Detecting program evasion of virtual machines or emulators

Patent metadata

Field	Value
Publication number	US-9984231-B2
Application number	US-201514937949-A
Country	US
Kind code	B2
Filing date	Nov 11, 2015
Priority date	Nov 11, 2015
Publication date	May 29, 2018
Grant date	May 29, 2018

Abstract

Various embodiments include methods implemented on a computing device for analyzing a program executing within a virtual environment on the computing device. The methods may include determining whether the program is attempting to detect whether it is being executed within the virtual environment, and analyzing the program within a protected mode of the computing device in response to determining that the program is attempting to detect whether it is being executed within the virtual environment.

First claim

What is claimed is:

1. A method for analyzing a program executing within a virtual environment on a computing device, comprising:
determining whether the program is attempting to detect whether the program is being executed within the virtual environment; and
in response to determining that the program is attempting to detect whether the program is being executed within the virtual environment:
terminating the program during execution within the virtual environment;
re-executing the program in a protected mode of the computing device; and

analyzing the program within the protected mode of the computing device.

2. The method of claim 1 , wherein the protected mode is a system management mode.

3. The method of claim 1 , further comprising continuing analysis of the program within the virtual environment in response to determining that the program is not attempting to detect whether the program is being executed within the virtual environment.

4. The method of claim 1 , wherein determining whether the program is attempting to detect whether the program is being executed within the virtual environment comprises:
monitoring access of the program to application programming interface (API) properties of the virtual environment.

5. The method of claim 4 , wherein the API properties include at least one member selected from the group consisting of a model specific register, a length of an instruction, a store interrupt descriptor table register, a debugger function, and an instruction for host-guest communication.

6. The method of claim 1 , wherein the virtual environment comprises a virtual machine or an emulator.

7. A computing device, comprising:
a hardware processor configured with processor-executable instructions to:
determine whether a program executing within a virtual environment on the computing device is attempting to detect whether the program is being executed within the virtual environment; and

in response to determining that the program is attempting to detect whether the program is being executed within the virtual environment:
terminate the program during execution within the virtual environment;
re-execute the program in a protected mode of the computing device; and
analyze the program within the protected mode of the computing device.

8. The computing device of claim 7 , wherein the protected mode is a system management mode.

9. The computing device of claim 7 , wherein the hardware processor is further configured with processor-executable instructions to continue analysis of the program within the virtual environment in response to determining that the program is not attempting to detect whether the program is being executed within the virtual environment.

10. The computing device of claim 7 , wherein the hardware processor is configured with processor-executable instructions to determine whether the program is attempting to detect whether the program is being executed within the virtual environment by:
monitoring access of the program to application programming interface (API) properties of the virtual environment.

11. The computing device of claim 10 , wherein the API properties include at least one member selected from the group consisting of a model specific register, a length of an instruction, a store interrupt descriptor table register, a debugger function, and an instruction for host-guest communication.

12. The computing device of claim 7 , wherein the virtual environment comprises a virtual machine or an emulator.

13. A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a processor of a computing device to perform operations comprising:
determining whether a program executing within a virtual environment on the computing device is attempting to detect whether the program is being executed within the virtual environment; and
in response to determining that the program is attempting to detect whether the program is being executed within the virtual environment:
terminating the program during execution within the virtual environment;
re-executing the program in a protected mode of the computing device; and
analyzing the program within the protected mode of the computing device.

14. The non-transitory computer readable storage medium of claim 13 , wherein the protected mode is a system management mode.

15. The non-transitory computer readable storage medium of claim 13 , wherein the stored processor-executable software instructions are configured to cause the processor to perform operations further comprising continuing analysis of the program within the virtual environment in response to determining that the program is not attempting to detect whether the program is being executed within the virtual environment.

16. The non-transitory computer readable storage medium of claim 13 , wherein the stored processor-executable software instructions are further configured to cause the processor to perform operations such that determining whether the program is attempting to detect whether the program is being executed within the virtual environment comprises:
monitoring access of the program to application programming interface (API) properties of the virtual environment.

17. The non-transitory computer readable storage medium of claim 16 , wherein the API properties include at least one member selected from the group consisting of a model specific register, a length of an instruction, a store interrupt descriptor table register, a debugger function, and an instruction for host-guest communication.

18. The non-transitory computer readable storage medium of claim 13 , wherein the virtual environment comprises a virtual machine or an emulator.

19. A computing device, comprising:
means for determining whether a program executing within a virtual environment on the computing device is attempting to detect whether the program is being executed within the virtual environment;
means for terminating the program during execution within the virtual environment in response to determining that the program is attempting to detect whether the program is being executed within the virtual environment;
means for re-executing the program in a protected mode of the computing device in response to determining that the program is attempting to detect whether the program is being executed within the virtual environment; and
means for analyzing the program within the protected mode of the computing device in response to determining that the program is attempting to detect whether the program is being executed within the virtual environment.

20. The computing device of claim 19 , wherein the protected mode is a system management mode.

21. The computing device of claim 19 , further comprising means for continuing analysis of the program within the virtual environment in response to determining that the program is not attempting to detect whether the program is being executed within the virtual environment.

22. The computing device of claim 19 , wherein the means for determining whether the program is attempting to detect whether the program is being executed within the virtual environment comprises:
means for monitoring access of the program to application programming interface (API) properties of the virtual environment.

23. The computing device of claim 22 , wherein the API properties include at least one member selected from the group consisting of a model

Assignees

• Qualcomm Inc

Inventors

• Salajegheh Mastooreh
• Gupta Rajarshi
• Islam Nayeem

Classifications

• G06F2221/2105

  Dual mode as a secondary aspect · CPC title

• G06F21/53 Primary

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title