Identifying vulnerabilities in binary files using a code signature

Patent metadata

Field	Value
Publication number	US-12579282-B2
Application number	US-202418590661-A
Country	US
Kind code	B2
Filing date	Feb 28, 2024
Priority date	Feb 28, 2024
Publication date	Mar 17, 2026
Grant date	Mar 17, 2026

Abstract

Techniques for identifying vulnerabilities in binary files using a code signature are disclosed. In some embodiments, a system, a process, and/or a computer program product for identifying vulnerabilities in binary files using a code signature includes collecting a plurality of binary files associated with a vulnerability (e.g., a known vulnerability); determining a function in the plurality of binary files that includes the vulnerability; and automatically generating a code signature (e.g., including wildcarding one or more instructions of the function) for detecting the vulnerability in the plurality of binary files.

First claim

What is claimed is:

1 . A system, comprising:
a processor configured to:
collect a plurality of binary files associated with a vulnerability;
determine a function in at least one binary file of the plurality of binary files that includes the vulnerability, comprising to determine function information associated with the function, wherein the function information includes at least one of the following: a function name and/or a function address;
determine a location of a function boundary of the function based on the function information, comprising to:
A) in the event that the function information includes the function name:
search the function name in a symbol table to obtain search results; and
disassemble the at least one binary file to determine the location of the function boundary based on the search results; and/or

B) in the event that the function information includes the function address, disassemble the at least one binary file starting from the function address to determine the location of the function boundary in the at least one binary file; and
automatically generate, based on the location of the function boundary, a code signature for detecting the vulnerability in the plurality of binary files; and
a memory coupled to the processor and configured to provide the processor with instructions.

2 . The system of claim 1 , wherein the code signature is a pattern-based rule.

3 . The system of claim 1 , wherein the code signature is a Yet Another Recursive Acronym (YARA).

4 . The system of claim 1 , wherein generating the code signature for detecting the vulnerability in the plurality of binary files includes wildcarding one or more instructions of the function.

5 . The system of claim 1 , wherein the code signature is validated.

6 . The system of claim 1 , wherein the processor is further configured to:
apply the code signature using a security solution for detecting the vulnerability.

7 . The system of claim 1 , wherein the processor is further configured to:
apply the code signature using a security solution for detecting the vulnerability; and perform an action in response to a match with another binary file with the code signature based on a security policy.

8 . A method, comprising:
collecting a plurality of binary files associated with a vulnerability; determining a function in at least one binary file of the plurality of binary files that includes the vulnerability, comprising to determine function information associated with the function, wherein the function information includes at least one of the following: a function name and/or a function address; determining a location of a function boundary of the function based on the function information, comprising: A) in the event that the function information includes the function name:
searching the function name in a symbol table to obtain search results; and
disassembling the at least one binary file to determine the location of the function boundary based on the search results; and/or
B) in the event that the function information includes the function address, disassembling the at least one binary file starting from the function address to determine the location of the function boundary in the at least one binary file; and automatically generating, based on the location of the function boundary, a code signature for detecting the vulnerability in the plurality of binary files.

9 . The method of claim 8 , wherein the code signature is a pattern-based rule.

10 . The method of claim 8 , wherein the code signature is a Yet Another Recursive Acronym (YARA).

11 . The method of claim 8 , wherein generating the code signature for detecting the vulnerability in the plurality of binary files includes wildcarding one or more instructions of the function.

12 . The method of claim 8 , wherein the code signature is validated.

13 . The method of claim 8 , further comprising:
applying the code signature using a security solution for detecting the vulnerability.

14 . The method of claim 8 , further comprising:
applying the code signature using a security solution for detecting the vulnerability; and performing an action in response to a match with another binary file with the code signature based on a security policy.

15 . A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
collecting a plurality of binary files associated with a vulnerability; determining a function in at least one binary file of the plurality of binary files that includes the vulnerability, comprising to determine function information associated with the function, wherein the function information includes at least one of the following: a function name and/or a function address; determining a location of a function boundary of the function based on the function information, comprising: A) in the event that the function information includes the function name:
searching the function name in a symbol table to obtain search results; and
disassembling the at least one binary file to determine the location of the function boundary based on the search results; and/or
B) in the event that the function information includes the function address, disassembling the at least one binary file starting from the function address to determine the location of the function boundary in the at least one binary file; and
automatically generating, based on the location of the function boundary, a code signature for detecting the vulnerability in the plurality of binary files.

16 . The computer program product of claim 15 , wherein the code signature is a pattern-based rule.

17 . The computer program product of claim 15 , wherein the code signature is a Yet Another Recursive Acronym (YARA).

18 . The computer program product of claim 15 , wherein the code signature is validated.

19 . The computer program product of claim 15 , further comprising computer instructions for:
applying the code signature using a security solution for detecting the vulnerability.

20 . The computer program product of claim 15 , further comprising computer instructions for:
applying the code signature using a security solution for detecting the vulnerability; and performing an action in response to a match with another binary file with the code signature based on a security policy.

Assignees

• Palo Alto Networks Inc

Inventors

• Ji Yang
• Zeng Dongrui
• Hu Wenjun

Classifications

• G06F21/564

  by virus signature recognition · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F21/56 Primary

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title