US Patent 8151352 Anti-malware emulation systems and methods

In some embodiments, antivirus/malware behavior-based scanning (emulation) is accelerated by identifying known code sequences and executing pre-stored native-code routines (e.g. decompression, decryption, checksum routines) implementing the functionality of the known code sequences before returning to the emulation. During emulation, target machine code instructions are compared to a set of known signatures. If a known code sequence is identified, the emulator calls a native code routine and caches the current instruction address. If the emulator subsequently reaches a cached address, a native code routine may be called without scanning the data at the address for known signatures. Signature scanning may be performed selectively for instructions following code flow changes (e.g. after jump, call or interrupt instructions). The emulator may also call native-code routines implementing virtual operating system calls, and native-code unpacked file reconstruction routines that reconstruct unpacked files from the contents of virtual memory for scanning by a content-based malware scanner.