fetch queue size and repeating the emulating, setting, and scanning steps when the first flag is set and no virus signature is found; and indicating a virus is not present when the first flag is not set and no virus signature is found.
Claim 2
Dependent Claim
120 words
A computer-implemented method for emulating a computer file in a processor emulator having a selectable pre-fetch queue size, to detect a computer virus, the method comprising the steps of: selecting a pre-fetch queue size for the emulator; emulating instructions of the computer file; setting a first flag when an emulated instruction modifies another instruction within the selected pre-fetch queue size and the modified instruction is executed; scanning the emulated computer file for a virus signature; reducing the pre-fetch queue size and repeating the emulating, setting, and scanning steps when the first flag is set and no virus signature is found; and indicating a virus is not present when the first flag is not set and no virus signature is found.
Claim 3
Dependent Claim
47 words
The method of claim 1, wherein the selecting step comprises the substeps of: identifying a plurality of pre-fetch queue sizes supported by versions of the processor being emulated; and selecting a largest of the plurality of pre-fetch queue sizes as the pre-fetch queue size for the emulator.
Claim 4
Dependent Claim
35 words
The method of claim 2, wherein the step of reducing the pre-fetch queue size comprises reducing the pre-fetch queue size to a next largest pre-fetch queue size of the plurality of supported pre-fetch queue sizes.
Claim 5
Dependent Claim
27 words
The method of claim 1, comprising the additional step of indicating a virus is present when the first flag is set and a virus signature is found.
Claim 6
Dependent Claim
29 words
The method of claim 1, comprising the additional step of indicating a virus is not present when the first flag is not set and no virus signature is found.
Claim 7
Dependent Claim
121 words
A computer-implemented method for detecting a virus in a computer file using a processor emulator having a pre-fetch queue characterized by a queue size, the method comprising the steps of: emulating instructions of the computer file; setting a first flag when an emulated instruction modifies another instruction in the pre-fetch queue and the modified instruction is subsequently emulated; scanning the emulated computer file for a virus signature; indicating a virus is detected if the virus signature is found; indicating no virus is detected if no virus signature is found and the flag is not set; and; decrementing the pre-fetch queue size and repeating the emulating, setting, and scanning steps when the first flag is set and no virus signature is found.
Claim 8
Dependent Claim
121 words
A computer-implemented method for detecting a virus in a computer file using a processor emulator having a pre-fetch queue characterized by a queue size, the method comprising the steps of: emulating instructions of the computer file; setting a first flag when an emulated instruction modifies another instruction in the pre-fetch queue and the modified instruction is subsequently emulated; scanning the emulated computer file for a virus signature; indicating a virus is detected if the virus signature is found; indicating no virus is detected if no virus signature is found and the flag is not set; and; decrementing the pre-fetch queue size and repeating the emulating, setting, and scanning steps when the first flag is set and no virus signature is found.
Claim 9
Dependent Claim
34 words
The method of claim 6, comprising the additional step of setting the pre-fetch queue size to a largest pre-fetch queue size supported by versions of the processor being emulated prior to the emulating step.
Claim 10
Dependent Claim
54 words
The method of claim 7, wherein the decrementing step comprises the substeps of: determining a plurality of pre-fetch queue sizes supported by versions of a processor being emulated; and adjusting the pre-fetch queue size of the emulator to a next largest supported pre-fetch queue size relative to the pre-fetch queue size currently being emulated.
Claim 11
Dependent Claim
59 words
The method of claim 6, wherein the step of setting a first flag comprises the substeps of: comparing the size of the pre-fetch queue with a spacing between the modifying instruction and the modified instruction; setting the first flag if the spacing is no larger than the size of the pre-fetch queue and the modified instruction is subsequently emulated.
Claim 12
Dependent Claim
134 words
A processor emulation module for emulating executable computer files running on versions of a processor having different size pre-fetch queues, the emulation module comprising: a pre-fetch queue module for receiving a plurality of instructions from the executable computer file, the pre-fetch queue module having an adjustable size; a decoder module coupled to the pre-fetch queue module for identifying an instruction received from the pre-fetch queue module; an execution module coupled to the decoder module and including a plurality of instruction routines corresponding to instructions supported by the processor versions, the instruction routines being activated when the corresponding instruction is identified by the decoder module; and a plurality of register modules coupled to the plurality of instruction routines for tracking a state of the emulated processor version according to instructions emulated by the execution module.
Claim 13
Dependent Claim
134 words
A processor emulation module for emulating executable computer files running on versions of a processor having different size pre-fetch queues, the emulation module comprising: a pre-fetch queue module for receiving a plurality of instructions from the executable computer file, the pre-fetch queue module having an adjustable size; a decoder module coupled to the pre-fetch queue module for identifying an instruction received from the pre-fetch queue module; an execution module coupled to the decoder module and including a plurality of instruction routines corresponding to instructions supported by the processor versions, the instruction routines being activated when the corresponding instruction is identified by the decoder module; and a plurality of register modules coupled to the plurality of instruction routines for tracking a state of the emulated processor version according to instructions emulated by the execution module.
Claim 14
Dependent Claim
129 words
A computer-readable storage medium on which is stored data for simulating versions of a processor as a processor emulator having different pre-fetch queue sizes, the data being suitable for implementation by a processor to perform the steps of: selecting a pre-fetch queue size for the emulator; emulating instructions of the computer file; setting a first flag when an emulated instruction modifies another instruction within the selected pre-fetch queue size and the modified instruction is executed; scanning the emulated computer file for a virus signature; reducing the pre-fetch queue size and repeating the emulating, setting, and scanning steps when the first flag is set and no virus signature is found; and indicating a virus is not present when the first flag is not set and no virus signature is found.
Claim 15
Dependent Claim
129 words
A computer-readable storage medium on which is stored data for simulating versions of a processor as a processor emulator having different pre-fetch queue sizes, the data being suitable for implementation by a processor to perform the steps of: selecting a pre-fetch queue size for the emulator; emulating instructions of the computer file; setting a first flag when an emulated instruction modifies another instruction within the selected pre-fetch queue size and the modified instruction is executed; scanning the emulated computer file for a virus signature; reducing the pre-fetch queue size and repeating the emulating, setting, and scanning steps when the first flag is set and no virus signature is found; and indicating a virus is not present when the first flag is not set and no virus signature is found.
References Cited (Backward Citations)
EP0063977A1
Cited
US5321840A
Cited
US5144660A
Cited
US4975950A
Cited
US5121345A
Cited
US5319776A
Cited
US5349655A
Cited
US5408642A
Cited
US5421006A
Cited
US5359659A
Cited
US5440723A
Cited
EP0636977A2
Cited
US5398196A
Cited
US5442699A
Cited
US5485575A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2001-06-08 | 2001-12-08 | 2002-06-09 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2005-06-08 | 2005-12-08 | 2006-06-09 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2009-06-08 | 2009-12-08 | 2010-06-09 | $7700.00 | Window Closed / Lapsed |