An Efficient Platform for the Automatic Extraction of Patterns in Native Code

Table 1

Example generalization of subpatterns.

	Example pattern		Generalization
Operand	mov 5,eax		mov  <literal>,<generic ax>
	mov [ecx],al		mov [ecx],<register>
	movsd xmm0,var_0		movsd xmm0,<var>
	mov edx,[ebp+var_1]		mov edx,[<var>]
	call func1493		call <address>
Mnemonic	movzx eax,al		<mov>  <generic ax>,<any>
	movss [esp+54h+var_2],xmm0		<mov> [esp+54h+var_2],xmm0
	movsd xmm0,var_3		<mov>  xmm0,<var>
	mov edx,[ebp+var_4]		<mov>  edx,[<var>]
	movsx ecx,[ebp+var_5]		<mov>  ecx,[<var>]
Instruction group	pop esi; mov esp,ebp; pop ebp; retn		<callee epilogue>
	mov esp,ebp; pop ebp; retn		<callee epilogue>
	pop ebp; retn		<callee epilogue>
	call func123; add esp,8		<caller epilogue>
	call func123		<caller epilogue>